What a good purchase approval workflow does
Before any numbers, four principles that hold for almost every mid-size company:
- Approval happens on the request, not on the invoice. Once the order is placed, the money is effectively spent. Approving the bill afterwards is a formality.
- Authority follows the budget. The person who owns a budget approves spending from it. Finance approves above a level of risk, not every coffee order.
- The rule is written once and applied by the system. Nobody should have to decide who to ask. The request routes itself.
- The number of approvers grows with risk, not with habit. Every extra step adds delay. Add one only when it adds a real check.
Step 1: set the amount thresholds
Start with amount tiers. Most mid-size companies need three or four. A starting point for a company of 100 to 500 people:
| Tier | Amount per request | Approvers |
|---|---|---|
| 1 | Up to $1,000 | Budget owner, or no request if bought on a company card within policy |
| 2 | $1,000 to $10,000 | Budget owner |
| 3 | $10,000 to $50,000 | Budget owner, then controller or finance manager |
| 4 | Above $50,000 | Budget owner, controller, then CFO (and CEO above a board-set limit) |
How to pick your own numbers: export last year's supplier spend and sort the transactions by amount. Typically a small share of purchases makes up most of the value. Put the upper thresholds where the big-value purchases start, so finance sees those, and let the long tail of small purchases through with one approval. The goal is for the controller to review a manageable number of requests a week that together cover most of the money.
Three details that often get missed:
- Amount means the total commitment, not the monthly payment. A 12 month contract at $3,000 a month is a $36,000 request.
- Splitting is blocked by rule. Two $9,000 requests to the same supplier in the same week are treated as one $18,000 request, or at least flagged.
- Changes re-route. If a PO grows after approval beyond a set margin (say 10 percent or $500), it goes back for approval.
Step 2: add department and category rules
Amount alone does not capture every risk. Layer a few rules on top:
- Department. Each department routes to its own budget owner. Marketing requests go to the head of marketing, warehouse requests to the operations director.
- Category. Some purchases need a specialist whatever the amount. IT hardware and software go to the IT lead for security and compatibility. Anything involving personal data goes to whoever owns privacy. Legal services go to the general counsel or the CFO.
- New suppliers. A request to a supplier not yet in the supplier directory adds a finance step to collect the W-9, check insurance where relevant and verify bank details.
- Projects and capital expenditure. Requests coded to a capital project route to the project owner, and above a capitalization threshold to finance for asset treatment.
- Contracts beyond a term. Commitments over 12 months or with automatic renewal add a review, even if the monthly amount is small.
Keep the rule count low. A company that needs more than a dozen conditions usually has an org chart problem, not an approval problem.
Step 3: write it down as an approval matrix
An approval matrix (sometimes called a delegation of authority table) is the single document that shows who can approve what. It is what the auditor asks for, and what your system should implement exactly. Here is a worked example for a company of about 250 people with five departments:
| Department | Up to $1,000 | $1,000 to $10,000 | $10,000 to $50,000 | Above $50,000 |
|---|---|---|---|---|
| Operations | Ops manager | Ops director | Ops director + Controller | Ops director + Controller + CFO |
| IT | IT lead | IT lead | IT lead + Controller | IT lead + Controller + CFO |
| Marketing | Marketing manager | Head of marketing | Head of marketing + Controller | Head of marketing + Controller + CFO |
| Facilities | Office manager | Facilities lead | Facilities lead + Controller | Facilities lead + Controller + CFO |
| Sales | Sales ops manager | VP sales | VP sales + Controller | VP sales + Controller + CFO |
- Operations
- Up to $1,000Ops manager$1,000 to $10,000Ops director$10,000 to $50,000Ops director + ControllerAbove $50,000Ops director + Controller + CFO
- IT
- Up to $1,000IT lead$1,000 to $10,000IT lead$10,000 to $50,000IT lead + ControllerAbove $50,000IT lead + Controller + CFO
- Marketing
- Up to $1,000Marketing manager$1,000 to $10,000Head of marketing$10,000 to $50,000Head of marketing + ControllerAbove $50,000Head of marketing + Controller + CFO
- Facilities
- Up to $1,000Office manager$1,000 to $10,000Facilities lead$10,000 to $50,000Facilities lead + ControllerAbove $50,000Facilities lead + Controller + CFO
- Sales
- Up to $1,000Sales ops manager$1,000 to $10,000VP sales$10,000 to $50,000VP sales + ControllerAbove $50,000VP sales + Controller + CFO
Category overlays apply on top of this table:
| Condition | Extra approver | Applies from |
|---|---|---|
| IT hardware or software (any department) | IT lead | Any amount |
| New supplier | Accounts payable lead | Any amount |
| Contract term over 12 months | Controller | Any amount |
| Capital expenditure | Financial analyst | $5,000 |
- IT hardware or software (any department)
- Extra approverIT leadApplies fromAny amount
- New supplier
- Extra approverAccounts payable leadApplies fromAny amount
- Contract term over 12 months
- Extra approverControllerApplies fromAny amount
- Capital expenditure
- Extra approverFinancial analystApplies from$5,000
Name roles, not people, in the matrix. When the head of marketing changes, you update one role assignment rather than every rule. Also define delegates: who approves when the named person is on vacation, and for how long.
Step 4: build in segregation of duties
The matrix controls who approves a purchase. Segregation of duties controls who can do more than one step of the same transaction. The minimum for a mid-size company:
- A requester cannot approve their own request, even if they are the budget owner. It routes to their manager or to the next level.
- The person who approves a purchase does not approve the resulting invoice for payment.
- The person who can edit supplier bank details cannot release payments.
- The person who records a receipt is not the one who ordered, for goods of meaningful value.
Small finance teams cannot always separate everything. Where they cannot, a review after the fact (for instance, the CFO reviewing a weekly list of payments above $10,000) is the usual compensating control.
Step 5: keep it fast
A slow approval workflow fails quietly. People stop raising requests and buy on cards, or place the order and raise the request afterwards. A few things keep approvals quick:
- Approve where people already are. An approval request in email or Slack with the key facts (amount, supplier, budget remaining, attachment) gets answered in minutes.
- Show the budget on the request. An approver who sees that the department has $14,000 left in the quarter does not need to ask finance.
- Set reminders and escalation. A request unanswered for 24 hours sends a reminder; after 48 hours it escalates to the delegate.
- Run steps in parallel where order does not matter. The IT lead and the controller can review at the same time.
- Measure it. Track the median time from request to approval by approver. The outliers are usually one or two people, and a conversation fixes it.
A worked example: one request through the matrix
A warehouse supervisor requests three rugged tablets and a mounting kit for the loading dock from a supplier not yet in the directory. The total is $4,650. It is coded to Operations.
- Amount tier: $1,000 to $10,000, so the Ops director approves.
- Category overlay: IT hardware, so the IT lead also approves. Both run in parallel.
- New supplier: the AP lead collects the W-9 and verifies bank details before the PO is sent.
- Budget: Operations has $11,300 left this quarter after open commitments, shown on the request.
Approvals come back the same afternoon, the supplier is set up, and the PO goes out the next morning. The $4,650 now appears as a commitment in the Operations budget, which drops to $6,650 available.
Rolling it out without a revolt
- Start with the matrix on one page, agreed with department heads. They approve it before the system does.
- Launch with a threshold high enough that most small purchases are untouched, then lower it once the process is trusted.
- Tell suppliers that invoices must carry a PO number, and give AP the authority to return those that do not.
- Review the rules after one quarter: which steps never reject anything (candidates to remove), which approvers are slow, which categories slip through.
For where approval sits in the wider cycle, read the procure to pay process, step by step, and for the document that approval produces, see purchase requisition vs purchase order.