Approval matrix: how to set purchasing limits people don’t work around

Three purchase orders to the same parts supplier on three consecutive days: $2,380, $2,290 and $1,950. Each is under the site manager's $2,500 approval limit, so each was approved at the site. Together they come to $6,620, a purchase the regional operations director was supposed to sign.

Nobody broke a rule, and the purchase still went around the approval matrix. Most matrices fail that way: the limits are clear, the routes are documented, and the spending flows through the gaps between single purchase orders.

What an approval matrix is

An approval matrix, or delegation of authority (DoA) matrix, answers one question for every purchase: who has to approve this before the money is committed? It does that with three things:

• Roles with limits. Each role can approve purchases up to a set amount. Anything above goes to the next role up.
• Category rules. Some kinds of spend get lower limits, extra approvers, or can't be approved at site level at all.
• Duties. Separately from limits, a matrix should say who may raise requests, approve orders, receive goods, create vendors, approve invoices and release payments, so that no one person controls two steps that should check each other.

The delegation of authority itself is usually a board-approved policy. The matrix is how that policy gets applied to a Tuesday-morning order for walk-in fridge parts.

Start with roles and limits

The Approval Matrix Builder's default example is a multi-site operator with five approval levels:

Set each limit just above the routine spending that role handles. If a site manager's normal weekly order is $1,800, a $2,500 limit lets it through without queueing while sending anything unusual upward. Set it at $1,000 and every routine order waits for a regional director, who starts approving without reading.

Add category rules for riskier spend

A site manager who can sign a $2,400 order for contracted cleaning supplies shouldn't be able to sign a $2,400 piece of kitchen equipment, or a $2,400 order from a supplier with no contract. Category rules handle that by scaling the role limits and adding specialists.

The rules change routes in ways a single limit can't. A $48,900 purchase from a kitchen equipment supplier sits $1,100 under the VP of Operations' $50,000 limit. Coded as capital equipment, where the VP's limit is $25,000, it needs the CFO and a capex review instead. Without category rules, the most expensive purchase of the month is approved one level too low.

Decide who signs: the deciding level, or every level

There are two common ways to route a purchase that exceeds the first approver's limit:

• Deciding level only. The purchase goes straight to the lowest role whose limit covers it, plus any specialist the category needs.
• Every level up to it. Each role below the deciding level approves first.

For a $60,000 services contract, the first route needs two sign-offs (CFO and Procurement). The second needs five (Site Manager, Regional Ops Director, VP Operations, CFO and Procurement). Each sign-off is another inbox where the request can wait. In our early-payment discount guide, cutting average approval time from nine days to two raised the discounts collected from $13,705 to $60,025 a year. Long chains are one of the main reasons approvals take nine days.

Use the deciding level as the default, and add a lower level only where it adds information the deciding approver lacks, such as a site manager confirming a repair is needed.

Separate the duties that check each other

Approval limits control how much one person can commit. Segregation of duties controls which steps one person can do. The builder checks six pairs:

In the builder's example team of six people, five have a conflict and three are high risk: a site manager who raises and approves her own requests, another who receives goods and approves the invoices for them, and a VP who can both create vendors and release payments.

Small sites can't always separate every duty. Where one person must hold two, add a check by someone else: a monthly review of that person's transactions, or spot checks of receipts against invoices by someone not involved in receiving.

How purchases get around the matrix

People rarely ignore a limit outright. They stay under it. The builder's sample of ten September purchase orders, worth $90,420, shows both patterns.

Orders clustered just under a limit

Six of the ten sit within 10% below a role's limit:

One order near a limit means nothing. A pattern of them, by the same person or to the same supplier, is worth a question.

Runs of orders to one supplier

The stronger signal is several orders from the same person to the same supplier within a few days, each under a limit, that together exceed it. The sample has two:

• Metro Facility Parts: three orders from one site manager on September 2, 3 and 4, totaling $6,620 against her $2,500 limit. The combined purchase needed the Regional Ops Director.
• BrightTech IT: two orders from the regional director on September 12 and 15, totaling $29,050 against his $15,000 limit. The combined purchase needed the VP of Operations and the IT Director.

US federal purchasing rules prohibit the same practice outright. FAR 13.003(c)(2) begins: "Do not break down requirements aggregating more than the simplified acquisition threshold" into smaller purchases to get under a threshold (Acquisition.gov). Your policy should say the same, and your reporting should look for it.

Handling rejected requests

A rejected request should always carry a written reason and go back to the requester with that reason attached. A rejection without a reason teaches the requester nothing, and they often send the same request again or buy around the process.

Separate a rejection that asks for changes, such as a wrong budget code, a missing quote or too high a quantity, from a final refusal. The first returns the request for editing and resubmission. The second closes it. Either way, the reason stays on the record. Read across a few months, rejection reasons show where the catalog, the budgets or the guidance for requesters need fixing.

Keeping approvals auditable

Approvals are auditable when you can show, for any purchase, who approved it, when, what they saw at the time, and which rule sent it to them. An auditor testing a sample of orders should be able to answer each question from the record alone.

• Record each decision with the approver, the time, the amount and the version of the request they approved.
• Keep the log append-only, so entries can be added but never edited or deleted.
• Record changes to a request after approval, with the before and after values.
• Version the matrix itself, with effective dates, so you can show which limits applied on the day.
• Review the limits at least once a year, and whenever roles or the organisation's structure change.

Who approves this?

Pick an amount and a category to see the route through the default matrix. The example is the $48,900 equipment order from above.

Who approves this? · the builder’s default matrix

Purchase amount

$

Category

Catalog supplies (on contract)Off-catalog purchasesCapital equipmentIT hardware & softwareServices & contractorsRegulated items

Who signs

Deciding level onlyEvery level up to it

Approval route

1. CFO
2. Finance (capex review)

2 sign-offs · site managers cannot approve this category · role limits are 50% here

Change the amount and category to see how the route changes.

Build your own matrix

Free tool

Approval Matrix Builder

Set your roles, limits and category rules, test any purchase against the route, check every person for segregation-of-duties conflicts, and upload purchase orders to find split orders. Download the matrix as a PDF for finance and audit to review.

Runs in your browser. No sign-up.

Open the builder

Building your matrix in six steps

1. List the roles that approve spending today, with the amounts they actually approve each week. Policy documents often describe a structure that no longer matches reality.
2. Set limits just above routine spend for each role, so normal orders don't queue and unusual ones rise.
3. Add category rules for capital equipment, off-contract buying, IT, services and anything regulated: lower limits, a specialist approver, or central approval only.
4. Route to the deciding level plus any specialist, and add a lower level only where it adds information.
5. Map duties for every person who can buy, receive, approve or pay. Remove high-risk conflicts, or add a compensating check where a small team can't.
6. Review quarterly. Look at where orders cluster under limits and at runs of orders to one supplier. If many legitimate orders sit just under a limit, the limit may be too low. If the same names appear in every run, ask.

A matrix in a shared spreadsheet only works when approvers remember to open it. The rules hold up when the system that routes purchases applies them automatically.