When approval limits in policy and in the system drift apart

Approval limits often drift. The published policy says one thing while payment and journal workflows enforce another, and the gap stays hidden until an audit sample or an odd payment exposes it. The fix: reconcile both and require a matching system change for every policy change.

How it starts

It rarely begins with a bad decision. It begins with an ordinary one.

A reorganisation moves a cost centre to a new director. Finance updates the delegation of authority document, gets it signed, and posts it on the intranet. Nobody raises a ticket to change the routing rules in the invoice approval workflow, because the policy owner sits in accounting and the workflow belongs to a systems team that never saw the memo.

The reverse happens too. A systems analyst raises a threshold to clear a backlog of stuck invoices during a busy close. The change works, so nobody reverses it. The written policy still shows the old limit.

Over time, small edits pile up on both sides. Temporary delegations for people on leave never expire. Departed managers stay in approver groups. Manual journal vouchers follow one approval path while invoices follow another, and the two were never designed against the same matrix. Each gap looks harmless alone. Together they mean the organisation cannot say with confidence who is allowed to approve what.

How it gets spotted

The most common trigger is an auditor. During an internal control review, someone pulls a sample of payments and asks for evidence that each one was approved by a person with the authority to do so. The approval record shows a name. The delegation document shows a different name, or a lower limit. Now finance has a finding to answer.

Other signals show up earlier for anyone watching closely:

• Invoices from one supplier arrive just under a threshold, again and again. Splitting is easier when the true limit is not what people think it is.
• Approvers complain that items land in their queue that should never reach them, or that they cannot approve items the policy says they own.
• Journal vouchers get posted with approval from someone outside the accounting team.
• Cycle memos describe a control that the walkthrough cannot reproduce.

A useful habit is to pull the list of active approvers and their limits straight from the system, then lay it beside the current signed matrix. Differences tend to jump out within minutes of reading.

Questions to ask the people who run it

What the policy manual describes and what the accounts payable clerk actually does are often different. Ask the operators directly.

• When an invoice is stuck because the approver is away, what do you do to get it paid?
• Who can change an approval threshold in the system, and do they need anyone's sign off first?
• When the delegation document was last updated, did anyone tell you, and what changed in your screens?
• Are there approvals you collect by email and attach later because the workflow will not route them correctly?
• Which suppliers or cost centres always seem to need a workaround?
• If a manager leaves, how long before their name disappears from the approver list, and who removes it?
• For manual journals, who reviews them, and is that the same person the policy names?

Listen for workarounds described as normal. Those are where the real process lives.

How to fix it

Start with a single reconciliation. Extract every approval rule from each system that routes spend or postings: the invoice workflow, the purchasing tool, the journal entry module, any card platform. Map each rule to a line in the signed delegation of authority. Mark every mismatch and decide which side is correct. Sometimes the system reflects a sensible business decision that never reached the document. Sometimes the document is right and the configuration needs to change. Get the decision signed by whoever owns the delegation.

Next, fix ownership. One person should own the approval matrix as a controlled record, and the systems team should treat it as the source for configuration. A policy change is not finished when the PDF is published. It is finished when the workflow has been updated and someone has tested a transaction against the new limit.

Then close the back doors. Restrict who can edit thresholds and approver groups. Give temporary delegations an end date in the system itself so they lapse on their own. Link leaver processing in HR to approver removal, so access ends when employment does.

Finally, build the comparison into routine work. Run the extract alongside the signed matrix as part of the control testing cycle, keep the output as evidence for auditors, and record any adjustments the review produces. When the comparison comes back clean several times in a row, the next audit request becomes a matter of handing over a file.

APQC's Process Classification Framework® (PCF) is an open standard developed by APQC, a nonprofit that promotes benchmarking and best practices worldwide. To download the full PCF or to view definitions and measures, please visit www.apqc.org/pcf.