An approval matrix, also called a delegation of authority, says who may approve which transaction, up to what amount and for which company. Segregation of duties makes sure no single person can start, approve, record and reconcile the same transaction. Together they are the basic controls that stop errors and fraud before they reach the bank or the reports.
What is an approval matrix?
An approval matrix is a table of decisions and the people allowed to make them. Each row is an action, such as releasing a payment or posting a manual journal. Each column is an amount tier. Each cell names the role that may approve that action up to that amount.
Companies use different names for it: delegation of authority (DoA), authority matrix, signing authority or approval limits. It is usually approved by the board or the chief executive, and it covers more than finance: contracts, hiring and procurement often sit in the same document. This guide covers the finance rows.
A good matrix names roles rather than people, works in one base currency, and says what happens when an approver is away. Without that, approvals drift to whoever is available, and the matrix becomes a document nobody follows.
What is segregation of duties?
Segregation of duties means splitting a transaction's steps between different people, so that one person's mistake or fraud is caught by another. It is a general principle of internal control, and external auditors routinely test it.
The duties to keep apart are usually these four:
- Authorising a transaction, such as approving a payment or a purchase.
- Recording it in the books.
- Holding the asset, such as access to the bank account or the stock.
- Reconciling and reviewing the records.
Its everyday form is the four-eyes principle: one person prepares, a second person approves. It applies to payments, journals, supplier bank details, write-offs and access to finance systems.
How do you build an approval matrix?
- List the decisionsStart with the actions that move money or change the books: payment release, manual journals, receivable write-offs, budget changes, capital expenditure, asset disposals, new suppliers and changes to their bank details, and access to finance systems.
- Set amount tiers for each actionChoose a few tiers per action, in one base currency. Say how foreign-currency amounts are converted and whether amounts include VAT. Fewer tiers are easier to follow.
- Name roles, not peopleWrite 'Finance manager' or 'CFO', not a name. When someone leaves, the matrix still works, and system access can follow the role.
- Scope by companyIn a group, approval rights apply to specific companies. A finance manager in one country should not approve another country's payments by default.
- Write the rules that apply everywhereNobody approves their own request. Each approver decides once. The route is fixed when the request is raised, so a later change to the matrix does not change requests already waiting.
- Plan for absenceWrite delegation down, limit it in time, and never delegate to the person who raised the request.
- Approve, publish and reviewHave the board or the chief executive approve the matrix, publish it to everyone who raises or approves requests, and review it at least once a year and after any reorganisation.
What does an approval matrix look like?
| Action | Up to SAR 50,000 | Up to SAR 500,000 | Above SAR 500,000 |
|---|---|---|---|
| Payment release | Finance manager | CFO | CFO and chief executive |
| Manual journal posting | Financial controller | CFO | CFO |
| Receivable write-off | Finance manager | CFO | Chief executive |
| Budget change | CFO | Chief executive | Board |
| Capital expenditure | CFO | Chief executive | Board |
| Asset disposal | CFO | Chief executive | Board |
Some rows do not depend on an amount. A change to a supplier's bank details needs a second person to verify it, whatever the next payment will be. An access request needs the system owner's approval, with the requester's manager confirming the need.
Which duties should one person never hold together?
These pairs are the usual conflicts in a finance team. If one person must hold both, add a review that would catch misuse.
| Duties held together | The risk | The usual fix |
|---|---|---|
| Maintain supplier details and bank accounts, and approve payments | A payment to a fictitious supplier or to a changed bank account | Supplier changes verified by a second person; payments approved by treasury or the CFO |
| Prepare payments and release them | Payments made without an independent check | Payables prepares; someone else approves and releases |
| Record customer receipts and reconcile the bank | Receipts taken and hidden by moving balances between customers | Bank reconciliation prepared or reviewed by someone who does not handle receipts |
| Post journals and approve them | Entries that change results with no review | Manual journals approved by a second person, by amount |
| Administer user roles and approve transactions | Granting oneself approval rights, then approving | Role administration with IT or security, away from approvers |
| Change the approval matrix and approve within it | Limits raised just before an approval | Matrix owned by someone who does not approve transactions |
| Submit an expense claim and approve it | Personal spending paid as a business cost | Claims approved by someone other than the claimant |
| Import or replace the numbers and sign off the close | Changed figures signed off without review | A second person reviews imports before sign-off |
How can a small finance team segregate duties?
With three or four people, full separation is not always possible. Use compensating controls instead: reviews that would catch what the missing separation lets through.
- Use the bank's own controls. Where your bank's portal supports separate initiator and authoriser roles, give them to different people, and keep the owner or chief executive as an authoriser above a set amount.
- Review a list, not every item. Each month someone outside the process reviews the manual journals, new suppliers, supplier bank changes and write-offs.
- Have the bank reconciliation reviewed by someone who does not handle receipts or payments, even if that person sits outside finance.
- Rotate duties, so the same person does not handle the same suppliers or customers for years.
- Review access regularly, for example every quarter: who can approve, who can pay and who can change the matrix.
Write the compensating controls down next to the matrix. An auditor will ask how the risk is covered, and a written answer is far stronger than a verbal one. The bank side of this is covered in our bank reconciliation guide.
How do you enforce the matrix in your systems?
A matrix on paper works only if the systems follow it. Put the rules where the work happens: the ERP, the bank portal and any finance platform that raises payments or journals.
- Route each request by amount when it is raised, and record the route on the request.
- Block self-approval in the system, not by policy alone.
- Ask for a fresh verification before sensitive actions such as approving a payment.
- Record every request, decision and change in a log that cannot be edited.
- Check user permissions for conflicting pairs, and review access regularly.
- Lock closed months, so approved figures cannot change quietly. See our month-end close checklist.
Permissions show what someone could do; the audit trail shows what they did. Check both. A person who changed a supplier's bank details and then prepared a payment to that supplier is worth a question, even if their role allowed both. The same goes for someone who drafted a journal and then approved the close that includes it.
Questions people ask
Is a delegation of authority the same as an approval matrix?
In practice, yes. The delegation of authority is the document the board approves, and the approval matrix is the table inside it or the version set up in your systems. Keep the two in step.
Should approval limits include VAT?
Either works if you write the rule down and apply it everywhere. For payments, the gross amount is simplest, because that is what leaves the bank. For budgets and purchase orders, the amount before VAT usually matches how the budget was set.
What happens when an approver is on leave?
Delegate to a named deputy, in writing, for a set period. The deputy should hold at least the same authority, and the delegation should never go to the person who raised the request.
Can the CFO approve their own expense claim?
No. Nobody should approve their own claim or request, whatever their level. The CFO's claims usually go to the chief executive or the chair of the audit committee.
Who should own the approval matrix?
Usually the CFO proposes it and the board or chief executive approves it. Changes in the system should be made by someone who does not approve transactions, and every change should be logged.
Can an API key or an automation approve a payment in Naarvin?
No. An API key acts as a service account with one role and the companies you choose, and it can never approve, sign off or complete a four-eyes review. Those always need a person.