Procurement approval workflows: designing controls that catch the commitments that matter

Every gate should be testing something specific

Approvals conflate several distinct questions: is this expenditure budgeted, is this technically the right item, is this supplier permitted, is the commitment within someone's authority, and does the resulting liability sit within what the business can carry. Each has a different competent approver, and bundling them into one signature means none is examined properly. Write down what each step is asking and who can actually answer it. A finance approver confirming a budget line is not assessing whether an unapproved supplier should be making a safety-related component, and should not be asked to.

The approvals that must happen before the commitment exists

Some decisions are effectively irreversible once an order is placed: a new supplier for a production part, a change to a specified material, tooling paid on a supplier's premises, a long non-cancellable commitment, a first purchase from an unauthorised channel. These need a gate positioned ahead of the order rather than a value threshold applied to it, because the risk has nothing to do with the amount. Route them by attribute — new source, engineering change, non-cancellable liability, restricted category — rather than by price, and require the technical approver rather than the financial one.

The emergency route and how it becomes the normal route

Every organisation needs a way to commit quickly when the line is down at night, and every emergency route eventually gets used for things that are not emergencies. The mechanism that keeps it honest is retrospective rather than preventive: a defined verbal or expedited authority with a named list of holders, a requirement that it be documented within a short defined window, and a periodic review of every use with the reason recorded. When the same part or the same requester appears repeatedly, the answer is fixing the underlying supply problem rather than tightening the exception.

Segregating duties when the team is small

The principle is that the person who selects the supplier, the person who commits the money, the person who confirms receipt and the person who releases payment should not all be the same individual. In a plant with a purchasing team of two, strict separation is impossible and pretending otherwise produces a documented control nobody follows. Partial measures work: bank detail changes verified by someone outside purchasing through an independently obtained contact, goods receipt performed by stores rather than the buyer, and a periodic review of new supplier records and price changes by a manager outside the function.

Thresholds that do not degrade into rubber stamps

An approver reviewing a large number of routine items each week stops reviewing and starts clicking, which is worse than having no gate because it creates the appearance of control. Set thresholds so the volume reaching each level is small enough to be genuinely considered, and index them to what the business actually spends rather than to a figure inherited from an earlier era. Remove approvals from spend already covered by a negotiated agreement, since the commercial decision was taken at the agreement. Then measure how often an approver actually rejects something; a gate that never says no is decoration.

Frequently asked questions

Should approval thresholds be based on order value or on risk?

Both, applied as separate tests rather than merged into one ladder. Value routing handles financial authority and is easy to automate. Attribute routing handles the decisions where the risk is unrelated to the amount, such as introducing a new source for a critical part or committing to a non-cancellable quantity. A purely value-based scheme lets a genuinely consequential low-value commitment pass unexamined while consuming senior attention on routine consumable orders.

How do we handle purchases made without any approval at all?

Distinguish between a control failure and a process that did not offer a workable route. Maverick buying is usually a symptom: the compliant path was too slow, the approved supplier could not deliver, or nobody knew an agreement existed. Investigate a sample before adding controls. Then close the gap by making the compliant route faster and better publicised, retaining a documented expedited path for genuine urgency, and reserving disciplinary treatment for cases where a usable route clearly existed and was bypassed.

Does approval workflow software solve the problem on its own?

It enforces whatever routing you configure and produces an audit trail, both of which are useful. It does not decide what should be controlled, and a badly designed process implemented in a system becomes harder to fix than one on paper because changing it now requires a project. Design the routing rules, the attribute triggers and the exception path first, run them for a period, then configure what has been shown to work rather than automating the structure you inherited.