Delegation of Authority Matrix Template (Approval Limits)

Delegation of Authority Matrix: [Organisation name]

Board-approved schedule of who may commit, approve, sign and pay on behalf of the organisation, and up to what limit: principles, roles and authority levels, the approval matrix for spending, capital expenditure, contracts, people, treasury, payments, accounting, tax, legal and subsidiaries, treasury dealing authorities, bank mandates, segregation of duties, exceptions, system enforcement and annual review. Written as original practice guidance; internal control concepts are based on the US GAO Standards for Internal Control in the Federal Government (Green Book, 2025 revision, GAO-25-107721, paragraphs 3.06 to 3.08 on delegation of authority and 10.21 to 10.23 on segregation of duties), a US government work. The matrix supports management's internal control over financial reporting under Sarbanes-Oxley Act sections 302 and 404 for US issuers and the material controls declaration in UK Corporate Governance Code 2024 Provision 29 (named only). Replace every [bracketed] value and every row marked Example. This is a document format, not legal, financial or accounting advice.

Document control

Approvals

Revision history

Contents

1. Purpose, scope and authority source
2. Principles
3. Roles and authority levels
4. How to read the matrix
5. Approval matrix
6. Treasury dealing authorities
7. Bank mandates and payment controls
8. Segregation of duties
9. Exceptions, emergencies and breaches
10. System enforcement
11. Review, attestation and monitoring
12. Traceability to controls
13. Glossary and references

1. Purpose, scope and authority source

This document sets the limits within which employees and officers of [Organisation name] may commit the organisation to spending, contracts, financial obligations and payments. It applies to every group company. The board of each subsidiary adopts it by resolution, subject to any local law that reserves decisions to that board or to its shareholders.

Authority flows from the board. The board keeps the matters listed in its schedule of reserved matters, for example approval of the annual budget, the strategy, major acquisitions and disposals, new borrowing facilities, dividends and the annual accounts. It delegates other matters to the Chief Executive Officer, who may sub-delegate within the limits below. Each delegation is personal to the role, not the individual, and lapses when the role holder changes.

Internal control standards treat the assignment of responsibility and the delegation of authority as part of establishing the organisational structure (GAO Green Book 2025, Principle 3, paragraphs 3.06 to 3.08). Management decides what authority each key role needs, delegates it, and keeps documentation that shows who is accountable. This matrix is that documentation for financial commitments.

2. Principles

3. Roles and authority levels

Specialist roles with their own authorities: Group Treasurer and authorised dealers (section 6), Financial Controller (accounting and journals), Head of Tax, Company Secretary, Head of Procurement (supplier selection, not approval of spend).

3.1 Assigning roles to levels

Map each job in the organisation chart to one level, using the size of the decisions the role normally takes rather than its title. A country managing director of a small subsidiary and a group function head may sit at the same level even though their titles differ. Record the mapping in the HR system so that the approval workflow can read it automatically when people join, move or leave.

Keep authority close to knowledge. The person who understands the business need and the budget should approve routine items; escalation should add judgement, not just another signature. If the CEO approves several hundred purchase orders a month, the limits below are too low and the CEO's approval has become a formality.

Interim and acting roles carry the authority of the level they cover only when HR records the appointment and finance updates the workflow. Contractors and consultants never hold approval authority, even when they act as managers of a team.

4. How to read the matrix

Limits are cumulative upwards: a CEO limit of 2,500 means the CEO approves items above the CFO limit and up to 2,500. Amounts in other currencies are converted at the current budget rate. Where a row says "within budget", an item that is not in the approved budget moves to the next column labelled "outside budget".

4.1 Worked routing examples

Example 1: The UK marketing director wants to commit EUR 180k to a budgeted media campaign. Marketing campaigns within budget allow a director (L5) up to 150, so the request goes to the Chief Revenue Officer (L4, up to 750), who approves it. Because the media agency contract is on the agency's terms rather than the group template, the contract row for non-standard supplier terms also applies: legal review is required and the L4 limit of 250 covers the value. Both conditions must be met before the order is placed.

Example 2: Engineering requests a budgeted data centre refresh of EUR 1,800k. Capex within budget above the CFO limit of 1,000 and up to 2,500 is approved by the CEO, after the CFO recommends it on the basis of the capex request and appraisal. The CFO's recommendation is recorded in the workflow; the board is informed through the quarterly capex report.

Example 3: A country finance manager in Vietnam receives an unbudgeted request for EUR 60k of warehouse racking. Capex outside budget allows an L4 country managing director only up to 50, so the request goes to the CFO (up to 250). Splitting the purchase into two orders of EUR 30k to stay within the country limit would breach principle PRN-003.

5. Approval matrix

5.1 Operating expenditure and purchasing

5.2 Capital expenditure and investments

Projects above EUR 1,000k need a capex request with an appraisal in Capex Request (finance/capex-request) and Investment Appraisal (finance/investment-appraisal).

5.3 Contracts

5.4 People

5.5 Treasury and financing

This table is the single source for treasury authorities. Treasury Policy (finance/treasury-policy) section 2.3 and FX and Interest Rate Hedging Policy (finance/fx-interest-rate-hedging-policy) section 10.1 repeat it word for word; change all three in the same board resolution.

Example: The interest rate swap that fixes 70% of the EUR 30,000k Term Facility (notional EUR 21,000k, maturing 2028-06-30 with the facility) was recommended by the Group Treasurer, who has no own authority for swaps, and approved by the CFO within the EUR 25,000k limit. It was reported to the board in the next treasury summary because it was inside the hedging policy. A forward-starting swap on the planned refinancing could be approved the same way only once the board has approved the refinancing in the funding plan; otherwise it is outside the policy and needs the board.

5.6 Payments

5.7 Accounting, credit and write-offs

5.8 Tax

5.9 Legal, related parties and subsidiaries

6. Treasury dealing authorities

A dealing limit is the size of trade a person may execute; the approval limit in 5.5 is who may decide it. A dealer may execute a trade above their own dealing limit only with the prior written approval of the level that 5.5 requires, recorded before execution. Configure the treasury management system so that user limits equal this table.

Rules: deals are recorded in the treasury system on the day; confirmations are matched independently by someone without dealing rights; recorded phone lines or electronic platforms are used where available; and any deal outside policy is reported to the CFO the same day. Instruments, hedge ratios and counterparty limits come from Treasury Policy (finance/treasury-policy) and FX and Interest Rate Hedging Policy (finance/fx-interest-rate-hedging-policy).

7. Bank mandates and payment controls

Payment controls that support the mandate:

• Changes to supplier bank details are verified by a call-back to a number already on file, not to the number on the change request, and approved by someone outside accounts payable.
• Payment files move from the ERP to the bank through a protected channel; manual edits to payment files are blocked.
• Online banking users have individual credentials with strong authentication; shared logins are prohibited.
• Leavers are removed from mandates and online banking on or before their last day; the treasury team reconciles users to the HR leaver list monthly.
• The bank account register is reconciled to bank confirmations at least once a year.

8. Segregation of duties

Segregation of duties divides key duties among different people so that no single person controls all stages of a transaction: authorising, processing, recording and reviewing, and custody of assets (GAO Green Book 2025, paragraphs 10.21 to 10.23). Where a team is too small to separate duties, management designs alternative controls, such as an independent review of transactions after the fact.

Example: In Corvid Commerce Vietnam LLC the finance team has three people. SOD-001 cannot be fully met, so the group shared service centre in Germany holds supplier master data rights and the country finance manager reviews the weekly change log.

9. Exceptions, emergencies and breaches

Exceptions and breaches are summarised for the audit committee each quarter with numbers, values and root causes. A pattern of exceptions in one area usually means the limits or the process need to change, not that people need more reminders.

Ratification is not automatic. The person asked to ratify an exception reviews the commitment as if it were a new request and may refuse it; where the organisation is already bound, the refusal is recorded and the owner of the process explains how the commitment was made without authority. Ratifications are reported with the exceptions so that the audit committee sees both the volume and the outcome.

Third parties may rely on the apparent authority of an employee even when the internal limit was exceeded. The matrix protects the organisation internally; it does not always protect it against a counterparty acting in good faith. Keep the list of authorised signatories current with banks and key suppliers, and tell them promptly when someone leaves.

10. System enforcement

Reconcile the system configuration to this document after every revision and at least once a year: export approval rules, compare them with section 5 and record differences and fixes.

11. Review, attestation and monitoring

For SEC registrants, including foreign private issuers that file annual reports on Form 20-F (such as the example group, whose American Depositary Shares are listed in New York), the matrix is evidence for the control environment and control activities that management assesses under Sarbanes-Oxley section 404(a) and certifies under section 302; external auditors of accelerated and large accelerated filers test it in their 404(b) attestation. For companies applying the UK Corporate Governance Code 2024, the matrix supports the board's monitoring and review of material controls behind the declaration under Provision 29, which applies to financial years beginning on or after 2026-01-01. Name the matrix in the controls evidence for both.

11.1 Rolling out a new or revised matrix

Announce each new version with a short summary of what changed and why, and publish the full matrix where every employee with approval rights can find it. Give budget holders a one-page extract for their level and a few worked examples from their own area; most breaches come from people who did not know a row existed rather than from deliberate bypass.

Change the system rules on the effective date, not before and not weeks after, and keep the previous rules available for audit. For the first quarter after a major revision, ask internal audit or the financial controller to sample approvals and report misunderstandings, then clarify the wording in the next version.

12. Traceability to controls

Keep the control descriptions in Risk and Control Matrix (compliance/risk-control-matrix) and the fraud scenarios that the matrix mitigates in Fraud Risk Assessment (compliance/fraud-risk-assessment).

12.1 Common design weaknesses

Limits that never change. A matrix written when the group was half its size forces routine items to the CEO or the board and creates pressure to find workarounds. Review limits against transaction volumes each year: if a level approves almost nothing, its limit may be too low; if one person approves most transactions, the next level may be too high.

Approvals that are only signatures. An approver must have the information to judge the item: the budget position, the business case, the contract terms. Configure workflows to attach these, and train approvers that approval means accountability for the decision, not a formality.

Commitments made outside the systems. Contracts signed by email, purchases on personal cards and verbal agreements with suppliers bypass the matrix entirely. Make clear that the organisation will not pay invoices without an approved order except under a short list of exemptions, and monitor invoices without orders.

13. Glossary and references

13.1 Glossary

13.2 References

Standard and licence note

Based on the US GAO Standards for Internal Control in the Federal Government (Green Book, 2025 revision, GAO-25-107721), a US government work not subject to copyright in the United States, cited by principle and paragraph number, and on the Sarbanes-Oxley Act of 2002 sections 302 and 404 (public law). The UK Corporate Governance Code 2024 and the COSO Internal Control, Integrated Framework are named only; no text from either is reproduced. The matrix structure, limits and examples are original and illustrative, not recommended values. Corvid Commerce Group and every figure are fictional. This template is original text written for this collection. Check the current official versions of cited documents before use. Template licence: MIT.