A spending approval workflow that scales

Ask a founder who is allowed to spend the company's money and you get a confident answer. Ask them to write it down — who, up to how much, and who signs off above that — and the confidence drains out. In most small companies the real rule is "ask someone senior if it feels big," which works right up until the team grows past the point where everyone agrees on what "big" means. By then the surprises have already started.

Deciding who can commit the money

Before you build any workflow, get clear on one word: commit. To commit company money is to create an obligation the company has to honor — signing a contract, sending a purchase order, clicking "subscribe," telling a vendor to start work. The cash may not move for weeks, but the decision is already made. Approval has to sit at the moment of commitment, not the moment of payment, because once an invoice arrives it is far too late to say no.

So the first thing you write down is a short list of people allowed to commit money at all, and up to what amount each one can commit on their own. Everyone else routes their request to one of them. This is not about trust. It is about making sure every obligation has a name attached to it before it exists.

A tiered approval matrix by amount

The backbone of the system is a threshold table — an approval matrix — that maps the size of a purchase to the level of sign-off it needs. The point is to spend attention where the dollars are, and let routine spending clear quickly.

A workable starting matrix for a fifteen-to-fifty-person company looks like this. Anything under $500 needs a single manager's approval — routine spend that should not consume a founder's afternoon. From $500 to $5,000, the request goes to a department head, who owns that budget and can weigh it against everything else the team is spending. Above $5,000 it goes to a founder or a controller (the person who owns the company's financial controls). The exact numbers are yours to set; what matters is that they are written, published, and applied the same way every time, so nobody has to guess where their $1,400 request lands.

Some purchases need a second gate, whatever the size

Amount is not the only thing that carries risk. A few categories deserve an extra sign-off even when the dollar figure is small, because they either create a lasting obligation or open a door that is hard to close later.

• New vendors: anyone the company has never paid before gets checked once — real business, correct bank details, a signed agreement — before the first dollar goes out
• Recurring subscriptions: a $99-a-month tool is a $1,188-a-year commitment that renews itself silently, so price it on the annual number, not the monthly one
• Capital purchases: equipment you will use for years and capitalize (spread across its useful life rather than expense at once) changes the balance sheet, not just the month
• Anything with a contract term: multi-year deals and auto-renewals lock you in long after the person who signed has moved on

The rule is simple. Size decides how high a request climbs; type decides whether it needs a second, different reviewer regardless of size.

Nobody plays two roles at once

Now the control that does the real work: segregation of duties. It means the person who requests a purchase is not the person who approves it, and neither of them is the person who actually sends the payment. Three roles, three different people.

The reason is plain. When one person can request, approve, and pay, there is nothing between them and the bank account but their own judgment on a bad day. Splitting the roles does not assume anyone is dishonest; it means a second set of eyes sees every obligation before it becomes real, and a third set sees it again before cash leaves. A small team can still do this — the requester is whoever needs the thing, the approver is their manager or department head, and the payer is your bookkeeper, who releases funds only against an already-approved request.

Put it in the tool, and keep it fast

An approval that lives in a hallway conversation or a Slack thumbs-up leaves no record and cannot be checked later. Put the whole flow inside your AP tool — the accounts-payable software that queues, approves, and pays your bills. Every request, approval, and payment then carries a timestamp and a name, so months later you can answer "who approved this?" in seconds instead of scrolling through chat history.

Just as important, keep it fast. A control the team resents is one they route around, and a bypassed workflow is worse than none because it hands you false confidence. If a $300 request sits for three days, someone starts putting it on a personal card and expensing it later, and the spend is invisible again. Auto-clear the routine, reserve human review for the amounts and types that earn it, and give approvers a same-day expectation.

Here is how it holds together. Your marketing manager wants a new analytics tool at $1,100 a month — $13,200 a year. Three gates apply at once: the annualized $13,200 clears the $5,000 line, so it needs founder sign-off; it is a brand-new vendor, so it gets the vendor check; and it is a recurring subscription, so it is priced on the yearly figure. The manager files the request in the AP tool, the founder approves it, and the finance lead runs the vendor verification. Only then is the vendor set up and the first $1,100 scheduled — by the bookkeeper, who never approved it. Contrast the alternative: the manager subscribes on a company card in ninety seconds, and you discover the $13,200 commitment at renewal, eleven months later, when someone finally asks what the charge is.