Unwritten authority is not authority; it is improvisation. Governance’s job is to turn improvisation into a rule everyone knows before the decision is made.
1 The authority and delegation matrix
The authority matrix is a board-approved document setting out — for each type of decision — who proposes, who reviews, who approves, and the financial limit at each level. It is the simplest governance tool and the most effective.
| Type of decision | Up to 50,000 | Up to 500,000 | Above 500,000 |
|---|---|---|---|
| Operating expenses | Department head | CEO | The board |
| Asset purchases | CFO | CEO | The board |
| Hiring and compensation | HR director | CEO | Remuneration committee |
| Financing and borrowing | — | — | The board and the general assembly, depending on the limit |
| Related party transactions | Disclosed and approved under the statutory procedure, whatever the amount | ||
A golden rule
Segregation of duties: whoever requests a payment is not whoever approves it, nor whoever executes it, nor whoever reviews it afterwards. Concentrating those roles in one person is the number one gateway to embezzlement.
2 Delegation: transferring authority, not responsibility
The board may delegate some of its authority, but delegation does not relieve it of responsibility. For a delegation to be sound, in practice:
- Written and specific: naming the particular authority, its limits and its duration.
- Given to a position, not only a person, so that it passes with the role.
- Revocable at any time by the delegating body.
- Excluding what may not be delegated under the law or the company’s own regulations.
- Reviewed periodically and updated as the structure or the size changes.
3 Policies and procedures
The policy
Says what we do and why
The procedure
Says how we do it, step by step
The form
The paper or screen that gets filled in
The evidence
The trail proving the procedure was applied
From the idea to the trail: a policy with no procedure is a wish, and a procedure with no evidence is a claim
The most important policies in any organisation: the authority policy, the procurement policy, the HR and remuneration policy, the conflicts of interest policy, the whistleblowing policy, the disclosure policy, and the document retention policy.
4 Conflicts of interest
A conflict of interest arises when a decision-maker has a personal interest that could influence their judgement: a family tie, an ownership stake in a supplier, competing outside work, or a gift of value. The rule is not an outright ban, but disclose, then abstain, then have it approved by a neutral party.
Case one: the procurement manager’s brother owns a company submitting a bid. The response: disclose in writing, withdraw entirely from the evaluation committee, and have someone else sign the decision.
Case two: an employee receives an expensive gift from a supplier before the award. The response: record the gift in the gift register and return it or hand it to the organisation, per the policy.
Case three: a board member sits on the board of a competitor. The response: disclose the appointment, assess the conflict, and possibly require them to step down from one of the two seats.
5 Whistleblowing
A whistleblowing policy gives employees and others a safe channel to report the breaches they see, and rests on three pillars:
- An independent channel that does not pass through the line manager — a mailbox or system reporting to the audit committee.
- Confidentiality and protection from retaliation for anyone reporting in good faith, even if the report turns out to be mistaken.
- A clear investigation procedure with a response time and an outcome communicated to the competent body.
A common mistake
Policies written and filed in a drawer. A policy that employees do not know, are not trained on, and whose application is never followed up, might as well not exist when accountability comes.
Lesson summary
- The authority matrix defines who approves what, and up to what financial limit.
- Segregating request, approval, execution and review is a fundamental control.
- Delegation transfers authority but not responsibility, and must be written, specific and revocable.
- A policy is followed by a procedure, a form and evidence proving it was applied.
- Conflicts of interest are handled by disclosure, abstention and neutral approval.
- A whistleblowing policy needs an independent channel, confidentiality and protection from retaliation.
6 Test your understanding
Three quick questions
Pick the answer you believe is correct and you will see the result immediately.
1. One employee requests the purchase, approves it and executes the payment. What is wrong?
Combining request, approval and execution in one person removes the mutual check, however good the intentions.
2. The board delegated purchasing authority up to a limit to the CEO, and a mistake occurred. Who is responsible?
Delegation transfers authority, not responsibility; the board still owes a duty of monitoring and oversight.
3. What is the most important pillar of a whistleblowing policy?
Without protection and confidentiality nobody reports, and the policy becomes a piece of paper with no effect.