A delegation of authority (DoA) is the formal document that defines who in a company can commit, approve or sign which transactions, up to which amount, and under which conditions.
In finance, the delegation of authority usually takes the form of a matrix: rows for transaction types (purchase orders, supplier invoices, payments, contracts, credit notes, write-offs), columns for roles, and an approval limit in each cell. For example, a site manager approves purchase orders up to €5,000, the CFO up to €50,000 and the CEO above. Management approves the matrix and updates it whenever the organization changes.
A delegation of authority is only effective if systems enforce it. Auditors regularly find three gaps:
- limits written in a policy but never configured in the ERP or the approval workflow
- order splitting: one purchase divided into several orders that each stay under a threshold
- outdated rights: a manager who changed roles, or left, still holds approval authority
Auditors test the delegation of authority as a key control in the risk and control matrix: they compare the approvals actually given with the limits in force on the approval date. It works alongside the four-eyes principle and segregation of duties, which define how many people approve and who must not hold two roles.
Phacet agents can apply the delegation in force on every transaction rather than on a sample. Each invoice is checked against the approver's limit, the amount, the cost center and orders that look split to stay under a threshold. Exceptions are routed to the next level of authority, and the payment approval is logged with the limit that applied, which gives auditors the evidence they ask for.
