TL;DR: An approval hierarchy is the ordered chain of people who must sign off on a purchase, with each level allowed to approve up to a set dollar limit. The lookup table below gives starting limits for 10, 50 and 200-person companies. Pair it with two rules auditors always check: nobody approves their own request, and nobody approves, receives and pays for the same order.
An approval hierarchy (also called a purchase approval hierarchy, PO approval hierarchy or approval matrix) is a set of rules that decides who must approve a purchase request or purchase order before it goes to a supplier. Routing usually depends on the order total, and sometimes on the category, cost center or location as well. A request under the first limit goes to the requester's manager. Anything bigger moves up a level until it reaches someone whose limit covers the total. A small business typically needs three or four levels. The thresholds matter less than applying them consistently and keeping requesting, approving and paying in separate hands.
Approval matrix lookup table
Use this as a starting point and adjust the limits to your margins and how often you buy. Each limit applies to the full order value, including tax and shipping, not to a single line.
| Order value (USD) | ~10 employees | ~50 employees | ~200 employees | Quotes required |
|---|---|---|---|---|
| Up to $1,000 | Manager | Team lead | Team lead | None |
| $1,000 to $5,000 | Owner | Department manager | Department manager | 1 written quote |
| $5,000 to $15,000 | Owner | Department head + finance | Department manager + finance | 2 to 3 quotes |
| $15,000 to $50,000 | Owner + accountant review | Finance lead / CFO | Director + finance controller | 3 quotes or an RFQ |
| $50,000 to $350,000 | Owner (board if any) | CEO | VP + CFO | Formal RFQ |
| Over $350,000 | Owner + board / lender | CEO + board | CEO + board | Formal RFQ or tender |
The $15,000 and $350,000 breakpoints are not arbitrary. They match the US federal micro-purchase threshold and simplified acquisition threshold, which the FAR Council raised from $10,000 to $15,000 and from $250,000 to $350,000 effective October 1, 2025 (Federal Register, August 27, 2025). Private companies aren't bound by them, but they are a defensible benchmark when an auditor or investor asks why your limits sit where they do.
What is an approval hierarchy?
An approval hierarchy is the sequence of approvers a purchasing document passes through, plus the authority limits that decide where it stops. ERP systems model it in two common ways:
- Supervisor hierarchy. The request goes to the requester's manager, then that manager's manager, and so on up the reporting line. Oracle Purchasing calls this "employee/supervisor relationships". It does not use Oracle's Approval Hierarchy form (Oracle Purchasing docs).
- Position hierarchy. Approval follows positions such as "Plant Buyer" or "Finance Controller", not named people, so it survives staff turnover. In Oracle, position hierarchies control both approval routing and who can see a document. After any structural or personnel change you must run the Fill Employee Hierarchy process.
In both models the limits live in rules. Oracle approval groups can set rules on Document Total, Account Range, Item Range, Item Category Range and Location. SAP's release strategy sets the release codes needed and the order they are applied in, with a maximum of eight release codes in the standard system (SAP Help). To pick a strategy, SAP copies the PO into the CEKKO communication structure, where the total value field is GNETW.
What approval limits should a small business set?
Base your limits on how many orders each level will actually see, not on job titles. A useful test: the first level should handle about 70-80% of orders by count, and the top level should see fewer than 5 per month. If the owner signs every $300 order, the hierarchy is a bottleneck, not a control.
| Signal | What it means | Adjustment |
|---|---|---|
| Top approver receives more than 20 per week | Limits too low | Raise level 1 and level 2 limits |
| Many orders land just under a limit (for example $4,950) | Order splitting | Approve cumulative spend per supplier over 30 days |
| Approvals take more than 3 days, or over 72 hours for urgent items | Too many levels | Remove a level or add a parallel approver |
| Finance sees orders only after delivery | Control comes too late | Add finance before the PO, not at invoice |
Write the limits into your procurement policy so they don't live only in someone's head.
Who approves purchase orders?
The budget owner approves the business need. Above a set value, finance approves the spend. These are two separate questions. In a typical 50-person company:
- Requester: raises the purchase requisition, and never approves it.
- Budget owner (team lead or department manager): confirms the purchase is needed and fits the budget.
- Finance: confirms the GL code and cash timing above the second threshold.
- Executive (CEO/CFO): signs off on large or multi-year commitments.
- Buyer or procurement lead: turns the approved request into a purchase order and handles supplier selection, but doesn't approve its own sourcing decision.
For more on who owns what as a team grows, see procurement team structure and roles.
Segregation of duties rules auditors check
Segregation of duties means one person can't control a transaction from start to finish. University and public-sector control guides list four duties to keep apart: initiating, approving, record keeping and custody of the asset (Penn internal controls guidance).
| Rule | Exact test |
|---|---|
| No self-approval | Requester ID is never equal to approver ID on the same document |
| Delegates can't request | A person with delegated approval can't create the requisition they approve (ISBE purchasing guidance) |
| Purchase, receipt and payment are split | Approver, goods receiver and payment releaser are 3 different people, 100% of the time |
| Supplier master is protected | People who approve POs can't add or edit supplier bank details |
| Changes re-trigger approval | An edited PO that increases value goes back through the hierarchy |
The last two rules close the gaps fraud usually goes through. The receiving split is also what makes 3-way matching work: the PO, the receipt and the invoice come from different hands.
How do you handle approver absence?
Every level needs a named backup with an equal or higher limit, set up before anyone goes on leave. Four rules cover most cases:
- Delegate up or sideways, never down. A $15,000 approver's delegate needs at least a $15,000 limit.
- Make delegation time-boxed. Set start and end dates (for example 14 days) so authority expires automatically.
- Escalate after a timeout. If a request sits for 2 days, route it to the next level.
- Log it. The record should show "approved by Dan on behalf of Maria", not only Dan's name.
Where software fits
A spreadsheet matrix works until requests start arriving by email and chat. After that, nobody can prove which version of the limit applied. Above the second threshold, most of the approval effort goes into getting and comparing quotes. That is the part AuraVMS handles: suppliers reply to an RFQ without creating an account, quotes are ranked L1/L2/L3 side by side, and the winning quote becomes a purchase order. AuraVMS starts at $4.99/month, billed annually.
FAQ
What is the difference between an approval hierarchy and an approval matrix?
The hierarchy is the chain of approvers. The matrix is the table that maps order values or categories to that chain. Most companies use the terms interchangeably, and the table above is both.
Should approval limits include tax and shipping?
Yes. Apply limits to the full committed value, including tax, freight and multi-year terms. Otherwise a $14,000 order with $1,500 freight slips under a $15,000 limit.
How many approval levels does a small business need?
Three or four. Each level should clear its queue within 2 days. A 10-person company can work with manager, owner, and owner plus accountant review. Each extra level adds days and rarely adds control.
Can the same person approve and receive goods?
They shouldn't. Separating purchase, receipt and payment is a core segregation of duties rule. In very small teams, add an owner review of a monthly receipts report as a compensating control.
What is a position hierarchy in Oracle?
It routes approvals by job position instead of named employees, so routing stays the same when people change roles. You must run Fill Employee Hierarchy after changes for the hierarchy to take effect.