In this article
- Start with board authority, not a template
- Build the matrix around three dimensions
- 1. Commitment size and currency
- 2. Spend category and underlying risk
- 3. Exceptions that override the normal route
- A practical authority matrix without arbitrary monetary bands
- Configure Odoo to reflect the policy
- Illustration: a growing Zimbabwe distributor
- Measure control quality, not just approval speed
- Frequently asked questions
- Does Zimbabwean law set fixed approval amounts for every private company?
- Should a subscription be assessed at its monthly charge?
- Who approves a related-party supplier?
- Can Odoo enforce the matrix automatically?
A procurement officer needs urgent stock, but the usual approver is travelling. Finance then discovers that the proposed supplier is related to a director and the purchase was never budgeted. The risk is not the amount alone; it is who can approve the commitment, on what evidence and under whose authority.
An approval matrix gives Zimbabwean businesses a clear route from request to payment. For ordinary private companies, the law does not prescribe a universal schedule of spending bands. Directors must design a delegation of authority that suits their business, financial position, transaction risks and governing documents.
Start with board authority, not a template
The board should adopt a written delegation of authority and specify who can amend it. Make a distinction between approving a budget, committing to a supplier, confirming goods received and authorising payment. These are different control decisions, even where the same transaction is involved.
-
Requisition: the user describes the business need and expected delivery.
-
Budget review: finance or the budget owner confirms available provision and cash implications.
-
Commitment approval: an authorised approver agrees the order or contract before placement.
-
Receipt verification: someone independent confirms goods or services delivered.
-
Payment release and reconciliation: finance checks the invoice, receipt, approval trail and bank outcome.
A single user should not be able to create a supplier, raise and approve an order, mark delivery complete and release payment without independent review. Small teams may need compensating owner-level oversight rather than separate employees for every stage.
Build the matrix around three dimensions
1. Commitment size and currency
Set approval tiers from the actual pattern of commitments, cash exposure and operating currency. Use the full contractual commitment for recurring services, not just the next invoice. Aggregate linked purchase requests so that a project cannot be split into smaller orders to bypass review. Document how mixed-currency values are assessed at the approval date.
2. Spend category and underlying risk
Routine, budgeted supplies can follow a streamlined route. Changes to supplier bank details, privileged IT access, staff advances, inventory write-offs or sensitive payroll data need additional scrutiny, even when the monetary amount seems modest.
3. Exceptions that override the normal route
Related-party or potentially conflicted transactions.
Unbudgeted expenditure, unusual contract extensions and sole-source procurement.
Foreign-currency, cross-border or regulated commitments requiring specialist review.
Emergency purchases, write-offs, employee advances and unusual vendor-master changes.
Requests that appear divided to avoid an approval level.
An exception is not an automatic rejection. A sole-source part may be commercially justified, for example, but the business should record the reason and independent approval. Directors with an interest in a matter must follow the applicable disclosure and recusal process before a decision is taken.
A practical authority matrix without arbitrary monetary bands
| Decision type | Approval principle | Evidence retained |
|---|---|---|
| Routine purchase within budget | Delegated operational approver; independent receipt and payment checks | Approved requisition, purchase order and receipt |
| Material or unbudgeted commitment | Finance impact review, then executive or board approval under policy | Cash-flow assessment, alternative options, decision record |
| Related-party supplier | Conflict disclosure and decision by non-conflicted authority | Interests declaration, pricing basis, minutes |
| Staff advance or vendor bank change | Specialist approval outside ordinary purchasing limits | Request, independent verification, authorisation |
| Emergency commitment | Named emergency authority plus time-bound retrospective review | Urgency, supplier choice, approval and follow-up |
Configure Odoo to reflect the policy
Odoo 19 can support approval steps for defined actions through Studio, including selected approvers or groups, conditional rules and ordered stages. Exclusive Approval helps prevent the same user from approving multiple stages of one record. Approvals are tracked in the record history. These capabilities must be scoped for the actual Odoo edition, installed applications and configuration; they are not a substitute for approved company policy.
Define approvers by company, department, role and exception type.
Prevent requester self-approval and separate supplier maintenance from payment authorisation.
Time-limit substitute approvers and remove access when roles change.
Attach quotations, conflict declarations, receipts and review notes to the transaction.
Test negative cases: missing budget, related-party supplier, split purchase and unavailable approver.
In a multi-company environment, approval in one subsidiary should not imply authority to commit a different legal entity. Group oversight can be centralised, but entity-level approval and accounting evidence must remain clear.
Illustration: a growing Zimbabwe distributor
A distributor delegates routine inventory replenishment to department heads. An urgent IT request arrives for a service that grants an external provider access to sales and customer information. Although the invoice is smaller than a normal stock order, the request is escalated to finance and IT security because its risks are different. The approver records the data-access controls, business need and expiry of the service before release.
The better result is not more approval layers. It is fewer commitments made without the right information, less dependence on an absent signatory and a reliable history of who made each decision.
Measure control quality, not just approval speed
Time from request to authorised commitment, separated by routine and exception cases.
Share of supplier bills supported by an approved purchase order and receipt.
Number and age of unresolved conflict, emergency and policy-override cases.
Rate of approvals obtained after orders were already committed.
Inactive users and expired delegations still carrying approval rights.
Review these indicators in a monthly finance meeting and bring material exceptions to the board. Where approval delays are high, inspect the decision design rather than encouraging staff to bypass it. Public procurement thresholds are not default limits for private-company spending policies.
Frequently asked questions
Does Zimbabwean law set fixed approval amounts for every private company?
No universal monetary bands apply to ordinary private companies. Directors should approve risk-based delegations consistent with their duties and governing documents.
Should a subscription be assessed at its monthly charge?
Normally assess the full commitment covered by the contract, including renewals and amendments where applicable. The obligation may be much larger than one invoice.
Who approves a related-party supplier?
The interested person must declare the relevant interest and follow the applicable recusal process. An independent authorised decision-maker should review the rationale and evidence.
Can Odoo enforce the matrix automatically?
Odoo can support configurable approval rules and an audit trail. Actual enforcement depends on configuration, user rights, application scope and deliberate exception testing.
Request a SERPA consultation to review your delegation-of-authority policy, Odoo approval configuration and exception controls.