Why Approval Limits Need More Than a Dollar Threshold
A financial limit can help keep routine decisions moving, but a dollar amount alone does not describe a decision’s full significance. A relatively inexpensive proposal may introduce substantial uncertainty or affect several business units. Conversely, a larger, well-understood expense within one unit may be covered by an appropriate delegation. A useful approval rule therefore considers financial impact, risk, and organizational reach, as well as any reserved-decision requirements.
This tutorial develops a practical way to combine those criteria. The thresholds and authority levels below are hypothetical policy choices, not universal standards. An organization should define them consistently with its governing documents and existing approval structure. Approval limits also do not replace required legal, compliance, control-function, or technical review.
Designing a Rule with Several Decision Dimensions
Start by defining the authority levels and the decision dimensions the policy will use. The following illustrative structure has four tiers: Tier 1 is a designated manager; Tier 2 is a designated executive; Tier 3 is an executive committee; and Tier 4 is the board or another authority identified in the governing documents. An organization would name its actual roles and decision-making bodies.
For a consistent example, assume the policy sets these financial thresholds for the total exposure from a decision:
| Tier | Financial impact | Risk classification | Organizational reach |
|---|---|---|---|
| 1 | Up to and including $100,000 | Low | One business unit |
| 2 | More than $100,000 and up to $500,000 | Moderate | More than one unit, but not enterprise-wide |
| 3 | More than $500,000 and up to $2,000,000 | High | Enterprise-wide |
| 4 | More than $2,000,000, or a reserved decision | Critical, or an unclassified risk requiring referral | Board-reserved matter |
The table gives each dimension a minimum tier. The organization must define its risk classifications and what counts as each type of reach; labels such as “high” are not usable approval criteria unless employees can apply them consistently. A decision affecting several business units may be Tier 2 by reach even if one unit originated it. A decision that is enterprise-wide may reach Tier 3 even when its financial impact is small.
Define financial impact in advance. For a contract, the relevant figure might be the maximum total contractual commitment over its term rather than a single year’s payment. For a decision whose loss or cost is uncertain, the policy should state which exposure measure and time horizon to use. It should also say whether related proposals are combined and how amendments, renewals, and options are treated. Without these rules, different decision-makers can classify the same proposal differently.
In symbols, if \(T_F\), \(T_R\), and \(T_O\) are the tiers indicated by financial impact, risk, and organizational reach, and \(T_S\) is any reserved-decision floor, then:
Here the tier numbers are ordered from lower to higher authority. The rule assumes that the dimensions have already been classified using the organization’s defined policy. It does not mean that financial impact, risk, or reach can be traded against one another, nor that approval is automatic once a tier is identified. It means the decision must go to at least the highest authority triggered by any dimension.
Why the Highest Applicable Tier Is the Minimum Sufficient Rule
Suppose each dimension establishes a minimum tier. An approver at Tier 2 cannot authorize a decision whose risk classification requires Tier 3. Likewise, a decision requiring Tier 1 approval on financial grounds still needs Tier 3 approval if its reach triggers Tier 3. The decision must satisfy every minimum requirement at once.
Determine the tier required by each applicable dimension and any reserved-decision rule.
The greatest of the minimum tiers is high enough to satisfy every individual minimum.
Adding tiers would not identify an authority level and could create a value outside the policy’s scale.
Formally, let the applicable minimum tiers be \(T_1,\ldots,T_n\). Any valid approval tier \(T\) must satisfy \(T\geq T_j\) for every \(j\). Therefore \(T\geq\max_j T_j\). The value \(\max_j T_j\) itself satisfies all those inequalities, so it is the lowest tier that does. This is why the rule uses the maximum, not a sum or an average.
The rule identifies the authority level; the policy must separately clarify the approval process. For the examples here, assume the highest required tier gives the final authorization, while mandatory specialist reviews or formal concurrence remain necessary. A higher-tier approval does not erase those requirements. Approval should occur before the organization makes a binding commitment, unless a specific emergency procedure applies.
Worked Example: A Multi-Year Service Contract
A business unit proposes a three-year data-storage contract with annual payments of $84,000. There is no cancellation option, and the hypothetical policy counts the full contractual commitment. The risk review classifies the arrangement as moderate, and only one business unit will use the service. Determine the required tier.
Method. Classify each dimension separately, then use the highest applicable tier. The common mistake avoided here is comparing only the first year’s payment with the financial limits.
Step 1: Calculate total commitment. The full non-cancellable commitment is \(3\times \$84,000=\$252,000\). The multiplication is \(84,000+84,000+84,000=252,000\).
Step 2: Assign the financial tier. Since \(\$100,000<\$252,000\leq \$500,000\), the financial tier is Tier 2.
Step 3: Assign the other tiers. Moderate risk gives Tier 2. One business unit gives Tier 1.
Step 4: Combine the triggers. \(T_{\mathrm{required}}=\max(2,2,1)=2\). The designated Tier 2 executive must authorize the contract, subject to any mandatory review.
Check. The calculated commitment falls within the stated Tier 2 band, and no other dimension requires Tier 3 or Tier 4. The result is Tier 2. Treating the annual payment of $84,000 as the full exposure would incorrectly suggest Tier 1.
Build Escalation and Aggregation into the Policy
A practical rule needs to say what happens when a decision exceeds a person’s authority. The person should pause the commitment, document the relevant facts and classifications, and refer the proposal to the designated higher authority. That authority may approve it, reject it, request changes, or refer it further if the governing rules require. Escalation is a control, not a substitute for a well-defined approval process.
The policy should also guard against dividing one decision into smaller pieces to obtain lower-tier approval. Define when commitments are related—for example, when they serve one initiative, share a counterparty, or are planned within a specified period—and whether their exposures must be combined. Apply the rule to the substance of the decision, not simply to the number of purchase orders, contracts, or departments involved.
Other useful drafting details include who records the approval, which version of a proposal was approved, how material amendments are treated, and who may act when the usual approver is unavailable. Any emergency exception should be narrowly defined, documented, time-limited, and subject to the organization’s designated review. It should not silently convert an exception into a general delegation.
Worked Example: A Low-Cost, High-Risk Pilot
A unit proposes a two-year software pilot. The vendor charges $30,000 at setup and $15,000 per year for two years. Internal implementation is estimated to cost $12,000, and the hypothetical financial rule includes that cost. The pilot would process identifiable sensitive information and inform eligibility recommendations, so the organization’s defined risk review classifies it as high risk. Two units will use it, but it will not be deployed enterprise-wide. Determine the approval tier.
Method. Calculate the policy-defined total cost, then assess risk and reach independently. The common mistake avoided is treating a small financial amount as sufficient evidence that the decision is low-tier.
Step 1: Calculate financial impact. Setup and recurring charges total \(\$30,000+2(\$15,000)=\$60,000\). Including implementation cost gives \(\$60,000+\$12,000=\$72,000\).
Step 2: Assign the financial tier. Since \(\$72,000\leq \$100,000\), the financial tier is Tier 1.
Step 3: Assign risk and reach tiers. High risk gives Tier 3. Use by two units, without enterprise-wide deployment, gives Tier 2.
Step 4: Combine the triggers. \(T_{\mathrm{required}}=\max(1,3,2)=3\). The designated Tier 3 committee must authorize the pilot, with any required specialist review.
Check. The financial amount is within Tier 1, but high risk independently requires Tier 3. The result is Tier 3. Selecting Tier 1 based only on cost would fail to enforce the risk trigger.
Worked Example: Related Proposals Submitted Separately
Two regional teams submit separate proposals for the same planned system upgrade within a 12-month period. Each proposal is for $720,000. Under the hypothetical policy, commitments for one initiative within 12 months are aggregated. The overall initiative is classified as moderate risk and enterprise-wide in reach. It is not a reserved decision. Determine the required tier and explain why the proposals cannot be approved separately at a lower level.
Method. Apply the policy’s aggregation rule before assigning the financial tier. The common mistake avoided is treating two submissions as unrelated merely because they came from different teams.
Step 1: Aggregate financial exposure. The initiative’s total is \(\$720,000+\$720,000=\$1,440,000\).
Step 2: Assign the financial tier. Since \(\$500,000<\$1,440,000\leq \$2,000,000\), the financial tier is Tier 3.
Step 3: Assign risk and reach tiers. Moderate risk gives Tier 2. Enterprise-wide reach gives Tier 3. No reserved-decision rule adds Tier 4.
Step 4: Combine the triggers. \(T_{\mathrm{required}}=\max(3,2,3)=3\). The initiative requires Tier 3 authorization.
Check. Each separate $720,000 proposal would fall in Tier 3 on its own under these financial thresholds; in any case, the policy expressly requires aggregation of this related initiative. The combined exposure is $1,440,000, which remains within the Tier 3 band. Submitting or approving the components separately does not change the required authority.
Common Approval-Rule Traps
- Using annual cost instead of defined exposure. A multi-year commitment may exceed the annual amount by several multiples. Follow the policy’s stated measurement basis.
- Letting one low dimension cancel a high one. A small cost does not reduce the approval tier triggered by high risk or broad reach.
- Adding or averaging tiers. Tiers are ordered authority levels, not quantities. Use the highest applicable minimum tier.
- Ignoring linked decisions. Related commitments may need aggregation under the policy, even if they are submitted by separate units.
- Approving first and escalating later. Unless an explicit exception applies, referral must happen before a binding commitment is made.
- Treating a classification as an approval. A risk assessment or financial calculation identifies a required tier; it does not itself authorize the decision.
Well-designed approval limits make responsibility predictable: decision-makers can identify the information needed, the applicable authority, and the point at which they must stop and refer a proposal. Clear thresholds, consistent aggregation, and a rule for combining multiple triggers support accountable decisions and are aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.
Check Your Understanding
Use the illustrative four-tier policy in this tutorial. For each problem, classify the stated dimensions, apply the relevant policy rule, and identify the required approval tier.
- A one-unit, low-risk equipment lease has a non-cancellable total commitment of $98,000 over its full term. No reserved-decision rule applies. What is the required tier? (Answer: Tier 1.)
- A $460,000, one-unit project is classified as moderate risk. No reserved-decision rule applies. Determine the financial, risk, and reach tiers, then the required tier. (Answer: Financial Tier 2, risk Tier 2, reach Tier 1; required Tier 2.)
- A $92,000 trial is classified as high risk and will be used by three units, but not enterprise-wide. Determine the minimum tier for each dimension and the final tier. (Answer: Financial Tier 1, risk Tier 3, reach Tier 2; required Tier 3.)
- Two related commitments of $510,000 and $1,100,000 support one enterprise-wide initiative. The combined initiative is low risk, and the policy requires aggregation of related commitments. What is the total exposure and approval tier? (Answer: Total exposure $1,610,000; financial Tier 3, risk Tier 1, reach Tier 3; required Tier 3.)
- A proposal has a total financial exposure of $80,000, is classified as moderate risk, and affects the whole enterprise. The organization’s governing rules also designate this type of decision as reserved to the board. What is the required tier, and why? (Answer: Tier 4; the reserved-decision rule requires Tier 4, above the Tier 1 financial, Tier 2 risk, and Tier 3 reach triggers.)