Approval Hell

Synopsis

All organizations use human approvals as a key control in their processes. But sometimes the volume of approvals an approver must handle defeats the purpose. If the volume is large, rejections are rare, or the approval itself is delegated, it may show that the control is ineffective. An optimum number is around five per day for an approver. Educating requesters about their performance, providing approvers with specific contextual information, automating the approval process, and being sensitive to volume during new process design can make approvals effective and painless.

The Study

In most of the business processes we have audited, one of the key controls is an approval by a human being — either a checkpoint where the process cannot proceed without an explicit green signal, or a notification of progress. Examples include PO approvals, approval for non-PO invoices, discount approvals and RMA approvals.

The question we have asked ourselves and our clients is whether approval by a human is an effective control.

In a typical complex modern organization, there may be a large number of applications that require human approval as a control. Approval notifications are often sent as an email with very little context or information for the approver to make a decision. There is no doubt that the looming shadow of someone verifying your work makes you want to get it right the first time, but using human approvals as a reliable control may not be a good solution.

Measures for the effectiveness of human approval as a control

• The number of approvals a person must do on the worst approval day — the more the number, the less effective the control.
• The average number of approvals required from a person on any given day — again, the higher the average, the lower the effectiveness.
• What percentage of approvals are rejected? Very few rejections could mean due diligence is missing; too many could be a symptom of a broken process.
• How many senior executives have delegated the approval to their admins? This indicates the approvals themselves may be inconsequential.

Some typical observations and conclusions during our business-process analysis are below.

So, can human approval be a key control?

If the approval notification does not have all the information necessary to take the decision, and the approver must consult other sources, we think it would be difficult for an approver to handle more than five a day. Beyond that number, effectiveness starts to decline.

Many approvers go 100s of approvals and a whole year without a single rejection.

If there are no or very few rejections, due diligence may be missing or the control is likely redundant. If both are true, it is a strong indication that the approval’s effectiveness as a control is compromised.

What is the solution?

• Make requesters self-aware. Explain a policy and ask them to self-approve if the request deviates. Create a dashboard where they can monitor their performance and compare with peers.
• Design the approval notification so that all necessary information, or links to it, is included. Highlight exceptions, so the approver can take a data-driven decision in a couple of minutes.
• Spread the approval burden around.
• Automate some approvals using a rule engine, especially those from outside the organization. Occasionally pick some requests randomly for manual approval, and build post-mortem analysis to detect misuse.
• As part of process design, forecast the number of approval decisions the controls will create, and make sure approvers have the capacity and capability to handle them.

Conclusion

Human approval controls are effective only if used selectively. Keep the volume small and provide contextual information to make the decision easier. Approvals need not be hell if they are designed and implemented thoughtfully.

← Back to all stories