Delegation of authority matrix: what it is and how to write one

A delegation of authority matrix sets out who in an organisation can commit it to what: which decisions the board keeps for itself, which it hands to the managing director, and how far that authority runs down through the business. In a growing private or family-owned company, it is often the single document that turns “ask the founder” into a system that works when the founder is not in the room.

Many organisations have one. Fewer have one that is current, matches the limits configured in their finance and banking systems, and is actually followed. This guide explains what a delegation of authority (DoA) matrix is and where the board’s power to delegate comes from, which decisions and transactions it should cover, how to set approval limits, how it interacts with segregation of duties, and how to approve, communicate and review it. It closes with the most common control failures.

What a delegation of authority matrix is

A DoA matrix, sometimes called a scheme of delegation or an authority matrix, is a table that lists categories of decision or transaction against roles and states, for each, who may approve it, up to what value and on what conditions. It usually sits beneath a separate schedule of matters reserved for the board.

Where the power to delegate comes from

For a UK company, the starting point is the articles of association. Under the model articles for private companies limited by shares, the directors are responsible for the management of the company’s business and may exercise all the powers of the company, subject to the articles. Article 5 then allows them to delegate any of those powers to such person or committee, to such an extent and on such terms and conditions as they think fit; to authorise further delegation if they so specify; and to revoke or alter any delegation.¹ The model articles apply to a company formed on or after 1 October 2009 to the extent its registered articles do not exclude or modify them.¹² Older companies, and those with bespoke articles, should check their own wording before relying on this summary.

Delegation also has to sit comfortably with directors’ general duties under the Companies Act 2006. Directors must act in accordance with the company’s constitution and only exercise powers for the purposes for which they are conferred (section 171); must exercise independent judgement (section 173); and must exercise reasonable care, skill and diligence (section 174).³ Section 173 states that the duty to exercise independent judgement is not infringed by a director acting in a way authorised by the company’s constitution.³ A properly approved DoA, made under the articles, is therefore a legitimate way to share decision-making. It does not remove the board’s responsibility: directors who delegate still need to satisfy themselves that delegated authority is being exercised properly.

Internal control frameworks say the same thing in different words. The COSO Internal Control – Integrated Framework (2013) includes, as its third principle, that management establishes, with board oversight, structures, reporting lines and appropriate authorities and responsibilities.⁴ For large private companies, the Wates Corporate Governance Principles expect clear lines of accountability and responsibility, and note that where a board uses committees, their delegated authorities should be set out and the board retains responsibility for any final decisions.⁵

How it fits with other governance documents

Document	What it does	Approved by
Schedule of matters reserved for the board	Lists decisions only the board can take, such as strategy, major transactions and borrowing	Board
Delegation of authority matrix	Sets who may approve everything else, with financial limits and conditions	Board, on the recommendation of the managing director or finance director
Policies and procedures	Explain how approved decisions are carried out, including the controls and evidence required	Management, within the DoA
Bank mandates and system workflows	Enforce the DoA in practice	Must mirror the approved DoA

Decisions and transactions to cover

The Chartered Governance Institute’s guidance note on matters reserved for the board starts from a simple premise: “An effective board controls the business but delegates day to day responsibility to the executive management.”⁶ The FRC makes a similar point for listed companies, noting that a formal schedule of matters reserved for the board gives clarity over where responsibility for decision-making lies.⁷ The Wates Principles add that a board’s processes may include ensuring that new business opportunities of a certain value are considered and approved at board level.⁵

A practical DoA matrix for a trading company usually covers:

• Strategy and structure: business plans and budgets, acquisitions and disposals, new subsidiaries, entering new markets.
• Expenditure: capital expenditure (budgeted and unbudgeted), operating expenditure and purchase orders.
• Contracts: supplier and customer contracts by total contract value, non-standard terms (unlimited liability, exclusivity, long notice periods), leases and guarantees.
• Payments and banking: payment release, bank mandates, opening and closing accounts.
• Treasury: borrowing, security, foreign exchange and investment of surplus cash.
• Revenue-side decisions: pricing, discounts, credit limits, credit notes and bad debt write-offs.
• People: recruitment within and outside budget, pay changes, bonuses, settlement agreements.
• Legal and regulatory: starting or settling litigation, regulatory filings, signing deeds.
• Related parties: any transaction with a director, shareholder, family member or connected business.

Related parties deserve particular care in family-owned businesses, where commercial and family relationships often overlap. Section 175 of the Companies Act 2006 requires a director to avoid situations in which they have, or can have, an interest that conflicts or may conflict with the company’s interests, and sets out how the other directors may authorise such a situation.³ A DoA matrix should route anything touching a conflict to the board, never to the conflicted individual.

Setting approval limits

There is no correct set of thresholds. Limits should reflect the organisation’s size, margins, risk appetite and the experience of the people concerned. A few design principles hold in almost every case:

• Use total commitment, not annual or invoice value. A three-year contract should be approved at the level that matches its whole-life value, including likely renewals.
• Distinguish budgeted from unbudgeted spend. Unbudgeted items usually warrant lower limits, because nobody has yet approved them in principle.
• State the basis. Say whether limits are before or after VAT, and how foreign currency amounts are converted.
• Prohibit splitting. Breaking a purchase into smaller orders to stay below a limit should be an explicit breach.
• Set non-financial conditions. Some decisions (non-standard contract terms, related parties, new bank accounts) should go to a set level whatever the value.
• Define cover arrangements. State who acts when an approver is absent, and that authority can never pass downwards to someone below the required level.

Illustrative example only. The roles and amounts below show the structure of a DoA matrix for a mid-sized private company. They are not recommendations; set your own limits by reference to your size, risk appetite and articles.

Decision	Department head	Finance director	Managing director	Board
Purchase order within approved budget	Up to £10,000	Up to £50,000	Up to £150,000	Above £150,000
Unbudgeted expenditure	None	Up to £10,000	Up to £50,000	Above £50,000
Supplier contract (total contract value, standard terms)	Up to £25,000	Up to £100,000	Up to £250,000	Above £250,000
Contract on non-standard terms (any value)	None	Recommends	Approves, with legal review	If unlimited liability or exclusivity
Credit notes and bad debt write-offs	None	Up to £5,000	Up to £25,000	Above £25,000
New borrowing, guarantees or security	None	None	None	All
Transactions with directors, shareholders or connected parties	None	None	None	All, conflicted directors excluded

Procurement is where limits are most often tested and most often bypassed. Our procurement and contract audits check whether purchase orders and contracts were approved at the right level, and whether spend has been split or committed before approval.

Segregation of duties

Approval authority is only one part of the control. COSO notes that segregation of duties is typically built into the selection and development of control activities, and that where it is not practical, management selects and develops alternative control activities.⁴ A DoA matrix that lets one person raise, approve and pay the same transaction provides little protection, however sensible its limits.

The principle is to separate four functions for any significant transaction: initiating it, approving it, recording it, and handling or reconciling the related asset (usually cash). The combinations to avoid include:

• setting up or amending a supplier and approving payments to that supplier;
• raising a purchase order and approving it;
• releasing payments and reconciling the bank account;
• amending payroll standing data and approving the payroll; and
• approving one’s own expenses, pay or contracts with one’s own connected parties.

In a small finance team, full segregation is not always possible. The answer is compensating controls rather than silence: dual authorisation enforced by the banking platform, a director’s review of the bank statement and supplier changes, independent reconciliations, and system access restricted to what each role needs. Record those compensating controls in your risk and control matrix so they are tested like any other control.

Approval, communication and review

A DoA matrix has authority only if it has been properly approved and people know it exists. A sound cycle looks like this:

1. Board approval. The board approves the schedule of reserved matters and the DoA, and the minutes record the decision and the version approved.
2. Embedding in systems. Approval workflows, purchasing limits and bank mandates are configured to match, and the finance director confirms they do.
3. Communication. Each approver receives the matrix, confirms they understand their limits, and is told where to find it. New joiners and promoted staff receive it as part of induction.
4. Monitoring. Management reviews exceptions and retrospective approvals; internal audit tests compliance periodically, including data analysis for split orders and approvals above limit.
5. Review. The DoA is reviewed at least annually and whenever the structure, leadership or scale of the business changes. The Wates Principles say the chair and company secretary should periodically review governance processes to confirm they remain fit for purpose.⁵

For listed companies, delegated authority limits may well be among the controls the board considers under Provision 29 of the UK Corporate Governance Code 2024. Our article on Provision 29 material controls explains why. Private companies are not subject to that Provision, but the discipline is equally useful.

Common control failures

• Out-of-date matrix: roles that no longer exist, leavers still named, or limits unchanged for years while the business has grown.
• Systems that do not match: purchasing or banking limits configured differently from the approved DoA, so the system permits what the policy prohibits.
• Retrospective approval: purchase orders raised after the invoice arrives, so the commitment was made without authority.
• Split transactions to stay below a threshold.
• Informal authority: family members or long-serving staff who commit the business without any formal delegation.
• Unrecorded sub-delegation: authority passed on by email during absences. Under the model articles, further delegation is possible only if the directors so specify.¹
• Annual rather than total value: multi-year contracts approved on their first-year cost.

How we can help

We draft and refresh delegation of authority matrices, schedules of reserved matters and the procedures that sit beneath them through our policies, procedures and SOPs service. Our governance and risk management work helps boards decide what to reserve and what to delegate, and our procurement and contract audits test whether authority limits are followed in practice. We work closely with private and family-owned businesses as they grow beyond founder-led decision-making. To talk it through, book a free 20-minute call.

This article is general guidance, not legal advice. Take advice on your organisation’s specific circumstances.

Frequently asked questions

What is the difference between a delegation of authority matrix and matters reserved for the board?

The schedule of matters reserved for the board lists the decisions only the board can take, such as strategy, major transactions and borrowing. The delegation of authority matrix covers everything the board has delegated, setting out who may approve each type of decision, up to what limit and on what conditions. Most organisations need both, and they should be approved together.

Who should approve a delegation of authority matrix?

The board should approve it, because the authority being delegated is the board's own. Management, usually the managing director or finance director, prepares and recommends it, and the board minutes should record the version approved. Bank mandates and system approval limits should then be configured to match.

How often should a DoA matrix be reviewed?

At least annually, and whenever the structure, leadership or scale of the business changes, for example after a restructuring, an acquisition or the departure of a key approver. The review should also confirm that system limits and bank mandates still match the approved matrix.

References

1. legislation.gov.uk (The National Archives), 2008 (in force 1 October 2009). The Companies (Model Articles) Regulations 2008 (SI 2008/3229), regulation 1 and Schedule 1
2. legislation.gov.uk (The National Archives), 2006. Companies Act 2006, section 20: Default application of model articles
3. legislation.gov.uk (The National Archives), 2006. Companies Act 2006, Part 10, Chapter 2: General duties of directors (sections 170 to 177)
4. Committee of Sponsoring Organizations of the Treadway Commission (COSO), May 2013. Internal Control – Integrated Framework: Executive Summary
5. Financial Reporting Council, December 2018. The Wates Corporate Governance Principles for Large Private Companies
6. The Chartered Governance Institute UK & Ireland, 1 July 2013. Matters reserved for the board (guidance note)
7. Financial Reporting Council, 29 January 2024 (as updated to 16 March 2026). Corporate Governance Code Guidance