Purchasing and Approvals: A Simple Ordering Process With Clear Limits

Why small companies need an ordering process

The fitter orders material directly from the wholesaler, the office manager orders printer cartridges from an online shop, the sales manager books trade fair space. The invoices go to accounting, and the owner approves them, often in a pile on Friday afternoon. Whether the quantity was right, the goods arrived, and the price matched the quote is usually not checked by anyone in detail.

This is not a question of distrust. Most errors in purchasing are simply errors: invoices paid twice, deliveries that never fully arrived, prices that deviate from the quote. Deliberate misuse is rarer but more expensive. Both become more likely when one person can order, receive, and approve without anyone else being involved.

This article answers the question: how does a small company design an ordering process that protects money without slowing down every order? To do so, we clarify the terms, introduce a thinking model from research on white-collar crime, examine findings from small companies, weigh control against speed, and describe an ordering process in five steps.

An approval protects not only the company's money but also the employee, who can show that everything was in order.

What do approval, the four-eyes principle, and segregation of duties mean?

An approval is the explicit consent of an authorized person to an order or payment before it is carried out. The four-eyes principle requires at least two people to be involved in a transaction, such as one who orders and one who approves. Segregation of duties goes one step further: it distributes consecutive steps of a transaction among different people, so that nobody controls a transaction from start to finish alone.

In purchasing, this concerns three steps: the order, the receipt of goods, and the approval of the invoice for payment. Matching these three documents, meaning order, delivery note, and invoice, is called a three-way match. If quantity and price agree in all three, the invoice can be paid. If something differs, it is clarified before money flows.

In a company with eight employees, not every step can be assigned to a different person. It is then often enough that at least ordering and invoice approval lie with different people. Who is responsible for which step is best recorded in a RACI matrix.

The thinking model: the fraud triangle

In the 1950s, the criminologist Donald Cressey interviewed people who had embezzled money entrusted to them. This gave rise to a model still used in auditing practice today: the fraud triangle. It names three conditions that come together when someone misuses their employer's assets. Pressure is a trigger, such as financial hardship or excessive targets. Opportunity is the possibility of acting undetected, usually due to missing controls. Rationalization is the inner justification by which someone makes their actions acceptable to themselves, such as “I'm underpaid anyway” or “I'll pay it back.”

For the ordering process, the model is useful because it shows where an owner can intervene. The private pressure individual employees are under can hardly be influenced. Opportunity can be reduced through approvals, segregation of duties, and the three-way match. Rationalization depends on culture: whoever experiences that money is handled fairly and openly in the company finds it harder to justify doing otherwise.

The model was later extended. The so-called fraud diamond adds capability as a fourth condition, meaning the knowledge and position needed to bypass a control. In purchasing this means: whoever knows the system best needs the most careful segregation of duties.

What studies show about controls in small companies

Tarigan, Simbolon, and Elviani (2025) tested the fraud triangle in small food and beverage businesses in Medan, Indonesia. They surveyed 161 café employees and examined which of the three conditions is related to dishonest behavior. The result contradicts the obvious expectation: only rationalization had a significant influence, pressure and opportunity on their own did not. Technical anti-fraud aids, such as digital till and recording systems, weakened the relationship between opportunity, rationalization, and misconduct. The authors stress that small businesses in particular often do not keep adequate records and thereby create opportunities. The sample is small and limited to one industry in one city.

Borras (2020) surveyed 129 owners and managers of small gas stations and convenience stores in Puerto Rico. How strongly duties were segregated and how owners viewed internal controls together explained a large part of the differences in the quality of their control systems, 43.8 percent in statistical terms. Walauskas (2025) spoke with six owners of small businesses in New England who said they had built effective controls. Four themes recurred: careful hiring, procedures for monitoring controls, thorough employee training, and transparency. Both works are doctoral studies with limited reach. Yet they consistently show that controls in small companies depend less on technology than on attitude and a clear division of duties.

Two views: strict control or fast ordering?

The first view says: every order needs an approval. Only then does the owner keep track of the money, and only then are errors and misuse prevented. The fact that missing controls create opportunities supports this.

The second view says: whoever requires approval for every order turns the owner into a bottleneck. The fitter waits two days for a signature on material worth 80 euros, the construction site stands still, and the damage is greater than any conceivable misuse. The finding by Tarigan and colleagues also supports this: if rationalization matters most, a fair culture is more important than a signature on every document.

I consider tiering by value to be the right answer, because it does justice to both objections. In almost every company, most orders are small and together make up a small share of the volume. A few large orders carry the largest share. Whoever concentrates approval on these few and lets the small ones run with a follow-up check controls most of the money with little effort.

How to introduce an ordering process in five steps

1. Analyze one year of orders

   Sort one year's purchase invoices by amount. That shows how many orders fall into which value class and where the money is.

2. Set value limits

   Set two or three limits: up to which someone may order alone, from which the department head approves, and from which the owner approves. For recurring needs, conclude framework agreements within which orders are placed without further approval.

3. Separate receiving from ordering

   Where possible, goods are received by someone who did not order them and who confirms quantity and condition on the delivery note.

4. Three-way match before payment

   Before every payment, order, delivery note, and invoice are compared. The article on how to write work instructions shows what an instruction for this looks like, using the incoming invoice as an example.

5. Arrange stand-ins and follow-up checks

   Every approving person has a stand-in. Orders below the first limit are spot-checked once a month.

What follows beyond purchasing

An ordering process with approvals is a small piece of governance with control, as described in the article on corporate governance for small businesses. The same principles apply wherever money flows: credits to customers, changes to suppliers' bank details, expenses. Changing bank details in particular is a well-known entry point for fraud from outside. A rule that such changes are always confirmed by phone with the known contact person costs little.

Technology can make the process easier. Marian, Neferu, and Mitrea (2026) describe a document approval system on a no-code platform that shortened approval times in a six-week pilot. The article on no-code automation compares the types of tools available for this. More important than the tool, however, is that the rules are fixed beforehand. A digital approval path with unclear limits is just a faster unclear path.

• Ordering and invoice approval lie with different people.
• There are written value limits that everyone on the team knows.
• Every approving person has a named stand-in.
• Before every payment, order, delivery note, and invoice are compared.
• Changes to bank details are confirmed by phone with the known contact person.

Conclusion: how does an ordering process protect without slowing things down?

The guiding question was how a small company designs an ordering process that protects money without slowing down every order. The answer consists of three building blocks. Segregation of duties ensures that nobody can order, receive, and approve without a second person being involved. Tiered value limits concentrate approval on the few orders that contain most of the money and let the many small ones run quickly. A stand-in for every approval prevents the process from becoming a bottleneck. Research on the fraud triangle adds an insight that goes beyond forms: controls reduce opportunity, but a fair and open culture reduces rationalization, and that appears to count at least as much.

What you can put into practice right away

1. Have the purchase invoices of the last twelve months printed out sorted by amount.
2. Count how many orders are below 500 euros, between 500 and 5,000 euros, and above, and what share of volume they account for.
3. Based on this, set two value limits and write them on one page.
4. Name a stand-in for every approving person.
5. Introduce the three-way match for invoices above the first limit, starting next month.

After a month, two numbers are worth a look: how long approvals take on average and how many discrepancies the match has found. The first shows whether the process slows things down, the second whether it protects.