Signed, Sealed, Delayed: Rethinking Authorisation Chains in Service Operations

Most service operations do not set out to make customers wait for a signature. The approval steps accumulate quietly: a refund above a certain value, a credit outside policy, an exception to a standard process, a complaint resolution that needs a manager, a safeguarding decision that needs a lead. Each step may have had a reason when it was introduced. The question for operations leads is whether that reason still holds, and whether the control is proportionate to the risk it addresses.

An approval is not free. It consumes management attention, extends elapsed time, creates handoffs and often asks the customer to supply the same information again. In that sense, authorisation chains impose a tax on service delivery. The purpose of an approval audit is not to remove control. It is to establish where control is real, where it is inherited ceremony, and where a different limit would produce the same protection with less delay.

Begin with the decision, not the form

Approval audits often start with the authority matrix. That is the wrong end. The matrix records who can sign; it does not explain what decision is being made or what harm the signature is meant to prevent. Start instead with the service decisions that customers experience: refunds, credits, exceptions, complaint resolutions and safeguarding decisions. For each decision type, record the trigger, the approver, the stated reason for approval, the evidence required, the elapsed time from request to decision, and the customer action needed in between.

This creates an approval register rather than a policy summary. It should be possible to see, for example, that a refund of a given value requires two signatures, a scanned form and a customer call, but that the second signature is checking a calculation already checked by the system. That is the kind of finding that turns an audit from a compliance exercise into an operating model conversation.

Map the chain as a service journey

An authorisation chain is a journey with its own failure modes. The request may wait in a queue. The approver may be on leave. The evidence may be incomplete. The customer may be asked to provide the same document twice because two systems do not share it. The decision may be made and then reversed by a later check. These are not administrative details; they are service design choices.

Take a sample of 20 to 30 cases for each material decision type over a defined period, such as 90 days. Record median elapsed time, active touch time, number of handoffs, rework rate and the number of customer contacts generated by the approval. Compare the approval path with the customer's stated need. A complaint resolution that takes eight days because it passes through three managers may be protected by a control that could be exercised in one review. A safeguarding decision may rightly take longer, but the delay should be attributable to safeguarding assessment, not to diary availability.

Separate control from ceremony

A useful test is to ask what the approver actually changes. If the approver routinely agrees, never records a challenge and has no evidence beyond the request, the step may be ceremonial. If the approver sometimes declines, records a rationale and can point to the risk being managed, the step is more likely to be a control.

Three questions help. First, what is the defined harm or error this approval prevents? Second, what evidence does the approver examine that the requester cannot or should not assess alone? Third, what would happen if the approval were replaced by a post-hoc sample? If the answer to the third question is that the same errors would be caught later at lower cost, the approval may be a candidate for redesign.

This is not an argument for removing judgement. It is an argument for locating judgement where it adds value. A team leader who knows the customer history may add more protection than a distant sign-off that reviews only the transaction value.

Quantify the approval tax

The business case for redesign needs numbers. Measure elapsed time from request to decision, not just the approver's touch time. Measure the customer effort created: repeat contacts, additional documents, time spent waiting and the number of times the customer has to explain the same issue. Measure operational effort: approver minutes, queue time, rework and escalation. Where possible, compare approved cases with similar cases that did not need approval and look for differences in complaint rates, error rates and repeat contact.

The aim is not to produce a single cost figure that pretends to be precise. It is to show where delay is concentrated and whether the control is buying proportionate protection. A small number of high-volume, low-risk approvals can generate more cumulative delay than a small number of complex cases.

Redesign limits around risk, not hierarchy

Authorisation limits should reflect the risk of the decision, not only the grade of the person making it. A senior manager may be the right approver for a reputational exception but the wrong gatekeeper for a routine credit. A team leader with clear criteria and a sampling regime may be better placed to resolve a complaint quickly.

Redesign typically involves tiered limits, pre-approved thresholds, exception panels with defined criteria, delegated authority for named roles, and post-hoc assurance for lower-risk decisions. Safeguarding decisions need a different treatment: the relevant lead should be involved early, the rationale should be recorded, and timescales should be set by safeguarding need rather than by management availability. Complaint resolutions may require reference to regulatory expectations and ombudsman findings, so the control should be designed around evidence and consistency, not just seniority.

Make the new limits auditable

A revised authority matrix is only useful if it is visible and testable. Publish the decision types, thresholds, approvers, evidence requirements and review dates. Sample decisions monthly, including cases approved under delegated authority. Record declines, overrides and reversals. Review whether the new limits have changed elapsed time and customer effort without increasing errors or complaints.

Approval chains are part of the operating model, not an administrative appendix. Auditing them is a practical way to test whether the organisation is controlling risk or simply controlling delay. The best outcome is not fewer signatures for their own sake. It is a clearer link between authority, evidence and the service the customer actually receives.