Delegated Authority Matrix: How to Build One (Template)

TL;DR: A delegated authority matrix (also called a delegation of authority or DOA matrix) is a table that says which role can approve which kind of decision, up to what amount, and under what conditions. Build it from decision types, not departments; set limits by risk, not only by money; name a backup for every approver; and keep the decisions the law reserves for the board out of anyone's personal limit.

A delegated authority matrix is a governance document that maps each type of business decision (buying, paying, signing, hiring, borrowing, discounting) to the role allowed to approve it, the monetary or percentage limit for that role, and the conditions that change the approver, such as a new vendor or non-standard contract terms. It answers one question in the moment: "who needs to approve this?" Once written, the same delegated authority matrix becomes the rule set for your approval workflow and the evidence your auditor tests.

What is a delegated authority matrix?

A delegated authority matrix is the operational half of a delegation of authority policy. The policy states principles (who delegates, how limits are reviewed, what happens on breach); the matrix turns them into rows anyone can apply without interpretation. EY and the Society for Corporate Governance found in a 2025 study that 90% of companies maintain a DOA policy and 54% use a combined memo-and-matrix format, as reported by Aptly. The same study found that 36% cite insufficient training as their top DOA problem, which is a design problem: rows people cannot read get ignored.

Every row in a working matrix has five fields:

A delegated authority matrix is not a RACI chart. RACI says who is Responsible, Accountable, Consulted and Informed for a piece of work; it grants no authority to commit money. You can be "Accountable" for a project and still need a director's signature for its largest purchase order.

Why does a small business need a DOA matrix?

A small business needs a DOA matrix because the founder stops being able to approve everything at roughly the point where they most need to. Before the matrix, two failure modes appear: decisions queue behind one person, or staff approve things "because it was urgent" with no record. A one-page matrix fixes both, and it makes three controls possible:

• Segregation of duties. The COSO Internal Control Integrated Framework lists segregation of duties among its control activities. The person who raises a purchase, the person who receives the goods and the person who releases payment should differ. In a three-person business, split at least "approve" from "pay".
• Anti-splitting. A cumulative limit (for example Rs 2,00,000 per vendor per month) stops a Rs 3,00,000 purchase being entered as six Rs 50,000 bills.
• An audit trail. When each approval names the rule that allowed it, an auditor or investor can test the rules instead of every voucher.

How do you build one in 7 steps?

Build the matrix in this order; each step feeds the next.

1. Pick the scope. Start with money going out: purchases, supplier payments, expenses, refunds and credit notes. Add contracts and hiring in version two. One domain done well beats an enterprise-wide draft that never gets approved.
2. List 6 to 10 decision types. Inventory decisions by what is being committed (raise a PO, approve a bill, release a payment, issue a credit note, give a discount, sign a contract, add a vendor, change vendor bank details), not by department, so the matrix survives a reorganisation.
3. Define authority levels as roles. A typical small-business ladder is team lead, department or operations manager, finance head, director or founder, and the board. Write roles, never names: names change with every resignation.
4. Set limits by risk. Money is one dimension. Add the conditions that change risk: budgeted or unbudgeted, matched to a PO or not, existing or new vendor, standard or non-standard terms, discount percentage, and a cumulative cap per vendor per month.
5. Write each row as an if-then rule. "Bill matched to PO and GRN, up to Rs 50,000: operations manager" can be followed by anyone and coded into a workflow. "Significant spend: senior management" cannot.
6. Design delegation, absence and exceptions before launch. Name a backup approver for every level, cap temporary delegations at 30 days, with an auto-expiry date in the row, and decide who can approve an exception, what evidence they attach, and when a recurring exception becomes a new rule.
7. Test, publish and review. Run 10 to 15 real decisions from the last 90 days through the draft. If any gets an ambiguous answer, fix the row. Then publish with an effective date, and review limits at least yearly and whenever a role, entity or bank account changes.

What does a DOA template for a small business look like?

The template below suits a 10 to 50 person trading or services business in India. The amounts are illustrations to scale to your own turnover and risk, not a standard; the structure is the part to copy.

Two rows matter more than their amounts. Vendor bank detail changes are the most common route for payment fraud, so they get a fixed approver and a call-back regardless of value. And borrowing never sits in a manager's limit, because company law puts it with the board.

Which powers can only the board exercise in India?

For an Indian company, the Companies Act 2013 decides part of your matrix for you. Section 179(3) says the board may exercise these powers only by resolutions passed at board meetings:

• (a) make calls on shareholders for unpaid share money;
• (b) authorise a buy-back of securities under section 68;
• (c) issue securities, including debentures;
• (d) borrow monies;
• (e) invest the company's funds;
• (f) grant loans, or give a guarantee or security for loans;
• (g) approve the financial statements and the board's report;
• (h) diversify the business;
• (i) approve an amalgamation, merger or reconstruction;
• (j) take over a company or acquire a controlling or substantial stake in another company.

Rule 8 of the Companies (Meetings of Board and its Powers) Rules, 2014 adds more board-only matters, including appointing or removing key managerial personnel, appointing the internal auditor and secretarial auditor, and making political contributions.

The proviso to section 179(3) is what makes a delegated authority matrix legal for money matters: the board may, by a resolution at a meeting, delegate clauses (d), (e) and (f) (borrowing, investing and lending) to a committee of directors, the managing director, the manager or another principal officer, on conditions it specifies. Put the resolution date and the delegated limit in the matrix row.

Explanation II to section 179(3) is useful in practice. For dealings with bankers, "borrowing" means the arrangement itself, such as sanctioning an overdraft or cash credit limit, not the day-to-day drawing on that account. So a finance head can operate the cash credit account within an approved limit; only setting or raising the limit needs the board.

When does a borrowing need shareholder approval?

Section 180(1)(c) requires a special resolution of shareholders when new borrowing, together with existing borrowing, would exceed the company's paid-up share capital, free reserves and securities premium. Temporary loans from the company's bankers in the ordinary course of business are excluded; the Act defines them as loans repayable on demand or within six months, such as cash credit and bill discounting, and not loans raised for capital expenditure. Securities premium was added to the formula by the Companies (Amendment) Act, 2017, effective 9 February 2018.

Section 180 does not apply to private companies, under exemption notification G.S.R. 464(E) of 5 June 2015, as long as the company is not in default in filing its financial statements (section 137) or annual return (section 92). A public company that breaches the limit has a real problem: section 180(5) makes the excess debt invalid unless the lender proves it lent in good faith without knowing the limit was crossed.

This is information about the statute, not legal advice. Check the current text and your articles of association, which can restrict delegation further.

How should AI agents appear in the matrix?

AI agents belong in the matrix as their own role, with the narrowest limits in it. An agent that can read bills and draft payments through an API or MCP key is a new kind of approver candidate, and the safest rule is the same one you apply to a new junior: it prepares, a person decides. Write rows such as "AI agent: draft purchase orders and bills, no approval limit, cannot issue, send or pay" and "Agent-drafted payment: same approver as a human-drafted one". Log the agent as the author so the audit trail shows who prepared and who approved.

This is how LuckPanda treats agents: API and MCP keys run the same commands as the app with the same permission checks, every change records the agent as its author, and agent keys cannot issue, send or pay. Approval rules by document and amount are being built in the Workspace module and are not live yet; until then, keep the matrix on paper and enforce it in your bank portal's signatory rules.

How do you keep the matrix working after launch?

A matrix keeps working only if it has an owner and a cadence:

• Owner. One role (usually the finance head) owns the document and its change log, with a named backup.
• Event updates. Update on every role change, resignation, new entity, new bank account or new borrowing sanction, the same week.
• Quarterly sample. Pull 20 approvals (about 5% of a 400-voucher quarter) and check each against the row in force on its date. Mismatches are either training gaps or rows that need changing.
• Yearly limits review. Inflation and growth make last year's limits too low, which pushes everything upward and slows the business.

For the invoice side of this, the invoice approval process guide covers matching and approver checklists, and the purchase requisition guide covers the request that comes before the PO. Repeat purchases under one agreed limit fit a blanket purchase order.