Guides › Operations

Who is allowed to buy what, and how to control it

Operations Updated 2026-10-02 purchasing approvals suppliers

Short answer

A purchase approval rule exists for three things: spend you control, spend you can see, and spend you can stop. Without one, the business buys things it does not need, at prices nobody compared, from whoever answered the phone first. Set a value ladder so the approval weight follows the money, write down what you chose and why on anything above your top threshold, and read every recurring debit off your bank statement rather than remembering it, because twelve small amounts become one annual number nobody agreed to.

Most small firms have no purchase approval rule, which means everyone can buy everything. Nobody has broken a rule, because there is not one. The consequence is not fraud — it is a slow drift into owning stock nobody ordered, subscriptions nobody reviewed, and prices nobody checked, paid to whoever happened to answer the phone.

What is a purchase approval rule actually for?

Three things, and if it does not deliver all three it is not worth the admin.

Spend you control. There is a value above which somebody else has to say yes. Not a value above which you have to be told — a value above which the decision is not one person's.

Spend you can see. Every purchase has a name, a date, an amount and a reason in one place. Right now, if you asked "what did we buy from that supplier last quarter?", the honest answer is probably that you would have to check the bank statement and hope.

Spend you can stop. A recurring amount, a standing order or a subscription can be cancelled by one person without a conversation. If nobody can stop it, nobody can.

The point is not to prevent anyone from buying anything. It is to make sure that the expensive decisions are made deliberately and the cheap ones do not require a meeting.

Who should be able to approve what, at what value?

One structural rule first, and it matters more than the numbers: whoever requests should not be the only one who approves. And whoever receives the goods should not be the approver either. If one person can ask, approve and receive, you have three eyes down to one.

Then set the ladder from your own average order value, not from a template:

Band	What it covers	Who approves	What must exist
Up to [your R___]	Consumables, small parts, one-off sundries	The person buying, alone	One line in the register
[R___] to [R___]	Tools, standard stock, recurring services	One other person, in writing	Two names and the amount
[R___] to [R___]	Equipment, vehicle items, contracts, bulk stock	Two written quotes, one written record	Quotes, the reason you chose one, a PO number
Above [R___]	Anything that changes how the business runs	Owner or director only	Three quotes, a PO, and approval before the money moves

Two things to fix before you fill the numbers in. Set the top band at a point where a wrong decision would actually hurt you — not at a round number, because round numbers get waved through. And set the bottom band high enough that nobody needs permission for a tube of fittings, or the rule will be ignored on day one.

What is the difference between a routine reorder and a considered purchase?

This distinction is what keeps an approval process alive.

A routine reorder is the same item, from the same supplier, at a known price, inside a minimum and maximum level you already agreed. It was approved once. Re-approving it every month is what turns an approval rule into paperwork nobody does, and then people start ordering through the back door to avoid the form.

A considered purchase is any of these: a new item, a new supplier, a first order, a price change, or anything that changes how the work gets done. Those get the full treatment every time, however small the amount.

So approve the reorder, not the purchase. Agree the list, the supplier, the price and the minimum and maximum levels once. After that, reordering inside those levels needs a name in the register and nothing else. Anything outside them goes back through the ladder.

The same logic applies to service work. A contractor you use regularly at the same rate is a reorder. A new contractor quoting for the same job is a considered purchase, and deserves three quotes even if the job is small.

When do three quotes matter, and what do you write down?

Three quotes matter when a wrong choice is expensive or hard to undo: equipment, vehicles, fit-out, a supplier relationship you will depend on, and anything above your top approval band.

Two rules that decide whether comparing quotes is worth anything:

Ask for them in writing. A price said on the phone and written down afterwards is a memory, not a quote.
Give all three suppliers the same specification. Three quotes for different things are not a comparison, and the cheapest one will always be the one that misunderstood.

Then write the record. It takes two minutes and it is the only thing that defends the decision later:

Purchase record — [project]

Item:                [what exactly, specification, quantity]
Quotes received:     A [amount] · B [amount] · C [amount]
Chosen:              [supplier], because [the real reason: lead time,
                     warranty, spare parts, they hold stock locally]
Decided by:          [name], on [date]
Rejected because:    [one line each — you will be asked later]

"Chosen because they were the only ones who could deliver by Friday" is a legitimate answer, provided it was actually true.

How do small recurring amounts become a large unnoticed number?

This is where most of the leak is, and it never appears as a line item.

Every standing order, subscription, monthly licence and card auto-debit feels trivial because you approve it one at a time. Nobody ever sees the total. So work it out from the bank statement rather than from memory — one page, thirty minutes:

Annualised recurring = monthly amount × 12
                     + any annual or quarterly commitment not already monthly

Then add the part that never appears on a statement:

Real cost of a recurring item = monthly amount × 12
                              + hours spent administering it each month × your hourly rate

The second line is where software subscriptions become obvious. A "small" system that needs an hour a month of somebody's time to keep it working is a considerably larger line than the invoice.

Then act on it. Cancel anything nobody in the business can name a purpose for. Put the rest on one page with the owner, the renewal date and what happens if you cancel. Review that page on a fixed date every year, not when a renewal email arrives — because the renewal email is written by the supplier and always sounds urgent.

What does a purchase-order discipline look like in a small firm?

Six steps, and the discipline is in the sixth.

The PO number exists before the money moves. Not afterwards, when someone remembers.
The PO is short: what, quantity, agreed price, delivery point, payment terms, and who approved it.
It goes to the supplier, so the price is agreed by both sides before goods move.
Goods-in checks the PO number against the delivery note. A delivery note with a different price gets queried on the spot, not at invoice time.
The invoice is matched to the PO and the delivery note before it is paid. This is the only place a price change of any size gets caught.
An invoice with no PO number is never paid without an owner's initials and a date next to it.

Step six is where the value is. A price that quietly moves, a quantity that quietly doubles, or an invoice from a supplier you did not order from will all be caught by the match — and none of them is caught by trusting the folder it arrived in.

What do you do when a supplier is genuinely the only option?

Honestly, sometimes there is no second supplier. In a small town, or a specialised trade, or where one supplier holds the only spares for your equipment, pretending otherwise wastes money you do not have.

What you can do instead:

Get the price in writing once a year, in the same way you would for a quote you had competed. Write the date next to it so the next conversation has a date to point at.
Ask what would make them more competitive. Sometimes the answer is volume, sometimes it is a slower payment term, and both are free.
Record, in one line, that they are the only option and why. Sooner or later somebody asks, and having the answer written down is worth more than having it remembered.
Decide in advance what would make you qualify a second one — what does one delivery stop cost you — and if the answer is "the business stops", spend a small amount qualifying a second supplier now and keep them warm with an occasional small order.
Review the price on a date, not when they tell you it has gone up.

The whole point is that a sole-source supplier is a normal thing to have. It only becomes a problem when it is an accident nobody noticed.

What goes in the purchase register?

One document, one row per order, kept in one place — a spreadsheet is fine, and so is a shared note if it is reliable.

Purchase register — [business name]

Date | Who asked | Item | Supplier | Amount (R) | Band | Approved by | PO no. | Reason

Keep it as a working document, not a monthly summary. Three things to get out of it at the end of each month:

Total spend per supplier, so a price change is visible against history.
Total spend in the band that should have needed approval but has none against it — the exceptions tell you where the rule is not working.
Everything above your top band, with the record of the quotes attached.

If a register is not being kept, it is almost always because nobody fills it in retrospectively. Make the register a by-product of buying: if the line is not in there, the PO number does not exist and the invoice does not get paid.

Where do you start this week?

Write the ladder with real numbers, and put it where whoever buys anything can see it.
Put the separation rule in writing: the requester cannot be the sole approver.
Approve the reorders once — list, supplier, price, minimum and maximum — so the rule has something to stand on.
Print one blank PO. Start using it for anything above your second band, from this week.
Open your bank statement and list every recurring debit on one page. Multiply by twelve. Decide what stays.

Not sure where to start? Book a free 30-minute strategy session and we will name the one gap worth fixing first: https://agentcy.co.za/#book-audit

Download the supplier purchase approvals toolkit

Agentcy builds these automations for a living. If you would rather have us map and build yours — from an R2,500 diagnostic, credited against the R8,000 audit within 30 days — book a free strategy session.