Ten approvals don't necessarily make a decision more certain

Why do such processes even arise? They often develop gradually. After an error, an additional check is added; after a compliance incident, another approval is required. Each individual measure can be useful on its own.

This is precisely where the approval trap lies: What seems plausible in individual cases can, in total, lead to processes becoming increasingly complex and responsibility being distributed among more and more people.

For me, therefore, the decisive factor is not the number of approvals, but their contribution to the quality of the decision. Does an authority independently assess a risk? Does it contribute a necessary expert perspective? Or does it merely confirm what others have already examined?

The four-eyes principle remains important, especially for compliance-proof processes. However, additional approvals should not be confused with additional security.

The extent of this problem is illustrated by a reform of the UK's spending and control system. The government investigated how decisions about public spending are controlled and found that duplicate and successive approvals not only waste time but can also dilute accountability.

A particularly illustrative example concerns the British tax authority HMRC. Eight interconnected digital and customer programs have previously had to pass through a total of up to 40 central approval and audit points.

In one technology program, the sequence of previous procedures alone meant that at least two months passed after the conclusion of negotiations with the supplier before the contract could be awarded.GOV.UK)

The basic idea behind the reform is that decisions should be made wherever the necessary expertise exists and the responsibility for them is borne. Central bodies will focus more on standards, strategic risks, and particularly far-reaching decisions.

A similar discussion is currently taking place at Uber. In early September 2026, the company announced major job cuts and a reorganization. Management levels will be reduced, teams merged, and structures simplified. CEO Dara Khosrowshahi justifies the restructuring, among other things, by stating that it will allow for clearer allocation of responsibilities and faster decision-making.

Of course, this is no proof that less hierarchy automatically leads to better decisions. And downsizing is not, in itself, a good organizational strategy.

The more interesting question is the underlying one: How much coordination does an organization actually need before someone can take action?

This is particularly relevant for purchasing. If every deviation, every contract amendment, and every non-standard decision has to travel through several hierarchical levels, it can significantly limit responsiveness. Especially in cases of supply problems, volatile markets, or short-term customer requirements, time itself is an economic factor.

Therefore, when designing a purchasing organization, I would not first ask which approvals we can eliminate.
I would ask which decisions should be made at which level.

A buyer needs to know the limits of their independent decision-making power. A manager must be able to recognize when a process requires their decision. And for exceptional risks, clear escalation procedures are essential.

This also includes the necessary information and skills.
Delegating responsibility without empowering people would not be an improvement.

The same principle applies to KPIs, because key performance indicators (KPIs) must also trigger something.
A dashboard shows that a supplier is repeatedly delivering late. The discrepancy is documented, and the report has been discussed. Nevertheless, nothing changes.
It's not necessarily that another key performance indicator is missing. What might be missing is a clear agreement about who needs to take action in the event of a deviation.

For me, therefore, every important key performance indicator (KPI) should be accompanied by a simple question: What decision or action is it intended to support?
If no one has an answer to that, one should check whether the metric is even needed.

Anyone who wants to review their approval and control processes should, in my opinion, start with three questions:

1. What specific risk is this release intended to prevent?
If multiple bodies are examining the same thing, each should be able to justify its additional contribution.

2. Who is allowed to make the decision – and when is escalation necessary?
Decision-making rights, technical reviews and escalation procedures should be clearly separated.

3. What action follows from a critical indicator?
Important KPIs require not only target values, but also responsibilities and agreed-upon responses.

The goal is not to have as few controls as possible. It is important to implement controls only where they actually make decisions better or safer.