The Approver on Leave

The racking in aisle four failed its inspection on a Tuesday. The warehouse raised a requisition for replacement bays that afternoon, the operations manager signed the first step the same evening, and on Wednesday morning it sat at step two: Finance Manager — Helen. Helen was on a beach. She had been on a beach since Saturday, she would be on it for another nine days, and aisle four was taped off with a forklift parked across the end of it.

By Thursday somebody had phoned her. Helen, being helpful and sunburnt, read out her password. Marco, her deputy, signed in as Helen and pressed Approve. The racking arrived the following week, and everyone agreed it had been handled sensibly.

It had — operationally. What it did to the record is the subject of this post, because the record now says that Helen approved a requisition from a beach, on a device she has never used, at an hour she was asleep. Every line of that is false, and it is false in the one document whose whole job is to say who decided.

Why one person away stops everything

An approval chain is built to concentrate a decision. That is the point of naming a person or a role on a step: spend over a certain size should be looked at by somebody specific, who is accountable for having looked. The same concentration that makes the control useful makes it fragile. A step addressed to one person waits for exactly one person, and annual leave, illness, a site visit with no signal and a resignation all look identical from inside the queue.

Every organization with approvals meets this within the first holiday season, and most of them reach for one of two fixes. Both work. Both are quick. And both destroy the thing the approval existed to produce.

The first fails loudly in an audit and quietly everywhere else: a shared credential means the whole account was handed over, not one decision, and nothing distinguishes the decisions made by the owner from the ones made by her guest. The second fails the other way round. The record is truthful about who pressed the button, but the authority behind it has been spread across a role, so the question an auditor actually asks — was this person entitled to approve this, on this day? — has the answer “everyone was, from March onwards”. We have written before about why approval should be a separate permission from action, and about the combinations that segregation of duties exists to prevent. A holiday is the most common way both are undone.

What an honest hand-over has to say

Strip the problem down and a hand-over is a small, specific statement. It is worth writing out, because each part is something one of the two workarounds loses.

• Who is away, by name — the person whose steps are waiting.
• Who is covering, by name — one person, chosen by the one who is away.
• Between which dates, so the authority starts and stops without anybody remembering to switch it off.
• Over what — the approval steps that would have waited for the absent person, and nothing else they can do.
• And on every decision made under it, both names: the person who signed, and the person they signed for.

A shared password keeps none of these. A widened permission keeps the second and loses the rest. The last point matters most, because it is the one that survives: long after the leave, the dates and the arrangement are forgotten, and the trail is the only place the hand-over still exists.

How cover works in our approval chains

Our version is called out-of-office cover, and it is deliberately small. It is set by the person going away, for themselves, and it needs no permission to set — because it can only let the delegate sign what the person away could have signed.

1. Open Out of Office in your settings

   On the web under Settings, or in the mobile app. It lists your current and upcoming cover, and you can remove one if your plans change.

2. Choose who covers you

   Somebody else in your organization. You cannot choose yourself, and you cannot choose somebody who is away today and has handed their own approvals to someone else.

3. Set From and Until

   Whole days, both included. The start cannot be in the past and the end cannot be before the start. Cover begins and ends on those dates by itself; there is nothing to switch back when you return.

4. Add a note if it helps

   “Annual leave, back on the 14th.” Setting cover is written to the audit log with both names and both dates.

While the cover runs, two kinds of step become signable by the delegate. A step that names the person away can be signed by their delegate. A step that needs a role the person away holds can be signed by their delegate too — so if Helen is a Finance Manager and a step needs any Finance Manager, Marco can sign it during her leave even though the role is hers and not his.

The rules that do not bend for cover

A delegation is a place where controls are commonly weakened by accident, because the delegate is usually a close colleague who is also involved in the work. So the rules that hold on an ordinary approval are held in exactly the same way under cover.

The test of a delegation is not whether the work moved. It is whether, a year later, the record can say who decided and why they were allowed to.

The last rule deserves a sentence of its own. If Helen hands her steps to Marco, and Marco goes away the following week and hands his to Dana, it is tempting to let Dana inherit Helen’s steps too, so that nothing stalls. We refuse that on purpose. Helen chose Marco. Nobody chose Dana for Helen’s approvals, and a chain of hand-overs nobody chose is the same problem as a widened permission, arrived at by a longer route. Cover is checked one link deep: Dana can sign Marco’s steps and only Marco’s. When Helen sets cover, she cannot choose somebody who is away that day and covered by somebody else.

What cover reaches, and where it stops

Cover lives inside our value-based approval rules, and those cover three kinds of document: procurement requests, quotation awards (the step before a purchase order) and supplier bills. The rules are opt-in per workspace. A workspace that has not set any approves those documents on permission alone, as it always did — and in that world there is no named person to be away, because anyone holding the permission can approve.

The second tool is a temporary role: an administrator grants someone a second role until a date, with a written reason, and the role ends by itself when the date passes. That is the right instrument when the cover needs to be broader than approval steps, or for the documents a chain does not govern — expense claims, staff advances, petty cash, payment runs and leave are approved on permission today, and out-of-office cover does not reach them. A temporary role is honest in its own way: the grant, its reason and its end date are on record, and the decisions made under it are the deputy’s own.

Two practical consequences are worth knowing before the leave starts. First, cover hands over steps, not screens. The delegate still needs to be able to reach the Approve button for that kind of document; a supplier bill, for example, needs the bill-approval permission whatever the cover says. Check that before the person leaves, not on the day the bill is due. Second, how the delegate finds out. When a chain moves on to a step that waits for somebody away, their delegate is notified as well as them, and covered steps appear in the delegate’s waiting-on-me list in the app and on the procurement overview. From a phone, the push carries Approve and Reject buttons only where the delegate holds the permission to approve that record; otherwise it opens the record.

Frequently asked questions