Authorised by Whom? The Register That Turns Trust Into Continuity

In many UK owner-managed companies, the most important commercial document is unwritten. The owner knows which supplier can be engaged, which customer can be offered credit, and which payment can be released. Staff know to ask. The arrangement works while the owner is present. It fails on the first morning of a hospital stay, a foreign holiday with poor signal, or a sudden opportunity that requires a signature before a meeting can be arranged.

The problem is not trust. It is the difference between personal confidence and legal authority. A long-serving colleague may be trusted with the company's future and yet be unable to authorise a £4,000 transfer because the bank mandate names only the founder and one retired accountant. A supplier may accept instructions from a familiar voice, but its terms may require notice from a director. A customer may treat an account manager's assurance as binding until a dispute reveals that the assurance was never within that person's remit.

A delegated authority register is a plain response. It records, in one place, who may commit the business to what, up to which value, and when a second signature is required. It is not a corporate constitution. It is a working document that should be short enough to be read and specific enough to be used.

The afternoon audit

The register can be drafted in an afternoon, provided the owner is honest about how decisions are actually made. Begin with the last twelve months of bank statements and purchase invoices. Mark every payment or commitment that required the owner's involvement. Group them by type: payroll, premises, professional fees, stock, equipment, marketing, travel, repairs, subscriptions. For each group, ask three questions. What is the ordinary monthly value? Who currently instructs the spend? Who currently signs?

Then list every external party that holds a mandate or a contractual right to rely on a signature: banks, payment providers, landlords, insurers, key suppliers, professional advisers, and any lender. Compare the list with the people who, in practice, give instructions. The gap between the two is the risk.

The audit usually produces a short set of thresholds rather than a complex matrix. A small business may need only four bands: routine spend below £500; operational spend between £500 and £5,000; significant commitments between £5,000 and £25,000; and anything above £25,000. The figures should reflect the business, not a template. A retailer with thin margins may treat £5,000 as significant. A consultancy may not.

What the register should say

A useful register contains six columns: type of commitment; ordinary value; person authorised to initiate; person authorised to approve; second signature required?; and documents that must be attached. The last column matters. A purchase order without a quote, or a credit note without a delivery record, is an authority problem waiting to become a cash-flow problem.

The second signature should not be reserved for the largest transactions alone. It should apply wherever the business is exposed to an irreversible commitment or a conflict of interest. That includes new bank accounts, changes to signatories, any borrowing, leases, settlement of disputes, write-offs above a stated value, related-party payments, and any contract that runs beyond twelve months. It also includes payments to the owner or to a person connected with the owner. The point is not suspicion. It is the ordinary discipline of separating initiation from approval.

For many owner-managed businesses, the second signatory will be a fellow director, a finance manager, or an external adviser with a defined role. Whoever it is, the register should name the deputy as well. A second signature that depends on one person being available is not a control. It is a single point of failure with an extra step.

Make the bank and the suppliers agree

A register that is not reflected in bank mandates and supplier terms is an internal fiction. Banks will generally act on the mandate they hold, not on a spreadsheet. If the register says that two directors must approve payments above £10,000, the mandate should say the same. If a finance manager is to authorise routine payments, the bank should recognise that authority within the agreed limits.

Supplier terms deserve the same treatment. Many standard terms allow a supplier to rely on instructions from anyone who appears to act for the customer. Others require notice of authorised signatories. It is worth checking the larger contracts and sending a short letter or email confirming who may instruct work and who may approve variations. This is not an accusation of bad faith. It is the commercial equivalent of keeping the contact list current.

The moment the gap appears

The candid moment in many businesses arrives when the owner is unavailable and a trusted colleague tries to act. The colleague may have run the office for a decade. They may know the customers better than the owner. But when the bank asks for a mandate, or the supplier asks for a purchase order signed by a director, the colleague discovers that trust has no legal weight. The business then waits. Sometimes it waits for a courier. Sometimes it waits for a hospital visiting hour.

A delegated authority register cannot remove every interruption. It can ensure that the interruption does not become a commercial stoppage. It also improves day-to-day decisions. When people know the limits of their authority, they spend less time seeking unnecessary permission and more time acting within their remit. The owner, in turn, spends less time approving matters that do not need a founder's judgement.

A short document, reviewed honestly

The register should be dated, signed by the directors, and reviewed at least annually. It should be stored where the people who need it can find it, not in a folder that only the owner can open. It should be shared with the bank and, where relevant, with key suppliers. And it should be tested. A simple test is to ask two colleagues to complete a routine transaction while the owner is deliberately out of contact for a day. The result will show whether the register is a document or a decoration.

For the owner-managed business, the second signature is not a sign of diminished control. It is evidence that control has been designed to survive the owner's absence. The cost is an afternoon and a short conversation with the bank. The alternative is a business that can be stopped by a single unavailable pen.