The Queue Before the Yes: Auditing Approval Layers for Cost and Control

Approval chains rarely arrive all at once. They accumulate: a sign-off added after an audit finding, a second pair of eyes introduced following a restructure, a committee stage retained because no one can remember who removed it last. Individually each layer appears defensible. Collectively they form a queue that can cost more in elapsed time and management attention than the risk it was designed to address.

For UK organisations entering the 2026 planning cycle, the pressure is twofold. Budgets remain tight and delivery expectations have not softened. The approval tax is therefore not an abstract governance concern; it is a measurable drag on throughput that sits alongside more visible operating costs. Opptimum's view is that the remedy is not wholesale delegation but a disciplined audit of what each sign-off actually protects.

Begin with a register, not a review

The instinct to review approvals often starts with an opinion: there are too many, or the wrong people are involved. A more useful starting point is a factual register. Select one recurring transaction type that matters to delivery — capital spend above a defined threshold, new supplier onboarding, contract variations, or changes to a regulated process. For a four-week window, record every approval event: the trigger, the approvers in sequence, the date each approver received the request, the date they responded, and whether the request was approved, rejected, or returned for amendment.

This register does two things. It replaces anecdote with evidence, and it exposes the difference between processing time and waiting time. In most approval chains the approver's actual review takes minutes; the delay sits in queues, inboxes, and the gaps between one stage and the next. That distinction matters because it determines whether the remedy is fewer approvers or simply better service-level expectations.

Separate genuine control from inherited ceremony

Not every sign-off is equal. A workable test is to ask four questions of each layer.

First, does this approval change the decision? If the approver has never rejected or amended a request in the review period, the layer may still be a control — but it requires evidence rather than assumption. Second, does it produce evidence that is used later, for example by internal audit, a regulator, or a board committee? If the output is filed and never read, the control may be ceremonial. Third, does it duplicate a check already performed earlier in the chain? Sequential reviews of the same document by people with similar expertise often add delay without adding assurance. Fourth, would removing it breach a statutory, regulatory, or contractual requirement? Some approvals are non-negotiable; many are not.

Classify each layer accordingly: statutory or regulatory, genuine risk control, evidence-producing, or inherited. The final category is usually larger than expected. It is also the category where reform is least contentious, because no one is arguing that the risk has changed — only that the habit has persisted.

The arithmetic of waiting

Approval costs appear in three places: management time, elapsed delivery time, and the opportunity cost of delayed decisions. The first is easiest to calculate. Multiply the number of approval events per month by the average time each approver spends reviewing, including context-switching. A chain of three approvers at twenty minutes each, handling forty requests a month, consumes forty hours of management time — a working week before any delay is counted.

The second requires the register. If the median end-to-end approval takes six working days but the median review time is under an hour, then five days and several hours are queue. For a project with a fixed delivery date, that queue is a direct constraint on throughput. The third is harder to quantify but often the largest: decisions deferred past a supplier's validity window, recruitment offers lost to competing employers, or contract variations that escalate in cost while waiting.

Set these figures against the risk actually mitigated. For each layer, ask what failure the approval is designed to prevent, how often that failure has occurred, and what it would cost if it did. Where the annualised cost of waiting exceeds the expected loss from the risk, the layer is a candidate for redesign — not necessarily removal.

A three-tier redesign

A practical response is to sort approvals into three tiers. Retain layers that are statutory, regulatory, or demonstrably effective at preventing high-severity events. Consolidate layers where multiple approvers review the same evidence; a single accountable owner with access to specialist advice is often sufficient. Delegate layers where the risk is low and reversible, using defined thresholds and post-hoc sampling rather than prior approval.

Redesign should also address the queue itself. Publish expected response times for approvers, designate a deputy for absences, and make decision rights explicit in a single document rather than scattered across policy manuals. These are governance changes, not merely administrative ones, and they require visible sponsorship from the executive team.

Keeping the audit honest

An approval audit is not a one-off exercise. Assign ownership of the register, review it quarterly, and report three measures to the appropriate governance forum: median end-to-end approval time, first-time approval rate, and the proportion of layers classified as inherited. These measures keep attention on the queue rather than on individual diligence.

In 2026 the organisations that deliver reliably will not necessarily be those with the fewest controls. They will be those that can demonstrate what each control protects, what it costs, and why it remains. That is the discipline the approval tax demands.