Automate the Approval, Not the Judgement

Look closely at any approval queue and it splits into two populations. The large one is requests that are plainly within policy, where the approver reads four fields, confirms nothing is unusual, and clicks approve. The small one needs actual judgement. The problem is that both arrive in the same queue and the large population trains people to click without reading.

The volume is the risk

An approver handling two hundred routine items a week is not exercising control by the end of it. They are pattern-matching, and the one request that deserved a question goes through with the rest. Automating the routine cases does not weaken the control — it is what makes the remaining control real.

A rubber-stamped approval is a control that exists on the process map and nowhere else.

Write the rule the approver is already using

Sit with them and ask what they check. It is usually four or five conditions, and they can state them in a sentence. That sentence is your automation.

The last line matters as much as the rule. Routing to a human with 'this failed the duplicate check' is a different task from routing with no context — it tells the approver where to look and keeps their attention on the exception.

Keep the human for the ambiguous cases

• Anything above a materiality threshold, regardless of other checks.

• New supplier, new category, or first request from a requester.

• Anything where the rule cannot be stated without the word 'usually'.

• A random sample of auto-approvals, for assurance that the rule still holds.

The random sample is not optional

An automated rule drifts out of correctness silently — a budget structure changes, a category is renamed, a supplier status stops being maintained. Sampling a small percentage of auto-approvals each month and having a human review them is how you find that out before an auditor does.

Log the decision, not just the outcome

For every automated approval, record which rule version fired and which conditions it evaluated. Six months later somebody will ask why a specific request was approved, and 'the system approved it' is not an answer that survives scrutiny. A stored evaluation trace is.

Done this way, automation moves the control earlier and makes it stronger: the policy is enforced on every single request rather than on the ones the approver had energy to read.