A gift budget can be fully funded and still fail at the moment somebody asks, “Who may approve this order?” A practical approval matrix answers that question before a purchase is made. It links the program, total expected cost, recipient risk, decision owner, delegated authority, expiry and evidence to one recorded decision. The downloadable workbook below is an editable starting point, not a company policy or a substitute for legal, tax, privacy or employer review.
Decide what an approval actually authorizes
Approval is often treated as a single button. In a gift program it is better understood as a bounded decision: a named person permits a defined request, against a particular policy and budget version, until a stated deadline. The permission should not silently expand when the recipient list, destination country, total cost or gift type changes. The matrix is therefore a routing and evidence instrument; it does not itself confer authority.
Begin with the object being approved. Is the decision for a program design, a campaign envelope, an individual order, a recipient cohort, a vendor commitment or an exception? An annual program authorization may let operations use a catalog, but it need not waive a separate review for a public-official recipient or a large custom order. A campaign budget may be available while the actual shipment is outside its geography or eligibility. Write these boundaries in ordinary language before configuring a tool.
The COSO internal-control framework is a useful general reference for designing controls over information and decisions. The public ISO 37301 overview describes a compliance-management system that organizations establish, operate, evaluate and improve. Neither public overview publishes a universal corporate-gift amount threshold. The amounts in our workbook are hypothetical policy units for testing; your controller and local compliance owners must choose real values. This distinction prevents an example spreadsheet from being mistaken for a legal safe harbor.
If the immediate question is how to fund a program or charge it to a cost center, use the separate budget-allocation guide. This article owns the subsequent decision right: given an approved funding model, who must review a particular request, by when, and against which evidence? Keeping those questions apart reduces duplicate approvals and ambiguous handoffs.
Set thresholds by program, not by intuition
A useful threshold table has nonoverlapping lower and upper bounds. The lower bound is inclusive; the upper bound is exclusive. For example, illustrative bands of 0 to under 100, 100 to under 500, and 500 upward place an amount of exactly 100 in the middle band and exactly 500 in the upper band. Define whether “amount” means gift face value or the full expected obligation including personalization, packaging, freight, duties, tax, fees and a reasonable contingency. We recommend the all-in expected cost for routing, with the component values retained for audit. Otherwise a small gift can be approved at a low band even though its delivery commitment is much larger.
Do not copy one threshold mechanically across every purpose. Employee recognition may be a recurring, policy-based program; customer appreciation may call for relationship or conflict review; event gifts may involve a fixed deadline and bulk quantities. A low per-recipient price can still create a high campaign obligation when the recipient count is large. Conversely, a high-value item does not automatically indicate impropriety, but it does justify a deliberate reviewer and documented business rationale. The matrix should identify the metric that controls each program: per-recipient value, campaign total, cumulative annual value, or a combination with a precedence rule.
| Design dimension | Decision the policy owner must make | Evidence at intake | Failure to catch |
|---|---|---|---|
| Cost basis | Whether the band uses all-in estimated cost, per-person value, campaign total or both | Cost breakdown and quantity | Freight or production moves a request above its apparent band |
| Recipient risk | Which public-role, procurement, conflict or restricted-party flags trigger a hold | Recipient category and review result | Low price is mistaken for low risk |
| Decision rights | Named owner, second reviewer, delegate and escalation path for each band | Current authority roster | Requester approves their own exception |
| Time boundary | Approval expiry and material-change rule | Decision time and launch date | Old approval is reused after a changed campaign |
| Record | Which request, policy, quote and final disposition are retained | Stable request and decision IDs | Finance cannot reconstruct the authorization |
The table is a design checklist, not benchmark data from other companies. There is no evidence-based “normal” threshold applicable across legal entities or markets. Consider a higher cumulative threshold for repeat gifts to the same recipient, an escalation for public-sector relationships regardless of amount, and a separate review when a product could be a regulated benefit. The relevant people, not the workbook formula, decide the final policy.
The editable workbook contains a Program Setup sheet, Threshold Matrix, RACI responsibility map, Exception Log, Test Cases and Read Me. Its three example bands cover each of three hypothetical program families. The proposed route changes when the example amount crosses a band and is overridden by a conflict or public-official flag. The editable thresholds and route owners live in the Threshold Matrix sheet; the formula references those cells. An amount below zero is held for review rather than treated as a valid inexpensive gift. The formulas are an intake aid only: they do not verify authority, approve an exception or enforce local law.
Download the English six-sheet XLSX approval matrix, threshold-table CSV and responsibility-map CSV. All three files are in English. The CSVs are static exports; use the XLSX when you need the editable routing tests.
Give every route a real owner and a substitute
An approval queue without an accountable human is merely a delay mechanism. For each band, record the role, the named current holder, the funding owner, any independent risk reviewer, and the substitute who may act when the primary reviewer is unavailable. State when delegation starts and ends and who authorized it. A delegate should not be inferred from a shared mailbox or from access to the worksheet. If no valid approver is available, the request waits; urgency is not an approval credential.
Separate four activities that are easily collapsed. The requester describes the purpose, audience and cost. The program owner checks eligibility and practical fit. Finance confirms the funding source and all-in obligation. Compliance or the appropriate local specialist reviews the flagged risk. The final authorizer signs the disposition and the recordkeeper preserves the decision. One person may hold multiple roles in a small team, but the company must then document what independent check compensates for that concentration. The workbook’s RACI sheet is an editable proposal, not a claim about your organization.
Approval also needs a revocation and change rule. A price rise, a switch from employees to external clients, a new country, a public-official recipient, a different funding entity or a delayed event can alter the risk even when the request ID stays the same. Identify which changes require a new decision and which may be noted as a controlled amendment. Preserve both versions rather than overwriting the old one. An approval tied to an earlier quote cannot automatically authorize a new, more expensive custom-production obligation.
An efficient roster includes the actual role holder and a backup, not just a generic department name. Test the roster during annual leave and at quarter-end. If a substitute has a lower authority ceiling, the route must escalate at that ceiling. Add an explicit “no valid owner” hold so a formula never returns “approved” simply because a name cell is populated. This workbook proposes routes; it does not validate those authority records automatically, so the human reviewer must check them before execution.
For deeper treatment of recipient restrictions, use the global corporate-gift compliance guide. A control matrix can surface a risk flag and collect the decision trail, but it cannot resolve every jurisdiction’s gift, tax, employment, anti-bribery or privacy question. Route those questions to the appropriate specialists and record their conclusion by version.
Make exceptions narrow, expiring and reconstructable
An exception is not a second invisible policy. It is a bounded decision that says which rule is being departed from, why the ordinary route is impractical, who can authorize the departure, and when it ceases to apply. The request should identify the recipient cohort, program, full cost, event date, risk flags, alternative considered and consequence of waiting. A general note such as “leadership approved” is not enough to reconstruct the decision.
The Exception Log sheet gives each proposed departure a stable ID, program, reason, requester, authorized approver, expiry date and status. For a real process, also attach the original request and quote, applicable policy version, actual decision record, delegate authorization if any, and proof of downstream disposition. A rejected or expired exception remains in the history. Do not delete it to make the register look clean. Link the final order back to the decision ID, or a later reviewer may have to guess which approval covered which shipment.
Emergency handling should protect both speed and independence. A defined duty officer can triage an imminent event, but the escalation rule must still say which risk types cannot be waived, who may decide, and whether retrospective review is allowed. “Ship now and fix paperwork later” is not a neutral fallback, especially if fulfillment creates an irreversible obligation. If an item cannot be held, the responsible owner must explicitly accept or reject that exposure under the actual policy; the gifting team should not improvise a substitute authorization.
Emergency exception: a short decision sequence
-
Freeze the request version and capture the deadline, quote, recipients and risk flags.
-
Identify the policy clause and the authorized exception owner; if either is missing, hold the order.
-
Record the options: delay, reduce scope, use a preapproved alternative or seek a narrowly bounded exception.
-
Log the decision ID, approver, time, expiry, affected units and conditions before commitment.
-
Reconcile the eventual fulfillment and close the exception with evidence; retain a rejected or expired record.
This panel is an operating pattern, not permission to bypass a legal restriction. It is especially important to separate the question “May we make this gift?” from “Can a vendor deliver it on time?” An operations team can estimate lead times; only the designated legal, compliance, tax, payroll or employer owner can decide its own domain.
Worked decision 1: a recognition program at the boundary
Hypothetical case. An HR team plans an employee-recognition wave of 80 gifts. Each example gift is 75 policy units, and estimated packaging and delivery add 20 per person. The all-in per-recipient estimate is therefore 95, but the campaign commitment is 7,600 policy units. Suppose the company’s actual policy routes on both per-recipient value and campaign total, using the higher required approval path. The simple workbook example routes 95 through its lowest band; it cannot infer the campaign-total clause unless the team records and applies it. The finance owner must map the requested amount to the approved metric before treating the output as usable.
The requester enters the program, audience, quantity, all-in estimate, budget reference, destination mix and desired ship date. HR verifies who is eligible and whether any recipient is duplicated across an anniversary and performance cohort. Finance checks whether 7,600 is available in the relevant period and which entity pays. The policy owner identifies the actual approver for this combined exposure and records whether a delegate can act. Operations obtains a quote that includes shipping assumptions, not just the gift face value.
Consider two alternatives. One consolidated approval for a clearly defined wave reduces repetitive administration but needs a tight recipient rule and a maximum commitment. Individual approvals offer granular visibility but may consume time and encourage splitting a campaign into small requests. The better choice depends on the company’s risk appetite and control evidence, not on a template preference. The budget-allocation guide explains the separate question of central versus cost-center funding; it does not replace approval rights.
Now change the estimate from 95 to 105 per recipient after a freight quote. The workbook crosses its illustrative boundary of 100 and proposes the next route. The original decision should be marked superseded if the real policy uses that boundary, and the revised quote should receive a new approval before purchase. If 20 employees are removed, recalculate both the campaign obligation and recipient eligibility; a reduction may not require a lower-level reapproval, but the change and policy interpretation should be documented. Acceptance evidence consists of the final cohort version, all-in quote, available budget, correct approver record, decision time, expiry and a fulfillment reconciliation back to the same request ID.
Failure recovery matters. If a manager approved the face value but not delivery cost, stop before committing funds, preserve the incomplete decision, and send the corrected total to the proper owner. If the organization has already committed, record the variance and use the exception route rather than altering the original amount to make it appear preapproved. This case shows why a threshold matrix must name both the measured value and the change rule.
Worked decision 2: a client gift with a risk override
Hypothetical case. A regional account team proposes a 60-unit thank-you gift for a person involved in an active procurement decision. The example amount sits below the workbook’s first boundary. Yet the relationship and timing create a conflict question independent of price. The requester marks the conflict flag, and the example formula returns a compliance hold rather than the low-band program owner. This is the correct behavior for an intake aid: it directs review; it does not decide whether the gift is permissible.
The account owner supplies the recipient’s role, business rationale, procurement timeline, company relationship, intended item, all-in cost, delivery country and any prior gifts that the team can lawfully identify. Compliance checks the applicable company rules, recipient organization restrictions and local requirements. Finance validates the budget but does not treat funding as permission. The decision owner may reject the gift, delay it, choose a non-gift alternative or approve a bounded action under an actual policy. Operations must wait for the recorded disposition before releasing an order.
One alternative is a shared educational item or public event material instead of an individual gift. That may reduce appearance concerns, but it is not automatically acceptable; the exact recipient, timing and rules still matter. Another is to defer the gesture until the procurement process ends, which may be safer but weakens the immediate relationship objective. The comparison is not a fabricated risk score. It presents options and what evidence each option would require. If no acceptable route exists, “no gift” is a legitimate outcome.
Suppose the account team then removes the flagged person from the list. That is a material recipient change, not a reason to clear the flag on the old request. Preserve the original hold and create a revised cohort version with the remaining recipients. Compliance decides whether the revised group needs review. The accepted audit packet contains the initial flag, hold, reviewed recipient version, decision, any conditions and proof that fulfillment used only the authorized cohort. If a gift was accidentally ordered during the hold, record the incident and determine whether it can be canceled; do not backdate an approval.
This risk override also applies to public-sector relationships. The workbook has a separate public-official flag because a low amount must not suppress specialized review. It contains no jurisdictional monetary safe harbor. A legal or compliance specialist owns the answer under the relevant policy and law.
Test the matrix as a system, not a pretty table
The Test Cases sheet verifies the illustrative routing logic at 99, 100, 499 and 500 policy units, across different programs and both risk flags. In the build test, raising the first editable threshold from 100 to 125 changed the 100-unit route from the middle band to the low band; restoring it returned the expected result. Those checks establish that the example formula reacts to a changed threshold. They do not prove that the company’s policy is complete or that the chosen numbers are appropriate.
Before adoption, add company-specific tests. At each boundary, check the amount just below, exactly at, and just above it. Test a changed program name, a negative or blank amount, cumulative spend, mixed currencies, an unknown recipient category, missing cost center, unavailable approver, delegate outside their term, expired approval and a changed quote. The workbook routes negative amounts to hold, but it does not automatically verify currency conversion, approver authority, expiry or delegation. Those remain named human or system controls to implement and test. A missing control should be visible as a gap, never silently treated as a passing case.
For every test, state the input version, expected disposition, actual disposition, reviewer and correction. Do not only record “pass.” If a band overlaps another, decide which rule wins and rewrite the table so it is mutually exclusive. If there is a gap, decide whether the request should hold by default. If a risk flag is overridden by a lower-level amount rule, correct precedence before launch. If a delegate can approve beyond their limit, fix the authority roster and retest. A useful matrix fails safely when the inputs are incomplete.
The adopted workflow also needs an audit trail outside the spreadsheet: immutable request ID, policy version, budget version, decision timestamp, approver identity, supporting quote, recipient-list version, amendment history, order reference and final reconciliation. Limit access to recipient information; retain only what your privacy policy requires and permits. A workbook circulated by email can be a planning artifact, but it is not automatically a controlled system of record. The gifting-operations guide addresses the broader operational handoff after the decision.
Choose a tool only after you know the control
The approval model can live in a controlled spreadsheet, a procurement platform, a ticketing workflow or a gifting platform integrated with the organization’s decision process. Compare them on the same dimensions: whether each can enforce or merely display thresholds, identify current approvers, capture risk flags, preserve versioned evidence, support delegation, and prevent commitment during a hold. A spreadsheet is transparent and easy to adapt but requires disciplined access and manual enforcement. A procurement tool may support strong approval history yet lack recipient or fulfillment context. A gifting platform may simplify program execution but should not be assumed to replace the company’s legal, tax, payroll, privacy or finance decisions.
Giftpack’s official site describes its branded storefronts, rewards, automation and global fulfillment offering. For this use case, evaluate whether a proposed Giftpack configuration can receive an already approved program and carry the correct identifiers, budget references, recipient eligibility and delivery conditions into execution. Confirm actual feature behavior, roles, integrations, contract terms and evidence export for the specific proposal; do not infer them from a category label. Another platform, procurement workflow or internal process may be a better fit when the principal requirement is legal approval rather than gifting fulfillment. There is no default vendor ranking in this matrix.
The first implementation decision is therefore modest: choose one program, one funding owner, one risk owner and a small set of boundary cases. Run the process in parallel with the current method, compare decisions, and resolve differences before replacing it. Keep the matrix versioned, train requesters on what “hold” means, and give finance a way to reconcile actual commitments against the approved request. Refresh the authority roster when people or policies change, not merely when the workbook is downloaded again.
Conclusion: a decision is complete only when its evidence survives
An effective approval matrix is a compact agreement about measurement, authority, risk precedence, time and proof. It lets a routine request move without guesswork and sends unusual requests to the right owner before a commitment is made. The downloadable workbook provides localized sheets and boundary tests, but the organization must replace illustrative thresholds, validate local obligations, approve its own roles and preserve a real decision record. If the procedure cannot explain who approved which version, or what changed afterward, it is not yet ready to govern fulfillment.
Once those decisions are in place, Giftpack can be evaluated as a way to execute a defined gifting program and its delivery requirements; the company’s finance, compliance, legal, tax, payroll and privacy owners remain responsible for their own decisions.