Every organisation that has implemented purchasing approval software and then watched people buy things on a card anyway has learned the same lesson: the control only exists if the process is faster than the workaround. That makes elapsed time the metric that decides whether the software worked, and it is not the metric most implementations measure.
Measure the wait, not the work
The decision itself takes a minute. What takes days is the request sitting unread, or sitting with somebody who is not the approver, or waiting for somebody on leave. Instrument the elapsed time from submission to decision, look at the distribution rather than the average, and the long tail will tell you exactly which rule or which person is generating the delay.
Design for absence and for ambiguity
Two cases produce most of the tail. An approver who is away and has no delegate, and a request that nobody is sure they own. Automatic delegation handles the first. An explicit default owner for anything unrouted handles the second, and it is better than a request sitting in nobody's queue while everyone assumes somebody else has it.
Keep the rules simple enough to explain
Approval matrices grow because each exception seems reasonable at the time. A rule set nobody can explain produces requests routed to surprising people, which produces delay and mistrust. If the routing cannot be described in three sentences, it will not be maintained and it will not be believed.
Questions people ask about purchasing approval software
How fast is fast enough?
Faster than the workaround available to your staff. If a card purchase takes an hour, an approval that takes three days will be bypassed for anything urgent, whatever the policy says.
Should approvals happen on a phone?
For most organisations yes, because the delay is usually an approver away from a desk. What matters is that they can see the amount, the supplier and the reason before deciding, not just a reference.
How do we handle emergency purchases?
With a documented fast path and a named approver, reviewed afterwards. Pretending emergencies do not happen just moves them outside the system where nothing records them.