Hong Kong SME governance guide · Free approval checklist
SME approval matrix and four-eyes control for lenders
Who may approve a loan, up to what amount and at what level of risk is a control, not a convenience. An approval matrix writes that down, and the system should enforce it rather than rely on people remembering it.
Core definitions
Put similar concepts in the right place
Each component solves a different problem. Complete lending operations depend on clear data and workflow hand-offs.
| Item | What it does in practice |
|---|---|
| 01Authority limits | The largest amount or riskiest grade each role may approve alone. |
| 02Escalation | Cases above a limit go to the next level, with the reason recorded. |
| 03Four-eyes control | A second person confirms decisions that carry extra risk, so no one decides alone. |
| 04Segregation of duties | The person who prepares a case is not the person who approves it. |
| 05Policy exceptions | Departures from policy need a reason and an approver at the right level. |
| 06Decision record | Who decided, when, on which version of the case, and why. |
Background
Why approval authority is a control
An approval is a lender taking on risk. The matrix decides who is allowed to do that, and how much.
What the matrix controls
Lending creates risk with every approval. The matrix limits how much of that risk any one person can take on, and makes sure that bigger or riskier decisions are made by people with more authority.
Maker and checker
Separating the person who prepares from the person who approves means a mistake or a shortcut has to survive a second look. For exceptions, a second authorised person adds the same protection where it matters most.
Version control of a decision
An approval applies to the case as it stood when it was given. If figures, security or terms change afterwards, the approval should not silently carry over. Tying the decision to a version keeps the record honest.
Evidence for auditors
Auditors, regulators and successors ask who approved a loan and on what basis. A decision record that cannot be altered without trace answers that without argument.
Book an SME lending walkthrough
A working session on your own approval matrix.
Workflow
How an approval runs
- 01
Set the matrix
Define limits by amount, risk grade and product for each role.
- 02
Route the case
Send each case to an approver whose limit covers it.
- 03
Escalate when needed
Pass cases above the limit to the next level, with the reason.
- 04
Check exceptions
Require a second, authorised person to decide any policy exception.
- 05
Tie the decision to a version
Record the decision against the version of the case that was approved.
- 06
Review the record
Let audit and credit risk review decisions, exceptions and overrides on a schedule.
Printable worksheet
Free: 10-point approval control checklist
Use it with credit, risk and internal audit. This is an operational self-assessment, not legal or compliance advice.
Practical evaluation
Three things auditors look for
A limit nobody enforces is a suggestion
If the system lets anyone approve anything, the matrix exists only on paper.
Approve the version you read
If a case can change after it was approved, the approval no longer matches what was decided.
Exceptions are where judgement replaces policy
Making exceptions visible, with a reason and an approver, is the control.
Frequently asked questions
Quick answers
What is an approval matrix?
An approval matrix is a table of who may approve what: the limits by role, amount and risk, and what happens above them.
What is four-eyes control?
Four-eyes control means a second person must confirm a decision before it takes effect. It is also called maker-checker.
Does Covenant Desk enforce authority limits?
Yes. Covenant Desk applies authority limits and escalates to higher approvers. A second-person check on policy exceptions is available, and you can require it.
Is the decision log protected?
The action log is append-only and hash-chained, so changes to it can be detected.
Primary sources
Official sources and editorial note
This guide reflects official material available on the review date. Requirements can change; each institution should check the latest licence conditions and obtain legal or compliance advice. This page is not legal advice. Read our editorial and corrections policy.
Next step
See authority limits and four-eyes checks on one SME case.
Talk to us about your approval matrix, or try the Covenant Desk platform that applies it.
Covenant Desk is lending operations software. It does not provide loans, issue credit reports or replace the lender’s final credit decision.