The board of directors is primarily responsible for ensuring that commitments are authorized. Directors hold fiduciary duties of care and loyalty, and they discharge those duties through a formal delegation chain: charter provisions, board resolutions, officer authority limits, and signature policies. Management executes commitments inside that framework, but the board owns the system that makes authorization lawful and traceable.
That answer holds across corporations, partnerships, and LLCs, though the mechanics shift with entity type. This explainer goes deeper than most summaries by showing how authorization actually flows, where it breaks, and what the numbers look like at each threshold.
The authorization chain runs from statute to signature
State corporate law supplies the foundation. Under Delaware General Corporation Law Section 141(a), a corporation's business is "managed by or under the direction of a board of directors." That phrase carries the whole structure: the board may delegate, but it cannot delegate away its oversight role. Every downstream authority, from the CFO's purchase approval to a branch manager's contract signature, traces back to a board action.
The chain has four links. First, the certificate of incorporation and bylaws define what the board may do and which decisions need shareholder votes. Second, board resolutions authorize specific commitments or create standing delegations. Third, officer certificates and written consents document who holds which authority. Fourth, signature policies and internal approval matrices translate paper authority into daily practice.
Each link has a failure mode. Bylaws that conflict with statute void the delegation. Resolutions that never specify dollar limits create silent authority creep. Officer certificates that go stale after leadership changes produce phantom signers. Approval matrices that live only in email leave no defensible record. The board is responsible for closing all four gaps, not just the first.
Quantified context: where authority thresholds sit in practice
Authorization limits are not standardized by law, which is exactly why boards must set them. Common corporate practice clusters officer approval authority into tiers. Front-line managers often hold purchase authority of roughly USD 5,000 to USD 25,000. Directors and senior managers frequently sit between USD 25,000 and USD 100,000. Vice presidents commonly hold up to USD 250,000 to USD 500,000. Chief financial officers often reach USD 1 million to USD 5 million. Anything above the top officer tier typically requires board or board-committee approval. These are industry norms, not legal requirements, and boards should calibrate them to company size, cash flow, and risk tolerance.
The delegation instrument itself matters as much as the number. A resolution stating "the CFO may approve contracts up to USD 1,000,000" grants different authority than one stating "the CFO may approve capital expenditures up to USD 1,000,000, excluding related-party transactions and real property." Scope, exclusions, and expiry dates convert a permission slip into a control.
Public companies add another quantitative layer. Securities and Exchange Commission rules require disclosure of certain executive compensation and related-party transactions, which means the board's authorization record becomes a disclosure input, not merely an internal formality. Private companies face bank covenants that often cap aggregate authorized indebtedness at fixed dollar figures, so a single unauthorized commitment can trigger a technical default.
Edge cases that test the delegation architecture
Related-party transactions are the classic stress test. When a director or officer has a personal interest in a commitment, most state laws permit the transaction if it is approved by disinterested directors after full disclosure, or by shareholders, or if it is fair to the corporation at the time. The board's responsibility is procedural: ensure the disinterested approval actually happens and is documented. A company that lets an interested CEO sign without recusal has an authorization defect even if the price was fair.
Emergency authority creates a second edge case. Boards sometimes adopt resolutions granting limited emergency powers, such as a standing committee authorized to approve expenditures up to a stated cap during a declared crisis. These grants need hard expiry dates. An emergency resolution without a sunset clause becomes permanent delegated authority through inattention.
Subsidiary and joint-venture structures add a third. A parent board's resolution does not automatically authorize commitments made by a partially owned subsidiary, because the subsidiary's own governing documents and its other owners' consent rights control. Boards that assume downstream authority without checking entity-level consents discover the gap during diligence, audits, or litigation.
Red flag: officer signature blocks that list titles but no dollar limits. Red flag: board resolutions with no expiration date or no excluded transaction types. Red flag: approval matrices maintained only in email threads or shared drives. Red flag: commitments signed by people whose officer certificate was never updated after a promotion. Red flag: subsidiary contracts executed without checking parent or co-owner consent requirements.
One counterintuitive detail deserves emphasis. The board's duty is not to approve most commitments; it is to ensure the approval system is designed, staffed, and monitored. Directors who personally sign hundreds of small contracts can still fail if the delegation architecture is undocumented. Conversely, a board that approves only a dozen resolutions per year can satisfy its duty if those resolutions create clear, auditable authority tiers and if the audit committee tests them.
Misconceptions about who authorizes what
The most common misconception is that the CEO is primarily responsible for authorization. The CEO is typically the largest single holder of delegated authority, but the authority exists because the board granted it. Remove the resolution and the CEO's signature loses its legal basis inside the entity. Courts evaluating ultra vires claims look to the governing documents and board actions, not to the seniority of the signer.
A second misconception treats authorization and approval as synonyms. Authorization is the antecedent grant of power; approval is the specific decision to proceed. A vice president may be authorized to sign contracts up to USD 500,000 but must still obtain approvals from legal, finance, and the business unit before exercising that power. Boards design both layers, and confusing them lets authorized signers bypass required reviews.
A third misconception assumes shareholder approval covers everything. Shareholders vote on charter amendments, mergers, and certain equity issuances, but they do not manage ordinary business commitments. A shareholder vote cannot cure an authorization defect in a routine contract, because the board, not the shareholder meeting, holds the management power.
A fourth misconception holds that ratification fixes any unauthorized act. Ratification can validate a prior commitment, but it requires a properly informed decision by the body holding the authority, and it cannot cure acts that are void under statute or that harmed third parties who relied on the absence of authority. Ratification is a repair tool, not a substitute for design.
Comparison: authorization instruments and what they control
| Instrument | Who adopts it | What it authorizes | Typical limit | Failure mode |
|---|---|---|---|---|
| Charter provision | Shareholders and board | Entity powers, share classes | Statutory floor | Conflicts with state law |
| Bylaws | Board, sometimes shareholders | Officer roles, meeting rules | Procedural | Silent on dollar authority |
| Board resolution | Board or committee | Named officers, specific deals | Stated dollar cap | No expiry or exclusions |
| Officer certificate | Board secretary | Individual signer authority | Tied to resolution | Stale after promotion |
| Signature policy | Management under board direction | Daily approval routing | Internal tiers | Undocumented in email |
| Written consent | Board or committee | Single commitment | Deal-specific | Missing disinterested recusal |
The table reveals a hierarchy. Charter and bylaws set the frame, resolutions and certificates grant specific power, and policies operationalize the grant. A defect at any row propagates downward, which is why boards must review the full stack annually rather than only when a deal surfaces.
Timeline: how a commitment becomes authorized
| Stage | Typical duration | Action | Owner | Evidence produced |
|---|---|---|---|---|
| Charter and bylaws adoption | Weeks to months | Founders and counsel draft governance frame | Board and shareholders | Filed charter, adopted bylaws |
| Delegation resolution | One board meeting | Board sets officer tiers and exclusions | Board | Signed resolution |
| Officer certificate issuance | Days | Secretary documents current signers | Corporate secretary | Certificate on file |
| Internal policy rollout | Weeks | Finance and legal build approval matrix | CFO and general counsel | Published policy |
| Commitment request | Days to weeks | Business unit routes request through tiers | Requesting manager | Approval record |
| Signature and documentation | Days | Authorized signer executes | Authorized officer | Executed contract |
| Periodic authority audit | Quarterly or annually | Committee tests compliance | Audit committee | Audit findings |
The timeline shows that authorization is a cycle, not an event. The audit stage is where most failures are caught, and it is also the stage boards most often skip when cost pressure rises. A board that adopts resolutions but never tests them has delegated authority without verifying its use.
Practical actions: building and testing the authorization system
Boards and executives can make the system defensible with a small set of concrete steps. Each step produces evidence that survives audits, bank reviews, and litigation discovery.
First, adopt a written delegation resolution that states dollar tiers, transaction exclusions, and a mandatory review date at least every 12 months. Second, maintain a current officer certificate signed by the corporate secretary, updated within 10 business days of any leadership change. Third, publish an approval matrix that maps every commitment type to its required reviewers and signers. Fourth, require disinterested approval and documented recusal for any related-party commitment, regardless of dollar size. Fifth, run a quarterly sample test of at least 10 executed commitments against the matrix and report exceptions to the audit committee. Sixth, set an absolute escalation threshold, commonly USD 1 million to USD 5 million depending on company size, above which no officer may sign without board or committee approval.
The thresholds should reconcile explicitly. If the delegation resolution caps the CFO at USD 2 million, the approval matrix must not route USD 3 million contracts to the CFO, and the signature policy must not let the CEO absorb the difference silently. Where internal policy is stricter than the board resolution, the stricter rule governs. Where a bank covenant caps total indebtedness, that covenant becomes a hard ceiling that overrides all internal tiers. Document the reconciliation so no signer has to guess which limit applies.
Limitations and what this article cannot resolve
Authorization law varies by state and entity type, and the dollar figures above reflect common practice rather than statutory mandates. Companies with unusual capital structures, regulated industries, or cross-border operations face additional consent layers that this framework only sketches. The board's responsibility is universal, but its specific instruments are not, and readers should confirm requirements with counsel licensed in the relevant jurisdiction.
This article is general educational information about corporate governance, not a legal opinion or a compliance certification. It does not create an attorney-client relationship and should not be relied on to validate any specific commitment or delegation. Consult a qualified corporate attorney in your jurisdiction before adopting or revising authorization resolutions, officer certificates, or approval policies.