Who should be able to authorise payments, and up to how much?
- TimeOne meeting, plus several weeks for the bank to process changes
- CostFree, though banks are slow
- Doing itYou can do this yourself
Every UK charity's trustees should agree tiered authorisation limits, minute them, and make the bank mandate match, removing anyone who has left. A schedule might let the treasurer approve routine spending alone, need two signatories above that, and send anything larger to a trustee resolution. None of this is set by statute anywhere in the UK. It is good practice, drawn from what regulators' inquiries find.
Do this first
England and Wales: This page sets out the position in full. Scotland: the same position, with no difference in principle — OSCR’s own inquiry learning names two-person authorisation as best practice independently. Northern Ireland: the same position, with no difference in principle identified.
The real risk: a bank mandate that names former trustees
The real failure behind authorisation limits is narrower and more concrete than “decide some spending limits”. It is a bank mandate that still names a trustee who resigned two years ago. That trustee can still, in practice, authorise payments from the charity’s account. They can do so long after they stopped being accountable for how it was spent.
The charity may also be unable to use its account when it needs to. That happens because the people who are current trustees were never added. This page assumes the charity’s financial controls are already written down; if not, set up your financial controls first.
The risk is the same in England and Wales, Scotland and Northern Ireland. Regulators, the Charity Commission among them, find it again and again in their inquiries.
A mandate failure like this stays hidden until the moment it matters. A payment is needed urgently, and the person who can authorise it left the board eighteen months ago. Or a departed trustee (in the worst case, one who left on bad terms) still technically has bank access.
Both happen. Fixing it is dull work. But it is the cheapest way for most small charities to cut risk.
How should a charity set its authorisation limits?
Set them as a tiered schedule, in plain figures: who can authorise spending up to what level, and what happens above that level. The schedule turns the financial controls into names and figures.
A schedule with no route above its own ceiling is not a complete schedule. When a larger invoice comes, as it will, one of two things happens. The payment stalls, waiting for a decision nobody is authorised to make. Or someone authorises it outside their delegated authority. That defeats the purpose of having a schedule at all.
Build the “what happens above the top tier” answer in from the start. Normally, that is a full trustee resolution. What the board can delegate at all is set in the decision and delegation framework. The schedule must fit inside it.
Minute the schedule once it is agreed. The minute is the authority the bank mandate is then built to match. It is also what you point a new trustee to, or an examiner asking why a payment was approved the way it was.
Keeping the bank mandate in step with the schedule
The bank mandate should name exactly the people the schedule names. A bank mandate is the bank’s own record of who can authorise payments from the charity’s account. It is first set up when you open a bank account. It goes wrong in two opposite directions, both common:
- removing a departed trustee from the mandate — the practical failure this step exists to prevent
- adding a current trustee who was never added in the first place — often missed because updating a bank mandate is tedious paperwork that nobody owns
Give the task to one named person, with a set trigger. Whenever the trustee list changes, updating the mandate is the next action. That includes a new trustee who has just passed the checks in check every trustee’s eligibility. Do not save it up for later.
How long does a bank mandate change take?
A bank mandate change can take several weeks to process. Expect the bank itself to be the slow part. That is a reason to start as soon as the trustee list changes, not to put it off until it suits you.
Once the mandate names exactly the people the schedule names, the next step is to set up expenses and reimbursement under the same limits.
Common mistake: the mandate still names trustees who resigned years ago
Changing a bank mandate is tedious, and nobody owns the task by default. The result: former trustees keep practical access to charity funds long after they stopped being accountable for them. And the charity may be unable to use its account when it needs to. Current trustees were never added in their place.
Common mistake: setting an authorisation limit with no route above it
The schedule is written for normal spending. Then a large invoice, or an unusual opportunity, arrives that nobody expected. The payment is delayed while the board works out who can approve it. Or someone authorises it outside their delegated authority. That is the failure the schedule was meant to prevent.
Worked example
A charity sets three tiers. The treasurer alone authorises routine day-to-day spending.
Anything above that needs two signatories. Anything above the second tier — or anything outside the approved budget, whatever the amount — needs a full trustee resolution. The annual budget is the one the trustees approved. The bank mandate is updated to name exactly the people the schedule names, and nobody else.
What you should have at the end
A minuted authorisation schedule, and a bank mandate that matches it.
"Matches it" is doing real work in that sentence. A schedule the bank's own mandate cannot put into effect is not a working control, whatever the minute says. That is what happens when the mandate names people the bank has not been told about, or fails to remove people it should have. CharityIQ's Authorisation schedule template (planned) is built to the same three-tier shape as the worked example.
Common questions
No statute requires two signatories anywhere in the UK. But two-person sign-off is good practice, and OSCR's inquiry learning names it as best practice expressly. The bank mandate should then require the same signatures as the schedule. A rule the bank cannot enforce is not a working control.
Normally the full trustee board, by resolution. The schedule should name who approves spending above its top tier. A schedule with no route above its own ceiling is not complete. The payment stalls, or someone approves it outside their delegated authority, which is the failure the schedule was meant to prevent.