What Is an Email Approval Workflow? Getting Quotes, Payment Confirmations and Formal Letters Approved First

An email approval workflow is a process that routes a company email — a quote, a payment confirmation, a formal letter — to one or more approvers before sending, recording every step with date and time. It catches wrong quotes, fraudulent payment confirmations and unauthorised commitments before they leave. Applied only to risky messages, it does not slow work down.

Key takeaways

• An email approval workflow lets an authorised person approve, request a revision of, or reject a risky email before it is sent.
• The main emails that need approval are price quotes, payment confirmations, bank details, contract changes and correspondence with public authorities.
• According to the FBI IC3 2025 report, 24,768 BEC complaints in the US reported losses of $3.05 billion.
• For emails containing payments or bank details, approval by two different people is the email equivalent of the four-eyes principle.
• SmartMail, part of Digital Bridge's Smart360 family, has send approval built in and records every step with date and time.

Why do you need an email approval workflow? One person controls the "Send" button

Most companies have required two signatures on purchases and dual approval on payments for years. Yet the email that puts the same decision in writing usually goes out on one person's judgement. A sales rep sends a quote at the wrong price, an accounts clerk confirms to a supplier that "we are paying into your new account", a project manager commits to a delivery date they had no authority to promise. If a message has also gone to the wrong recipient, the first-hour steps are in email sent to the wrong recipient.

The issue is not carelessness; it is the absence of a second pair of eyes in the process. In many firms the "second pair of eyes" on email works like this: the employee forwards a draft to their manager, the manager replies "fine", the employee sends the email. Forwarding a draft and waiting for a "fine" has three weaknesses:

• Nobody can be sure the text that was approved is the text that was sent.
• The approval sits in a separate email thread and cannot be found months later.
• When the manager is on leave, the process either stalls or gets skipped.

What does unapproved sending cost a business?

The most expensive consequence of having no email approval workflow is payment diversion fraud. The attacker poses as a supplier or an executive, and a single person's reply confirms the payment. Its most common forms are fake invoice email scams and freight payment fraud in logistics.

According to the FBI's Internet Crime Complaint Center (IC3), 24,768 business email compromise (BEC) complaints in the US reported total losses of $3.05 billion in 2025. (FBI IC3 2025 Internet Crime Report)

The amounts requested are growing. According to APWG's Phishing Activity Trends Report for Q2 2026, the average amount requested in wire-transfer BEC attacks rose to $61,732, up 45% from the previous quarter's average of $42,663.

Attacks built on a fabricated story are on the rise too. In the Verizon 2026 Data Breach Investigations Report, pretexting reached 6% of all breaches as an initial access vector, while phishing remained at 16%. Pretexting works by persuading someone to act on a convincing scenario; a second approver is the cheapest way to break that scenario.

Timing matters as well. In 2025 the FBI IC3 Recovery Asset Team initiated 3,900 Financial Fraud Kill Chain incidents involving $1.16 billion in attempted theft and froze $679 million of it, and the report stresses that "time is of the essence" once a fraudulent transfer is discovered (FBI IC3 2025 Internet Crime Report). An email approval workflow aims to catch the mistake earlier still — before the email is sent and before any money moves. For critical emails going out in English, an approval step also catches language slips; useful phrasing is collected in our guide to business emails in a second language.

Which emails should go through an approval workflow?

Routing every email for approval slows the team down and turns approval into a rubber stamp. Before setting up an email approval workflow, identify the risky message types and suggested approvers:

How do you set up an email approval workflow? Six steps

1. List the message types. Fill in the risky message types table for your own company. Which addresses and topics create commitments in the company's name? Tender periods need extra controls on the bid email; we list them in tender email security.
2. Name the approvers. For each type, define one or more approvers and a deputy so the process does not stop during holidays.
3. Define the decisions. Approval should not be just yes or no; "request a revision, with a reason" must be an option, and the reason should stay on record.
4. Lock the approved text. If the text changes after approval, the approval should no longer count; what is sent must match what was approved.
5. Check scheduled sends. An email approved and scheduled for later should still be sent by someone with the right permissions at the moment it goes out. A message from someone who has left or changed role in the meantime should not be sent.
6. Keep and review the record. Who requested approval, who approved or rejected it and when — in a dispute, this record is one of the most useful documents you have. Every quarter, review how many emails went through approval and the average waiting time.

Mistakes that make email approval workflows useless

• Approving everything: An approver who sees hundreds of requests a day will approve without reading.
• A single approver with no deputy: When they are away, employees bypass approval and send from personal addresses.
• Approving outside the system: A "go ahead" on the phone leaves no record.
• Rejecting without a reason: The sender is left waiting without knowing what to fix.

One approver or several?

In an email approval workflow, not every message type needs the same level of scrutiny. For a routine quote, a single approval from the sales manager is enough. For a payment confirmation that includes bank details, approval from two different people is the email equivalent of the four-eyes principle: one checks the content, the other checks that the counterparty is genuine.

Messages with legal consequences, such as contract changes, may need both a department head and a legal adviser. The rule is simple: the greater the potential damage, the more approvers — but never so many that approvers become the bottleneck. Make pending approvals visible and give approvers a reasonable response-time target.

The quote's own approval rules, such as discount thresholds and validity periods, are covered in sales quote tracking.

Email approval workflows work best alongside well-organised shared addresses; we cover that in our article on shared mailbox management. If your current system has no built-in send approval, add it to your business email selection criteria.

Do not confuse email approval with formal records approval. Approving a quote that leaves the company happens in email; correspondence that needs a registry number, an e-signature and a formal archive is approved in an electronic document management system (EDMS). We explain the difference between the two flows in our paperless office guide.

How does Digital Bridge set up an email approval workflow?

An email approval workflow is a design of authority and responsibility before it is an email setting. We run the work like this:

• Process mapping: With your sales, finance and purchasing teams we map which correspondence goes out in the company's name and who approves it today. This can form part of wider process improvement under our digital transformation consultancy, as described in our digital transformation roadmap.
• Risk assessment: We report gaps in payment and bank-detail correspondence as part of our cyber security consultancy and help you prioritise which messages should need a second approval.
• Connecting systems: If the approval decision needs to match the payment process in your ERP or accounting system, we plan the RPA and process automation and ERP side together; where rule-based automation pays off is summarised in RPA explained.
• Implementation: With your teams we decide which messages should be submitted for send approval in SmartMail and who the approvers are, then review how it is being used during the first weeks.

How send approval works in SmartMail

SmartMail, our business email product (SmartMail.com.tr) in the Smart360 family developed by Digital Bridge, has send approval built in:

• The author starts it. The person who writes a message going out in the company's name chooses "Send with approval" instead of "Send"; it is not a mandatory rule an administrator imposes on everyone.
• One or more approvers. A message can be routed to a single approver or to several; with several approvers you choose whether "any one" or "all" must approve.
• Three decisions: approve, revise with a reason, reject. The approver can approve (the email goes out at once), request a revision stating what must change, or reject the message. An email that is not approved is never delivered to the recipient.
• Every step recorded. The approval request, revision, rejection and sending are each recorded with date and time.
• Permission re-checked for scheduled sends. For a message scheduled for later, permissions are checked again at the moment of sending, so an email from someone who has since left or changed role does not go out without authority.

A concrete example: a sales rep prepares a tender response from the shared sales@ mailbox and submits it for approval. The sales manager spots a line item at last year's price and requests a revision with the reason "apply the current list price to item 3". The rep corrects it and resubmits; the email goes out the moment the manager approves, and every step is recorded with date and time.

In SmartMail, approval and scheduled sending are not combined; they are separate routes. For an ordinary email the rep schedules for later, if they move to another department in the meantime, their permission is re-checked at the moment of sending.

In SmartMail, inbound mail is protected too: SmartMail runs every incoming email through identity, structure and content checks, including SPF/DKIM/DMARC, lookalike domains, display-name impersonation, Reply-To mismatches and an AI review of the text, and reports the result with a written reason. A fake "our bank details have changed" email can be flagged on arrival with a reason, depending on the signals it carries, and when the author submits the payment confirmation for approval, it gets a second pair of eyes before it goes out. To buy SmartMail, use the Smart360 purchase page.

Where should an email approval workflow start?

For the next month, count the quotes and payment emails sent in the company's name and note which of them had a second pair of eyes. That count will show where your email approval workflow should start. In most companies the first candidate is correspondence involving payments and bank details, and the second is quotes with binding prices.

Start small: one message type, one team, one month — measure waiting times, then widen the scope. That way teams see the process as protection rather than an obstacle.

To understand how payment fraud unfolds, read our guide to bank detail change email fraud; to try an approval workflow with your own teams, get in touch. The other topics in email and document security are gathered in our Business Email & Documents guide.