How to Build SOPs During Company Setup: Approvals, Purchasing, Expenses & Payroll Workflows
Most founders in Saudi Arabia get the Commercial Registration, the ZATCA registration, and the GOSI setup done — and then run the actual business on WhatsApp approvals and a shared spreadsheet. That gap is where the real operational risk lives. Standard Operating Procedures (SOPs) aren’t paperwork for later; they’re the difference between a business that scales cleanly and one that has to be rebuilt from scratch at 20 employees.
In short: SOPs for approvals, purchasing, expenses, and payroll should be documented and system-enforced from the day a company is legally formed — not after the first process failure. In Saudi Arabia specifically, payroll and purchasing SOPs also have to account for connected government systems (Mudad/WPS, GOSI, Qiwa, ZATCA’s Fatoora) from day one, since these platforms flag mismatches automatically rather than waiting for an annual audit.
Why Founders Skip SOPs at Setup — And Why That Costs More Later
Building SOPs during company formation feels like premature bureaucracy. There’s no team yet, no transaction volume, nothing to control. So founders reasonably prioritize the CR, the bank account, the office lease.
The problem is that the first few months are exactly when habits get set. The first purchase order that goes through on a verbal “yes,” the first expense reimbursed via bank transfer with no receipt trail, the first payroll run built from a spreadsheet instead of a documented process — these become the default. By the time a business has 10 employees and a finance hire, undoing those habits is a much bigger project than building them correctly from the start would have been.
In Saudi Arabia, this gets sharper because several of these workflows aren’t just internal preference anymore — they connect to government-monitored systems. A payroll SOP that doesn’t account for Mudad’s monthly Salary Information File submission, or a purchasing SOP that doesn’t produce ZATCA-compliant invoice data, isn’t just informal — it’s a compliance gap waiting to surface.
The Four SOPs Every New Business Needs From Day One
1. Approval Workflows
An approval SOP answers one question clearly: who can authorize what, at what value, before money moves or a commitment is made. Without it, every decision defaults to “ask the founder,” which doesn’t scale past a handful of people and creates a single point of failure.
A workable starting structure for a new company:
- Define 2–3 approval tiers by value (e.g., under SAR 5,000, SAR 5,000–25,000, above SAR 25,000)
- Name a specific approver for each tier — by role, not by person, so it survives staff changes
- Require approval before commitment, not after the invoice arrives
- Keep an auditable trail — even a structured approval log in a shared system is enough at this stage; it doesn’t need to be enterprise software
2. Purchasing SOP
Purchasing is where most new businesses in Saudi Arabia first run into the gap between “how we’ve always done it” and what digital compliance now expects. A purchasing SOP should define:
- How a purchase request is raised and approved (tied into the approval tiers above)
- Vendor onboarding basics — CR verification, bank details, and confirming the vendor can issue ZATCA-compliant invoices
- How incoming supplier invoices are matched against purchase orders and goods/services received
- Where purchase records live, so they’re retrievable if ZATCA or an auditor asks
If your invoicing and purchasing data live in disconnected tools — a purchase order in one spreadsheet, supplier invoices in an email inbox — that mismatch is exactly what creates reconciliation problems down the line. Our guide to automated bookkeeping rules and approvals covers how to connect these steps into one system rather than several disconnected ones.
3. Expense Management SOP
Expense SOPs are often the most informally run process in a new business, and the one most likely to create both cash leakage and audit exposure. A basic SOP should cover:
- Submission method and required documentation (a receipt, not a bank statement line, is the standard ZATCA and internal audit expect)
- Reimbursement timeline and approval routing
- Corporate card policy, if applicable — who has one, what it can and can’t be used for
- How recurring expenses (subscriptions, utilities) are reviewed rather than auto-renewed indefinitely
4. Payroll SOP
This is the highest-stakes SOP for a new Saudi employer, because payroll now runs through multiple connected government systems simultaneously rather than as an internal-only process:
- GOSI — contribution registration and monthly submission, with different rates depending on whether an employee falls under the pre- or post-July 2024 social insurance system
- Mudad/WPS — the monthly Salary Information File (SIF) must be submitted through Mudad, generally at least one business day before payday, with salaries paid within the standard window most employers follow (typically the first ten days of the month)
- Qiwa — contract data must match what’s submitted through Mudad and GOSI; a mismatch between these three systems can freeze portal access until resolved
A payroll SOP for a new business should map out the monthly cycle end-to-end: when payroll data is finalized, when it’s approved internally, when the WPS file is generated and submitted, and who owns catching discrepancies before submission rather than after a flag. For the registration mechanics specifically, see our GOSI registration guide for Saudi employers.
Ad Hoc Process vs. Documented SOP
| Workflow | Ad Hoc Approach | Documented SOP |
|---|---|---|
| Approvals | Verbal “ask the founder” | Defined value tiers, named approver roles, auditable log |
| Purchasing | PO issued informally, invoices matched manually | Structured PO-to-invoice matching, vendor verification built in |
| Expenses | Reimbursed by request, inconsistent documentation | Standard submission and approval process, receipt requirement enforced |
| Payroll | Manually calculated, submitted close to deadline | Documented monthly cycle synced to Mudad/GOSI/Qiwa timelines |
| Audit readiness | Reactive — reconstruct records when asked | Continuous — records exist because the process requires them |
| Scaling to new hires | Process breaks or gets reinvented per hire | New hires follow the same documented workflow from day one |
SOP Build Checklist for New Businesses
- [ ] Approval tiers defined by value, with a named approver role for each tier
- [ ] Purchase request → approval → PO → invoice matching documented as one flow, not separate habits
- [ ] Vendor onboarding checklist created, including confirming ZATCA-compliant invoicing capability
- [ ] Expense submission and reimbursement process documented, with a receipt requirement — not “reasonable effort”
- [ ] Corporate card policy written down, if cards are issued
- [ ] Payroll monthly cycle mapped against Mudad’s WPS submission deadline and standard payday window
- [ ] GOSI, Qiwa, and payroll data cross-checked before each submission, not discovered as a mismatch after
- [ ] A single system of record for approvals, purchasing, and expenses — not three disconnected tools that someone has to manually reconcile
If more than a couple of these are still “we’ll figure it out when it comes up,” that’s usually the sign to build the SOP now rather than after the first process failure.
Where New Businesses Get This Wrong
- Treating SOPs as documentation instead of system design. A written policy nobody follows because the actual workflow doesn’t enforce it isn’t an SOP — it’s a PDF. Approval tiers, purchasing flows, and expense rules need to live in whatever system people actually use daily.
- Building payroll SOPs around internal payroll only, without accounting for the Mudad/GOSI/Qiwa cross-checks that can freeze government portal access if the data doesn’t align.
- Treating purchasing and bookkeeping as separate processes. When purchase orders and supplier invoices live in different tools, reconciliation becomes a monthly fire drill instead of a byproduct of how the business already runs.
- Waiting until headcount forces the issue. SOPs built after the third person joins usually have to unwind bad habits first — building them at company setup is materially less work.
How Syneffo Builds SOPs Into the Operating System, Not a Binder
We don’t treat SOPs as a document to hand over — we build them into how your accounting, purchasing, and payroll systems actually operate, so the approval tier, the PO match, and the payroll cross-check happen because the system requires it, not because someone remembered the policy. That’s the same principle behind our day-one compliance, finance, and governance guide and KSA startup operations stack guide — the workflows and the compliance requirements are designed together, not bolted on separately.
For businesses already past setup and looking to formalize what’s been running informally, our automated bookkeeping and approval rules guide walks through how the purchasing-to-reconciliation flow gets connected in practice.
Building SOPs During Company Setup — FAQ
Answers on approval workflows, purchasing, expenses, and payroll SOPs for new Saudi businesses.
Related Reading
- Business Setup in Saudi Arabia: The Documents Checklist for Founders
- Common Company Setup Mistakes in Saudi Arabia — And How to Fix Them
- Month-End Close Automation: A Step-by-Step Checklist
- All Syneffo Services
About Syneffo Solutions: Syneffo Solutions is a multi-market operations and compliance partner working with founders across Saudi Arabia, the UAE, and Malaysia — building the approval, purchasing, expense, and payroll systems that keep growing businesses audit-ready from day one.
