How to Create an Expense Policy and Approval Process That Works

Why does a small company need a written expense policy?

Most companies of 10 to 300 people run expenses on habit. Claims arrive by email or chat, receipts turn up weeks later, the approver is whoever the manager happens to be, and finance pays when it can. Nothing is badly wrong, which is exactly why the drift goes unnoticed. Without written limits, each person sets their own, and the most generous reading quietly becomes the norm.

The cost is not only money. Slow reimbursement makes staff feel suspected rather than served. Numbers nobody trusts make it hard to answer a simple question from the owner, such as why travel is up. And an unchecked process leaves an open door for the few people who will use it. The Association of Certified Fraud Examiners' Occupational Fraud 2026 report, based on 2,402 cases from 143 countries, puts the median loss per case at 104,000 US dollars and the typical time to detection at about a year.

The same body of research points to cheap defences: management review, proactive data monitoring, surprise audits and a safe way to report concerns. A written policy, an approval matrix and a monthly check are exactly those controls, sized for a small company.

What should an expense policy include?

Start with principles, because they decide the cases no rule covers: spend the company's money as carefully as your own, business purpose first, reasonable rather than luxurious, receipts and names, nobody approves their own spend, ask early. Then make seven design decisions and write each one down.

• Categories, each with a unit: per night for hotels, per head for meals, per mile or kilometre for driving
• Limits set from last year's real invoices, near the upper-middle of the range, so exceptions mean something
• Pre-approval for trips above a threshold, software, training, gifts above a value and larger entertainment
• Receipts: an itemised receipt above a small threshold, and a lost receipt declaration for the rare genuine case
• Timelines: claims within a set number of days, approved claims paid within a promised number of days, card statements reconciled monthly
• What is never claimable: commuting, fines, personal items, family members, upgrades, anything already paid elsewhere
• Who approves: the approval matrix, published as its own one-page document

How do you set expense limits that people respect?

Limits fail in two ways. Set too low, they generate exceptions every week and people stop asking. Set too high, they stop being limits. The fix is to set them from data, not memory. Pull last year's hotel invoices for the cities your staff actually visit and set the cap where most real bookings fall below it. Do the same for client meals per head.

Use tiers where costs differ a lot, for example domestic, major city and international hotels. Express every limit per unit so the check is arithmetic: a two-night stay against a nightly cap, a dinner for four against a per-head limit. Keep the numbers in one place and copy them to the policy annex and the one-page claimant guide on the same day you change them.

Review limits once a year. Three similar exceptions in a quarter usually mean the limit is wrong, not the people.

Who should approve expenses? Building an approval matrix

An approval matrix answers, in advance, who must say yes to which spend. It rests on segregation of duties, the long-standing control principle that no single person should be able to create, approve, pay and record a transaction without someone else seeing it. In a very small company the founder may be finance too; then the accountant or a co-founder reviews the founder's own spend and samples claims every quarter.

Build the matrix in two parts. Amount bands go down the side, each with a named approver and a named deputy. Category rules go across the top, because some spend needs a particular approver whatever the amount: gifts above the limit, hospitality involving a public official, software and equipment, exceptions and appeals.

Should staff use a purchase request, a company card or an expense claim?

Spend arrives through three doors, and the matrix only works if each line comes through the right one. A purchase request is for planned purchases above a threshold, contracts, software and equipment: finance checks budget and supplier before anyone commits, and the invoice is matched to the order and the delivery before payment, a light version of the three-way match used in purchasing. A corporate, prepaid or virtual card suits frequent travellers and online spend. An expense claim covers out-of-pocket costs such as a train fare or a client coffee.

Cards need four controls: a signed card holder agreement, single-transaction and monthly limits matched to the role, a monthly statement reconciliation by a deadline, and consequences applied consistently. Personal spend that the holder declares is a note and a repayment; personal spend that finance finds is a calm conversation first, in person, then written confirmation.

The rule for finance is simple: one line, one door. If a card line also appears on a claim, it is a duplicate.

What are the steps in an expense claim process?

Five steps, each with an owner, a tool and a service level. Submit: the claimant lists each expense with date, category, merchant, amount, tax shown on the receipt, attendees for entertainment and a description someone else could understand in a year. Check: finance confirms the limit per unit, the receipt rule, the approval level and the deadline, and runs pattern checks. Approve: the approver confirms the business purpose, that every line is within policy or covered by a logged exception, and that nothing is claimed twice. Pay: fixed runs on known dates, by bank transfer, within the promise. Record: the approver, dates and payment reference, coded by category so the monthly summary agrees with the accounts.

Two details make a large difference. Before the first payment to anyone, and after any request to change bank details, call the number already on file rather than replying to the email that asked for the change. And pay on time: on-time payment is what earns finance the right to insist on receipts and deadlines.

How do you check claims for fraud without accusing honest people?

Most red flags are mistakes, some are habits and a few are something worse. The way you handle the many decides whether you find the few. Run the same checks on every line: possible duplicate (same merchant and amount), possible split (same merchant, date and person on several lines), just under the limit, round amounts, weekend spend, missing receipts above the threshold, over-limit lines and late claims. One flag with a good description: approve and note. Two or more: ask one kind written question per flag and record the answer.

Patterns across a person's claims, such as repeated missing receipts, call for a coaching conversation with the line manager. Anything that looks deliberate, such as an altered receipt or a trip on a day of leave, changes the rules: do not confront, preserve copies, tell the MD and HR confidentially in writing, and take advice before anyone speaks to the person. Then follow your disciplinary policy and local employment law.

Make it safe to speak up. Tips were the most common way frauds came to light in the ACFE 2026 study, in 43% of cases, with more than half of those tips coming from employees. A small company does not need a hotline vendor: a named person, a confidential route, a no-retaliation line in the policy and a regular reminder are enough to start.

How do per diems, mileage, tax and gifts differ by country?

A per diem is a flat daily allowance for meals and incidentals while travelling; actuals means paying receipts up to a cap. Many tax authorities publish rates they accept as tax free. In the US, the GSA sets federal per diem rates by locality and the IRS publishes a standard mileage rate, 72.5 cents per mile for business use from 1 January 2026. In the UK, the approved mileage allowance for cars and vans rose to 55p a mile for the first 10,000 business miles from 6 April 2026, the first change in many years. Rates like these change, so keep them in a dated sheet and confirm them before each tax year.

Four tax questions apply everywhere: is the reimbursement taxable pay for the employee, can the company recover VAT or GST on it, is it deductible for the company, and is a gift to an employee a taxable benefit. In the US, IRS Publication 463 explains when reimbursements under an accountable plan are not treated as wages. Design the policy so the answers are easy: rates at or below published ones, itemised receipts, separate categories for client and staff entertainment, and no cash gifts. This is general information, not tax advice: check your accountant, auditor and local law.

Gifts and hospitality need a plain anti-bribery line. The UK Ministry of Justice guidance on the Bribery Act 2010 explains that an organisation with adequate procedures has a defence to the offence of failing to prevent bribery. A simple register of gifts given and received, a value above which approval is needed first, a ban on cash and vouchers, and a rule that nothing goes to a public official without written approval are the core of those procedures for a small firm.

Where can AI help with expense management, and where must a person decide?

AI is useful in three places. Receipt extraction: a model reads the photo and suggests merchant, date, total and tax, and a person compares each value with the image before it is recorded. Duplicate and split detection: given a month's lines with names replaced by codes, a model can find near-matches that exact formulas miss, such as one restaurant spelled two ways; every output is a question for the claimant. Policy questions: a model given the policy text can answer routine questions with the section quoted, as long as staff know finance's answer wins.

AI must not decide whether a claim is approved, whether a pattern is fraud, what the tax treatment is, or what to say to a person about their spending. Never paste names, card numbers or bank details into a tool your organisation has not approved. The review rule is short: AI extracts, sorts, drafts and flags; a person checks every value, decides every outcome and holds every conversation.

If you want the whole job in one place, the Expense Policy and Approvals Kit from Bodhih Training includes a policy template, an approval matrix one-pager, a 15-sheet Expense Control Workbook with automatic red-flag checks, claim and card forms, a message library and an AI prompt pack with a review step for every prompt. To check your own attention to detail before you take on more checking, AssessAll's Attention to Detail & Error Checking assessment gives you a starting point, and a Jobulary development plan can turn the gaps into practice for your approvers.