Corporate Expense Management: Policy, Controls, and Software

Corporate expense management is how a company decides what employees may buy, applies those rules when they buy it, and records the result in the general ledger. Policy sets the rules, controls apply them, and software keeps the evidence.

Most finance teams buy the third layer first. They pick a system that captures receipts and routes approvals, then find that a better submission form does nothing about the purchase that shouldn't have happened in the first place. The wider practice of expense management spans all three layers, and the two that decide whether a policy holds are the two nobody shops for.

A corporate expense policy fails at the moment of purchase. By the time a non-compliant charge reaches your review queue, the money is gone and every remaining option is awkward. You can absorb it, claw it back from someone's paycheck, or send a reminder email that changes nothing. So the useful question to ask about any control is when it fires.

Key Takeaways

• Corporate expense management runs on three layers, and most companies buy the system of record first while leaving the policy and the controls unfinished.

• A policy enforced at submission generates cleanup work. The same policy enforced at the card generates compliance.

• A workable policy covers seven areas, and the one most often missing is a named exception path with a stated turnaround.

• Card-level controls decline off-policy purchases while they're happening. Submission-level controls document them after the money is gone.

• Coding at the point of swipe is what keeps month-end from turning into a recoding project, and it's the most useful thing to test in a software demo.

• Auditors ask which policy version applied to a given transaction, so keep dated copies of the policy alongside the receipts and approval trail.

What does corporate expense management cover?

Corporate expense management covers three things. A policy says what employees may buy and under what conditions. Controls apply those rules at the moment of purchase. The system of record captures each transaction, codes it, and stores the evidence for accounting and audit. Business expense management names the same practice from the company's side, and finance teams use the two terms interchangeably.

The recording layer is where the money and the minutes go. A GBTA Foundation study with HRS, published in 2015, put the fully loaded cost of processing a single expense report at $58 and the time at 20 minutes (GBTA). That figure is a decade old and the industry still quotes it, largely because nobody has funded a better one. Treat it as an order of magnitude, and notice what it measures. It prices the paperwork. It says nothing about whether the purchase should have happened.

Most companies invest in the third layer and neglect the first two, which is why so many finance teams own a modern expense platform and a policy last revised when the CFO before this one was hired.

How is expense management different from spend management?

Expense management covers money employees spend on the company's behalf, mostly on cards or out of pocket. Travel, meals, supplies, and software make up most of it. Spend management is the wider category that also takes in supplier invoices, purchase orders, and the full card program, governed as one picture instead of four.

The distinction matters when you're deciding what a policy has to cover. An expense policy governs employee-initiated purchases. A procurement policy governs company-initiated purchases with a contract behind them. Spend that starts as an employee's judgment call and ends as a recurring vendor relationship, which is how most software gets bought, tends to fall in the crack between the two documents.

Who owns the expense policy in a mid-market finance team?

The controller owns it in practice, whatever the org chart says. The CFO approves the policy and answers for the exposure, HR owns the pieces that touch employment terms such as commuting and relocation, and the controller writes the rules, enforces them, and takes the phone call when someone's reimbursement gets rejected.

That split is why expense policies go stale. Nobody's annual review depends on the document being current, and it only becomes urgent after an audit finding or a fraud event. If you want it maintained, put a review date on it and attach the review to close, where it will get done.

What belongs in a corporate expense policy?

A corporate expense policy has to answer, in writing, what an employee may buy, how much they may spend, what proof they have to produce, and what happens when they go outside the rules. Everything else is commentary. An expense management policy that leaves any of those four unanswered gets those decisions made ad hoc by whoever is closest to the purchase.

The sections worth writing out in full:

• Covered categories. Name what the company pays for and, more usefully, name what it doesn't. Alcohol, first-class fare, in-room movies, and spousal travel are the perennial arguments.

• Spending limits by role. Per transaction, per month, and per category, tied to job level, not to named individuals.

• Receipt thresholds. The dollar amount above which an itemized receipt is required, plus the rule for lost receipts.

• Pre-approval triggers. The conditions that require a sign-off before the purchase, usually a dollar threshold, a category, or international travel.

• Mileage and per diem treatment. The rate you reimburse, the method for calculating it, and whether per diem or actuals apply.

• Personal-use rules. What happens when a company card gets used for a personal charge, including the repayment window.

• The exception path. Who approves an out-of-policy expense, what they need to see, and how long they have.

Smaller companies can get a workable policy into two pages. Name the categories you'll pay for, set one per-transaction limit and one monthly limit per role, require an itemized receipt above $25, require pre-approval for anything over $500 or any air travel, adopt the federal mileage and per diem rates by reference so you never have to revise them, and name one person who approves exceptions. That covers the ground. Adding twelve more pages of edge cases before you have controls in place adds reading, not compliance.

Reimbursement mechanics deserve their own passage, because the tax treatment follows the paperwork. Under an accountable plan, reimbursements stay out of taxable wages when the expense has a business connection, gets substantiated, and any excess advance comes back. Get that wrong and employee expense reimbursement becomes a payroll problem instead of an AP problem.

How should spending limits be set by role?

Set limits by role, not by seniority as a courtesy. The question to answer for each role is what that job needs to be able to buy without asking, and the honest answer for most roles is a short list.

Three numbers do most of the work.

• A per-transaction limit stops the single large purchase.

• A monthly limit caps cumulative drift.

• A category limit keeps a travel card from becoming a general-purpose card.

Sales roles usually need a high transaction limit and a tight category list, while operations roles need the reverse, and setting both from one template is how companies end up with a $10,000 monthly limit on a card that buys coffee.

Card type matters here as much as the numbers. A corporate card program can issue different card products against different rule sets, so the travel card, the purchasing card, and the one-off project card don't have to share a policy just because they share a company.

What should the policy say about mileage and per diem?

Adopt published federal rates by reference and let them update themselves. The 2026 IRS standard mileage rate for business use is 72.5 cents per mile, up 2.5 cents from the 2025 rate of 70 cents, effective January 1, 2026 (IRS, news release IR-2025-128). Writing "the current IRS standard mileage rate" into the policy saves you an annual revision and an argument every January.

Per diem works the same way. The FY 2026 standard CONUS rate is $110 for lodging plus $68 for meals and incidental expenses, with M&IE tiers running $68 to $92, unchanged from FY 2025 and effective October 1, 2025 through September 30, 2026 (GSA Per Diem Bulletin FTR 26-01). Per diem also removes a category of receipt chasing, since the employee gets a fixed amount and you stop adjudicating whether an $18 airport sandwich was reasonable.

The choice between per diem and actuals is a real trade-off, and it comes down to which failure you'd rather have. Actuals cost you review time and produce arguments. Per diem costs you a little money on the low-spend trips and buys back the review time. Companies with heavy travel volume usually land on per diem for meals and actuals for lodging.

How do you write an exception path people will use?

Make the exception path shorter than the workaround. If getting an exception approved takes four days and three emails, people will find a compliant-looking way to book the thing they were going to book anyway, and you'll have a policy with a clean compliance rate and no relationship to reality.

A usable path has a named approver, a stated turnaround, and a written reason field that gets retained. The reason field is the part that pays off later, because a quarterly read of exception reasons tells you where the policy is wrong. If eleven people asked for the same exception, the policy has a gap, and the eleven people were right.

Where this gets uncomfortable is seniority. Every expense policy eventually meets a senior executive's out-of-policy charge, and how the CFO handles the first one sets the real policy for everyone watching. No software solves that, and any vendor who suggests otherwise hasn't sat through the conversation.

Which controls actually enforce the policy?

Controls enforce a policy when they fire before or during the purchase. Grouping them by timing is more useful than grouping them by feature name, because the timing determines whether you get prevention or a report.

The bottom three rows create cleanup work. The rows above them stop the spend.

Controls that fire after the fact generate the cleanup nobody staffs for. The same GBTA research found that 19% of expense reports contain errors or missing information, and that correcting each one costs an additional $52 and 18 minutes. At the study's average volume of 51,000 expense reports a year, that works out to roughly half a million dollars and nearly 3,000 hours annually spent fixing paperwork that a required field would have caught at entry.

The fraud exposure runs alongside it. The Association of Certified Fraud Examiners estimates that organizations lose 5% of revenue to fraud each year, drawing on 1,921 cases totaling roughly $3.1 billion across 138 countries in its 2024 Occupational Fraud: A Report to the Nations (ACFE). I'd treat the 5% as directional, since practitioner estimates carry wider error bars than measured loss rates do. Expense reimbursement fraud is still consistently among the schemes that run longest before anyone notices, for the obvious reason that individual amounts stay small.

Setting card controls and spend policies together is the practical fix, and it's the one place where writing the policy and configuring the system should happen in the same week. Most companies leave eighteen months between them.

What can a card block before the money moves?

A card can decline the transaction outright. Spending limits, merchant category restrictions, single-use numbers, and time-boxed activation windows all operate at authorization, which means the purchase never completes and there's nothing to review, claw back, or argue about.

Merchant category restrictions do the heaviest lifting and get configured the least carefully. Merchant category codes are assigned by the acquirer, not by you, so a hotel restaurant may code as lodging and a warehouse club may code as groceries. Build the block list from your own transaction history, and expect to adjust it twice in the first quarter.

Velocity rules are the underused one. Capping the number of transactions per day, or the total in any rolling seven days, catches the pattern that a single-transaction limit never sees, which is a series of compliant-looking charges that add up to something nobody approved. Teams that lock down spend before it slips are usually doing exactly this.

Control every card and expense

Scan receipts, auto-code transactions, and approve reports from one mobile app, with spending rules that sync to your ERP. Automated reporting saves an average of $19.78 per expense report.

Explore Expense Management

Which fields should be mandatory before a submission is accepted?

Require business purpose, GL account or project code, attendees for any meal involving more than one person, and an itemized receipt above your threshold. Reject the submission when any of them is blank. Accepting it into a queue just hands someone else the job of chasing the missing field.

That single design choice separates expense tools that reduce work from expense tools that relocate it. A system that accepts an incomplete submission has handed your team a follow-up task and a delay; a system that refuses it has handed the employee a thirty-second fix while they still remember who was at the dinner. Ask any AP or accounting manager which version they're living with and you'll get a fast, unhappy answer.

Keep the required-field list short enough that people can complete it from a phone in an airport. Every additional mandatory field buys a little more data quality and a little more late submission, and past four or five fields the trade stops paying.

What happens to an out-of-policy expense?

Decide in advance and write it down, because the decision made in the moment always favors whoever is most senior in the room. Four responses cover nearly every case.

1. Deny the reimbursement outright.

2. Reimburse partially, up to the policy amount.

3. Deduct the amount from payroll when a personal charge went on a company card.

4. Approve it as a documented exception with the reason retained.

Partial reimbursement is the one most policies forget to define and the one that comes up most. An employee books a $340 hotel room when the policy caps lodging at $250 in that market. Paying $250 and denying the rest is defensible, consistent, and takes about a minute, provided the policy said so before the trip.

How does expense data reach your GL and your auditor?

Expense data reaches the general ledger either by coding at the point of transaction and posting on a schedule, or by coding during review and posting after approval. The path you're on determines how much of your close is reconciliation and how much is investigation.

Fraud pressure is what makes the audit trail worth building properly. The Association for Financial Professionals found that 76% of U.S. organizations experienced attempted or actual payments fraud in 2025, based on 465 treasury practitioners surveyed in January 2026 for its 2026 AFP Payments Fraud and Control Survey Report (AFP). Card programs are a smaller share of that exposure than checks, but they're the share where the evidence trail is easiest to build and easiest to neglect.

Corpay card and expense data posts into NetSuite, Sage Intacct, Microsoft Dynamics 365, Acumatica, and QuickBooks, with 180+ ERP integrations available via API, SFTP, or file-based connections. Knowing which of those your expense system supports natively, and which it supports through a file drop someone has to run, is worth confirming before you sign anything. An ERP handles the ledger, and the last mile between a card swipe and a posted journal entry is exactly the gap that gets underestimated.

Does coding happen at the point of swipe or after the fact?

Coding at the point of swipe means the transaction arrives already carrying its GL account, cost center, and project. The cardholder picks from a short list at the time of purchase, or the system applies a default derived from the card, the merchant, or the department, and the accountant only reviews the exceptions.

The alternative pushes coding into review, where somebody who wasn't there decides what a $220 charge at a hardware store was for, and that version of the process turns corporate card reconciliation into the longest task on the close calendar, which is why close gets described as a fire drill.

Allocation is the part that decides whether the data is useful afterward. Splitting one transaction across cost centers or projects has to be possible at entry, because reconstructing an allocation three weeks later is guesswork wearing a spreadsheet. Teams running spend management inside Microsoft Dynamics 365 generally find that the dimension structure in the ERP, not the expense tool, is what constrains how granular the coding can get.

What audit evidence does an expense program need to retain?

Retain five things for every transaction.

• The receipt or other supporting document.

• The stated business purpose.

• The approver's identity and the timestamp.

• The GL coding, along with any later changes to it.

• The version of the policy in force on the transaction date.

That last item is the one nearly everyone skips, and auditors ask for it. "The current version on the intranet" is not an answer when the question concerns a charge from March.

Timing is the argument for building the trail in the first place. The ACFE found that 43% of frauds were detected by tips and that the typical case ran about 12 months before anyone caught it. A control that shortens detection is worth more than a control that only preserves history, which is another way of saying that a real-time exception report beats a perfect archive. Long-running expense schemes are precisely the pattern that a monthly variance review misses and a daily threshold alert catches, and it's a recurring theme in fraud and the T&E process.

Set retention to match your longest applicable requirement, which for most U.S. companies means the tax record, not the accounting one. Storing receipt images inside the expense system is fine, provided you've confirmed you can export them in bulk if you ever change systems.

How should you handle travel and entertainment spend?

Put travel and entertainment on company-issued cards wherever you can, and reserve reimbursement for the cases where a card genuinely can't be used. Card-funded travel gives you controls at authorization and a transaction record that arrives without anyone typing it.

The payment mix has already moved this direction. U.S. noncash payments reached 236.6 billion in 2024, with cards used most frequently at over three-quarters of payments by number, according to the Federal Reserve's 2025 Federal Reserve Payments Study (Federal Reserve). Employees live in a card-first world, and a T&E program built around personal cards and monthly reimbursement is asking them to finance the company's travel out of their own credit line.

Booking is a separate category from expense control, and it's worth being precise about the boundary. Corpay handles card-funded T&E spend, the controls on it, and the coding that follows; travel booking, itinerary management, and negotiated air and hotel rates come from travel management platforms. Companies commonly run both, and the integration point is the card, not the booking tool.

Should travel be reimbursed or put on a card?

Put it on a card. Reimbursement moves the control to after the money is spent, adds a payment cycle, and pushes the float onto the employee, which is a real retention issue for anyone traveling weekly on a personal card.

Reimbursement still has a place for infrequent travelers, new hires who don't yet have a card, and the occasional merchant that won't take a commercial card. A one card program consolidates travel and purchasing onto a single product where that fits the org, while companies with distinct travel and purchasing populations often do better running a multi-card program for T&E so each card carries its own rule set.

Which T&E controls are worth the friction?

Pre-approval for air travel and any trip over a dollar threshold, attendee capture on meals, and a lodging cap by market are worth the friction. They're few enough to remember and they cover the categories where the money and the audit risk concentrate.

Virtual cards earn their place for the bookings that don't happen at a card terminal, particularly hotel prepayments and conference registrations, since a single-use number with an exact amount and a date window removes the duplicate-charge dispute entirely. B2B virtual card payments are projected to reach $14.6 trillion by 2029, accounting for 83% of the global virtual cards market by then, per Juniper Research's Global Virtual Cards Market 2025-2029 (Juniper Research).

Receipt-level itemization on every meal under $50 is not worth the friction. You'll spend more reviewing it than you'll ever recover, and it trains people to resent the policy, which costs you compliance on the rules that matter.

What should you look for in corporate expense management software?

Judge corporate expense management software on whether it can apply the policy you wrote. That's a narrower test than most evaluations run, and it eliminates a surprising number of products quickly.

Four questions cover it.

1. Can the system enforce your limits and category rules at authorization rather than at review?

2. Will it code transactions at the point of purchase using your GL structure and dimensions?

3. Does it post to your ERP through a supported integration, or only through a monthly export?

4. Can you hand an auditor the receipts, approvals, and coding history, and export them in bulk?

Small businesses should apply the same four questions with a fifth added, which is whether the thing can be administered by a person who has other jobs. The best expense management software for a small business is usually the one bundled with the card program, because a separate expense tool means a second vendor, a second integration, and a reconciliation between the two that somebody has to own. Companies that consolidate onto a card program with expense capture built in, which is what a business expense card provides, generally spend less admin time than companies running best-of-breed tools side by side. Pricing, support models, and implementation timelines matter too, and those belong in a full system evaluation.

How do you test whether software can enforce your policy?

Ask the vendor to attempt a non-compliant purchase in front of you. Have them swipe at a merchant category your policy excludes, or for an amount above the card's limit, in a live environment rather than a demo tenant. Watch whether the authorization declines or whether the charge clears and surfaces later as a flag in a report.

Those two outcomes look nearly identical in a slide deck and behave nothing alike at month-end. Run the same test on required fields by submitting an expense with the business purpose blank and seeing whether the system accepts it. A team that has been getting more out of a corporate credit card program for a few years will tell you the demo they wish they'd asked for is this one.

Put policy, controls, and coding on one system with Corpay

An expense policy becomes enforceable when the card and the expense system are the same system. Limits, merchant category rules, and required fields get applied at the card instead of reviewed after the statement arrives, which is the difference between preventing off-policy spend and documenting it. Corpay expense management puts card issuance, spend controls, receipt capture, and GL coding in one place, so the rules you wrote are the rules that run.

That matters most for the failure the card-plus-separate-expense-tool stack keeps producing, where the card program enforces one set of limits, the expense tool enforces another, and the reconciliation between them becomes a monthly project. Running corporate cards and expense capture on a single platform removes that reconciliation rather than automating it. More than 800,000 businesses run spend on Corpay today.

Frequently Asked Questions

What is corporate expense management?

Corporate expense management is the practice of setting rules for employee spending, enforcing those rules when purchases happen, and recording the results for accounting and audit. It combines a written policy, controls applied at the card or the submission, and a system of record.

What is expense management?

Expense management is the process of capturing, reviewing, approving, and reimbursing money employees spend on the company's behalf. Travel, meals, supplies, and software bought by individuals all fall under it. Supplier invoices run through accounts payable instead.

What should a corporate expense policy include?

A corporate expense policy should name covered and excluded categories, set spending limits by role, and state receipt thresholds. It also needs pre-approval triggers, mileage and per diem treatment, personal-use rules, and a named exception path with a stated turnaround.

What is the difference between spend management and expense management?

Expense management covers employee-initiated spending on cards and out of pocket. Spend management is the broader discipline that also covers supplier invoices, purchase orders, and the full card program, all managed as one picture.

What is an expense management system?

An expense management system is the software that captures receipts, applies policy rules, routes approvals, and posts coded transactions to the general ledger. Evaluating one is a separate exercise from writing the policy, and it should follow the policy, not define it.

What is expense management software?

Expense management software automates receipt capture, policy checks, approval workflows, and ERP posting for employee spending. The meaningful distinction between products is whether rules get applied at authorization or only flagged during review after the money has already moved.

What is the best expense management software for a small business?

For a small business, the best option is usually the expense capability bundled with the corporate card program, because it avoids a second vendor, a second integration, and a reconciliation between them. Judge candidates on rule enforcement, coding at purchase, ERP posting, and evidence retention.

Which ERPs does an expense program need to post to?

An expense program needs to post to whichever general ledger you close in. Corpay card and expense data posts into NetSuite, Sage Intacct, and Microsoft Dynamics 365. Acumatica and QuickBooks are supported as well, and other systems connect through API, SFTP, or file-based integrations.

David Luther

Product Marketing Program Manager

David Luther, MBA is a product marketing program manager with years of experience in commercial banking, finance, and technology sectors, with research and writing appearing in financial publications.

Expense management

Commercial Cards