Expense Audit: How Finance Teams Review Employee Spend Without Checking Every Receipt

An expense audit is finance's review of employee expense reports and card transactions after approval, to confirm each expense is documented, within policy, and legitimate. The goal is to catch errors, policy breaks, and fraud without spending more on review than the problems cost.

Most finance teams feel the trade-off. Read every report and the close slips, which matters when closing times have stretched to 14 days on average, according to Center's 2024 trends survey. Read none and policy drifts. The same survey found only 39% of companies have a written, up-to-date expense policy, so many teams are auditing against rules nobody wrote down.

The answer is a risk-based program. It reviews the reports most likely to be wrong, samples the rest, and lets card data settle the facts before a person looks.

Key Takeaways

• An internal expense audit checks receipts, amounts, dates, merchants, business purpose, and duplicates after a manager approves a report.

• IRS rules generally require documentary evidence showing amount, date, place, and the essential character of each expense, with a receipt exception for non-lodging expenses under $75.

• No reliable industry benchmark exists for what share of reports to audit. A risk-tier approach sets rates by how risky each report looks.

• Card transaction data settles amount, date, and merchant automatically. People still need to judge business purpose.

• Audit findings that reveal unsubstantiated reimbursements can affect accountable-plan treatment, so involve your tax advisor.

What is an expense audit?

An expense audit is a structured review of submitted expenses against company policy and documentation rules. In most companies, it's an internal control run by finance or internal audit on a regular schedule.

The term gets used three ways, which causes confusion. An external auditor's review of expenses during a financial-statement audit tests whether the books are fairly stated. A personal "expense audit" is a household budget review. The third is the internal program that reviews employee expense reports and corporate card spend, which is the one most controllers mean.

How is an expense audit different from expense approval?

Expense approval is the manager's check before payment, and the audit is finance's check afterward. A manager approving a report confirms the trip happened and the spending made sense for the team. The expense approval process is a first line of defense, but managers approve quickly and rarely check receipts against policy.

The audit adds a second, independent look. Finance reviews against the written policy, compares reports across employees and periods, and spots patterns no single manager would see.

What should an expense audit check?

An expense audit should check that each expense is documented, accurate, within policy, and not claimed twice. A practical checklist covers six items:

• A receipt is attached, readable, and adequate under your policy and IRS rules

• The amount and date on the receipt match the amount and date claimed

• The merchant and expense category are allowed under policy

• The business purpose is stated, with attendees listed for meals and entertainment

• The expense doesn't also appear on another report or on a corporate card statement

• Mileage, per diem, and other non-receipt claims follow the policy's rates and rules

IRS guidance sets a useful floor for documentation. IRS Publication 463 says you "must generally have documentary evidence such as receipts, canceled checks, or bills, to support your expenses." It adds that documentary evidence will ordinarily be considered adequate "if it shows the amount, date, place, and essential character of the expense." A canceled check alone isn't enough. The publication notes it doesn't prove a business expense without other evidence showing a business purpose.

How do you verify expenses in an audit?

Verify expenses by matching each claimed line to independent evidence. Compare receipts to claimed amounts and card transactions to the card feed. For mileage and attendee claims, check a map or the calendar where the amount justifies it.

Errors are common enough to justify the work. In a 2015 GBTA Foundation study sponsored by HRS, 19% of expense reports contained errors or missing information, and each cost another $58 and 18 minutes to correct. Most of those errors are honest. A good audit catches them early, fixes the habit, and saves the correction cost on the next report.

A receipt management process that captures images at the point of purchase makes verification faster, because the receipt arrives with the transaction instead of weeks later. Corpay's single-use virtual cards tighten that link for supplier purchases, with one card number per approved payment.

Which receipts can you skip under IRS rules?

Under IRS rules, you generally don't need a receipt for an expense other than lodging that's less than $75, according to Publication 463. You still need a record of the amount, date, place, and business purpose.

Your policy can be stricter, and many are. Some companies require receipts for everything, especially on corporate cards, so the audit has a consistent standard. Lodging always needs a receipt regardless of amount. Whatever threshold you pick, write it into the policy and apply it the same way in the audit, so employees know exactly what a reviewer will ask for.

What share of expense reports should finance audit?

No reliable industry benchmark exists for what share of expense reports to audit. The right rate depends on your risk, so the practical approach is to set rates by risk tier and adjust them as findings come in.

Here's a starting structure. The rates are suggestions based on practice, not benchmarks:

Random selection matters in the sampled tier. If employees can predict which reports get reviewed, the sample stops working as a deterrent. In my experience, the biggest gain comes from the always-review tier, because a small set of rules catches most of the problems worth finding.

Adjust the sampled rate as results come in. If a quarter of samples turn up a finding, raise the rate or add a risk rule that would have flagged those reports. If several quarters pass with almost nothing found, lower it and move the time to the always-review tier. The rate is a dial, not a fixed policy, and the findings log tells you which way to turn it.

Executives belong in the always-review tier on principle. Their reports often have the least manager oversight, and auditing them visibly signals the policy applies to everyone.

Which risk rules should pull a report into review?

Risk rules should flag the patterns most associated with errors and misuse. Common ones include:

• Round-dollar amounts, especially just under a receipt or approval threshold

• Weekend or holiday spending outside approved travel

• Split transactions that look like one purchase broken up

• Repeated missing receipts from the same employee

• First-time merchants or merchant categories rarely used by the team

• Mileage claims that don't match trip records

These rules work best as filters, not verdicts. A flagged report goes to a reviewer. It isn't automatically rejected, and many flags turn out to have ordinary explanations. Guidance on expense fraud detection and prevention covers the patterns that point to deliberate misuse.

What does a 30-day audit calendar look like?

A 30-day audit calendar spreads the work across the month so it doesn't pile up at close. A simple version for a mid-size company looks like this:

1. Days 1 to 5, review every report flagged by a risk rule since the last cycle and every executive report

2. Days 6 to 10, draw the random sample from last month's standard reports and assign reviewers

3. Days 11 to 20, complete sampled reviews, contact employees about missing items, and log findings by type

4. Days 21 to 25, follow up on open items and escalate repeat or unresolved findings to the employee's manager

5. Days 26 to 30, summarize findings for the controller and note any policy or rule changes for next month

Running the cycle on a fixed schedule makes the audit predictable for finance and unpredictable for employees, because the sample itself stays random.

How do you handle a confirmed policy violation?

Handle a confirmed violation in proportion to what happened. A first-time honest mistake, such as a meal slightly over the limit, usually needs a note to the employee and a repayment or a policy reminder. A pattern of the same violation needs a conversation with the employee's manager.

Suspected fraud is different. Stop the normal follow-up, preserve the reports and receipts, and escalate to internal audit or counsel before talking to the employee. Tipping someone off gives them time to adjust records. Keep a log of every confirmed violation and its outcome, so treatment stays consistent across departments and audits can show the policy is enforced.

How do audit findings feed back into policy?

Audit findings feed back into policy when you track them by type and fix the cause, not just the report. If the same category keeps generating findings, the rule is probably unclear or out of date.

Review findings quarterly. A spike in missing hotel receipts might mean travelers book through a channel that doesn't email receipts. A spike in meal overages might mean the limit hasn't kept up with prices. Update the travel and expense policy, tell employees what changed, and watch whether the finding rate drops.

Can card data replace most of the manual expense audit?

Card data can replace most of the fact-checking in an expense audit, but not the judgment. When employees spend on a corporate card, the transaction itself records the amount, date, and merchant, so nobody has to check those against a receipt by hand.

That shift is already large. US credit card payments reached 67.1 billion in 2024, up 16.2 billion from 2021, counting consumer and business cards together, according to the Federal Reserve Payments Study. On the business side, US commercial card purchase volume was $2.230 trillion in 2024, up 4.5% over 2023, according to the Nilson Report.

Reimbursement is where fraud hides longest. Expense reimbursement schemes were 13% of occupational fraud cases in ACFE's 2026 study, with a $36,000 median loss, according to ACFE's Occupational Fraud 2026: A Report to the Nations. The same report found those schemes ran a median 18 months before detection. Out-of-pocket claims rely on documents the employee supplies. Card transactions come from the card network, so inflated amounts and invented merchants are much harder to slip through.

Card controls move some of the audit before the purchase. Merchant category blocks, per-transaction limits, and spending rules stop out-of-policy charges instead of finding them later. Corporate card reconciliation then matches the feed to receipts and coding.

What still needs a human reviewer?

A human reviewer still needs to judge business purpose, attendees, and context. A card transaction proves that $340 was spent at a restaurant on a Tuesday. It doesn't prove the dinner was with a client, or that the client was who the employee says.

Automated rules and models catch duplicates, out-of-policy merchants, and date and amount mismatches well. They're weaker on intent. That's why the always-review tier should stay with people, and why sampled reviews should include a check on the stated purpose, not just the numbers. A reviewer who knows the team, its customers, and its travel pattern will spot a dinner that doesn't fit long before a rule does.

Capacity is a real constraint. A third of accountants make several financial errors every week, and 18% make errors at least daily, according to a 2024 Gartner survey of 497 accountants. Letting card data and rules handle the routine checks gives reviewers time for the judgment calls.

How do audit findings affect taxes and the accountable plan?

Audit findings can affect taxes when they show reimbursements that weren't properly substantiated. IRS Publication 463 lists safe-harbor timing for an adequate accounting "within 60 days after they were paid or incurred," with any excess returned "within 120 days after the expense was paid or incurred."

Reimbursements that fail the accountable-plan rules are generally treated as paid under a nonaccountable plan, according to the same publication. An audit that finds a pattern of missing documentation or late submissions may be finding amounts with tax consequences. Talk to your tax advisor about your own facts before deciding how to treat them.

Run audits on card data with Corpay

The cheapest audit is the one a control made unnecessary. Corpay expense management puts spend data in finance's hands at the transaction, with spending rules, mobile receipt capture, automatic coding, and approvals from a phone, so most of the fact-checking is done before an auditor looks.

Corpay virtual cards add single-use virtual cards that limit each card to one approved purchase. Coded spend posts to the ledger through 100+ ERP integrations, with NetSuite and Sage Intacct among them alongside Business Central and Acumatica. Card data becomes the audit's first filter, and reviewers keep their time for the reports that need judgment. Each review leaves an AP audit trail for the next one.

Frequently Asked Questions

What is an expense report audit?

An expense report audit is finance's review of submitted expense reports to confirm each expense is documented, accurate, and within policy. It happens after manager approval and often uses risk rules and random sampling instead of reviewing every report.

How often should expense reports be audited?

Most companies audit continuously, with flagged reports reviewed as they arrive and a random sample drawn monthly. Review the overall results quarterly to adjust risk rules, sample rates, and policy.

Who should perform the expense audit?

Someone independent of the employee and the approving manager should perform the audit, usually finance staff or internal audit. Keeping the reviewer separate follows the same logic as segregation of duties in AP.

What are common expense audit findings?

Common findings include missing or unreadable receipts, missing business purpose or attendees, expenses in blocked categories, duplicate claims across reports or card feeds, and mileage that doesn't match trip records. Most are honest mistakes that point to unclear policy.

Does every expense need a receipt?

Not under IRS rules. Non-lodging expenses under $75 generally don't need a receipt, though you still need a record of the details. Many company policies require receipts for everything, and lodging always needs one.

David Luther

Product Marketing Program Manager

David Luther, MBA is a product marketing program manager with years of experience in commercial banking, finance, and technology sectors, with research and writing appearing in financial publications.

Expense management

Risk management