The Expense Approval Process: Designing a Workflow That Survives an Audit

In brief

• A good expense approval process routes a claim by rule: value, category, cost centre, and claimant decide who sees it and when.
• The design decisions that matter are the auto-approval threshold, the routing hierarchy, the segregation rules, and what lands in the exception queue.
• Set thresholds by category, not one company-wide number. Around £25 a line is defensible for private sector spend; public money, grants, and low volumes point to zero.
• The test of segregation of duties is whether the system refuses a bad approval, not whether the policy forbids it.

A well-designed expense approval process routes a claim by rule rather than by memory: value, category, cost centre, and claimant decide who sees it and when.

The design decisions that matter are the auto-approval threshold, the routing hierarchy, the segregation rules, and what lands in the exception queue. Get those wrong and automation approves your problems faster than a person ever could.

What follows is the design manual rather than the case for automating: who approves what, at which value, in which order, and what happens when that person is in Croatia. It’s useful if you’re building or reviewing a workflow, and more useful still if an auditor has ever asked why a claim was approved in four seconds.

The three people who could approve a claim

Vendor demonstrations show a claim going to “the manager”. Real organisations have at least three candidates for that job, and in most of them the three are different people.

• The line manager knows whether the trip happened. They know the claimant was in Birmingham on Tuesday because they sent them there. They don’t usually know whether the department has £900 left in its travel budget, and often can’t see the cost centre the claim will land in.
• The cost centre owner knows the budget position. They can see travel is 14% overspent with four months to run. They have no idea whether a particular sales engineer genuinely stayed two nights in Leeds, and will approve anything that looks ordinary because they have no basis to challenge it.
• The budget holder is a third thing again, in organisations running project or programme budgets. A claim can be charged to a project whose owner sits in a different division from both the claimant and the cost centre. This is the person who actually loses money if the claim is wrong, and in a lot of configurations they never see it.

Design the workflow around the wrong one and you get a control that looks fine on the org chart and catches nothing.

Role	What they can genuinely verify	What they can’t see	Characteristic failure
Line manager	That the journey or purchase happened, that the claimant was where they say, and whether the amount is plausible	Budget position. Value added tax (VAT) treatment. Whether the same receipt was claimed in March	Won’t challenge a colleague they sit next to over £34. Approves to keep the relationship
Cost centre owner	Whether the cost centre can carry the amount, and whether the coding is right	Whether the underlying activity took place at all	Approves anything within budget, without checking whether the spend actually happened
Project or budget holder	Whether the cost belongs to this project, whether it’s recoverable from a client or grant, and whether it was in scope	The claimant’s working pattern, and anything about the person	Never configured into the workflow, so the person carrying the cost never sees it
Finance	VAT treatment, duplicate matching across the whole population, coding consistency, and whether the record satisfies HM Revenue and Customs (HMRC)	Whether any individual claim is honest	Given 200 items a week and no time, so reviews the total rather than the lines

No single approver is enough, and no organisation can afford four. What you can afford is a rule that puts the right one in front of the right claim:

• The line manager on everything.
• The cost centre owner above a value.
• The budget holder on anything charged outside the claimant’s own division.
• Finance on exceptions only.

Matrix organisations, where the manager doesn’t own the budget

In a matrix, a consultant reports to a practice lead for their career and to an engagement lead for their work. The engagement lead controls the budget the claim will hit. The practice lead is in the HR feed, and therefore in the “manager” field your expense system imported on day one.

The default configuration routes every claim to the practice lead, who has no budget, no knowledge of the engagement, and thirty direct reports. That approver approves everything in about four seconds, and every one of those approvals is logged, timestamped, and evidentially worthless.

Two fixes work:

• Route on the code, not the person. Route on the cost centre or project code carried by the claim line rather than the claimant’s manager field, so a line coded to engagement 4471 goes to whoever owns 4471.
• Run both. The line manager confirms the person and activity, and the project owner confirms the budget and recoverability. This is slower, and it’s the one that stands up in an audit, because the two approvers are attesting to different facts.

Whichever you pick, the org chart has to be maintained somewhere. If your expense system takes its hierarchy from an HR feed, a leaver who was somebody’s approver stays their approver until the feed corrects it. Ask during procurement what happens to in-flight claims when an approver leaves.

Reconciling to your scheme of delegation

Most organisations of any size already have a document saying who may commit what: a delegated authority schedule behind the finance policy, or a scheme of delegation inside the constitution.

The failure is almost never that the document doesn’t exist. It’s that nobody has reconciled the value bands configured in the expense system to the value bands in the document. An internal auditor will ask for both, put them side by side, and find the system auto-approves at £50 while the schedule says all expenditure needs an authorised signatory.

That’s a finding, and an easy one to avoid: export your configured bands, reconcile them line by line, keep the reconciliation, and re-run it whenever either document changes.

Expense approval thresholds: why one company-wide number is nearly always wrong

The standard advice is to pick an auto-approval threshold, usually a round number someone liked, and apply it to everything. It’s the wrong shape of control, because value is a poor proxy for risk.

A £40 train ticket bought through a corporate account, backed by a card transaction, from a supplier the system has seen four hundred times, carries almost no risk. A £40 client dinner carries a VAT question, a benefit-in-kind question, a policy question about who was there, and a corporation tax question about deductibility. Same number, entirely different exposure.

Three things should move the threshold, and only one of them is value:

• Is the spend card-backed? A claim that reconciles to a company card transaction has independent evidence that the money left the business, at that merchant, on that date. An out-of-pocket claim has a photograph and an assertion. That gap is the single biggest reason to set different thresholds.
• What category is it? Some categories are arithmetic and some are judgement. Mileage at a published rate is arithmetic. Entertaining is judgement, every time, at any value.
• Who’s claiming? A director’s claim isn’t the same risk as a graduate’s claim at the same value.

Set thresholds by category, not by value alone

Category	Auto-approve up to	Why that number	The rule that has to sit with it
Mileage at the approved rate	Any value	The amount is calculated, not claimed. There’s no receipt to falsify, only a distance	Distance tolerance against a routing engine, a cumulative annual total, and a flag on any journey repeated with a different distance
Rail and public transport, card-backed	£100	Reconciles to a statement line, with structured fare data and a small supplier set	Must match a card transaction. An out-of-pocket rail claim drops to the general threshold
Subsistence within the HMRC benchmark rates	The rate itself	The exposure isn’t the amount, it’s whether the travel qualified	A qualifying travel test rather than a value test. Sampling replaces per-claim approval
Accommodation	£150 a night	Above a cap the question stops being financial and becomes a policy conversation	A per-night cap by city, not a per-claim total. A four-night stay shouldn’t fail for being four nights
Stationery, consumables, small tools	£50	High volume, low value, low ambiguity	A monthly cumulative cap per claimant, so forty £49 claims can’t pass one at a time
Client entertaining	Never	Input VAT is generally not recoverable and the cost isn’t deductible for corporation tax	Mandatory field for who was present and which organisation they represent, enforced at submission
Staff entertaining and events	Never	The £150 per head annual event exemption isn’t an allowance. Go over it, even by £1, and the whole amount is taxable	A running annual per-head total, visible to the approver at the moment of approval
Anything with no receipt	Never	The image is the evidence. Without it there’s nothing to audit later	A receipt requirement floor set low enough to be honest, with a written exception route rather than a silent one
Anything claimed by a director	Never	Director expenses are a distinct risk	A routing rule keyed to the claimant’s role, not the amount

For the entertaining rows, our guides to staff and business entertainment and HMRC meal allowances cover the tax treatment in more detail.

On mileage, use the current figure. The approved rate for cars and vans rose to 55p for the first 10,000 business miles on 6 April 2026, with 25p above 10,000 (35p from 6 April 2027) and 5p per passenger per mile. For National Insurance, 55p applies to every business mile with no 10,000 mile step. Configure against those rates, and check which page a supplier is quoting when they tell you their rates are current.

A sensible starting threshold

For a private sector organisation with mixed card and out-of-pocket spend, moderate risk appetite, and enough volume to matter, a general auto-approval threshold of £25 is defensible. It clears the coffee, the parking, the taxi from the station, and the sandwich, which together are most of the line count and almost none of the money. Above that, a person looks.

Two things should push it to zero:

• Public money, grant funding, or regulated spend: these are audited on the assumption a human approved the claim.
• Low volume: below roughly a hundred claim lines a month, one person can look at every claim in under an hour, so there’s no efficiency case for auto-approval, only exposure.

One thing should push it up: spend that sits mostly on company cards, where the transaction is independent evidence and the approval is confirming the business purpose rather than confirming the money moved.

Whatever threshold you set, two numbers matter more:

• Approval load per approver: if one person sees hundreds of claims a month, they won’t read any of them.
• Exception queue per reviewer: if finance can’t work through the flagged claims, your second check doesn’t exist.

Segregation of duties, and where real organisations fail an audit

This is the section that turns up in audit findings, and it’s almost always a configuration problem rather than a policy problem. The policy nearly always says the right thing. The system nearly always allows the wrong thing.

Nobody approves their own claim

Obvious, universally written down, and routinely possible in live systems.

The usual mechanism isn’t a claimant approving their own claim directly. It’s one of these:

• An administrator with a global approval permission who also submits claims.
• A finance manager configured as the fallback approver for their own cost centre.
• A small team where the only person senior enough to approve the office manager’s claim is the office manager.

The test isn’t whether the policy forbids it. It’s whether the system refuses. In a demonstration, ask the vendor to log in as an administrator, submit a claim, then try to approve it. If the button is there, the control is a promise rather than a control.

Nobody approves their own manager’s claim

Upward approval is the less obvious failure, and it survives in a lot of workflows, particularly around absence cover.

A director goes on holiday and delegates their approvals to their direct report. That direct report now approves claims from the person who sets their objectives and their pay. They’ll approve everything, and no reasonable person would expect otherwise.

The rule to configure is that an approver may never be someone who reports, directly or indirectly, to the claimant. That’s a check against your hierarchy, not a value check, and it has to apply to delegated approvers as well as substantive ones. Most systems check the substantive route and let the delegated one through.

Directors and the chief executive

Every organisation hits this, and most don’t solve it properly.

The chief executive submits a claim. There’s nobody above them in the reporting line, so the claim goes to the finance director, who reports to them. That’s upward approval with a job title on it.

The answer is to route director and chief executive claims outside the executive line entirely: to the board, the audit committee chair, or a non-executive. It feels heavy for a £60 taxi, and it’s the single control most likely to be asked about, because senior expenses are where reputational risk sits rather than financial risk.

The other two separations

• The person who approves a claim isn’t the person who releases the payment. Approval and payment release are different acts, and a single compromised login shouldn’t be able to do both.
• The expense approver and the payroll approver are different people. Where reimbursement runs through payroll, a wrong claim lands in net pay and becomes a payroll correction rather than an expense query.

Escalation, delegation and the claim that sits for three weeks

Every workflow needs an answer to the approver who’s on leave, and most of them have the wrong one.

Escalation should be automatic and time-based: an unactioned claim moves to the approver’s own approver after a set number of working days, typically three. That keeps the claim moving without anyone having to notice it’s stopped.

Delegation is where the risk sits. A delegated approver must be subject to exactly the same segregation rules as the substantive one, which is the check most systems skip. Delegation should also be time-bounded and logged, so the audit trail shows who held the authority on the date the claim was approved, not who holds it today.

The failure to design for is the silent one. A claim sitting unactioned for three weeks isn’t a control operating slowly. It’s a control that has stopped, and the claimant is out of pocket while it does. Stalled and bounced claims are also where most rejected expense claims start.

Frequently asked questions

Q. What is an expense approval process?

A. It’s the set of rules that decides who checks an expense claim before it’s paid, in what order, and at what value. A good one routes by value, category, cost centre, and claimant, enforces segregation of duties in the system rather than just the policy, and leaves a timestamped trail an auditor can follow.

Q. What is a sensible auto-approval threshold?

A. Around £25 a claim line for a private sector organisation with mixed spend and moderate oversight needs. Push it to zero for public money, grant funding, regulated spend, or low claim volumes, and higher only where spend is card-backed and sampling genuinely happens.

Q. Should approvals be routed on the manager field?

A. Not in a matrix organisation. Route on the cost centre or project code carried by the claim line, so the person who owns the budget sees it, and add the line manager as a second attestation that the activity happened.

Q. Can a director approve their own expenses?

A. No, and the harder question is who approves theirs. Routing a chief executive’s claim to a finance director who reports to them is upward approval, so director claims should go outside the executive line to the board, the audit committee chair, or a non-executive.

Q. What should never be auto-approved?

A. Client and staff entertaining, any claim with a missing or illegible receipt, foreign currency claims where the claimant supplied the exchange rate, any claim by a director, and cash claims or advances.

Q. How do we test segregation of duties in a demo?

A. Ask the vendor to log in as an administrator, submit a claim and try to approve it. Then ask them to delegate approvals downward and try to approve the delegator’s own claim. Both should be blocked by the system, not by the policy.

Q. What if our exception queue is enormous?

A. Then the second check isn’t really happening. Either tighten the flag rules so fewer, better exceptions arrive, or stop describing it as a control. A queue nobody can read properly is worse than no queue, because it gives false assurance.

The four second test

Pull your approval log and check how long claims sit with an approver before they’re approved. If a meaningful share go through in seconds, you have an approval log, not an approval control, and the fix is usually routing, not people.

Then put the value bands configured in your system next to your delegated authority schedule. If they don’t match, fix that first. It’s the finding an internal auditor reaches soonest, and the cheapest to prevent.

Capture Expense approval workflows route claims by value threshold and expense type, with as many tiers as you need, built by team, role, or region. Approvers set their own delegation for a defined date range, and every stage carries a timestamp in the audit export. Smart Audit checks every expense line at submission, so only the exceptions reach a person. Book a demo to see it run against your own approval rules.