How to Write an Expense Policy People Follow
Global business travel spending will hit a record 1.71 trillion dollars in 2026 across 1.84 billion trips, according to the Global Business Travel Association forecast, and the United States alone accounts for 423 billion of it. Most of that money moves through a document almost nobody rewrites on purpose: the company expense policy. Ask a finance leader when theirs was last updated and the honest answer is usually a year that starts with 201.
This guide is not a template you paste and forget. It is the method I use when a company asks me to fix the way money leaves the business before they buy another piece of software. It covers what an expense policy is actually for, the seven sections it needs, how to set limits that survive contact with reality, the legal floor you cannot go under in the United States and Europe, and how to roll the whole thing out in ninety days without turning finance into the police.
Start from one premise. A policy does not control spending. It removes ambiguity, so that the people spending the money know the answer before they ask, and the people approving it stop making one off judgment calls. Control comes later, from the decisions you make once the data is finally comparable.
What a company expense policy is actually for
Most policies fail because they are written to do one job when they need to do three, and the three jobs pull in different directions.
The first job is tax defensibility. In the United States, reimbursements made under an accountable plan are not wages. Fail the requirements and the whole thing becomes taxable income with payroll tax consequences on both sides. That is not a theoretical risk, it is an audit finding with a number attached.
The second job is spend control. Limits, categories, preferred vendors, approval thresholds. This is the part everybody thinks is the whole policy, and it is maybe a third of it.
The third job is decision speed. A good policy answers the question before it is asked. Can I book this flight. Do I need a receipt for this. Who signs off on this software renewal. Every question that reaches a manager is a small tax on the organization, paid in minutes and attention.
When a policy is written only for job one, it reads like a tax memo and nobody follows it. Written only for job two, it turns managers into auditors. Written only for job three, it fails the first audit. The craft is in doing all three in a document short enough to read.
The ten-minute test
Before you write a word, run this with your finance lead. Time it. Pull the last fifty expense reports and answer four questions from the data, not from memory.
- What percentage of reports were submitted more than sixty days after the expense was incurred.
- What percentage were approved in under two minutes, measured from the approval timestamp.
- How many distinct spend categories appear, and how many of them account for eighty percent of the value.
- How many exceptions were granted last quarter, and who granted them.
If the first number is above ten percent, you have a tax exposure, not an admin problem. If the second is above seventy percent, approval is theater and you should replace it with sampling. If the third shows forty categories where six would do, your reporting is noise. If the fourth answer is "we do not track that," exceptions are your real policy and nobody has read it.
I worked with a company that had a beautifully written twenty-six page policy and a ninety-four percent instant approval rate. Every manager clicked approve because reading the detail cost more than the average report was worth. The fix was not a stricter policy. It was auto approval under a threshold plus a random audit of one in twenty, which cost less and caught more.
The seven sections every expense policy needs
Length is the enemy. The policies that work run between six and twelve pages, and they are organized so nobody has to read the whole thing to answer one question.
Scope and definitions
Who it covers: employees, contractors, interns, board members, candidates traveling for interviews. What counts as a business expense and what does not. Which entity and currency applies for multi country teams. This section is short and it prevents half of all disputes.
Categories and what is allowed
Air, ground, lodging, meals, client entertainment, software and subscriptions, professional development, home office, mobile and internet, gifts. For each one: what is covered, what is explicitly not, and the documentation required. Write the exclusions plainly. "Reasonable" is not a rule, it is an invitation to argue.
Limits and how they are set
The part everyone gets wrong, which is why it gets its own section below.
Approval thresholds
Who approves what, by amount. Not by seniority, by amount. More on this below too.
Documentation and deadlines
What a valid receipt looks like, the threshold above which one is mandatory, the submission deadline, and what happens when it is missed. This is where tax compliance lives, so it must be specific to the day.
Exceptions
How to request one, who decides, how it is recorded, and how often the list gets reviewed. A policy with no exception path generates silent noncompliance. A policy with an undocumented one generates favoritism.
Consequences
What happens on a first honest mistake, a repeated pattern, and deliberate falsification. Write it once, calmly, and apply it consistently. Most policies are vague here and then land in an HR dispute the first time something serious happens.
How to set limits that survive contact with reality
Almost every policy sets limits the same wrong way: someone picks a round number that feels right, and it never changes. Two years later half the team is quietly over budget in high cost cities and the other half is sandbagging.
Here is the method that works.
Set from your own data, not from a benchmark. Pull twelve months of actual spend by category and city. Take the seventy-fifth percentile of what people actually spent, then look at what falls above it and ask whether those cases were wrong or whether your assumption was. In practice, the seventy-fifth percentile is a limit that covers normal behavior without rewarding the outliers.
Band your cities, do not average them. Three or four tiers is enough. A single national hotel cap means people overpay in the cheap tier because the cap reads as a target, and cannot comply in the expensive one. Update the tiers once a year against a published index, and say in the policy which index you use.
Decide per diem versus actuals per category, not globally. Meals work well on a per diem: it removes receipts, kills disputes, and caps exposure. Lodging works badly on a per diem in volatile markets. Mixing the two is not inconsistency, it is design.
Write soft caps and hard caps separately. A soft cap is a number above which the system asks for a one line reason, which is recorded. A hard cap is a number above which the expense needs pre approval. Most policies use only hard caps and then grant exceptions constantly, which is a soft cap with extra paperwork and no data.
Review on a schedule, not on complaint. Put the date in the document. A policy that changes only when someone complains loudly rewards the loudest, not the most exposed.
Approval thresholds: by amount, not by seniority
The single change with the highest return in most companies is moving approval from a hierarchy to a ladder of amounts.
A workable default for a mid sized company: auto approve under a hundred dollars with a random audit sample. Manager approval from a hundred to two thousand five hundred. Director or department head above that. Finance and the executive owner above ten thousand, plus anything that creates a recurring commitment regardless of size.
Three rules make that ladder work.
Recurring beats one time. A twelve dollar a month subscription is a one hundred forty four dollar annual commitment that renews by default and never gets reviewed. Route it by annual value, not by the amount on the receipt. The same logic that governs vendor spend applies here, and I described the full mechanism when writing about how to build a vendor management program.
Nobody approves their own. Including the founder. Especially the founder. An expense policy that exempts the top of the organization is not a policy, it is a memo to everyone else.
Set a decision clock. Approvals owed after five business days escalate automatically. Without a clock, the bottleneck is always a busy manager, and the cost lands on the employee who fronted the money.
If you are redesigning thresholds and want an outside read before you roll it out, an hour spent stress testing the ladder against last quarter's real reports is worth more than any template.
The legal and tax floor you cannot go under
This is the part international templates get wrong and the part that turns a tidy policy into a liability.
Accountable plan rules, United States. To keep reimbursements out of taxable wages, three conditions must hold: a business connection, adequate substantiation, and the return of any excess advance. The IRS fixed date safe harbor treats substantiation within sixty days of the expense and return of excess within one hundred twenty days as timely, with advances issued no more than thirty days before the expense. The detail sits in IRS Publication 463 and Treasury Regulation 1.62-2. Put those exact day counts in your policy. A vague "submit promptly" fails the test.
Mileage. For 2026 the IRS set the business standard mileage rate at 72.5 cents per mile, then raised it to 76 cents for July through December citing fuel costs. That mid year change is the argument for never hard coding a rate into the policy body. Reference the current published rate and keep the number in an appendix that finance updates.
State reimbursement law. California Labor Code section 2802 requires employers to indemnify employees for all necessary expenditures incurred in direct consequence of their duties, which in practice covers mileage, personal phone use for work, and home internet where the job requires it. Illinois, Massachusetts and several other states have their own versions. A national policy that caps or refuses phone reimbursement will not survive in those states, and the penalty includes the employee's legal fees.
Non exempt employees. Under federal wage and hour rules, an unreimbursed business expense that drags effective pay below minimum wage is a violation. This bites hardest on field roles with vehicle costs, and it is the reason mileage policy is a wage question, not a travel question.
Europe and the United Kingdom. Many countries allow tax free subsistence payments only up to published scale rates, and anything above is taxable benefit. If you operate in more than one country, the policy needs a per country appendix with local limits and the documentation each tax authority expects. One global number is the fastest way to create payroll problems in four jurisdictions at once.
Controls that catch the few without punishing the many
The Association of Certified Fraud Examiners estimates that organizations lose roughly five percent of annual revenue to occupational fraud each year, and its 2026 Report to the Nations found asset misappropriation in ninety percent of the 2,402 cases analyzed, with a median loss of one hundred thousand dollars for that category. Expense reimbursement schemes sit inside that group. They are rarely the biggest single loss, and they are almost always the longest running, because each individual amount is small enough to clear approval without a second look.
The controls that work are cheap and unglamorous.
Random sampling beats universal review. Audit one in twenty reports properly instead of glancing at all of them. Publish that you do it. The deterrent comes from the possibility, not the frequency.
Duplicate detection on amount, date and vendor. The most common pattern is not invention, it is the same receipt submitted twice, once alone and once inside a batch.
Watch the just under threshold cluster. If your receipt requirement starts at seventy-five dollars, a spike of seventy-two dollar claims is a signal. Plot the distribution once a quarter and look at the shape.
Round numbers and weekend dates. Neither proves anything alone. Both are worth a question when they cluster on one person.
Check the approver, not just the claimant. Collusion between a submitter and a single approver is the pattern that runs longest. Rotate a sample of approvals to a second reviewer.
Close the loop on the finding. A control that detects and never acts teaches the organization that detection is decorative. Once the expense process feeds into payables, the same discipline applies downstream, which is the argument I made in the guide on how to automate the accounts payable process.
The cost model: three line items nobody budgets
When companies evaluate expense management, they compare software subscriptions. The subscription is rarely the biggest number.
| Line item | Typical share of year one | Note |
|---|---|---|
| Software subscription | 20-30% | Usually per active user per month |
| Configuration and policy build | 15-25% | Categories, limits, approval rules, entities |
| Card program migration | 10-20% | Systematically underestimated |
| Training and change | 10-15% | Two populations: submitters and approvers |
| Accounting integration | 10-20% | Zero if you do not integrate, painful if done badly |
| Internal time | Unbilled but real | Often the largest cost of all |
Three costs that never make the business case and regularly sink the project:
Approver time outside finance. If two hundred people submit twice a month and each report takes a manager three minutes, that is twenty hours a month of management attention spent clicking. Price it. It is usually the single strongest argument for auto approval under a threshold.
The float employees carry. When reimbursement takes four weeks, employees are financing the company on personal credit. It shows up as declined travel, slower bookings, and resentment that never appears in a report. Cutting reimbursement time from four weeks to one is a real compensation improvement that costs nothing.
The cleanup before migration. Category lists nobody pruned, vendors entered nine different ways, cards issued to people who left. Budget two to six weeks of internal work before any data moves, and do it first.
Cards, advances and who fronts the money
The policy question nobody writes down is who carries the cost between the moment money is spent and the moment it comes back. Get this wrong and every other rule gets quietly ignored.
Corporate cards in the employee's name. The company pays the issuer, the employee reconciles. Fast, clean, and it removes the float entirely. The trade off is that reconciliation discipline has to be real, because an unreconciled card charge is a deduction you cannot defend.
Personal card plus reimbursement. Simplest to set up and the most expensive in goodwill. Anyone spending two thousand dollars a month of their own money on company travel is running a personal credit line for you. If this is your model, reimbursement time is not an operational metric, it is a compensation issue.
Virtual cards per vendor or per trip. The strongest control available for subscriptions and one off bookings, because the limit and the expiry are set at issue. It is also the single best defence against the renewal nobody noticed, since a virtual card that expires cannot silently renew.
Cash advances. Rare in most companies, essential in field operations and international travel to markets where cards are impractical. If you use them, the accountable plan timing matters most here: advances no more than thirty days ahead, excess returned within one hundred twenty days, and a reconciliation that someone actually checks.
Two rules regardless of instrument. Never let one person both hold the card and approve its statement. And set a written rule for what happens to outstanding balances when someone leaves, before someone leaves, because doing it afterwards always looks punitive.
What the software changes and what it does not
Expense tools do four things well and one thing badly, and knowing the difference saves a year of disappointment.
They capture receipts and read them accurately enough to eliminate most manual entry. They apply rules at submission, so an out of policy claim gets flagged before a manager sees it rather than after. They route approvals with a clock attached. And they push clean, coded entries into the accounting system, which is where most of the finance time is actually saved.
What they do badly is decide your policy for you. Every tool ships with defaults, and defaults become policy by accident in companies that never wrote one. That is backwards: the rules should be decided in a document with your data behind them, then configured. A tool configured from someone else's defaults will produce beautifully automated compliance with rules you never chose.
Two practical selection notes. Ask to see a report rejected and reworked end to end, not just a clean submission, because the exception path is where the daily friction lives. And ask exactly what data you can export and in what format, because expense history is evidence you may need years after you have changed vendors.
The broader pattern is the one I described when writing about the contract lifecycle management process: software makes an agreed process faster, and makes an unagreed one fail more visibly.
The conversation nobody wants to have
There is a moment in every policy rewrite when someone senior asks to be exempt. Sometimes it is phrased as practicality: the chief executive travels constantly, reviewing their expenses slows things down. Sometimes it is not phrased at all, it just happens.
Handle it explicitly, in writing, before launch. Executives can have higher limits, which is defensible and easy to publish. What they cannot have is self approval or an unaudited path, because the first time an organization learns that the rules stop at a certain level, the rules stop working everywhere below it too. The cheapest version of this control is the audit committee or the board chair reviewing executive expenses once a quarter, which takes twenty minutes and removes the question permanently.
The same principle applies to founders in small companies, where the line between business and personal spend is genuinely blurry. A clear policy protects the founder more than anyone, because it turns a judgment call into a documented decision that survives a due diligence process.
How to write a company expense policy that gets read
Structure decides whether it gets read. Some practical rules from documents that actually worked.
Open with the one paragraph summary. Spend company money as if it were your own, submit within thirty days, keep receipts above the threshold, ask before you spend if you are unsure. Then say everything else in detail below for the people who need it.
Use a table for limits, never prose. Numbers in sentences are impossible to scan and impossible to update.
Write the common cases, not the exotic ones. Ninety percent of spend is flights, hotels, meals, ground transport and software. Handle those with precision and handle the rest with a principle.
Say what happens, not what is forbidden. "Alcohol is reimbursable only as part of a client meal, itemized separately" beats a ban that everyone works around.
Date it and version it. Policy with no version number means nobody knows which one is in force, which means nobody is in breach of anything.
Translate it if your team needs it. A policy people read in a second language is a policy half applied. The onboarding lesson is identical to the one I described in the guide on the customer onboarding process: comprehension is the deliverable, not delivery.
Rollout in 30, 60, 90 days
Days 1 to 30: measure and decide. Run the ten-minute test. Pull twelve months of spend by category and city and compute the percentiles. List every current exception and who granted it. Draft limits and the approval ladder. Do not announce anything yet.
Days 31 to 60: pressure test and write. Take the draft to three groups separately: frequent travelers, managers who approve, and finance. Ask each to find the case the draft handles badly, and expect to change numbers. Write the document, keep it under twelve pages, get legal review on the tax and state law sections. Prepare the appendix that finance owns and can update without reopening the policy.
Days 61 to 90: launch small and enforce early. Start with one department or one country. Announce the effective date and the transition window for old reports. Train the two populations separately: approvers need twenty minutes on the ladder and the audit sample, submitters need ten minutes and the one paragraph summary. Run the first audit sample in week two, not week twelve, and tell people it happened.
By day ninety you do not need full coverage. You need one population operating under the new rules, with real data, an audit that actually ran, and a published number for reimbursement time. Extension after that is the easy part.
If you want the ladder and the limits stress tested against your own last quarter before you publish, that review takes about a week and prevents the two or three decisions that usually get reversed in month four.
Eight mistakes I see most often
- Writing limits from benchmarks instead of your own spend. Your data already knows the answer, use it.
- Approval by seniority. It makes senior people bottlenecks and junior people invisible.
- Vague deadlines. "Promptly" fails the accountable plan test. Use days.
- Hard coding tax rates in the policy body. They changed mid year in 2026 and will change again.
- One global number for a multi country team. It creates a payroll problem in every jurisdiction with scale rates.
- No exception path. Silent noncompliance is worse than a recorded exception.
- Auditing everything, acting on nothing. Detection without consequence trains the opposite of the lesson.
- Never measuring reimbursement time. It is the number employees feel most and finance tracks least.
What to measure after six months
Four numbers, always measured the same way, always read together. Alone, each one lies.
Days from expense date to submission. The compliance number. Anything above sixty days is a tax problem, so track the tail, not the average.
Days from submission to payment. The employee experience number, and the one that predicts whether people follow the process at all.
Percentage of spend inside policy without an exception. Aim high, but be suspicious of ninety-nine percent: it usually means limits are so loose they constrain nothing.
Cost per report, fully loaded. Include finance time, approver time and software. It is the figure that tells you whether automation actually paid, and the same discipline I apply to workforce cost in the guide on the workforce scheduling process.
Eighteen questions to pressure test your draft
Take the draft and answer these out loud with finance and one frequent traveler in the room. Any answer that starts with "it depends" is a section that needs rewriting.
- An employee spends four hundred dollars on a hotel in a city with a three hundred dollar cap. What happens, exactly.
- A manager approves their own team dinner that they attended. Is that allowed.
- A contractor submits an expense. Which rules apply to them.
- Someone submits a receipt ninety days late. Do we pay it, and is it taxable.
- An employee uses a personal phone for work in California. What do we owe.
- A twenty dollar a month tool is expensed by six different people. Who catches it.
- Two people from the same team pay for the same client dinner. How do we detect it.
- An employee books a cheaper flight with a personal loyalty upgrade. Allowed or not.
- Someone extends a business trip for personal reasons. Which nights do we pay.
- A candidate travels for an interview. Who owns that spend.
- An employee buys a monitor for a home office and then leaves. Whose monitor is it.
- An expense is submitted in a currency we do not hold. Which rate applies, on which date.
- A team offsite includes alcohol. Reimbursable, and under which category.
- A manager is on leave when approval is due. Who acts on day five.
- An employee disputes a rejection. Who hears it and how fast.
- Finance finds a pattern, not a single violation. What is the process.
- The policy conflicts with local law in one country. Which wins and who decides.
- Who owns this document, and when does it get reviewed next.
If more than three of those have no clear answer, the draft is not ready. If question eighteen has no name attached, nothing else in the document will survive the year.
How this changes by company type
Early stage startups. Keep it to two pages and one principle, with a card per person and a low auto approval threshold. The cost of a heavy policy exceeds the leakage it prevents at this size.
Professional services. Client billable versus non billable is the axis that matters most. The policy has to make that split at capture time, because reconstructing it at invoicing is where margin quietly disappears.
Field operations. Mileage, tools and per diem dominate, and wage and hour exposure is real. This is the profile where a careless policy becomes a legal claim.
Multi country groups. Country appendices, local scale rates, and one owner per jurisdiction. Central policy sets principles, local appendices set numbers.
Regulated industries. Gifts and entertainment need their own section with pre approval and a register, because the risk is not the money, it is the disclosure.
Four real examples, no names
A sports distribution company had three approval paths that had grown up separately, and nobody could say which applied. The fix started with the ladder, not the software: one page defining who approves what by amount, published before any tool was bought. Reimbursement time fell from just over three weeks to five days. The parallel work on marketing and commercial data at the same client drove a thirty percent increase in sales, which is what happens when the right people stop spending their week on administration.
A hotel group with heavy seasonality faced the opposite problem: a workforce that turns over twice a year, each cohort learning the policy from scratch. The decisive criterion in their redesign was not control, it was teachability. The policy was cut to four pages and a single summary paragraph. In the same period, revenue work took the business from nine to ten million, not because of the expense policy, but because the organization stopped losing hours to zero value activity.
A medical center needed to separate clinician spend, which carried regulatory sensitivity around gifts and hospitality, from ordinary administrative spend. The design decision was two categories with different approval paths and a register for the sensitive one. Reorganizing those flows contributed to roughly twenty percent more operational capacity.
An agritourism business with fifteen seasonal staff bought a full expense management platform and abandoned it in five months. The product was fine, the size was wrong. A shared card, a two page rule and a monthly review would have cost a tenth. The doubling of guests came from entirely different work, but the lesson about over buying is the most expensive one I have seen in a small business.
FAQ
How to write a company expense policy that people follow?
Start with your own spend data, not a template. Set limits at roughly the seventy-fifth percentile of what people already spend by category and city tier, build an approval ladder by amount rather than seniority, and keep the document under twelve pages with a one paragraph summary at the top. Then test the draft against real cases from last quarter with travelers, approvers and finance in the room. Compliance comes from a policy that answers questions faster than asking a manager would, not from stricter rules.
What should the spending limits be?
There is no universal number, and copying one from a benchmark is how policies stop matching reality. Use twelve months of your own data, take the seventy-fifth percentile by category, and band your cities into three or four cost tiers instead of using one national cap. Separate soft caps, which require a recorded one line reason, from hard caps, which require pre approval. Put the review date in the document so numbers change on a schedule instead of changing whenever someone complains.
What are the IRS accountable plan rules in practice?
Three conditions: the expense must have a business connection, it must be substantiated, and any excess advance must be returned. The fixed date safe harbor treats substantiation within sixty days of the expense and return of excess within one hundred twenty days as timely, with advances issued no more than thirty days ahead. Miss those and reimbursements become taxable wages with payroll tax consequences for both sides. Write the exact day counts into the policy, because a phrase like submit promptly does not satisfy the standard.
Do we have to reimburse phone and home internet?
In several states, yes. California Labor Code section 2802 requires indemnity for all necessary expenditures incurred in direct consequence of the job, which courts have applied to personal phone use for work, and Illinois and Massachusetts have comparable requirements. A national policy that refuses those costs will not hold in those jurisdictions, and the exposure includes the employee's legal fees. The practical answer is a defined monthly stipend by role, documented as a business expense.
How do we catch expense fraud without treating everyone as a suspect?
Replace universal review with random sampling of about one report in twenty, done properly and announced publicly. Add duplicate detection on amount, date and vendor, watch for clusters just below your receipt threshold, and rotate a sample of approvals to a second reviewer to catch approver collusion, which is the pattern that runs longest. The deterrent is the known possibility of a real audit, not the volume of reviews, and the sampling approach costs far less management time than reading everything.
How long does it take to roll out a new expense policy?
Ninety days to have one department or country operating under the new rules with real data and a first audit already run. Six to twelve months for full coverage across entities with accounting integration and per country appendices. The slow part is never the writing, it is agreeing the limits and the approval ladder, so start the data pull in week one and expect the numbers to change after you test the draft with the people who travel most.