An expense policy is the document that defines which business expenses an organization reimburses, at what limits, with what documentation, and under whose approval. It works when every threshold states a number, every exception has an owner named by role, and the document states the compliance test beside each rule. Ten sections cover it.
Most expense policies are written once, cleared by legal review, and then ignored by the people filing reports. The cause is rarely bad intent. The document never gave anyone a number to work from. A policy that people follow does four things instead. It attaches a figure to every limit, names an owner for every exception, states the test beside the rule, and says what happens when someone breaks it. The ten sections below are the working structure, and the FY2026 federal rates give the thresholds an external anchor.
A policy fails when it asks an employee to make a judgment the document should already have made.
Picture a submitter at the end of a trip. She holds a hotel folio for $214 a night and a client dinner for four. The policy asks only for spending that is reasonable and customary. She makes a call. Her manager, reading the same sentence, reaches a different judgment, and the auditor inherits both decisions. Nobody in that chain broke a rule, because the document never wrote one down as a number.
That gap is expensive over time. The Association of Certified Fraud Examiners studied 2,402 cases across 143 countries and territories for its 2026 Report to the Nations. Asset misappropriation, the category that covers expense reimbursement schemes, appeared in 90 percent of them. Across all 2,402 cases the median loss was $104,000, and the median scheme lasted 12 months before detection.
The same 2026 study found a training effect. Organizations that trained both staff-level employees and management reported median losses of $84,000 per case. Organizations that trained neither group reported median losses of $150,000. Training depends on the policy, and a document with no numbers in it gives a trainer nothing to teach.
Vagueness creates a second problem that matters more than most teams expect. Policy language sets the ceiling on what an audit test can look like. "Reasonable and customary" is not testable, so nobody tests it. "Lodging is reimbursed up to $110 per night in standard continental US locations" is testable on day one. Every vague sentence is a control the organization has quietly decided not to have.
The working standard is simple. The submitter, the approver, the auditor, and whoever later inherits the dispute all read a rule the same way. Five questions applied to each draft rule usually produce that shared reading.
Each category also forces a choice about where the friction belongs. Tight thresholds mean auditors catch more violations, and they raise the volume of exceptions that approvers work through. Loose thresholds keep submission fast, and they leave the decision to an auditor after the company has already paid. Airfare and lodging usually warrant hard caps, because the amounts are large and the market price is public. Ground transportation usually does not, because exception review costs more than the variance it recovers.
The limits of the document deserve stating plainly. A policy detects nothing on its own. It defines what counts as a violation so that detection has a standard to measure against. The tests an auditor runs, covered in our guide to auditing expense reports, form a separate design problem. Policy comes first, and whatever the policy leaves undefined stays undetected.
This section order survives contact with a real audit. Each heading gets filled in with the organization's own numbers, and the instructions below can be copied into a draft as they stand.
State who the policy covers, including contractors, interns, and employees in other countries. Name the local addenda that exist and say which document wins in a conflict. Give the policy an effective date and an owner identified by role.
Publish the approval matrix in the policy itself rather than in a separate finance wiki. Give each band a dollar threshold, an approver level, and a rule for when the approver is also the beneficiary. Say whether approval limits apply per transaction or per report. Employees will split transactions if that is left open.
Set the class of service by flight duration, not by seniority alone. State the advance booking window and what happens when someone misses it. Say whether personal travel attached to a business trip is reimbursable up to the cost of the direct itinerary.
Most US companies index lodging and meal limits to the General Services Administration (GSA) rates, the federal travel allowances published annually and defensible to a tax examiner. Under Per Diem Bulletin FTR 26-01, the FY2026 standard continental US lodging rate is $110 per night. The standard meals and incidental expenses rate is $68 per day, with tiers running from $68 to $92. Those rates hold at the FY2025 level and apply to travel from October 1, 2025 through September 30, 2026. State whether reimbursement covers actual cost up to the cap or pays a flat per diem, because the two produce different receipt requirements. Then write the conference exception, since event hotels routinely price above the standard rate.
Set a per person cap for employee meals and a separate cap for client entertainment. Require the attendee list and a written business purpose on any meal above a stated amount. State the position on alcohol plainly, including whether it is reimbursable at all and whether it counts toward the meal cap.
Give a threshold above which a ride requires justification, rather than banning categories of service. Publish the mileage rate reimbursed and the year it applies to. State how commuting mileage is treated, since that is the most common honest mistake in this category.
Say which categories must go on the corporate card and which must not. Set the deadline for reconciling card transactions and the consequence for unreconciled charges. Define how an accidental personal charge gets repaid, with a timeline.
Set the receipt threshold as a number, and state what a valid receipt shows. Itemized detail, merchant name, date, currency, and payment method are the fields an auditor needs. Require the itemized receipt rather than the card slip for meals and hotels. For international travel, name the local document required, such as a value-added tax (VAT) invoice or a fapiao, the official receipt issued in China.
List the categories that are never paid, in plain language and without hedging. Keep the list short enough that people read it, and review it once a year.
Give a submission deadline in days after the trip ends and say what happens after it passes. Route exceptions through one named path with a written justification. Then state the consequence ladder, from a coaching conversation to recovery of funds to termination for falsified documentation. A policy with no stated consequence is guidance, and employees read it that way.
Most policies are written to survive a legal review rather than an audit. The larger structural problem is coverage.
Most finance teams review 10 to 20 percent of expense transactions, a gap examined in our analysis of 100 percent audit coverage. Most rules in the document therefore never get tested against most reports. A threshold nobody checks works as a suggestion, and employees generally work out which rules are enforced within about two reporting cycles.
Timing compounds the gap. When review happens after reimbursement, enforcement turns into recovery, and recovery from a current employee is slow and awkward. Duplicate expense detection is the clearest example, because catching a duplicate means comparing a report against history rather than against a single rule.
We built Expense Audit on the position that a policy is worth only what gets tested against every report. Our AI reads every line of every receipt on every report before reimbursement, at 100 percent coverage rather than on a sample. More than 40 pre-built travel and expense (T&E) audit models map to the rules most policies already contain. Those include per diem caps, receipt requirements, attendee validation, and duplicate detection across periods.
Those models work in 42 languages across 97 countries. A policy written at headquarters is therefore applied the same way to a fapiao, a VAT invoice, and a US hotel folio. Compliance checks for the Foreign Corrupt Practices Act (FCPA), the Sunshine Act, and politically exposed person screening run alongside the spend rules. Exceptions that need a human reviewer are routed with the evidence attached, and AI Agents resolve the routine ones without a reviewer.
The practical effect on policy design is that vagueness stops being the safe choice. When every report gets tested, real numbers are worth writing, because the numbers are what gets enforced.
An expense policy earns compliance by removing judgment calls from the moment of submission. Anchor every threshold to a number, name an owner by role for every exception, and put the test beside the rule. To assess where a current document stands, mark each of the ten sections above as testable or not testable, then rewrite the ones that failed. Our AI expense audit page describes how policy rules are applied before reimbursement.
An expense policy is the document that defines which business expenses a company reimburses, at what limits, with what documentation, and under whose approval. It sets the standard that expense reports are measured against before payment.
Ten sections cover it. The first five are scope and precedence, approval authority, travel booking, lodging and per diem thresholds, and meals and attendees. The remaining five are ground transportation, corporate card use, receipt requirements, a non-reimbursable list, and deadlines with stated consequences.
Many US companies index to the GSA rates. For FY2026 the standard continental US lodging rate is $110 per night. The standard meals and incidental expenses rate is $68 per day, with tiers running to $92. Those rates apply to travel from October 1, 2025 through September 30, 2026.
Thresholds need to be specific enough to be testable. A rule that states a dollar amount, a period, and a required document is one an auditor or an audit system checks directly. A rule that asks only for reasonable spending leaves the decision with the submitter.