A travel and expense policy states what an organization pays for when employees travel, how much it pays, and what proof it requires before reimbursing the traveler. It binds employees only where someone can check it, so each clause needs a signal that would prove it was broken. Anchor every threshold to a published, dated rate.
Most published guidance on this subject stops at the document. The sections get listed, a template gets offered, and the harder half goes unwritten. What decides whether employees follow any of it is the detection behind each clause and the four measures that show which clauses are working. Below are the sections a policy needs, the external rates that make its thresholds defensible in 2026, and the enforcement work that gives the document force.
A policy fails in one of three ways, and none of them look like failure at the time.
The first is staleness. Published rates change. A policy citing the previous year's mileage figure, or a vague dollar-a-day meal cap, produces exceptions that reviewers approve because the rule is plainly out of date.
The second is weak enforcement. A document may state that alcohol is not reimbursable while nobody reads the individual line items on a restaurant bill. Alcohol then gets reimbursed inside meal totals every week. A rule with no detection behind it teaches employees that the rule is decorative.
The third is tax exposure, and it is the expensive one. The Internal Revenue Service (IRS) sets three tests for an accountable plan, meaning a reimbursement arrangement whose payments are not treated as wages. Its Fringe Benefit Guide, Publication 5137, was revised in October 2022. The three tests are a business connection to the expenditure, adequate accounting by the recipient within a reasonable period, and return of any excess reimbursement within a reasonable period. Payments made under a nonaccountable plan are taxable wages subject to all withholding. The policy language is what maps an organization's process to those three tests.
A travel and expense policy has two jobs in tension. It has to be specific enough to enforce and short enough to read. Every clause costs the reader attention, so the clauses worth keeping are the ones that change behavior.
Three principles hold the balance.
Name who the policy covers, including contractors, candidates, and non-employee travelers such as speakers or clinical investigators. Regulated industries need this section to be precise, because reportable spend obligations attach to the traveler category rather than to the amount.
State what requires approval before booking, who approves it, and at what dollar value. Set the threshold from the organization's own exception data rather than from a round number, and say plainly what happens to unapproved travel.
Cover air class by flight duration, preferred booking channels, rail versus air, and rental car classes. Where a travel management company is used, state whether booking outside that channel is reimbursable at all. Duty of care obligations, meaning the employer's responsibility for the safety of travelers, belong here as well.
Choose per diem, a fixed daily allowance paid whether or not the money is spent, or reimbursement of actual costs, and give the reason. Mixing the two without a rule creates the most common exception category. The General Services Administration (GSA) is the federal agency that publishes travel rates. Its Per Diem Bulletin FTR 26-01 sets the FY2026 standard federal rate at $110 for lodging and $68 for meals and incidental expenses. Those rates hold at the FY2025 level and apply to travel from October 1, 2025 through September 30, 2026. Locality rates are higher, so cite the GSA table by city rather than applying the standard rate everywhere.
Set a per-person cap, require attendee names and business purpose above a stated value, and state the alcohol rule explicitly. Silence on alcohol is read as permission.
Cite the current IRS business standard mileage rate and note that it changes mid-year. It did in 2026. The rate was 72.5 cents per mile from January 1. It rose to 76 cents per mile for July 1 through December 31 under IRS Announcement 2026-11, which modified Notice 2026-10. A policy that names one 2026 figure without a date is wrong for half the year.
List them. Common entries are travel companion costs, personal entertainment, minibar charges, traffic fines, flight upgrades bought personally, pet care, and lost baggage. The list is short, concrete, and the section employees actually read.
State the receipt threshold, the required contents of a receipt, the submission deadline in days, and the consequence of missing it. This section makes the accountable plan substantiation argument, so write it against the three IRS tests rather than by habit.
Define who grants an exception, how it is recorded, and what happens after repeated violations. Set a review date for the whole document, annually at minimum, and name the owner.
A policy works as a detection specification. Read each clause and identify the signal that would prove it was broken.
Some clauses are simple to check. A lodging cap tied to a GSA locality rate is a numeric comparison. Others need line-level reading of the receipt, because the violation is inside the document rather than in the total. A check that reads only the amount misses all of these. It misses alcohol on a dinner bill, a pet boarding charge on a hotel folio, and a companion's airfare inside a booking total.
A third group needs comparison across claims. Spend split into several submissions to stay under an approval threshold looks compliant claim by claim. Duplicate submissions across periods or employees look legitimate in isolation. Personal spend on a corporate card never appears in the expense system at all, so the card feed is the only place to find it.
There is a newer problem on top of those. A policy written before 2025 assumes a receipt is evidence. In our own platform data, generated documents rose from zero percent of flagged fraudulent receipts in March 2025 to 70.8 percent by mid-May 2026. Our explainer on receipt fraud covers that shift and its sourcing. Two clauses are worth adding in response. State that submitting a generated or altered receipt is a policy violation, regardless of whether the underlying expense was real. Then state what an employee should do instead when a genuine receipt is lost.
Four measures show whether the document is working.
Track them by department. Policy problems concentrate, and a company-wide average will not show the few teams that account for most of the exposure.
Different teams own policy work and audit work, so the document and the detection stop matching each other. Finance writes the policy. The expense platform enforces whatever its rules engine expresses. Everything the rules cannot see becomes an unwritten allowance.
Rules engines express thresholds and merchant categories well. They cannot read a hotel folio, compare a claim against the previous quarter, or judge whether a merchant exists. The clauses that get enforced are therefore the ones a rule states, and the clauses that matter most quietly become optional.
Our AI reads every line of every receipt on every report before reimbursement, and every corporate card transaction as it posts. Each one is checked against the organization's own policy rather than a generic template. That covers the line-level cases, such as alcohol inside a meal total or a personal charge inside a hotel folio. It also covers the cross-claim cases, such as split spend and duplicates across periods or employees.
Coverage is the difference. Policy compliance measured on a sample describes the sample. Measured on everything, it shows which clauses are working, which are being waived, and which departments need a conversation rather than a rewrite. We describe the individual checks in our expense report auditing overview.
Assess an existing policy clause by clause. For each clause, the signal that would prove it was broken either exists or it does not. The clauses without such a signal are the ones being ignored, and rewriting their wording changes nothing. Build the detection first, then trim the document to what can actually be enforced. Our AI expense audit page describes how policy is read at the line-item level across every report.
Nine sections cover it. Scope and eligibility, pre-trip approval thresholds, booking and class-of-service rules, lodging and per diem, and meals and attendee requirements come first. Then come mileage and ground transport, a non-reimbursable list, documentation deadlines, and an exceptions and violations process with a named owner and review date.
Per diem reduces receipt handling and makes budgeting predictable, and it pays the same amount whether or not the money was spent. Reimbursement of actual costs gives precise cost data and requires substantiation for every claim. Finance teams generally pick one method per expense category and state that choice in the policy, because mixing the two without a rule generates most exception volume.
The business standard mileage rate was 72.5 cents per mile from January 1, 2026. It rose to 76 cents per mile for July 1 through December 31, 2026 under IRS Announcement 2026-11. Policies citing a single 2026 rate need a date qualifier.
An accountable plan is a reimbursement arrangement that meets three IRS tests. The expense has a business connection, it is substantiated within a reasonable period, and any excess advance is returned. Reimbursements under an accountable plan are not treated as taxable wages.
Review annually at minimum, and on any change to federal per diem or mileage rates, entry into a new country, or a shift in corporate card program design. Recording the review date on the document lets employees see that it is current.