Expense Report Risks: A Risk Map for Global Finance Teams

Expense reports are rarely the largest line in a group’s income statement. Yet they remain one of the most scrutinised processes by auditors, one of the most frequent sources of internal investigations, and one of the most revealing indicators of a company’s control culture. Every claim combines an individual decision, a manager’s approval and an accounting entry, which makes the process a concentrated test of how well controls work.

This article opens a series that grew out of discussions with members of our User Club: finance, internal control and audit leaders from international groups operating across many countries and entities. Their shared experience paints a clear picture of where expense report risk really sits today, and why it is harder to see than it used to be.

One observation framed everything else: the tools are mature and the rules exist. Expense management platforms now check most claims at the point of entry, apply policy caps and route each report through a hierarchical approval workflow.

And yet anomalies persist. Workarounds still go through the claim itself, and the ease with which a fake claim can now be generated only reinforces them. But they increasingly rely on behavior too: automatic approvals, managerial complacency and tolerated habits have become the main channels through which non-compliant claims reach the ledger. Risk now lies as much in behavior as in the declaration.

The nature of the flow makes this shift particularly hard to detect. Expense reports are a high-volume process: hundreds or thousands of claims each month, most of them for small amounts. When controls are performed manually after the fact, they are limited to spot checks on small samples, with no guarantee that high-risk situations are covered. Some weaknesses simply cannot be seen one claim at a time. Rubber-stamp approvals, recurring delegations, ignored alerts and gaps between the expense tool and the accounting records only become visible at the scale of the whole system.

Technology is accelerating the problem. Generative AI has made fabricating a convincing receipt almost effortless. In a survey published by Emburse in June 2026, 34% of the 2,000 employees questioned in the UK and the US admitted having used AI to generate a fake business receipt. When the receipt itself can no longer be trusted as proof, controls that rely on visual inspection lose much of their value.

The stakes go beyond individual claims. The ACFE’s 2026 Report to the Nations, based on more than 2,400 cases in 143 countries, estimates that a typical organisation loses 5% of its revenue to fraud each year. Expense reimbursement schemes account for 13% of the cases studied, with a median loss of $36,000, and typically run for 18 months before being detected.

Twenty risks emerged from the discussions, grouped into five families. One distinction runs through all of them: some risks originate with the claimant, others with the approver.

1. Fraud and abusive behavior. Falsified receipts, duplicate submissions, personal expenses declared as business costs, deliberately inflated amounts, collusion between claimant and approver or supplier, and deliberate approval of fraudulent spend.

2. Errors and poor practices. Data entry mistakes on amounts or currencies, incorrect categorisation or accounting allocation, misuse of corporate cards, missing or lost receipts, and misapplication of the policy.

3. Tax and regulatory non-compliance. Unjustified recovery of VAT or other indirect taxes, an unreliable audit trail, failure to retain supporting documents, and expenses that may be requalified as benefits in kind under local payroll rules.

4. Failure of managerial control. Lack of independence (self-approval, proximity between claimant and approver), controls that are insufficient or purely formal, and automatic validation below thresholds with no subsequent review.

5. Weakness of the framework. Policies that are insufficient, ineffective or poorly rolled out, and alerts that are too few or left untreated.

Not all twenty risks carry the same weight. Five stand out as priorities for the groups involved:

• falsified receipts;
• duplicate expense claims;
• collusion between claimant and approver;
• deliberate approval of fraudulent spend by a manager;
• controls that are insufficient, untargeted or purely formal.

The most telling feature of this list is its balance. Three of the five priority risks sit with the approver, not the claimant. The weak point has moved further down the chain, to the moment where someone is supposed to look at the claim and decide.

Tax and regulatory risks, by contrast, are generally seen as lower priority. That does not mean they are minor. It may simply reflect the fact that their consequences surface later, during a tax audit, rather than in day-to-day operations.

Three shared conclusions shift the question from “do we have controls?” to “can we show they work?”

Self-approval is a structural blind spot. Many groups accept it for small amounts or high-volume populations, for understandable efficiency reasons. But it is almost never offset by a subsequent review. Without that review, self-approval creates an area where no one is looking.

Policies alone are not enough. Too often they remain theoretical, defined at group level and poorly adapted to local realities. Alerts are numerous but seldom followed up. A poorly calibrated framework produces noise rather than control. The policy has to be embedded in the tool itself, translated into rules, thresholds and categories.

Transactional review has reached its limits. Checking claims one by one cannot reveal a pattern of small, repeated anomalies, which is precisely how behavioral risk expresses itself. The answer is a longitudinal approach: analysing patterns over at least three to six months, and ideally longer, by employee, by approver and by expense type, and reconciling expense data with accounting records.

An illustrative case shows why. Several employees each claim a meal from the same supplier, for the same amount, in the same location, on the same day. Each claim is supported by a receipt, each falls within policy, and each has been approved. Reviewed individually, nothing stands out. Only by cross-analysing claims across employees does the pattern appear: one expense, potentially reimbursed several times.

The same logic applies to the link with accounting. Comparing the expense tool with the general ledger can reveal approved claims that never reached the books, entries booked with no equivalent in the tool, or differences between approved and recorded amounts.

Underlying all of this is a simple observation: visibility often prevents more effectively than sanctions. Making anomalies visible to managers is frequently enough to change behavior.

This is where effectiveness of measurement comes in. A control that exists on paper but is never triggered, or triggered and ignored, gives an illusion of security. Boards, auditors and control functions increasingly expect evidence that controls operate as intended. For expense reports, this means tracking indicators over time, such as self-approval rates, alert treatment rates, approval delays and reconciliation gaps, rather than relying on the existence of a policy or a workflow. The evidence supports this shift: according to the ACFE, organisations using proactive data monitoring and analysis suffer median fraud losses 53% lower and detect fraud 44% faster than those that do not. Yet fewer than half of the victim organisations studied had such monitoring in place.

From policy compliance to control effectiveness

This risk map is not a theoretical inventory. It reflects what finance, internal control and audit teams in international groups actually observe. Its message is clear: the next gains in expense control will not come from adding rules, but from testing whether existing rules hold up against real behavior, across all expenses rather than a sample.

In the articles that follow, we look at each family of risk in turn: what practitioners see in the field, how the risk works, which key control addresses it, what good practice looks like, and how to measure whether the control is effective. The next article starts with the most visible family: fraud and abusive behaviour.

Sources:

Emburse, survey conducted by Atomik Research among 1,000 employees in the UK and 1,000 in the US, 5–8 May 2026, published June 2026

ACFE, Occupational Fraud 2026: A Report to the Nations (figs. 5, 8, 28 and 29)