How to support expense compliance without becoming the villain

Expense compliance breaks down when your team only sees the spend after money's already been spent. You end up chasing missing receipts, questioning expense claims that employees submitted in good faith, and manually applying policies nobody fully understood. The finance team becomes an internal police force instead of a strategic partner.

The fix is to build the guardrails that keep spend in check before it happens, not after. That changes the dynamic completely.

This is general guidance for UK finance teams, not tax advice. VAT treatment and expense deductibility depend on your specific circumstances, so consult a qualified tax adviser before making decisions based on the rules covered here.

What HMRC's upstream compliance shift means for your expense process

HMRC's approach to enforcement has changed, and it affects every part of your expense process. According to HMRC's 2024 to 2025 annual report, the tax authority now raises 43% of its compliance yield by preventing errors before they happen, up from 24% in 2019 to 2020. HMRC calls this approach upstream compliance, and the shift means the tax authority now expects businesses to catch problems before they file tax returns, not after.

HMRC's technical notes put numbers on where the attention is going. The notes identify £7.1 million in estimated tax under consideration from PAYE Settlement Agreement and dispensation failures, which cover how employers report and tax employee expenses and benefits. They flag another £14.2 million from input tax overclaims across the wider mid-market portfolio.

These are open enquiry figures, not recovered tax. But they show what HMRC is investigating, and expense processes are central to that work.

Why after-the-fact review turns compliance into an adversarial process

When you only see expenses after the money's gone, your options are limited to rejecting the claim or clawing back the amount. Neither builds trust with your colleagues.

Finance teams using reimbursement models feel this most sharply. An employee pays out of pocket, submits the claim days or weeks later, and your team reviews it against policy without enough evidence to tell whether it was genuinely for work. The employee feels questioned, and you feel like the obstacle.

Most rejected claims come from misunderstanding, not bad intent. If you only see the expense after it's been paid, you're correcting problems rather than preventing them.

How to move accountability upstream, before spend happens

The biggest single improvement you can make is moving your controls to before the money's spent. An ACCA fraud prevention report describes how the UK government itself has adopted this approach. Its "Managing Public Money" rules require departments to assess fraud risk before programmes are approved, not as a compliance footnote added afterward.

Write policy limits that reflect operational reality

Nothing destroys the credibility of an expense policy guide faster than unrealistic limits. A single national hotel rate treats central London and rural areas the same way. That rate can't possibly work for both. HR Magazine notes that reducing the hotel room night spending limit to £80 "may be generous in Plymouth but harsh in London."

When employees see a meal allowance as the amount they can claim rather than a ceiling on what they can spend, they claim the maximum every time. To prevent this, you can set limits by city and by expense category, and review them each year against inflation. Bring department heads into the process before the limits go live. Policies people helped shape are policies they'll actually follow.

Build approval workflows with backup coverage and time limits

If approvals depend on one person, have no turnaround deadline, and stop when that person goes on leave, you've built the bottleneck your team might get blamed for.

Consider tiered approval thresholds that match your organisation's scale:

• Lower-value claims typically need only line manager approval.

• Mid-range claims benefit from a finance review step at a defined threshold, giving your team visibility without slowing the process down.

• Higher-value items warrant finance director sign-off as a final check.

Publish a deadline for each tier, such as two working days for line manager approval. When the deadline passes, automated reminders can escalate to a backup approver, so approvals don't stall in one inbox. How quickly are your current approvals actually being completed? If you don't know, that's the first metric to establish.

Multi-condition approval workflows route items to finance only when a line manager has already signed them off and the amount is above a threshold you set. Low-value noise never reaches your queue.

Codify your exception handling process

If your policy has no way to handle exceptions, employees face a bad choice: break the rules or stop getting their work done. An AccountingWEB article on structured controls makes the point well. A clear exception process replaces the one-off negotiations between employees and finance, which is where the "finance as the bad guys" dynamic usually starts.

You'll want to define three distinct categories:

• Pre-approved exceptions cover specific roles that always have above-standard limits for certain categories, defined in advance.

• Case-by-case exceptions require additional evidence and senior approval.

• Policy violations require investigation.

Log every exception and watch for patterns. If the same exception keeps appearing, the problem isn't the employee. It's that your limit no longer matches reality.

Making the compliant action easier than the non-compliant one

Client entertainment claims. A receipt that went missing the night before close. These are the moments when your expense compliance process either helps your employees or fights them. AccountingWEB puts it well: complying with an expense policy "should be as easy as ABC." When the system gets harder, employees stop trying to stay within the lines.

Automation is what makes this workable at scale. The ICAEW's AI Roundtable Report names expense anomaly detection and policy checking as one of finance's established uses for AI.

The strongest before-spend control builds the rules into the card. Spendesk's smart company cards carry pre-set limits and tie to team budgets. They block any further spending when previous receipts are overdue, so maverick spend never leaves the account.

If a transaction is declined, the employee is arguing with the card, not with someone in finance. The rejection is immediate and consistent, which means your team doesn't have to be the one saying no.

Card-embedded controls are only part of it. Spendesk is an all-in-one spend management platform covering company cards, expense management, accounts payable, procurement, and budgeting. The same pre-authorisation rules apply to reimbursement requests and supplier invoices as well as card spend. Finance sets the policy once, and the platform enforces it across every type of company spend.

Fast reimbursement is its own compliance mechanism. As Accountancy Age notes, delayed reimbursements can "complicate expense tracking, impact cash flow forecasting, and increase compliance risks." When employees see the system processing their valid claims quickly, they're far more likely to stick to the rules themselves.

Getting automation right takes upfront work, and the first few weeks will be uncomfortable as employees adjust to pre-approval workflows and real-time receipt capture. The alternative is chasing receipts by hand and rejecting claims after the fact, forever. That's what keeps your team in the villain role.

How senior accountability changes the compliance conversation

Even the best automation can't overcome a rule that only applies when it's convenient. The most common complaint about expense policies is that the rules aren't applied evenly. CIMA ethics guidance makes the point clearly: a colleague's seniority doesn't change whether bypassing the expense policy is acceptable.

When the policy applies to everyone equally, enforcement isn't personal. It's procedural. That takes the burden off your team.

That accountability has to be visible to work. The CFO, CEO, and board members should submit expenses through the same system and process as every other employee. Would your leadership team be comfortable if their expense claims were audited to the same standard as everyone else's?

For violations, a graduated response keeps finance out of the enforcer role:

• The first violation should trigger an automated system flag with a clear policy explanation rather than a manual rebuke from your team.

• The second should involve a coaching conversation with the line manager.

• The third should escalate to HR, with finance providing evidence instead of acting as the investigator.

Deliberate fraud goes through formal channels: HR, legal, and sometimes prosecution. Under the Economic Crime and Corporate Transparency Act 2023 (ECCTA), large UK organisations can now face criminal liability when an employee fraud incident benefits the company. The law applies where the organisation can't show it had reasonable fraud prevention procedures in place. Your expense compliance process is part of what demonstrates those procedures exist.

Once everyone's held to the same standard, the question changes. It stops being "is the review process fair?" and becomes "how much review do we actually need?"

Risk-based audits instead of universal policing

You don't need to review every claim to maintain expense compliance. The updated UK Corporate Governance Code takes what the Financial Reporting Council describes as a "targeted, proportionate and balanced response" to internal controls. That sets the UK apart from the more rigid approaches required in other jurisdictions, and Deloitte UK has endorsed the same principle. It applies directly to your expense review process.

Apply full review to claims above a materiality threshold you set, and use statistical sampling for routine low-value claims. Automated anomaly detection can handle the rest: duplicate submissions, claims from the same merchant on consecutive days, and amounts just below approval thresholds.

Define your high-risk categories up front. Cash claims, entertainment, international travel, and claims from employees with a history of exceptions are sensible starting points. That way, your review effort goes where the actual risk is. What percentage of your current claims get reviewed, and does that percentage reflect risk, or just capacity?

Your audit approach doesn't need to catch every £12 lunch receipt. It needs to catch the patterns that signal something more serious. Tell employees how the review process works and why, and they'll stop seeing finance as the team watching over their shoulder.

What good expense compliance actually looks like in practice

The real test is whether a new employee in their second week can submit a compliant claim without asking anyone a question, and whether your team can close the books at month-end without chasing a stack of missing receipts.

Five things work together to make compliance the default: before-spend controls, realistic limits, automated receipt collection, risk-based audits, and visible senior accountability. Together they turn finance into an enabler rather than the gatekeeper. For example, GWI achieved 95% receipt compliance after centralising their spend process across five countries.

If your process still depends on your team manually applying every rule, the automation options are worth exploring. According to Spendesk, the platform achieves up to 98% receipt collection, which means your team spends month-end closing the books, not chasing receipts. That's the shift from corrective work to strategic work.

See how Spendesk handles expense reimbursements and card-based spend control across a single platform.

Frequently asked questions about expense compliance

How do you measure whether your expense compliance process is working?

Track four metrics: how many receipts employees submit within your deadline (say, seven working days), what percentage of claims get rejected for policy reasons, how long it takes from submission to reimbursement, and how many exceptions get logged per quarter. If your rejection rate is high, the problem is usually the policy or the tools rather than the employees. If receipt submission is low, your capture process is creating too much friction. Trending these quarterly tells you whether your controls are preventing problems or just catching them.

What records must you keep for HMRC?

Under UK tax rules, companies must keep records for six years after the end of the financial year they cover. This overrides the shorter minimums in the Companies Act 2006 (three years for private companies, six for public).

Can you reclaim VAT on flat-rate subsistence payments?

No. Under Notice 700, you can't claim input VAT on flat-rate subsistence payments to employees, even if the employee paid VAT on the underlying spend. To reclaim VAT on subsistence, the business normally needs to reimburse the actual cost and hold a valid VAT receipt. HMRC does allow benchmark scale-rate arrangements in some cases without receipts for every cost, provided the qualifying conditions are met.

What happens if your annual staff event exceeds £150 per head?

If the cost exceeds £150 per head (inclusive of VAT) in a tax year, the entire amount becomes taxable, not just the excess. This catches out companies that treat each event separately. You need to track the total cost across all qualifying events in a tax year, not the cost per event.

When does mandatory payrolling of benefits in kind start?

The government announced a one-year delay in April 2025. Mandatory payrolling for most benefits in kind now starts in April 2027, not April 2026. If you miss HMRC's registration deadline for voluntary payrolling changes ahead of that, you may have to wait another tax year to start. If you haven't begun planning the transition from P11D reporting, the window is narrowing.