The percentage of expense reports that companies audit still varies greatly based on personal preference, as increased corporate adoption of automated systems enables companies to incorporate their own rules to flag out-of-policy expenses and to help them comply with Sarbanes-Oxley reporting requirements.
"Automated expense reporting systems have given people the opportunity to reduce audits to a relatively low number since the rules which reflect their travel policies are embedded in the system. Therefore, to a great extent there's no need to audit beyond that," said David Hillman, a principal in New York-based Consulting Strategies. "That being said, there are certain circumstances under which you want to audit, and just good policy says you should audit a certain sample to make sure that in fact people are following the policy and the system is working."
Hillman said that it is simply "good business practice" to audit a random sampling of expense reports, with the number of random audits falling "typically somewhere between 5 and 10 percent."
David Kaufman, partner in New York-based Acquis Consulting Group, agreed. "A lot of best practice is to audit 5 to 10 percent of expense reports. Very often when you tell a finance person that, they react, 'That's too low. We need to look at more.' In my mind, you're really auditing all of the reports utilizing the flags. The actual auditing of the 5 or 10 percent is just going beyond that where somebody is looking at each expense individually, seeing if it makes sense, if the receipts are appropriate, etc."
Kaufman said automated systems have become so advanced that they can cross-check all reports filed to see if a receipt was duplicated and an expense submitted by the same person or a co-worker months earlier, or whether two employees have claimed the same person as a dinner guest on the same night. "Those are the types of things that would be very difficult to find with individual audits, so the technology is allowing things to be much more powerful," he said.
Chris Juneau, senior director of product marketing for Concur Technologies, a Redmond, Wash-based expense reporting firm, similarly spoke of the power of built-in flags. "Each company can set their own policies and audit rules to match their needs. An employee putting a car purchase on an expense report—while rare and noteworthy—isn't in and of itself necessarily a fraudulent activity. Likewise, a seemingly innocent gift or entertainment expense could be an out-of-policy expense if that employee works for a pharmaceutical company and the recipient of the gift is a physician."
"Because of the control and visibility inherent in an automated process, companies can concentrate their resources to focus on the exceptions flagged by the system, instead of worrying about the vast majority of expenses, which are in compliance," Juneau said. "Random audits for companies with automated expense reporting are usually based on volume. The number can vary, but we see most organizations randomly auditing around 20 percent of their reports."
"While 100 percent audit is still very common, the scope of the audit they performis narrowing," said Alan Tyson, CEO and president of Reston, Va.-based expense reporting firm DataBasics. "Much of the remaining auditingeffort is focusedon receipts. Automation can facilitate this review, especially where the organizationhas converted toimage-based receipt management, but someonestill needs to match receipts againstreported expenses and make a judgment regarding the adequacy or legitimacy."
Tyson said there is "considerable waste whenreports are being universally tested against acomprehensive set of automated business rules.In effect, the software serves as a surrogate formuch of the calculator and categorization-related approval and audit activity. Still, automated rules themselves need to bereviewed/refinedas part of a Sarbanes-Oxley-compliantcontrol structure."
"We coach clients that on average most organizations look to a 10 percent random audit percentage, but it is very much up to the company," said Troy Thibodeau, vice president of marketing for Eden Prairie, Minn.-based Gelco Information Network. "We run into companies that say they are very control-conscious and want to have more than 10 percent. We have others that have a less control-conscious environment and they say 3 or 4 or 5 percent is sufficient," Gelco's Thibodeau said.
With 204 organizations providing responses, BTN's second annual payment and expense managers' survey
(BTN, Oct. 31, 2005) found that the average number of T&E expense reports audited was 44 percent. Twenty-six percent of respondents said they do not audit any reports, while 29 percent said they audit every single one of their reports.
Thibodeau said that it is fairly common for companies, when they first adopt an automated expense reporting system, to initially audit a large amount of reports. Then, once they become more familiar with the system, "they resonate back down to about a 10 percent random audit."
The decision to randomly audit ultimately falls to a company's senior financial management staff, Hillman said. "Those people are used to sampling techniques. Once they feel comfortable with the system, then the fact you're doing what appears to be a small percentage is something they're comfortable with," he said.
Both analysts and expense reporting providers agree that, in addition to a percentage of random audits, companies also must audit targeted groups within their organizations.
"There are certain people in the company you might want to flag for audit in any case, and that would include the so-called 'cowboys,' people who you identify as somewhat reckless with respect to the travel policy, and a level of senior executives and board members who, for compliance with Sarbanes-Oxley, you want to make sure are audited 100 percent," Hillman said.
Hillman said it also is common for companies to automatically audit expense reports over a certain dollar threshold, particularly those involving international travel. "Materiality comes into play," he said. "If there is any funny business going on, you might as well look at the big numbers rather than the small numbers."
Tyson and Kaufman both pointed to the use of pre-population credit card information as a way some companies are further reducing the number of audits performed. "If you use your MasterCard, those charges will come into your expense report. You can set the system so the user cannot change the amounts, or the dates, or the vendors. The IRS accepts that as a receipt. That eliminates the need for an auditor to audit that receipt because it's already verified by the system as a legitimate receipt," Kaufman said.
In addition to providing software that automatically flags out-of-policy expenses, some firms also offer third-party auditing services.
"When we perform audit services for clients, we substantiate there are receipts associated with an expense and that those receipts are originals and not copies, we make sure they're not mutilated receipts, we make sure that somebody hasn't altered the receipts in any way, we try make sure that receipt numbers and vendors match with what was filed in the report," said Gelco's Thibodeau.
"We've seen a significant increase in audit services business because of Sarbanes-Oxley," he said. "The visibility to control environments has really made companies re-look at how they want to perform that objectively and they look to third parties like Gelco to do that."