Vendors, Buyers Diverge On Expense Auditing Process

A new report released by Geac—the parent company of Extensity Inc.—raises questions about how much a company should audit and which reports it should audit. The results released this month of a 32-client expense report auditing best practices and benchmarking study, found that the majority of companies using the Extensity system audited between 10 percent and 25 percent of expense reports. Other expense vendors disagreed on the exact percentage of reports a company should audit.

Redmond, Wash.-based Concur Technologies said the benchmark for auditing incoming expense reports should peak above 25 percent. "With the focus that Sarbanes-Oxley has placed on the expense management process, companies are doing more auditing because they have to attest to the legitimacy of their process controls," said Elena Donio, Concur vice president of sales and marketing. "We see a lot of them tightening down the hatches a bit in this area. Reducing audit is an abdication of controls."

Toronto-based Necho Systems Corp. said it encourages customers to audit just around 10 percent of incoming expense reports. Minneapolis-based Gelco Information Network agreed. "The results have shown that if you audit more than 10 percent, it costs you more to audit than you will recover from the fraud or accidentals," said Dave Rotman, Gelco vice president of product management.

Establishing benchmarks and best practices in expense report auditing traditionally have been elusive pursuits, considering the different needs of companies based on their size and industry: Some companies randomly audit, while others audit every single report; some pick a percentage of reports to take a closer look at, yet others monitor only those submitted by "maverick spenders."

Necho vice president of marketing Marc DiGiorgio agreed with the latter method, saying companies should just "pick on the bad apples."

However, as Sarbanes-Oxley has broached the subject within Corporate America—the legislation establishes new rules for corporate governance—Donio is confident that a benchmark will follow. "Over the next year, as we see companies start to certify, you'll see some precedents set for what flies and what doesn't, and people will feel a lot more comfortable," she said.

Although "there's never really been an industry source that establishes benchmarks," said Christa Degnan, an Aberdeen Group analyst specializing in expense management, there is one best practice in expense management for tight control: "Companies should automate the expense process as much as possible." She noted that in addition to enabling employees to enter the system electronically and letting managers and auditors view reports in a digital environment, other elements of automation include electronic charge card feeds and the imaging or electronic storage of receipts. This type of environment, vendors and consultants claimed, allows companies to audit more in less time.

In the past, companies audited a fixed range or specific percentage of the reports that came in, but with the emergence of automated expense reporting the debate of auditing has shifted from quantity audits to quality audits. Since most expense reporting platforms in recent years have enabled clients to build policy and controls into the system, out-of-policy expenses are flagged so audit-worthy expense reports gain more visibility—making it easier to pick on the bad apples.

"There is slicing and dicing of the data that you want to do to make sure that you are auditing the things that represent the higher risk," Concur's Donio said. Many companies exemplifying best practices keep a closer eye on rebel spenders, vendors said, auditing 100 percent of expense reports submitted by those considered likely to be noncompliant, while auditing only a percentage of the employee population at large.

"We can see where people are not adhering to policy," said T&E expense administrator Nancy Sampson of Nutley, N.J.-based Hoffmann-La Roche Inc. In the past, the company audited 10 percent to 20 percent of all expense reports, but now it uses Gelco's expense management solution, which flags reports that deviate from policy. Sampson said the company now looks only at those flagged reports, as well as those "reports over $2,000 and from international travel."

Philadelphia-based Cigna Corp. also has moved from auditing a fixed percentage to taking a closer look at reports that fit predetermined criteria.

"We audit everything over a certain dollar threshold, then randomly audit others," said Tracy Thompson of Cigna at a panel on T&E best practices held in New York City by the Institute of Management and Administration. "We don't take a look at everyone. Before the Web-based system was put in place, we audited 100 percent."

While auditing every expense report filed has been a surefire way to clamp down on deviant spenders and recover accidentals, companies have moved away from the model due to costliness. Auditing all expense reports, Degnan said, "gets to the issue of risk versus reward. Many companies do still believe in doing 100 percent auditing. They can start to pare back that risk with an automated system when they have a technological process in place to check some of these."

Auditing too much has been a tangible issue for expense managers. "You don't want to spend $10 to save $2," said Dwight Drum of American Tire Distributors, adding that his company also avoids auditing randomly. "If you use a random audit approach, it's like closing your eyes hoping to catch what you're looking for."