In Startup Expense Management, Review Beats Pre-Approval

Expense management is how a company controls what employees spend on its behalf: policy, approvals, cards and reimbursements. A startup’s legal minimum is short. Above it, the evidence favours reviewing the whole ledger after the spend over approving each item before it: approval limits move spending just below the line, and expense fraud shows up as a slow pattern.

The legal minimum dates from 1962 and has barely moved. The Internal Revenue Service wants a receipt for lodging and for anything of $75 or more. That line was set on 1 October 1995 and never indexed; carried forward with consumer prices, it would be about $163 in August 2026 prices. A policy can therefore ask for more paperwork than the law does and still review less than the fraud data suggest. What matters in expense management is which controls earn their cost.

The four parts of expense management: what the IRS requires, and what is the company’s choice

Part	What the IRS requires for tax-free reimbursement	What the company chooses	What a mistake costs
Policy	Reimburse business expenses only (business connection)	Spending limits, travel class, per diem rates	A flat allowance is taxed as wages
Records and receipts	Amount, time and place, business purpose and business relationship; a receipt for lodging and for anything of $75 or more	Receipts below $75	Unsubstantiated amounts are taxed as wages
Reimbursements and advances	Account within a reasonable period and return any excess (safe harbour: 30, 60 and 120 days)	How fast employees are repaid	A pattern of abuse turns every payment into wages
Approvals and cards	Nothing: the law asks for evidence, not permission	Who approves what, card limits, review	An estimated 15% of sampled federal card purchases lacked proper authorization (GAO, 2008)

Source: 26 CFR 1.62-2; 26 U.S.C. 274(d); 26 CFR 1.274-5; GAO-08-333.

Expense management starts from a legal floor that fits on one page

The floor comes from two parts of the tax code. Treasury regulation §1.62-2 treats a reimbursement arrangement as an accountable plan when it meets three requirements: business connection, substantiation and the return of any excess. Payments under such a plan “are excluded from the employee’s gross income” and carry no employment taxes; under a plan that fails any test, they count as wages. For timing, the regulation offers a safe harbour: an advance within 30 days of the expense, substantiation within 60 days and any excess returned within 120 days.

Substantiation has its own statute. Section 274(d) of the Internal Revenue Code asks, for travel, gifts and similar items, for four elements: the amount, the time and place, the business purpose, and the business relationship of anyone who benefits (26 U.S.C. 274). The regulations add the receipt rule. Documentary evidence is required for lodging and for “Any other expenditure of $75 or more” (26 CFR 1.274-5). Below $75 the record of amount, date, place and purpose is still needed; only the receipt is optional. None of these rules requires anyone to approve a purchase in advance.

The stakes sit in two clauses. An allowance paid “regardless of whether the employee incurs” business expenses fails the first test, so a monthly stipend with no accounting is salary. And if an arrangement “evidences a pattern of abuse of the rules”, every payment under it is treated as made under a nonaccountable plan. Take a hypothetical startup that reimburses $60,000 a year. Reclassified as wages, that sum would cost the company $4,590 in employer social security and Medicare tax at the 2026 rates of 6.2% and 1.45% (IRS Publication 15), before the employees’ own income tax.

The receipt rules answer a 1962 problem, and the $75 line has not moved since 1995

In 1930 the entertainer George M. Cohan won the right to deduct travel and entertainment costs he could not document with certainty (Wikipedia). Three decades of approximation later, John F. Kennedy told Congress in 1961 that “expense account living has become a byword in the American scene” (Kennedy, 1961). Congress added section 274 to the tax code on 16 October 1962, and the regulation now says the substantiation rule “supersedes the doctrine found in Cohan v. Commissioner” (26 CFR 1.274-5T).

The receipt line has moved once since. In Notice 95-50 the IRS raised it from $25 to $75 for expenses from 1 October 1995, a change “expected to reduce the recordkeeping burden on affected taxpayers, including individuals and small businesses” (T.D. 8715, 1997). Consumer prices have risen by a factor of 2.18 since October 1995 (BLS, CPI-U), so today’s $75 buys what about $34 bought then (our arithmetic). Federal procurement, by contrast, indexes its thresholds every five years by law (41 U.S.C. 1908); its micro-purchase limit is now $15,000 (FAR 2.101), up from $2,500 in 2008.

A startup that demands a receipt for every coffee asks for more than the IRS has since 1995; one that collects nothing above $75 falls below the floor.

Expense fraud in small companies is common, slow and small per month

The case for heavier control rests on fraud, and the best recent data come from the Association of Certified Fraud Examiners (ACFE). Its 2026 report covers 2,402 cases investigated between January 2024 and September 2025, each the largest case a responding examiner had worked, so its losses lean high and include only frauds that were caught (ACFE, 2026). Expense reimbursement schemes appeared in 13% of cases, with a median loss of $36,000. In organisations with fewer than 100 employees they appeared in 19% of cases, against 10% in larger ones, and the smallest organisations had the highest median loss of any size band across all schemes, $126,000.

The shape of the loss matters more than its size. Expense schemes ran a median 18 months before detection, against 12 months for all frauds, and did damage at a median $1,900 a month, the second-slowest pace ACFE measured. That is about $22,800 a year (our arithmetic), spread across many ordinary-looking claims. What gives a scheme away is the series: the same merchant every week, round amounts, claims gathered just under a limit. In expense management, a control that inspects one claim at a time is looking at the wrong unit.

Approval limits work like notches, and where anyone has measured, spending piles up beneath them

Public economists would call an approval limit a notch. Henrik Kleven and Mazhar Waseem studied tax notches, points where the cost of a choice jumps. They found that “Notches create excess bunching on the low-tax side and missing mass on the high-tax side of a cutoff”, with a band just above the cutoff where no informed person would choose to be (Kleven & Waseem, 2013).

An approval limit is a notch in the cost of a claim: one dollar over it adds a request, a wait and a question. For the person buying, a $510 purchase is worse than a $490 one, or than two of $255. The cost differs in kind, though. A tax notch changes what a person owes, an approval notch changes time and scrutiny, and some bunching below a limit is honest thrift. Whether approval limits produce bunching on the scale of tax notches is a question for the evidence.

The few cases that have been measured show it. Mark Nigrini, an accounting professor, found a spike at $24.50 in one company’s payables, from travel claims under a $25 voucher requirement: “Employees were apparently biased toward claiming $24.50”. In an Arizona case he describes, most of the 23 checks a manager in the State Treasurer’s office issued to a bogus vendor sat just below $100,000, a level above which checks possibly drew more scrutiny (Nigrini, 1999). In federal purchase cards, the Government Accountability Office counted over $600 million of split transactions in one year: the same cardholder, the same vendor, the same day. They “appeared to have been transacted to circumvent the micropurchase threshold” of $2,500 (GAO, 2008).

Where control thresholds have been measured, activity piles up just below them

Setting	Threshold	What piled up below it	Source
One company’s travel claims	$25 voucher (receipt) rule	Claims of exactly $24.50	Nigrini (1999)
Arizona State Treasurer’s office, 1993 court case	$100,000 checks, possibly subject to extra scrutiny	Most of 23 fraudulent checks, worth nearly $2 million in total	Nigrini (1999)
US federal purchase cards, July 2005 to June 2006	$2,500 micropurchase limit	Over $600 million of same-day, same-vendor split purchases	GAO-08-333
Pakistan’s income tax	Notches in average tax rates	Bunching that is large and sharp below each notch	Kleven & Waseem (2013)

Source: as listed. The Nigrini cases are single examples; GAO’s figure comes from its analysis of bank transaction data.

The consequence is a place to look. Call it the shadow band: the top 10% of the range just under each limit, where split, shaved and rounded claims gather. A startup with a $500 pre-approval limit and the IRS’s $75 receipt line has two shadow bands, $450 to $499.99 and $67.50 to $74.99. A rising share of claims in either band is a signal no approver of single items can see, while the limit produces a clean record of compliance. But a band also fills when a cap becomes a target: staff book up to a nightly hotel cap instead of the cheaper room, and the average night can rise. Shaving empties the range just above a limit, a target the range well below it; only the whole distribution tells them apart.

Cards moved the control from before the purchase to after it

The federal government ran the largest documented experiment. The Federal Acquisition Regulation made the purchase card the preferred way to buy below the micropurchase limit, and card purchases grew from $3 billion in fiscal 1996 to $17.7 billion in fiscal 2006. In fiscal 2025 the GSA SmartPay programme handled $39.4 billion at an average of $480 a transaction and earned agencies $471 million in refunds, about 1.2% of spend (GSA SmartPay; our arithmetic).

Businesses use cards the same way. In 2022 US business payers, a Federal Reserve category that includes non-profits and government agencies, made $1.40 trillion of general-purpose credit card payments, about a quarter of all credit card value (Federal Reserve Payments Study, 2024; our arithmetic). Their average payment was $275, against $80 for consumers.

Below its limit a purchase needs nobody’s permission, and the issuer records every transaction. That record makes review cheap. It does not replace the receipt: a card statement “alone will not constitute acceptable documentary evidence of a lodging expense”, the IRS has said, because it does not separate the room from meals and personal charges (T.D. 8715). A card without review also fails. In GAO’s sample of 96 federal card transactions over $50, an estimated 41% were not properly authorized or not independently received (95% confidence interval: 31% to 51%). A card programme without review is approval with the approvals removed.

Review after the spend is the control linked to smaller, shorter frauds

ACFE’s data suggest where the control budget belongs. Frauds at organisations with management review in place had a median loss of $84,000, against $186,000 without it, and were caught in 10 months instead of 18. Surprise audits went with $74,000 against $149,000, and detection in 8 months instead of 16; proactive data monitoring, with $70,000 against $150,000. These are associations across all fraud types, drawn from frauds that were caught, so they overstate what any one control buys.

They also show where small firms are thin. Among victims with fewer than 100 employees, 41% had management review, against 79% of larger ones; 16% ran surprise audits, against 52%; 17% monitored data, against 58% (ACFE, 2026). For expense management in a small company, review fits the shape of the fraud: an 18-month scheme leaves a series that shows what one claim hides, from shadow-band entries to duplicate receipts.

Two ways to spend a startup’s control budget, in hours a year

Take a hypothetical 30-person startup with 1,800 card transactions and reimbursement claims a year (150 a month), checked by people whose time costs $100 an hour.

Step	Approve every item	Floor plus review
Manager approval	Every item at 3 minutes: 90 hours	Commitments over $2,500 only, 24 a year at 15 minutes: 6 hours
Receipts	Every item, 2 minutes to submit and 4 to check: 180 hours	Lodging and items of $75 or more, 810 items (45%): 81 hours
Monthly review	None	Every shadow-band item plus a random 10%, 270 items at 6 minutes: 27 hours
Surprise audits	None	4 a year at 6 hours: 24 hours
Total	270 hours, $27,000	138 hours, $13,800

Hypothetical company. Item counts, minutes and the hourly cost are assumptions; the $75 line is the IRS’s (26 CFR 1.274-5). Totals computed by us.

The first regime costs about $27,000 a year whether or not anyone cheats: more than the $22,800 a year a scheme at ACFE’s median pace would take, though probably no more than the fraud it targets measured at the mean. Losses are skewed: in ACFE’s data even expense schemes, with a thinner tail than fraud overall, average $113,000, about three times their median. Drawn from organisations of every size, they give one 30-person company a scale and no more.

The comparison that holds is therefore between the two regimes, and the table probably understates the first. Its 3 minutes per approval are low: customers of one invoice-software vendor report far longer for a multi-stage chain, for a small bill as for a large one, although a startup with one approver sits nearer the table. The second regime costs about half as much, keeps the legal floor, and puts 51 of its 138 hours, more than a third, into review and surprise audits.

Does trust beat control in an expense policy?

Netflix makes the case against most of this in five words. Its culture memo gives its expense policy as “Act in Netflix’s best interests” and argues that so few rules prevent “the process creep that typically happens when companies grow” (Netflix). A laboratory game backs the instinct. Armin Falk and Michael Kosfeld let one player, the principal, either trust another or impose a minimum performance level on them. “Principals who trust induce, on average, a higher performance and hence earn higher payoffs than principals who control”, they found, because most agents read the restriction as a signal of distrust. Under control, more than half chose exactly the minimum (Falk & Kosfeld, 2004): the floor became a target. Whether employees filing claims behave like subjects in a one-shot game is untested.

Falk and Kosfeld’s result is strongest for light, item-level control, the experiment’s worst case: “For low levels of x, control generates significantly lower profits than trust”. Beyond that it fades. A replication with 364 subjects found results that “largely conflict with those of the original study”, with hidden costs of control “of low magnitude” (Ploner, Schmelz & Ziegelmeyer, 2010). Netflix itself concedes that “a few people have taken advantage of our culture in bad ways”. And five words do not satisfy §1.62-2: a company that reimburses tax-free still needs substantiation and the return of any excess. The defensible version of the objection is narrower. Trust at the point of purchase, which a card with a limit provides; verify afterwards, which a review provides.

Cards at the till, review of the ledger

A policy built on this evidence is mostly a calendar. The founder writes each row once; the board checks that each one happened. A company that approves every item today can move its expense management to this calendar one approval layer at a time. Each step is tested for a quarter on a unit cost such as the average hotel night, against a team kept on the old rule, since prices drift anyway. An unchanged or slightly higher unit cost still passes if routing hours fall sharply.

When	What the company does	Why
Once, at setup	An accountable plan: business connection, substantiation within 60 days, excess returned within 120 days, no flat allowances	Payments under a plan that fails any test are wages
Once, at setup	A web form or other reporting channel that reaches a board member, since whistleblowers who skip formal channels most often tell their direct supervisor (32%), in a startup often a founder	Tips, 55% of them from employees, uncovered 43% of frauds in ACFE’s 2026 study; with a channel, the median fraud cost $100,000 over 11 months, against $150,000 over 17. About a quarter of small businesses have one, against 85% of larger ones
At each purchase	Cards with limits for routine spending; amount, date, place and purpose recorded for every item; a receipt for lodging and for anything of $75 or more	The IRS floor, and no more
Before a commitment	Pre-approval for contracts, annual subscriptions, contractors and travel above a set cost	These are hard to undo once signed
Every month	A review of the ledger by someone other than the approver: every shadow-band claim, plus a sample including the largest claims, each checked against its documents, with the band’s share counted	Expense schemes ran a median 18 months before detection; a reviewer who only checks for a signature repeats the approval
Every month	The founders’ own claims, read by a board member or outside accountant	Owners and executives committed 16% of ACFE’s cases, at a median loss of $475,000 over 23 months, against $50,000 over 8 for employees
Every quarter	A surprise audit	ACFE links surprise audits to smaller, shorter frauds
At each board meeting	When the ledger and the founders’ claims were last reviewed, by whom, what the sample found, the shadow-band share over time, and whether reimbursements still run through an accountable plan	A 100% approval rate says nothing about where claims sit

The law asks for evidence, and review finds the pattern

The law asks a startup for evidence, not permission: a business reason, a record, a receipt for lodging and for anything of $75 or more, and the return of anything unspent. Approval limits added on top tend to move spending just below the line, and the frauds they target are slow patterns. Expense management gets more from the same budget with cards with limits at the point of purchase, a review of the whole ledger after it, and an occasional audit that nobody expects. For the hypothetical 30-person startup, that regime takes 138 hours a year, about $13,800, against $27,000 for approving every item.

An approval sees a receipt; a review sees the pattern.

Notes and sources

• Association of Certified Fraud Examiners (2026). Occupational Fraud 2026: A Report to the Nations.
• Bureau of Labor Statistics. Consumer Price Index for All Urban Consumers (CPI-U), series CUUR0000SA0, October 1995 and August 2026.
• Falk, A. and Kosfeld, M. (2006). The hidden costs of control. American Economic Review 96(5), 1611–1630; read in its 2004 IZA Discussion Paper version (No. 1203).
• Federal Acquisition Regulation, 48 CFR 2.101 (micro-purchase threshold).
• Federal Reserve (2024). Federal Reserve Payments Study: Cards and Alternative Payments, NPIPS detailed data for 2015–2022.
• Government Accountability Office (2008). Governmentwide Purchase Cards: Actions Needed to Strengthen Internal Controls to Reduce Fraudulent, Improper, and Abusive Purchases, GAO-08-333.
• GSA SmartPay. Statistics and Reports, fiscal 2025 figures.
• Internal Revenue Service (2026). Publication 15 (Circular E), Employer’s Tax Guide.
• Internal Revenue Code, 26 U.S.C. 274, with its statutory notes; 41 U.S.C. 1908.
• Kennedy, J. F. (1961). Special Message to the Congress on Taxation, 20 April. The American Presidency Project.
• Kleven, H. J. and Waseem, M. (2013). Using notches to uncover optimization frictions and structural elasticities: theory and evidence from Pakistan. Quarterly Journal of Economics 128(2), 669–723.
• Netflix. Netflix Culture (culture memo).
• Nigrini, M. J. (1999). I’ve got your number. Journal of Accountancy, May.
• Ploner, M., Schmelz, K. and Ziegelmeyer, A. (2010). Hidden costs of control: three repetitions and an extension. Jena Economic Research Papers 2010-007; published as Ziegelmeyer, Schmelz and Ploner (2012), Experimental Economics 15, 323–340.
• Treasury regulations 26 CFR 1.62-2, 1.274-5 and 1.274-5T; Treasury Decision 8715 (Federal Register, 25 March 1997).
• Wikipedia. George M. Cohan.

Where a figure has no source of its own, it is worked out from the cited rules, price indices and surveys, and the 30-person startup in the control-budget table is hypothetical. ACFE’s figures describe frauds that were caught, and its control comparisons are associations. The widely quoted GBTA cost of $58 per expense report is left out: it dates from 2015, although one vendor guide gives it as 2023, and it describes a one-night hotel report at companies filing about 51,000 reports a year.