Finance AI Skill

Expense Audit

Design and execute expense audit programs including policy compliance reviews, anomaly detection, fraud investigation, and continuous monitoring frameworks. Use when conducting expense audits, detecting fraud patterns, building audit workflows, or implement...

Expense Audit & Compliance

Design and execute comprehensive expense audit programs including policy compliance reviews, anomaly detection, fraud investigation, and continuous monitoring frameworks to protect organizational assets and ensure expense policy adherence.

Workflow

Phase 1: Audit Program Design

  1. Audit scope and objectives:
  1. Sampling methodology:
  1. Audit criteria development:

Phase 2: Audit Execution

  1. Data collection and preparation:
  1. Automated analysis:
  1. Detailed testing:
  1. Fieldwork and interviews:

Phase 3: Reporting & Remediation

  1. Findings synthesis:
  1. Reporting:
  1. Remediation tracking:

Templates

Expense Audit Program Framework

EXPENSE AUDIT PROGRAM — Annual Framework
==========================================
Version: [2025-01] | Audit Committee Approved

AUDIT OBJECTIVE:
  Assess the effectiveness of expense management controls, detect policy
  violations and potential fraud, and recommend improvements to reduce
  risk, improve compliance, and optimize expense management processes.

AUDIT SCOPE:
  Period under review: January 1, 2024 — December 31, 2024
  Total expenses: $24.8M across 12,400 submissions
  Coverage: All departments, all regions, all expense categories
  Exclusions: Payroll-related expenses (covered under payroll audit)

RISK ASSESSMENT:
┌──────────────────────────────┬──────────┬───────────┬────────────────┐
│ Risk Area                    │ Likelihood│ Impact   │ Audit Effort   │
│                              │          │          │ Allocation     │
├──────────────────────────────┼──────────┼───────────┼────────────────┤
│ Duplicate submissions        │ Medium   │ High     │ 15%            │
│ Receipt fraud/forgery        │ Low      │ Critical  │ 20%            │
│ Policy non-compliance        │ High     │ Medium    │ 25%            │
│ Related-party transactions   │ Low      │ Critical  │ 15%            │
│ Travel over-limit            │ High     │ Low       │ 10%            │
│ Entertainment misclassification│ Medium  │ High     │ 10%            │
│ System control weaknesses    │ Medium   │ Medium    │ 5%             │
└──────────────────────────────┴──────────┴───────────┴────────────────┘

SAMPLING METHODOLOGY:
  Automated testing: 100% of transactions (rule-based screening)
  Manual testing:
    • > $10,000: 100% review
    • $5,000 — $10,000: 50% sample
    • $1,000 — $5,000: 25% sample
    • $500 — $1,000: 10% sample
    • < $500: 5% sample
    • High-risk categories (travel, entertainment): +10% sample rate
    • New employees (< 6 months): +5% sample rate

  Total manual sample: ~1,240 submissions (10% of population)

AUDIT CRITERIA:
  Receipt requirements:
    ✓ All expenses > $25 require itemized receipt
    ✓ Receipt must show: vendor, date, amount, items purchased
    ✓ Digital receipts acceptable (email, e-receipt)

  Approval hierarchy:
    ✓ < $500: direct manager approval
    ✓ $500 — $5,000: skip-level approval
    ✓ > $5,000: department head + finance approval

  Policy limits:
    ✓ Meal per diem: $75/domestic, $125/international
    ✓ Lodging: $250/domestic, $350/international (tiered by city)
    ✓ Entertainment: $500/event maximum, pre-approval required
    ✓ Mileage: $0.67/mile (IRS rate)

  Timing:
    ✓ Submission within 30 days of expense date
    ✓ No retroactive approvals > 90 days

RED FLAG INDICATORS:
  1. Duplicate: same amount, same vendor, same date (or ±1 day)
  2. Split receipt: multiple small claims just under approval threshold
  3. Weekend/holiday: expense dates falling on non-business days
  4. Round dollar: amounts at exact $50, $100, $500 increments
  5. Missing receipt: claims submitted without required documentation
  6. Vendor anomaly: personal accounts (Venmo, CashApp), unusual merchants
  7. Geographic mismatch: expense location inconsistent with travel itinerary
  8. Frequency: unusual volume from single employee in short period

Audit Findings Report Template

AUDIT FINDINGS REPORT — Expense Audit Q4 2024
================================================
Report Date: 2025-01-15 | Distribution: CFO, Audit Committee, Department Heads

EXECUTIVE SUMMARY:
  Overall assessment: Controls are MODERATELY EFFECTIVE
  Total findings: 14 (2 Critical, 4 High, 5 Medium, 3 Low)
  Financial impact: $187,400 identified in questionable expenses
  Fraud indicators: 3 cases under investigation
  Compliance rate: 89.2% (target: 95%)

FINDING #1 — Duplicate Expense Submissions (HIGH)
  Risk rating: HIGH | Financial impact: $42,300
  Frequency: 37 duplicate pairs detected across 28 employees
  Root cause: System does not flag near-duplicate submissions; manual review
              process inconsistent
  Evidence: Automated scan identified 37 duplicate pairs totaling $42,300
            (examples: Employee A submitted two $245 travel claims on
            consecutive days with identical vendor)
  Recommendation:
    ✓ Implement automated duplicate detection in expensing system
    ✓ Add duplicate check to manager approval workflow
    ✓ Retroactive investigation for 2024 submissions
    ✓ Recovery action for identified duplicates (14 cases deemed
       unintentional — education; 23 cases flagged for recovery)

FINDING #2 — Receipt Fraud Indicators (CRITICAL)
  Risk rating: CRITICAL | Financial impact: $67,800 (under investigation)
  Frequency: 3 employees flagged for suspicious receipt patterns
  Root cause: Manual receipt verification insufficient; system lacks
              image authentication capabilities
  Evidence:
    • Employee X: 12 expense claims with identical receipt font/spacing
      (suggesting digital manipulation) — $28,400
    • Employee Y: 8 expense claims at non-existent vendor (name similarity
      to real vendor) — $21,600
    • Employee Z: 15 expense claims with weekend timestamps but receipt
      dates on weekdays — $17,800
  Recommendation:
    ✓ Immediate HR + internal audit investigation
    ✓ Implement receipt OCR with authenticity verification
    ✓ Vendor validation against known business database
    ✓ Recovery action pending investigation outcome

FINDING #3 — Travel Policy Non-Compliance (MEDIUM)
  Risk rating: MEDIUM | Financial impact: $54,200
  Frequency: 156 over-limit submissions (not pre-approved)
  Root cause: Unclear communication of city-tiered lodging limits;
              booking system does not enforce limits at point of booking
  Evidence: Automated policy scan identified 156 submissions exceeding
            lodging or meal per diem limits without pre-approval
  Recommendation:
    ✓ Integrate policy limits into travel booking system
    ✓ Pre-approval workflow for exceptions
    ✓ Refresher training for all employees
    ✓ Department-level compliance dashboards

FINDING #4 — Related-Party Transaction Weakness (HIGH)
  Risk rating: HIGH | Financial impact: $23,100
  Frequency: 7 claims involving vendors linked to employees
  Root cause: No automated related-party screening; disclosure process
              relies on self-reporting
  Evidence: Cross-referencing vendor bank accounts with employee
            direct deposit accounts identified 7 potential matches
  Recommendation:
    ✓ Implement automated related-party screening
    ✓ Mandatory conflict-of-interest disclosure annualization
    ✓ Policy update: prohibition on personal gain from vendor selection
    ✓ Review all vendor relationships for 2024

REMEDIAL ACTIONS STATUS:
┌──────────────────────────────┬───────────┬──────────┬───────────┐
│ Action                       │ Owner     │ Deadline │ Status    │
├──────────────────────────────┼───────────┼──────────┼───────────┤
│ Duplicate detection system   │ IT/Finance│ Feb 28   │ Planned   │
│ Receipt OCR implementation   │ IT       │ Mar 31   │ Planned   │
│ Travel policy training       │ HR       │ Jan 31   │ In Progress│
│ Related-party screening      │ Finance  │ Feb 15   │ Planned   │
│ Fraud investigation closure  │ IA/HR    │ Feb 28   │ Active    │
│ Vendor validation database   │ Procurement│ Mar 15  │ Planned   │
│ Recovery process execution   │ Finance  │ Jan 31   │ Active    │
└──────────────────────────────┴───────────┴──────────┴───────────┘

CONTINUOUS MONITORING RECOMMENDATIONS:
  1. Monthly automated duplicate scan (all transactions)
  2. Quarterly policy compliance review (stratified sample)
  3. Annual Benford's Law analysis (statistical anomaly detection)
  4. Real-time alerts for: > $10K submissions, weekend expenses,
     new vendor first use, related-party matches
  5. Annual audit program refresh and risk reassessment

Integration Points

Edge Cases

| Scenario | Handling | |----------|----------| | C-level executive flagged for policy violation | Handle through confidential channel; notify audit committee; avoid public reprimand | | Evidence of systematic fraud (not isolated) | Engage legal counsel; preserve evidence; consider law enforcement referral | | Employee denies violation during interview | Document response; escalate per HR policy; focus on evidence not testimony | | Audit findings reveal systemic policy flaw | Recommend policy revision; separate process finding from individual violations | | Data privacy conflict (employee data in audit) | Consult legal; anonymize where possible; limit access to audit team | | Retaliation concern after audit | Monitor flagged employees; ensure protection per whistleblower policy | | Audit scope expanded mid-engagement | Formal scope change documentation; reassess timeline and resources | | Management disputes audit findings | Present evidence clearly; allow management response in report; escalate to audit committee |

Output

Audit Program Dashboard

EXPENSE AUDIT — Program Dashboard
==================================
As of: 2025-01-15

AUDIT STATUS:
  Current audit: Annual Expense Audit 2024
  Phase: Reporting & Remediation
  Completion: 85% (3 of 4 phases complete)
  Estimated close: January 28, 2025

KEY METRICS:
  Universe tested:       $24.8M | 12,400 submissions
  Sample tested:          $2.4M | 1,240 submissions (10%)
  Automated testing:     100% of population (rule-based)

COMPLIANCE OVERVIEW:
  Overall compliance rate: 89.2% [██████████████████████░░░░░░] (target: 95%) ⚠
  Receipt compliance:      94.5% [█████████████████████████░░░] ✓
  Approval compliance:     96.8% [████████████████████████████] ✓
  Policy limit compliance: 87.1% [██████████████████████░░░░░░] ⚠
  Timely submission:       91.3% [█████████████████████████░░░] ✓

FINDINGS SUMMARY:
  Critical:  2 [████] — Investigation active
  High:      4 [████████] — Remediation planned
  Medium:    5 [████████████] — Remediation in progress
  Low:       3 [█████] — Acceptable risk / monitoring

FINANCIAL EXPOSURE:
  Questionable expenses:   $187,400
  Duplicate amount:        $ 42,300 (recovery target)
  Over-limit unapproved:   $ 54,200 (training + system fix)
  Fraud under investigation: $67,800 (pending outcome)
  Related-party exposure:  $ 23,100 (screening + policy fix)

REMEDIATION TRACKING:
  Actions planned: 7
  In progress:     2
  Completed:       0
  Overdue:         0

CONTINUOUS MONITORING:
  Active alerts: 4
    • Real-time duplicate detection: ACTIVE
    • Over-limit notification: ACTIVE
    • Weekend expense alert: ACTIVE
    • Related-party screening: PENDING (go-live Feb 15)

  Monthly scan schedule: 1st of each month (automated)
  Last scan: 2025-01-01 → 12 near-duplicates flagged (auto-resolved)

TREND ANALYSIS (Quarterly):
┌──────────────┬──────────┬──────────┬──────────┬──────────┐
│ Metric       │ Q4 2023  │ Q1 2024  │ Q2 2024  │ Q4 2024  │
├──────────────┼──────────┼──────────┼──────────┼──────────┤
│ Compliance   │  92.1%   │  90.8%   │  89.5%   │  89.2%   │ ← ⚠ Declining
│ Avg claim $  │  $847    │  $892    │  $915    │  $923    │ ← Rising
│ Duplicates   │    18    │    22    │    31    │    37    │ ← ⚠ Increasing
│ Over-limit   │    98    │   112    │   134    │   156    │ ← ⚠ Increasing
│ Fraud flags  │     1    │     0    │     2    │     3    │ ← ⚠ Emerging
└──────────────┴──────────┴──────────┴──────────┴──────────┘

  Trend assessment: COMPLIANCE DECLINING — requires management attention
  Recommended actions: policy refresher training; system enforcement;
  enhanced monitoring