To audit expenses, you scope the review around your highest-risk categories, set a materiality threshold, pull a sample of transactions with their supporting documents, test whether those transactions are real, accurate, complete, and correctly classified, check them against internal policy and tax rules, and then document your findings in a report with recommended corrective actions. The steps below walk through how to audit expenses in the order you’d actually perform them, from planning through the final report.
Plan the Scope Before You Touch a Receipt
Trying to audit every expense line equally wastes time. Pick the categories where errors and fraud are most likely: travel and entertainment, vendor payments, executive reimbursements, and anything that recently spiked without a clear reason. Decide the fiscal period, the categories in scope, and how deep you’ll go in each one.
Set a Materiality Threshold
Materiality is the dollar amount above which an error would change how someone reads the financial statements. The U.S. Supreme Court framed it as whether there is “a substantial likelihood” the fact would significantly alter the “total mix” of information available to a reasonable investor, and the PCAOB carries that definition into its auditing standards.1PCAOB. AS 2105: Consideration of Materiality in Planning and Performing an Audit You don’t apply one number uniformly. Accounts that carry outsized risk, such as related-party transactions or executive compensation, deserve a lower threshold.
Identify Where the Risk Lives
Dollar amounts are only part of the picture. Non-monetary red flags often matter more when deciding where to dig:
- Bonus structures tied to cost targets, which motivate misclassification or underreporting.
- Weak segregation of duties, where the same person initiates purchases, approves invoices, and records payments.
- High turnover in a department, which erodes both policy familiarity and institutional memory of what “normal” looks like.
- Systems that allow manual journal entries or approvals outside the standard workflow.
- Complex contracts involving multi-year terms, foreign currency, or related parties, where judgment calls are easy to get wrong.
The PCAOB also directs auditors to consider whether misstatements suggest management bias, whether errors affect loan covenant compliance, and whether possible undetected misstatements remain.2PCAOB. Auditing Standard No. 14: Evaluating Audit Results – Appendix B
Nail Down Four Objectives
Objectives generally cluster around four questions. Did the expense actually happen (existence)? Does the recorded amount match the real transaction (accuracy)? Were all transactions captured, or is something missing (completeness)? Was the expense booked to the right account (classification)? These drive which tests you run and how big your sample needs to be.
Gather Documentation and Choose a Sample
The primary documents are vendor invoices, approved purchase orders, employee expense reports, bank and credit card statements, and the underlying contracts. Each ties a general ledger entry back to a real event, so gaps in documentation are themselves findings.
Pick Your Sampling Method
You typically can’t review every transaction. Statistical sampling uses random selection so you can extrapolate an error rate to the full population. Judgmental sampling targets specific items: transactions above a certain dollar threshold, payments to new vendors, reimbursements just below an approval limit, or anything the risk assessment flagged. Most audits blend both. The statistical sample gives coverage; the targeted pulls go after transactions most likely to be wrong.
Map Each Sampled Item to the General Ledger
Trace each sampled transaction directly to its ledger entry. Confirm the amount, the account code, and the posting date all match the source document. When they don’t align, you’ve found either a recording error or evidence that something was moved to the wrong account deliberately. Establish this audit trail before you start substantive testing.
Don’t Skip Electronic Transactions
Purchases processed through electronic data interchange or automated procurement platforms often have no paper invoice. The audit trail lives in system logs, transmission confirmations, and error reports. Sample a batch of electronic transactions and reconcile the data fields against the corresponding ledger entries the same way you would with paper.
Run the Substantive Tests
Vouch and Trace in Both Directions
Vouching starts at the general ledger and works backward. Pick a recorded expense and follow it to the original invoice, receipt, or contract. This catches fictitious entries: ledger amounts with nothing behind them.
Tracing runs the other way. Start with a source document and follow it forward into the ledger and financial statements. This catches omissions: real transactions that never got recorded. Doing only one direction leaves a blind spot.
Recalculate the Math
Independently recompute the math on sampled transactions. Check invoice extensions, verify sales tax rates, and recompute any foreign currency conversions using the exchange rate from the transaction date. Log every discrepancy as an exception, no matter how minor it looks in isolation. Small errors compound across thousands of entries.
Use Analytical Procedures
Analytical procedures compare current expense balances against predictable benchmarks. Compare this quarter’s utility costs against the same quarter last year, or travel spending per employee against the prior period. Investigate significant unexplained variances.
Benford’s Law analysis compares the distribution of leading digits in expense data against the mathematically expected distribution. Fraudulent entries tend to cluster at certain amounts, especially just below approval thresholds. It works best with datasets of at least 5,000 records, and you should exclude automated recurring entries, which naturally deviate from the expected distribution for legitimate reasons.
Check Policy and Regulatory Compliance
Verifying that the numbers are right is only half the job. The audit also has to confirm spending followed internal rules and external legal requirements.
Review Against Internal Policy
Check each sampled expense against the organization’s spending policies: approval thresholds, preferred vendor requirements, competitive bidding rules, and travel per diem limits. Pay particular attention to the line between operating expenses and capital expenditures. An operating expense covers day-to-day costs and gets deducted in the current year, while a capital expenditure buys something with a useful life beyond one year and must be depreciated over time.3Investopedia. CapEx vs. OpEx: Key Differences Explained Misclassifying a large asset purchase as a current-year expense inflates the deduction and distorts both net income and the balance sheet.
The IRS allows a de minimis safe harbor election that lets you expense items costing up to $2,500 per invoice, or $5,000 if the organization has audited financial statements, rather than capitalizing them. Confirm the organization applies this threshold consistently and elects the safe harbor properly each year.
Test Segregation of Duties
While you’re in the transactions, look at whether the organization keeps adequate separation between the people who request purchases, approve them, and process payments. The person who initiates a purchase order should not be the same person who approves it, and neither should be the one cutting the check. If separation breaks down, flag it as a control deficiency even when no misstatement occurred. The exposure itself is the finding.
Verify 2026 Federal Tax Rules
Several rules matter most for audits covering 2026.
Business meals. The deduction for non-entertainment business meals remains limited to 50% of the cost, provided the taxpayer or an employee is present and the expense is not lavish.4Internal Revenue Service. Income and Expenses 2 The 50% cap is codified at IRC Section 274(n).5Office of the Law Revision Counsel. 26 USC 274 – Disallowance of Certain Entertainment, Etc., Expenses Confirm the organization isn’t deducting meals at 100%.
Employer-provided meals. Starting in 2026, Section 274(o) eliminates deductions for meals furnished for the employer’s convenience and food provided through company-operated cafeterias. This change was enacted by the One Big Beautiful Bill Act, with amendments applying to amounts paid or incurred after December 31, 2025.5Office of the Law Revision Counsel. 26 USC 274 – Disallowance of Certain Entertainment, Etc., Expenses Limited exceptions exist for meals sold to customers and certain remote-site operations. Organizations that previously deducted cafeteria costs or on-site meals need to adjust accordingly.
Entertainment. Entertainment, amusement, and recreation expenses remain fully nondeductible under Section 274(a). Verify any entertainment spending is flagged as non-deductible and not blended into the meals category.
Contractor payments. A business that pays $600 or more in non-employee compensation to an independent contractor during the year must file Form 1099-NEC.6Internal Revenue Service. Reporting Payments to Independent Contractors Review contractor payments to confirm 1099-NEC forms were issued for all qualifying payees. Missing forms create penalty exposure and may signal worker misclassification.
Watch for Expense Fraud Patterns
Expense reimbursement fraud typically falls into four patterns. Occupational fraud schemes involving expense reimbursements last roughly two years on average before detection, so recognizing the patterns early matters:
- Mischaracterized expenses, such as a family dinner submitted as a client meeting.
- Inflated amounts, where a legitimate expense is submitted at a higher figure than actually incurred.
- Fictitious expenses backed by forged or altered receipts.
- Duplicate submissions, where the same receipt is submitted across different reporting periods.
Look for clusters of reimbursements just under the approval threshold that would trigger manager review. Look for round-number expenses that don’t match the pricing patterns of the claimed vendor. Check whether any employee consistently submits expenses on dates that don’t align with their calendar or travel records.
Confirm Substantiation and Record Retention
What Counts as Adequate Substantiation
For travel, meals, and similar business expenses, the IRS requires records showing the amount, date, place, and business purpose of each expense. A restaurant receipt must show the restaurant name and location, the number of people served, and the date and amount. Business purpose generally requires a written explanation unless the context makes it obvious. Records created at or near the time of the expense carry more weight than reconstructions made later. Receipts are not required for non-lodging expenses under $75.7Internal Revenue Service. Publication 463 – Travel, Gift, and Car Expenses
How Long Records Have to Be Kept
IRS retention requirements depend on the type of expense and what happens on the return:
- General rule: at least three years from the date the return was filed.
- Employment tax records: at least four years after the tax is due or paid, whichever is later.
- Unreported income exceeding 25% of gross income: six years.
- Bad debt or worthless securities deductions: seven years.
- Unfiled or fraudulent returns: indefinitely.
- Property records: until the limitations period expires for the year the asset is disposed of, since the records are needed to calculate depreciation and gain or loss on sale.8Internal Revenue Service. How Long Should I Keep Records
A seven-year retention policy covers most situations in practice. Verify the organization’s schedule meets at least these minimums and that older records haven’t been purged prematurely.
Requirements for Electronic Storage
If receipts and records are stored digitally, the system must meet the standards in IRS Revenue Procedure 97-22. Reproduced documents must be legible, the system must include controls to prevent unauthorized alteration or deletion, and electronically stored records must cross-reference to the general ledger in a way that maintains a complete audit trail.9Internal Revenue Service. Revenue Procedure 97-22 The organization must also document how the system works, make it available to the IRS during an examination (including the hardware and software needed to retrieve records), and run a documented quality assurance program with periodic checks.
Understand the Penalty Exposure
The IRS imposes a 20% accuracy-related penalty on underpayments attributable to negligence or disregard of tax rules. Negligence means failing to make a reasonable attempt to comply when preparing the return, and it includes claiming deductions that appear “too good to be true” without verifying their accuracy.10Internal Revenue Service. Accuracy-Related Penalty Improperly deducted expenses that inflate losses or reduce taxable income can trigger this penalty.
The same 20% penalty applies to a substantial understatement of tax. For individuals, that means understating tax liability by at least 10% of the correct tax or $5,000, whichever is greater. For C corporations other than S corporations and personal holding companies, the threshold is the lesser of 10% of the correct tax (or $10,000 if that is greater) and $10,000,000.10Internal Revenue Service. Accuracy-Related Penalty Connecting a misclassified expense to these thresholds makes the case for corrective action far more concrete for management than a vague reference to compliance risk.
Document Findings and Issue the Report
Work papers are the official record of the engagement. They should capture the scope, the sampling methodology, every test performed, and every exception identified. Each finding must link back to the specific evidence and the policy or regulation that was violated. A duplicate reimbursement finding should include both expense reports, the matching receipt, and a reference to the company’s duplicate-submission policy.
The final audit report synthesizes findings for management and the audit committee. Organize findings by severity: material misstatements first, then significant control weaknesses, then lower-risk observations. Quantify the financial impact where possible and recommend a specific corrective action for each item, whether that’s updating the travel policy, adding pre-approval workflows for purchases above a certain amount, or retraining staff on the capitalization threshold.
Management should provide a formal written response detailing the corrective actions they will take and by when. Follow up on prior-period findings during the next audit cycle to verify the fixes actually landed. An audit that surfaces problems but never drives change is expensive paperwork.