The Expense Report Was Never About Expenses

The expense report is one of the most universally resented administrative instruments in corporate life. This is well-known. What is less well-understood is why it exists — what purpose the expense report is actually serving, and whether that purpose is served well by the process that has been built around it.

The answer to both questions is instructive. The expense report exists because organisations cannot trust that their employees will spend money correctly without oversight. The oversight mechanism is: require employees to record what they spent, justify it after the fact, and submit it to a reviewer who determines whether the spending was within policy. The process is not an accounting mechanism. The accounting is a by-product. The process is a trust mechanism — an institutional response to the problem of delegating spending authority to people whose judgment about what constitutes appropriate spending may not be identical to the organisation's policy.

Understanding what the expense report is actually for is the prerequisite for understanding why agentic payment infrastructure makes it obsolete.

Same purpose, two mechanisms — one checks after the money has moved, one decides before it can.

1. A narrower claim than it looks, and what it rests on

This paper makes a narrower claim than it might first appear to, and here are the boundaries, stated before the argument.

What it argues from. A direct reading of the Global Business Travel Association Foundation's 2015 study of expense-report processing cost and error rates.¹ A direct, full reading of the Association of Certified Fraud Examiners' Occupational Fraud 2024: A Report to the Nations — not a secondary summary of it, but the 106-page primary document, fetched and read in full.² Two primary US Government Accountability Office reports on government purchase-card controls, nineteen years apart, which let the argument track what happened to the review-based model as the alternative (card-level controls) matured.³⁴ Jensen and Meckling's foundational 1976 account of agency costs, which supplies the analytic vocabulary — principal, agent, monitoring cost — for the claim that the expense report is a trust mechanism rather than an accounting one.⁵ Parasuraman, Sheridan and Wickens's taxonomy of where automation can be inserted into a human task, which supplies the test this paper uses to decide whether a given review step is adding judgment or merely executing a policy.⁶ And ProcureBee's own stated design intent — not an independent audit of its outcomes, which does not yet exist.

What it does not argue from. No independent, published audit of ProcureBee's own deployments exists; every claim about what ProcureBee does is a description of the product's design, not a measured outcome. No study was found that directly compares the total cost — administrative plus fraud-loss plus foregone-spending — of a traditional expense-report cycle against a virtual-card program for a matched set of organisations. Several figures that circulate in the expense-management industry (a commonly cited "$15–$50 per report" processing-cost range, for instance) could not be traced to a readable primary study and are not used here; only the GBTA/HRS figure, independently confirmed, appears below.

What it does not claim. It does not claim expense-report review is mere theatre with no protective value; §3 and §7 engage directly with evidence that the review step, even though it rarely catches fraud directly, correlates with substantially smaller losses when fraud occurs. It does not claim card-level controls are fraud-proof, or free of new failure modes of their own. It does not claim every institution Flux serves can adopt a card-based model; cash-first and informal-sector spending, common in the markets ProcureBee actually operates in, is a case this paper's mechanism does not yet address, and §7 and §8 say so rather than skip past it.

What would refute it. Given in full in §9. The sharpest version: if organisations that move from expense-report review to point-of-transaction card controls show no measurable reduction in total administrative-plus-fraud cost once that comparison is actually measured, the practical case this paper makes collapses regardless of how clean the theoretical argument in §§2–6 reads.

2. The Anatomy of Distrust

The expense report cycle has a characteristic shape that reveals its purpose. It begins after the fact — after the employee has already spent the money. This is already strange if accounting is the goal: accounting systems work better with real-time data, not retrospective reconstruction. The after-the-fact structure of expense reporting is not a feature of accounting. It is a feature of the trust architecture: the organisation extends spending authority by allowing employees to spend on a commitment to report and justify, rather than requiring pre-approval of every purchase.

It then moves through a review stage where a named individual — typically a direct manager, sometimes a finance officer — determines whether the spending was appropriate. This stage is the trust enforcement mechanism. The reviewer is not adding accounting information. The reviewer is making a judgment: was this spending within policy?

Jensen and Meckling's 1976 account of agency costs gives this the vocabulary it needs.⁵ An organisation (the principal) delegates spending authority to an employee (the agent) whose interests and information are not identical to the principal's. The principal cannot costlessly verify every action the agent takes, so it incurs "monitoring costs" — mechanisms, like the expense report, designed to align the agent's behaviour with the principal's interest after the fact, because verifying it before the fact was judged too expensive relative to the risk. The expense report is, in this frame, exactly a monitoring-cost instrument: a specific, generalisable answer to a very old problem of delegated authority, not a feature of accounting bureaucracy invented for its own sake.

The process was designed for a world where the policy could not be automatically enforced at the point of transaction — where the only available mechanism for ensuring that employees spent within policy was to review their spending after it had already occurred. In that world, the expense report makes sense. It is an imperfect but functional response to a real constraint.

Two US Government Accountability Office reports, read nineteen years apart, show what that constraint looked like in practice at government scale, and what started to change once point-of-sale control became available. In May 2002 testimony on governmentwide purchase-card programs, GAO found weak review and approval processes across agencies had allowed "fraudulent, improper, abusive, and questionable purchases" and left government property "lost, missing, or misused" — a direct description of what a monitoring regime without point-of-sale enforcement actually produces under real organisational pressure.³ By February 2017, after GSA and OMB had tightened purchase-card program controls in the intervening years, a GAO sample of 300 transactions out of more than 17 million government-wide micropurchases found little evidence of fraud in the sample — but 22% of transactions government-wide still lacked complete documentation to substantiate their own approval process.⁴ Read together, the two reports suggest something more specific than "review doesn't work": the review-based model's weak point was never only fraud detection. It was the review itself failing to leave a complete, checkable record of having happened — a structural property, not a staffing problem, and one a system that enforces policy automatically at the point of purchase does not have in the same way.

That constraint no longer exists for most ordinary institutional purchasing.

3. What the Evidence Actually Shows About Review

It is tempting to describe the review stage as pure rubber-stamping — a reviewer confirming, in the vast majority of cases, that the employee did what the policy permits, and adding nothing else. The evidence does not support quite that strong a claim, and it is worth being precise about what it does support, because the precise version is a better argument for replacing the review, not a worse one.

On the "rubber stamp" side: SAP Concur, the dominant expense-management vendor, states on its own published materials that T&E policy exceptions are common — in the range of one in five expense transactions or reports carrying at least one policy exception, drawing on earlier third-party survey work (Oversight Systems) whose original methodology this paper could not independently re-verify and which is accordingly treated as an industry-reported range rather than a precise rate.⁷ The GBTA Foundation's 2015 study, co-produced with HRS and read directly from GBTA's own published results, found 19% of expense reports contained an error or missing information requiring correction — a real, verified figure, not a secondary estimate.¹ Both point the same direction: a meaningful minority of what reaches a reviewer is, in some sense, wrong, which is not what "the reviewer is just confirming compliance" would predict if compliance were near-universal.

On the other side, the ACFE's 2024 global fraud survey — read directly in full, not taken from a secondary citation — complicates a pure "review catches nothing" story. Expense-reimbursement schemes accounted for 248 of the 1,921 cases in the study (13%), with a median loss of $50,000 and a median duration of 18 months before detection — meaning the typical expense-reimbursement fraud ran for a year and a half before anyone caught it.² Globally, across all fraud types, tips were by far the most common detection method (43% of cases), followed by internal audit (14%) and management review (13%) — together 70% of cases, meaning management review specifically is responsible for catching only about one case in eight.² So the review is not, on this evidence, primarily a detection mechanism. But the same report found that where a management-review control was present — in 72% of victim organisations — the median loss when fraud did occur was $100,000, against $250,000 where it was absent: a 60% reduction.² Management review rarely catches the fraud. Its presence is nonetheless associated with the fraud, when it happens, being much smaller.

I do not think this is a contradiction, and I do not think it rescues the review process. The most plausible reading is that a reviewer's presence shortens how long an improper pattern can run before something — often not the review itself, but the fact that spending now has to pass in front of a person — interrupts it, and that this is a weaker, slower, and more expensive version of exactly the mechanism a point-of-transaction control implements directly: making the improper pattern impossible to start, rather than merely uncomfortable to sustain. §7 returns to whether that reading survives the obvious objection that card controls might lose whatever the human reviewer was contributing beyond detection.

4. What Agentic Infrastructure Does Differently

ProcureBee does not automate the expense report process. It eliminates it. The distinction is important.

Automating the expense report process would mean: making the submission faster, making the approval workflow more efficient, making the reimbursement cycle shorter. Many existing expense-management platforms do exactly this, and have produced genuine improvements in the speed and accuracy of expense reporting. They have not changed the structure. The employee still records spending after the fact. The manager still reviews and approves. The accounting team still reconciles. The process is faster. It is still the same process, and on Parasuraman, Sheridan and Wickens's taxonomy of where automation gets inserted into a task, it automates only the information-acquisition and information-analysis stages — faster capture, faster categorisation — while leaving the decision stage (was this within policy?) exactly where it always was.⁶

Eliminating the expense report means redesigning the trust architecture from first principles, which on the same taxonomy means moving automation into the decision and action stages themselves. If the expense report exists to enforce spending policy, and if the goal is to enforce spending policy, the right question is: what is the most reliable mechanism for ensuring that employees spend within policy? The answer is not "review spending after it has occurred." The answer is "make out-of-policy spending impossible at the point of transaction" — which is a different, and older, mechanism than it sounds: merchant-category-code (MCC) based spend controls are a standard, documented feature of commercial card networks, not a novel Flux invention. Visa's own developer documentation for its Commercial Payment Controls describes merchant-category rules that block or allow transactions by MCC at the card level before authorisation completes, not after.⁸

ProcureBee issues virtual cards built on this same network mechanism — cards whose spending parameters are set by the organisation's policy, encoded at the card level. The cardholder cannot spend above the approved limit. The cardholder cannot spend at merchant categories the policy does not permit. The transaction is reconciled automatically against the budget line it was drawn from. The receipt is attached by the payment processor, not by the employee reconstructing their memory of a transaction from three weeks ago.

At the end of this process, there is nothing to approve. The spending either occurred within policy — in which case it is automatically recorded and reconciled — or it did not occur, because the card declined. The manager does not review individual transactions. The manager set the policy. The system executed it.

Did it do it for you? Yes — in exactly the sense that question means elsewhere in this corpus: the oversight is structural, encoded in the policy design itself, not procedural, re-performed by a person on every transaction. Whether "structural rather than procedural" is a strictly better trade, in every case, is not something this paper treats as settled; §7 takes up the strongest version of why not.

5. What the Approval Chain Was Actually Costing

There are two costs to the traditional expense-report cycle that are rarely calculated together.

The direct cost is the time of everyone involved: the employee documenting the expense, the manager reviewing it, the finance team processing and reimbursing it. GBTA's 2015 study, produced with HRS and read directly, put the average cost of processing a single expense report at $58 in staff time, taking roughly 20 minutes; where the report contained an error — which happened 19% of the time — correcting it cost a further $52 and 18 minutes.¹ For a company with fifty employees making regular business purchases, at even a modest volume, this is a measurable and recurring operating cost, and it recurs every month regardless of whether any individual report turns out to need correcting.

The ACFE data in §3 supplies a second, less visible component of the same direct cost: expense-reimbursement fraud that does occur runs for a median 18 months before detection, at roughly $2,800 of loss per month of operation — a cost that accrues precisely during the period when the review process is, by construction, failing to catch it.² That figure should not be read as the cost of expense reporting generally; it is the cost specific to the 13% of fraud cases that take this particular form, and it is a tail cost, not a typical one. But it is a real cost the review-based model carries that a system which makes the pattern impossible to start does not.

The indirect cost is harder to measure and, in the absence of a study measuring it, this paper does not attach a number to it: the spending decisions that do not get made because the administrative friction of the expense cycle is too high. The market researcher who decides not to buy the database subscription because submitting the receipt and waiting for reimbursement is not worth the effort. The field officer who pays for a client meeting out of pocket and does not submit because the submission process is more effort than the amount. These invisible non-expenditures are a real cost of a trust mechanism that is more expensive to navigate than the trust it provides is worth — but no study located for this paper measures their scale, and it is flagged CITATION-NEEDED in Appendix B rather than estimated.

ProcureBee's virtual-card model is designed to eliminate both costs. The direct cost falls because there is, structurally, less to process: the transaction is recorded, reconciled, and categorised automatically at the point of purchase. The indirect cost falls, in design intent, because the friction of accessing funds within policy approaches zero: the employee has a card with appropriate limits, and spending within those limits requires no additional steps. Both of these are claims about mechanism and design intent, not measured outcomes for ProcureBee specifically; Appendix A marks the difference between the two kinds of row explicitly.

6. The Deeper Argument

The expense report is a useful focus for this argument because it is so familiar — everyone who has worked in an organisation has filed one, reviewed one, or waited for reimbursement from one. But the argument is not specifically about expense reports. It is about a category of organisational process.

The category, in Parasuraman, Sheridan and Wickens's terms, is: processes where automation has been applied to the acquisition and analysis stages of a task but never reaches the decision stage, because for most of the institutional history of these processes, no reliable mechanism existed for automating the decision stage itself.⁶ Expense reports are the most visible example in corporate life. They are not the only one. Purchase-order approval workflows, document routing processes, compliance sign-off chains, data-entry validation — much of the administrative apparatus of a well-run organisation is, on examination, a decision-stage bottleneck inherited from a period when policy-encoding software did not yet exist to relieve it, which is a more specific and more falsifiable claim than "an outdated process," because it names exactly what changed and when.

For each of these processes, the question is the same one §4 applied to expense reports: is the human in this loop adding judgment, or executing a process that could be specified in advance and encoded? If they are adding judgment — if the decision requires context, relationship, experience, or interpretive skill that cannot be specified in advance — they should stay in the loop, and a companion paper in this corpus takes up directly what "accountability" requires when they do. If they are executing a process — if the decision is a function of checking the request against a policy that could be encoded — then the process is a candidate for elimination, not optimisation.

The organisations asking this question systematically, and building the process replacements that follow from asking it, are the ones that will be operating in a structurally different way in five years. The ones making their expense-report processes faster are not — they have automated the acquisition and analysis stages, and left the decision stage, and its cost, exactly where it was.

7. Objections I take seriously

"Flux has a commercial interest in this conclusion." Flux builds ProcureBee, and the central argument of this paper — that review-based expense reporting should be eliminated, not optimised — is close to ProcureBee's own sales pitch. I am not going to pretend otherwise. The honest mitigation is narrow: the GBTA processing-cost data, the GAO purchase-card findings, and the ACFE fraud data in §§2–3 and §5 are all independent of Flux and would show the same patterns whether or not Flux or ProcureBee existed. What is not independent is the leap from "a point-of-transaction card control can structurally replace the review stage" to "ProcureBee specifically does this well" — that second claim rests on Flux's own, unaudited account of its own product, and this paper does not have outcome data to offer in its support.

"Management review correlates with 60% smaller fraud losses — doesn't eliminating it throw away a real protective effect?" This is the sharpest objection in this paper and deserves an honest answer rather than a dismissal. §3 reports the ACFE finding accurately: organisations with a management-review control see median fraud losses of $100,000 against $250,000 without one.² It is possible that the mechanism producing this effect is something a card control reproduces exactly — a reviewer interrupting a sustained improper pattern sooner than it would otherwise be interrupted, which a transaction that is simply declined does at the moment it starts, not months later. It is also possible the mechanism is something a card control does not reproduce — a reviewer who knows the context well enough to notice a transaction that is technically within policy but substantively wrong in a way no rule written in advance could have anticipated. This paper cannot distinguish between those two explanations from the available evidence, and §9 names the second one directly as a falsification condition rather than assuming the first.

"Card-level controls assume spending happens on a card. Most spending, in the markets Flux actually operates in, does not." This is correct, and it is a real limitation rather than a rhetorical one. ProcureBee's virtual-card model depends on the merchant being able to accept a card transaction with MCC-level restriction — a real constraint in cash-first and informal-sector commerce, which describes a large share of day-to-day institutional spending in the African markets this corpus is otherwise concerned with. A field officer paying a boda-boda rider, a market vendor, or an unregistered contractor in cash is not a transaction a virtual card can intercept, and this paper's mechanism has nothing to say about that spending category. §8 states this as a limitation rather than a special case the argument quietly excludes.

"The documentation-completeness problem GAO found in 2017 (22% of transactions missing complete approval records) might just move, not disappear, under a card-control model." A card-level control removes the need for a human approval record for routine transactions, but it substitutes a different kind of record — the policy configuration itself, and the log of what the card declined. Whether that record is actually more complete and more auditable than the human approval trail GAO found incomplete is not something this paper has evidence to settle either way; it is an empirical question about ProcureBee's own implementation, not the general argument, and no independent audit of it exists yet.

8. Where the trust-mechanism argument stops

Expense-report review is not valueless: §3 and §7 report, accurately, that management review correlates with substantially smaller fraud losses even though it rarely detects fraud directly, and this paper cannot fully explain why.

It does not claim ProcureBee's virtual-card model has been independently measured against the review-based model it proposes to replace; no such comparative study — of total administrative-plus-fraud-loss cost — was found, and Appendix A marks the gap rather than filling it with an estimate.

It does not claim card-level spend controls work for all institutional spending; cash-first and informal-sector transactions, common in the markets Flux operates in, fall outside this paper's mechanism entirely, and §7 says so directly rather than treating it as a marginal case.

It does not claim the indirect cost of foregone spending under expense-report friction has been measured; §5 names it as a real but unquantified cost and leaves it CITATION-NEEDED rather than estimating a figure.

And it does not claim the 2017 GAO documentation finding generalises to ProcureBee's own record-keeping; that is stated as an open question in §7, not resolved in this paper's favour.

9. What would falsify this

Stated as commitments, in decreasing order of how much damage each would do to this paper's claims.

Institutions that replace expense-report review with point-of-transaction card controls show no measurable reduction in total administrative-plus-fraud cost, once that comparison is actually measured. That would directly contradict the practical core of this paper regardless of how clean the mechanism described in §4 sounds, and the right response would be withdrawal, not a softer restatement.

A controlled or large-sample study finds that management review's correlation with smaller fraud losses (§3, §7) is driven specifically by human contextual judgment that a pre-specified policy cannot encode — rather than by the reviewer merely interrupting a pattern sooner than an automated decline would. That would undercut this paper's central mechanism claim directly, not merely qualify it, because it would mean the thing being eliminated was doing more work than "the same thing, slower."

ProcureBee's own record-keeping, once independently audited, turns out to reproduce the 2017 GAO finding — incomplete documentation of what was approved and why — rather than improving on it. That would weaken the specific product claim in §4 without touching the general argument that point-of-transaction controls are theoretically superior to after-the-fact review.

The cash-first and informal-sector spending this paper excludes in §7 turns out to be the majority, not a residual, of institutional spending in the markets this paper is actually about. That would not falsify the mechanism, but it would sharply limit how much of real institutional spending it can ever reach.

Appendix A — Evidence table

Appendix B — Citation register

CITATION-NEEDED — ProcureBee's own measured outcomes. Appendix A row 12. No independent audit or measured comparison of ProcureBee's administrative cost or fraud-loss performance against the review-based model exists; every claim about ProcureBee in this paper is a description of its design intent, not a measured result.

CITATION-NEEDED — scale of foregone spending under expense-report friction. Appendix A row 13. No study was found quantifying how much legitimate institutional spending does not happen because of expense-reporting friction; §5 names the mechanism without estimating its size.

CITATION-NEEDED — mechanism behind management review's loss-reduction effect. Appendix A row 14. The ACFE data (row 5) shows a strong correlation but does not identify whether it reflects contextual human judgment or merely faster pattern-interruption; §7 and §9 treat this as open and consequential rather than resolved.