How do I set up expense management software for approving expenditures and enforcing segregation of duties?

To set up expense management software so it supports approval controls and segregation of duties (SoD), focus on configuring the workflow, roles, and permissions to prevent the same person from initiating, approving, and paying the same expense.

1) Define the control policy first

Before configuring the software, document:

• Who can submit expenses
• Who can approve them
• Approval thresholds by amount, category, department, or project
• What requires additional review
  Examples: cash advances, travel, gifts, contracts, high-value purchases
• What is prohibited
  For example, self-approval, approving direct reports’ expenses above a threshold, or approving after payment

2) Set up distinct user roles

Create separate roles in the system such as:

• Employee / Requestor: submits expenses
• Manager / Approver: reviews and approves expenses
• Finance / AP Reviewer: checks policy and budget compliance
• Treasury / Payment Processor: releases payment or reimbursement
• Admin: configures system, but should not approve or pay expenses

Key SoD rule: No user should have more than one conflicting role in the same transaction flow.

3) Configure approval workflows

Set up workflows based on rules such as:

• By expense amount
  • Under $100: manager approval
  • $100–$1,000: manager + finance approval
  • Over $1,000: manager + finance + department head approval
• By expense type
  • Travel, meals, software, capital items, gifts, etc.
• By cost center or project
• By risk indicators
  • Missing receipt
  • Weekend/holiday purchases
  • Duplicate claims
  • High-frequency claims

Use conditional routing so the right approver is assigned automatically.

4) Enforce segregation of duties in the system

Configure the software to block conflicts such as:

• Self-approval prohibited
• Approver cannot approve their own expense report
• Approver cannot approve expenses they created
• Approver cannot approve expenses for direct reports if policy forbids it
• Payment processor cannot also approve the expense
• Admin cannot change workflow rules without logging and oversight

If the software supports it, turn on:

• Role-based access control
• Approval matrix restrictions
• Duplicate/conflict detection
• Audit logs
• Exception escalation

5) Build exception handling

Some situations need overrides, but keep them controlled:

• Require secondary approval for exceptions
• Route exceptions to internal audit, controller, or finance director
• Require a written justification
• Log every override with timestamp, user, and reason

Avoid allowing unrestricted “approve anyway” rights.

6) Integrate with accounting and payment systems carefully

When integrating expense software with ERP/AP/payments:

• Ensure approved expenses flow to AP, but AP cannot alter approval history
• Separate invoice entry from approval
• Separate approval from payment release
• Reconcile expense reports against bank/payment records

7) Lock down admin access

Admins should be able to configure the system, but:

• Limit who can change approval rules
• Use maker-checker control for master data changes
• Review admin activity regularly
• Require MFA and strong password policies

8) Set up audit and reporting

Enable reports for:

• Expenses approved by role/user
• Self-approval attempts
• Overrides and exceptions
• Late approvals
• Split transactions below approval thresholds
• Duplicate receipts or claims
• Unusual approval patterns

These reports help detect control weaknesses and fraud.

9) Test the controls before go-live

Run test cases such as:

• Employee submits own expense and attempts self-approval
• Manager approves expense above their threshold
• Same person tries to submit and approve
• Payment attempt before approval
• Exception approval without required justification

Confirm the system blocks or routes these correctly.

10) Train users and document the process

Provide clear guidance on:

• Submission rules
• Approval authority
• Receipt requirements
• What constitutes a conflict of interest
• How exceptions are handled

Also maintain written procedures so the system configuration matches policy.

---

Simple example of a good SoD setup

• Employee submits expense report
• Manager approves up to $500
• Finance reviews anything over $500 or flagged
• AP processes reimbursement only after approvals
• Controller/Audit reviews exceptions and admin changes

No one person should be able to:

1. Create the expense,
2. Approve it,
3. And release payment.

---

If you want, I can also give you:

1. a sample approval matrix,
2. a Segregation of Duties policy template, or
3. a step-by-step configuration checklist for a specific tool like Concur, Expensify, SAP, or Oracle.