Expense Approvals: Workflows That Stop Fraud, Not Speed

Expense Approvals: Workflows That Stop Fraud, Not Speed

Key takeaways

• Approval chain depth should scale with headcount: single-step under 20 people, two-step with dollar thresholds at 20-50, role-based routing past 50.
• Each extra approver adds a separate queue wait, and the slowest approver sets the reimbursement date, so every step must catch something the previous one cannot.
• Set dollar tiers relative to your median expense, and flag duplicates, policy-excluded categories, late receipts, and self-approved claims for manual review regardless of amount.
• Always route an approver's own expenses to a second approver; it is the one claim type where a single-step chain is indefensible.
• Task management tools like ClickUp, Asana, and Wrike can model a two- or three-step approval chain, but none replace accounting software for reconciliation.

Expense approvals should take one to three steps, not five, and the right chain depth depends on your headcount and dollar thresholds, not on copying what enterprises do. This guide gives you a size-based framework for choosing single-step versus multi-step chains, where to set thresholds, which fraud controls earn their friction at 20-50 people, and how to keep approvals inside your task and ops platform instead of another fragmented tool.

What is an expense approval workflow, and why does chain depth matter?

An expense approval workflow is the path a reimbursement claim takes from receipt to payout: submission, review, approval, reimbursement. Every company runs some version of it. What varies, and what determines whether employees wait two days or two weeks, is how many people touch the claim along the way.

The four stages every workflow shares

Submission means the employee files the expense with a receipt and business purpose. Review checks it against policy and substantiation rules, which under an IRS accountable plan require business connection, substantiation, and returning excess advances (IRS Publication 15-B). Approval is the manager or finance sign-off. Reimbursement is the payment itself.

Why chain depth is the main design decision

Each extra approver adds queue time, and the delays compound: three approvers at one day each means most claims take a week, not three days. Depth is also your fraud lever, since a second set of eyes catches duplicate and inflated claims that a single manager misses. Chain depth is the one setting that moves both reimbursement speed and fraud risk, which is why it deserves a deliberate decision rather than a default.

What does each extra approval step actually cost you in reimbursement speed?

Queue time vs review time

The review itself is fast. A manager can approve a $60 receipt in under a minute. The real cost is queue time: the report sits unread until the approver checks the tool, and every added approver adds another idle wait. Three steps means three separate waits, and the slowest one sets your reimbursement date. Each step also adds context switching for the approver, who drops whatever they were doing to open the tool, judge the expense, and get back to work.

When a step earns its keep

A step is worth its delay only if it catches something the previous step cannot. Finance review catches policy violations and duplicate claims. A second manager tier catches approvals that rubber-stamp their own team's spend. Escalation above a dollar threshold catches outliers. If a step only re-checks what an earlier approver already verified, it is overhead: cut it or merge it into an audit sample instead.

How should approval chain depth change with company size?

Chain depth should scale with headcount, not with ambition. Under 20 people, a single approver with spot checks is enough; at 20-50, two steps with dollar thresholds catch most problems without slowing reimbursements; past 50, role-based routing keeps accountability clear as finance and department leads split duties. Occupational fraud research supports tiering: expense reimbursement schemes are among the most common asset misappropriation types, and median losses climb sharply as company size shrinks, per the ACFE Report to the Nations.

| Headcount | Chain depth | Threshold tiers | Escalation rule | | :--- | :--- | :--- | :--- | | Under 20 | Single-step | One tier, ~$500 review line | Manager flags anything above line to owner | | 20-50 | Two-step | <$500 manager only; ≥$500 adds finance | Policy exceptions route to ops lead | | 50-100+ | Role-based multi-step | <$250 auto-approve; $250-$2,500 two-step; >$2,500 three-step | Duplicate or out-of-policy claims escalate to controller |

Under 20 people: single-step with spot checks

One approver, usually the founder or ops lead, signs off on everything. Run a random 10% audit monthly instead of adding a second step.

20-50 people: two-step with thresholds

Manager approves, finance approves above a dollar line. This is where scope creep in policy usually starts, so write the thresholds down.

50+: role-based multi-step

Route by department and amount, not by person. Pre-approvals for travel and recurring vendors cut queue volume without weakening controls.

Where should dollar thresholds sit, and what triggers escalation?

Setting the tiers

For a 20-50 person company, a three-tier structure covers most cases. Auto-approve anything under $50 so employees are not waiting two days for a $12 parking fee. Route $50 to $500 through the direct manager, and send anything above $500 to finance plus the manager. Calibrate the tiers to your median expense: if your median receipt is $180, an auto-approve floor of $50 catches too little to reduce overhead.

Escalation triggers beyond dollar amounts

Dollar thresholds miss the risks that actually matter. Flag these for manual review regardless of amount:

• Same merchant charged twice within 48 hours
• Categories your policy excludes, like alcohol or personal travel upgrades
• Per diem claims that exceed the daily cap, even by a few dollars
• Receipts submitted more than 60 days after purchase
• Any expense from an employee approving their own report

These triggers catch split transactions and policy drift that a flat dollar limit waves through. Review them weekly at first, then tune the rules so you are not manually checking noise.

Single-step vs multi-step: which fits your company right now?

A ten-minute self-assessment

Run this checklist before touching your approval chain.

• Transaction volume: Under 50 expense reports a month? Single-step approval is usually enough. APQC benchmark data shows median reimbursement cycle times stretch as approval layers stack up, so every step you add has a measurable cost (APQC, accounts payable benchmarks).
• Card issuance: If most spend runs through company cards with hard limits, you need fewer human approvals, not more.
• Audit exposure: If you file taxes in multiple jurisdictions or face investor diligence, keep a second step above a threshold.
• Ad hoc approvals: Track who currently approves outside the system for two weeks. If one person clears most exceptions, formalize their role instead of adding a layer.

When to restructure

Move to multi-step when monthly volume doubles, when a card program ends, or when an audit flags missing segregation of duties. Review thresholds annually, not reactively.

How do expense approvals fit a unified task and ops platform?

Keeping expense approvals next to your tasks, onboarding, and device management cuts two costs that generic stacks carry: tool sprawl and context switching. When the approval task, the conversation, and the decision live in one place, you stop losing context between systems and stop paying for overlapping seats.

What generic task tools do and don't cover

ClickUp, Asana, monday.com, Wrike, and Trello all let you build an approval as a task, a status column, or a form with a routing step. What varies is how much finance structure you get for free. Wrike and monday.com lean into request forms and custom workflows; Trello gives you a board and little else; ClickUp and Asana sit in between. None of them are accounting systems, so reconciliation still happens elsewhere. If your approval chain is two or three steps with dollar thresholds, any of these can model it; the question is how much setup overhead you accept and whether approvals end up siloed from the onboarding and device workflows they often trigger.

Honest look: where Task22 falls short

Task22 treats expense approvals as one workflow among the ops tasks it already runs: role-based accountability, onboarding checklists, device management, and a portfolio view across projects. The upside is fewer fragmented tools and decisions that stay attached to the work they came from. The trade-off is real: Task22 is not accounting software, has no receipt OCR or card feeds, and its reporting is thinner than a dedicated finance tool. If you need deep expense analytics, pair it with your accounting system rather than expecting one tool to replace it.

What fraud controls are worth the friction at 20-50 people?

At your size, fraud risk is usually a sloppy process, not a criminal mastermind. Rank controls by deterrence-per-friction:

Controls ranked by friction cost

1. Receipt requirements for anything over your lowest threshold. Near-zero friction, kills most padded claims.
2. Duplicate detection on amount-plus-merchant-date. Your tooling should flag it; the employee does nothing extra.
3. Policy acknowledgment at onboarding. One signature, and "I didn't know" stops working as a defense.
4. Random audits of 5-10% of claims per month. The deterrence comes from unpredictability, not volume.
5. Segregation of duties for approver-submitted expenses. Highest friction, so reserve it for the one role that needs it.

The approver-submits problem

When the person who approves expenses also submits them, every other control weakens. The fix is cheap: route their claims to a second approver, always. Small companies skip this because it feels bureaucratic, but it is the one claim type where a one-step chain is genuinely indefensible. Everything else can stay lean. The Association of Certified Fraud Examiners publishes guidance on segregation of duties for small organizations here.

How do you roll out a new approval workflow without a rebellion?

Rollout sequence

Publish the thresholds and escalation rules first, in writing, before you touch the tool. People accept rules they can see; they resent rules that change mid-submission. Then run the new workflow in parallel with the old one for one full expense cycle so nobody's reimbursement is trapped in a migration.

Announce the reimbursement SLA with the rollout: what gets paid, and by when, under the new chain. A predictable two-week payout beats a vague "faster" promise. Flag the one policy change that matters most (usually receipt requirements) rather than bundling five changes into one memo.

Metrics to track

Measure median approval turnaround and reimbursement lag for one cycle before the switch, then compare after. Track escalation rate too: if more than a small share of expenses hit the second step, your thresholds are set wrong. Review at 60 days and adjust.

FAQ

How long should expense reimbursement take at a small company?

Most claims should move from submission to payout within one to two expense cycles, roughly a week at smaller companies. Each extra approver adds a separate queue wait, and the slowest one sets your reimbursement date. If median turnaround exceeds two weeks, your chain is too deep or thresholds are routing too many claims into manual review.

Who approves expenses when the manager is the one spending?

Route their claims to a second approver, always. When the approver also submits, every other control weakens, because no one independently checks the claim. It feels bureaucratic, but it is the one situation where a single-step chain is genuinely indefensible. The fix costs one routing rule, not a new approval layer for the whole company.

Do I need expense approval software if we already use a task management tool?

Probably not. ClickUp, Asana, monday.com, Wrike, and Trello can all model a two- or three-step chain with dollar thresholds as tasks, status columns, or routed forms. None are accounting systems, so reconciliation happens elsewhere regardless. The real question is whether approvals sit siloed from the workflows they trigger, like onboarding and device management.

What receipt documentation should we legally require for reimbursements?

If you run an IRS accountable plan, you need business connection, substantiation, and return of excess advances, which in practice means a receipt plus a stated business purpose for each claim. Require receipts for anything above your lowest threshold, and flag anything submitted more than 60 days after purchase for manual review regardless of amount.