Expense audit readiness is not created at audit time. It is created every time a claim is submitted, checked, approved, reimbursed, and exported with evidence attached. By the time a reviewer asks for a sample, the trail either exists or it does not — the weeks before an audit can organize evidence, but they cannot create it.
That is what makes readiness checkable in advance. The questions a reviewer will ask are stable and public: was the spend legitimate, was it approved by someone with authority, is the evidence attached, does the payment match the approval, and does the export reconcile to the books. A finance team can score itself against those questions any quarter it likes, at a fraction of the cost of discovering the gaps mid-audit.
The interactive checklist below does exactly that: score your evidence trail across seven dimensions and read where the gaps are. It runs entirely in your browser — nothing you select is sent anywhere or stored. The result is operational guidance for your own preparation, not an audit opinion and not a guarantee of any audit outcome. The guide underneath covers what reviewers typically request, what each checklist dimension means, and the multi-entity risks that standard checklists miss.
Rate each dimension against your last full quarter, not your best week. Runs entirely in your browser — nothing you select is sent anywhere or stored.
An expense audit — internal or external — works by sampling: the reviewer selects claims and asks for the complete story of each. For every sampled claim, finance should be able to produce, without reconstruction:
| Evidence item | What the reviewer is checking |
|---|---|
| Original receipt or invoice | The spend happened, at the stated merchant, for the stated amount |
| Employee and date | Who incurred it and when — matched against employment and travel records |
| Business purpose | Why this was the company’s cost — the substantiation standards auditors reference, such as IRS Publication 463, frame this as adequate, timely kept records proving time, place, and business purpose |
| Category | The claim was classified so the right policy rules applied |
| Approver identity and timestamp | Someone with authority accepted the cost, and when |
| Policy exception note | If a rule was waived: who waived it, and why |
| Payment record | What was actually reimbursed, when, matching the approved amount |
| Accounting export trail | The claim landed in the books, in the right entity and period |
| Rate source and converted amount | For foreign-currency claims: which rate, from where, fixed at which moment |
The last row is the one most checklists omit. A foreign-currency claim whose converted amount cannot be traced to a stated rate on a stated date turns a routine sample into a discussion — the mechanics of documenting rates are covered in foreign currency expenses.
The professional context reviewers work in is also worth knowing: the Global Internal Audit Standards (2024) organize internal auditing into five domains built on fifteen principles, including planning engagements effectively, conducting engagement work, and communicating results. The practical translation: reviewers arrive with a plan and a sample, and they escalate when the first items sampled cannot be evidenced — which is why the completeness of the routine trail matters more than any binder assembled the week before.
Score each dimension honestly against your last full quarter, not your best week. The checklist grades in three levels per dimension — consistently true, partially true, and not true — because “we mostly do this” is precisely the state audits surface.
The output is a percentage and a per-dimension breakdown, and it means exactly this: how much of the evidence a reviewer will predictably request already exists as a routine byproduct of your workflow. It is not an audit opinion, a compliance rating, or a prediction of any audit’s outcome — no checklist can guarantee an audit result, and this one does not try.
Re-run the checklist after each fix and each quarter. A score that improves across quarters is itself useful evidence of a control environment that monitors and corrects — the posture the standards frameworks describe.
Standard expense checklists assume one company. If your team operates several entities, three additional checks decide whether an entity-level audit is an export or a project:
Cross-entity claims add a fourth: the link between the original expense and any intercompany recharge should be navigable in both directions, so a reviewer on either side reaches the same facts — the workflow that produces this is described in intercompany expenses, and the surrounding structure in multi-entity expense management.
If an audit is scheduled, the useful preparation is a rehearsal, not a reorganization:
Where the workflow itself does the capturing, most of this preparation is already done: in Clara Global, receipts and approval history stay attached to each expense as it moves, the approval rules your finance team defines flag an out-of-policy expense before it reaches a reviewer, and the transaction-date rate — fetched automatically from a market feed — is locked onto the claim at submission, so every converted amount traces to a stated rate on a stated date. Flagging is pre-review support for your own controls — it is not a promise of compliance or of any audit outcome.
The checklist scores seven dimensions, each rated consistently true / partially true / not true from your own answers; the score is the weighted share of fully and partially met items, computed in your browser from your selections alone. Nothing you select is transmitted or stored.
The scoring is operational guidance for self-assessment — it is not an audit, an assurance opinion, or a prediction of any audit outcome. The evidence table reflects what expense reviewers commonly request; the cited standards are attributed only to what their pages verifiably state, each URL verified to resolve before citation.
An expense audit is a review of whether employee expenses were legitimate, properly approved, adequately documented, correctly reimbursed, and recorded in line with policy and accounting requirements. It can be internal — run by your own audit function or finance leadership as part of routine control monitoring — or external, as part of a financial statement audit or a tax examination. In either form it typically works by sampling: the reviewer selects a set of claims and asks for the complete evidence trail of each, escalating the sample size when early items cannot be evidenced.
The scope usually covers the claim’s documentation (receipt, business purpose, category), its approval (who, when, under what authority), its payment (does the reimbursement match the approval), and its accounting (did it land in the right books, entity, and period). Recurring findings are rarely about fraud; they are about evidence that was never captured at the moment it existed.
Per claim: the original receipt or invoice; the employee, date, and merchant; the business purpose, written by the submitter at submission; the category; the full approval history with identities and timestamps; any policy exception with its reason and approver; the payment record showing what was actually reimbursed and when; and the accounting export trail showing where the claim landed in the ledger. For foreign-currency claims, add the rate source, the rate’s date, and the converted amount, so the figure in the books traces to a stated rate rather than an unexplained conversion.
The quality bar auditors reference is contemporaneity: substantiation standards such as IRS Publication 463 frame the requirement as adequate, timely kept records proving time, place, and business purpose — evidence created when the expense happened, not reconstructed when someone asked. Retention periods vary by jurisdiction and are a question for your adviser; the field-by-field capture list is covered in the expense audit trail guide.
The purpose and the consequence differ more than the method. An internal audit is your own organization checking its controls — typically broader in scope, interested in whether the control design works, and ending in recommendations your team schedules and fixes. An external audit serves someone else’s assurance: a financial statement auditor testing whether expense records support the numbers, or a tax authority examining whether reimbursements met substantiation and treatment rules.
External findings carry harder consequences — adjustments, qualified opinions, or tax reassessments — and external reviewers extend their testing when samples fail, which makes the routine completeness of the trail more valuable than any explanation offered during fieldwork. The preparation is the same for both, which is the point of a readiness checklist: a trail that satisfies your own internal sampling will meet an external reviewer’s requests without a special project.
Quarterly is a defensible baseline for the checklist itself, with a small claim-level self-sample — a dozen claims traced end to end — once or twice a year, and immediately after any structural change: a new entity, a policy rewrite, a system migration, or a change in who configures rules and prepares payments. The cadence matters less than the trend: a score that improves across quarters, with documented fixes between runs, is itself evidence of a monitored control environment — the posture internal-control frameworks describe and reviewers are trained to look for.
Two triggers should override the calendar: a failed sample in any review (re-run the checklist immediately and treat the gap as systemic until shown otherwise), and a growing exception log (recurring exceptions mean a rule is mis-calibrated, and audit findings tend to follow mis-calibrated rules).
It removes the mechanical causes of unreadiness, and only those. Software that attaches receipts at submission, records approver identity and timestamps, keeps exception notes, and exports with a reconcilable trail means the evidence exists as a byproduct of the workflow instead of depending on discipline — which is where most audit findings actually come from.
What software cannot do is make the judgment calls that audits also test: whether your thresholds are sensible, whether approvers genuinely review or rubber-stamp, whether exceptions are warranted, whether roles are separated appropriately for your size. No tool can promise compliance or an audit outcome, and a well-configured system operated carelessly fails audits fine. The honest division: use the workflow to make evidence capture automatic, use the checklist above to test the parts that remain human, and treat the combination — not either half — as audit readiness.
The checklist computes a self-assessment score from your selections alone, in your browser, and is explicitly not an audit opinion. Standards citations are limited to what the cited IIA and IRS pages verifiably state, each URL verified to resolve before citation.
Manage your team's expenses in any country and currency. Receipts, approvals, and bank-ready payment reports — all in one place.