Procure-to-Pay and Expense Policy Template

Procure-to-Pay and Expense Policy: [Entity name]

Finance control policy for the payables side of the business: vendor master data, purchase orders and receipts, invoice processing and three-way match, payment runs, employee travel and expenses, and corporate cards. Control design follows the five components of internal control in the GAO Standards for Internal Control in the Federal Government (the Green Book, 2025 revision, GAO-25-107721, effective from fiscal year 2026), which mirror the COSO Internal Control framework, and can be used by private and public entities. Sourcing and supplier selection rules sit in the procurement policy. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal, tax or financial advice: check the current official text and a qualified professional.

Document control

Approvals

Revision history

1. Purpose, scope and control framework

This policy applies to every purchase of goods and services, every supplier payment and every employee expense claim or card transaction of the entities in scope.

The control design maps to the five components of internal control in the Green Book (2025): control environment, risk assessment, control activities, information and communication, and monitoring. The 2025 revision adds an explicit expectation to consider improper payment and information security risks during risk assessment; both are central to payables. Private companies may map the same controls to COSO Internal Control, Integrated Framework (2013).

Main risks addressed:

UK note: since 2025-09-01 large organisations can be liable for the offence of failure to prevent fraud under the Economic Crime and Corporate Transparency Act 2023, with a defence of reasonable fraud prevention procedures; payables controls form part of that evidence.

2. Roles and segregation of duties

User access to these roles is reviewed every [quarter]; conflicts are listed with a compensating control or removed.

3. Approval authority

The value is the full commitment over the contract term. Splitting one need into several orders to stay under a threshold is a breach of this policy and is monitored by a monthly report of orders to the same supplier just below a threshold.

4. Vendor master data

5. Purchase orders and receipts

A PO approved before commitment is mandatory for all purchases except the "no PO" categories: [utilities, rates and taxes, regulator fees, payroll-related payments, intercompany charges]. Each exception category has a named approver for invoices.

Goods receipts are recorded when goods arrive, against the PO line, with quantity accepted. Service receipts are confirmed by the service owner on evidence of delivery (timesheet, milestone sign-off). Retrospective POs (dated after the invoice) are reported monthly by department.

6. Invoice processing and three-way match

Invoices are received only through [the AP mailbox or e-invoicing channel], registered on the day of receipt and matched:

Tolerances: price variance accepted automatically up to the lower of [2%] of the line value or [GBP 250]; no automatic acceptance of quantity above received quantity.

Example: PO for 100 units at GBP 48.00 (GBP 4,800.00); receipt of 98 units; invoice for 100 units at GBP 48.50 (GBP 4,850.00). The price variance is GBP 0.50 per unit, 1.04% of PO price, within tolerance. AP posts 98 x 48.50 = GBP 4,753.00 and holds 2 x 48.50 = GBP 97.00 until the remaining units arrive or a credit note is received.

Duplicate checks run on supplier, invoice number (normalised), date and amount before posting, and as a monthly analytic over paid invoices. Tax on the invoice is checked for the required content of the jurisdiction (for example VAT invoice requirements in the UK and EU).

7. Payment runs

Pay suppliers on the agreed terms and within any statutory maximum (see finance/credit-control-collections-policy for EU and UK late payment rules). In the UK, large companies must also report payment practices under the Reporting on Payment Practices and Performance Regulations; check the current reporting fields.

8. Travel and expenses

Rules:

1. Book travel through [the travel tool]; economy class for flights under [6] hours.
2. Hotel nightly caps by city tier: [Tier 1 GBP 220, Tier 2 GBP 150].
3. Meals while travelling at actual cost up to [GBP 50] per day, with itemised receipts.
4. Mileage for business use of a private car at [the approved rate]; check HMRC approved mileage allowance payments in the UK or the IRS standard mileage rate in the US for the current year.
5. Client entertainment pre-approved above [GBP 250] and recorded in the gifts and hospitality register.
6. Claims submitted within [30] days with itemised receipts; approved by the claimant's manager, never by the claimant or a subordinate.
7. Not reimbursed: fines, personal travel extensions, alcohol without a client present, [other items].

Tax: reimbursements are structured to meet local rules (for example an accountable plan under US Treas. Reg. 1.62-2, or HMRC rules on expenses and benefits in the UK). Payroll and tax review any allowance paid without receipts.

9. Corporate cards

10. Monitoring and metrics

Internal audit tests the key controls annually using the control IDs in this policy.

11. Glossary and references

Standard and licence note

Based on the GAO Standards for Internal Control in the Federal Government (2025 revision, a public US government publication), with control components named and summarised in original words; COSO, UK and US instruments are cited by name only. Check the current official text of each source and local tax rules before adoption. Fenmarsh Retail Group and all figures are fictional. The text is original and is not legal, tax or financial advice. Template licence: MIT.