Home · Solutions · Other solutions
Solution · Other solutionsSampling after payment replaced by a full check that runs before reimbursement
Every expense report audited before the money leaves
Every report is tested against its receipts, the policy and two years of history before it is released; auditors only open the exceptions.
Executive summary
A sample checked after payment finds errors it cannot recover and misses the duplicates entirely.
The change is one of sequence: the check moves in front of the payment.
Coverage becomes complete: every line is tested before payment rather than a random fraction after it.
SAP Concur (audit status and comments); SAP S/4HANA (reimbursement postings); Power BI
Business problem
Travel & expense
Expense audit is a post-payment sampling exercise for one reason: reading every receipt by hand is impossible at volume. Everything else follows. Errors are found after reimbursement, so recovery is awkward, slow and frequently abandoned. Duplicates are close to invisible, because they hide between reports, between an employee's card feed and their cash claims, and between months. Altered receipts pass, because nobody compares fonts, totals and file metadata on a sample of one.
The people doing this work are skilled and expensive, and they spend most of their month confirming that ordinary reports are ordinary. The share that is not ordinary is small, but at group scale it is real money, and a case that surfaces late costs far more in explanation than in euros. Meanwhile the approving manager, who is the only other control, is looking at totals rather than receipts.
Scale makes each of these worse. Receipts arrive in nine languages and a dozen tax regimes; three analysts cannot read them consistently. Coverage falls as the company grows, because the sample stays the same size while the population does not. And the findings describe a sample rather than a population, so there is no evidence base on which to change a policy, retrain a country or challenge a manager.
How it works today
- PersonThe employee submits a report with receipt images attached at the end of a trip
- PersonThe manager approves, mostly on the totals, without opening the receipts
- SystemThe expense system releases the report and the payment run reimburses the employee
- WaitingInternal audit waits for the month to close, then exports last month's paid reports
- PersonAn analyst draws a random sample and opens each report to compare receipts with claimed lines
- Risk of errorDuplicates across reports, cards and months, and altered receipts, pass unless the sample happens to catch them
- PersonFindings go to finance, which emails employees to ask for repayment or an explanation months after the trip
- SystemA quarterly pack goes to the audit committee: sample size, findings, recoveries
Why the current process costs more than it appears
The budget shows headcount, not what it is spent on.
- Recovery is the expensive half and never appears in a budget line. Chasing money already spent consumes finance time, strains the relationship with employees who made an honest mistake, and often ends in a write-off.
- What passes teaches. The few people who notice that a split claim or a second submission goes through do it again, and the amounts grow slowly enough never to trigger a manager.
- Managers calibrate to the control they can see. When approval is not checked, approval gets faster, and the second pair of eyes becomes a click.
- Every acquisition adds a country whose receipt formats, languages and tax rules nobody in the team reads, so coverage there is effectively zero for a year.
- External auditors accept sampling until a case reaches a regulator or a newspaper, at which point the question is not the amount but why nobody tried full coverage.
Cost of inaction
Coverage falls without anyone deciding it. Report volume grows with headcount and travel, the audit team does not grow with it, and one report in eight quietly becomes one in ten. Each acquisition adds a country whose receipts nobody reads, and recovery letters keep going out months after payment and keep being written off.
The quiet risk is behavioural. People who have learned that a second submission passes keep going, and their claims grow slowly enough never to trigger a manager or a sample. Nothing about that is dramatic in any single month, which is why it survives every review of the control.
A plausible organisation with realistic proportions. The figures are there to be recalculated on your data; they are not a client result.
A building-materials industrial group, 6,500 employees in nine European countries, SAP Concur as the expense system and SAP S/4HANA as the ledger; internal audit is three analysts reporting to a head of internal audit.
About 4,200 expense reports a month, roughly 31,000 lines, average report value €410, so around €1.7 million reimbursed every month; receipts arrive in nine languages, mostly hotel folios, restaurant bills and taxi receipts.
One report in eight is sampled after payment, 525 a month at about 18 minutes each. Findings are mostly missing itemisation and small overclaims, plus a duplicate or an altered receipt a few times a year.
The check sits after the cash has left, and it covers a random fraction, so patterns across people, cards and months are never seen and nothing found can be prevented.
Every approved report is retrieved before release, its receipts are read by UiPath Document Understanding, and a rule set tests each line for duplicates, receipt-to-claim mismatches, inflated totals, altered-document signals and policy limits. Clean reports go to payment; the rest reach an auditor with the evidence already assembled.
In the modelled case coverage goes from one report in eight to all of them, roughly 9% of reports raise an exception, and the analyst month moves from confirming ordinary reports to deciding the ones that failed a rule. Illustrative, not a client result.
Proposed solution
The change is one of sequence: the check moves in front of the payment. When a manager approves a report, the UiPath Integration Service connector for SAP Concur triggers a robot that retrieves the report, its lines and its receipt images. UiPath Document Understanding reads each receipt with the pre-trained Receipts model, and Generative Extraction takes the layouts the model does not recognise. Every extracted field carries a confidence score, and anything below the threshold goes to Validation Station rather than into a rule.
The rules then run on every line. We build them with the audit team as DMN decision tables in UiPath Maestro, so finance owns the thresholds and changes them under a documented process: duplicate search across reports, card transactions and a rolling 24-month window; receipt-to-claim comparison on amount, date, currency and merchant; inflated totals and tips; signals that a receipt image was altered; and the policy limits of that country. The index of line fingerprints, receipt hashes and card transactions sits in UiPath Data Fabric.
Each report leaves the rules with an outcome. Clean reports are released to the payment run, and the audit status is written back to the expense system. Reports that failed a rule become UiPath Action Center review tasks, delivered where the audit team works in Microsoft Teams, with the receipt image, the matching candidate, the rule that fired and the policy clause on one screen. The auditor releases, returns to the employee, or escalates to compliance, and the decision is written back and logged. Power BI reports coverage, exception rate by rule, country and manager, and the amounts stopped.
The AI in this design is narrow and supervised. A model reads receipts and flags image anomalies; it never decides anything. Duplicate matching, the rules and the outcomes are deterministic and reproducible, which is what makes the result defensible in front of an audit committee.
UiPath Document Understanding pre-trained Receipts model, Generative Extraction and Validation Station; UiPath Maestro with DMN decision tables; UiPath Action Center review tasks delivered in Microsoft Teams; UiPath Integration Service SAP Concur connector; UiPath Orchestrator queues, triggers, credential stores and audit; UiPath Data Fabric entities
The rule set and its thresholds, the 24-month duplicate index over lines, receipt hashes and card transactions, the evidence layout the auditor sees, the release and return logic with write-back, the escalation path to compliance, and the Power BI reporting on coverage, exception rate and amounts stopped
The corporate card feed import used for cross-channel duplicate matching; SAP S/4HANA reimbursement postings through UiPath SAP activities where the expense system does not post them itself
How the automated process works
- AutomationManager approval triggers retrieval of the report, its lines and its receipt images before release
- AutomationDocument Understanding reads every receipt, with Generative Extraction for unusual layouts and a confidence score per field
- PersonFields below the confidence threshold go to Validation Station for a short check, so no rule runs on a guess
- AutomationThe DMN rules test each line: duplicates across reports, cards and 24 months, receipt-to-claim mismatches, inflated totals, altered-image signals, policy limits
- AutomationReports that pass every rule are released to the payment run and the audit status is written back
- SystemReports that fail become Action Center review tasks in Microsoft Teams with the evidence attached
- PersonThe auditor releases, returns the report to the employee with the reason, or escalates the case to compliance
- AutomationDecisions are written back and logged, and Power BI refreshes coverage, exception rate by rule and amounts stopped
Human-in-the-loop model
Automation handles
- Retrieval of every approved report, its lines and its receipt images
- Receipt reading in any language, with a confidence score on every field
- The duplicate search across reports, card transactions and a rolling 24-month window
- Rule execution, the risk outcome per report, and release of the reports that pass
People decide
- Every exception: release, return to the employee, or escalate
- Any investigation of suspected fraud and every conversation with the employee
- Low-confidence extractions, checked in Validation Station before a rule sees them
- The rule thresholds themselves, which stay a finance decision under change control
Before and after
Systems and integrations
The stack is deliberately short: one engine, one execution layer, one place where a person decides.
Inputs
- approved reports and receipt images from SAP Concur
- the corporate card feed
- policy documents and rule tables on SharePoint
Automation layer
- UiPath Orchestrator
- UiPath Robots
- UiPath Document Understanding
- UiPath Maestro
- UiPath Action Center
- UiPath Data Fabric
Target systems
- SAP Concur (audit status and comments)
- SAP S/4HANA (reimbursement postings)
- Power BI
Human touchpoints: Action Center review queue in Microsoft Teams; Validation Station for low-confidence receipts; the escalation path to compliance
Technologies used
pre-trained Receipts model and Generative Extraction read every receipt image, with confidence scores
Aretrieve approved reports, run the checks, hold queues, credentials and the audit record
Aexecutes the rule set: duplicates, mismatches, inflated totals, policy limits
Aholds the 24-month index of line fingerprints, receipt hashes and card transactions
Aauditor review queue with the evidence attached, assignment and SLAs
Awhere review tasks and escalations reach the audit team
Aapproved-report trigger, report and receipt retrieval, audit-status write-back
Acoverage, exception rate by rule, country and manager, and amounts stopped
AIllustrative economic model
Numbers you can check against your own data.
The box below prices one thing, the post-payment sample: 525 reports a month, one in eight of 4,200, at about 18 minutes of manual audit each and €42 an hour fully loaded for an analyst. It does not net off the work that replaces it, which is stated instead: roughly 380 exceptions a month at about 12 minutes leave 76 hours, so the net release is 81.5 hours a month, about €3,423. The larger figure sits outside the calculator: at €1,722,000 reimbursed a month and 0.6% stopped or corrected before payment, €10,332 a month never leaves. Both ratios are assumptions for discussion, not measurements.
Run the numbers on your data
An illustrative estimate from your own inputs. It models released capacity; it is not a promise of savings.
Business benefits
- Coverage becomes complete: every line is tested before payment rather than a random fraction after it
- Duplicates are actually found, because the comparison runs across reports, card feeds and two years, which no human sample does
- Prevention replaces recovery, so the awkward email months after a trip stops being part of the process
- Auditors spend their month on judgement, because reports that pass every rule never reach the queue
- Treatment is consistent across nine countries and languages, because the same rules read every receipt
- Policy decisions gain an evidence base, because the findings now describe the whole population rather than a sample
The management view
- Coverage stops being a number to defend and becomes a fact, with exception rates by rule, country and manager underneath it
- Queue age shows whether the audit team is keeping up, and the exception mix shows whether the rules are tuned or noisy
- Every release and return is logged with the evidence and the auditor's name, so the audit committee pack is produced from the log rather than assembled
- Team size follows exception volume rather than report volume, which is the first time this control has scaled with anything other than headcount
Board-level KPIs
Security and governance
An auditor should be able to reconstruct every decision.
- Receipt images and expense lines are personal data: they stay inside your Microsoft 365 tenant and the EU region of UiPath Automation Cloud, and are never sent anywhere else for processing
- The robot uses a dedicated expense-system account with read access to approved reports and write access limited to the audit status, with credentials in the Orchestrator credential store or Azure Key Vault
- Extraction and any generative step run under the UiPath AI Trust Layer with a model allow-list, masking where extraction does not need the field, and full logging of prompts and answers
- Only auditors see exceptions, assigned through a Microsoft Entra ID group, and every release, return and escalation is attributable to a named person
- The duplicate index stores hashes and line fingerprints under a retention period agreed with your data protection officer, not the underlying images
- Employees are told that every report is checked, which is a legal requirement in several countries and, in practice, the strongest part of the control
Why now
Reading receipts in many languages is a pre-trained capability rather than a modelling project, and generative extraction handles the odd formats that used to defeat OCR
Convincing fabricated receipts are now easy to produce with consumer tools, and a control that reads one document in eight was designed for a world where they were not
The economics have inverted: checking everything costs less than the team that checks one in eight, and the modelled €10,332 a month of spend stopped does not depend on adding analysts
Relevant executive roles
Spend stopped before it leaves, and a coverage figure the audit committee accepts without a discussion about sample sizes
Complete coverage with evidence attached, a precision metric for the rules, and a defensible log behind every decision
A smaller queue worked by the same team, and an end to recovery letters written months after the trip
Consistent treatment across nine countries and early detection of fabricated documents rather than annual discovery
Common questions and objections
They accept it because full coverage was not feasible. Once it is feasible at a lower cost than the sample, sampling becomes a choice to justify rather than a constraint to understand.
That is what the shadow run is for: the rules work on live reports beside the existing sample until precision is acceptable, and exception rate by rule is monitored afterwards so a noisy threshold is visible in days.
Most exceptions are errors and duplicates rather than fraud, and a consistent check protects honest employees from suspicion. The rules are written down, identical for everyone, and every decision stays with a person.
When this is not the right solution
- Fewer than a few hundred reports a month, where one person can genuinely read everything
- Receipts are still on paper and not imaged at submission; capture has to be solved first
- The expense system's own audit module already covers cross-report duplicates and is tuned and used
- Nobody in finance or audit can work the queue within days; an exception queue nobody opens is worse than a sample
A question for the next management meeting
Would this board rather explain a coverage figure of one report in eight to the audit committee, or the cost of making it eight in eight?
Implementation approach
A scope without ambiguity, before anything is signed.
We deliver
- A read of three months of paid reports with their receipts, alongside your own findings for the same period, so the rules are calibrated against what your team knows
- The rule set as decision tables your finance and audit people own: duplicates, mismatches, inflated totals, altered-image signals, policy limits
- Receipt extraction configured for your languages and formats, with confidence thresholds and the validation path
- The duplicate index over lines, receipt hashes and card transactions, with a retention period agreed with your data protection officer
- The review queue, its evidence layout, the write-back of decisions and the escalation to compliance
- Power BI on coverage, exception rate, precision and amounts stopped, plus training for the audit team
We need from you
- Three months of paid reports with receipt images and the audit findings for the same period
- The corporate card feed and the expense policy in its authoritative version
- An audit lead as process owner, able to decide thresholds
- Technical accounts for the expense system and a test environment
Stages
Calibration
Historical reports and your own findings turned into a first rule set with thresholds
Shadow run
The rules run on live reports in one country while auditors keep sampling, and precision is tuned
Switch-on
The pre-reimbursement hold goes live for that country, with the queue watched daily
Rollout
Country by country, adding local receipt formats, languages and tax rules
Run
Monthly rule review, exception-rate monitoring, audit-committee reporting produced from the log
Departmental. Effort is driven by the number of countries and receipt languages, the quality of the card feed, and how many of your policy rules can be written as thresholds rather than judgement.
Seven expense reports in eight are paid without anyone reading a receipt.
Export 300 paid reports from last quarter with their receipt images, anonymised if you prefer. We run our rule set over them and return the exceptions with the evidence attached and a precision estimate for each rule.
Send 300 paid reports with receiptsThe neighbouring process usually has the same problem
Stop paying nine expense claims in ten on trust because nobody has time to check them against policy.
View solution Other solutionsEvery card transaction matched to a receipt and a policyCard spend is matched, coded and checked weeks after it posts, and receipts are chased forever.
View solution Other solutionsMissing itemisations and tax lines caught at submissionThe VAT on a hotel night is lost in the week the folio is wrong, not in the quarter the adviser finds it.
View solutionIndustries we deliver this in most oftenManufacturing & industryServices & ITFinance & insuranceShared services