Who can spend what, without asking you?

Nobody sets out to run a company without spending controls. It happens because the informal version works so well for so long. Ten people, one founder, every decision passes across a desk, and a written policy would be an insult to everyone.

Then the company doubles and the founder becomes a bottleneck. What happens next is not that spending stops. People make reasonable decisions without asking, because asking has become slow, and three months later nobody can reconstruct who approved the subscription that renews annually.

The point of a policy is not control. It is so that people can spend without asking, inside limits everyone agreed, and so the month-end close is not an archaeology exercise.

Approval matrix

Amount bands with who approves each, plus the categories that need approval at any amount: new recurring subscriptions, new vendors, hiring outside the plan, international travel, anything with a personal benefit.

Categories

Eighteen spending categories with what each allows, the evidence a claim needs, whether GST input credit is available, and the account it should post to.

Policy

The written version in plain sentences, drafted and ready to edit into your own words and circulate. Purpose, the test, what the company does and does not pay for, evidence, timing, and what to do when something goes wrong.

Claim log

A simple record of claims, approvals and payments, with days to reimburse and a running total of claims submitted without an invoice.

Shaded cells are yours. The policy sheet is entirely yours to rewrite, and it should be: a policy in somebody else's voice does not get followed.

Most of the evidence rules in the file exist for a reason that is not control. Two things make an expense deductible and its input GST claimable: a valid tax invoice in the company's name carrying its GSTIN, and a business purpose you could explain.

Three rules are worth knowing before you write your own version, because they change what is worth chasing.

1. 01Input credit is blocked on some categories whatever the paperwork says, including food and beverage, outdoor catering, club and gym memberships, and motor vehicles in most cases. Chasing GST invoices for a team lunch wastes everyone's time.
2. 02Cash payments above ₹10,000 to one person in one day are disallowed as a deduction. Reimbursing an employee who paid cash does not change that, so the company bears the full cost of the expense and the tax on it.
3. 03Input credit depends on the supplier having reported the invoice, which is why the monthly reconciliation against GSTR-2B matters and why an invoice in hand is necessary rather than sufficient.

None of this is tax advice and the position for your company should be confirmed with your CA. Rates, blocked categories and thresholds change.

Each category in the file carries the account it should post to, and getting that alignment right is worth more than it sounds.

When categories and accounts disagree, the same expense gets posted three different ways depending on who processed it. Every month-on-month variance then needs investigating before it can be explained, and the monthly pack becomes something people argue about rather than act on.

Two placements are worth deciding deliberately. Recruitment fees belong with people cost rather than in general overheads, because they are a cost of the hiring decision and they distort a month badly when they land. And in a services business, delivery people and contractors belong in cost of sales rather than overheads, or every project margin you calculate will be wrong.

The free chart of accounts on this site is built to line up with these categories, so claims post consistently and plan against actual is a subtraction rather than a reconciliation.

The drafted policy in the file is deliberately short and written in the second person. A few things make the difference between a policy that gets followed and one that gets filed.

• ·Lead with a test rather than a list. Would you be comfortable explaining this expense, in a sentence, to the whole company? That covers more ground than any set of rules and it is what people actually remember.
• ·Say why the evidence rules exist. People chase invoices when they understand the company loses money without them, and not when they are told it is policy.
• ·Be explicit that a declared mistake is an administrative matter. Undeclared ones are what you actually want to prevent, and saying so makes declaring easy.
• ·Put the reimbursement timeline in writing and then meet it. People stop following a policy when getting their own money back takes six weeks.
• ·Keep it to one page of real content. Anything longer is a document nobody has read that you will nonetheless cite at someone.

Not fraud, in almost every case. Three ordinary failures, each of which costs real money.

The first is recurring spending nobody owns. Subscriptions bought for a project that ended, seats for people who left, two tools doing the same job because different teams chose differently. It accumulates at a few thousand rupees a month and reaches a meaningful number inside two years, and it is invisible because no single line looks wrong.

The second is lost input credit. Claims paid without a valid tax invoice are reimbursed in full and recover nothing, and by the time anyone notices the period is closed and the return is filed. A company spending ₹6 lakh a month through claims, with a tenth of it undocumented, has about ₹7.2 lakh of undocumented claims a year, carrying roughly ₹1.1 lakh of input GST it cannot recover.

The third is the one that surfaces at the worst moment. Diligence asks who approved a payment and there is no answer, because the approval was a message that is no longer findable. It rarely ends a deal and it reliably adds a week and a set of follow-up questions about what else is undocumented.

Earlier than most founders think, and the signals are behavioural rather than numerical.

• ·Somebody asks you to approve something and you realise you do not know whether you should.
• ·A cost appears in the monthly accounts that nobody remembers approving.
• ·You are approving expenses in the evening because the queue built up during the day.
• ·A subscription renews and the person who bought it has left.
• ·You have raised, and an investor has asked how spending is controlled.
• ·Headcount crosses about twenty-five, which is roughly where the informal version stops scaling in most companies.

Any two of those and it is overdue. Putting it in place is an afternoon, and the thing that makes it stick is circulating it once with an explanation rather than adding it to an onboarding folder.

• ·It is not a legal document and not an employment contract. How a policy binds employees, and what happens if someone breaches it, is a question for your lawyer.
• ·It is not tax advice. The GST and income tax points are there so you know what to ask about, and your CA should confirm the position for your company.
• ·It is not expense management software. It is what you use before you need that, and what you hand over when you buy it, because the categories and limits transfer straight across.
• ·It does not cover procurement for companies buying stock or capital equipment at scale, which needs purchase orders, three-quote rules and goods receipt matching.
• ·It says nothing about payroll, which is a different control problem with different rules.

What it does is answer one question clearly enough that people stop asking it: who can spend what, on what evidence, without coming to you. For a company past about twenty-five people, that is usually several hours a month back and a month-end close that reconciles.