Where to start with AI · First workflow No. 2

Reviewing expense reports

An expense review assistant, rolled out in two stages: first it prepares a recommendation for the reviewer, then it approves compliant reports below a set threshold on its own.

A first AI use case doesn’t need to be spectacular. It does need to be narrow enough to test, measure, and improve.

Download the Scoping Sheet (PDF, 2 pages) View the Carousel (PDF)

Low risk, but only within a strict scope

Expense reports meet all four tests of a good first workflow: they come up often, they have a clear owner, they call for a clear output (a reasoned recommendation), and they are a pain point that reviewers and employees already feel.

The use case is low-risk only within a strict scope:

A written expense policy approved, current, and consistent.
Amounts below a set threshold above it, the reviewer always decides.
No sanctions or judgments on employees left to AI.
Unusual, sensitive, or ambiguous cases routed to finance.

The assistant checks each report against an expense policy the company already has. The risk does not go away. It becomes more visible, measurable, and manageable once the rules, the scope, and the escalation thresholds are defined.

A three-step approach

Get the policy in order

Clarify limits, required receipts, and exceptions; give each rule an owner and a dated version. The tool comes after.

The assistant recommends, the reviewer decides

The assistant reads the receipts, applies the policy rules, and prepares a reasoned recommendation that cites the relevant rule. The reviewer approves, corrects, or asks for a receipt. Every correction is logged, category by category.

The assistant approves compliant reports

It approves on its own any report whose category is allowed, whose receipts are legible and consistent, and whose amount is within policy limits and below the set threshold. It routes to finance any report that is unusual, incomplete, or ambiguous, any questionable receipt, and any amount above the threshold.

Moving from stage 1 to stage 2

The move to stage 2 should not be decided in advance. It depends on what finance observes during stage 1: the accuracy of the recommendations, the corrections needed, and the system’s ability to recognize reports that fall outside its scope.

Accuracy of extraction and recommendationsCorrections needed, by categoryExceptions correctly routedNo significant incident within the tested scopeA current policy, each rule with an owner

Travel expenses could move to stage 2 while business meals stay in stage 1.

Reference architecture: how the system stays under control

Structured extraction of receipts, deterministic rules for limits and thresholds, and a recommendation drafted by an LLM instructed to cite the rule and the receipt, with input and output guardrails and routing to finance. A learning loop connects the log, finance review, and the evaluation set.

Click the diagram to open it full size.

The controls required before any autonomous answer:

Evaluation. A reference set of about 200 past reports, pseudonymized or anonymized as the test requires, each with the expected decision. Metrics: extraction accuracy, recommendation accuracy, correct rule cited, and the rate at which exceptions are detected and correctly routed. Rerun whenever the model, a rule, or the instructions change.

Observability. Every report processed is logged: extracted fields, rules applied, recommendation or approval, routing decision. Receipts and personal data: log minimized, access restricted to authorized roles, retention defined by purpose and applicable obligations.

Identity and access. SSO (SAML or OIDC). Segregation of duties: whoever submits a report can neither approve it nor change the rules. Access rights enforced from receipt intake onward.

Data. Hosting and data transfers verified for the chosen solution; contractual terms barring use of the data for model training; encryption; receipt retention in line with accounting law; documented Swiss FADP assessment.

Application security. Protection against prompt injection, including in receipt text. Scope limited to three outcomes: recommend, approve within the authorized scope, or route to finance. Accounting alone triggers payment.

Corrections go first into improving the rules, extraction, instructions, and evaluation set. Retraining the model is neither the starting point nor a substitute for that work.

The goal

The goal is not to take review away from the finance team. It is to cut reimbursement time for compliant reports, stop the same checks from being redone by hand, and focus reviewers’ time on expenses that call for context and judgment.

Download the Scoping Sheet (PDF) View the Carousel (PDF)

Illustrative case: fictitious company; all figures are approximate. Sergio Castagna Consulting is a member of the OpenAI Partner Network and a registered partner in the Google Cloud Partner Network. The tool comes after the problem is defined.