July 27, 2026

A Corporate Card Expense Policy Template for SMBs (Steal This)

Most corporate card policies fail for the same reason: they're written to survive an audit, not to be read by the person holding the card. Twelve pages of defined terms, no numbers anyone remembers, and a submission deadline nobody can name. The result is a document that satisfies no one — employees ignore it, and it still wouldn't hold up under scrutiny.

Here's a shorter one you can adapt today. Every number in it traces back to an actual IRS rule, which we've cited so you can check the reasoning rather than take our word for it.

First, understand what makes a policy "accountable"

This is the part most SMB policies skip, and it's the part with real money attached.

If your reimbursement arrangement is an accountable plan under the IRS rules, reimbursements aren't wages — they're not reported on the W-2 and not subject to payroll tax. If it isn't, the amounts become taxable compensation with withholding attached. An arrangement qualifies on three conditions: expenses must have a business connection, must be substantiated to the employer within a reasonable period, and any excess must be returned within a reasonable period (26 CFR 1.62-2).

Corporate cards blur this, because nothing is "reimbursed" — the company already paid. But the substantiation logic still governs whether a charge is a documented business expense or an undocumented benefit to the employee. Write the policy as if substantiation matters, because it does.

The template

1. What the card is for

The company card is for business expenses incurred in your role. Personal charges are not permitted. If you charge something personal by mistake, report it within five business days and reimburse the company.

Keep the prohibition simple. A short honest rule with a stated remedy gets followed; a long list of forbidden categories invites hunting for gaps.

2. Receipts

Attach a receipt for every charge of $75 or more. Attach a receipt for all lodging, regardless of amount. Receipts must show the vendor, date, amount, and what was purchased. For meals with others, note the attendees and the business purpose.

The $75 figure isn't arbitrary. IRS substantiation rules require documentary evidence for lodging while traveling away from home and for any other expenditure of $75 or more (26 CFR 1.274-5).

The tradeoff: plenty of companies set the internal threshold lower — $25, or receipts on everything. Lower thresholds give you cleaner books and better vendor data. They also generate far more chasing, and chasing is what kills policy compliance. If your card volume is mostly small recurring SaaS and fuel charges, $75 with a handful of always-receipt categories is the honest place to start.

3. The submission deadline

Code and submit each transaction within 30 days of the charge. Anything unsubstantiated after 60 days may be treated as taxable income.

The safe harbor behind those numbers: under the fixed date method, an advance within 30 days of the expense, substantiation within 60 days of the expense, and return of excess within 120 days are all deemed to occur within a reasonable period. There's also a periodic statement method — issue statements at least quarterly listing unsubstantiated amounts and give employees 120 days from the statement to substantiate or return.

Pick one method and name it in the policy. Most small teams find the fixed date method easier to explain; the periodic statement method fits better if you already run a monthly review cycle.

4. Mileage and personal vehicles

Personal vehicle use for business is reimbursed at the current IRS standard mileage rate. Log date, destination, business purpose, and miles.

Do not hardcode the rate. 2026 is a good illustration of why: the business standard mileage rate was 72.5 cents per mile for January 1 through June 30, then rose to 76 cents for July 1 through December 31 (IRS standard mileage rates). A policy naming a number goes stale mid-year; a policy pointing at "the current IRS rate" never does.

5. Approvals and limits

Charges above $[500] require manager approval. Charges above $[5,000] require finance approval. Travel is pre-approved through [process].

Set thresholds where a human would actually add judgment. A $50 approval step is theater — it trains people to click approve without reading, which is worse than no approval at all.

6. What happens when the policy isn't followed

Repeated missing receipts or late submissions may result in card suspension. Undocumented personal use is recovered through payroll.

Unstated consequences are the most common reason a policy quietly stops working. Write the consequence down, then apply it consistently.

Three mistakes that make policies unenforceable

Writing rules nobody can check. "Reasonable and necessary" is not a rule, it's a mood. "Under $75, receipt optional" is a rule.

Setting a deadline with no reminder attached. A 30-day deadline enforced by one email at month end is a 30-day deadline in name only.

Never revisiting it. If 40% of transactions violate a rule every month, either the rule is wrong or nobody knows it exists. Both are fixable — and both are invisible unless you're measuring exceptions.

The policy is only as good as its enforcement surface

A PDF in a shared drive can't check a receipt threshold. The rules above work when they run where the spending happens: receipt requirements enforced at the transaction, reminders that go out on day three instead of day thirty, and an exception queue that shows you what actually broke this month.

Summit Spend does this against the corporate cards you already have — connected through Plaid, no card program to switch — so policy checks, receipt matching, and approval routing run on real transactions as they arrive. If you want to see whether your policy survives contact with your actual spend, request access and we'll run it against your own transactions with you.