1. IDC 614
I D C A N A L Y S T C O N N E C T I O N
Kathleen Wilhide
Research Director, Compliance and Business Performance Management
Solutions
Avoiding the Compliance Trap for Travel and
Expenses
January 2008
Travel and related expenses are one of the largest controllable indirect expenses many companies
incur. Managing adherence to policy and monitoring for fraud can be burdensome and costly tasks.
Software that automates the travel and expense (T&E) process has always been a valuable
investment for companies to achieve efficiency and provide policy enforcement. However, increasing
compliance requirements, from the broad stroke of Sarbanes-Oxley to targeted regulations affecting
financial services and pharmaceutical firms, now demand greater transparency and control over the
T&E management process.
Organizations weighing T&E automation should look beyond the value of streamlining the process to
solutions that include analytic and reporting features that enforce compliance controls and provide
audit evidence while minimizing business risks associated with uncontrolled spending and fraud.
These more robust solutions are part of the extended enterprise applications market experiencing
greater investment as a result of governance, risk, and compliance requirements.
IDC estimates that some companies are spending up to 0.5% of revenue to meet compliance
requirements, and investments to improve core processes and automatically enforce controls and
compliance can ease the compliance burden while mitigating risk. With the promise of fast and
dynamic delivery of software functionality, on-demand T&E solutions are helping companies quickly
meet requirements to enforce policies and controls and are also providing capabilities to meet
evolving compliance requirements.
The following questions were posed by travel and expense management services provider Concur to
Kathleen Wilhide, research director for IDC's Compliance and Business Performance Management
(BPM) Solutions research, on behalf of Concur's customers.
Q. What are the compliance issues surrounding employee travel and expense
management?
A. Compliance has a number of direct and indirect implications for companies. Many
organizations have no choice but to assign employees to check and double-check
operational controls and manually assemble evidence to prove adherence to policy. If control
gaps are identified, auditors continue to make demands on organizations to prove risks are
being managed. As the cost of compliance escalates, companies look to automated solutions
to help them provide enforcement in areas that pose control risk or are impacted by specific
legislation. T&E is one of those areas.

2. ©2008 IDC2
Regulations such as Sarbanes-Oxley are not prescriptive with regard to what areas should
be automated, but they provide overall guidance for processes that are material in nature and
pose risk. When processes such as T&E pose control risks, the opportunity for fraud
escalates. Companies can continue to manually monitor this process and incur increasing
internal costs and audit fees or implement technology to automate the process and provide a
system of record that auditors can rely on while reducing manual effort.
Q. Which industries are particularly at risk for noncompliance, and why?
A. Processes such as T&E management pose control risks for all industries. What organizations
find is that other areas of legislation can also be satisfied through a common compliance
process or an investment in software. The financial services and pharmaceutical industries
are at the forefront of determining how their technology solutions can help meet multiple
compliance requirements. From a T&E perspective, these two industries in particular are also
looking to software to manage the T&E process and at the same time meet the requirements
of currently evolving legislation for additional policy enforcement and reporting in this area.
For example, in the financial services arena, the National Association of Securities Dealers
(NASD) Rule 3060 addresses business entertainment expenses and conflicts of interest.
Specifically, the rule prohibits brokers from giving gifts worth more than $100 in any given
year to individuals with whom they have a business relationship. Gifts can take the form of
entertainment as well as specific gifts, both of which are typically paid through corporate
travel and expense reimbursement processes. The rule requires organizations to monitor
compliance with this policy, enforce supervision and approval, and maintain detailed records
of these expenses.
The pharmaceutical industry has similar state-mandated gift-disclosure laws that require
companies to provide comparable oversight and detailed reporting on gifts, promotions,
marketing costs, drug samples, meals and entertainment, and travel expenditures. Failure to
report can result in fines approaching $10,000. More expensive than the fines, however, is
the brand impact associated with public disclosure of these violations. Regulations are in
place in six states, with similar legislation pending in other states as well.
Requirements like these are cumbersome to enforce manually, but they are a natural
extension of an automated T&E process, which then becomes the system of record for
compliance with this regulation.
Q. What can companies do to improve internal controls and compliance?
A. Internal control weaknesses and related compliance risks are buried in operational
processes, and when technology is implemented, consideration must be given not only to the
processing of high volumes of transactions but also to the enforcement of corporate policies
and the ability to provide exception reporting. Purpose-built software and on-demand
services that automate areas such as T&E management from both policy and transaction
processing perspectives are part of a best practices approach to achieve operational
efficiency while mitigating risks associated with error, fraud, and legislative rule violations.
Once the company's audit firm establishes that an enterprise system is functioning as
intended and supporting prescribed policies and internal controls, it becomes a system of
record that can be relied upon. When processes are manual or spreadsheet driven, they
represent a risk of noncompliance subject to regulatory action as well as an increased risk
that may drive higher audit fees.

3. ©2008 IDC 3
Q. How is the value proposition for automating T&E evolving?
A. Manual T&E processes can be time-consuming and subject to error. When T&E represents a
material expense to the business, it is a process ripe for automation, and the value
proposition of implementing technology is further increased in light of heightened scrutiny of
internal control reviews or specific legislation in industries such as pharmaceuticals or
financial services. By automating the process, organizations can prove process consistency
and policy enforcement to regulators and auditors and also take comfort in knowing that the
risk of fraud and error is mitigated. When this automation is coupled with process
optimization, cost savings and resulting return on investment can be significant.
Q. What should companies look for in an on-demand provider of travel booking and
expense reporting solutions?
A. The solutions best suited to on-demand delivery are those that can deliver support for
repeatable processes. Certainly the basic processes around T&E are similar enough from
company to company, with variability lying in the establishment of policies and business
rules. Travel and expense is perfectly suited to delivery as an on-demand solution, as core
functionality can be deployed consistently as a service, with individual company business
rules dictating its application. These solutions have evolved to help organizations manage the
entire process — from the procurement of travel to payment of vendors and reimbursement
of employees — which can provide a greater degree of visibility, control, and compliance
compared with disparate systems that manage each step of the process discretely.
This is a great example of how organizations can use an on-demand solution to quickly
automate the core process and meet individual policy needs with minimal impact on their
IT departments. From a compliance perspective, on-demand providers undergo a SAS 70
Type 2 audit that provides their customers with assurance around internal control
enforcement. As companies look to implement technology for key business processes,
on-demand providers can help them achieve quick time to value.
A B O U T T H I S A N A L Y S T
Kathleen Wilhide is the research director for Compliance and Business Performance Management (BPM) Solutions
research at IDC, a worldwide research firm with headquarters in Framingham, Massachusetts. Ms. Wilhide directs IDC's
research efforts on software solutions supporting compliance and risk management and related business assurance
processes.
A B O U T T H I S P U B L I C A T I O N
This publication was produced by IDC Go-to-Market Services. The opinion, analysis, and research results presented herein
are drawn from more detailed research and analysis independently conducted and published by IDC, unless specific vendor
sponsorship is noted. IDC Go-to-Market Services makes IDC content available in a wide range of formats for distribution by
various companies. A license to distribute IDC content does not imply endorsement of or opinion about the licensee.
C O P Y R I G H T A N D R E S T R I C T I O N S
Any IDC information or reference to IDC that is to be used in advertising, press releases, or promotional materials requires
prior written approval from IDC. For permission requests, contact the GMS information line at 508-988-7610 or gms@idc.com.
Translation and/or localization of this document requires an additional license from IDC.
For more information on IDC, visit www.idc.com. For more information on IDC GMS, visit www.idc.com/gms.
Global Headquarters: 5 Speen Street Framingham, MA 01701 USA P.508.872.8200 F.508.935.4015 www.idc.com