# Corporate Card Controls: Limits, Receipts and Review

- Author: PreciseBankFlow (https://precisebankflow.com)
- Published: 2026-10-17
- Category: Internal controls over cash
- Canonical: https://precisebankflow.com/blog/corporate-card-controls

> Corporate card controls: per-card limits, merchant blocks, receipt deadlines, manager review and what to do when a card is used for personal costs.
Corporate card controls keep company cards for company spending. The core set is a limit on each card sized to the holder's role, blocks on merchant types the business never buys from, a firm deadline for receipts, and a monthly review by someone other than the cardholder. A written process for personal charges completes it.

## Which corporate card controls matter most?

The corporate card controls that matter most fall into three layers: limits set before any spending, documentation required after each purchase, and an independent review of the monthly statement. Limits cap the damage. Receipts explain each charge. Review catches the charge that has a receipt but should not have happened.

### The three layers

- **Before the purchase**: who gets a card, the credit limit on it, the merchant types it can be used at, and whether cash withdrawals are allowed.
- **After the purchase**: a receipt and a business purpose for every charge, submitted by a deadline.
- **At month end**: a review of each cardholder's statement by their manager, and a reconciliation of the card account to the general ledger by finance.

A card program missing any layer has a known weakness. Generous limits with strong review still allow a large loss before the review happens. Tight limits with no review let small misuse run for years.

### Who should hold a card at all

Fewer cards mean fewer statements to review. Issue cards to people who buy regularly as part of their job, such as office managers, field supervisors or staff who travel. Occasional buyers can use a shared purchasing process or claim a reimbursement. When someone changes role or leaves, cancel the card on their last day, not at the next statement.

## Per-card limits and merchant category blocks on corporate cards

Per-card limits cap what each cardholder can spend in a billing cycle, and merchant category blocks stop the card working at types of business the company never uses. Together they turn a policy rule into a decline at the till. Set both at the card issuer, so they apply whether or not anyone reads the policy.

### An example card policy by role

The values below are examples for a small company. Use your own spending history to set limits a little above normal monthly use for each role.

| Cardholder role | Monthly limit | Single-purchase limit | Blocked merchant types | Receipt deadline | Reviewer |
| --- | --- | --- | --- | --- | --- |
| Office manager | 3,000 | 750 | Bars, casinos, cash advances, jewelry | 10 days after the charge | Controller |
| Field supervisor | 5,000 | 1,500 | Bars, casinos, cash advances, travel agencies | 10 days | Operations manager |
| Sales staff who travel | 7,500 | 2,500 | Casinos, cash advances | 10 days | Sales manager |
| Controller | 10,000 | 5,000 | Casinos, cash advances | 10 days | CFO or owner |
| Owner or CFO | 15,000 | 7,500 | Casinos, cash advances | 10 days | Outside accountant or board member |

### Setting limits that fit

A limit far above actual spending protects nothing, while a limit set too tight leads to declined cards and requests to "just raise it for this month." Review limits each year against the last twelve months of use. Temporary increases for a trade show or a project should expire on a set date.

### Merchant blocks

Card issuers usually group merchants by type, and the program administrator can block whole groups. Blocking gambling, cash advances and other merchant types the business never needs costs nothing and removes some of the most obvious misuse. Keep a record of each block so a later administrator understands why a card declined.

## What receipt deadline should corporate cardholders meet?

Corporate cardholders should submit a receipt and a business purpose for each charge within a short, fixed period, such as ten business days, with an outer limit that matches the IRS timing for substantiating employee expenses. A deadline the program enforces keeps the documentation fresh and makes the monthly review possible.

### The IRS timing behind the deadline

The IRS describes an accountable plan as one where expenses have a business connection, the employee accounts for them within a reasonable period, and any excess is returned within a reasonable period. Under [IRS Publication 463 on travel, gift and car expenses](https://www.irs.gov/publications/p463), accounting for expenses within 60 days after they were paid or incurred counts as a reasonable period, and returning any excess within 120 days does too. A company deadline shorter than 60 days stays well inside that safe harbor. Ask your tax adviser how these rules apply to charges the company pays directly.

### What a receipt submission includes

- The itemized receipt, not just the card slip showing the total.
- The business purpose in a sentence: who, what and why.
- For meals and entertainment, the names of the people present and their business relationship.
- The expense account or project code, if the cardholder knows it.

### Enforcing the deadline

A deadline nobody enforces becomes a suggestion. Send a reminder at the deadline, escalate to the manager a week later, and suspend the card if receipts are still missing at the next statement. Suspension applies to everyone, including senior staff, or it loses its force.

## Manager review of corporate card statements each month

Manager review of corporate card statements means the cardholder's manager reads every charge on the monthly statement against the receipts and the business purposes, then signs off. Finance then reconciles the card account to the general ledger. The manager judges whether each charge was reasonable; finance proves the totals agree.

### A monthly review checklist

The reviewer works through each cardholder's statement:

1. Every charge has a receipt and a business purpose.
2. Merchant names make sense for the cardholder's job.
3. No charges fall on weekends or holidays without a reason, such as travel.
4. No two charges at the same merchant on the same day look like one purchase split to stay under the single-purchase limit.
5. No charges appear for personal-type merchants: groceries, streaming services, clothing, personal travel.
6. Refunds and credits are expected and match an earlier charge.
7. Amounts on receipts match amounts on the statement.

Finance's part is to reconcile the card statement balance to the card liability account each month, and to follow up on any cardholder whose review is late. A shared spreadsheet works for a small program; [a bank reconciliation template Google Sheets can run](/blog/bank-reconciliation-template-google-sheets) shows a self-checking layout that adapts well to a card account.

### Reading statements across many cards

When a program has many cards, patterns across cardholders matter as much as single charges: the same merchant appearing on several cards, or one cardholder's spend climbing every month. [PreciseBankFlow](/) reads card statements alongside bank statements, checks each one foots and flags possible duplicate charges, so the reviewer can start with the lines most likely to need a question.

### Why review fails

Review fails when the manager approves the whole statement in one click, or when the cardholder's manager is also a frequent companion on the trips being reviewed. The fix for a review that leaves no trail is the same for cards as for bank reconciliations; [the cash control deficiencies auditors report most](/blog/cash-control-deficiencies#missing-or-rubber-stamp-review-of-reconciliations) shows what a documented review looks like.

## What should you do when a corporate card is used for personal costs?

When a corporate card is used for personal costs, first find out whether it was a mistake, such as the wrong card pulled from a wallet, or deliberate misuse. A one-off mistake that the cardholder reports and repays quickly is a policy issue. A pattern of personal charges, or charges hidden with false business purposes, is a fraud issue.

### The honest mistake

Write the steps into the card policy so everyone knows them in advance:

1. The cardholder flags the charge on their expense submission as personal.
2. The cardholder repays the company by a set date, for example within 30 days, by check, transfer or payroll deduction they have agreed in writing.
3. Finance records the repayment against the charge and keeps the evidence with the statement.

If an employee never repays a personal charge, the amount may become taxable pay. Publication 463 says amounts that fail the accountable plan rules are reported as wages in box 1 of Form W-2, so involve payroll and your tax adviser rather than letting the item sit.

### Deliberate misuse

Signs of deliberate misuse include repeated personal merchants, receipts that look altered, business purposes copied from month to month, and charges split to avoid limits. When those appear:

- Suspend the card at the issuer.
- Pull the full history of the card, not just the current month.
- Preserve the statements, receipts and submissions.
- Involve HR and, where the amounts justify it, legal counsel before talking to the employee.

The analysis that follows uses the card statements as evidence. Building that case is a separate task, with patterns and proof that go beyond a monthly review.

## Owner and executive corporate cards: the review gap at the top

Owner and executive corporate cards create a review gap, because the people holding them are usually the ones who approve everyone else's spending. Nobody below them feels able to question a charge. The control is to route their statements to someone independent, such as a board member, an audit committee or an outside accountant.

### Closing the gap

- Send the owner's or CFO's card statements to a named reviewer outside the reporting line, every month.
- Apply the same receipt deadline and the same blocks to executive cards as to everyone else.
- Have the outside accountant test a sample of executive charges at year end, even when nothing looks wrong.

### When the owner is the business

In a company with a single owner, there may be no one above to review. Personal spending on the company card then becomes an owner draw or a loan that needs recording correctly, not a fraud on the business. It still matters, because it distorts the books, the tax return and any lender's view of the business. Record those charges to the owner's equity or loan account each month, not to expenses.

Card controls are one part of a wider set of cash controls. For the full minimum set that a small team can run, see [internal controls over cash for small teams](/blog/internal-controls-over-cash).