Giving Staff Cards: Limits, Receipts and Who Is Liable | HL Hunt
Giving Staff Cards: Limits, Receipts and Who Is Liable
Issuing cards to staff is framed as a trust decision and is better framed as an exposure calculation, because the number is knowable and the trust question is not. Nine cards at $2,500 limits is $22,500 of exposure against $14,800 of monthly spend; right-sizing to actual need takes it to $5,400, a 76% cut with no policy change and nobody told anything. And employee misuse is frequently a loss the business bears rather than a fraud the issuer absorbs, which changes what the controls are for.
What you'll learn
Start with the exposure, not the policy
Giving staff cards is usually framed as a trust decision. It is better framed as an exposure calculation, because the number is knowable and the trust question is not.
Nine cards at $2,500 limits, with monthly card spend of $14,800:
- Exposure at any moment: 9 × $2,500 = $22,500
- Actual need per card, on examination: around $600
- Exposure at right-sized limits: $5,400
That is the first control and almost nobody uses it, because limits are set once at issuance and never revisited. Per our limit setting analysis, a limit is a maximum rather than a budget, and a limit set generously to avoid declines is a limit set to the largest purchase anyone might ever need rather than to the spend that actually occurs.
Per our internal controls analysis, the general principle is that controls which reduce exposure without requiring anyone to behave differently are the ones that survive, because they do not depend on vigilance and they insult nobody.
What leakage actually costs
On the same $14,800 of monthly spend, at a leakage rate of 2.1%, meaning spend that was not for the business or not within policy:
- Monthly: $311
- Annually: $3,730
That figure is modest, and it is not the reason to put controls in. The reasons are the tail risks that do not show up as a rate: a single large misuse, a card compromised and not noticed, a dispute you cannot evidence, and the tax position on expenses with no receipt.
Per our optimal rate analysis, the correct leakage rate is not zero, because the controls required to reach zero cost more than $3,730. What the controls are actually buying is a bound on the worst case rather than an elimination of the average one.
The controls that are worth the friction
| Control | What it prevents | Friction |
|---|---|---|
| Limits set to actual need | The entire tail, proportionally | None. Do this first |
| Merchant category restrictions | Categories that are never legitimate for the role | Low, and occasional false declines |
| Single-transaction caps | One large misuse, which is the expensive case | Low |
| Receipt capture at the point of spend | The evidence gap, per our reconciliation analysis | Low if it is a photo, high if it is a form |
| Approval above a threshold | Spend nobody would have authorized | Moderate, and it delays legitimate purchases |
| Virtual cards per vendor or per project | Exposure beyond the intended use, and it makes reconciliation automatic | Low once set up |
| Reviewing every transaction | Little that the above has not caught | High. Usually not worth it |
The fourth row is where most programmes fail operationally. Receipt capture works when it is a photograph taken at the till and fails when it is a form filled in later, and per our exception analysis a process that is bypassed in a hurry is a process that produces the gap it was meant to close.
The sixth row is the underused one. A virtual card issued per vendor caps exposure at that vendor, makes an unexpected charge impossible rather than detectable, and means the reconciliation is already done because the card identifies the purpose. Per our stored credential analysis, it also removes the problem of a shared card stored across a dozen services with nobody certain which.
A shared card is not a control problem, it is the absence of one
One card used by several people, with the number stored in a few places, cannot be attributed, cannot be limited per person, cannot be cancelled without disrupting everyone, and cannot be reconciled except by asking. If that is the current arrangement, replacing it with one card per person at a right-sized limit is a larger improvement than any policy document, and it is also cheaper than the time currently spent working out who bought what.
Who is liable for what
This is the part business owners most often have wrong, and it differs from the consumer position they are familiar with.
- Commercial card protections differ from consumer ones. Per our dispute analysis, the consumer dispute framework a business owner knows personally may not apply to a business card, and the terms govern.
- The liability model matters. Whether the company, the individual, or both are liable for a card is set at issuance, and it determines who the issuer pursues and what happens on employee departure.
- Unauthorized use by an employee is frequently not treated as fraud by the issuer, because the card was given to them, which puts the loss on the business rather than on the network.
- Deducting misuse from wages is restricted, per our payroll obligations analysis, and the rules are not the ones most owners assume.
- Cards must be cancelled on departure, same day. Per our institutional memory analysis, this is the step that depends on one process reaching another and therefore the step that fails.
The third bullet is the one that changes the calculation. If misuse by someone you authorized is a loss the business bears rather than a fraud the issuer absorbs, then the controls are not protecting you from an outsider, they are the only protection that exists. That reframing is usually enough to get limits right-sized.
Spend controls and a business credit record that is yours
Card programmes are easier to obtain and to expand when the business has a credit file of its own rather than borrowing against the owner. HL Hunt Business Credit Builder establishes tradelines reported in your entity's name, which is what the issuer reviews when you ask for more cards or higher limits.
Introducing controls without insulting anyone
- Start with limits, which requires no conversation and no policy.
- Explain the controls as reconciliation, because that is largely true: receipt capture exists so nobody has to reconstruct a month of spend from memory.
- Apply them to everyone including the owner. Per our owner compensation analysis, a control the owner is exempt from is a control the team reads correctly.
- Make compliance easier than non-compliance. A photo at the till beats an expense form every time.
- Set a threshold, not a review. Approving everything above $400 is a rule; approving things that look odd is a judgment nobody can apply consistently.
- Tell people what is in and out of policy specifically, because most leakage is ambiguity rather than intent.
- Review limits quarterly against actual spend, upward as well as down.
Item six is where most of the $3,730 is. Per our ambiguity analysis, an unclear rule gets resolved by the person applying it in their own favour, not from dishonesty but because somebody had to decide and the policy did not. A written list of what is and is not reimbursable removes most of the leakage without any monitoring at all.
Item three costs nothing and does more for adoption than any amount of explanation. Controls that visibly apply to whoever set them are read as administration; controls with an exemption at the top are read as supervision.
What to watch
| Metric | Why |
|---|---|
| Total exposure, meaning the sum of limits | The number to reduce first and the easiest to compute |
| Spend against limit per card | Identifies the limits that are wrong in both directions |
| Transactions without a receipt | The evidence gap, which is also the tax exposure |
| Declines by reason | A control calibration measure; frequent legitimate declines mean a limit is too tight |
| Days from departure to card cancellation | Should be zero and frequently is not |
| Spend outside stated policy categories | Mostly ambiguity, per our ambiguity analysis, and fixable by writing the list |
The first row is a one-hour task with a 76% result in the example above. Add up the limits on every card the business has issued. Most owners have never done it, and the figure is usually several times the monthly spend it supports.
Frequently asked questions
The limits. Nine cards at $2,500 is $22,500 of exposure; right-sizing to actual need takes it to $5,400, a 76% cut with no policy change.
About $3,730 a year on $14,800 of monthly spend. That average is not the point; controls exist to bound the tail, not eliminate the rate.
Usually the business. Misuse by someone you authorized is often not treated as fraud, so the controls are the only protection rather than a backstop.
Start with limits, which needs no conversation. Frame controls as reconciliation, apply them to the owner too, and write down what is reimbursable.
Key takeaways
- Nine cards at $2,500 limits is $22,500 of exposure; right-sizing to actual need cuts it 76% with no policy change.
- Limits are set once at issuance and reflect the largest purchase anyone might need, not the spend that occurs.
- Leakage of about $3,730 a year is not the reason for controls; bounding the tail is.
- A single-transaction cap prevents the expensive case rather than detecting it afterward.
- Virtual cards per vendor bound exposure at the intended use and make reconciliation automatic.
- Receipt capture works as a photo at the till and fails as a form filled in later.
- Employee misuse is frequently a business loss rather than issuer-absorbed fraud, so controls are the only protection.
- Most leakage is ambiguity, so writing down what is reimbursable removes it without any monitoring.
This guide is educational and does not constitute legal, tax, or accounting advice. All figures are stylized illustrations using assumed card counts, limits, spend, and leakage rates, and do not describe any particular business. Commercial card liability models, dispute rights on business cards, treatment of unauthorized employee use, restrictions on deducting losses from wages, and documentation requirements for expense deductibility vary by issuer, by card product, and by jurisdiction. Review your card agreement and consult a qualified adviser before relying on any liability position described here.