Expense user rights
Expense rights separate the people who approve spending from the people who release money, and both from the people who can change an approved amount. Those separations are the entire control over expense fraud.
Where: Expenses › Rights You need: the expense user rights permission
The rights
Access
| Right | Allows |
|---|---|
| Expenses administrator | Administering the module |
| Expenses manager | Managing expenses for a team |
| Expense settings | Configuring expense types and rules |
| Expense reports | Running expense reports |
Approving
| Right | Allows |
|---|---|
| Expense approver | Approving claims |
| Expenses universal approver | Approving across the company |
| Advance approver | Approving advances |
| Advance universal approver | Approving advances across the company |
Money and overrides
| Right | Allows |
|---|---|
| Expense payer | Releasing payment |
| Override approved amount | Changing an amount after approval |
| Delete approved | Deleting an approved claim |
The three separations that matter
Approver and payer must be different people. One agrees the spending, another releases the money. Without this, a single person can create, approve and pay a claim — which is the simplest expense fraud there is, and the one auditors look for first.
⚠️ Override approved amount lets someone change what was approved, after it was approved. That is the right most worth restricting and most worth reviewing: it silently breaks the link between what an approver agreed and what the company paid. Give it to as few people as possible and expect each use to be explainable.
Delete approved removes an approved claim entirely. Prefer declining and correcting over deleting, so the record of what was requested and decided survives.
Universal approvers
A universal approver can approve across the company rather than within their own team. That is useful for finance and for cover during absence — and it is also a very broad permission. Grant it to keep approvals moving when a manager is away, not as a default for the finance team.
How to grant expense rights
- Open Expenses › Rights.
- Select the person.
- Grant only what their role needs.
- Save, and have them confirm what they can see and do.
What Happens Next
- Rights apply immediately; the person may need to reload.
- Employees can always submit and see their own claims without any right being granted.
- Removing a right does not alter approvals or payments already made.
Tips
- Separate approver from payer on day one. It costs nothing to set up and is very awkward to retrofit after an incident.
- Audit who holds override and delete regularly, and keep both lists to one or two people.
- Do not let anyone approve their own claims. Make it structurally impossible rather than relying on people not to.
- Review rights when someone changes role. Expense approval follows people around long after they stop managing the team.
- Grant universal approver sparingly and temporarily where you can — it bypasses the normal route by design.
Troubleshooting / FAQ
Q: A manager cannot approve their team's claims. Check they hold the approver right and that it covers those employees.
Q: Someone can approve but not pay. Correct — those are separate rights, deliberately.
Q: An approved amount was changed. Who can do that? Only someone with the override right. It should be a very short list.
Q: Should finance hold universal approver? Only if they genuinely approve across the company. Otherwise it bypasses the managers who should be deciding.
Q: Can someone delete a claim to fix a mistake? They can with the delete right, but declining and correcting keeps the history intact and is almost always better.