Automating Travel Expense Audits at Cal Poly
Overview
Every year, Cal Poly processes thousands of travel expense reports — conference trips, athletic team travel, research fieldwork — each one needing to be checked against the university’s official travel policy before it can be reimbursed. That review has always been a manual process: an auditor opens a spreadsheet, cross-references each line item against per diem limits, lodging caps, and airfare rules, and flags anything that looks off. It’s slow, inconsistent, and doesn’t scale.
The Cal Poly Digital Transformation Hub (DxHub) partnered with Cal Poly’s Financial Services team to explore whether this process could be automated. Using Amazon’s “Working Backwards” innovation methodology, the DxHub team built Travel Audit AI — a policy-aware auditing tool that ingests expense report data and automatically flags violations of Cal Poly’s travel policy.
Problem
Cal Poly’s travel policy is detailed and easy to get wrong. Meal per diems vary by traveler type and location. Lodging has a nightly cap. Airfare must be economy class. Mileage reimbursement follows the IRS rate. Receipts are required above a set dollar threshold, and expenses must be submitted within a fixed window after travel ends. Multiply those rules across every trip, every department, every quarter, and manual review becomes a bottleneck — auditors can only sample a fraction of expense reports, which means most policy violations go undetected until they’ve already been reimbursed.
Financial Services staff described wanting something closer to a first-pass filter: a system that could take a quarter’s worth of expense data, apply the same rules a human auditor would, and hand back a prioritized list — critical violations that need to be rejected outright, and lower-severity issues that need a human to weigh in.
Innovation In Action
The team started where most DxHub engagements do: with a working session to map the actual audit workflow, not the theoretical one. Auditors walked through how they use Cal Poly’s continuous auditing procedures today, which policy sections cause the most disputes, and what “confidence” would look like in an automated flag.
From there, the team built a Next.js dashboard where an auditor could upload an expense export and see a visual breakdown of flagged line items by category (meals, lodging, airfare, mileage). Behind that dashboard, DxHub engineers translated Cal Poly’s published travel policy (per diem tables, lodging limits, receipt thresholds, submission deadlines) into a structured, versioned rules engine, so violations were computed directly from policy rather than flagged manually. Each rule carries a severity level (critical, high, medium, low) that determines whether an expense should be auto-rejected, routed for manager approval, or just logged for review.
Technical Solution
Travel Audit AI was designed as a serverless pipeline on AWS:
- Amazon S3: landing zone for expense report exports (CSV/XLSX) uploaded by Financial Services staff
- AWS Lambda: event-driven ingestion; normalizes uploaded reports into a common expense-record schema
- Amazon Bedrock: used for the harder-to-rule-code judgment calls (for example, interpreting ambiguous receipt descriptions or matching conference agendas against claimed meal exclusions) that pure rule logic can’t reliably catch
- Amazon DynamoDB: stores the structured policy configuration and per-expense violation results, keyed by report and quarter
- Next.js frontend on AWS Amplify: the auditor-facing dashboard, showing violations grouped by severity with drill-down detail per line item
- Amazon CloudWatch: pipeline monitoring and audit-trail logging, so every automated decision is traceable back to the rule (or model call) that produced it
This split kept the deterministic policy checks (dollar limits, deadlines, receipt thresholds) fast, cheap, and fully explainable, while reserving the LLM for the genuinely ambiguous cases auditors flagged as hardest to automate.
Next Steps
The rules engine encoded Cal Poly’s core travel policy — meal per diems, lodging caps, airfare class restrictions, mileage rates, receipt and submission-deadline requirements — into a single structured configuration that the audit pipeline could evaluate against every line item in a report. A dedicated meals-analysis view let auditors drill into per diem violations trip-by-trip, including first/last travel day adjustments, and a violation-detail panel showed exactly which policy rule was triggered and why.
Running the engine against a real quarter of Cal Poly travel data (FY2024 Q2 continuous auditing procedures) surfaced violations across every category the policy covers, giving Financial Services their first look at systematic policy compliance rather than a manual spot-check.
Supporting Documents
| Source Code | All of the code and assets developed during the course of creating the prototype. |
About the DxHub
The Cal Poly Digital Transformation Hub (DxHub) is a strategic relationship with Amazon Web Services (AWS) and is the world’s first cloud innovation center supported by AWS on a University campus. The primary goal of the DxHub is to provide students with real-world problem-solving experiences by immersing them in the application of proven innovation methods in combination with the latest technologies to solve important challenges in the public sector. The challenges being addressed cover a wide variety of topics including homelessness, evidence-based policing, digital literacy, virtual cybersecurity laboratories and many others. The DxHub leverages the deep subject matter expertise of government, education, and non-profit organizations to clearly understand the customers affected by public sector challenges and develop solutions that meet the customer needs.