Expense management tool testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: After each release, a test employee captures a receipt, submits a report, a manager approves it and the reimbursement appears in the payout file.Risks: money-loss. Tool class: mobile automation. Usually run by: QA engineer.
2. 2.end-to-end functional testsDone when: A report with a missing receipt or business purpose cannot be approved for payment, and an employee leaving the company has every card frozen on the offboarding date, and a dinner split into two receipts below the approval threshold, or a card charge claimed again as out-of-pocket, is flagged before payment.Risks: regulatory-penalty, money-loss, fraud-abuse. Tool class: browser automation. Usually run by: QA engineer.
3. 3.penetration testingDone when: An external tester cannot open another team's receipts by changing an ID, and cannot raise their own card limit or approve their own report.Risks: data-breach, money-loss, fraud-abuse. Tool class: proxy. Usually run by: external lab.
4. 4.integration testsDone when: A card transaction from the issuer processor appears once on the cardholder's expense list with the same amount, currency and merchant, and a reversal removes it.Risks: money-loss, data-corruption. Tool class: API client. Usually run by: developer.
5. 5.payment and money-flow testingDone when: In the card sandbox, a frozen card declines the next purchase, a merchant-category block declines a blocked purchase, and a spend limit declines the first charge above it.Risks: money-loss. Tool class: API client. Usually run by: QA engineer.
6. 6.compliance checksDone when: A reviewer finds, for a sample of reimbursements, the receipt, the business purpose, the approver and any returned advance recorded with dates.Risks: regulatory-penalty, data-corruption. Tool class: test management. Usually run by: product manager.
7. 7.unit testsDone when: Currency conversion, per diem and mileage amounts match a reviewed table for each rate and country the tool supports.Risks: data-corruption. Tool class: unit framework. Usually run by: developer.
8. 8.security scanningDone when: The latest scan of the web app, mobile API and receipt storage shows no open finding that exposes receipt images or card numbers.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.
9. 9.data integrity and migration testingDone when: For a sample of approved expenses, each stored receipt image opens, shows a readable amount and date, and is linked to the same expense line after edits.Risks: data-corruption. Tool class: data validation. Usually run by: QA engineer.