# Test brief: expense management tool

Product type: expense management tool. Corporate cards, receipts, approvals and reimbursements.
Risk map and evidence: https://howtotestaproduct.com/how-to-test/expense-management/
Printable checklist: https://howtotestaproduct.com/checklists/expense-management/

Run these 9 mandatory tests in this order. A test is done only when its done condition is true on the build you will release.

1. release smoke tests (risks: money-loss). Tool class: mobile automation. Usually run by: QA engineer.
   Done when: After each release, a test employee captures a receipt, submits a report, a manager approves it and the reimbursement appears in the payout file.
2. end-to-end functional tests (risks: regulatory-penalty, money-loss, fraud-abuse). Tool class: browser automation. Usually run by: QA engineer.
   Done when: A report with a missing receipt or business purpose cannot be approved for payment, and an employee leaving the company has every card frozen on the offboarding date, and a dinner split into two receipts below the approval threshold, or a card charge claimed again as out-of-pocket, is flagged before payment.
3. penetration testing (risks: data-breach, money-loss, fraud-abuse). Tool class: proxy. Usually run by: external lab.
   Done when: An external tester cannot open another team's receipts by changing an ID, and cannot raise their own card limit or approve their own report.
4. integration tests (risks: money-loss, data-corruption). Tool class: API client. Usually run by: developer.
   Done when: A card transaction from the issuer processor appears once on the cardholder's expense list with the same amount, currency and merchant, and a reversal removes it.
5. payment and money-flow testing (risks: money-loss). Tool class: API client. Usually run by: QA engineer.
   Done when: In the card sandbox, a frozen card declines the next purchase, a merchant-category block declines a blocked purchase, and a spend limit declines the first charge above it.
6. compliance checks (risks: regulatory-penalty, data-corruption). Tool class: test management. Usually run by: product manager.
   Done when: A reviewer finds, for a sample of reimbursements, the receipt, the business purpose, the approver and any returned advance recorded with dates.
7. unit tests (risks: data-corruption). Tool class: unit framework. Usually run by: developer.
   Done when: Currency conversion, per diem and mileage amounts match a reviewed table for each rate and country the tool supports.
8. security scanning (risks: data-breach). Tool class: DAST scanner. Usually run by: security specialist.
   Done when: The latest scan of the web app, mobile API and receipt storage shows no open finding that exposes receipt images or card numbers.
9. data integrity and migration testing (risks: data-corruption). Tool class: data validation. Usually run by: QA engineer.
   Done when: For a sample of approved expenses, each stored receipt image opens, shows a readable amount and date, and is linked to the same expense line after edits.

Acceptance criteria wording:
A release of the expense management tool is accepted when a report without a receipt or business purpose cannot be approved for payment and an offboarded employee's cards decline the next purchase. Card transactions from the issuer processor appear once on the cardholder's list with matching amount, currency and merchant, and each stored receipt image opens readable and linked to its expense line. No open scan finding exposes receipt images or card numbers.

Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file).

Licence: CC BY 4.0.