CFO vs Controller vs VP Who Owns T&E Policy

A traveler books business class on a route the policy caps at economy. The expense surfaces at month-end, and three people point at each other. The controller says the policy belongs to the VP of finance. The VP says the CFO set the budget it has to fit. The CFO says enforcement is the controller's job. T&E policy ownership is the most quietly contested question in a finance org, because the honest answer is that three roles each own a different piece of it. This is who owns what, and how to make the split work.

Who owns T&E policy? The short answer

T&E policy has three finance owners, not one: the CFO sets the mandate it serves, the controller enforces it, and the VP of finance owns the document that ties the two together. The confusion is real because the work is genuinely shared. GBTA research on travel departments found that finance and accounting are the top collaborators on travel-expense policy, involved in about 79% of organizations, while the travel department is the sole primary owner in only around 43%. Those collaborators are senior finance roles, and there are a lot of them: the US employs about 868,600 financial managers, a group projected to grow 15% through 2034.

Getting the split right matters because the money is real and the leakage is quiet. Business travel is a $1.71 trillion category worldwide in 2026, and expense-reimbursement fraud shows up in about 13% of occupational-fraud cases at a median loss of $50,000 each. A policy nobody clearly owns is where that leakage hides. The rest of this piece assigns each role its piece, then puts them into one RACI model.

What the CFO owns: strategy, budget, and risk appetite

The CFO owns the "why" behind the policy, not its line items. In Deloitte's widely used model, the CFO plays Strategist and Steward, taking a seat at the strategy table while protecting the company's assets and communicating risk to the board. Applied to travel, that means the CFO sets the spend target, decides how much out-of-policy behavior the company will tolerate, and signs the large financial commitments the program runs on.

What the CFO does not do is write the per-diem or approve individual trips. They set the mandate and hold the biggest sign-offs, and delegate the rest. That division shows up clearly in the field. 

At a healthcare staffing firm, an operations manager approved travel upgrades and policy exceptions day to day but still routed corporate-card sign-off to the CFO, a clean split between running the policy and owning the money behind it. The way finance sets that mandate is changing as automation takes over the mechanics, a shift covered in the role of finance in travel and expense.

What the controller owns: enforcement, compliance, and the close

The controller owns the policy where it meets reality. As the company's chief accountant, the controller runs the financial close, internal controls, and compliance monitoring, and is responsible for keeping the books accurate and in line with company policy. Every out-of-policy expense eventually lands on the controller's desk at month-end, which makes them the enforcement owner whether or not the title says so.

That enforcement role is why the controller cares most about a policy that is written to be checked. Clear rules, a clean travel and expense audit process, and consistent travel and expense policy compliance are the controller's defense against the leakage the ACFE data quantifies. When enforcement is weak, the policy is words; when the controller owns it, the policy has teeth.

What the VP of finance owns: the policy document itself

The VP of finance usually owns the policy as a living document. Robert Half describes the role as the bridge between the controller's backward-looking precision and the CFO's forward-looking vision, owning day-to-day financial leadership, systems, and mid-range planning. In practice that makes the VP the person who drafts the policy, keeps it current, and aligns it across travel, HR, legal, and the department budgets.

The boundary here is genuinely fuzzy, and it moves with the org chart. In a company with no VP of finance, the controller absorbs the policy-ownership and planning duties; in a company with no separate controller, the VP of finance absorbs the close and compliance work. The role in the room is what matters, not the title. 

When a large energy and fuel-distribution company evaluated a new travel platform, the VP of finance was a lead voice in the room, which is where day-to-day T&E policy ownership tends to sit. Whoever holds it should start from a solid template, like the one in the comprehensive guide to corporate T&E policy.

A RACI model for T&E policy ownership

The clean way to settle ownership is a RACI matrix, which forces exactly one role to be Accountable for a task even when several are Responsible for the work. That single-owner rule is the whole point: many people touch T&E policy, but only one should be answerable for it. The table below maps the roles to a typical mid-size finance org.

In a company with no VP of finance, move the Accountable role to the controller or the CFO, but keep it to one. The failure mode is not having two owners; it is having none.

How a platform supports shared T&E policy ownership

Software does not decide who owns the policy, but it is what makes a shared model workable instead of a standing argument. The point is to encode the policy once and give each owner the view they need, so the CFO sees spend against the target, the controller sees enforcement and exceptions, and the VP of finance sees a policy that is actually being followed.

ITILITE supports that split directly. The VP of finance gets the policy encoded as configurable rules and approval workflows; the controller gets automatic out-of-policy flagging, an audit trail, and reporting that holds up at close; and the CFO gets spend visibility against budget, plus the business travel and expense card controls that keep the big commitments in view. Running it on one corporate travel booking platform means the same policy the VP owns is the one the controller enforces and the CFO can see, rather than three versions in three systems.