A small business often hands a virtual assistant a company card because it is the fastest way to keep operations moving. The card solves a convenience problem and creates an accounting problem at the same time. Who approved the purchase? What was bought? Which job or client does it belong to? Why does the receipt not match the statement? This review examines how public internal-control and recordkeeping guidance can be translated into a bounded purchase-card workflow for an assistant.
The decision this research supports
The buyer is not deciding whether purchase cards are inherently safe or risky. The decision is narrower: which purchases may an assistant initiate, what evidence must accompany them, who approves them, and how will the business detect a problem before the monthly close. A control design answers those questions in advance so that a routine purchase does not depend on a chat message and a favor.
This article treats the assistant as a preparer and coordinator, not a budget owner. The assistant may collect quotes, prepare a purchase request, place an approved order, and assemble receipts. The business retains vendor selection, spending limits, payment approval, dispute decisions, and any accounting treatment. That separation is the core design choice; the rest of the workflow exists to make it operable.
What the Green Book contributes to a private-company workflow
The U.S. Government Accountability Office’s Green Book sets out standards for internal control in federal agencies. A private business is not required to follow it, and its terminology can feel formal for a five-person company. Its value is the underlying logic: define objectives, identify risks, design control activities, communicate information, and monitor results. Those steps apply to a purchase card even when the organization is small.
For delegated buying, the relevant objective might be: purchases are authorized, received, recorded in the correct period and category, and supported by evidence. The risks include unauthorized spend, duplicate orders, personal use, split transactions that evade a limit, changed vendor payment details, missing receipts, and purchases that never reach the accounting record. Naming the risks makes it possible to design a specific check rather than telling an assistant to “be careful.”
The Green Book also emphasizes documentation and correction. A control that exists only in a manager’s memory is difficult to evaluate and easy to bypass during a busy week. A short written procedure, a transaction log, and a review sample give the business something to test. The framework does not guarantee that fraud will not occur; it makes ordinary errors visible and high-risk exceptions easier to route.
Map the buying path before setting limits
List the ordinary paths a purchase can take: a recurring subscription, a one-off supply order, a client-reimbursable expense, an emergency repair, and a software renewal. Each path has different evidence and approval needs. A twelve-dollar monthly tool does not need the same review as a four-thousand-dollar equipment purchase, but both need a defined owner and a record.
For each path, identify the trigger, the allowed vendor list or selection rule, the spending limit, the required quote or comparison, the approver, the receipt requirement, the accounting category, and the exception route. The assistant should know which path a request belongs to before placing an order. If a request spans paths, such as an emergency purchase from a new vendor, the higher-risk route should apply.
Map the systems too. Where is the request recorded? Where is the approval? Where does the receipt live? Which system holds the card transaction? A control that requires copying the same information into three places will fail under volume. Prefer a single request record that links to the source documents and the card transaction.
Separate the cardholder, approver, and reconciler
In a very small business, one person may hold several roles. That is a reality, not a reason to abandon separation. The business can use compensating review: the owner reviews the card statement and the exception report even if the assistant prepares the records. What matters is that the person who benefits from a purchase is not the only person who approves and reconciles it.
A practical role split is: requester describes the need; assistant prepares the request and evidence; budget owner approves; cardholder or assistant places the order; receiver confirms delivery; bookkeeper or owner reconciles the statement; owner reviews exceptions. One person may perform more than one step, but the procedure should name who did what. The log should show the actor, not just the status.
Do not give the assistant the ability to raise a card limit, add a new cardholder, change the bank account, or approve their own exception. If the platform allows those actions, restrict them through permissions. If it does not, use a second approval and a periodic access review. A control that depends on the assistant choosing not to use an available permission is weaker than one that removes the permission.
Define the evidence each purchase must carry
A complete purchase record should include the request identifier, business purpose, requester, vendor, items or services, quantity, amount, currency, taxes and fees, payment method, approval, order confirmation, receipt or invoice, delivery or completion evidence, accounting category, and any client or job reference. For a subscription, add the term, renewal date, cancellation terms, and owner.
The receipt proves that a transaction occurred; it does not prove that the purchase was authorized or that the item was received. Link the approval and the delivery evidence to the same record. For services, a completion note or deliverable may replace a shipping confirmation. For a partially delivered order, record the open balance rather than marking the whole purchase complete.
IRS recordkeeping guidance supports keeping records that substantiate income, deductions, and credits for the applicable period. The assistant does not need to make a tax determination, but should preserve the documents the bookkeeper or tax owner needs. Store them in the approved system, use consistent names, and avoid relying on a card statement alone when the business needs an itemized receipt.
Design exceptions for the purchases that do not fit
Common exceptions include a missing receipt, a split transaction near a limit, a new vendor, a changed remittance account, a purchase that exceeds the approved amount, a personal item mixed with a business order, a duplicate charge, a subscription that renewed without review, and an emergency purchase made before approval. Each needs a stop or review rule, not a general instruction to use judgment.
For a changed vendor bank account, the safe action is to pause and verify through an independent channel. The assistant should not update payment details from an email alone. For a missing receipt, request a duplicate from the vendor and record the request; do not create a substitute receipt. For a split transaction, route the pattern to the owner because it may indicate a limit-avoidance problem or a legitimate bundle.
An exception log should show the transaction, the missing or conflicting element, the person contacted, the due date, the decision owner, the resolution, and the effect on payment or reconciliation. Age the open items. An exception that stays open across two statement cycles is a signal that the process, not just the purchase, needs attention.
Monitor patterns, not only individual receipts
A receipt-by-receipt review can miss a pattern: the same vendor appearing just below the approval threshold, purchases clustering at month-end, a card used for categories outside its intended purpose, or repeated “emergency” buys that should be planned. The assistant can prepare a monthly summary by vendor, category, requester, and amount band without making an accusation.
Sample completed purchases back to the request, approval, receipt, and delivery evidence. Also sample the exception log for items that were closed without a clear disposition. A low exception count is not proof of good control; it may mean the assistant is not capturing the right events or the reviewer is approving without reading.
NIST’s small-business security guidance reinforces basic access, authentication, backup, and incident planning. Apply the same discipline to the card program: named users, strong authentication, prompt removal of departed staff, protected storage for receipts, and a known route for a suspected fraudulent charge. The purchase-card procedure and the security procedure should not be separate universes.
Implement in a sequence that can be tested
Start with a two-week baseline. Record every card purchase, its purpose, and the evidence currently available. Do not change behavior during the baseline; use it to see where records are missing and which approvals are informal. Then write the smallest procedure that covers the ordinary paths and the highest-risk exceptions.
Pilot the procedure with one cardholder and one assistant. Set a low limit for new vendors, require a second approval above a threshold, and review every exception for the first month. At the end of the pilot, test the record with someone who did not make the purchase. Can they identify the business purpose, approval, receipt, and accounting treatment without asking?
Expand only after the pilot produces a complete sample. Add categories, vendors, or cardholders one at a time. Review the limits quarterly and after any material change in the business. The goal is not a perfect control environment; it is a repeatable one that makes ordinary spending easy and unusual spending visible.
Limitations and appropriate use
The Green Book is written for federal internal control and is not a private-company accounting standard, legal opinion, or fraud-prevention guarantee. IRS recordkeeping guidance describes record obligations but does not resolve every substantiation question for every entity or transaction. NIST guidance is security-oriented and does not prescribe purchasing authority. Local law, contracts, card-network rules, and the company’s own governance may add requirements.
This review is desk research based on the named public sources, checked on October 22, 2026. It does not test a specific card program or estimate fraud risk. A business should involve its accountant, legal advisor, and security owner in designing limits, approval authority, and record retention. The workflow below is a way to organize evidence and decisions, not a certification of compliance.
Buyer conclusion
The strongest purchase-card design is boring: a short list of allowed paths, a named approver, a receipt requirement, a reconciliation step, and a visible exception route. An assistant can make that design work by preparing complete records and following up on missing evidence. The assistant should not be asked to supply judgment that the business has not written down.
When evaluating a staffing provider, ask how the assistant will handle a missing receipt, a changed vendor account, a limit exception, and a suspected personal charge. The answers reveal whether the provider treats delegated buying as an administrative workflow with controls or as a trust exercise. A traceable sample is more convincing than a promise of careful spending.
Sources
- The Green Book: Standards for Internal Control in the Federal Government - U.S. Government Accountability Office. Checked October 22, 2026.
- Recordkeeping - Internal Revenue Service. Checked October 22, 2026.
- Small Business Information Security: The Fundamentals (NISTIR 7621 Rev. 1) - National Institute of Standards and Technology. Checked October 22, 2026.
Next step
If this research raises a workflow you want to delegate, review AssistantStaffing's bookkeeping virtual assistant service and the related analysis of consumer deletion request intake. Bring your current procedure and a redacted sample to a free role consultation so the scope, access, and review boundaries can be defined before work begins.
