Our organization recently completed a migration from Expensify to Ramp, scaling to approximately 150 users. As part of my standard vendor risk assessment, I was involved pre- and post-migration to evaluate the security and operational integrity of the transition. The financial team's primary metrics were cost and time savings; my audit lens focused on control preservation, data handling, and compliance adherence. The outcome was a mixed landscape of significant procedural improvements juxtaposed with several non-trivial breakages that required immediate remediation.
**What Broke (The Control Gaps & Compliance Headaches)**
* **Custom Field and Policy Logic Migration:** Our Expensify instance utilized complex custom fields for project accounting and locality-based tax tracking. The migration path for these fields was not one-to-one. Ramp's policy engine, while robust, operates on a different paradigm. This resulted in:
* A temporary loss of granular expense categorization, impacting our cost-center attribution for two pay cycles.
* Manual, offline validation required for approximately 300 historical expense reports that did not map cleanly, creating a data integrity concern for our upcoming SOC 2 audit. We had to maintain a separate reconciliation log, which is far from ideal.
* **API Integration and Webhook Security:** Our automated GL sync relied on Expensify's webhooks. Ramp's API, while well-documented, required a different authentication model (JWT vs. OAuth 2.0 client credentials in Expensify). The breakage wasn't functional, but architectural:
```bash
# Expensify-style webhook payload (simplified)
{"reportId": "123", "status": "APPROVED", "signature": "expensify_hmac_sha256..."}
# Ramp-style event payload (simplified)
{"event": "transaction.posted", "data": {...}, "webhook_id": "abc"}
```
The security verification shift meant our downstream middleware had to be rewritten to validate Ramp's digital signatures instead of Expensify's HMAC. This introduced a project delay and a period where automated feeds ran on a trust-but-verify basis, a deviation from our zero-trust principles for system-to-system communication.
* **Audit Trail Comprehensiveness:** For disputed transactions, Expensify provided a verbose, easily exportable audit log of all user and approver actions. Ramp's audit log is accessible via API but is less granular for certain administrative overrides. This has created a minor compliance gap for our internal `PCI-DSS` controls related to dispute resolution evidence.
**What Saved Us (The Security & Efficiency Wins)**
* **Unified Card Issuance and Real-Time Policy Enforcement:** The shift from a reimbursable expense model (Expensify) to a corporate card-first model (Ramp) fundamentally reduced our attack surface. Pre-transaction controls (merchant category blocks, spending limits set per card/per user) prevented policy violations before they occurred, rather than detecting them after the fact. This is a direct alignment with a preventative control framework.
* **Automated Receipt Capture and Matching:** The OCR and automated matching of transactions to receipts drastically reduced the volume of manual, error-prone data entry. From an infosec perspective, this minimizes the risk of receipt fraud and improves the reliability of our financial data. The audit trail of receipt submission is automatic and tamper-evident.
* **Simplified Vendor Management:** Ramp's vendor management module, where one-time virtual cards can be issued, has reduced our vendor-related fraud risk profile. The ability to set spend limits and expiration dates on a per-vendor basis is a superior control compared to our previous process of managing a shared pool of card details in a separate, less-secure system.
* **Cost Consolidation and Visibility:** Financially, the move consolidated several tools into one. From a security auditing standpoint, this reduces vendor risk assessment overhead. Having spend, cards, approvals, and bill payments in a single platform means one set of APIs to review, one set of user provisioning workflows to audit, and one primary data repository to protect, as opposed to the previously fragmented toolset.
**Overall Security Posture Assessment:**
The migration presented a short-term increase in compliance risk due to data mapping and integration challenges. However, the long-term security posture is improved due to Ramp's embedded preventative controls and reduced operational complexity. Organizations considering a similar migration must conduct a thorough data field mapping exercise *prior* to cutover and allocate significant development resources to rebuild any downstream financial system integrations, with a special focus on the authentication and payload verification changes. The trade-off is acceptable only if the proactive spending controls align with your organization's risk tolerance.
trust but verify