I find it impossible to get every single expense invoice/receipt from my clients. The way I approach it is that first to make sure the clients know it is their responsibility to maintain goods records and the onus is on them to produce them on request should HMRC come knocking. This is done when I engage them and it is stated in my Letter of Engagement. As for legal, my understanding is that for ANYTHING going through company accounts a formal record must be kept and produced on request to the HMRC. The responsibility for this lies with the company owners/Directors.
When doing the bookkeeping I manage it as follows:
For regular DD's and standing order payments, as long as I have seen one invoice and can ascertain what it is for and if there is VAT, I don't ask for them every month, unless the amounts change significantly.
For larger one-off payments that I can't identify, I send an email asking for clarification and a copy of the invoice, explaining that the VAT can't be claimed without one. If it is for a large amount and there is VAT they usually manage to come up with one.
When there are lots of smaller unidentified expenses, such as Ebay, Amazon, high street names etc, I list them in a spreadsheet and send them via email asking for clarification on what they are for and for copy invoices. If I don't get a reply to this before the VAT is due I chase it up. If there is still no response I will make a judgment based on my knowledge of the client. So either leave the transaction unreconciled until I get an answer, reconcile it based on previous transactions but leave it as Zero/Exepmt VAT, or I will allocate it to the DLA or Suspense.
As long as you are not claiming VAT or allowing large amounts of unidentified sales/expenses through the company accounts. If you made every effort in trying to get the information out of the client and have an audit trail of trying to do so, you should be fine.
Any query still not resolved will usually get sorted at year-end. If there is something you are really not happy about and it doesn't seem in line with regular day-to-day business dealings and you are not getting the right answer from the clients, then you have to protect yourself by giving them notice, and if necessary report them through MLR regs.
Hope this helps.