Ghil · Labs

Back-office decision model · Internal Audit 04

The receipt was sampled.
The pattern was not.

Rutherford Advisory Group processes 18,600 card and expense transactions every month. Its four-person internal audit team checks a quarterly sample, while split purchases, duplicate receipts, and prohibited merchants hide in the 95% left untouched.

Open the audit workbenchRead the case

// fictional company · illustrative data · no payment system connection · runs in your browser

01 · Observe

Screen every transaction against policy, timing, merchant, and behavioral context.

02 · Connect

Link repeated amounts, receipt hashes, approvers, cards, and purchase windows.

03 · Intercept

Hold only high-confidence exceptions and route the evidence to an authorized reviewer.

Use-case story

The sample was clean.
The month was not.

Rutherford is a fictional $285M U.S. professional-services firm with remote sales and client-delivery teams. Its audit staff can inspect about 5% of transactions after the quarter closes. That process can find a bad receipt, but not reliably connect three sub-$1,000 charges made eleven minutes apart.

01 / FRIDAY 18:42

One purchase becomes three.

A cardholder splits a $2,940 electronics purchase into three $980 charges, each below the $1,000 manager-approval threshold. Each line looks ordinary by itself.

02 / MONTH-END

The same receipt appears twice.

A hotel receipt is uploaded to a card reconciliation and again to an expense report. Different filenames conceal an identical image hash and amount.

03 / QUARTER +45

The sample finds the receipt, not the system.

Reviewers select transactions after payment. Recovery is uncertain, evidence has gone stale, and the connected behavior remains outside the sample.

04 / WITH THE AGENT

Every exception arrives with its pattern.

The agent screens 100%, groups linked events, holds high-confidence exceptions before settlement, and sends ambiguous cases to a person with the evidence already assembled.

Real-time anomaly interceptor

Change the threshold. Watch the blind spot move.

Compare quarterly sampling with continuous screening, adjust sensitivity and transaction volume, inject new events, and inspect why a simulated charge was cleared, reviewed, or held.

Audit coverage

100%continuous transaction screening

Detection latency

<1 minfrom 45-day average sample lag

Preventable / recoverable

$214Kmodeled annual amount

Analyst review queue

233 / motrue signals plus false positives

Audit capacity returned

1,231 hrper year versus 5% sample workflow

Incoming transaction stream

LIVE SIMULATION

Stream 0718 · 0 simulated decisions · 10 events in view

What the number means

Coverage is not
the same as certainty.

The simulator models screening reach, anomaly prevalence, sensitivity, false-positive rate, review time, and the difference between post-payment recovery and a pre-authorization hold. A 100% scan can still make bad decisions; every material action needs evidence and accountable review.

Boundary: The agent may flag, group, score, and recommend a temporary hold. Final fraud determination, employee action, reimbursement denial, card suspension, payment recovery, and policy changes remain authorized human decisions.

Model inputWhy it mattersBase value
Monthly transactionsCorporate-card and employee-expense events entering the model.18,600
Audit coverageTraditional sample versus transaction-level automated screening.100%
Modeled anomaly prevalenceIllustrative rate used to estimate true signals, not an accusation rate.0.18%
Detection / false-positive rateChanges with selected sensitivity; both affect the analyst queue.84% / 1.10%
Average exposed amountIllustrative unauthorized or policy-exception amount per true anomaly.$720
Software and implementationCard/ERP integration, privacy, labor, security, change management, and product price.Not modeled

The operating change

Audit reviews the pattern.
The agent watches the stream.

A credible pilot starts in shadow mode with historical transactions and confirmed outcomes. Measure alert precision, recall, false holds, reviewer time, employee impact, duplicate recovery, and appeal outcomes before enabling any live card hold or reimbursement decision.