Anomaly Detection
Anomaly detection in accounting is the automated screening of every transaction for entries that differ from the normal pattern, such as duplicate payments, unusually large amounts, round numbers or unfamiliar vendors, so a person can review them before they become errors or losses.
Last updated
Formula
z-score = (Transaction amount − Vendor's mean amount) ÷ Standard deviation of the vendor's amounts
Example: A vendor's last 24 bills average $3,200 with a standard deviation of $600. A new bill for $6,500 scores (6,500 − 3,200) ÷ 600 = 5.5. With a threshold of 3, it is flagged as unusual.
Anomaly detection tests every transaction, not a sample, for duplicates, outlier amounts, round numbers, and new or dormant vendors, then ranks what it finds for a person to review. APQC benchmarking puts duplicate or erroneous payments at 0.8% to 2% of annual disbursements, which is the kind of leakage full-population screening is designed to catch.
Key Industry Data
- Duplicate or erroneous payments: 0.8% of annual disbursements at top performers, 2% at bottom performers: APQC Open Standards Benchmarking, via CFO.com (2020)
Definition
Anomaly detection compares each bill, payment or journal entry with what is normal for that vendor, account or company, and flags the ones that stand out. Some checks are rules, such as "same vendor, same amount, within 7 days" for a possible duplicate. Others are statistical, such as an amount that sits several standard deviations above a vendor's usual range. A flag is not a finding of fraud. It is a lead that a reviewer confirms or dismisses, and the decision is recorded so the same item is not reviewed twice.
Full-population review vs sampling
Traditional audit and bookkeeping review relies on sampling: a reviewer picks a few dozen transactions and tests them, and the rest are assumed to be fine. Sampling is practical by hand, but an error or a fraudulent payment that is not in the sample goes unseen.
Anomaly detection turns that around. Software checks every transaction in the period against the same set of tests, ranks what it finds by severity, and the reviewer spends time only on the exceptions. A bookkeeping firm can run the same checks across every client company each month, instead of sampling a handful of entries per client at year-end.
Common checks in accounts payable and the general ledger
Duplicate payments: the same vendor paid the same or a near-identical amount within a short window, often because an invoice arrived twice or a reminder copy was entered as a new bill.
Unusual amounts: a bill far outside a vendor's normal range, measured with a statistical score. Round-number amounts: exact figures such as $5,000.00, which are a common sign of estimates, manual entries or invented invoices.
New and dormant vendors: a first-time payee, or a vendor that has been inactive for months and suddenly receives a payment. Both are worth a second look because fictitious or hijacked vendor records are a common fraud route. Miscategorization: a transaction coded to an account that does not fit the vendor's usual pattern.
Some tools also apply Benford's law, which compares the distribution of leading digits with the expected frequencies. It works best on large populations and is a screening test, not proof of anything.
Why It Matters
Small errors repeat. A duplicate that slips through once will slip through again under the same conditions, and a fictitious vendor rarely sends just one invoice. APQC benchmarking puts duplicate or erroneous payments at 0.8% of annual disbursements for top performers and 2% for bottom performers. Screening the whole population finds these items while they can still be stopped or recovered, and it gives auditors evidence that every transaction was tested, not just a sample.
Examples
Catching a duplicate before payment
A cleaning contractor bills $1,480 on March 3 and again on March 9 with invoice numbers INV-2231 and INV2231. The duplicate check matches vendor, amount within tolerance and a 14-day window, and flags the second bill as high severity. The bookkeeper confirms it is a reminder copy and voids it, saving $1,480.
An outlier amount that was legitimate
A software vendor's monthly bill is usually $900 with a standard deviation of $50. An annual renewal of $9,800 scores a z-score of 178 and is flagged. The reviewer checks the contract, confirms the renewal and marks the finding a false positive with a note, so the next annual bill is easier to clear.
A dormant vendor reappears
A supplier with no activity for 14 months receives a $12,000 payment to a newly changed bank account. The dormant-vendor flag prompts a call to the supplier using the phone number on file, which reveals the bank change request was a phishing email. The payment is stopped.
Common Mistakes
Treating every flag as fraud
Most anomalies have an ordinary explanation, such as an annual renewal or a price increase. Review the evidence, record the reason and close the finding. Escalate only what you cannot explain.
Setting thresholds once and never tuning them
A threshold that is too tight floods reviewers with false positives, and one that is too loose misses real issues. Review the confirmed and dismissed rate each quarter and adjust tolerances, date windows and minimum amounts.
Scoring a vendor with too little history
A z-score on three bills is unreliable. Use a minimum number of transactions before scoring unusual amounts, and rely on new-vendor checks for vendors without history.
Running checks only at year-end
By year-end, a duplicate paid in February is hard to recover. Scan monthly, or after each sync, so findings arrive while the money can still be reclaimed.
Not documenting dismissals
An unrecorded "looked fine" leaves no audit trail. Keep the reviewer, the date, the reason and the supporting evidence with every finding.
In Practice
- Connect the ledger or AP system so every bill, payment and journal entry for the period is in scope, not a sample.
- Turn on the checks that fit the business: duplicates, unusual amounts, round numbers, new vendors, dormant vendors and miscategorization.
- Set starting thresholds, such as a duplicate window of 7 to 14 days, a z-score of 3 and a round-number minimum of $1,000, then tune them after the first month.
- Review findings in severity order. Check the source document, the vendor record and any bank detail changes.
- Mark each finding confirmed, investigating or false positive, and record why.
- Fix the root cause of confirmed findings, such as a missing duplicate invoice check at entry or a weak vendor-change process.
- Keep the findings and evidence with the period's workpapers for the auditor or the client file.
How Aequo AP Helps
Aequo Audit, in early access with a waitlist, connects to QuickBooks Online and scans the bills and transactions it syncs from each company on a schedule and after each sync. It checks for duplicate payments with a tolerance and date window you set, unusual amounts, round-number amounts, new vendors, dormant vendors and likely miscategorized transactions, and lists each as a finding with a severity and a review status. It does not apply Benford's law. Inside Aequo AP, every incoming invoice is also compared with past invoices from the same vendor to flag likely duplicates before approval.
Start Free TrialFrequently Asked Questions
What is anomaly detection in accounting?
It is the automated screening of every transaction for entries that differ from the normal pattern, such as duplicates, outlier amounts, round numbers and new or dormant vendors, so a person can review them.
How can a bookkeeping firm review every client transaction instead of sampling?
Connect each client's accounting file to an anomaly detection tool that tests 100% of transactions against the same checks, then review only the flagged items, ranked by severity. The reviewer's time goes to exceptions, and each client gets the same coverage every month.
What are examples of anomalies in accounts payable?
Duplicate invoices, a bill far above a vendor's usual amount, exact round-number invoices, payments to brand-new vendors, payments to vendors that were dormant, sudden changes to vendor bank details and transactions coded to an unusual account.
Is anomaly detection the same as fraud detection?
No. Anomaly detection finds unusual items. Some are fraud, many are errors and most have a legitimate explanation. A person decides which is which.
What is a z-score in anomaly detection?
It measures how many standard deviations a value is from the average. A bill with a z-score of 3 or more is far outside a vendor's usual range and worth a look.
Why are round-number invoices a red flag?
Real invoices usually include tax, freight or unit pricing that produce uneven totals. Exact round amounts can point to estimates, manual entries or invented invoices. Many are legitimate, such as retainers, so they need a quick check, not an assumption.
Does anomaly detection replace an audit?
No. It gives auditors and reviewers a complete, prioritized list of unusual items and evidence that everything was tested. Auditors still apply judgment, test controls and form an opinion.
Category
complianceDeep Dive Guides
Aequo Audit
QuickBooks Online anomaly detection for accountants
Fraud Assessment
Evaluate your organization's vulnerability to AP payment fraud and get actionable recommendations to strengthen your defenses.
Risk Calculator
Estimate your exposure to duplicate payments and the potential recovery value hiding in your AP data.
Glossary: duplicate payment
Canonical definition and related AP context.
Ready to automate your AP?
See how Aequo AP can transform your accounts payable process.