Stop 5 of 9 · Weekly
The anomaly sweep
Five signals swept across twenty files every week, the questions list by client, and the escalation path for the one that stops looking like an error.
What it is
The checklist in stop 4 proves a file agrees with itself. This stop looks for the things that agree with themselves perfectly and are still wrong. It runs weekly across all twenty files, it costs Farida about twenty minutes, and it is the only part of the practice that has ever found a fraud.
Nothing here posts, reclasses or changes a bank rule. A signal is a question, and the question goes to a person.
Five signals
| Signal | What it usually turns out to be |
|---|---|
| The same amount to the same payee twice | A double-paid invoice or a re-imported feed |
| Round numbers where round numbers do not belong | A manual entry, an estimate posted as fact, a plug |
| A new vendor whose first payments are large | A real new supplier, occasionally not |
| Cost or revenue shifted across a period boundary | Timing, sometimes deliberate timing |
| Personal-looking spend on the business card | Habit, usually, and worth asking about anyway |
Thresholds are per client. A trades client paying 5,000 dollars in round numbers is a Tuesday. A professional services client doing it is a question.
Across every connected client file, read only, sweep the last fourteen days for: the same amount to the same payee more than once, payments that are exact multiples of 100 above [threshold] dollars, first payments to vendors created in the last sixty days, transactions dated within three days of a period boundary that are larger than that client monthly average for the account, and card spend at merchants that do not appear in that client trade profile. Return one table for the whole practice: client code, signal, transactions with dates and amounts, why it tripped, and dollars. Sort by dollars. Post nothing and contact nobody. List clients where you could not run a signal and say why.
Take this week's signals for [client code] and turn them into a numbered questions list for the owner. One line per question with the date, the amount and the payee so it is recognisable without opening anything. Ask what happened, do not suggest what happened. Leave out anything I have already asked about in the last sixty days, and say at the end which questions are repeats I should chase instead.
Write a memo to me about the CL-06 vendor signals. Facts only: when the vendor was created and by whom if the file records it, every payment with date, amount and approver, what is unusual relative to that client other vendors, and what evidence exists in the file. State no conclusion, name no motive, and use no word that implies intent. End with the three things I would need to look at outside the file to resolve it.
When a signal stops being an error
The route changes the moment a pattern involves a person rather than a process. It does not go into the portal message batch, it does not go to the client contact who is closest to it, and it does not go out as a conclusion. It goes to the practice owner, alongside the engagement letter, which is the document that says what the practice does next. Write facts. Let the facts be dull.