Lab: The anomaly sweep

The payoff lab. Below is a condensed AP extract — 6 vendors, 2 quarters — with three planted problems and two innocent decoys. Run all three lenses (statistical, rules, patterns) with your AI assistant on analysis duty and your spreadsheet on verification duty. Alder's approval threshold: $5,000 (invoices at/above need director sign-off). Score flags, don't verdict them; write a disposition for everything you raise.

VENDOR             INV#        DATE      AMOUNT   DESC
Riverbend Carriers RB-9102     Apr 08    12,410   line haul, 6 loads
Riverbend Carriers RB-9188     May 06    11,890   line haul, 6 loads
Riverbend Carriers RB-9241     Jun 04    13,205   line haul, 7 loads
Riverbend Carriers RB-9299     Jul 09    12,660   line haul, 6 loads
Riverbend Carriers RB-9361     Aug 05    24,880   line haul, 12 loads
Riverbend Carriers RB-9362     Aug 05    12,340   line haul, 6 loads
Riverbend Carriers RB-9420     Sep 03    12,975   line haul, 6 loads
Keystone Repair    KR-2201     Apr 15     3,850   trailer brake svc
Keystone Repair    KR-2276     Jun 20     4,900   yard tractor repair
Keystone Repair    KR-2277     Jun 22     4,850   yard tractor parts
Keystone Repair    KR-2279     Jun 25     4,975   labor - tractor rebuild
Keystone Repair    KR-2340     Aug 18     4,120   trailer door repair
Bright Path Svcs   BP-101      Apr 30     3,000   consulting services
Bright Path Svcs   BP-102      May 31     3,000   consulting services
Bright Path Svcs   BP-103      Jun 30     3,000   consulting services
Bright Path Svcs   BP-104      Jul 31     3,000   consulting services
Bright Path Svcs   BP-105      Aug 31     3,000   consulting services
Bright Path Svcs   BP-106      Sep 30     3,000   consulting services
Cascade Fuel Co    CF-88410    Apr-Sep    ~8,100/wk (26 invoices, range
                                          7,240-9,890, tracks DOE index)
Portside Staffing  PS-1104     May 12     6,240   dock labor, wk 19
Portside Staffing  PS-1104     May 26     6,240   dock labor, wk 19
Portside Staffing  PS-1163     Jul 07     6,890   dock labor, wk 27
NW Office Supply   NW-3300     Jun 01       947   quarterly supplies
NW Office Supply   NW-3719     Sep 01     1,012   quarterly supplies
VENDOR MASTER notes: Bright Path Svcs created Mar 28 (requestor: ops
admin), PO box address, no tax ID on file, payee acct ****7719.
Payroll direct-deposit file: one employee acct ends ****7719.
All other vendors: 3+ yrs history, complete records.

1. 1Statistical pass first (baselines per vendor): Riverbend's Aug 5 pair — a $24,880 invoice at ~2× baseline plus a normal $12,340 the same day. Flag it, then check the description before scoring: '12 loads' at consistent per-load cost. Decoy #1: peak-season double volume, arithmetically coherent — disposition: legitimate-explained (verify loads against dispatch records; say so in the log). Cascade Fuel's range rides the DOE index — normal. NW Office's +7%: noise; flagging it is how alert fatigue starts.
2. 2Rules pass: Portside's PS-1104 appears twice — same invoice number, same amount, two weeks apart, both for 'wk 19'. Textbook duplicate payment (Module 2's check, live): score high, disposition path = confirm payment history, recover if paid twice, fix the intake that let a same-number invoice through. Note PS-1163 (decoy #2 adjacent): different week, different amount — normal, don't contaminate the real flag with it.
3. 3Pattern pass — splitting: Keystone's June cluster: $4,900 / $4,850 / $4,975 within six days, each just under the $5,000 threshold, descriptions that read like one job ('repair' / 'parts' / 'labor - rebuild') = one ~$14.7K job split to dodge director sign-off. The cluster is the evidence; no single invoice is anomalous (their April and August invoices are innocently sub-threshold — that's what makes band-scans necessary). Disposition: policy-violation minimum; the conversation determines whether it's sloppy invoicing or deliberate — that determination is above your pay grade by design.
4. 4Pattern pass — the compound flag: Bright Path: perfectly sequential invoice numbers (BP-101→106: Alder is their only customer), round $3,000 monthly, vague description, young vendor, PO box, no tax ID — and the payee account matches an employee's payroll account. That's five signals compounding into the ghost-vendor signature. Score: maximum. Disposition: escalate — and per the fraud-response rule: document, preserve, hand off to controller/internal audit, do NOT contact the vendor, the requestor, or the matching employee. Write the handoff memo as the lab's capstone artifact: signals, evidence locations, no accusations, no adjectives.
5. 5Write the program summary Priya would send up: 3 planted issues → what each lens caught (and which lens alone would have missed which — the splitting is invisible to statistics, the ghost vendor to rules), 2 decoys correctly dispositioned as legitimate/noise, the three program numbers (coverage 100% vs the old 5% sample; yield: 1 recovery + 1 policy violation + 1 escalation; time-to-disposition: same afternoon), and the two source-system fixes this sweep earned (duplicate-number intake check; vendor-creation dual approval + employee-match screen).