What anomalies look like

Finance anomaly detection is three different disciplines wearing one name, and real coverage means running all three — because each catches what the others structurally miss:

• Statistical anomalies — 'this number is far from its normal.' A store's weekly card refunds at 3× its trailing average; a lane's cost-per-mile two standard deviations above baseline; T&E for one department doubling without a headcount change. The machinery is baselines + deviation thresholds (z-scores against a trailing window — the distribution-drift technique tools like our Vigil run against warehouse tables; here you're pointing it at ledger balances and spend lines). Catches: the unknown unknowns, drift, and errors nobody wrote a rule for. Misses: bad things that happen to be normal-sized.
• Rule violations — 'this breaks a policy we wrote down.' Payment without a PO above the threshold; expense category over limit; invoice approved by its own creator; vendor added and paid within the same week. Deterministic checks, zero statistics, and AI's role is coverage — running every rule against every transaction where humans sampled. Catches: exactly what you encoded. Misses: exactly what you didn't — which is why the third lens exists.
• Pattern signatures — 'no single record is wrong, but the shape is.' Three invoices just under the $5K approval limit in one week (splitting); a vendor whose invoice numbers are perfectly sequential — meaning you're their only customer (ghost-vendor tell); round-number amounts recurring monthly; digit distributions that violate Benford's expectations in a dataset that should follow them. Signatures only emerge across records, which is why sampling-based review never saw them and 100%-coverage analysis does.

Baselines: the same discipline as forecasting, pointed backward

Statistical detection inherits Module 3's machinery wholesale: a baseline is a trailing window (long enough to be stable, recent enough to be relevant), seasonality must be respected (month-end AP spikes are normal — an alert that fires every month-end trains everyone to ignore alerts), and known events get annotated so they don't pollute the window. The craft decisions are the window (13 weeks is a decent default for weekly finance series), the threshold (start at 3σ, not 2 — you can always tighten; you can't un-teach a team that alerts are noise), and the exclusion rule (an anomalous week must not join its own baseline, or every incident normalizes itself).