Anomaly screening for expense and AP data.
You sample forty transactions at random. There are twenty thousand.
Ledger reads every line instead, and hands back the three quarters of one percent a human should actually open, in order. It is a ranking function for audit hours, not an accusation about anybody.
One quarter of invoices and expenses, 19,800 lines across 16 vendors and cost centres, with splitting injected into two of them. Every test runs in your browser on the actual amounts.
The problem
The controls you have are threshold rules, and everyone knows the threshold.
Finance approves thousands of transactions a month and sample-audits a handful of them essentially at random. Anything worth catching is invisible at that rate: a purchase split into three to stay under an approval limit, an invoice paid twice, a vendor whose amounts stopped looking like anyone else’s. The one control that does exist is a rule that flags spend above a limit, which is exactly the rule that a split purchase is built to walk under.
The insight
Invented numbers and split numbers have the wrong digits.
Amounts that arise from real activity spread across orders of magnitude, and their leading digits follow Benford’s law: about 30% start with 1, under 5% start with 9. Amounts someone chose do not. Splitting leaves a second and sharper fingerprint that has nothing to do with digits: a pile of values immediately below the approval limit and a hole immediately above it, which no smooth spending pattern produces. Here is the part every vendor in this space should say and none of them do. A Benford deviation is evidence of an anomaly and never evidence of fraud. Legitimate data violates Benford constantly: fixed price points, capped ranges, a vendor that bills one number all year. The demo includes a vendor exactly like that, flags it, and shows it clearing on inspection in about thirty seconds. Ledger does not decide that anything is wrong. It decides which one line in a hundred a person reads, and that is a strictly better use of the same audit hours.
First-digit chi-square and Nigrini MAD conformity per vendor and per cost centre. Threshold clustering at each approval limit, comparing counts in equal windows either side of the boundary against the even split a locally smooth density implies. Bonferroni across the two tests within a unit, then Benjamini-Hochberg across every unit screened, because testing sixteen units on two signals each is thirty-two tests and an uncorrected 5% would hand back noise. Ranking by dollars sitting under the limit rather than by p-value, because a digit flag with no money attached belongs at the bottom of the queue.
How it works
Four steps, no data science team
Line-level amounts, a vendor or cost centre, a date. The export your ERP already produces nightly. No agent, no write access, nothing that can touch a payment.
Digit distribution per vendor and per cost centre against Benford, plus a clustering test at each approval limit in your policy. Both run on all of it, every night.
Screening hundreds of vendors means hundreds of simultaneous tests. Benjamini-Hochberg at 5% FDR is what keeps a nightly run from producing five plausible-looking flags that mean nothing.
Each item carries its q-value, the digit histogram against expectation, the count either side of the limit, the dollars involved, and the specific transaction ids. Ordered by money at stake. A reviewer works down until the hours run out.
Who it is for
The controller who has forty audit hours and twenty thousand transactions
Controllers and internal audit at companies past the point where anyone can eyeball the ledger, and the AI-accounting firms taking over that work for them. The tell is a team that already runs a threshold rule and already knows it does nothing.
Pricing
- –Benford and threshold screening
- –Ranked review queue
- –CSV in, CSV out
- –Nightly runs on the AP feed
- –Every approval limit in your policy
- –Reviewer dispositions and audit trail
- –Per-unit history, so a vendor drifting shows up
- –White-label queues
- –Workpaper export
- –SSO and per-client isolation
- –Method review with a statistician
Competition
What exists, and what it does not do
| Who | What they do | The gap |
|---|---|---|
| AppZen / Oversight | AI expense and AP audit at enterprise scale, with real detection behind it. | Priced and sold to companies with a procurement function. The mid-market controller doing this in Excel is not their buyer, and the digit and threshold tests are a black box you cannot inspect. |
| IDEA and ACL / Diligent | The audit analytics tools that already ship a Benford routine. Genuinely capable. | Run once a year by a specialist against a static extract, with no correction across units, so the output is a long list rather than a short one. Nothing runs nightly. |
| The threshold rule in your ERP | Flags anything above the approval limit. Free, already on. | Catches the transactions nobody was hiding. Structurally blind to the ones written to sit underneath it. |
| Random sampling | The default, and defensible under audit standards. | Finds concentrated patterns only by luck. Ledger is a better way to choose the sample, not a replacement for reviewing it. |
The failure that kills this is a customer who reads a flag as an accusation. If a controller pulls a vendor’s contract or confronts an employee because a digit test fired, the product has caused real harm and earned the lawsuit, and no amount of caveat text in the UI undoes it. So the caveat cannot live in the UI copy alone. It has to be the ranking itself: the queue orders by dollars under a limit rather than by statistical strength, every item ships with the innocent explanation attached, and the demo deliberately includes a clean vendor that the digit test flags. The commercial risk is separate and also real. This is a screening filter, not a determination, which means it is worth what an hour of audit time is worth and not what a fraud loss is worth, and that ceiling is lower than the category’s pricing suggests.
Market
Sold against audit hours, which every company past a few hundred employees already pays for
Mid-market controllers already spend $20k to $200k a year on external audit support and internal control tooling. Ledger is a small line beside that with a number attached to it: the hours saved choosing what to review. Two thousand entities at the Controls tier is $48M ARR, and the accounting firms buy it per client, which multiplies the same install.