Build a Vendor-Spend Anomaly Screen from an AP Export

The task

Every close, someone in AP or FP&A eyeballs the vendor ledger for weird spend — duplicate invoices, round-dollar payments, a new vendor suddenly getting five-figure runs, month-over-month swings that don't match the accrual story. This workflow turns that eyeball pass into a repeatable screen you run against a pasted AP export before you lock the period.

Before AI

The manual version is a pivot table and a highlighter. You group by vendor, sort by amount, scan for repeats, then flip to a prior-period pivot and compare totals row by row. On a mid-sized ledger (500-2,000 lines) it's a 2-3 hour job, and the pattern you're most likely to miss is the boring one — the same invoice paid twice on different PO numbers, or a vendor whose spend crept up 40% while nobody was watching.

Auditors have leaned on techniques like Benford's Law and duplicate-payment testing for decades — the workflow below just makes an LLM do the first pass so you spend your time on judgment, not sorting.

The workflow

Step 1 — Paste the export and get a triage table.

Grab the current-period AP detail from your ERP (invoice date, vendor, invoice number, amount, GL account, PO). Paste it into the prompt below. You'll get back the ledger normalized into a table plus a first read on what looks unusual.

You are a senior AP analyst helping close the month. Below is a raw accounts-payable export as CSV. 

Do three things:
1. Parse it into a clean markdown table with columns: invoice_date, vendor, invoice_number, amount, gl_account, po_number. Fix obvious formatting issues (stray whitespace, inconsistent vendor casing, currency symbols) but do NOT invent missing data — leave blanks blank.
2. Compute totals by vendor and by GL account. Show the top 10 vendors by spend.
3. Give me a plain-English "first read" — 3-5 bullets on what jumps out before we run formal checks. No hedging, no disclaimers, just what you'd tell a controller in the hallway.

Here is the export:

invoice_date,vendor,invoice_number,amount,gl_account,po_number
2026-06-02,Northwind Print & Sign,NW-4412,4820.00,6120-Marketing,PO-88231
2026-06-03,Cascade Freight LLC,CF-100281,12450.75,5300-Freight,PO-88240
2026-06-05,Brightpoint Consulting,BPC-2026-051,25000.00,6410-Prof Svcs,
2026-06-05,Brightpoint Consulting,BPC-2026-051,25000.00,6410-Prof Svcs,PO-88255
2026-06-07,Aldergrove Office Supply,AOS-77120,318.44,6210-Office,PO-88261
2026-06-08,Cascade Freight LLC,CF-100299,11980.00,5300-Freight,PO-88270
2026-06-10,Meridian IT Services,MIT-5540,9000.00,6420-IT Svcs,PO-88275
2026-06-11,Meridian IT Services,MIT-5541,9000.00,6420-IT Svcs,PO-88276
2026-06-11,Meridian IT Services,MIT-5542,9000.00,6420-IT Svcs,PO-88277
2026-06-12,Pineridge Catering,PR-2026-06-12,1500.00,6510-T&E,
2026-06-14,Northwind Print & Sign,NW-4419,5100.00,6120-Marketing,PO-88289
2026-06-15,Brightpoint Consulting,BPC-2026-052,25000.00,6410-Prof Svcs,PO-88291
2026-06-17,Halcyon Logistics,HL-77-A,48200.00,5300-Freight,PO-88301
2026-06-18,Cascade Freight LLC,CF-100322,12450.75,5300-Freight,PO-88240
2026-06-20,Aldergrove Office Supply,AOS-77188,412.10,6210-Office,PO-88318
2026-06-21,Summit Realty Partners,SRP-JUN26,18500.00,7100-Rent,PO-STANDING
2026-06-22,Verdant Cleaning Co,VCC-6-2026,2200.00,6220-Facilities,
2026-06-24,Brightpoint Consulting,BPC-2026-053,25000.00,6410-Prof Svcs,PO-88332
2026-06-25,Northwind Print & Sign,NW-4425,4990.00,6120-Marketing,PO-88340
2026-06-26,Halcyon Logistics,HL-77-B,48200.00,5300-Freight,PO-88355
2026-06-27,Pineridge Catering,PR-2026-06-27,3000.00,6510-T&E,
2026-06-28,Meridian IT Services,MIT-5543,9000.00,6420-IT Svcs,PO-88361
2026-06-29,Cascade Freight LLC,CF-100340,13100.00,5300-Freight,PO-88370
2026-06-30,Brightpoint Consulting,BPC-2026-054,25000.00,6410-Prof Svcs,PO-88378
2026-06-30,Ironwood Staffing,IW-JUN-FINAL,31200.00,6415-Contract Labor,

Step 2 — Run the anomaly screen.

Now push the cleaned data through a structured set of checks. This is where the LLM earns its keep: it can hold five rules in its head at once without losing track.

Using the parsed ledger from the previous step, run the following anomaly screen. For each rule, list the specific invoices that hit and a one-line reason. If a rule finds nothing, say "none" — do not pad.

Rule 1 — Exact duplicates: same vendor + same invoice_number OR same vendor + same amount within 21 days.
Rule 2 — Round-dollar clusters: amounts ending in .00 that are also ≥ $5,000, grouped by vendor. Flag any vendor with 3+ such invoices in the period.
Rule 3 — Missing PO on amounts ≥ $2,000.
Rule 4 — Split-invoice pattern: same vendor, same GL, multiple invoices in the period that are individually under a plausible approval threshold ($10,000) but sum to well above it.
Rule 5 — New or unusual vendor: vendors whose name pattern, invoice-number format, or GL account looks inconsistent with the rest of the ledger. Explain your reasoning; do not just guess.

Output as a markdown table: rule | invoice_number(s) | vendor | amount | reason. Then a short "watchlist" paragraph — which 2-3 items would you personally chase before signing off, and why.

Step 3 — Draft the controller memo.

Turn the findings into something you can actually send. Keep it short — controllers read the first three lines and the last one.

Write a close-cycle memo to the Controller summarizing the anomaly screen. Constraints:
- Max 250 words.
- Lead with the two items that most need a decision this week (approve/reject/investigate).
- Include a "cleared" line for rules that found nothing, so the reader knows the screen ran fully.
- End with one sentence on what would tighten the control next period (e.g., PO threshold, vendor master hygiene).
- Neutral tone. No adjectives like "concerning" or "significant" unless the dollars justify them.

Format: plain prose, no headers, no bullets in the body — this goes in an email.

Gotchas

• The LLM will hallucinate patterns if the sample is tiny. Under about 50 rows, its "unusual vendor" call is basically a coin flip. Trust duplicate and round-dollar rules; discount the vibes-based ones.
• Recurring legitimate spend gets flagged. Monthly rent, standing IT retainers, and weekly freight will trip the "round dollar" and "split invoice" rules every time. Maintain a short allow-list in the prompt or expect to override in the memo.
• Dates matter. If your export mixes invoice date and post date the same-amount-within-21-days check gets noisy. Standardize on invoice date before pasting.
• Do not paste real vendor names or PII into a general-purpose model unless your tenant has the data-handling terms to support it. Redact to "Vendor A / Vendor B" or run this in an enterprise deployment. AP data is exactly the kind of thing your CFO does not want in a training set.
• This is a screen, not an audit. It surfaces candidates. A human still has to open the invoice image and confirm.

Time saved

Roughly 2-3 hours per close cycle for a mid-sized ledger — mostly reclaimed from pivot-table wrangling and cross-referencing prior-period totals. The bigger win is that the checks run the same way every month, so a duplicate that would've slipped past a tired analyst at 6pm on close day is more likely to get caught. Treat the estimate as directional; savings scale with ledger size and how disciplined your current manual process already is.

What we got when we ran it

We executed every prompt above, in order, against the sample input (model: claude-sonnet-4-6). Outputs below are real and unedited apart from length truncation.

Step 1 output

1. Clean Invoice Table | invoice_date | vendor | invoice_number | amount | gl_account | po_number | |---|---|---|---|---|---| | 2026-06-02 | Northwind Print & Sign | NW-4412 | 4,820.00 | 6120-Marketing | PO-88231 | | 2026-06-03 | Cascade Freight LLC | CF-100281 | 12,450.75 | 5300-Freight | PO-88240 | | 2026-06-05 | Brightpoint Consulting | BPC-2026-051 | 25,000.00 | 6410-Prof Svcs | | | 2026-06-05 | Brightpoint Consulting | BPC-2026-051 | 25,000.00 | 6410-Prof Svcs | PO-88255 | | 2026-06-07 | Aldergrove Office Supply | AOS-77120 | 318.44 | 6210-Office | PO-88261 | | 2026-06-08 | Cascade Freight LLC | CF-100299 | 11,980.00 | 5300-Freight | PO-88270 | | 2026-06-10 | Meridian IT Services | MIT-5540 | 9,000.00 | 6420-IT Svcs | PO-88275 | | 2026-06-11 | Meridian IT Services | MIT-5541 | 9,000.00 | 6420-IT Svcs | PO-88276 | | 2026-06-11 | Meridian IT Services | MIT-5542 | 9,000.00 | 6420-IT Svcs | PO-88277 | | 2026-06-12 | Pineridge Catering | PR-2026-06-12 | 1,500.00 | 6510-T&E | | | 2026-06-14 | Northwind Print & Sign | NW-4419 | 5,100.00 | 6120-Marketing | PO-88289 | | 2026-06-15 | Brightpoint Consulting | BPC-2026-052 | 25,000.00 | 6410-Prof Svcs | PO-88291 | | 2026-06-17 | Halcyon Logistics | HL-77-A | 48,200.00 | 5300-Freight | PO-88301 | | 2026-06-18 | Cascade Freight LLC | CF-100322 | 12,450.75 | 5300-Freight | PO-88240 | | 2026-06-20 | Aldergrove Office Supply | AOS-77188 | 412.10 | 6210-Office | PO-88318 | | 2026-06-21 | Summit Realty

…output truncated at 250 words.

Step 2 output

Anomaly Screen Results | Rule | Invoice Number(s) | Vendor | Amount(s) | Reason | |---|---|---|---|---| | 1 – Exact Duplicate | BPC-2026-051 / BPC-2026-051 | Brightpoint Consulting | $25,000.00 / $25,000.00 | Identical vendor + invoice number on the same date (2026-06-05); one line has no PO, one has PO-88255 — textbook duplicate entry. | | 1 – Same Vendor / Same Amount ≤21 Days | CF-100281 / CF-100322 | Cascade Freight LLC | $12,450.75 / $12,450.75 | Same vendor, identical amount, 15 days apart (June 3 → June 18); both reference the same PO-88240, suggesting either a double-pay against a blanket PO or a legitimate recurring release that needs balance verification. | | 1 – Same Vendor / Same Amount ≤21 Days | HL-77-A / HL-77-B | Halcyon Logistics | $48,200.00 / $48,200.00 | Same vendor, identical amount, 9 days apart (June 17 → June 26); sequential alpha suffix on invoice numbers is consistent with a deliberate series but the amounts are unusually large and the vendor is unvetted (see Rule 5). | | 2 – Round-Dollar Cluster | BPC-2026-051, BPC-2026-051, BPC-2026-052, BPC-2026-053, BPC-2026-054 | Brightpoint Consulting | $25,000.00 × 5 | Five invoices (4 unique + 1 duplicate) all exactly $25,000.00, all ≥$5,000 — well above the 3-invoice threshold; mechanical uniformity suggests retainer billing or possible invoice fabrication. | | 2 – Round-Dollar Cluster | MIT-5540, MIT-5541, MIT-5542, MIT-5543 | Meridian IT Services | $9,000.00 × 4 | Four invoices all exactly $9,000.00 ≥$5,000; triggers the

…output truncated at 250 words.

Step 3 output

To: [Controller] From: [AP Analyst] Date: 2026-06-30 Re: June AP Anomaly Screen — Items Requiring Decision --- Two items need a decision before the ledger closes. First, Ironwood Staffing invoice IW-JUN-FINAL ($31,200, GL 6415-Contract Labor) has no PO, no prior payment history in the period, and is the sole entry against that GL account. A signed contract or SOW and controller approval memo are required before this releases. Second, Brightpoint Consulting invoice BPC-2026-051 ($25,000) appears twice on June 5 — one line with PO-88255, one without — and must be confirmed as a duplicate and voided before month-end to avoid a double payment. Three additional items are flagged for investigation but are not immediate payment holds. Halcyon Logistics billed $96,400 across two identical invoices (HL-77-A, HL-77-B) from a vendor with no prior ledger history; PO dates should be verified as predating the invoice dates and banking details independently confirmed. Meridian IT Services submitted four sequential $9,000 invoices (MIT-5540 through MIT-5543) totaling $36,000, which individually fall below the $10,000 single-approver threshold; the applicable contract rate and approval tier should be confirmed. Verdant Cleaning Co (VCC-6-2026, $2,200) lacks a PO and has no prior history. The screen found no issues under Rules 1 through 5 beyond those listed above. All other invoices cleared duplicate, round-dollar, missing-PO, split-pattern, and vendor-anomaly checks. To tighten controls next period, lower the mandatory-PO threshold from its current implied level to $1,000 and run a vendor-master hygiene pass to flag any supplier added within 30 days of a

…output truncated at 250 words.

---

This content is for informational purposes only and is not financial, investment, or accounting advice. Verify outputs against authoritative sources before use.