Turn a Raw Expense Report Batch into an AI-Fraud Risk Memo

The task

HR partners increasingly get pulled into expense-fraud triage when Finance flags a batch — because the pattern now looks less like a shady receipt and more like a policy-and-culture problem. A recent survey found that four in ten U.S. employees have used AI to generate fake expense receipts, and HR is the function that has to decide who gets a coaching conversation, who gets investigated, and whether the policy itself is inviting the behavior. This workflow turns a de-identified line-item dump into a structured risk memo you can bring to your Finance or ER counterpart the same afternoon.

Before AI

Manually: you export the batch to a spreadsheet, sort by vendor and amount, eyeball for round numbers and duplicate totals, cross-check against the T&E policy PDF, then write a memo summarizing which employees warrant follow-up and what's a coaching moment vs. an investigation. For a 40-line batch this is roughly an hour of focused work, and the bias risk is real — you tend to notice the names you already have opinions about.

The workflow

Step 1 — Paste the batch and get a first-pass anomaly scan.

Feed the tool a de-identified list of expense lines. The prompt below asks for a structured pass that ignores names and focuses on line-item patterns — this is important for reducing the bias risk that comes with "gut feel" reviews.

You are an HR analyst helping triage a batch of expense reports for potential fraud or policy violation. You will receive a de-identified list of expense line items (employee is coded as EMP-001, EMP-002, etc.).

Do a first-pass anomaly scan. For EACH line item, output a table row with these columns:
- Line ID
- Employee code
- Vendor
- Amount
- Anomaly flags (choose from: ROUND_NUMBER, JUST_UNDER_THRESHOLD, DUPLICATE_AMOUNT_SAME_EMP, WEEKEND_BUSINESS_MEAL, UNUSUAL_VENDOR, MISSING_DETAIL, NONE)
- One-sentence rationale

Do NOT make a fraud judgment yet. Just surface the pattern. Assume the policy threshold requiring itemized receipts is $75, and business meals over $50/person require attendee names.

After the table, list any employee codes with 3+ flagged lines.

Here is the batch:

Line ID | Employee | Vendor | Date | Amount | Category | Notes
L-101 | EMP-001 | The Copper Kettle | 2026-06-14 (Sat) | $74.00 | Business Meal | Client dinner, no attendees listed
L-102 | EMP-001 | The Copper Kettle | 2026-06-21 (Sat) | $74.00 | Business Meal | Client dinner, no attendees listed
L-103 | EMP-001 | Uber | 2026-06-14 | $42.50 | Ground Transport | Airport
L-104 | EMP-002 | Marriott Downtown | 2026-06-10 | $312.88 | Lodging | 2 nights, conf booking
L-105 | EMP-002 | Delta Airlines | 2026-06-09 | $488.20 | Airfare | SFO-ORD roundtrip
L-106 | EMP-003 | Amazon | 2026-06-18 | $150.00 | Office Supplies | "Misc supplies"
L-107 | EMP-003 | Amazon | 2026-06-19 | $150.00 | Office Supplies | "Misc supplies"
L-108 | EMP-003 | Amazon | 2026-06-20 | $150.00 | Office Supplies | "Misc supplies"
L-109 | EMP-004 | Starbucks | 2026-06-12 | $8.75 | Business Meal | Coffee with recruit
L-110 | EMP-004 | Panera | 2026-06-15 | $23.40 | Business Meal | Lunch, candidate J.R.
L-111 | EMP-005 | Ritz-Carlton Spa | 2026-06-22 | $220.00 | Client Entertainment | "Client wellness"
L-112 | EMP-005 | Nobu | 2026-06-22 (Sun) | $410.00 | Business Meal | No attendees listed
L-113 | EMP-006 | Hertz | 2026-06-11 | $189.44 | Ground Transport | 3-day rental
L-114 | EMP-006 | Shell | 2026-06-13 | $52.10 | Ground Transport | Fuel, rental car
L-115 | EMP-007 | "InvoicePro Services" | 2026-06-17 | $74.99 | Professional Services | No description
L-116 | EMP-007 | "InvoicePro Services" | 2026-06-24 | $74.99 | Professional Services | No description
L-117 | EMP-008 | United Airlines | 2026-06-05 | $612.00 | Airfare | LGA-LAX
L-118 | EMP-008 | Airbnb | 2026-06-06 | $445.00 | Lodging | 3 nights

Step 2 — Sort flags into HR response tiers.

Not every anomaly is fraud. Some are sloppy paperwork, some are policy ignorance, some are the actual bad thing. This step forces the model to distinguish — which mirrors how a good ER partner thinks. Guidance on separating error from intent is well-covered in the Emburse expense fraud detection guide, which is worth skimming before you finalize the memo.

Using the anomaly table you just produced, now sort every flagged employee into ONE of three HR response tiers. Do not repeat the raw table — produce a new tiered list.

TIER 1 — COACHING: Likely policy misunderstanding or sloppy documentation. Response: manager conversation, resubmit with detail.
TIER 2 — REVIEW: Pattern is suspicious but ambiguous. Response: HR + Finance joint review, request supporting docs.
TIER 3 — INVESTIGATE: Pattern is consistent with intentional manipulation (e.g., structuring under thresholds, duplicated round amounts, fabricated vendors). Response: formal ER intake.

For each employee, output:
- Employee code
- Tier (1, 2, or 3)
- The specific behavioral pattern (in plain language, no jargon)
- The evidence lines (Line IDs)
- What you would NOT conclude from this alone (bias check — what an alternative innocent explanation could be)

Be conservative. When in doubt, tier down, not up.

Step 3 — Draft the memo to Finance/ER, plus a policy-gap note.

The last step produces two deliverables: the memo itself, and a short note on where the policy is inviting the behavior. That second piece is the HR-specific value-add — if half the "fraud" is people not knowing weekend meals need attendees, that's a training problem, not a discipline problem. This framing echoes advice from HR Executive's coverage of the AI-generated expense trend.

Produce two documents from the tiered analysis:

DOCUMENT 1 — Risk Triage Memo
- Audience: Finance Controller and ER Lead
- Format: brief memo, max 350 words
- Sections: Summary (1 sentence), Batch stats (# lines reviewed, # flagged, tier counts), Recommended actions by tier (name employee codes only), Items requiring immediate hold on reimbursement
- Tone: neutral, factual, no adjectives like "egregious" or "clearly"

DOCUMENT 2 — Policy Gap Note
- Audience: HR Business Partner team
- Format: bulleted list, max 8 bullets
- Identify where the current policy (>$75 itemization, >$50/person meals need attendees) is either being systematically misunderstood OR being gamed via structuring. For each gap, suggest one policy or training fix.
- Include a note on whether AI-generated receipts specifically appear plausible in this batch (e.g., unusual vendors with generic names, identical amounts across dates).

Output DOCUMENT 1 first, then a divider line, then DOCUMENT 2.

Gotchas

• De-identify before pasting. Employee names, card numbers, and merchant IDs that could re-identify someone don't belong in a general-purpose model. Code employees as EMP-001, EMP-002. If your legal/privacy team hasn't approved the tool for internal data, stop here and use an enterprise instance.
• AI-generated receipts are hard to spot from line items alone. This workflow catches patterns (structuring, duplicates, weekend anomalies). It won't catch a single well-crafted fake receipt for a real vendor at a plausible amount — that requires image forensics or vendor verification, which is outside this scope.
• Tier 3 is not a conclusion. It's a recommendation to open an intake. Do not communicate a tier 3 designation to the employee or their manager before ER review — that's how you end up with a defamation problem.
• Watch for the model over-flagging. If almost every line comes back with a flag, the model is being too sensitive. Re-run step 1 and explicitly tell it "only flag lines where the pattern is unusual relative to the rest of the batch."
• Bias check the tiers yourself. Before sending the memo, look at the tier 2 and 3 employees. If they cluster on any protected characteristic you happen to know about, pause and have a second reviewer look.

Time saved

Manual review of a ~20-line batch and drafting a memo runs about 60 minutes for an HR partner who doesn't do this daily. This workflow gets you to a reviewable draft in about 15 minutes, including the pasting and the human sanity-check at the end — so roughly 45 minutes per batch. The saving grows with batch size; the bias-check step at the end is non-negotiable and should not be rushed.

What we got when we ran it

We executed every prompt above, in order, against the sample input (model: claude-sonnet-4-6). Outputs below are real and unedited apart from length truncation.

Step 1 output

First-Pass Anomaly Scan | Line ID | Employee | Vendor | Amount | Anomaly Flags | Rationale | |---------|----------|--------|--------|---------------|-----------| | L-101 | EMP-001 | The Copper Kettle | $74.00 | JUST_UNDER_THRESHOLD, WEEKEND_BUSINESS_MEAL, MISSING_DETAIL | Saturday meal at $74.00 sits $1 below the $75 itemized-receipt threshold, and no attendees are listed despite a per-person meal context. | | L-102 | EMP-001 | The Copper Kettle | $74.00 | JUST_UNDER_THRESHOLD, WEEKEND_BUSINESS_MEAL, MISSING_DETAIL, DUPLICATE_AMOUNT_SAME_EMP | Identical amount, vendor, day-of-week, and missing-attendee pattern as L-101 one week later, compounding all prior flags. | | L-103 | EMP-001 | Uber | $42.50 | NONE | Routine ground transport on the same day as L-101; amount and category are unremarkable. | | L-104 | EMP-002 | Marriott Downtown | $312.88 | NONE | Two-night conference lodging with a specific booking reference; amount is plausible and non-round. | | L-105 | EMP-002 | Delta Airlines | $488.20 | NONE | Roundtrip airfare with route specified; amount and detail are consistent with policy norms. | | L-106 | EMP-003 | Amazon | $150.00 | ROUND_NUMBER, MISSING_DETAIL, DUPLICATE_AMOUNT_SAME_EMP | Round $150 charge with only "Misc supplies" as description; first of three consecutive identical entries. | | L-107 | EMP-003 | Amazon | $150.00 | ROUND_NUMBER, MISSING_DETAIL, DUPLICATE_AMOUNT_SAME_EMP | Exact repeat of L-106 the following day with identically vague notes, suggesting possible splitting or duplication. | | L-108 | EMP-003 | Amazon | $150.00 | ROUND_NUMBER, MISSING_DETAIL, DUPLICATE_AMOUNT_SAME_EMP | Third consecutive day with identical vendor, amount, and description; pattern

…output truncated at 250 words.

Step 2 output

HR Response Tier Classification --- ### TIER 3 — INVESTIGATE --- **EMP-007** - **Tier:** 3 - **Behavioral Pattern:** Two charges from an unverifiable vendor ("InvoicePro Services") arrive exactly one week apart, each priced at $74.99 — one cent below the threshold that triggers a required itemized receipt. Neither charge has any description of services rendered. The combination of an unrecognizable vendor name, identical sub-threshold amounts, and complete absence of detail is the textbook profile of threshold structuring. - **Evidence Lines:** L-115, L-116 - **What we would NOT conclude from this alone:** InvoicePro Services may be a legitimate small vendor (e.g., a freelance invoicing tool or SaaS subscription) that happens to have a flat monthly fee just under $75. The weekly cadence could reflect a billing cycle rather than deliberate splitting. This does not confirm fabrication — it warrants verification, not a finding. --- ### TIER 2 — REVIEW --- **EMP-003** - **Tier:** 2 - **Behavioral Pattern:** Three Amazon charges of exactly $150.00 each are submitted on three consecutive days, all categorized as "Office Supplies" with identical vague notes ("Misc supplies"). The round number, the repetition, and the lack of itemization together suggest either expense splitting to stay manageable, bulk personal purchasing expensed as work supplies, or duplicate submissions from a single order. - **Evidence Lines:** L-106, L-107, L-108 - **What we would NOT conclude from this alone:** Amazon frequently ships multi-item orders in separate fulfillment batches that bill separately and on different dates. It is plausible that three legitimate

…output truncated at 250 words.

Step 3 output

DOCUMENT 1 --- **INTEROFFICE MEMORANDUM** **TO:** Finance Controller; Employee Relations Lead **FROM:** HR Analytics — Expense Review **DATE:** 2026-06-27 **RE:** June 2026 Expense Batch — First-Pass Anomaly Triage --- **Summary** A batch of 18 expense line items submitted for the June 2026 cycle has been reviewed for policy compliance and anomaly patterns; findings warrant tiered follow-up action on five employees before reimbursement is processed. --- **Batch Statistics** - Total line items reviewed: 18 - Line items flagged with at least one anomaly: 11 (61%) - Employees represented in batch: 8 - Employees with no flags: 3 (EMP-002, EMP-004, EMP-006) - Tier 1 — Coaching: 1 employee - Tier 2 — Review: 3 employees - Tier 3 — Investigate: 1 employee --- **Recommended Actions by Tier** **Tier 3 — Formal ER Intake (refer prior to any reimbursement):** EMP-007. Two submissions from an unverified vendor at identical sub-threshold amounts on a weekly cadence. Refer to ER for intake and vendor verification. **Tier 2 — HR and Finance Joint Review (request supporting documentation):** - EMP-003: Request itemized Amazon order confirmations and business justification for three consecutive same-amount submissions. - EMP-001: Request attendee names and business purpose documentation for both meal submissions; confirm client relationship. - EMP-005: Request pre-approval documentation for entertainment category, itemized receipts, and attendee list for both charges. **Tier 1 — Manager Coaching (resubmit with correction):** EMP-008: Manager to advise on approved lodging vendors; employee to resubmit with confirmation of business necessity or pre-approval for Airbnb use. --- **Immediate Reimbursement

…output truncated at 250 words.