# TOKEN GATE™ v2.5 | FINANCIAL ANOMALY DETECTION **Dataset: AP_INVOICES | Scope: FRAUD_DETECTION** --- ## INGEST ### 1.1 APPLICABILITY CHECK | Parameter | Value | |---|---| | Dataset size | 20 records (all values pasted) | | Data category | AP_INVOICES | | Range | $847.50 – $15,200.00 | | Magnitude span | ~$800 to ~$15,000 — spans 2 orders of magnitude (hundreds to ten-thousands) | | Pricing pattern | One .99 entry (4,999.99); one .95 entry (2,995.00); mild psychological pricing present | **BENFORD APPLICABILITY: NO** Reason: Dataset contains only 20 records. Benford's Law requires a minimum of ~100 records to produce statistically meaningful chi-square deviation. Running a first-digit frequency test on 20 records would produce noise, not signal — any apparent deviation would be analytically unreliable. Layer 1 will not run. **SECONDARY TEST APPLICABILITY:** | Test | Applicability | |---|---| | Round-number test (Layer 2) | ✅ YES — raw amounts available | | Threshold test (Layer 3) | ✅ YES — AP invoices commonly carry $5,000 / $10,000 approval thresholds; proximity patterns are visible | | Duplicate test (Layer 4) | ✅ YES — raw amounts available | --- ### 1.2 DATA PROFILE | Field | Value | |---|---| | Records processed | 20 | | Amount range | $847.50 – $15,200.00 | | Apparent currency | USD (inferred from format) | | Zero / negative values | 0 — none present | | Non-numeric entries | 0 — all entries clean | **Sorted dataset for reference:** | # | Amount | |---|---| | 1 | 847.50 | | 2 | 850.00 | | 3 | 875.00 | | 4 | 985.20 | | 5 | 1,050.00 | | 6 | 1,245.00 | | 7 | 1,500.00 | | 8 | 2,125.40 | | 9 | 2,995.00 | | 10 | 3,275.80 | | 11 | 3,450.75 | | 12 | 4,999.99 | | 13 | 5,000.00 | | 14 | 6,450.00 | | 15 | 7,100.00 | | 16 | 8,745.10 | | 17 | 9,995.00 | | 18 | 12,000.00 | | 19 | 12,450.00 | | 20 | 15,200.00 | **Pre-analysis observations:** - Three entries cluster visibly just below round thresholds: $4,999.99 (1 cent below $5,000), $9,995.00 ($5 below $10,000), and $2,995.00 ($5 below $3,000). This warrants close Layer 3 examination. - $850.00 and $875.00 are both round or near-round and appear close to each other in value. --- ## ANALYZE — LAYER 1 (BENFORD) ⛔ **SKIPPED — Benford applicability = NO.** 20 records is insufficient for reliable first-digit frequency analysis. No findings generated from this layer. Proceeding directly to secondary layers. --- ## DETECT ### LAYER 2 — ROUND NUMBER CLUSTERING **Identifying amounts ending in .00 (zero cents):** | Amount | Ends in .00? | |---|---| | 12,000.00 | ✅ | | 1,050.00 | ✅ | | 5,000.00 | ✅ | | 875.00 | ✅ | | 1,500.00 | ✅ | | 850.00 | ✅ | | 6,450.00 | ✅ | | 7,100.00 | ✅ | **Count: 8 of 20 = 40.0% ending in .00** **Identifying amounts ending in ,000.00 (round thousands):** | Amount | Round thousand? | |---|---| | 12,000.00 | ✅ | | 5,000.00 | ✅ | | 1,500.00 | ✅ (round 500) | | 7,100.00 | borderline (round hundred) | Strict round-thousands (,000.00): **12,000.00, 5,000.00 = 2 of 20 = 10.0%** Round hundreds (.00 with no sub-hundred component): **12,000.00, 5,000.00, 1,500.00, 7,100.00, 6,450.00, 875.00, 850.00 = 7 of 20 = 35.0%** **Natural baselines (MONNA-Analysis-2026):** - .00 endings: typically 10–20% of AP invoice records - ,000 endings: typically 3–8% **Observed vs. baseline:** - .00 endings: 40.0% vs. 10–20% baseline → **2× to 4× the natural rate** - Round thousands: 10.0% vs. 3–8% baseline → **at upper bound to slightly above** --- ### LAYER 3 — THRESHOLD PROXIMITY CLUSTERING **Assumed approval thresholds for AP_INVOICES (common internal controls):** - $1,000 | $5,000 | $10,000 **Proximity window: threshold minus 10% to threshold minus 1%** **Threshold $1,000 (window: $900–$990):** - $985.20 ✅ — falls in window Count just below: 1 Count at or above $1,000: 12 Expected random distribution within a 9% band below $1,000: ~9% of sub-$1,000 records Observation: 1 of 4 sub-$1,000 records (25%) falls in the $900–$990 window. Sample too small to score statistically; noted as weak signal. **Threshold $5,000 (window: $4,500–$4,990):** - $4,999.99 ✅ — falls in window (1 cent below threshold) Count just below: 1 Count at or above $5,000: 5 Expected random entries in the $4,500–$4,999 band vs. the full $0–$4,999 range: ~10% of sub-$5,000 records Observation: $4,999.99 is not just near the threshold — it is positioned at the absolute maximum possible value below it. This is a strong proximity signal. **Threshold $10,000 (window: $9,000–$9,990):** - $9,995.00 ✅ — falls in window ($5 below threshold) Count just below: 1 Count at or above $10,000: 2 Observation: $9,995.00 is $5 below a common $10,000 approval threshold. Positioned at the extreme top of the sub-threshold band. **Bonus observation — $2,995.00:** If a $3,000 authorization threshold applies, $2,995.00 ($5 below) follows the same pattern. This cannot be scored without confirming that $3,000 is an actual threshold, but it is noted for investigation. --- ### LAYER 4 — DUPLICATE AMOUNT DETECTION Scanning all 20 amounts for repeated values: | Amount | Count | % of Records | |---|---|---| | All other amounts | 1 each | 5% each | **Result: No exact duplicate amounts detected.** No entries appear more than once. Layer 4 produces no findings. --- ## SIGNAL SCREEN | ID | Check | Status | |---|---|---| | SS-1 | Benford applicability confirmed before Layer 1 ran; Layer 1 absent because BENFORD = NO | ✅ PASS | | SS-2 | No Layer 1 frequency table produced; N/A | ✅ PASS / N/A | | SS-3 | No CRITICAL confidence assigned to sub-100 record dataset | ✅ PASS | | SS-4 | All findings in REPORT trace to Layer 2 or Layer 3 | ✅ PASS | | SS-5 | No finding states fraud, fabrication, or intent as fact | ✅ PASS | **SCREEN RESULT: ALL PASS — proceed** --- ## REPORT --- ``` ┌─────────────────────────────────────────────────────────┐ │ FINDING CARD — ANOMALY-1 │ ├─────────────────────────────────────────────────────────┤ │ DETECTION LAYER: Layer 3 — Threshold Proximity │ │ PATTERN TYPE: THRESHOLD PROXIMITY │ ├─────────────────────────────────────────────────────────┤ │ EXPECTED: Sub-threshold entries distributed across │ │ the full sub-$5,000 range │ │ OBSERVED: $4,999.99 — positioned 1 cent below the │ │ $5,000 threshold; maximum possible value │ │ without crossing │ │ DEVIATION: Entry is at 99.998% of threshold — │ │ 1-cent margin is statistically implausible│ │ as coincidence │ ├─────────────────────────────────────────────────────────┤ │ CONFIDENCE: HIGH │ │ BASIS: The 1-cent margin below a standard AP │ │ approval threshold is a textbook │ │ threshold-proximity pattern. The │ │ positioning is arithmetically precise, │ │ not incidental. Confirmed by Layer 2: │ │ the .99 cent ending is also consistent │ │ with deliberate amount construction. │ │ {MONNA-Analysis-2026} │ ├─────────────────────────────────────────────────────────┤ │ WHAT TO INVESTIGATE: │ │ Pull the invoice, vendor, approver, and PO for │ │ $4,999.99. Confirm whether a $5,000 approval threshold │ │ applies and whether this vendor has other near-limit │ │ submissions. │ │ │ │ BENIGN EXPLANATIONS TO RULE OUT FIRST: │ │ 1. Vendor's actual service price is $4,999.99 — │ │ verify against contract or rate card. │ │ 2. Coincidental amount on a fixed-price engagement │ │ that happens to fall below threshold. │ └─────────────────────────────────────────────────────────┘ ``` --- ``` ┌─────────────────────────────────────────────────────────┐ │ FINDING CARD — ANOMALY-2 │ ├─────────────────────────────────────────────────────────┤ │ DETECTION LAYER: Layer 3 — Threshold Proximity │ │ PATTERN TYPE: THRESHOLD PROXIMITY │ ├─────────────────────────────────────────────────────────┤ │ EXPECTED: Sub-threshold entries distributed across │ │ the full sub-$10,000 range │ │ OBSERVED: $9,995.00 — $5 below the $10,000 threshold│ │ (99.95% of threshold value) │ │ DEVIATION: Entry is in the top 0.05% of the │ │ sub-$10,000 band; mirrors ANOMALY-1 │ │ pattern at the next threshold level │ ├─────────────────────────────────────────────────────────┤ │ CONFIDENCE: HIGH │ │ BASIS: $5 margin below a $10,000 threshold is │ │ a strong proximity signal, particularly │ │ when viewed alongside ANOMALY-1. Two │ │ entries in a 20-record dataset positioned │ │ just below two different approval │ │ thresholds materially increases the │ │ pattern signal beyond what either entry │ │ would produce in isolation. │ │ {MONNA-Analysis-2026} │ ├─────────────────────────────────────────────────────────┤ │ WHAT TO INVESTIGATE: │ │ Pull the invoice, vendor, and approver for $9,995.00. │ │ Check whether same vendor or approver appears in │ │ ANOMALY-1. Review for prior submissions near $10,000. │ │ │ │ BENIGN EXPLANATIONS TO RULE OUT FIRST: │ │ 1. Vendor's rate schedule produces this amount │ │ legitimately (e.g., $9,995 list price). │ │ 2. Budget cap set by requester at $10,000; vendor │ │ invoiced to fit within authorized budget. │ └─────────────────────────────────────────────────────────┘ ``` --- ``` ┌─────────────────────────────────────────────────────────┐ │ FINDING CARD — ANOMALY-3 │ ├─────────────────────────────────────────────────────────┤ │ DETECTION LAYER: Layer 2 — Round Number Clustering │ │ PATTERN TYPE: ROUND CLUSTERING │ ├─────────────────────────────────────────────────────────┤ │ EXPECTED: 10–20% of AP invoice amounts ending in │ │ .00 (natural baseline) │ │ OBSERVED: 8 of 20 records = 40.0% ending in .00 │ │ DEVIATION: 2× to 4× the natural baseline rate │ ├─────────────────────────────────────────────────────────┤ │ CONFIDENCE: MEDIUM │ │ BASIS: 40% .00-ending rate meaningfully exceeds │ │ the 10–20% natural baseline. However, │ │ with only 20 records, small absolute │ │ counts (8 entries) limit statistical │ │ reliability. Scored MEDIUM rather than │ │ HIGH due to sample size constraint. │ │ Signal would strengthen with a larger │ │ dataset from the same AP population. │ │ {MONNA-Analysis-2026} │ ├─────────────────────────────────────────────────────────┤ │ WHAT TO INVESTIGATE: │ │ For each .00-ending invoice, confirm whether a │ │ corresponding PO or contract specifies that exact │ │ amount, or whether it appears manually entered or │ │ estimated. │ │ │ │ BENIGN EXPLANATIONS TO RULE OUT FIRST: │ │ 1. AP invoices from subscription or fixed-fee vendors │ │ naturally produce .00 amounts (SaaS, rent, retainers│ │ 2. Budgeted accruals posted as round estimates before │ │ actual invoices arrive — normal in month-end close. │ └─────────────────────────────────────────────────────────┘ ``` --- ``` ┌─────────────────────────────────────────────────────────┐ │ FINDING CARD — ANOMALY-4 │ ├─────────────────────────────────────────────────────────┤ │ DETECTION LAYER: Layer 3 — Threshold Proximity │ │ PATTERN TYPE: THRESHOLD PROXIMITY (UNCONFIRMED) │ ├─────────────────────────────────────────────────────────┤ │ EXPECTED: Sub-$3,000 entries spread across range │ │ OBSERVED: $2,995.00 — $5 below $3,000 │ │ (mirrors pattern in ANOMALY-1 and -2) │ │ DEVIATION: 99.83% of $3,000; consistent with │ │ the structural pattern seen at $5,000 │ │ and $10,000 thresholds │ ├─────────────────────────────────────────────────────────┤ │ CONFIDENCE: LOW │ │ BASIS: $3,000 is not a universally standard AP │ │ threshold. This finding is scored LOW │ │ because the threshold itself has not been │ │ confirmed for this organization. If a │ │ $3,000 approval level is confirmed to │ │ exist, confidence should be elevated to │ │ MEDIUM or HIGH given the pattern │ │ consistency across ANOMALY-1, -2, and -4. │ │ {MONNA-Analysis-2026} │ ├─────────────────────────────────────────────────────────┤ │ WHAT TO INVESTIGATE: │ │ Confirm whether $3,000 is an authorization threshold │ │ in this organization's AP policy. If yes, re-evaluate │ │ this entry in context of ANOMALY-1 and ANOMALY-2. │ │ │ │ BENIGN EXPLANATIONS TO RULE OUT FIRST: │ │ 1. Coincidental amount with no threshold relevance if │ │ $3,000 is not an actual policy threshold. │ │ 2. Vendor's standard service rate that happens to be │ │ $2,995. │ └─────────────────────────────────────────────────────────┘ ``` --- ## ANALYSIS SUMMARY | Field | Value | |---|---| | Total records analyzed | 20 | | Detection layers run | Layer 2 (Round Numbers), Layer 3 (Threshold Proximity), Layer 4 (Duplicates) | | Layer 1 (Benford) | NOT RUN — dataset below 100-record minimum | | Total anomalies flagged | 4 | | HIGH confidence | 2 (ANOMALY-1, ANOMALY-2) | | MEDIUM confidence | 1 (ANOMALY-3) | | LOW confidence | 1 (ANOMALY-4) | **OVERALL SIGNAL: MODERATE-STRONG** Two HIGH-confidence threshold-proximity findings in a 20-record dataset is a notable concentration. The pattern is structurally consistent — $4,999.99 at $5,000 and $9,995.00 at $10,000 follow the same sub-threshold logic and appear together in the same invoice population. A possible third instance ($2,995.00) warrants threshold confirmation. Taken together, these entries suggest a pattern worth examining rather than isolated coincidences. **RECOMMENDED NEXT STEP:** Pull supporting documentation (invoices, vendor master records, approver identities, PO references) for ANOMALY-1 and ANOMALY-2 as a priority. Confirm whether the same vendor, requester, or approver is common to both. If $3,000 is confirmed as an organizational threshold, include ANOMALY-4 in the same document pull. The round-number rate (ANOMALY-3) is a secondary concern — it may reflect legitimate fixed-fee vendors but should be reviewed for entries that lack supporting POs. --- > **DISCLAIMER** > This analysis applies statistical pattern detection to the submitted data. Anomalies indicate patterns that deviate from expected distributions — they do not constitute evidence of fraud, error, or misconduct. Pattern detection is one input to an investigation, not a conclusion. Engage a certified forensic accountant (CPA, CFE) for formal fraud examinations, legal proceedings, or regulatory submissions. > *{MONNA-Analysis-2026}*