VeraStream audit report
Northwind Logistics · Q3 FY2024
Anonymized and synthetic data, generated deterministically and run through the same detector logic VeraStream ships against live ERP and card feeds. Numbers below come from the real evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, and detectRoundDollar helpers — exactly as the production agent uses them.
Executive summary
2,400-row synthetic ledger · Generated Aug 19, 2026
4641 flags surfaced — Critical findings are stop-work items your finance team should review before reimbursement; exposure is the dollar total of every flagged transaction.
- Transactions
- 2,400
- Spend audited
- $2,319,228
- Total flags
- 4,641
- Exposure
- $5,140,837
Flags by severity
Severity distribution
How flags break down
Findings by detector
What each detector surfaced
Each section is collapsible — open one to see what rules the detector enforces and a sample of the highest-impact catches.
Policy violations
372 flags$671,629 exposurePer-transaction rule checks against spend policy: meal limits, single-transaction VP-sign-off thresholds, last-minute travel bookings, and entertainment purposes.
Severity breakdown:CRITICAL51HIGH110MEDIUM211LOW0
Policy violations
Top findings
| Date | Vendor | Amount | Code | Severity |
|---|---|---|---|---|
| 2024-09-12 | Singularis Asset Holdings | $100,000.00 | AMT_OVER_THRESHOLD | CRITICAL |
| 2024-08-10 | Helix Industrial Services | $50,000.00 | AMT_OVER_THRESHOLD | CRITICAL |
| 2024-09-29 | Salesforce | $13,450.00 | AMT_OVER_THRESHOLD | CRITICAL |
| 2024-09-07 | Microsoft Azure | $12,250.00 | AMT_OVER_THRESHOLD | CRITICAL |
| 2024-07-18 | Salesforce | $11,240.00 | AMT_OVER_THRESHOLD | CRITICAL |
- Singularis Asset HoldingsCRITICAL2024-09-12$100,000.00
AMT_OVER_THRESHOLD
Single transaction of $100000.00 exceeds $5,000 VP sign-off threshold
- Helix Industrial ServicesCRITICAL2024-08-10$50,000.00
AMT_OVER_THRESHOLD
Single transaction of $50000.00 exceeds $5,000 VP sign-off threshold
- SalesforceCRITICAL2024-09-29$13,450.00
AMT_OVER_THRESHOLD
Single transaction of $13450.00 exceeds $5,000 VP sign-off threshold
- Microsoft AzureCRITICAL2024-09-07$12,250.00
AMT_OVER_THRESHOLD
Single transaction of $12250.00 exceeds $5,000 VP sign-off threshold
- SalesforceCRITICAL2024-07-18$11,240.00
AMT_OVER_THRESHOLD
Single transaction of $11240.00 exceeds $5,000 VP sign-off threshold
+ 367 more flags produced by this detector on the 2,400-row synthetic ledger.
Duplicate invoices
192 flags$226,738 exposurePairwise comparison across the full ledger for identical or near-identical vendor + amount + window invoice pairs.
Severity breakdown:CRITICAL0HIGH54MEDIUM138LOW0
Duplicate invoices
Top findings
| Date | Vendor | Amount | Code | Severity |
|---|---|---|---|---|
| 2024-09-01 | Stratus Logistics | $10,000.00 | DUPE_EXACT | HIGH |
| 2024-09-01 | Stratus Logistics | $10,000.00 | DUPE_EXACT | HIGH |
| 2024-09-15 | Stratus Logistics | $10,000.00 | DUPE_EXACT | HIGH |
| 2024-08-01 | Meridian Freight Co | $7,000.00 | DUPE_EXACT | HIGH |
| 2024-08-30 | Meridian Freight Co | $7,000.00 | DUPE_EXACT | HIGH |
- Stratus LogisticsHIGH2024-09-01$10,000.00
DUPE_EXACT
Pair with INV-2024-NW-2359 (2024-09-15): Exact vendor name match and amount within $0.50
- Stratus LogisticsHIGH2024-09-01$10,000.00
DUPE_EXACT
Pair with INV-2024-NW-2366 (2024-09-25): Exact vendor name match and amount within $0.50
- Stratus LogisticsHIGH2024-09-15$10,000.00
DUPE_EXACT
Pair with INV-2024-NW-2366 (2024-09-25): Exact vendor name match and amount within $0.50
- Meridian Freight CoHIGH2024-08-01$7,000.00
DUPE_EXACT
Pair with INV-2024-NW-2311 (2024-08-30): Exact vendor name match and amount within $0.50
- Meridian Freight CoHIGH2024-08-30$7,000.00
DUPE_EXACT
Pair with INV-2024-NW-2317 (2024-09-25): Exact vendor name match and amount within $0.50
+ 187 more flags produced by this detector on the 2,400-row synthetic ledger.
Expense anomalies
3170 flags$3,100,312 exposureStatistical and outlier checks: amount deviation from the employee+category baseline, round-number meal spikes, weekend / holiday submissions, and merchant/category mismatches.
Severity breakdown:CRITICAL0HIGH493MEDIUM2677LOW0
Expense anomalies
Top findings
| Date | Vendor | Amount | Code | Severity |
|---|---|---|---|---|
| 2024-09-12 | Singularis Asset Holdings | $100,000.00 | STAT_OUTLIER_HIGH | HIGH |
| 2024-09-29 | Salesforce | $13,450.00 | WEEKEND_SUBMISSION | HIGH |
| 2024-09-07 | Microsoft Azure | $12,250.00 | WEEKEND_SUBMISSION | HIGH |
| 2024-09-22 | Snowflake | $8,200.00 | WEEKEND_SUBMISSION | HIGH |
| 2024-07-03 | Zendesk | $6,958.00 | STAT_OUTLIER_HIGH | HIGH |
- Singularis Asset HoldingsHIGH2024-09-12$100,000.00
STAT_OUTLIER_HIGH
$100000.00 is >3σ from the 30-item group mean ($10422.17) — possible phantom expense
- SalesforceHIGH2024-09-29$13,450.00
WEEKEND_SUBMISSION
"SaaS" expense on 2024-09-29 (Sunday) — business-hours category submitted outside business hours
- Microsoft AzureHIGH2024-09-07$12,250.00
WEEKEND_SUBMISSION
"SaaS" expense on 2024-09-07 (Saturday) — business-hours category submitted outside business hours
- SnowflakeHIGH2024-09-22$8,200.00
WEEKEND_SUBMISSION
"SaaS" expense on 2024-09-22 (Sunday) — business-hours category submitted outside business hours
- ZendeskHIGH2024-07-03$6,958.00
STAT_OUTLIER_HIGH
$6958.00 is >3σ from the 65-item group mean ($1577.42) — possible phantom expense
+ 3165 more flags produced by this detector on the 2,400-row synthetic ledger.
Vendor risk
850 flags$771,631 exposureVendor allowlist enforcement: unapproved payees, typosquats of approved vendors, and vendors first-seen inside the rolling 14-day onboarding window.
Severity breakdown:CRITICAL7HIGH21MEDIUM817LOW5
Vendor risk
Top findings
| Date | Vendor | Amount | Code | Severity |
|---|---|---|---|---|
| 2024-08-31 | Amaz0n Web Services | $5,400.00 | SUSPICIOUS_PAYEE_FUZZY | CRITICAL |
| 2024-08-31 | Microsft Azure | $3,250.00 | SUSPICIOUS_PAYEE_FUZZY | CRITICAL |
| 2024-08-31 | Slakc | $1,420.00 | SUSPICIOUS_PAYEE_FUZZY | CRITICAL |
| 2024-08-15 | Slakc | $880.00 | SUSPICIOUS_PAYEE_FUZZY | CRITICAL |
| 2024-08-31 | Marriot Hotels | $412.00 | SUSPICIOUS_PAYEE_FUZZY | CRITICAL |
- Amaz0n Web ServicesCRITICAL2024-08-31$5,400.00
SUSPICIOUS_PAYEE_FUZZY
Vendor "Amaz0n Web Services" is within 1 edit(s) of approved "Amazon Web Services" — possible typosquat / fraudulent payee
- Microsft AzureCRITICAL2024-08-31$3,250.00
SUSPICIOUS_PAYEE_FUZZY
Vendor "Microsft Azure" is within 1 edit(s) of approved "Microsoft Azure" — possible typosquat / fraudulent payee
- SlakcCRITICAL2024-08-31$1,420.00
SUSPICIOUS_PAYEE_FUZZY
Vendor "Slakc" is within 2 edit(s) of approved "Slack" — possible typosquat / fraudulent payee
- SlakcCRITICAL2024-08-15$880.00
SUSPICIOUS_PAYEE_FUZZY
Vendor "Slakc" is within 2 edit(s) of approved "Slack" — possible typosquat / fraudulent payee
- Marriot HotelsCRITICAL2024-08-31$412.00
SUSPICIOUS_PAYEE_FUZZY
Vendor "Marriot Hotels" is within 1 edit(s) of approved "Marriott Hotels" — possible typosquat / fraudulent payee
+ 845 more flags produced by this detector on the 2,400-row synthetic ledger.
Threshold gaming
4 flags$56,024 exposureSplit-purchase / P-card threshold-gaming: a single vendor receiving multiple invoices each sitting just below the same approval ceiling, clustered inside a 14-day window. Pre-tuned ceilings are $1k / $2.5k / $5k / $10k / $25k; non-pre-tuned round numbers are auto-detected from the data. ACFE Occupational Fraud 2024 — P-card split-purchase scheme.
Severity breakdown:CRITICAL0HIGH0MEDIUM4LOW0
Threshold gaming
Top findings
| Date | Vendor | Amount | Code | Severity |
|---|---|---|---|---|
| 2024-07-31 | Facilities Solutions LLC | $39,420.00 | THRESHOLD_GAMING_MEDIUM | MEDIUM |
| 2024-08-20 | Pacific Office Supplies LLC | $9,820.00 | THRESHOLD_GAMING_MEDIUM | MEDIUM |
| 2024-09-02 | Streamworks Cloud Solutions | $3,840.00 | THRESHOLD_GAMING_MEDIUM | MEDIUM |
| 2024-09-20 | Uber Business | $2,944.00 | THRESHOLD_GAMING_MEDIUM | MEDIUM |
- Facilities Solutions LLCMEDIUM2024-07-31$39,420.00
THRESHOLD_GAMING_MEDIUM
4 invoices from "Facilities Solutions LLC" sit just below the $10,000 approval ceiling over 9d — classic split-purchase / P-card structure to evade the next approval tier. ACFE Occupational Fraud 2024 — P-card split-purchase scheme.
- Pacific Office Supplies LLCMEDIUM2024-08-20$9,820.00
THRESHOLD_GAMING_MEDIUM
4 invoices from "Pacific Office Supplies LLC" sit just below the $2,500 approval ceiling over 10d — classic split-purchase / P-card structure to evade the next approval tier. ACFE Occupational Fraud 2024 — P-card split-purchase scheme.
- Streamworks Cloud SolutionsMEDIUM2024-09-02$3,840.00
THRESHOLD_GAMING_MEDIUM
4 invoices from "Streamworks Cloud Solutions" sit just below the $1,000 approval ceiling over 10d — classic split-purchase / P-card structure to evade the next approval tier. ACFE Occupational Fraud 2024 — P-card split-purchase scheme.
- Uber BusinessMEDIUM2024-09-20$2,944.00
THRESHOLD_GAMING_MEDIUM
3 invoices from "Uber Business" sit just below the $1,000 approval ceiling over 6d — classic split-purchase / P-card structure to evade the next approval tier. ACFE Occupational Fraud 2024 — P-card split-purchase scheme.
Round dollar
10 flags$212,000 exposureRound-dollar payments (no-cents exact multiples — classic fabricated-invoice / kickback signal). LOW: the vendor's only such payment, ≥ $1,000. MED: ≥ 3 round payments to the same vendor within any 90-day window, OR one exact $10k multiple ≥ $25,000. HIGH: ≥ 5 round payments to the same vendor in 90 days, OR one exact $25k multiple ≥ $100,000, OR ≥ 60% of a vendor's total spend is round with ≥ 5 round payments. ACFE Occupational Fraud 2024 — P-card split-purchase / round-ticket fabrication.
Severity breakdown:CRITICAL0HIGH5MEDIUM1LOW4
Round dollar
Top findings
| Date | Vendor | Amount | Code | Severity |
|---|---|---|---|---|
| 2024-09-12 | Singularis Asset Holdings | $100,000.00 | ROUND_DOLLAR_HIGH | HIGH |
| 2024-09-28 | Stratus Logistics | $46,000.00 | ROUND_DOLLAR_HIGH | HIGH |
| 2024-09-20 | Polaris Strategy Consulting | $20,000.00 | ROUND_DOLLAR_HIGH | HIGH |
| 2024-09-01 | Stratus Logistics | $10,000.00 | ROUND_DOLLAR_HIGH | HIGH |
| 2024-09-20 | Polaris Strategy Consulting | $6,000.00 | ROUND_DOLLAR_HIGH | HIGH |
- Singularis Asset HoldingsHIGH2024-09-12$100,000.00
ROUND_DOLLAR_HIGH
Single $100,000 exact $25,000 multiple to "Singularis Asset Holdings" — large round-ticket payment above the $100,000 anchor.
- Stratus LogisticsHIGH2024-09-28$46,000.00
ROUND_DOLLAR_HIGH
5 round payments to "Stratus Logistics" inside 27d — ≥5 round amounts to the same vendor in a 90-day window.
- Polaris Strategy ConsultingHIGH2024-09-20$20,000.00
ROUND_DOLLAR_HIGH
5 round payments to "Polaris Strategy Consulting" inside 67d — ≥5 round amounts to the same vendor in a 90-day window.
- Stratus LogisticsHIGH2024-09-01$10,000.00
ROUND_DOLLAR_HIGH
100% of "Stratus Logistics"'s total spend is round across 5 round payments (vs 5 total) — vendor-wide round-spend ratio above threshold.
- Polaris Strategy ConsultingHIGH2024-09-20$6,000.00
ROUND_DOLLAR_HIGH
73% of "Polaris Strategy Consulting"'s total spend is round across 5 round payments (vs 8 total) — vendor-wide round-spend ratio above threshold.
+ 5 more flags produced by this detector on the 2,400-row synthetic ledger.
Duplicate payment
37 flags$88,273 exposureDuplicate-payment detection (same vendor + same-or-near amount clustered in a short window). LOW: ≥ 4 same-vendor, same-amount rows in 180d with non-recurring gap cadence (CV > 20%) — suggests investigation. MED.1: same-day twin (same vendor + same day + same amount + DIFFERENT invoice refs, 2 rows). MED.2: round-cent twin (same vendor + cents-identical amount within 60 days, 2 rows). HIGH.1: exact duplicate (same vendor + same amount within 14 days, invoice-ref gate passes or both sides have no ref). HIGH.2: near-duplicate cluster (same vendor + amount ± 1%, ≥ 3 rows within 30 days). Recurring SaaS/rent (CV ≤ 20%) and refund/reversal rows inside the window are auto-suppressed. Vendor-ignore gate bypassed for HIGH — a duplicate is a duplicate regardless. ACFE Occupational Fraud 2024 — duplicate-vendor-payments loss vector.
Severity breakdown:CRITICAL0HIGH25MEDIUM11LOW1
Duplicate payment
Top findings
| Date | Vendor | Amount | Code | Severity |
|---|---|---|---|---|
| 2024-09-13 | Apex Legal LLC | $7,500.00 | DUPLICATE_PAYMENT_HIGH | HIGH |
| 2024-08-03 | Enterprise Rent-A-Car | $4,557.00 | DUPLICATE_PAYMENT_HIGH | HIGH |
| 2024-08-18 | Marriott Hotels | $4,382.00 | DUPLICATE_PAYMENT_HIGH | HIGH |
| 2024-09-17 | Lyft Business | $4,308.00 | DUPLICATE_PAYMENT_HIGH | HIGH |
| 2024-08-12 | Uber Business | $4,228.00 | DUPLICATE_PAYMENT_HIGH | HIGH |
- Apex Legal LLCHIGH2024-09-13$7,500.00
DUPLICATE_PAYMENT_HIGH
2 identical $3,750.00 payments to "Apex Legal LLC" inside 8d — exact-amount duplicate payment (vendor + amount + invoice-ref match, no paired refund/reversal in window).
- Enterprise Rent-A-CarHIGH2024-08-03$4,557.00
DUPLICATE_PAYMENT_HIGH
3 near-duplicate payments (~$1,519.00 ± 1%) to "Enterprise Rent-A-Car" inside 25d — small-amount variant of duplicate payment (vendor + amount ± tolerance + window, no paired refund/reversal).
- Marriott HotelsHIGH2024-08-18$4,382.00
DUPLICATE_PAYMENT_HIGH
3 near-duplicate payments (~$1,458.00 ± 1%) to "Marriott Hotels" inside 29d — small-amount variant of duplicate payment (vendor + amount ± tolerance + window, no paired refund/reversal).
- Lyft BusinessHIGH2024-09-17$4,308.00
DUPLICATE_PAYMENT_HIGH
4 near-duplicate payments (~$1,079.00 ± 1%) to "Lyft Business" inside 14d — small-amount variant of duplicate payment (vendor + amount ± tolerance + window, no paired refund/reversal).
- Uber BusinessHIGH2024-08-12$4,228.00
DUPLICATE_PAYMENT_HIGH
3 near-duplicate payments (~$1,414.00 ± 1%) to "Uber Business" inside 23d — small-amount variant of duplicate payment (vendor + amount ± tolerance + window, no paired refund/reversal).
+ 32 more flags produced by this detector on the 2,400-row synthetic ledger.
Ghost employee
6 flags$14,230 exposureGhost-employee detection (fresh-payee + fresh-approver signals surfaced from a single payee/approver first-seen cross-check). LOW: a new vendor first-seen within 14d of dataset end, approved by a stable approver (vendor count ≤ 2). MED: a fresh vendor first-seen within 30d AND an approver first-seen within the same 30d window — but past the HIGH 14d cutoff. HIGH: a fresh vendor AND a fresh approver, both first-seen within 14d of dataset end AND within 14d of each other — the textbook post-cutover / missing-approver-rights ghost-employee signal. ACFE Occupational Fraud 2024 — phantom-employee / segregation-of-duties weakness.
Severity breakdown:CRITICAL0HIGH1MEDIUM1LOW4
Ghost employee
Top findings
| Date | Vendor | Amount | Code | Severity |
|---|---|---|---|---|
| 2024-09-27 | Marlow Vendor Partners LLC | $5,400.00 | GHOST_EMPLOYEE_HIGH | HIGH |
| 2024-09-13 | Halberd Industrial Supply | $3,200.00 | GHOST_EMPLOYEE_MED | MEDIUM |
| 2024-09-27 | Granite State Sourcing LLC | $2,100.00 | GHOST_EMPLOYEE_LOW | LOW |
| 2024-09-28 | Vanta Compliance | $1,850.00 | GHOST_EMPLOYEE_LOW | LOW |
| 2024-09-25 | Retool Inc | $1,200.00 | GHOST_EMPLOYEE_LOW | LOW |
- Marlow Vendor Partners LLCHIGH2024-09-27$5,400.00
GHOST_EMPLOYEE_HIGH
Vendor "Marlow Vendor Partners LLC" first-seen 2024-09-27 and approver "Marcus Holloway" first-seen 2024-09-27 (0d apart, both inside the freshness window) — fresh-payee + fresh-approver inside 14d of dataset end, classic post-cutover ghost-employee signal.
- Halberd Industrial SupplyMEDIUM2024-09-13$3,200.00
GHOST_EMPLOYEE_MED
Vendor "Halberd Industrial Supply" first-seen 2024-09-13 AND approver "Priya Iyer" first-seen inside the dataset (16d before dataset end) — fresh-payee + recently-onboarded approver, ghost-employee MED signal.
- Granite State Sourcing LLCLOW2024-09-27$2,100.00
GHOST_EMPLOYEE_LOW
Vendor "Granite State Sourcing LLC" first-seen 2024-09-27 on a stable approver — fresh-payee single-side signal, ghost-employee LOW watch.
- Vanta ComplianceLOW2024-09-28$1,850.00
GHOST_EMPLOYEE_LOW
Vendor "Vanta Compliance" first-seen 2024-09-28 on a stable approver — fresh-payee single-side signal, ghost-employee LOW watch.
- Retool IncLOW2024-09-25$1,200.00
GHOST_EMPLOYEE_LOW
Vendor "Retool Inc" first-seen 2024-09-25 on a stable approver — fresh-payee single-side signal, ghost-employee LOW watch.
+ 1 more flag produced by this detector on the 2,400-row synthetic ledger.
Security & trust
See this on your own ledger
Run your real samples through the same detectors
On a 20-minute demo, the VeraStream operator runs your actual expense or card feed through the same agent and shows you which of these catches trip against your spend.