Rules explain, models find
We use two kinds of test, and each covers the other's blind spot.
Explainable rules state a condition in plain terms: an entry posted between 22:00 and 05:00, an invoice within 2% below an approval limit, a vendor whose bank account matches an employee's. Anyone can check why a rule fired. But rules only find what someone thought to look for.
Statistical outlier models score each transaction against the pattern for its account, vendor and user. They catch the item nobody wrote a rule for, such as a modest payment released by a user who never pays that vendor, at an hour that user never works. Models are harder to explain, so we never report a model flag without the analyst's account of what made it unusual.
A flag reads like a question
Here is an illustrative entry from an exception register:
Journal entry 4471, posted Sunday 30 June at 23:48 by user sr.accountant and approved by sr.accountant. Reclasses $18,400 of freight from cost of goods sold to the prior period. No supporting schedule attached. Reversed 2 July. Similar entries on the last Sunday of March and December. Consequence: high. Pattern suggests a period-end margin adjustment without independent review.
The entry may have a legitimate explanation. The register exists to make the question impossible to skip. The Sunday-night entries scenario follows a pattern like this one through to its fix.
Sensitive data stays tightly held
The data completeness memo comes first for a reason. A test run on an incomplete extract can miss exactly the entries that matter, so totals are reconciled to the trial balance before any rule runs.
The tests also need sensitive data: payroll, bank details, vendor tax IDs. We process it in access-logged environments, restrict payroll and bank fields to the analysts who need them, never use it to train external AI models, and delete it 90 days after the engagement closes unless you ask otherwise in writing. Any finding that names an employee goes only to the contact you designated at scoping.
The diagnostic becomes a baseline
A diagnostic tells you what happened in one period. Once the tests are tuned and the noise removed, they earn more by running again: monthly, on the same rules, with each exception sent to a named owner. That is what our continuous controls monitoring subscription does. The article on ten automated tests lists the ones we usually start with.