One unusual transaction may be noise: a legitimate exception, a one-time event, an operational anomaly with an innocent explanation. Two unusual transactions of the same type are a coincidence worth noting. Three are a pattern. And a pattern, in forensic analysis, is a hypothesis that demands investigation.
The Anomaly Problem exists because traditional controls and audits are designed to evaluate individual transactions, not patterns across transactions. The three-way match tests whether this PO matches this GRN matches this invoice. It does not test whether 15 invoices from the same vendor over six months, all posted by the same user, all at amounts just below the approval threshold, all on the last day of each month, constitute a pattern that no legitimate business process would produce.
The individual transaction passes every control. The pattern fails every reasonable test of normalcy. And the pattern is invisible to any review that examines transactions individually rather than collectively.
Detecting Patterns
Statistical outliers
Transactions whose amounts, timing, counterparties or characteristics fall outside the normal distribution for their category. A vendor whose average invoice is Rs 4.9 lakh when the approval threshold is Rs 5 lakh has a statistical concentration just below the control limit that is unlikely to be coincidental.
Behavioural clustering
Transactions that cluster around specific dates (period-end), specific users (a single individual), specific accounts (revenue, provisions, intercompany) or specific counterparties (a small set of vendors receiving disproportionate payment volume). The clustering reveals behaviour that the individual transactions do not show.
Temporal patterns
Transactions that follow a regular cadence: the same amount, to the same counterparty, on the same day each month. Or transactions that spike at predictable intervals: quarter-end revenue bursts, month-end journal entry concentrations, year-end provision reversals. The regularity of the pattern is the signal. Genuine commercial activity is irregular. Managed activity is rhythmic.
Absence patterns
The absence of expected activity can be as significant as the presence of unusual activity. A vendor who normally invoices monthly but stops invoicing for three months, then resumes with a catch-up invoice, may be concealing a period of non-delivery. A customer who normally pays within 30 days but delays for 90 days before a large payment arrives may be part of a coordinated timing arrangement.
In Northrop Management Private Limited's forensic analytics practice, the Anomaly Problem is addressed through full-population pattern analysis. Rather than sampling individual transactions and testing them against controls, the methodology analyses the complete transaction dataset for patterns that emerge only at scale: statistical concentrations, behavioural clusters, temporal rhythms and absence signals.
The output is not a list of failed transactions. It is a list of patterns, each of which constitutes a hypothesis about the behaviour of the people, processes and counterparties involved.
Ashish Chaudhary, frames the analytical principle directly: "One unusual transaction may be noise. A pattern is a hypothesis. And a hypothesis, investigated with forensic rigour, is either confirmed (the pattern reflects misconduct) or refuted (the pattern has an innocent explanation). Either outcome is valuable. The first identifies the problem. The second eliminates the suspicion."
Closing Implication
The most important fraud signal is often not a transaction. It is a pattern that no legitimate business process would produce: a statistical concentration, a behavioural cluster, a temporal rhythm or a conspicuous absence. The pattern is invisible to any analysis that examines transactions individually. It becomes visible only to an analysis that examines the full population collectively. And the visibility of the pattern is what separates a forensic investigation that finds the mechanism from one that merely reports the symptoms.
