> ## Content Index
> Fetch the complete content index at: https://www.agilebrainsconsulting.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How a utility turned a 216,000-invoice blind spot into a ranked audit queue
- URL: https://www.agilebrainsconsulting.com/case-studies/utility-invoice-anomaly-detection/
- Published: 2026-10-23T14:49:28.000Z
- Updated: 2026-10-23T15:13:29.000Z
- Description: Manual review reached only a small sample of a high-value invoice stream. In a proof of concept, Agile Brains built a machine-learning framework that screened all 216,000 records and narrowed them to 1,847 transactions ranked for audit.
- Author: Lara Hill
- Tags: #case-study, Utilities

A large East Coast electric and gas utility reviewed its invoices by hand: a small sample of a large, high-value stream, with most transactions never checked at all. In a proof of concept on the utility's historical data, we built a machine-learning framework that screens every transaction and tells auditors where to look first.

## The challenge

The utility's accounting and compliance teams relied entirely on manual review to catch fraud, policy violations and billing errors across roughly $35 million in monthly spend. Auditors could only sample a fraction, so most invoices and work orders received no review at all.

Cross-referencing purchase orders, receiving logs, permits and invoices across disconnected systems was done by hand, one invoice at a time. Patterns such as collusive approvals or split billing, which only show up across hundreds of creator-approver pairs, were effectively impossible to catch. When anomalies were found, it was often weeks later, after the invoice had already been paid in full.

## How we helped

Rather than sample, we built a hybrid, defense-in-depth framework that checks every transaction from several independent angles: six models across three analytical layers of unsupervised clustering, statistical modeling and deep-learning autoencoders. Each model targets a distinct pattern:

- **Point and temporal outliers**, using K-Means clustering with ARIMA time-series modeling.
- **Delegation-of-authority bypass**, such as self-approvals, limit circumvention and collusive creator-approver circles, using behavioral clustering.
- **Robotic approvals** that happen almost instantly, using behavioral clustering.
- **Multi-variable price and compliance deviations**, including work orders missing active permits, using principal component analysis.
- **Billing before delivery**, by reconciling invoiced quantities against receiving records with rules-based checks.
- **Non-linear price gouging and work-order slicing**, using dual autoencoders.

![Diagram: a dense cloud of transactions passes through clustering, statistical and deep-learning screens, narrowing to a ranked audit queue.](https://storage.ghost.io/c/e4/2d/e42df399-b545-4436-aee1-6737869588bf/content/images/2026/10/case-utility-invoice-anomaly-web.jpg)

The framework runs on cloud-native machine learning at database scale and feeds a single prioritized, human-readable audit queue. A person reviews every flag, and every flag traces back to the underlying transaction with an explanation of why it was surfaced, not just that it was.

**Designed for production.** Around the models, we designed the pipeline to run continuously: a data-conformance stage, model scoring, a detected-anomalies queue, audit-team review, and a feedback loop that uses confirmed true and false positives to retrain the models and refine the data rules for the next cycle.

## The result

The proof of concept took 216,000 historical invoice records and progressively narrowed them to 1,847 transactions ranked for audit review, turning an opaque financial stream into a short, explainable worklist. Auditors can spend their time where the risk is. The framework also surfaced the kinds of patterns manual review can't see, including self-approvals, collusive approval circles, limit circumvention, billing before delivery, work-order slicing and price gouging, several of which only emerge across the full population.

Run continuously, database-scale scoring moves detection toward the point of transaction, before payment, instead of a forensic review weeks later. This was a proof of concept on historical data: it demonstrated the framework and produced the ranked queue, and flagged transactions remain subject to audit confirmation. Operating it as a continuous production pipeline is the recommended next step.

**By the numbers**

- 216,000 historical invoice records screened, every one rather than a sample
- 1,847 high-priority transactions surfaced and ranked for audit
- 6 detection models across 3 analytical layers
- About $35 million in monthly spend brought under review
- Human review on every flag, with confirmed outcomes feeding back into the models