How a utility turned a 216,000-invoice blind spot into a ranked audit queue

A large East Coast electric and gas utility reviewed its invoices by hand: a small sample of a large, high-value stream, with most transactions never checked at all. In a proof of concept on the utility's historical data, we built a machine-learning framework that screens every transaction and tells auditors where to look first.

The challenge

The utility's accounting and compliance teams relied entirely on manual review to catch fraud, policy violations and billing errors across roughly $35 million in monthly spend. Auditors could only sample a fraction, so most invoices and work orders received no review at all.

Cross-referencing purchase orders, receiving logs, permits and invoices across disconnected systems was done by hand, one invoice at a time. Patterns such as collusive approvals or split billing, which only show up across hundreds of creator-approver pairs, were effectively impossible to catch. When anomalies were found, it was often weeks later, after the invoice had already been paid in full.

How we helped

Rather than sample, we built a hybrid, defense-in-depth framework that checks every transaction from several independent angles: six models across three analytical layers of unsupervised clustering, statistical modeling and deep-learning autoencoders. Each model targets a distinct pattern:

• Point and temporal outliers, using K-Means clustering with ARIMA time-series modeling.
• Delegation-of-authority bypass, such as self-approvals, limit circumvention and collusive creator-approver circles, using behavioral clustering.
• Robotic approvals that happen almost instantly, using behavioral clustering.
• Multi-variable price and compliance deviations, including work orders missing active permits, using principal component analysis.
• Billing before delivery, by reconciling invoiced quantities against receiving records with rules-based checks.
• Non-linear price gouging and work-order slicing, using dual autoencoders.

The framework runs on cloud-native machine learning at database scale and feeds a single prioritized, human-readable audit queue. A person reviews every flag, and every flag traces back to the underlying transaction with an explanation of why it was surfaced, not just that it was.

Designed for production. Around the models, we designed the pipeline to run continuously: a data-conformance stage, model scoring, a detected-anomalies queue, audit-team review, and a feedback loop that uses confirmed true and false positives to retrain the models and refine the data rules for the next cycle.

The result

The proof of concept took 216,000 historical invoice records and progressively narrowed them to 1,847 transactions ranked for audit review, turning an opaque financial stream into a short, explainable worklist. Auditors can spend their time where the risk is. The framework also surfaced the kinds of patterns manual review can't see, including self-approvals, collusive approval circles, limit circumvention, billing before delivery, work-order slicing and price gouging, several of which only emerge across the full population.

Run continuously, database-scale scoring moves detection toward the point of transaction, before payment, instead of a forensic review weeks later. This was a proof of concept on historical data: it demonstrated the framework and produced the ranked queue, and flagged transactions remain subject to audit confirmation. Operating it as a continuous production pipeline is the recommended next step.

By the numbers

• 216,000 historical invoice records screened, every one rather than a sample
• 1,847 high-priority transactions surfaced and ranked for audit
• 6 detection models across 3 analytical layers
• About $35 million in monthly spend brought under review
• Human review on every flag, with confirmed outcomes feeding back into the models