Source-linked AI summary
Detection of Anomalies in Large Scale Accounting Data using Deep Autoencoder Networks
Marco Schreyer, Timur Sattarov, Damian Borth, Andreas Dengel, Bernd Reimer
TL;DR
Handcrafted fraud tests often fail to generalize beyond known cases, motivating a more adaptive way to flag anomalous journal entries. The paper scores entries with deep-autoencoder reconstruction error regularized by attribute probabilities and reports f1-scores of 32.93 (dataset A) and 16.95 (dataset B), with fewer false-positive alerts than state-of-the-art baselines.
Problem
Handcrafted journal-entry techniques based on known fraud scenarios often fail to generalize beyond historical cases.
Source: §1 · p. 2Method
The method scores journal entries using deep-autoencoder reconstruction error regularized by each entry’s individual attribute probabilities.
Source: §1 · p. 3Results
The approach achieved f1-scores of 32.93 in dataset A and 16.95 in dataset B, with fewer false-positive alerts than state-of-the-art baseline methods.
Source: §6 · p. 16Takeaways & Limitations
Auditor and forensic-accountant feedback indicated that the method captures journal entries relevant for detailed follow-up audits.
Source: §6 · p. 16The approach assumes that most recorded journal entries are normal.
Source: §3.2 · p. 6
Abstract
from arXiv · showhide
Learning to detect fraud in large-scale accounting data is one of the long-standing challenges in financial statement audits or fraud investigations. Nowadays, the majority of applied techniques refer to handcrafted rules derived from known fraud scenarios. While fairly successful, these rules exhibit the drawback that they often fail to generalize beyond known fraud scenarios and fraudsters gradually find ways to circumvent them. To overcome this disadvantage and inspired by the recent success of deep learning we propose the application of deep autoencoder neural networks to detect anomalous journal entries. We demonstrate that the trained network's reconstruction error obtainable for a journal entry and regularized by the entry's individual attribute probabilities can be interpreted as a highly adaptive anomaly assessment. Experiments on two real-world datasets of journal entries, show the effectiveness of the approach resulting in high f1-scores of 32.93 (dataset A) and 16.95 (dataset B) and less false positive alerts compared to state of the art baseline methods. Initial feedback received by chartered accountants and fraud examiners underpinned the quality of the approach in capturing highly relevant accounting anomalies.
1 Motivation
The section motivates anomaly detection in journal entries because handcrafted techniques based on known fraud scenarios often fail to generalize. It proposes deep autoencoders and an adaptive score combining reconstruction error with attribute probabilities.
1 Motivation
- Fraud is estimated to cost a typical organization 5% of annual revenues; PwC also reported that 22% of respondents experienced losses between $100’000 and $1 million.The cited study found financial statement fraud had the highest median loss among surveyed fraud schemes.Source: §1 · pp. 1–2
- Handcrafted red-flag tests and statistical analyses based on known fraud scenarios often fail to generalize beyond historical fraud cases.These approaches are commonly used to examine journal entries.Source: §1 · p. 2
- Deep autoencoders are proposed to detect anomalous journal entries in large-scale accounting data, supplementing accountants’ and forensic examiners’ tools.The proposal draws inspiration from deep learning’s use of complex nonlinear features.Source: §1 · p. 3
- The anomaly score combines a trained autoencoder’s reconstruction error with each entry’s individual attribute probabilities, adapting to varying distributions and enabling threshold-based flags.The method is evaluated on two anonymized real-world journal-entry datasets from large-scale SAP ERP systems against state-of-the-art anomaly-detection algorithms.Source: §1 · p. 3
2 Related work
The review covers ERP-based fraud detection and autoencoder anomaly detection, then identifies a need for unsupervised approaches to previously unknown fraudulent journal-entry scenarios. It presents this work as a first deep-learning-inspired approach for anomalous journal entries in real-world, large-scale accounting data.
2 Related work
- The review focuses on fraud detection in ERP data and anomaly detection using autoencoder networks, against a broader background of practitioner and academic work.It frames these as two strands of research on accounting anomalies.Source: §2 · p. 3
2.1 Fraud Detection in Enterprise Resource Planning (ERP) Data
- ERP approaches include account-level Naive Bayes and link analysis,, SAP user profiling,, and red-flag matching for known scenarios.These studies use journal-entry activity or system audit logs to identify suspicious accounts, behavior, or fraud scenarios.Source: §2.1 · pp. 3–4
- Other ERP studies examine Benford’s Law and posting patterns,, cluster purchase-order transactions,, or use self-organizing maps and extreme-value thresholds,.The methods flag unusual amounts, temporal patterns, transactions, or journal entries for review.Source: §2.1 · p. 4
- The review identifies demand for unsupervised approaches that detect previously unknown fraudulent journal-entry scenarios, beyond historical red flags and traditional techniques.Source: §2.1 · p. 4
2.2 Anomaly Detection using Autoencoder Neural Networks
- Autoencoders progressed from anomaly-detection proposals, to benchmark and forensic applications in images, video, and export controls,,,,, [16],.A filter layer and regularization penalty were also proposed for anomaly detection.Source: §2.2 · pp. 4–5
- The paper presents a first deep-learning-inspired approach to detect anomalous journal entries in real-world, large-scale accounting data.Source: §2.2 · p. 5
3 Detection of Accounting Anomalies
The section describes autoencoders for reconstructing journal entries and a scoring method that combines attribute-value rarity with reconstruction error. It treats anomalies as rare individual values or unusual combinations against a background of mostly routine entries.
3.1 Deep Autoencoder Neural Networks
- An autoencoder compresses an entry into a latent representation and decodes it into a reconstruction, with training aimed at minimizing their dissimilarity.A bottleneck constrains hidden-layer size to prevent identity mapping and learn a compressed model of prevalent attribute-value distributions and dependencies; experiments use cross-entropy loss for binary-encoded values.Source: §3.1 · p. 6
3.2 Classification of Accounting Anomalies
- The method assumes most ERP journal entries reflect routine activity and distinguishes anomalies with rare individual values from those with unusual combinations of otherwise frequent values.The paper notes that global anomalies can include errors, while local anomalies may pose higher fraud risk because they can imitate regular activity patterns.Source: §3.2 · p. 7
3.3 Scoring of Accounting Anomalies
- Each entry’s score combines normalized reconstruction error with a min-max-normalized sum of attribute-value log probabilities, targeting rare values and unusual co-occurrences.The method uses reconstruction error to capture irregular combinations that the network has not learned effectively.Source: §3.3 · p. 8
4 Experimental Setup and Network Training
The experiments used two SAP ERP journal-entry datasets, prepared with anonymized categorical attributes and injected synthetic anomalies. Nine autoencoder architectures were trained and assessed by reconstruction behavior.
4.1 Datasets and Data Preparation
- Both datasets cover a full fiscal year of SAP ERP journal entries; attributes were irreversibly hashed and balances reconciled against standard trial-balance reports.Dataset A has 307,457 line items and six categorical attributes; dataset B has 172,990 line items and ten.Source: §4.1 · pp. 9–10
- Categorical attributes were one-hot encoded, yielding 401 dimensions for dataset A and 576 for dataset B.Six attributes were selected for A and ten for B from the BKPF and BSEG tables.Source: §4.1 · pp. 9–10
- Synthetic anomalies supplied ground-truth labels: dataset A contained 95 and dataset B 100, amid highly unbalanced regular-entry populations.Global anomalies used attribute values absent from the original data; local anomalies used combinations of attribute-value subsets absent from it.Source: §4.1 · p. 10
4.2 Autoencoder Neural Network Training
- Training targeted low reconstruction error, 100% recall of synthetic entries, and high precision to reduce false-positive alerts.Nine architectures ranged from shallow AE 1 to deep AE 9; each was trained up to 2,000 epochs with five initialization seeds.Source: §4.2 · pp. 10–11
- Increasing hidden-unit counts sped error convergence and reduced detected anomalies; dataset B attributes with fewer distinct values were learned faster.For example, one attribute with 19 distinct values was learned more slowly than one with two.Source: Figure 3 · p. 10, §4.2 · p. 11
- AE 8 reconstructed most regular entries but failed to reconstruct global and local anomalies as training progressed.Figure 4 follows reconstruction error across 10, 100, and 400 epochs for 307,457 entries in dataset A.Source: Figure 4 · p. 11, §4.2 · p. 12
5 Experimental Results
Across both datasets, AE 9 produced fewer false-positive detections than the evaluated baselines while retaining full recall of synthetic anomalies. Qualitative review found both rare individual values and unusual combinations among flagged entries.
5.1 Quantitative Evaluation
- With 100% recall, AE 9 detected 0.16% of dataset A and 0.62% of dataset B as anomalous; increasing network depth reduced detections.Table 2 identifies AE 9 as the best-performing architecture, with 17 hidden layers and LReLU activations.Source: §5.1 · p. 13, Table 2 · p. 13
- Latent activations showed distinctive patterns for global, local, and regular entries after training, including at 2,000 epochs.The reported mean activations for the three classes were [−12.99, −20.57, −50.55], [−15.09, 18.99, 23.40], and [−1.67, 37.28, 44.76], respectively.Source: §5.1 · p. 13
5.2 Qualitative Evaluation
- Most reviewed global anomalies had one or two rare attribute values; other cases included posting errors, unusual document types, and missing currency information.The authors said the latter observations indicated a weak control environment around certain processes at the investigated organization.Source: §5.2 · p. 14
- Reviewed local anomalies combined frequently observed attributes in rare ways, including unusual currency, company-code, date-lag, and rental-payment patterns.Initial auditor feedback supported the relevance of these instances from audit and forensic perspectives.Source: §5.2 · p. 14
5.3 Baseline Evaluation:
- AE 9 detected 176 fewer false positives on dataset A and 97 fewer on dataset B than OC-SVM; OC-SVM and AE 9 had the best ROC-AUC results for both datasets.The comparison selected methods with 100% recall of synthetic anomalies and the best obtainable ROC-AUC.Source: Table 3 · p. 14, §5.3 · p. 15
6 Conclusion and Future Work
Evaluation on two real-world accounting datasets found that deep-autoencoder reconstruction error can provide an adaptive anomaly assessment, with auditors judging detected entries relevant for follow-up. Future work will investigate latent representations and evaluate newer autoencoder architectures.
6 Conclusion and Future Work
- 32.93 and 16.95 f1-scores in datasets A and B, respectively, were superior to state-of-the-art baseline methods.The authors also report that auditors and forensic accountants considered detected entries highly relevant for detailed follow-up audits.Source: §6 · p. 16
- Future work will investigate autoencoders’ latent manifolds for insights into accounting-data structures and underlying business processes.Source: §6 · p. 16
- The authors also plan to evaluate anomaly detection with newer architectures, including adversarial autoencoder neural networks.Source: §6 · p. 16
- Automated, high-precision anomaly detection may save auditors time and decrease the risk of fraudulent financial statements.Source: §6 · p. 16
- The code used to train and evaluate the models is available online.Source: §6 · p. 16