PaperlayerView exact revision on arXiv

Source-linked AI summary

Anomaly Detection in General Ledger Data: Results from a Hybrid Approach

Jan Gronewald, Alexander Michael Rombach, Sebastian Stephan, Peter Fettke

arXiv:2609.18228v1cs.LG

TL;DR

JETs can generate extensive review lists because they target known patterns, and combining them with ML has received less attention. The paper evaluates two hybrid designs on synthetic data; its H2 Isolation Forest detects all anomalies while reducing false positives, although real-world effectiveness remains uncertain.

  • Problem

    JETs rely on known patterns and can produce many false positives, while combining rule-based tests with ML has received less attention.

    Source: §I · p. 2, Journal entry testing · p. 4

  • Method

    The authors test H1, which intersects independent JET and ML results, and H2, which adds JET-result features to ML training, using synthetic data.

    Source: §I · p. 3, Overview · p. 6

  • Results

    In H2, Isolation Forest detected all anomalies while reducing FPs from 10,019 to 1,881 entries; overall, hybrids slightly improved detection versus dedicated JETs and ML methods.

    Source: Discussion · p. 18, V.CONCLUSION AND FUTURE WORK · p. 20

  • Takeaways & Limitations

    H2 achieved complete anomaly detection with Isolation Forest, but the result-list delta should still be checked for material misstatements.

    Source: Discussion · p. 18

    The synthetic data may not capture real financial-transaction complexity, leaving effectiveness and reliability in real-world audits uncertain.

    Source: Limitations · p. 20

Abstract

from arXiv · show

Journal Entry Tests (JETs) are a mandatory part of annual audits to evaluate and assess both highrisk audit areas and potential material misstatements. However, as JETs are designed to detect known patterns based on domain knowledge, the resulting lists are often very large and require substantial additional effort from the auditor. To ensure the economic efficiency of the audit, the number of false positives in JET result lists must be reduced. Especially machine learning (ML) methods represent a promising approach to improve anomaly detection in this field. In this research in progress paper, we investigate different approaches on how to combine JETs with ML-methods in a hybrid manner. We present specialized models to increase the detection performance and validity of anomaly detection results to improve audit efficiency. The experiments are based on synthetic data consisting of different normal and anomalous journal entries.

I. INTRODUCTION

Journal entry tests (JETs) are mandatory but rely on known patterns and can produce large result lists that burden auditors. The paper investigates combining JETs with machine learning to reduce false positives and improve audit efficiency.

I. INTRODUCTION

  • The paper addresses the underexplored combination of rule-based and ML-based methods to improve JET efficiency without compromising test quality or reliability.The broader motivation also includes reducing false positives so auditors can focus on genuinely suspicious entries.Source: §I · p. 2
  • The proposed hybrids intersect independently generated JET and ML anomaly lists in H1 or add JET-result features to ML training in H2.Both approaches are evaluated on synthetic data, with expected reductions in false positives and false negatives.Source: §I · p. 3

Journal entry testing

  • JETs are mandatory audit procedures for assessing material-misstatement risk in individual journal entries.The audit objective includes evaluating whether financial statements are free from material misstatement, whether intentional or unintentional.Source: §I · pp. 1–2, Journal entry testing · p. 4
  • Known-pattern rules and filter criteria limit JETs and can generate many false positives for auditors to review.The resulting lists require substantial additional effort and longer processing times.Source: §I · p. 2, Journal entry testing · p. 4

Anomaly detection

Prior anomaly-detection research spans statistical, process-mining, machine-learning, graph, and autoencoder approaches. The paper investigates the less-explored combination of JETs with ML, using two distinct hybrid designs.

Anomaly detection

  • Prior work applies EVT, red-flag analysis with process mining, ML algorithms, and graph topology to journal-entry anomaly detection.Examples include clustering and classification for imbalanced data and structural relationships between entries.Source: Anomaly detection · p. 4
  • Autoencoder research includes SAP anomaly detection, variational-autoencoder combinations with LSTMs, and training on account-prefiltered journal entries.Other work evaluated deep autoencoders and Isolation Forest alongside supervised methods using synthetic anomalies.Source: Anomaly detection · p. 5
  • The authors state that, to their knowledge, hybrid JET-and-ML approaches such as those involving autoencoders had not yet been considered.They investigate whether combining the approaches can leverage their advantages to reduce false positives.Source: Anomaly detection · pp. 5–6

Overview

  • H1 intersects anomalies identified independently by JETs and ML, while H2 feeds JET-result-list features into ML models.The overview presents these as two hybrid approaches following separate applications of JETs and ML methods.Source: Overview · p. 6

Business Case Study

The synthetic case study models a garden-tools trading company with selected business cases, accountants, and JET patterns. Synthetic postings and anomalies are generated under specified assumptions to evaluate the detection methods.

Business Case Study

  • The case study models a garden-tools trading company across merchandise purchases and sales, payments, and various expenses.It assigns six accountants to the business cases, with responsibilities and posting frequencies determined randomly.Source: Business Case Study · pp. 6–7
  • Four selected JETs flag highest-value postings, large cash-account disbursements, untimely postings, and postings at unusual times or on unusual days.Their selection was intended to align the tests with the simulated transactions.Source: Business Case Study · p. 7

Generation of synthetic data and anomalies

  • Because real posting data were unavailable, the authors generated synthetic data based on general accounting logic and their domain knowledge.The simulation assumes one year of postings and uses static item prices and probability distributions for timing and posting counts.Source: Generation of synthetic data and… · pp. 7–8
  • The generator produced 51,076 business transactions comprising 127,835 posting lines, with entries represented by two or three lines.The simulation varies posting behavior across defined cases, including timing and seasonal weights.Source: Generation of synthetic data and… · p. 9
  • The authors generated 573 labeled anomalies by changing postings to create attribute combinations absent from the generated data, using the four JET patterns.Examples include altered users or accounts, less-prompt posting, underrepresented user-account combinations, and unusual weekend postings.Source: Generation of synthetic data and… · pp. 9–10

Data preprocessing

Preprocessing removes or transforms fields before model training, then represents each journal entry as a padded, document-level feature vector. H2 adds JET-result indicators to the baseline feature set.

Data preprocessing

  • Preprocessing removes date, account, reference, text, and posting identifiers, while adding the document-to-entry date difference as a feature.The entries are merged at document level, so posting identifiers used only to group lines are unnecessary for the models.Source: Data preprocessing · pp. 10–11
  • Categorical fields are one-hot encoded, while date difference and amount are scaled with RobustScaler and then MinMaxScaler to [0;1].One-hot encoding covers account name, debit/credit flag, user, and tax rate.Source: Data preprocessing · p. 11
  • Document-level entries are concatenated and padded to three transactions, producing 92-feature baseline vectors and 104-feature vectors for H2.Categorical padding uses a PAD category and amount columns use zero; H2 adds one-hot JET success-or-failure indicators.Source: Data preprocessing · pp. 11–12

Anomaly detection pipeline

The pipeline combines threshold-based JETs with unsupervised models to identify potentially anomalous journal entries. The ML approaches include reconstruction, isolation, and density-clustering methods.

Journal Entry Tests

  • JETs flag large entries, high cash disbursements, delayed postings, and entries outside regular working hours for closer review.The experiment used a threshold of n=1,000 for J1 and an amount above 1,500 euros for J2; postings more than 10 days late were not considered prompt.Source: Journal Entry Tests · p. 12
  • JET result lists can contain many records, so the approach targets reducing false positives and false negatives to improve operational efficiency.The passages caution that flagged entries are not automatically fraudulent or anomalous.Source: Journal Entry Tests · pp. 12–13

Machine learning Approaches

  • The study uses unsupervised Deep Autoencoder, Isolation Forest, and HDBSCAN models because real-world audit data is usually unlabeled and models are trained per audit mandate.The paper does not aim to produce a generally valid model.Source: Machine learning Approaches · p. 13
  • The Deep Autoencoder compresses journal-entry features into a latent representation and reconstructs them, with reconstruction error used to assess entries.Its input feature vector had length 92 for the baseline and H1, and 104 for H2.Source: Machine learning Approaches · p. 13
  • Isolation Forest scores entries by how quickly random partitions isolate them, while HDBSCAN flags entries outside high-density regions as anomalies.The Isolation Forest used 650 trees and auto contamination; HDBSCAN used a minimum cluster size of 12.Source: Machine learning Approaches · p. 14

Hybrid Approaches

The paper tests two ways to combine rule-based JETs with ML: intersecting their flagged entries or adding JET-derived information to model features. It evaluates detection with class-balanced metrics suited to imbalanced data.

Hybrid Approaches

  • The hybrid rationale is that JETs identify known rule-based issues while ML can uncover previously unknown patterns and correlations.The paper presents the combination as a way to examine anomalies from different perspectives.Source: Hybrid Approaches · pp. 14–15
  • H1 intersects independent JET and ML result lists, whereas H2 adds JET-derived features to ML training rather than intersecting lists.For J3, H2 labels postings according to the prompt-posting thresholds; both approaches are compared with ML and JET baselines.Source: Hybrid Approaches · p. 15

Evaluation metrics

  • The evaluation uses precision, recall, F1, and ROC-AUC, with macro averages weighting normal and anomalous classes equally.The task is binary classification, and Deep Autoencoder anomalies are labeled when reconstruction error exceeds the dataset's 99th percentile.Source: Evaluation metrics · pp. 15–16

IV.EVALUATION

H2 delivered the strongest overall results in the reported comparison: Isolation Forest detected all injected anomalies while substantially reducing false positives. The discussion also identifies residual review needs and trade-offs among the approaches.

Results

  • The JET baseline found all 573 synthetic anomalies but also produced 10,019 false positives for auditor review.This full anomaly detection was expected because anomalies were injected only inside JET result lists.Source: Results · p. 16
  • Isolation Forest led in recall and ROC-AUC, while the Deep Autoencoder had the strongest precision and F1; HDBSCAN produced average results of 51–53%.Isolation Forest's strong recall came with low precision, and the paper notes that HDBSCAN's results may reflect default parameter settings.Source: Results · pp. 17–18
  • H2 increased true-positive detection across models compared with plain ML and H1, while H1 reduced false positives without improving true-positive or false-negative counts.The discussion reports that H1 still left 19 anomalies undetected.Source: Results · p. 17, Discussion · p. 18

Discussion

  • The authors say the residual result-list delta should still be checked because it may contain high-value errors.The Deep Autoencoder also remained far from detecting all anomalies despite its stronger precision and F1 performance.Source: Discussion · pp. 18–19
  • Isolation Forest in H2 detected all 573 anomalies and reduced false positives from 10,019 to 1,881 entries.The H2 variant had 667 more false positives than H1 in exchange for complete anomaly detection.Source: Discussion · p. 18, Results · p. 18
  • The remaining 1,881 H2 Isolation Forest false positives included 1,571 entries where at least one JET scored a hit and 284 tied to purchases or sales of a specific item.The other 26 entries were distributed across cases and would require deeper analysis for precise explanations.Source: Discussion · p. 19

Limitations

The approach is constrained by simplified synthetic data and default modeling choices, and its applicability to real journal entries and audit settings remains uncertain.

Limitations

  • Synthetic postings reflect a well-defined, less-complex context, with randomly generated values and limited variation in accounts, users, and amounts.More demanding cases, including discounts, goods complaints, and ancillary bookings, could add depth.Source: Limitations · p. 19
  • Fraudulent entries may resemble regular bookings, making transaction context necessary when considering anomalous journals.The extent to which anomalous journals can be detected remains unclear across transaction types and anomaly patterns.Source: Limitations · pp. 19–20
  • The ML models use default parameters and standard preprocessing, including one-hot encoding and concatenation of related postings.The authors suggest entity or large-language-model embeddings as possible improvements.Source: Limitations · p. 20
  • Real-world journal-entry data and audit-setting applicability remain uncertain, so the approaches still need validation beyond the synthetic setting.The authors call for refinement and validation using more nuanced synthetic and genuine data.Source: Limitations · p. 20

V.CONCLUSION AND FUTURE WORK

The paper reports that hybrid anomaly detection can slightly improve anomaly detection relative to dedicated JET and ML implementations, using synthetic data. Future work will broaden the data, methods, and hybrid designs and evaluate them on real-world data.

V.CONCLUSION AND FUTURE WORK

  • Hybrid approaches slightly improve anomaly detection over standard implementations of dedicated JETs and ML methods in experiments using synthetic data.The paper frames these approaches as a way to reduce false positives in JET result lists.Source: V.CONCLUSION AND FUTURE WORK · p. 20
  • Future work will refine synthetic-data generation, evaluate on real-world data, and test additional JETs and ML methods.The authors also plan a hybrid that uses JETs as prefilters and trains ML models on the resulting lists.Source: V.CONCLUSION AND FUTURE WORK · pp. 20–21

NUMBERED FIGURES

Figure 1 is identified as an overview of the experimental design.

NUMBERED FIGURES

  • Figure 1 is an overview of the experimental design.The supplied passage does not specify the design components shown.Source: Figure 1 · p. 27

NUMBERED TABLES

The supplied table passages identify Table 1 as covering data attributes and Table 2 as an overview of generated postings; the available material does not describe Table 3's contents.

NUMBERED TABLES

  • Table 2 overviews generated postings across business cases with varied account, calendar, user, and item settings.The listed settings include weekdays or weekends, months, users, and single or multiple items.Source: NUMBERED TABLES · pp. 29–30, Table 2

Related papers

Loading 2609.18228v1…