Field Note
Choosing Anomaly Thresholds Before the First Chart
Why agreeing on velocity and concentration limits during scoping prevents revision cycles that delay committee delivery.
Internal audit teams often arrive at our scoping call with a general mandate—"find suspicious transactions"—but without numeric thresholds. That vagueness becomes expensive when draft charts arrive and the compliance officer realizes the velocity spike definition was half the committee's actual concern.
We recommend resolving four threshold questions before data transfer:
Payment velocity. How many transactions to the same beneficiary within what window triggers review? Common starting points are three payments within 48 hours or five within seven days, but municipal procurement offices often use tighter windows during contract award seasons.
Concentration limits. What percentage of total outflows to a single beneficiary raises concern? Manufacturing clients frequently use 8–12% of quarterly outflows; banking clients may use absolute KRW amounts instead.
Geographic scope. Should cross-province payments flag automatically, or only when the beneficiary lacks prior payment history? Regional organizations often care about cross-border wires; municipal offices focus on within-province anomalies.
Round amounts. Flagging payments ending in repeated zeros catches structuring patterns but produces noise in payroll cycles. Agree whether payroll dates should be excluded from round-amount passes.
Documenting these decisions in the scope memo takes twenty minutes on a call. Rebuilding eight charts because thresholds shifted mid-project takes a week. The memo also gives your committee a reference when they ask why a particular cluster appeared on the folio.
If you are unsure where to start, bring your last external audit finding letter. The thresholds auditors questioned previously usually indicate where your committee already expects visual evidence.
