Context Brief: Financial Anomaly Investigation

content/demos/financial-anomaly-investigation-demo.json

{
  "raw_materials": {
    "key_facts": [
      {
        "label": "Vendor age",
        "value": "24 days"
      },
      {
        "label": "Invoices",
        "value": "3"
      },
      {
        "label": "Total value",
        "value": "\u00a342,450"
      },
      {
        "label": "Approval threshold",
        "value": "\u00a315,000"
      },
      {
        "label": "Submission window",
        "value": "19 days"
      }
    ],
    "investigation_notes": [
      {
        "from": "Automated fraud detection system",
        "when": "21 days ago",
        "body": "Anomaly flag: three invoices to vendor Lumen Creative Collective (onboarded 24 days ago, no prior payment history) totalling \u00a342,450, each individually below the \u00a315,000 single-invoice approval threshold, submitted within a 19-day window. Flag reason: new vendor + threshold-adjacent invoice values + rapid succession."
      },
      {
        "from": "Analyst (initial review)",
        "when": "18 days ago",
        "body": "Checked with Marketing. Contract on file for the Q3 influencer campaign, signed 26 days ago, approved budget \u00a345,000. Vendor invoiced in three parts rather than one lump sum."
      },
      {
        "from": "Procurement",
        "when": "14 days ago",
        "body": "Confirmed: the finance system enforces a hard \u00a315,000 cap per single invoice submission. Anything above that must be split into multiple invoices regardless of intent \u2014 this is a known system limitation, not something a vendor or team can choose to avoid. Marketing wasn't informed of the cap in advance, which is why the split wasn't flagged internally before submission."
      },
      {
        "from": "Analyst (junior, flagging precedent)",
        "when": "9 days ago",
        "body": "Worth mentioning: a similar-looking case 14 months ago in the Logistics cost centre also involved invoice splitting, and that one turned out to be a confirmed kickback arrangement with a haulage vendor. Resulted in disciplinary action and a restated Q1 figure."
      },
      {
        "from": "Analyst (final check)",
        "when": "today",
        "body": "Vendor confirmed by phone that the three invoices correspond to three distinct contract milestones (concept development, content production, paid distribution). Written confirmation requested by email, no reply yet. Line manager needs the investigation brief for this week's spend review."
      }
    ],
    "reporting_standard": [
      "Anomaly briefs must state a root-cause status of Confirmed, Probable, or Unconfirmed. \u201cProbable\u201d requires supporting evidence beyond the flagged pattern itself; a plausible explanation without corroboration should be reported as Unconfirmed.",
      "Known fraud indicators (new vendor, invoice splitting near an approval threshold, rapid payment succession) must be named when present, but must not be characterised as fraud unless independently confirmed. Indicator presence and confirmed fraud are not the same finding.",
      "Every brief must end with one of three recommended actions: Close (no further action), Monitor (flag for a defined future review point), or Escalate (refer to the audit committee). A brief without one of these three is incomplete."
    ],
    "evidentiary_guide": {
      "do": [
        "State exactly what is confirmed, what is probable, and what is still open",
        "Name the specific fraud indicator present, not just \u201cthis looks suspicious\u201d",
        "Attribute claims to their source (contract, procurement, vendor confirmation) so a reader can judge reliability",
        "Distinguish a similar-looking past case from a comparable one"
      ],
      "dont": [
        "Don't use words like \u201cconcerning\u201d or \u201cirregular\u201d without saying which specific indicator is triggering that read",
        "Don't cite a past case as precedent unless it shares the actual mechanism, not just the surface pattern",
        "Don't recommend \u201cfurther review\u201d without naming what would be reviewed and by when"
      ]
    }
  },
  "presets": [
    {
      "id": "none",
      "label": "No curation",
      "summary": "The full investigation note history, reporting standard and evidentiary language guide, handed over as-is with no framing.",
      "brief": "No brief. The model was given the full investigation note history, the full reporting standard excerpt and the full evidentiary language guide, unedited, with the instruction \u201cwrite the anomaly investigation brief.\u201d",
      "response": "Three invoices totalling \u00a342,450 were submitted to vendor Lumen Creative Collective, a newly onboarded vendor, in a 19-day window. Each invoice was individually below the \u00a315,000 approval threshold, which is a known fraud indicator. This pattern is similar to a case identified 14 months ago in the Logistics cost centre, where invoice splitting was used to conceal a kickback arrangement. Given the similarity, this is a concerning pattern that warrants further review.",
      "verdict": "Root cause: Probable, invoice splitting to avoid approval oversight. Recommended action: Escalate for further review.",
      "critique": "Ignores Procurement's explanation entirely and instead treats the threshold-adjacent splitting as evidence of an approval workaround. Cites an unrelated case as if it were a precedent, when the two share a surface pattern but not a mechanism. \u201cConcerning pattern\u201d doesn't name the specific indicator the standard requires. Closes with \u201cescalate for further review,\u201d which names an action but not what would be reviewed or by whom.",
      "annotations": [
        {
          "id": "n1",
          "type": "gap",
          "label": "Procurement had already confirmed the \u00a315,000 split was a system requirement, not an approval workaround \u2014 this response ignores that.",
          "verdict_span": "invoice splitting to avoid approval oversight"
        },
        {
          "id": "n2",
          "type": "gap",
          "label": "The Logistics case involved a confirmed kickback scheme, a different mechanism entirely \u2014 it isn't a valid precedent here.",
          "response_span": "This pattern is similar to a case identified 14 months ago in the Logistics cost centre, where invoice splitting was used to conceal a kickback arrangement."
        },
        {
          "id": "n3",
          "type": "gap",
          "label": "\u201cConcerning pattern\u201d doesn't name which specific indicator is doing the work, which the standard requires.",
          "response_span": "this is a concerning pattern that warrants further review"
        },
        {
          "id": "n4",
          "type": "gap",
          "label": "\u201cEscalate for further review\u201d doesn't say what would be reviewed or by whom.",
          "verdict_span": "Escalate for further review"
        }
      ]
    },
    {
      "id": "partial",
      "label": "Partial curation",
      "summary": "The core ambiguity is resolved correctly, but the irrelevant precedent isn't excluded and the recommended action has no defined check-in point.",
      "brief": "Situation: Three invoices to vendor Lumen Creative Collective, totalling \u00a342,450, each under the \u00a315,000 approval threshold. Context: Procurement confirmed the finance system enforces a hard \u00a315,000 cap per invoice \u2014 vendors must split any invoice above that regardless of intent. This is a known system limitation, not evidence of an approval workaround.",
      "response": "Three invoices totalling \u00a342,450 were submitted to vendor Lumen Creative Collective within a 19-day window, each below the \u00a315,000 single-invoice threshold. Procurement has confirmed that the finance system enforces a \u00a315,000 cap per invoice, so any invoice above that value must be split \u2014 this explains the pattern independent of any approval workaround. A similar pattern was flagged in the Logistics cost centre 14 months ago, so we should note the resemblance.",
      "verdict": "Root cause: Probable, invoice splitting due to system constraint. Recommended action: Monitor.",
      "critique": "Gets the central call right: the split is explained by a system constraint, not an approval workaround, which is real progress over the uncurated version. But the brief never addresses the Logistics case, so the response still surfaces it as relevant rather than excluding it, and \u201cMonitor\u201d has no defined review point, which the reporting standard requires.",
      "annotations": [
        {
          "id": "p1",
          "type": "pair",
          "brief_line": "Procurement confirmed the finance system enforces a hard \u00a315,000 cap per invoice \u2014 vendors must split any invoice above that regardless of intent.",
          "response_span": "Procurement has confirmed that the finance system enforces a \u00a315,000 cap per invoice, so any invoice above that value must be split"
        },
        {
          "id": "p2",
          "type": "pair",
          "brief_line": "This is a known system limitation, not evidence of an approval workaround.",
          "response_span": "this explains the pattern independent of any approval workaround"
        },
        {
          "id": "p3",
          "type": "gap",
          "label": "The brief says nothing about the Logistics case, so the response still cites it as relevant instead of ruling it out.",
          "response_span": "A similar pattern was flagged in the Logistics cost centre 14 months ago, so we should note the resemblance."
        },
        {
          "id": "p4",
          "type": "gap",
          "label": "\u201cMonitor\u201d has no defined check-in point, which the reporting standard requires.",
          "verdict_span": "Recommended action: Monitor."
        }
      ]
    },
    {
      "id": "full",
      "label": "Full curation",
      "summary": "The ambiguity is resolved, the irrelevant precedent is explicitly excluded, and the recommended action has a concrete closing condition.",
      "brief": "Situation: Three invoices to vendor Lumen Creative Collective, totalling \u00a342,450 (against a \u00a345,000 approved Q3 campaign contract), each below the \u00a315,000 single-invoice threshold, submitted within a 19-day window. What's confirmed: Procurement confirmed the finance system enforces a hard \u00a315,000 cap per invoice, so splitting was a system requirement, not a workaround \u2014 marketing wasn't warned of the cap in advance. The vendor confirmed by phone, not yet in writing, that each invoice matches a distinct contract milestone (concept, production, distribution). Exclude: The Logistics cost centre case from 14 months ago is not comparable \u2014 that case involved a confirmed kickback arrangement, a different mechanism entirely, not a system-imposed invoice cap. Don't cite it as precedent. Root-cause status: call this Probable, not Confirmed \u2014 the system-cap explanation is corroborated by Procurement, but the milestone match is only a verbal vendor claim pending written confirmation. Recommended action: Monitor, closing the loop once written vendor confirmation arrives; escalate if that hasn't happened within 10 business days. Tone: name the specific indicators present (new vendor, threshold-adjacent splitting, rapid succession) without calling them fraud, and attribute every claim to its source.",
      "response": "Three invoices totalling \u00a342,450 were submitted to vendor Lumen Creative Collective within a 19-day window, against a \u00a345,000 Q3 influencer campaign contract. Each invoice fell below the \u00a315,000 single-approval threshold \u2014 a known indicator alongside the vendor's new status and the rapid succession of payments \u2014 but Procurement confirms the finance system enforces a hard \u00a315,000 cap per invoice, so the split was a system requirement rather than an approval workaround; marketing wasn't warned of the cap in advance. By phone, the vendor confirmed each invoice corresponds to a distinct contract milestone (concept, production, distribution); written confirmation is still pending. A similar-looking case in Logistics 14 months ago involved a confirmed kickback arrangement, a different mechanism, and isn't comparable here.",
      "verdict": "Root cause: Probable \u2014 the system-cap explanation is corroborated by Procurement, but the milestone match rests on an unconfirmed verbal claim. Recommended action: Monitor, closing this once written vendor confirmation arrives; escalate if that hasn't happened within 10 business days.",
      "critique": "Names all three indicators (new vendor, threshold-adjacent splitting, rapid succession) without calling them fraud, and attributes every claim to its source: Procurement for the system cap, the vendor for the milestone match, the contract for the budget figure. Explicitly rules out the Logistics case as a different mechanism rather than citing it as precedent. States root cause as Probable with the actual evidentiary gap named (verbal versus written), and gives a concrete recommended action with both a closing condition and an escalation trigger, not open-ended \u201cfurther review.\u201d",
      "annotations": [
        {
          "id": "f1",
          "type": "pair",
          "brief_line": "Procurement confirmed the finance system enforces a hard \u00a315,000 cap per invoice, so splitting was a system requirement, not a workaround",
          "response_span": "Procurement confirms the finance system enforces a hard \u00a315,000 cap per invoice, so the split was a system requirement rather than an approval workaround"
        },
        {
          "id": "f2",
          "type": "pair",
          "brief_line": "The Logistics cost centre case from 14 months ago is not comparable \u2014 that case involved a confirmed kickback arrangement, a different mechanism entirely, not a system-imposed invoice cap.",
          "response_span": "A similar-looking case in Logistics 14 months ago involved a confirmed kickback arrangement, a different mechanism, and isn't comparable here."
        },
        {
          "id": "f3",
          "type": "pair",
          "brief_line": "Root-cause status: call this Probable, not Confirmed \u2014 the system-cap explanation is corroborated by Procurement, but the milestone match is only a verbal vendor claim pending written confirmation.",
          "verdict_span": "Root cause: Probable \u2014 the system-cap explanation is corroborated by Procurement, but the milestone match rests on an unconfirmed verbal claim."
        },
        {
          "id": "f4",
          "type": "pair",
          "brief_line": "Recommended action: Monitor, closing the loop once written vendor confirmation arrives; escalate if that hasn't happened within 10 business days.",
          "verdict_span": "Recommended action: Monitor, closing this once written vendor confirmation arrives; escalate if that hasn't happened within 10 business days."
        }
      ]
    }
  ]
}