CORAA for Enterprise · Employee expense forensics

Every expense claim, read. Only the ones worth your time, shown.

CORAA reads your whole expense register and every bill, e-mail and photo attached to it. It tests them against recognised fraud-analytics families, then gives your team a short list of leads, each with the evidence beside it and the standard behind it.

See it on your register How we test, and the standards we use

Built on ACFE analytics · Aligned with ICAI SA 240 and the Standards on Internal Audit

The problem

Sampling misses the pattern. Reading every line finds it.

Expense registers are large, repetitive and mostly honest. That is exactly why the unusual is hard to see: a duplicate sits in a different report, an approval sits inside a forwarded e-mail, a bill is shared between two claims, a cost centre drifts for six months. A reviewer reading claim by claim cannot see across tens of thousands of lines. A sample cannot either.

Across reports

Duplicates hide across reports

The same expense can appear in two reports, or one bill can back two claims. Reading claim by claim, nobody sees it.

Across files

Evidence is scattered

Bills, approval e-mails and photos sit in files nobody can search across. Approval often lives inside a forwarded e-mail.

Across alerts

Noise buries the signal

Most red-flag tools raise thousands of alerts and teams stop reading them. A short list people trust is worth more.

How it works

From register to leads, in five steps.

Step 1

Load

Your expense register and the files attached to each claim.

Step 2

Read

Text recognition reads every bill, ticket, e-mail and PDF. Details are also read from photos and files. Bills that are hard to read are marked for a person.

Step 3

Test

The register is tested for repeats, missing evidence, unusual timing, outliers and approval patterns.

Step 4

Compare

Spend is compared by company, zone, department, cost centre, location and grade, against what each unit's own mix would normally spend.

Step 5

Hand over leads

A short list. Each lead has the claim lines, the evidence, the reason it was flagged and the question to ask.

The proof ladder

Proof for every transaction, in one table that adds up.

Every claim line sits in exactly one row: a bill is attached and matches; a bill is attached but cannot be confirmed; no bill, but the claim is paid by formula (such as kilometres) and is tested that way; or no bill at all. The rows add up to the register total, and a check cell reads zero. If the numbers ever stop adding up, you see it.

Bill attached and matches. The amount on the paper equals the claim52%
Bill attached, cannot tell. Handwritten, unclear or in another language. Left for a person14%
No bill, paid by formula. Such as kilometres. Tested that way24%
No bill at all. Where a bill should exist, this is the row to look at10%

ILLUSTRATIVE, SYNTHETIC DATARows total 100% · check = 0

It shows what share of spend has paper behind it.

It separates “no bill because none is expected” from “no bill where one should exist”.

It makes the review auditable.

“Matches the bill” means the amount on the paper equals the claim. It does not mean the claim is right.

The test library

What we test, grouped by how expense fraud actually happens.

Group names follow the expense-reimbursement scheme classes in the ACFE Fraud Tree.

AThe same expense paid twice

The same expense ID entered in two different reports

The same employee, date, category and amount claimed more than once

The same bill file used on more than one claim, ignoring normal cases such as colleagues sharing one hotel stay or shared documents like odometer photos and toll statements

The same camera capturing a photo at the same second on claims with different dates

Bills printed as “Duplicate”

BEvidence that does not hold up

A photo whose capture date is well before the expense date

A bill file created or saved in an editor, raised as a question, since some vendors do issue invoices from Word or Excel

A GSTIN that fails the format and check-character test, needing two independent readings

Alcohol printed as a priced line on a bill when the claim is not marked as alcohol

COverstated claims

Kilometres claimed above a system distance, valued at the rate on each line

Own-vehicle claims that imply more kilometres in a day than a person can drive

Own-stay nightly rates against the register's own norm

Claims several times above the median for the same category and grade

DUnusual or mischaracterised expenses

Personal-sounding descriptions such as gifts, parties, donations and tips

Sunday claims and round-amount claims, treated as patterns and not proof

Amounts held just under a receipt limit, compared with those just over

ETiming and behaviour

Late submission, month-end clustering, night and Sunday submissions

Spend spikes against a person's own usual month

Allowance claimed on 20 or more days in a month

A first-digit (Benford) check, shown as context only because fixed allowances and caps bend it

FApprovals and controls

How concentrated approval is, and how often claims clear on the day they are submitted

Large claims with no written approval anywhere in their files, including approvals printed inside forwarded or combined documents

Whether the approvers named in the register appear in the attached approval e-mails

Several approvals or several supporting documents on one claim

GMissing evidence

Claims above a stated amount with no receipt, in categories that normally carry one

We also retire tests that do not hold up. In our own pilot we removed or narrowed several that raised false alarms, for example treating two colleagues who share a hotel bill as a duplicate.

Intelligence

Intelligence beyond the flags.

The register already says who spent, where and under whom. CORAA uses all of it: spend, people, spend per head, field-work share and month-by-month trend for every company, zone, department, section, cost centre, work location and grade. A unit is called out only when it spends at least twice what its own department’s people at the same grades normally spend, with enough people and rupees to matter. That keeps a field-sales team from being flagged just for travelling more than head office.

Lens 1

By company

A group of companies, split by zone. You learn where spend concentrates across the group.

Lens 2

By zone

North, South, East, West and Central, with a monthly trend. You learn which region is drifting.

Lens 3

Field sales

Allowance against fuel by month, vehicle and business unit, and the spread across employees. The rate on each line is used, never an assumed rate.

Lens 4

Cost centres and grades

Spend per head and a grade-adjusted comparison. You learn who spends more than people at the same grade.

Lens 5

Approvals

Who clears what, how fast, and written approval by claim size.

Lens 6

Behaviour and timing

How long claims take, which weekday, and the timing tests above.

Lens 7

Own car, own stay, auto

Declared claims with no vendor bill, tested by pattern.

An honest limit. Intelligence compares spend with expectation and with peers. It does not compare with revenue or budget unless you give us those.

Reading documents safely

AI that reads, and a check that keeps it honest.

Approval e-mails are often forwarded, quoted or printed inside another document. CORAA uses small language models to read them, and then checks every answer against the text: the quote must be in the document, the person must be named in it, an “approved” must be in the newest message, and the approver cannot be the person who asked. An answer that fails the check is shown to a person as “needs a look”. It is never turned into a finding.

A reading counts only when at least two of three independent models, each passing the check, agree on who approved.

The AI never creates a finding, a rating or a conclusion.

Amounts and coverage it reads are shown as suggestions only, because they were right only about half to two-thirds of the time.

Anything it cannot read with confidence goes to a person.

Standards and authorities

The standards and references behind it.

We align with these standards and references. We do not claim compliance with them, and we say plainly what we did not do.

Standards and references used for employee expense forensics
Area	What we use it for	Authority and reference	Status
Classifying schemes	Grouping tests by how expense fraud happens	ACFE Occupational Fraud Classification (expense reimbursement schemes) Reference	Used
Analytics tests	Repeated claims, round amounts, Sunday claims, outliers, missing information	ACFE Anti-Fraud Data Analytics Tests Reference	Used
Threshold behaviour	Claims held just under a receipt or approval limit	ACFE red flag; Loss Prevention Media (secondary source) Reference	Used
First-digit test	Context on how amounts are distributed	Nigrini, Benford's Law: Applications for Forensic Accounting, Auditing, and Fraud Detection (Wiley, 2012); Drake and Nigrini (2000) Reference	Context only
Fraud-risk thinking	Why we test approvals, concentration and override-style patterns	ICAI SA 240 (equivalent to ISA 240); ICAI SIA 11, Consideration of Fraud in an Internal Audit Reference	Context only
Analytical procedures	Comparison with peers and with expectation	ICAI SIA 6, Analytical Procedures (legacy numbering still listed by ICAI) Reference	Used
Evidence and sampling	Treating bills and e-mails as evidence, and how much is read by eye	ICAI SIA 320 (formerly SIA 10), Internal Audit Evidence; SIA 5, Sampling	Used
GSTIN	Format and check-character test on supplier tax numbers	GSTIN structure of 15 characters (state code, PAN, entity number, “Z”, check character). Secondary guides; the official GSTN check-digit algorithm has not been independently verified	Used
File metadata	Photo capture date, creating software	EXIF (CIPA DC-008); PDF information dictionary (ISO 32000)	Used
Our own validation	Recounting from the raw file, shifted-date control, reading hits by eye, answer key for the AI reader	CORAA validation practice	Used

Plain statements

This is not journal-entry testing. Journal-entry testing is a general-ledger procedure under SA 240. Our population is expense claims. SA 240 gave us the thinking, not the procedure.
ICAI numbering is being updated. SIA 5, 6 and 11 are the legacy numbers still listed by ICAI, and Internal Audit Evidence appears as SIA 320 (formerly SIA 10).
Some references are practitioner or secondary sources and are labelled as such.
What we did not do: journal-entry testing, a policy-limit test (no policy was supplied), international expenses (none in the pilot extract), a revenue or ROI link, or any audit opinion.

What you get

What lands on your desk.

Dashboard

Every number opens its claim lines

Spend insights, proof, field work, ordinary expenses with no bill, own car, stay and auto, documents and approvals, behaviour and trends, duplicates, all findings, organisation patterns and the methodology.

Report (PDF)

A plain-English report

Findings in plain words, an Intelligence section with charts, the methodology and sources, and what we need from you.

Workbook (Excel)

A workbook your team can work in

Opens on a contents page with links to every sheet and back. Tabs are colour-coded by purpose, and each observation has an annexure listing its claim lines.

Review workflow

Confirm, clear, query or mark recovered

Each decision carries a remark and is kept as an audit trail. After about 30 judged lines per observation, CORAA reports how often that observation turned out to be right, so the tests improve with your own feedback.

Questions

Frequently asked.

No. It produces leads for people to confirm. It never calls anyone dishonest and never turns an AI reading into a finding.

We test narrowly, compare units with their own peers and grade mix, retire tests that raise false alarms, and read every hit of a small finding by eye before it is listed. Several of our own tests were narrowed or removed in the pilot for that reason.

Those are marked as “cannot tell yet” and left for a person. They are not turned into findings.

We align with them and draw on them. We do not claim compliance, and this page says what we did not do.

Yes, once you give us the policy and grade limits. Without them, we compare employees with their peers.

With revenue by business unit, zone and cost centre, we can build that view. It is not part of the standard output.

Yes. The pilot register covered a group of twelve companies.

An expense register export and the files attached to each claim. For richer analysis: the travel policy and grade limits, the approval matrix, and, optionally, revenue by business unit.

Start small

Start with one register.

Send us one expense register and its attachments. We will show you the proof ladder, the leads, the intelligence by company and zone, and the standards behind each, so your team can decide what to put into regular use.

See it on your register

Findings are leads for your team to confirm against the original document and the employee’s explanation. They are not conclusions and not an audit opinion.