AI Audit & Anomaly Detection for ERPNext

ECOSIRE builds a proper Frappe application — its own module, DocTypes and permissions — that runs continuous, explainable checks over your ERPNext accounting data and turns the hits into a reviewable caseload. At the core is an Anomaly Case DocType: each flagged transaction becomes a case with a rule name, a risk score, the linked source document (Journal Entry, Purchase Invoice, Payment Entry, Sales Invoice), a plain-language reason, and a disposition workflow (Open → Under Review → Cleared / Confirmed Exception) driven by ERPNext's native Workflow engine. Detection runs two ways: near-real-time via hooks.py doc events (on_submit, on_update_after_submit) so a suspicious document is scored the moment it is submitted, and as a nightly sweep via a scheduler_events job that re-scans the period for patterns only visible across many documents.

The detection logic is deliberately transparent rather than a black box. Deterministic rules cover the high-value, well-understood risks: fuzzy duplicate detection on (supplier, amount, reference no, date-window) to catch near-duplicate bills and double payments; round-number and threshold-clustering heuristics (amounts landing just under an approval limit); weekend and after-hours posting flags derived from the document's creation and owner; and a segregation-of-duties matrix that compares the owner of the source document against the owner of its downstream Payment Entry and against your Role Profiles. On top of that, an unsupervised model (isolation-forest style scoring over amount, account, party, posting-hour and frequency features) ranks entries that break from each account's own historical pattern — so unusual is defined by your data, not a guessed threshold. Every score ships with the features that drove it, so an auditor can defend the flag. An audit-trail completeness check reconciles the Version/document history to catch gaps, and a set of whitelisted REST methods let your GRC tooling pull cases via the Frappe REST API.

Because this is build-to-order, nothing is a generic download. We start with a scoping call to map your chart of accounts, approval limits, Role Profiles and the specific fraud and error patterns that matter to your business, then tune the rules and model thresholds against a copy of your real data on a staging bench. You get the full source as an installable Frappe app, UAT sign-off on staging before anything touches production, a documented install and rollback plan, auditor training, and a post-go-live support window. Typical delivery is 2-4 weeks from confirmed scope, depending on the number of detection rules and integrations. It targets Frappe/ERPNext v15 and v16 and installs alongside your existing apps without core patches.