Internal auditors and controllers running ERPNext usually discover control failures the same way everyone else does: after the money has left. A duplicate supplier payment surfaces on a bank reconciliation weeks later; a back-dated Journal Entry posted over a weekend never gets a second look; the same person who created a Purchase Invoice also submitted the Payment Entry because approval workflow was never enforced on that account. ERPNext gives you an immutable submitted-document trail and role-based permissions, but it does not proactively tell you which of last month's ten thousand transactions deserve a human's attention. Native reports are descriptive, not investigative — there is no built-in duplicate-payment sweep, no statistical outlier flag, no segregation-of-duties matrix, and no auditor workqueue. That gap is exactly where teams fall back to exporting to Excel and eyeballing, which does not scale.

ECOSIRE builds a proper Frappe application — its own module, DocTypes and permissions — that runs continuous, explainable checks over your ERPNext accounting data and turns the hits into a reviewable caseload. At the core is an Anomaly Case DocType: each flagged transaction becomes a case with a rule name, a risk score, the linked source document (Journal Entry, Purchase Invoice, Payment Entry, Sales Invoice), a plain-language reason, and a disposition workflow (Open → Under Review → Cleared / Confirmed Exception) driven by ERPNext's native Workflow engine. Detection runs two ways: near-real-time via hooks.py doc events (on_submit, on_update_after_submit) so a suspicious document is scored the moment it is submitted, and as a nightly sweep via a scheduler_events job that re-scans the period for patterns only visible across many documents.

The detection logic is deliberately transparent rather than a black box. Deterministic rules cover the high-value, well-understood risks: fuzzy duplicate detection on (supplier, amount, reference no, date-window) to catch near-duplicate bills and double payments; round-number and threshold-clustering heuristics (amounts landing just under an approval limit); weekend and after-hours posting flags derived from the document's creation and owner; and a segregation-of-duties matrix that compares the owner of the source document against the owner of its downstream Payment Entry and against your Role Profiles. On top of that, an unsupervised model (isolation-forest style scoring over amount, account, party, posting-hour and frequency features) ranks entries that break from each account's own historical pattern — so unusual is defined by your data, not a guessed threshold. Every score ships with the features that drove it, so an auditor can defend the flag. An audit-trail completeness check reconciles the Version/document history to catch gaps, and a set of whitelisted REST methods let your GRC tooling pull cases via the Frappe REST API.

Because this is build-to-order, nothing is a generic download. We start with a scoping call to map your chart of accounts, approval limits, Role Profiles and the specific fraud and error patterns that matter to your business, then tune the rules and model thresholds against a copy of your real data on a staging bench. You get the full source as an installable Frappe app, UAT sign-off on staging before anything touches production, a documented install and rollback plan, auditor training, and a post-go-live support window. Typical delivery is one working week from confirmed scope, depending on the number of detection rules and integrations. It targets Frappe/ERPNext v15 and v16 and installs alongside your existing apps without core patches.