Cash disbursement anomalies: evidence-led review of unusual payments

Payment review is often weakened by looking only at large amounts. This research uses a broader population: payments, voids, reversals, manual journals, vendor-master changes, and approval records for a defined period. It asks which observable signals help an owner prioritize review without turning a statistical outlier into an accusation.

Retain payment date, amount, currency, vendor, bank account, invoice reference, preparer, approver, release status, and any reversal or return. Link vendor changes to the change request and effective date. A duplicate signal can be same vendor and amount, similar invoice number, close dates, or a repeated bank destination; each is a prompt for inspection, not a final finding.

Review the population by count and amount, then compare the current period with the prior three periods. Useful cuts include payments just below approval thresholds, after-hours entries, new vendors, changed bank details, round-dollar payments, and rapid payment followed by reversal. The report should show the filter logic and its blind spots so it cannot be mistaken for a complete fraud examination.

Approval evidence has value only when it identifies what was approved. A generic email may show consent but not invoice, amount, recipient, or date. A stronger packet links the invoice, receiving or service evidence, coding, approval, and bank settlement. When one person prepares, approves, and releases a payment, record the conflict and the compensating review rather than hiding it.

The bookkeeper’s role is to assemble the population, link documents, and flag anomalies. Management or an independent reviewer should investigate suspected misconduct, contact banks, preserve privileged evidence, or decide disciplinary action. This boundary reduces the chance that a routine reconciliation is presented as an investigative conclusion.

No anomaly screen detects every improper payment, and normal business events can create every signal listed here. The method does not estimate fraud prevalence or replace a formal investigation. Its conclusion is narrower: an owner can review cash more effectively when transaction identity, approval scope, vendor history, and settlement outcome are connected in one evidence trail.

Sources cover fraud-risk context, control, access, accounting, and recordkeeping. They inform the framework but do not prove any individual transaction is improper.