Best Practices in Duplicate Invoice Detection

White Paper Best Practices in Duplicate Invoice Detection Author Dr Michael Lawler Updated 10 Sep 2013 Version 1.1

Table of Contents Executive Summary... 3 Background... 4 Challenges... 4 Businesses In a State of Change... 4 Risk Indicators for Duplicate Payments... 4 Why Doesn t 3-Way Match Prevent This?... 5 Business Benefits... 6 Improve Financial Performance... 6 Lower Compliance Costs... 6 Improve Financial Governance... 6 Best Practices... 7 Continuous Monitoring... 7 Engagement of the Business User... 7 Exception Management... 8 Business Models of Solution Providers... 8 Adaptability to Your Organisation s Processes... 9 True Positives versus False Positives... 10 Technology Concerns... 11 Modern Approaches to Data Analytics... 11 Improved Recall and Precision... 12 Deployment Architectures... 12 2

Executive Summary Preventing duplicate payments provides significant benefits in minimising lost profits for large organisations at scale. Without an effective solution in place, large organisations can expect to pay out considerable amounts ( > $1M ) annually due to duplicate payments made in error. Many large organisations are currently operating with a false sense of security about: The effectiveness of their A/P business process controls, or The effectiveness of their existing tools for auditing/monitoring for duplicate payments This document provides an overview of the latest approaches for Duplicate Invoice detection in ERP systems and guidance on current best practices and technology approaches for maximising outcomes in the following areas: Elimination of duplicate payments Improved cash flow & financial performance Improved governance and compliance Reduced financial risk Reduced internal audit costs Driving business process improvement Improved vendor relations In today s economic environment, a modern duplicate invoice solution is key to an efficient procurement process, maximising financial performance and delivering on your organisation s governance, risk and compliance obligations. 3

Background In todays economic environment there are few organisations that are not affected by competitive pressures, shrinking budgets, and rising customer expectations. Declining margins are making organizations look inward to make their processes as efficient as possible. Procurement is one area that has attracted attention, leading to initiatives that allow greater value to be derived for every dollar spent. Efficient procurement processes provide an added competitive edge to an organization s product and service portfolio. This white paper focuses on best-practice approaches to solving a common issue within the procure-to-pay process of large organisations at scale duplicate payments made in error to vendors. If addressed effectively, this can yield significant dollar savings to an organisation s bottom line, as well as improving the business process within the Procure-to-Pay scenario. Many organisations are currently responding to the issue of duplicate payments based on outdated approaches and aging technology. There is often a false sense of security that the processes or solutions currently in place are addressing this risk adequately. This paper explains the benefits of modern approaches to addressing this issue. Challenges Businesses In a State of Change Businesses are always changing as they are always finding better ways to do what they do. New risks are continuously introduced by way of: Expansion into new locations Mergers and acquisitions Change in personnel New processes New technologies Alternatively, other risks can become irrelevant as technology, processes and business units are decommissioned, centralised or standardised. Risk Indicators for Duplicate Payments The key indicators for high incidence rates of duplicate payments in large organisations include: Decentralised teams Decentralised systems and heterogenous ERP landscapes Quality of vendor master data Quality of downstream data and processes Staff turnover 4

Decentralised teams introduce risk when an organisation handles the AP process through teams in different locations. Reduced inter-team communication and the possibility for the same documents to be processed by different people in different locations increase the likelihood of variations in business process that result in duplicate payments. Decentralised systems are an indicator of risk when an organisation has multiple systems in different locations that serve the Accounts Payable function. Heterogenous ERP landscapes can occur within an organization due to mergers and acquisitions or migration strategies and the lack of process integration between separate systems can also be a driver for incidences of duplicate payments. The quality of vendor master data is also a key factor in duplicate payments. If there are duplicates or similar records representing the same vendor in your master data, then this significantly increases the likelihood of the same logical invoice accidentally being entered against different vendor master records. Finally, the quality of downstream data and processes are also significant contributors to errors in the payment process. If the vendor does not follow standard practices in generating a unique invoice reference number for each invoice, or if the vendor recombines previously issued invoices together into a new invoice with a new reference number and amounts, then these types of data quality issues will cause problems within your AP process. Why Doesn t 3-Way Match Prevent This? The AP 3-way match process is a traditional method involving detailed inspection of documents to ensure that the company is paying the right amounts of money to the right suppliers or other vendors. However, typical ERP implementations generate AP invoices from a number of different sources all of which reflect different business processes. These processes can cover: Invoices for goods Invoices for services Credit card invoices Payroll related invoices Workers compensation invoices Recurring payments for rents, leases and so on Rebate invoices for sales volume Mass invoice load for utility charges Although a purchase order / goods receipt based process is an effective basic control mechanism for service and goods related processes, it is not designed to be effective for other invoicing processes. Therefore a comprehensive invoice detection function that caters for all possible invoice types is not just desirable but absolutely necessary if a risk perspective of all invoice types is to be achieved. 5

Business Benefits White Paper - Best Practices in Duplicate Invoice Detection An effective Duplicate Invoice detection solution reduces fraud and improves financial governance, typically resulting in a substantial return on investment. It improves the reliability of the procurement controls, and it improves the management oversight, policy enforcement and operational efficiency for procurement processes often producing hard-dollar savings. Duplicate Invoice detection adds value to risk management and compliance initiatives in a number of ways. Improve Financial Performance Fraud or failure to follow business rules governing financial transactions can result in significant business losses that affect financial performance. The prevention of duplicate payments assists the business in reducing these lost profits. In some scenarios, a subset of duplicate payments may be detected by the business via existing processes, but the impact to the cash flow of the business will still be evident. The business must then engage in a process with their vendor to recover the funds (if possible). Lower Compliance Costs A Duplicate Invoice detection solution can reduce the cost of audits by eliminating much manual sampling and minimizing the time it takes to gather documentation. An effective solution also reduces the amount of low-level investigative effort expended by procurement staff for their normal compliance activities. A modern solution enables less staff to deliver significantly more coverage at a greater level of quality by allowing them to spend their time at a higher level of productivity examining the exceptions produced by the system. Improve Financial Governance Duplicate Invoice can increase the reliability of transactional controls, improve auditor trust and increase the effectiveness of antifraud controls. Another benefit is in the riskmanagement behaviors it cultivates, as well as the trust in compliance processes it helps generate throughout the company. 6

Best Practices Continuous Monitoring Historical approaches to detecting duplicate payments followed a retrospective approach, where an audit team might analyse transactional data periodically in order to get a feel for the incidence rates of duplicates, and the level of compliance of transactions against business rules and best practice. Alternatively, the problem of duplicate payments might be handed off to a third party for retrospective analysis and potential recovery after payments have been made. Modern best-of-breed solutions leverage a Continuous Controls Monitoring (CCM) approach, where the transactional data is proactively checked for compliance continuously rather than months after the fact. Continuous Monitoring is employed as a business monitoring function by financial managers to ensure that the procurement process is operating as designed and that invoices and payments are processed appropriately. The Procure-to-Pay process normally involves many business rules or policies that address accounting, reliability and anti-fraud issues. To ensure that policies and rules are followed, many ERP and financial applications have built-in internal controls with simple gated logic. However, the existence of these built-in automated controls does not ensure that they are turned on, that they are configured appropriately, and that they are not regularly overridden or bypassed thus establishing the need for a solution that can monitor these controls. Continuous Monitoring brings two major benefits to historical approaches. Firstly, it provides proactive prevention rather than retrospective detection of duplicate payments, as procurement staff are alerted to potential duplicate invoices before they are paid. Secondly, it provides 100% coverage of the transactional data rather an analysis of a sample set of data. Engagement of the Business User Some legacy solutions currently employed for duplicate invoice prevention at large organisations are enacted offsite or behind closed doors, effectively disconnecting the procurement staff from the process. Best practices allow for flexible business user engagement - enabling individual users to manage and control their level of involvement according to the situation. This means: Daily alerting of high confidence exceptions for remediation The ability to deep dive into individual exceptions and quickly understand the rationale behind the result through systematically assembled explanations and analysis Dashboard-style metrics and reporting across exceptions, trends, input data, and business process improvement. These information dashboards should support presenting an up to date overview of the current situation, summaries of historical trends and allow business users to quickly filter and explore arbitrary subcategories of exceptions. 7

Being able to tune behaviour via simple configuration screens, and using their business process knowledge to iteratively refine the behaviour of the installation. Allowing your business users to easily engage with the solution is the best way to maximise the opportunity for improvements in business process as procurement staff can witness every day examples of transactions that are not adhering to the defined business process. Exception Management A critical component of an effective solution for senior internal auditors and compliance executives is how business process owners respond to the potential exceptions detected by the system. One part of the solution s benefits is in the risk-management behaviours it cultivates, as well as the trust in compliance processes it helps generate throughout the company. While a modern Duplicate Invoice solution based on a continuous monitoring approach will provide timely alerting and a rich assembly of supporting data for each exception, it remains up to process owners to take action and make decisions in response to the exceptions that they receive. An effective solution must support and assist the business in the decision-making and related remediation actions, through integrated support for exception management via role-based workflow and email follow-up. Business Models of Solution Providers There are a variety of licensing and business models offered to the market by duplicate invoice detection solution providers including: Percentage of Recovered Payments Percentage of Identified Duplicates Flat Fee per Analysed Invoice Approaches based on a Percentage of Recovered Payments are usually offered as a periodic retrospective service over 3, 6, or 12 months of invoicing data. These approaches are often offered with minimal upfront fees and this is usually perceived as the drawcard for this model. However, they do little for business process improvement as the analysis is usually performed offsite away from the business and there is little to no engagement with your own procurement team. In fact, the solution provider has no incentive to assist in correcting the problem as occurrences of duplicates drive their revenue. This approach also can impact relationships with your vendors, as they will be chased by a 3 rd party who is incented by recovery of potential duplicates. Finally, it is a reactive approach rather than a preventative approach so there is no governance, risk or compliance benefits from the solution and losses from duplicate payments will still impact the cash flow position of the business. 8

Models sometimes involve a Percentage of Identified Duplicates. These approaches are typically associated with a continuous monitoring approach as the aim is to identify the potential duplicate before it is paid. Again, these approaches can be offered with a reduced upfront fee and this is usually perceived as the drawcard for this model. However, in this model, circumstances often arise where the solution detects what it sees as a potential duplicate payment for a large invoice, yet staff within the business were already aware of the two matching invoices but had not yet reversed one of the invoices. In this case, it is possible for differing opinions between customer and solution provider over which potential duplicates are eligible for revenue. Because this scenario can occur regularly, it is not an ideal model for either party. Another potential model is a Flat Fee per Volume of Analysed Invoices. In this approach, the customer pays for the volume of invoices analysed, regardless of the number or value of duplicates detected. The customer is allowed control of the scope of which invoices are analysed for example being able to filter out certain types of invoices. The model usually allows invoices to be reanalysed with a different tuning or configuration at no cost. In this model, the customer has a clear view of the annual cost of the solution, and simply makes a purchasing or engagement decision based on demonstrated ROI with respect to financial performance or governance, risk and compliance factors. Adaptability to Your Organisation s Processes Although many organisations may employ the same ERP software, organisations are often different in terms of their ERP landscapes, business processes and policies. It is very important that customisations can be made quickly and easily to the matching behaviour provided by the solution. Rules and features that detect high confidence true positive duplicates for one organisation may trigger false positive noise for another company. The ability to tune behaviour can be classified into 3 categories: Enabling or disabling built-in matching functions Tuning or adjusting the parameters and thresholds of existing matching functions Addition of completely new custom matching behaviour It should be expected that the tuning process or the addition of new matching behaviour can be performed interactively as an iterative process of refinement on a live system, not as something requiring back-room software development and release cycles or length periods of data reloading. 9

True Positives versus False Positives It is expected that a correctly functioning Duplicate Invoice detection solution will usually generate some degree of false positives. Being able to tune the balance correctly between the mix of false positives and true positives for a specific organisation s business processes is the key to a successful solution that provides maximal risk and compliance benefits while minimising the review effort from the procurement team. In information retrieval theory, this is normally framed as precision versus recall and is a classic concept underpinning relevance. Precision is the fraction of retrieved instances that are relevant, and is achieved by having tighter evaluation or more sophisticated restrictions on what potential results should be shown to user effectively using smarts to reduce false positives. Recall is the fraction of relevant instances that are retrieved, and is increased by casting a wider net and considering more potential scenarios for duplicates. This ensures you detect all the actual true positive duplicates that are occurring within the business. Balancing false positives and true positives is analogous to balancing precision and recall. A modern duplicate invoice solution will provide your procurement team with rich result metadata that can be quickly evaluated and easily understood. Even when an organisation tunes its detection behaviour for greater recall and perhaps looser results, supporting result metadata provides the means to easily differentiate and filter lower confidence results from higher confidence results, saving time and effort for procurement staff while reviewing potential exceptions. 10

Technology Concerns Modern Approaches to Data Analytics The rise of data analytics has brought significant progress in the sophistication of matching and classification approaches in the last decade. Traditional Duplicate Invoice detection solutions based on legacy approaches have typically employed relatively simple SQL-style queries with some use of fuzzy matching via phonetics and match codes over key fields. These traditional approaches usually suffer from either one of two shortcomings over modern approaches: They do not detect all of the potential scenarios for true positive duplicate payments being made by the organisation which means they are failing to fully address the problem, or They are too noisy in the amount of potential exceptions they generate which means they are either ignored by the AP team, or they cause as unpalatable amount of remediation effort. State of the art approaches in duplicate detection leverage a much more advanced set of algorithms and techniques including: Search Engine features: o Synonyms o Linguistics o Stop Words o Fuzzy Matching o Inverse Document Frequency (IDF) based scoring Natural Language Processing o For Header Text, Item Texts and Vendor information Statistical functions o Clustering o Outlier Detection Domain-based Feature Extraction o There are many features of Invoices and matches between Invoices that are significantly interesting to be of use to higher-level algorithms Domain-based Heuristics o There are many rules derived from general AP business processes that can be applied to Machine Learning o Random Forest 11

Improved Recall and Precision White Paper - Best Practices in Duplicate Invoice Detection The progression from simple query style matching to more advanced algorithms allows much more sophisticated and nuanced matching that outperforms legacy approaches significantly. The key reasons are that the more advanced approaches allow for both greater recall and more precision. Providing greater recall means that many more potential scenarios can be detected and evaluated meaning there is less chance of a true positive duplicate getting past the solution. More precision is delivered because the algorithms can make more sophisticated determinations on whether a candidate result is a false positive by examining a host of positive and negative factors such as: Users who entered the invoices into the systems Dates entered into header and item text fields Consistent chronology of Invoice reference numbers versus Invoice dates Common vendor invoice amounts versus outlier amounts Automatic detection of recurring invoices Recognising payments to employees Clustered results Post-analysis for fuzzy field matches to understand and classify the difference between the two similar values in relation to its potential for human-originated error causes versus random occurrence. o Homoglyphic substitution ( 0 for a O, 1 for an I etc) o Delimiter substitution (O briens versus Obriens) o String of Zeros (1000023 versus 100023) A modern solution will extract dozens of features from the raw data to better understand it from a domain perspective, mimicking the way a domain expert would think about the data. This allows the solution to make more sophisticated inferences on what potential matches mean which matches are more likely to be true positives and which matches are more likely to be false positives. Regardless of the specific techniques and algorithms used, a Duplicate Invoice solution should always come with a complete set of built-in rules and features that can be used out of the box to provide compliance for established business processes. Deployment Architectures There are a number of options to consider when examining deployment architectures for a Duplicate Invoice Detection solution. In general, organisations are looking for low impact, low friction deployment models that are easy to rollout and integrate quickly, and that do not add complexity or risk to their existing ERP landscape and business processes. Some of the issues include: On-Premise versus Cloud versus Offsite Support for Heterogeneous Landscapes Virtual Appliances 12

Although organisations of all sizes are increasingly embracing the cloud for data and services driving their business, as of 2013 there is still a desire to keep financial data such as invoicing on premise for privacy and security reasons. A trend to cloud-based services for continuous monitoring of ERP transaction data could occur at some point in the future, but for large organisations running ERPs on-premise issues such as data sovereignty preclude most real opportunities for cloud-based integration. Another important factor is support for heterogeneous landscapes. Many large organisations have multiple systems that deal with transactional data across the Procure-to-Pay process. For example, an organisation may have multiple ERP systems (potentially from multiple vendors), and then may have P-Card or Expense Card systems that are not tightly integrated with their ERP systems from a compliance perspective. A key requirement is the capability to easily connect and integrate with transactional data from multiple disparate systems and detect duplicates both inside each of these systems and across the systems. A recent trend in state-of-the-art packaging for ease of deployment is to provide a solution as a Virtual Appliance. This is a pre-integrated, self-contained system that combines the software application already installed into the operating system to enable it to run optimally on industry standard virtualization layers (e.g. VMware or Microsoft). Packaging a solution as a virtual appliance allows delivering ready to use systems that just work out of the box or in the cloud with little to no setup. A virtual appliance reduces unnecessary friction by streamlining previously complicated, labor intensive processes. 13