Atul Iwale · Project 4 · Payroll anomaly detection (unsupervised ML)

Which wage lines should the auditor check this month?

Site-labour payroll leaks through ghost workers, proxy attendance, padded overtime, unauthorised rate increases and pay after exit, and nobody labels these in advance. Unsupervised detectors learn what normal looks like for each site, crew and worker, then rank the lines that don't fit. The Isolation Forest and the autoencoder run live in your browser.

Isolation ForestAutoencoder (neural network)One-Class SVM · Local Outlier Factor · Robust z-scoreReason codes
← Original staff-payroll rule checks · Notebook · README · Data

Audit list

Mar to Aug 2026, months the detectors never saw while learning. The audit result column shows what internal audit later confirmed. It is used only to score the detectors.

#WorkerGrossScoreAudit result

How the detectors compare

At the selected audit budget, all six months

Precision = share of reviewed lines that were real issues. Recall = share of all real issues found. PR-AUC ranks the whole list; a random order scores .

Issues found at a 5% budget, by type

Proxy attendance is the hardest: a few extra manual days look like normal absence. It needs gate or face-recognition data, not just payroll.

Why the audit rules alone don't work

Contractors: share of lines flagged (Isolation Forest, 5% budget)

Approvers behind mid-year rate increases

How it works

  • Data: 12 months of wages for about 1,300 site workers from labour contractors, on the same 12 sites and approvers as the staff payroll.
  • Features: each line is compared with its site that month, its trade crew, its trade across sites, and the worker's own past, plus identity signals (shared bank account, KYC, pay after exit).
  • Unsupervised: the detectors learn from Sep 2025 to Feb 2026 with no labels, and settings are picked on earlier audit results only.
  • Reason codes: the features that are rarest compared with the learning period (top or bottom 2%), shown for every line.
  • In this page: isolation trees and the autoencoder's weights score every line in JavaScript.

Honest limits

  • The payroll is synthetic, built on realistic patterns. Real payroll has messier master data.
  • In real life, audit outcomes exist only for the lines reviewed, so precision is measured on that sample.
  • The ensemble did not beat the Isolation Forest alone, and the Local Outlier Factor struggles because fraud from one contractor forms its own cluster (masking).
  • A flag is a reason to check, not proof of fraud.