An organization’s processes to halt financial misconduct may be strong, but if compliance and audit teams aren’t analyzing transaction-level data, wrongdoing may pass unnoticed. Steve Markle, chief operating officer of Itemize, examines financial compliance blind spots and how to address them.
Most organizations today have extensive compliance frameworks in place. Policies are documented. Approval workflows are enforced. Segregation of duties is carefully designed. Internal audit teams regularly test whether procedures are being followed.
Yet, financial misconduct still slips through.
In many cases, the problem is not that organizations lack control. It’s that real-world warning signs were never visible within those controls to begin with. They were buried inside transaction data that few compliance programs actively analyze.
For many compliance and internal audit teams, financial transactions represent one of the most overlooked areas of risk monitoring. Policies and procedures may be carefully reviewed, but the details inside invoices, vendor records, expense reports and payment instructions often receive far less scrutiny. This creates a compliance blind spot.
Transaction-level data matters more than ever
Traditionally, compliance frameworks focused on ensuring that the right processes were followed, and if so, organizations could reasonably assume that transactions were legitimate.
But modern fraud and misconduct rarely occur in ways that violate obvious procedural controls. Instead, they are embedded inside legitimate workflows. Invoices could pass through approval channels, and seemingly good-faith vendors may exist in the system. Payments could follow approved processes, while expense reports complied with policies.
What makes these activities problematic is not the process surrounding them but the details inside the transactions themselves. An invoice line item may contain inflated pricing, or a vendor record may belong to a shell company created by an insider. A reimbursement request may technically comply with policy but conceal personal spending.
Without examining the underlying transaction data, these risks remain difficult to detect. For compliance teams, oversight must extend into the substance of financial activity.
Invoice manipulation & vendor fraud
Each invoice contains vendor information, descriptions of goods or services, quantities, unit prices, tax calculations and payment instructions. Within that complexity, manipulation can easily occur.
Overbilling may be hidden through inflated unit prices. Duplicate charges may appear across multiple invoices. Unauthorized services may be inserted into legitimate billing documents. In some cases, fraudulent invoices are deliberately structured to resemble legitimate ones, allowing them to pass through approval workflows unnoticed.
Even well-trained approvers may not catch these issues if their review focuses primarily on the invoice appearing reasonable rather than the underlying data aligning with contract terms or historical patterns. Compliance professionals should be examining not only whether invoices were approved but what those invoices contain.
Similarly, vendor fraud risk often hides inside transaction data. For many organizations, vendors are treated as trusted partners once they are established in the supplier master file. Vendor fraud schemes often exploit that trust.
Employees may create shell vendors to receive fraudulent payments. Legitimate vendors may collude with internal staff to inflate billing. Payment instructions may be altered to redirect funds to unauthorized accounts. Duplicate invoices may be submitted deliberately by vendors seeking additional payments.
These schemes frequently appear legitimate at a process level, but what exposes them are often subtle signals inside the financial activity, such as unusual transaction patterns, unexpected pricing changes or relationships between vendors and employees.
Without careful attention, vendor fraud can persist undetected for extended periods.
Expense abuse that evades policy enforcement
Most organizations establish clear guidelines regarding expenses. Yet, expense abuse remains one of the most persistent forms of financial misconduct. One reason for this is expense policies often focus on categories rather than context. A meal expense may fall within policy limits, but the circumstances surrounding that expense may still raise questions.
Employees may split transactions to remain below approval thresholds. Personal expenses may be embedded within legitimate business receipts. Travel expenses may include unauthorized upgrades or inflated costs. Because these transactions often technically comply with policy rules, they can pass through standard review processes without raising concerns.
Closer examination of transaction details, such as patterns of spending, timing of expenses and relationships between transactions, often provides the only reliable way to identify misuse.
The State of OFAC Sanctions Enforcement in 2025-26
OFAC issued 14 enforcement actions in 2025, but the more important signal may be who got dinged
Read moreDetailsContract overbilling hidden in line-level details
Contract overbilling is another risk that often becomes visible only through careful analysis of transaction details.
Many service contracts include complex pricing structures. These arrangements create opportunities for vendors to bill for services that exceed contract terms.
Overbilling may involve inflated hours, unauthorized services or misclassification of billable activities. In some cases, these discrepancies gradually accumulate, making them difficult to detect through periodic audits.
Reviewing invoices only at the summary level often fails to reveal these issues. It is the line-level details, such as quantities and billing descriptions, that expose inconsistencies with contracts. Compliance and audit teams need to understand not just the financial totals but the activity those totals represent.
A new area of focus for compliance professionals
Financial transaction data represents one of the richest sources of insight into organizational risk. Within that data lie patterns that can reveal fraud schemes, compliance violations and control weaknesses long before they become visible through traditional oversight methods.
For compliance professionals, this presents both a challenge and an opportunity.
The challenge is that financial activity is complex and high-volume, making it difficult to examine every transaction manually. The opportunity is that greater attention to transaction-level details can significantly strengthen an organization’s ability to detect and prevent misconduct.
As financial systems continue to evolve and transaction volumes increase, the importance of this perspective will only grow.
Compliance programs that expand their focus beyond policies and procedures to include the substance of financial activity will be better positioned to identify emerging risks and protect their organizations from financial misconduct.
Steve Markle is chief operating officer of Itemize, an agentic AI company in finance operations. Previously, he was president and CEO of BirchStreet, an e-procurement and accounts payable platform for the hospitality industry and served as vice president of solutions management at SAP Ariba. 
