すべての統制を、すべての取引で、毎日。
年に一度しか検証されないコントロールは、残りの11か月の間に静かに機能しなくなることがあります。CompliBearは主要なコントロールを取引の100%にわたって継続的に監視し、例外を金額と証拠とともに責任者へ送ります。問題は期末に発覚するのではなく、数日で解決されます。
定期的な検証には長い死角がある
サンプリングではパターンが見えない
25件が合格しても、26件目とその後の1000件が不合格かもしれません。
期末のサプライズ
3月に機能しなくなったコントロールが12月に発覚します。お金が出ていった後に。
アラート疲れ
何でも知らせるルールは、重要なアラートを無視する習慣を人に植え付けます。
証拠が散らばっている
Workpapers, emails and spreadsheets. Nobody can trace a finding to its source.
Three frauds, 10,000 invoices, a sample of 25
10,000件の請求書に3件の不正が潜んでいます。ランダムに25件を検証したとき、1件も見つからない確率は？
サンプルを抽出して、何が見つかるか確かめてください。
(9,997 ÷ 10,000)²⁵ ≈ 0.993。10,000件すべてを毎日検証すれば、3件とも見つかります。
From a policy clause to a daily test
- THE CLAUSE“Requirements shall not be split to avoid the approval of the competent authority.”
A line from a purchase manual.
- THE RULE, EXTRACTED BY AIFlag orders to the same vendor, for the same material, within a short window, that together exceed the approval limit while each stays below it.
The auditor reviews and approves the rule.
- THE TESTRuns every day, on every order
The window, the limit and the tolerance stay editable.
Private generative AI reads your documents inside your environment. 750+ ready-made tests are there from day one.
Where we look, and what warns early
| 領域 | What we test | Early-warning signal |
|---|---|---|
| Procurement and tendering | Split orders, single or limited tenders, bid patterns, repeat orders beyond validity | Spend concentrating on a few vendors |
| Vendor master and payments | Duplicates, bank changes, dormant vendors reactivated, payments without receipt | Vendor risk score rising before payment |
| Contracts and capex projects | Billing against the awarded value, extra items, advances not recovered, damages not levied | Contracts trending to overrun |
| Inventory and product | Stock variance against loss norms, write-offs, slow-moving stores and spares | Variance drifting towards the norm |
| Logistics and freight | Claims against distance, duplicate trips, short deliveries, rate overrides | Transporter outlier score |
| Dealers and distributors | Credit-limit breaches, discounts and incentives beyond the scheme, claims, commissions | Dealer health score falling |
| Revenue and receivables | Price applied against the price list, credit notes, rebates, ageing | Collection slippage forecast |
| Payroll and expenses | Ghost employees, duplicate claims, overtime and allowance anomalies | Unusual pay changes |
| Tax and regulatory | GST input credit against GSTR-2B, TDS, the MSME 45-day rule, e-invoice gaps | Due-date breach forecast |
| IT and SAP controls | SoD conflicts, sensitive transactions, direct table changes, privileged access | Control drift alerts |
Six techniques, one engine
| Technique | What it catches | Example |
|---|---|---|
| Rules and thresholds | Known policy breaches | A payment above the delegated limit |
| Statistical tests | 外れ値 | Freight claims per kilometre far above peers |
| Machine learning | Unknown patterns | A dealer that behaves unlike similar dealers |
| Link analysis | Hidden relationships | An employee and a vendor sharing a bank account or address |
| Text analytics | What narrations reveal | Vague narrations on large manual entries |
| Predictive models | Exceptions likely to occur | Invoices on course to breach the MSME 45-day limit |
Signals that come before the loss
| Leading signal | What it predicts | Action before the loss |
|---|---|---|
| MSME invoices nearing 45 days | Interest and a disallowed tax deduction | Prioritise them in the next payment run |
| Contract billing nearing the awarded value | A cost overrun | Review variations before approval |
| Dealer credit use rising while offtake falls | A credit breach or bad debt | Review the credit limit |
| Stock variance drifting towards the loss norm | Product loss | Physical verification |
| Vendor risk score climbing | Payment to a risky vendor | Hold before the payment run |
| Manual overrides rising | A control breakdown | A targeted review |
Every vendor, dealer, contract and user, scored daily
| エンティティ | 種類 | リスクスコア | Trend | Top reason |
|---|---|---|---|---|
| Vendor V-20931 | 仕入先 | 92HIGH | Rising | Bank details changed; tax registration inactive |
| Dealer D-4471 | Dealer | 86HIGH | Rising | Credit use up, offtake down for three months |
| Depot DP-07 | Location | 78MED | Rising | Stock variance close to the loss norm |
| Contract C-1187 | 契約 | 74MED | Stable | Billing near the awarded value |
| ERP user U-0332 | User | 69MED | 新規 | Created and paid the same vendor |
Illustrative scores. Each score runs from 0 to 100 and shows the reasons and source transactions behind it.
解説動画の内容。
- Controls tested once a year can fail quietly for the other eleven months.
- Test a random 25 of 10,000 invoices and there is a 99.3% chance you miss all three frauds. Test all 10,000, every day, and you find all three.
- Private generative AI, inside your environment, turns a policy clause into a daily test. The auditor approves the rule.
- Each exception reaches its owner with a value and the evidence, so problems are fixed in days, not found at year end.
Not data ingestion. Not reporting. An early-warning system for internal audit.
07仕組み
- 01接続
ERPへ読み取り専用で接続
- 02監視
すべてのコントロールを毎日
- 03アラート
ビジネスへの影響順に並べた例外
- 04解決
責任者がOATSで判断し、タイムスタンプ付きの記録を残す
- 05説明
Root Cause Analyzerが原因とコストを示す
08実績
ある上場メーカーは6工場でCompliBearを運用：最初の四半期で4,200件、USD 1.1 Mn相当の例外を発見し、年間2,600時間の監査時間を削減。 · 導入先全体で年間1,690時間以上の手作業による検証を削減
まずは2週間のLaunchPadから
御社のデータに接続し、一緒に選んだ5つのインサイトと2つの機械学習モデルを稼働させ、2週間の集中サポートで伴走します。御社のデータ上で、金額換算された実際の例外をご覧いただけます。
2週間。データは読み取り専用。実際の例外を、金額換算で。
10よくある質問
ERPのGRCモジュールとの違いは？
GRCツールはコントロールの文書化とアクセスルールを管理します。CompliBearは取引で実際に何が起きたかを検証し、例外ごとに金額を付けます。GRCツールと併用できます。
コントロールの責任者は誰ですか？
御社です。インサイトは御社のコントロールフレームワークに合わせて設定し、コントロールの責任者が例外を受け取って判断します。
外部監査人はどう見ますか？
完全な監査証跡付きの継続的な証拠は、通常、監査人の作業を楽にします。手法のご説明も可能です。
コントロールはどのくらい早く追加できますか？
新しいインサイトは750以上のライブラリから追加します。Audit Flexは四半期ごとに5つ、Audit Proは25追加できます。「価格とライセンス」をご覧ください。
How is this different from the audit analytics we already run?
Most analytics report what has already happened. Here the tests come from your own policies and run on every transaction, every day, and leading signals warn the owner before the loss. The observation is drafted for you.
データは当社の環境から出ますか？
No. It runs on premises or in your chosen cloud, with read-only access. The generative AI that reads your policies is private and runs inside your environment.