Vendor Anomaly Detection — Florida CRE Portfolio

Vendor price creep, single-month spikes, and CAM-reconciliation errors invisible to monthly spot-checks were silently eroding NOI on a multi-property portfolio.

• Industry research (PredictAP / Tango Analytics) reports 40% of CAM reconciliations contain material errors — translating to $5-15B in industry-wide leakage
• Vendor price creep of 3-8% annually is common on unmonitored portfolios and invisible at the monthly-review level
• Hauler and utility vendors are particularly prone to silent rate increases under multi-year contracts
• Property-management chart-of-accounts often miscodes vendor categories — e.g., landscaping booked under a waste-removal GL — compounding analytical error

Built a deterministic Python pipeline that ingests Yardi-style General-Ledger exports, normalizes vendor names, and runs three orthogonal anomaly detectors against 36 months of AP history. End-to-end runtime under 2 seconds per portfolio.

• GL parser handles hierarchical section-header format (GL code as section row) with vendor names embedded in the description field, plus the Debit/Credit column split — a Yardi quirk that breaks naive CSV parsers
• Z-score detector flags single-month spikes against a vendor-specific historical mean (threshold: >2σ AND > $200 absolute impact, to suppress noise)
• Rolling-mean detector catches gradual upward drift — 0.5-1%/month price creep that compounds to 6-12% annual increases invisible to monthly review
• Duplicate-invoice detector catches same-vendor / same-amount / within-7-days submission pairs
• Vendor name normalization strips legal suffixes (LLC, Inc, Corp) but preserves brand identity (Services, Group) — corporate descriptors are recognition cues, not noise
• Separates CapEx from OpEx so a one-time $10K water-main replacement does not corrupt the baseline for the same vendor's $550/mo routine plumbing maintenance

Phase 1 audit on a 36-month General-Ledger export (May 2023 → May 2026) surfaced 7 anomalies across 59 vendors. The smoking-gun vendor was a regional trash hauler where 5 corroborating flags landed cumulatively on $3,559 of dollar-impact, including a single-month spike to $2,292 (179.8% above baseline) where the Z-score and rolling-creep detectors fired on the same data point — high-confidence dual-detector corroboration. Cap-rate translation: at the prevailing 6.5% cap rate, the modeled annualized recovery translates to $133K in property value created.

“The November 2024 single-month spike to $2,292 was the dual-detector anchor — Z-score and rolling-creep both fired on the same data point. That kind of corroboration is what separates a signal from a false positive. A property manager scanning monthly statements would see the spike but not the structural shift; the engine catches both, separately.”

— DMG audit report — anonymized Florida CRE engagement

Timeline

6 weeks discovery and data ingestion, pipeline run in ~1.5 seconds end-to-end, Phase 2 expansion (change-point detection for regime-shift vendors) currently in scoping.