Responding to Risk Alerts
How anomaly detection works and how to investigate and resolve flagged procurement activity.
Overview
The Risk Detection module uses machine learning and rule-based analysis to identify anomalies in procurement activity — including unusual pricing patterns, bid rigging indicators, conflict-of-interest violations, and supplier performance concerns. This guide explains how to review, investigate, and resolve these alerts.
Step-by-Step Guide
Step 1: Review the Alert Dashboard
The Risk Dashboard displays all active alerts sorted by severity — Critical, High, Medium, and Low. Each alert includes the affected module, transaction reference, detected anomaly type, and a brief description. Review the dashboard regularly to ensure no alerts remain unaddressed beyond the configured response SLA.
Step 2: Investigate Flagged Activity
Click on any alert to open the detailed investigation view. This includes the full transaction history, related records, and the specific data points that triggered the anomaly. For example, a pricing alert will show historical pricing for the same supplier and category, highlighting the deviation. Use the linked records to trace the complete procurement lifecycle.
Step 3: Take Action
After investigation, select the appropriate action. "Escalate" routes the alert to management or the investigation unit with your notes. "Dismiss" closes the alert if the investigation found no issue — dismissal requires documented justification. "Investigate" opens a formal investigation workflow with evidence collection and reporting. All actions are logged in the Audit Vault.
Step 4: Document the Resolution
Every alert must be resolved with documented findings. Record your conclusion, supporting evidence, and any corrective actions taken. If the alert revealed a process gap, document the recommended process improvement. The resolution record is sealed in the Audit Vault and feeds into your organisation's risk reporting.
Tips & Best Practices
- Never dismiss an alert without investigation — even false positives should be documented to improve detection accuracy.
- Escalate potential fraud or corruption immediately to the designated authority; do not attempt to resolve internally.
- Use alert patterns to identify systemic weaknesses — recurring alerts in the same module or category indicate a process improvement opportunity.
- Review resolved alerts quarterly to assess detection effectiveness and adjust sensitivity thresholds where needed.
Related Features
Risk Detection — Features page →