Dissecting Expense Approval: Blocking Financial Security Risks
19/09/2026
"Can the system stop an employee from withdrawing double their limit?"
That is the most common question I receive from CFOs when discussing financial security. The honest answer: No, if you rely solely on rigid rules.
In reality, most internal fraud cases do not violate monetary limits, but rather behavioral boundaries. They withdraw funds at midnight, at a store far from the office, or through three consecutive small transactions below the reporting threshold. Old rules only catch the obvious. The clever ones will slip through every gap. This is precisely when User and Entity Behavior Analytics (UEBA) becomes a critical factor in corporate expense management.
Bottlenecks in Current Manual Approval Processes
To understand why change is necessary, look at the internal card expense approval process at a food distribution conglomerate in Hanoi that I once consulted for. While the process sounds simple, its actual operation is highly fragmented.
Stage 1: Transaction Occurrence. An employee purchases raw materials from Supplier A. The banking system sends an SMS notification regarding the balance and amount. This is raw data, lacking context.
Stage 2: Document Collection. The accounting department waits for the VAT invoice from the supplier. The average waiting time is 2-3 business days. During this period, no one verifies if the transaction is reasonable, unless there is a complaint from the supplier.
Stage 3: Reconciliation and Approval. Accountants reconcile the invoice with the payment voucher. If they match, they enter the data into the ERP software. If not, they make a phone call to confirm. This step relies heavily on the diligence and experience of individual accountants.
Stage 4: Month-End Reporting. The CFO reviews the consolidated report. At this point, if there is an anomalous transaction worth 50 million VND, it will be buried among thousands of other transactions. To detect it, you must dig through every PDF file and call every supplier again. This process takes two weeks to a month to clarify.
The biggest problem lies in Stages 2 and 3. The time gap between when money leaves and when it is checked is the gateway for fraud. Furthermore, humans cannot remember the entire spending history of 500 employees. Accountant A may be good at detecting fraud in the North branch, but might miss a sophisticated fraud pattern in the South branch because they have never seen that pattern before.
Where Does AI Fit In? And Where Should Humans Stay?
This is the most important part. Many executives think AI will replace accountants. A major mistake. AI does not replace humans; AI replaces the "static data matching" so that humans can focus on "dynamic context judgment."
What everyone says: "AI will automate the entire approval process; humans just need to click approve."
What reality shows: 100% automation is a path to accidents. I have seen a system automatically block 30% of valid transactions because they deviated from the average model (e.g., a year-end party larger than usual). The result was employees stuck with funds, delayed project progress, and the CFO losing trust in the system.
The correct approach I have implemented with partners like Masan or multinational corporations in Thailand is to tier the process:
- Layer 1: Technical Filtering (100% AI). Check balances, limits, duplicate transactions, and invoice format errors. If there is an error, the system automatically rejects it and sends a detailed notification. No human intervention is needed. This helps reduce the accounting department's workload by about one-third.
- Layer 2: Behavioral Alerts (AI suggests, humans decide). This is where UEBA shines. AI analyzes each employee's spending history. If an employee who usually buys office supplies in Hanoi suddenly makes a 20 million VND purchase in Ho Chi Minh City on a Saturday, the system flags it as "High Risk." It does not block the transaction immediately but pushes the alert to the Finance Manager's dashboard. The manager reviews the context: Is the employee on a business trip? Is there a permission request? If yes, they approve. If no, they call to confirm.
- Layer 3: Exception Approval (100% Human). Transactions exceeding a certain threshold (e.g., over 100 million VND) or involving sensitive categories (cash, gifts) always require manual approval from a higher level. AI only provides supporting information, not autonomous decisions.
The key point is behavioral recognition rather than numerical analysis. A 5 million VND transaction may seem small, but if it is the 10th transaction of the day for the same employee, it is a red flag. Humans find it difficult to spot this with the naked eye when scrolling through 500 lines of data. Machines are very good at this.
Hardware Limits and Data Quality: The Silent Enemies
I want to be direct about a reality that many marketing articles often overlook: The best AI model is useless if the input data is garbage.
In Vietnamese enterprises, expense data is often very "dirty." Supplier names are written inconsistently ("Company ABC" vs "CTy ABC" vs "ABC Trading"). Invoices are blurry, missing barcodes, or folded. When you feed this data into a UEBA model, the result is noise. The model will constantly issue false alerts, causing users to ignore the system (alert fatigue).
I once implemented a project for a lubricant company. The first step was not building the AI model, but spending three months cleaning the data. We established rules for standardizing supplier names, integrated OCR to read invoices automatically, and cross-referenced them with the product catalog. Only when the data was clean and consistent did UEBA begin to make sense.
In addition, hardware limitations are also a factor to consider. Processing millions of transactions daily and running real-time anomaly detection models requires robust computing infrastructure. If your company is using outdated local servers, deploying real-time UEBA will face significant latency challenges. In many cases, we advise clients to move the big data processing layer to the cloud, while keeping sensitive financial data on-premise. This is a trade-off that requires careful consideration between cost and performance.
Another note on the regional context. If your enterprise has a supply chain in the Philippines or Mexico, expense data will differ significantly in terms of time zones, exchange rates, and consumer habits. The UEBA model needs to be trained separately for each geographic region; a single common model cannot be used for the entire system. I have seen many projects fail because they tried to impose US market rules on the Southeast Asian market without adjusting parameters.
Practical Conclusion
No technology can replace human judgment in ambiguous situations. But no human is as good as a machine at recognizing a repeating pattern in millions of lines of data. True financial security comes from knowing that boundary clearly: let AI do the repetitive work, and let humans do the creative and judgmental work.
This series comes out of projects that actually shipped. More on the AIVISION blog, details on face recognition and the rest of our solutions, or reach out to us.