Reading flags and the risk score

Every transaction accumulates points from whichever flags apply, and the total maps to a risk level shown as a colored badge and rolled up in the summary cards.

Risk levels

• Critical — 90+ points
• High — 60+ points
• Medium — 30+ points
• Low — under 30

Flags from the P-Card Excel

These fire the moment you load a file — no receipt images needed: - High Dollar — a single transaction ≥ $5,000 (High) or ≥ $1,000 (Medium); airfare is exempt from the High tier, hotels from the Medium tier. - Split Cluster — multiple rows (same Transaction Reference, or same merchant/day) that are each under an approval threshold but add up over it. - Suspicious Merchant — a merchant name that looks like impersonation, an unusually close match to a frequent vendor, an MCC-to-name mismatch, or a garbled/digit-heavy name on a high-dollar charge.

Running Trend against PULSE history adds the statistical flags (spend and transaction-velocity outliers, MCC shifts, peer and approver comparisons) — these need several months of data to compute a meaningful average, so they never fire against a single month's file.

Flags from the OCR module

These come from SPARK_OCR.exe and appear once you import its output through OCR Excel. They're scored per receipt — the tool only ever looks at one image at a time, so these describe what's on that receipt, not patterns across transactions: prohibited merchant categories (alcohol, entertainment, gaming, luxury or consumer retail, foreign merchants), personal items on the line-item list (gift cards, home-improvement or consumer goods, a duplicate line item, one vague catch-all line item, every line item landing on a whole dollar), and a tip over 20% of the pre-tip subtotal.

If someone's transactions are missing entirely

Check the Admin area's Excluded Cardholders tab — an admin can exclude a cardholder there, which voids (not deletes) their existing rows and leaves them out of every future load and Trend read.