Anomaly detection

What the anomaly indicator is

CheckBiz360 includes a mechanism for automatically detecting anomalous clocking patterns. When the system identifies behaviour that deviates significantly from what would be expected of a real worker, it activates an anomaly indicator on the employee's profile.

This indicator is not an accusation and is not proof of any irregularity. It is a warning signal indicating that that employee's clocking behaviour deserves a manual review. The responsibility for investigating, interpreting and acting always rests with the human manager.

Why this mechanism exists

Digital clocking solves the problem of manual control, but opens the possibility of new forms of irregularity that are hard to detect visually: employees who ask a colleague to clock in for them, records generated by unauthorised devices or automated behaviour simulating a presence that does not exist.

These situations have two things in common: individually, each record looks correct; taken together, the pattern is too regular to be the product of natural human behaviour. Anomaly detection analyses precisely that: not each isolated clock record, but the pattern they all form over time.

Which patterns trigger detection

The system continuously analyses each employee's records looking for the following signals:

Excessive time precision. A real employee clocks in with natural variation: one day they arrive two minutes early, another a minute late, sometimes the app takes longer to open. If an employee's clock records systematically occur at exactly the same time to the second, over a sufficient number of days, the system considers it statistically improbable and raises the alert.

Static or identical geolocation. If the employee always clocks in from exactly the same GPS coordinates, day after day, with no variation in the decimals, it may indicate that the clock-in is not being made from the employee's own mobile device at their real location, but from a system that always reproduces the same position.

Patterns of excessive regularity. Human behaviour has inherent variability. If all the parameters of an employee's clock records (time, coordinates, workday length) are too constant over a prolonged period, the system identifies that regularity as statistically anomalous.

What the manager should do when an employee is flagged

When the system activates the anomaly indicator for an employee, the recommended course of action is as follows:

1. Review the complete history. Go to the employee's record in the operational intelligence module and examine the records of the last few months. Identify when the anomalous pattern started appearing and whether it coincides with any change in the employee's or the team's circumstances.

1. Check against the operational context. Ask the direct supervisor whether there is an operational explanation: does the employee always work from the same fixed location? Was there any change in their working conditions that explains the regularity?

1. Compare with other employees at the same site. If the anomalous pattern coincides with other employees at the same branch, it may indicate a systemic problem (for example, a shared clocking device in a fixed place) rather than individual conduct.

1. If the irregularity has no obvious explanation, meet the employee. The interview should be conducted with caution: present the data observed, listen to the employee's explanation and document the conversation. Do not confront them with direct accusations based solely on the system indicator.

1. Document the resolution externally. Whether the anomaly has a legitimate explanation or an irregularity is confirmed, record the outcome of the review in whatever systems or procedures your organisation has in place. The platform shows the indicator, but tracking the status of the review has to be done outside CheckBiz360 in the current version.

Review workflow and configurable alerts

In a future version, the anomaly indicator will be integrated into a review workflow with statuses manageable directly on the platform (pending review, reviewed, archived), which will allow each alert's life cycle to be tracked without leaving the back office. Likewise, the possibility of configuring alert notifications is envisaged, so that managers are informed automatically when a new indicator is triggered. For now, the manager has to review the Operations dashboard proactively: the Analysis tab gathers where and when clocking fails, which is where these patterns surface.

What the anomaly indicator does not imply

The anomaly indicator is not a sanction, does not generate a notification to the employee and has no automatic effects on their profile, their rights or their contract. It is exclusively an internal warning tool for managers with access to the module.

The anomaly indicator should under no circumstances be used as the sole basis for starting a disciplinary procedure. Any action of that kind has to be grounded in an investigation process in line with the collective agreement and applicable employment law, with the involvement, where appropriate, of the HR function or legal advisers.