What is anomaly detection?

At a glance

• Three types of anomalies: point anomalies, contextual anomalies, and collective anomalies require different detection methods and interpretations.
• Three detection approaches: Statistical methods, rule-based systems, and machine-learning models can be combined and complement one another.
• In controlling, an anomaly is often a signal of process problems, posting errors, or unexpected business developments.
• Anomaly detection is always relative to a frame of reference.

What is an anomaly?

An anomaly is a data point, sequence, or pattern that cannot be explained by the expected behavior of a system. The term comes from the Greek anomalia (irregularity) and essentially describes what people or machines would consider “strange” or “in need of explanation.”

The key point is that an anomaly is not an absolute quantity; it is always relative to a frame of reference. What is normal in one context may indicate a serious problem in another. A 30% increase in revenue in December is expected during the holiday season; in February of the same year, it would be an anomaly requiring an explanation.

In practice, three types are distinguished:

• Point anomalies are individual data points that deviate significantly from the expected value. They are the most common type and the easiest to detect—for example, a single posting amount that is several times higher than the usual level.
• Contextual anomalies are values that appear unremarkable when viewed in isolation but are implausible in the context of their surroundings. A temperature of 25 degrees is normal in summer but an anomaly in January. In controlling, this could be a cost item that appears plausible on its own but cannot be explained in relation to revenue, seasonality, or the prior-year value.
• Collective anomalies do not arise from individual outliers but from the combination of several values that are unusual when viewed together. No individual value necessarily exceeds a threshold—the pattern as a whole is what makes the deviation visible. In controlling, this could occur when several cost centers simultaneously show slightly elevated values without any one of them being conspicuous on its own.

This distinction affects which detection method is appropriate and how the results need to be interpreted. A system designed only for point anomalies will miss collective patterns—and potentially overlook precisely those anomalies that indicate systematic problems.

What does anomaly detection mean in controlling?

Controllers work with large volumes of data every day: revenue figures, cost trends, contribution margins, and liquidity KPIs. Most of these values fall within expected ranges. The exceptions are both problematic and informative: a cost item that suddenly rises 40% above the previous month’s level; a decline in revenue in a region that cannot be explained by seasonal patterns; a payment item that falls outside the normal range.

Without systematic anomaly detection, controllers rely on manual visual checks, experience, or chance. This is error-prone and does not scale—especially when companies need to monitor dozens of cost centers, hundreds of products, and multiple entities in parallel.

Anomaly detection automates precisely this step: It makes unusual patterns visible before they disappear into the noise of large volumes of data.

How does automated anomaly detection work?

Technically, three basic approaches can be distinguished:

• Statistical methods: The classic approach: A measurement is considered an anomaly if it deviates statistically significantly from the expected value—for example, if it is more than two standard deviations away from the moving average. These methods are transparent, easy to explain, and sufficient for many controlling applications. Their disadvantage is that they assume the data follows a particular distribution and are sensitive to structural breaks in time series.
• Rule-based systems: Here, the user explicitly defines what constitutes an anomaly: “If cost center X exceeds the budget value by more than 15%, trigger an alert.” Rule-based systems are easy to understand and can be readily integrated into existing controlling processes. However, they are blind to unknown types of anomalies—anything not covered by a rule remains invisible.
• Machine-learning-based methods: Algorithms such as Isolation Forest, autoencoders, or LSTM networks (Long Short-Term Memory) learn the “normal” behavior of a dataset and identify deviations without explicit rules. They are particularly well suited to high-dimensional data and complex patterns that are difficult to capture statistically. The trade-off is that explainability must be strictly ensured, and implementation requires more effort.

In practice, these approaches are often combined. A rule-based filter triggers alerts for known thresholds; a statistical model monitors time series for unexpected breaks in trends; and a machine-learning model searches for hidden patterns in multidimensional data.

Comparison of detection approaches

How are anomaly detection and visualization connected?

Anomaly detection only delivers its full value when its results are presented appropriately. Raw alert lists that report dozens of outliers every day create alert fatigue: Controllers start ignoring alerts because the signal-to-noise ratio is too low.

Effective visualizations show anomalies in context: embedded in time series, with reference ranges, and with indications of comparable historical events. Sparklines and color-coded heatmaps help users quickly identify unusual patterns without losing sight of the overall picture.

What are the limitations of anomaly detection?

To reliably detect all anomalies, a system must address several typical limitations:

• False positives: Correct values are incorrectly flagged as anomalies—for example, because a special effect such as annual bonuses or one-time payments was not accounted for in the model.
• False negatives: Genuine anomalies are overlooked because they develop gradually and never exceed a threshold on their own.
• Concept drift: The model was trained on historical data representing a business model that has since changed. What was normal in the past may now be considered an anomaly—and vice versa.

These limitations are not an argument against automated anomaly detection. They are an argument for using it thoughtfully. Human-in-the-loop approaches and explainable AI help ensure the reliability of AI-powered anomaly detection.

Application examples: where is anomaly detection used?

Anomaly detection helps wherever large volumes of data are monitored and deviations are relevant to decisions. Typical fields of application within a company are:

Summary

Anomaly detection is an indispensable tool in modern controlling: It makes unusual patterns visible before they disappear into the noise of large volumes of data—automated, scalable, and context-sensitive. Choosing the right detection approach, using appropriate visualization, and establishing clearly defined human-in-the-loop processes determine whether anomaly detection delivers genuine value or leads to alert fatigue. With DeltaMaster, Bissantz integrates anomaly detection as a permanent part of the controlling workflow—not as an isolated feature, but as an attention system that supports controllers where fast, well-founded decisions matter.