Continuous Controls Monitoring (CCM) & Automated Query Architect.

-- PostgreSQL / DuckDB Dialect
-- Detects split POs created for the same vendor within rolling 72h below threshold
WITH clustered_pos AS (
    SELECT 
        p.buyer_id,
        p.vendor_id,
        v.vendor_name,
        p.po_number,
        p.po_date,
        p.total_amount,
        SUM(p.total_amount) OVER (
            PARTITION BY p.buyer_id, p.vendor_id 
            ORDER BY p.po_date 
            RANGE BETWEEN INTERVAL '3 DAYS' PRECEDING AND CURRENT ROW
        ) AS rolling_vendor_spend,
        COUNT(p.po_number) OVER (
            PARTITION BY p.buyer_id, p.vendor_id 
            ORDER BY p.po_date 
            RANGE BETWEEN INTERVAL '3 DAYS' PRECEDING AND CURRENT ROW
        ) AS rolling_po_count
    FROM po_headers p
    JOIN vendor_master v ON p.vendor_id = v.vendor_id
    WHERE p.status NOT IN ('CANCELLED', 'REJECTED')
      -- Flag POs sitting just below DOA limit (e.g., within 10% of 50,000)
      AND p.total_amount BETWEEN (50000 * 0.90) AND 50000
)
SELECT 
    buyer_id,
    vendor_name,
    po_number,
    po_date,
    total_amount,
    rolling_vendor_spend,
    rolling_po_count
FROM clustered_pos
WHERE rolling_po_count > 1
ORDER BY rolling_vendor_spend DESC;