The audit pipeline a 10–100 person multi-clinic group actually needs.

Lab, imaging, and pharmacy suppliers that bill several clinics in the same week enter through one group inbox, reconcile against one shared PO list, and queue reversals in one place. A line that posts clean to one clinic continues through; a stale PO, a missing end-date on a clinic-level contract, or an out-of-band total pauses the posting and surfaces on the group digest with the rule, the reason, and the suggested next action.

A lab that bills Northgate and Westside for the same accession, a pharmacy that re-ships the same controlled-substance order to two sites in the same week, an imaging centre that splits one study into two invoices across locations — the duplicate-pay guard fires on identical vendor + invoice-number + near-identical amount within 90 days, regardless of which clinic the line belonged to. Any one pauses the second posting and lands on the next morning's digest.

An EMR add-on billed to one clinic, a telehealth line item billed to another, a per-location IT-services contract that quietly auto-renews, a billing-platform module that ships "free for the first 90 days" and then posts the same way a lab invoice does — PODetect treats subscription and seat-creep lines the same way it treats a lab invoice: an AP line that lands, a contract that owns it, a 30/60/90-day notice window that opens against the matching contract record, and a clean post or a flag on the morning digest. The same vendor-master guard that runs against lab and imaging runs against the SaaS roster, so a duplicate seat line and a duplicate lab line land in the same reversal queue.

One digest channel per group, one reversal window per clean posting, and one canonical evidence record per rule that fires. The clinical controller signs off from a single morning review — no outsourced reviewer, no shared spreadsheet, no per-clinic inbox to chase. The 30-day reversal window backs every clean post in case the next morning's digest returns a thumbs-down.