Ranking exceptions by how unusual they are rather than presenting a flat queue, so investigators start with the ones most likely to be genuine problems rather than routine timing.
Unsupervised outlier detection over transaction features — amount, time of day, vendor novelty, frequency spike — plus simple volume-spike comparison against a rolling average
scikit-learn IsolationForest; PyOD; pandas rolling averages for the spike check