Which of the following is the MOST effective way to identify anomalous transactions when performing a payroll fraud audit?