Catching Anomalies

One Wednesday in June, the card machines fail across the whole chain. Sales drop by more than half. Nobody at head office notices until the following week. A simple automated alarm would have flagged it the same evening.

• The card machines fail
• Sales halve
• Nobody notices for a week

A seasonal alarm

We take our real data, and we break one day on purpose, cutting it to less than half. Now, a simple rule like, below a fixed number, won't work, because normal sales change with the weekday and the season. So we compare each day with recent days of the same weekday. That gives us a ratio. Then we ask how unusual that ratio is, compared with the last ninety days. Run it. In two years of data, there's only one alert, and it's the exact day that we broke. It's about nineteen standard deviations away from normal. That's what a good alarm looks like. It finds the real problem, and it doesn't cry wolf.

import pandas as pd

sales = pd.read_csv("sales.csv", parse_dates=["date"])
d = sales.groupby("date")["revenue"].sum().asfreq("D")
d.loc["2025-06-18"] *= 0.45

base = d.rolling(28).median().shift(1)
ratio = d / d.groupby(d.index.dayofweek).transform(lambda s: s.rolling(4).median().shift(1))
z = (ratio - 1) / (ratio - 1).rolling(90).std().shift(1)

alerts = z[z.abs() > 4]
print("Alerts:", [str(i.date()) for i in alerts.index])
print(alerts.round(1).to_string())

Alerts: ['2025-06-18']
date
2025-06-18   -19.1
Freq: D

Alarms people trust

An alarm that fires every day is soon ignored. So set the threshold high to begin with, and lower it slowly. Compare like with like, which here means the same weekday. Send alarms to the person who can act. And include context, such as which cafe, how big the gap is, and what the usual level looks like. Track false alarms, and tune them out.

Summary