Forensics system

1. A computer-implemented method, comprising:

receiving, with a computing system that comprises one or more hardware processors, ticket and invoice data, the ticket data comprising a ticket identifier, a description of requested work, a date work was requested, a number of loads, a vendor identifier associated with the work ticket, an identifier of a vehicle operator associated with the work ticket, a number of hours worked, a service start date, a service end date, and a vehicle identifier;

comparing, with the computing system, the ticket and invoice data to rules to identify anomalies, each anomaly comprising a determination that the invoice data exceeds a threshold of at least one rule of the rules, with at least two rules combined into a single rule;

generating, with the computing system, a graphical user interface displaying information related to the anomalies and selectable options to assign the anomalies to user accounts;

in response to receiving a selection of an option to assign a particular anomaly to a user account, storing, with the computing system, data assigning the particular anomaly to the user account; and

in response to receiving a request to access the user account, generating, with the computing system, a graphical user interface displaying information related to the particular anomaly.

2. The computer-implemented method of claim 1 , further comprising transmitting, with the computing system, the graphical user interface displaying the information related to the particular anomaly to a device associated with the user account.

3. The computer-implemented method of claim 2 , further comprising:

receiving, with the computing system, notes associated with the particular anomaly from the device associated with the user account; and

storing, with the computing system, an association of the notes to the anomaly.

4. The computer-implemented method of claim 1 , further comprising transmitting, with the computing system, the graphical user interface displaying the information related to the anomalies and the selectable options to assign the anomalies to user accounts to a device associated with an administrator account.

5. The computer-implemented method of claim 1 , wherein the ticket and invoice data describe oilfield services.

6. The computer-implemented method of claim 1 , wherein comparing the ticket and invoice data to the rules to identify anomalies includes determining, with the computing system, whether the ticket and invoice data indicates that hours a driver worked in a 24 hour period exceed a threshold.

7. The computer-implemented method of claim 1 , wherein comparing the ticket and invoice data to the rules to identify anomalies includes determining, with the computing system, whether the ticket and invoice data indicates that hours a vehicle was used in a 24 hour period exceed a threshold.

8. The computer-implemented method of claim 1 , wherein comparing the ticket and invoice data to the rules to identify anomalies includes determining, with the computing system, whether tickets associated with a driver in a threshold period of time are sequentially numbered.

9. The computer-implemented method of claim 1 , wherein comparing the ticket and invoice data to the rules to identify anomalies includes determining, with the computing system, whether the ticket and invoice data indicates that a vendor transported more than a threshold volume of oilfield fluids.

10. The computer-implemented method of claim 1 , wherein comparing the ticket and invoice data to the rules to identify anomalies includes determining, with the computing system, whether the ticket and invoice data indicates that a driver or vehicle visited water stations and disposal stations sequentially.

11. The computer-implemented method of claim 1 , further comprising determining, with the computing system, severity levels of the anomalies by comparing the ticket and invoice data to the rules.

12. The computer-implemented method of claim 1 , wherein comparing the ticket and invoice data to the rules to identify anomalies includes determining, with the computing system, whether the ticket and invoice data indicates that a vehicle was operated by more than one driver and for more than a threshold duration in a 24 hour period.

13. The computer-implemented method of claim 1 , wherein comparing the ticket and invoice data to the rules to identify anomalies includes determining, with the computing system, whether invoices with different invoice identifiers identify a common line number amount, date of service, and property serviced.

14. The computer-implemented method of claim 1 , wherein comparing the ticket and invoice data to the rules to identify anomalies includes determining, with the computing system, whether the ticket and invoice data indicates that a driver worked more than 70 hours in a week.

15. The computer-implemented method of claim 1 , wherein comparing the ticket and invoice data to the rules to identify anomalies includes determining, with the computing system, whether the ticket and invoice data indicates that a ticket was submitted more than a threshold period of time after a service date identified by the ticket.

16. The computer-implemented method of claim 1 , wherein comparing the ticket and invoice data to the rules to identify anomalies includes at least one of:

determining, with the computing system, whether a ticket includes a charge for disposal at a disposal site associated with a direct billing procedure;

determining, with the computing system, whether the ticket includes a line item associated with zero hours of work;

determining, with the computing system, whether a first period of time that the ticket indicates a vehicle was in use overlaps with a second period of time that another ticket indicates the vehicle was in use; or

determining, with the computing system, whether a third period of time that the ticket indicates a driver was working overlaps a fourth period of time that the other ticket indicates the driver was working.

17. An apparatus comprising a tangible, non-transitory computer readable storage device configured to store instructions executable by a processor to:

receive ticket and invoice data, the ticket data comprising a ticket identifier, a description of requested work, a date work was requested, a number of loads, a vendor identifier associated with the work ticket, an identifier of a vehicle operator associated with the work ticket, a number of hours worked, a service start date, a service end date, and a vehicle identifier;

compare the ticket and invoice data to rules to identify anomalies, each anomaly comprising a determination that the invoice data exceeds a threshold of at least one rule of the rules, with at least two rules combined into a single rule;

generate a graphical user interface displaying information related to the anomalies and selectable options to assign the anomalies to user accounts;

in response to receiving a selection of an option to assign a particular anomaly to a user account, store data assigning the particular anomaly to the user account; and

in response to receiving a request to access the user account, generate a graphical user interface displaying information related to the particular anomaly.

18. The apparatus of claim 17 , wherein the instructions are further executable by the processor to initiate transmission of the graphical user interface displaying the information related to the particular anomaly to a device associated with the user account.

19. The apparatus of claim 18 , wherein the instructions are further executable by the processor to:

receive notes associated with the particular anomaly from the device associated with the user account; and

store an association of the notes to the anomaly.

20. The apparatus of claim 17 , wherein the instructions are further executable by the processor to initiate transmission of the graphical user interface displaying the information related to the anomalies and the selectable options to assign the anomalies to user accounts to a device associated with an administrator account.

21. The computer-implemented method of claim 1 , wherein the invoice data comprises a billed amount, a number of barrels, one or more line item amounts, a number of loads, an invoice identifier, an associated work ticket identifier, a description of requested work, a vendor identifier associated with the work ticket, an identifier of a vehicle operator associated with the work ticket, a number of hours worked, a service start date, a service end date, and a vehicle identifier.