Background: A UK E-commerce Retailer at 1,200 Headcount
This case study is a composite drawn from patterns observed across multiple UK e-commerce engagements. No named customer is represented; details are generalized to protect confidentiality while preserving operational realism.
The client is a mid-market e-commerce retailer operating across the UK and Ireland, with approximately 1,200 employees and annual revenue in the GBP 80-120 million range. The finance and accounting team consists of 14 people, of whom 6 are dedicated to accounts payable. The company holds ISO 27001 certification, a requirement driven by its B2B wholesale division and its payment processor’s vendor security questionnaire. The existing stack includes NetSuite ERP, a document management system (DMS) for incoming supplier invoices, and a custom internal approval workflow built on a low-code platform. Invoices arrive via email, EDI, and a supplier portal, creating three separate ingestion paths that all funnel into manual data entry before posting to NetSuite.
Challenge: 4.2% Error Rate and an ISO 27001 Surveillance Audit
The finance director flagged a specific pain: 6 of 14 AP staff spent an estimated 35-40 hours per week on manual invoice data entry, cross-referencing supplier codes, and chasing missing PO numbers. The error rate on manual entry was measured at 4.2% over a 90-day sample of 1,800 invoices, with the most common errors being incorrect tax codes and mismatched supplier references. Each error triggered a correction cycle averaging 3.5 days, delaying supplier payments and occasionally triggering late-payment penalties under supplier contracts.
The operational pressure was twofold. First, the company was preparing for a Series C fundraising round in Q3, and the CFO wanted to demonstrate operational efficiency gains to investors. Second, the ISO 27001 surveillance audit was scheduled for the following quarter, and the auditors had noted the manual process as a control weakness in the previous year’s report. The finance team needed a solution that reduced manual effort without introducing a new compliance risk. The constraint was clear: no invoice data could leave the company’s controlled environment without a documented risk assessment, and any third-party API usage had to be covered by a data processing agreement.
Approach: A 4-Week Integration Sprint on Anthropic Claude
Forfis scoped a 4-week integration sprint focused on a single process: supplier invoice ingestion and data extraction. The process audit in week one mapped all three ingestion paths (email, EDI, supplier portal) and identified that 78% of invoices arrived as PDFs with a consistent layout from the top 20 suppliers. The pilot scope was deliberately narrow: automate extraction for those 20 suppliers, route the remaining 22% to manual entry, and integrate the extracted data into NetSuite via its REST API.
The technical stack used the Anthropic Claude API for document understanding and field extraction. The integration layer was a custom Python service deployed on the client’s existing AWS account, receiving webhooks from the DMS when a new invoice was uploaded. The service called the Claude API with a structured prompt that specified the expected output schema (supplier name, invoice number, line items, tax code, total amount, due date). The response was validated against a JSON schema, and any field with a confidence score below 0.92 was flagged for human review. Approved records were pushed to NetSuite via its REST API, with a webhook confirmation written back to the DMS.
The human-in-the-loop layer was built into the client’s existing low-code approval platform. Reviewers received a Slack notification with a link to a review screen showing the extracted fields, the original PDF, and a one-click approve/reject button. Every action was logged with a timestamp, user ID, and the model’s raw output, creating an audit trail that mapped directly to ISO 27001 Annex A.12 and A.14 controls.
Outcome: 61% Cycle-Time Reduction and 0.8% Error Rate
The pilot ran for 6 weeks post-launch, covering approximately 2,400 invoices from the 20 in-scope suppliers. The measured results, compared against the 90-day baseline:
- Cycle time (from invoice receipt to NetSuite posting) dropped from an average of 4.1 days to 1.6 days, a 61% reduction.
- Error rate on extracted fields fell from 4.2% to 0.8%, with the remaining errors concentrated in tax code classification for cross-border invoices.
- Manual data entry hours for the 6 AP staff decreased by an estimated 28 hours per week, freeing capacity for supplier reconciliation and month-end close tasks.
- Late-payment penalties dropped to zero during the pilot period, compared to an average of GBP 1,200 per month in the prior quarter.
The human-in-the-loop approval queue averaged 12-15 items per day, with a median review time of 45 seconds per invoice. The finance team reported that the approval step felt like a quality check rather than a data-entry task, which improved adoption. The ISO 27001 surveillance audit, conducted 8 weeks after launch, noted the new process as a control improvement, with no findings related to the automation layer. The client’s CTO confirmed that the integration code, API keys, and infrastructure were fully owned by the client, with no vendor lock-in beyond the Anthropic API subscription.
Lessons for Similar Teams
-
Scope discipline is the single biggest predictor of sprint success. The pilot succeeded because the team resisted the urge to include the 22% of non-standard invoices in week one. Expanding scope to all suppliers would have pushed the timeline to 8-10 weeks and diluted the baseline measurement. Start with the 70-80% of documents that share a common format, prove the pipeline, then expand.
-
Baseline measurement must happen before the build, not after. The 4.2% error rate and 4.1-day cycle time were measured over 90 days before any code was written. Without that baseline, the outcome metrics would have been anecdotal. Allocate at least one week to process mapping and data collection before the integration sprint begins.
-
Human-in-the-loop design determines adoption, not accuracy. A 95% accurate model is useless if the approval queue is buried in a separate system. The approval step had to live where the reviewers already worked (Slack, in this case) and required no more than one click to approve. The 45-second median review time was a design outcome, not an accident.
-
Compliance documentation is part of the deliverable, not an afterthought. The ISO 27001 risk assessment, data processing agreement with Anthropic, and audit trail specification were drafted during week one, not retrofitted in week four. For regulated clients, compliance artifacts should be treated as first-class deliverables with their own acceptance criteria.
-
Model-agnostic architecture protects the client’s future. The integration layer was built to swap the LLM provider without changing the ingestion, validation, or ERP posting logic. If the client later moves to an open-weight model on-premises for data residency reasons, the change is a configuration update, not a rebuild.
Leave a Reply