Froc

Methodology

How Frock decides what to flag

Every flag is a lead for review. It means a pattern in public records deserves a question from a person with authority to ask. It is never a finding that anyone did something wrong.

The checks

Scores run from 1 (low) to 3 (high). The Skeptic can lower a score or clear a flag, and a person makes the final call.

Split contracts

HRS §103D-305: purchases may not be divided or parceled to stay under the small-purchase limit.

Logic

  • Awards are grouped by vendor, department and division, using awards dated 2020 onward.
  • Within a 30-day window, the check looks for two or more awards that are each under the limit but together reach it.

Thresholds

  • Limit: $100,000 for goods and services, $250,000 for construction.
  • Base score 1. Add 1 for three or more awards in the window. Add 1 when titles are similar (token overlap of at least 0.5) and at least two awards are 80% or more of the limit.

Known innocent explanations

  • Distinct projects that happened to be bought in the same month.
  • Task orders under a master agreement that was competed earlier.
  • Emergency or exempt procurements.

Limitations

  • Award titles are short and sometimes generic, so similarity is a rough signal.
  • The check cannot see the scope of work. Reviewers need the purchase orders to decide.

Contractor campaign contributions

HRS §11-355: a state or county contractor may not contribute to candidates between contract execution and completion.

Logic

  • Contributions from 2018 onward are matched to vendors by normalized name.
  • A contribution counts when it falls within 365 days after an award date to the same vendor.

Thresholds

  • Window: 365 days after the award, a proxy because contract end dates are not published.
  • Minimum total in the window: $500. Score 2 for three or more contributions or $5,000 or more, otherwise 1.

Known innocent explanations

  • The contract had already ended before the contribution.
  • A different company or person with a similar name.
  • The contribution came from an individual, not the contractor.

Limitations

  • Matching is by name only. Common names produce false matches, which the Skeptic is told to test.
  • Because end dates are unknown, the window can include periods after completion.

Excluded vendor still paid

42 U.S.C. §1320a-7: entities excluded by HHS-OIG may not be paid with federal health care program funds.

Logic

  • Business entries on the LEIE with no reinstatement date are matched to award vendors by normalized name.
  • An award dated after the exclusion date creates a candidate.

Thresholds

  • Names must have at least two words. Score 2 when the excluded business is listed in Hawaii, otherwise 1.

Known innocent explanations

  • A different business with a similar name in another state.
  • The award was funded by non-federal money, which the exclusion does not cover.
  • The exclusion is a name collision with a reinstated entity.

Limitations

  • Matching is on business name only, with no tax ID, so every match needs human confirmation.
  • The award record does not show the funding source.

Payment spikes

A standard audit risk indicator, not a legal rule.

Logic

  • For the current and prior year, a vendor's total is compared with the median of its own yearly totals over the previous five years.

Thresholds

  • At least three prior years of history.
  • Year total at least 5 times the median, and at least $1,000,000 above it. Score 2 at 10 times or more, otherwise 1.

Known innocent explanations

  • A single large, legitimately competed project.
  • Emergency response or disaster recovery spending.
  • A change in how an agency records awards.

Limitations

  • Cannot distinguish a big project from a problem.
  • Vendors with short histories are excluded, so new entrants are covered only by the next check.

New vendor, large award

A standard audit risk indicator, not a legal rule.

Logic

  • A vendor's first-ever award is compared with the 95th percentile of award sizes at that department.

Thresholds

  • Department needs at least 50 awards. Award at or above the greater of the department's 95th percentile and $500,000.
  • Score 2 when no solicitation number is listed, otherwise 1.

Known innocent explanations

  • An established company that is new to this data system or recently renamed.
  • A fully competed bid with a legitimately low-cost winner.

Limitations

  • The record starts when the data does, so a long-standing vendor can look new.
  • Name changes and mergers can break vendor history.

Benford's law, agency level

A forensic accounting technique. It describes agencies, never vendors.

Logic

  • For each department with at least 300 awards of $10 or more, the first-digit distribution is compared with Benford's expected distribution.
  • The deviation is reported as mean absolute deviation (MAD).

Thresholds

  • Minimum 300 awards per department. Departments are ranked by MAD.

Known innocent explanations

  • Purchasing rules that cluster amounts, such as fixed fees or price caps.
  • A few recurring contracts that dominate the count.

Limitations

  • Departure from Benford is a prompt for questions, not evidence of anything.
  • Results are shown at agency level only and never attached to a vendor.

The agent pipeline

  1. 01

    Scout

    Loads contract awards, the federal exclusion list and campaign finance records into the database, with the source link kept for each record.

  2. 02

    Analyst

    Runs the checks above and produces candidate flags. Each carries the rule, the metrics and the evidence records.

  3. 03

    Skeptic

    Receives the evidence and must list innocent explanations first, say whether each holds, and then keep, downgrade or clear the flag.

  4. 04

    Investigator

    Writes a dossier with sourced facts and the records to request. For reported concerns it researches the organization and tests each claim.

  5. 05

    Router

    Proposes the reviewer with authority to look at it, such as a state auditor or a campaign spending commission. A person sends it.

AI model governance

  • Structured outputs

    Model responses must match a fixed schema (verdict, score, explanations, open question). Free-form text that does not validate is rejected, not displayed.

  • Skeptic first

    The model has to argue the innocent explanation before it can keep a flag. Its job is to clear flags, and cleared flags stay in the audit trail.

  • A human decides

    Models propose. A reviewer accepts, rejects or sends. Nothing is routed outside the workspace without a person.

  • No names in public

    Public pages show counts, totals and rates only. Vendor names and flag details never leave the invite-only workspace, and demo mode hides names there too.

  • Sourced claims

    Dossiers and research reports cite the records or pages they rely on. A claim the agents cannot source is marked unverified.

  • Prompt-injection defenses for reports

    Text from a reported concern or a web page is treated as untrusted data, never as instructions. Tool access is limited to read-only research, and outputs must pass the same schema checks.

Data refresh cadence

  • Contract awards: pulled daily.
  • Federal exclusion list and campaign contribution data: refreshed weekly.
  • Live row counts and refresh times are on the data page.

What Frock cannot do

  • It cannot establish intent, and it does not try to.
  • It sees only what is in public records. Missing or mistyped records can hide or invent a pattern.
  • Name matching is imperfect. Every match is confirmed by a person against the source record.
  • Reviewers should treat a flag as a reason to request documents, not as a conclusion.
Request a pilotSee the data