> ## Content Index > Fetch the complete content index at: https://www.livain.com/llms.txt > Use this file to discover other available public pages before exploring further. # The audit found eleven missing receipts. Nine of them existed. - URL: https://www.livain.com/blog/eleven-missing-receipts-nine-existed/ - Published: 2026-08-27T07:00:00.000Z - Updated: 2026-08-29T07:07:41.000Z - Description: An automated gap report compared bank lines against an index that only knew one of several folders. The fix wasn't a smarter matcher — it was an index that could prove it saw everything. - Author: Remco Livain - Tags: AI, Entrepreneurship, IMHO The first automated gap report on my own bookkeeping came back with eleven missing receipts and a five-figure franc total attached to them. That is the kind of number that ruins an afternoon. Nine of the eleven were sitting on my disk the whole time. Two were genuinely missing. The report was not wrong about what it had checked. It was wrong about what it had checked *against*, and that distinction is the entire post. ### An index that only knew one folder Years of filing had produced three competing taxonomies in the same tree. A processed archive organised by year and month. A separate personal branch. A non-receipt branch for things that had been scanned but judged not to be receipts. And underneath all of it, an older sorted structure by entity, year and category, from a previous system that had never been fully retired. The master log — the thing every report was built on — effectively only knew about the processed branch. Everything filed anywhere else was invisible to it. So every gap analysis dutifully compared bank lines against a partial list and reported the difference as missing. They were not missing. They were unindexed. Those are very different problems and they produce identical reports. > An index that cannot prove it is complete does not produce a report. It produces fiction with a confident total at the bottom. Auditors have a name for what I got wrong, and a whole methodology around it. Completeness is the hardest assertion to test precisely because [you cannot find a missing transaction by searching the ledger it never made it onto](https://www.fieldguide.io/resource-articles/why-completeness-assertion-hardest-to-test?ref=livain.com) — the evidence sits outside the recorded population, so a bigger sample just covers more of the wrong list. That is exactly what I had built: a very thorough scan of the wrong list. ### What fixed it was not a smarter matcher The instinct, when a report is unreliable, is to improve the report. Better fuzzy matching. Wider date tolerance. More clever handling of currency. None of that would have helped, because the input was the problem. What actually fixed it was collapsing two hundred and fifty-seven folders into six, and then building an index that walks every branch including the frozen archive, and records date, vendor, amount and reference number for all of it. Roughly three and a half thousand files, indexed once, with a sheet that lists everything not yet linked to a booked line. Only then does a gap report mean anything. And the number it now produces is uncomfortable in a useful way: over a thousand receipts on file that are not linked to anything. Some are duplicates, some are HTML train tickets, and some are real work. But that is a backlog, which you can burn down. The previous version was a rumour. ### The matching rule that beats amount and date One practical thing came out of the rebuild that I would not have predicted. Amount-and-date matching fails constantly and fails silently. It fails on foreign currency, because a euro invoice and a franc debit are different numbers on different days. It fails on collective invoices, where one annual provisional bill covers four separate payments. It fails whenever a payment is split or partial. Reference numbers do not fail. The payment reference from the bank line is often sitting verbatim in the receipt's filename or in the document text. Matching on that is exact, order-independent and survives currency conversion entirely. Amount and date are now the fallback, not the primary key. The other lesson was less flattering: read the whole document. I dismissed one telecom invoice twice as "not a receipt" because page one was a price-adjustment letter. The invoice started on page two. An assistant that stops reading at the first page will confidently tell you a receipt does not exist, and it will be as wrong as I was. ### The key that was never used While clearing this up I found an API key sitting in plaintext in a config file, inside an iCloud-synced folder — which means it was in every device sync and every backup. Not ideal. The more interesting finding was that no script had ever read it. Nothing in the pipeline imports the SDK or calls the API. What the documentation called "vision" was the session model reading the file directly with a file tool. The key was a fossil from an earlier standalone version that had been replaced without anyone removing its credentials. All four keys from that generation are now deleted. But the pattern is worth naming, because it is common and quiet: secrets outlive the code that needed them. OWASP's [secrets management guidance](https://cheatsheetseries.owasp.org/cheatsheets/Secrets%5FManagement%5FCheat%5FSheet.html?ref=livain.com) is blunt about it — the real risk is persistence, secrets surviving rotation, remaining valid downstream, and being reintroduced by people copying a working example. Deleting the script is not deleting the key. ### Why any of this matters beyond my own books Swiss law requires business records and supporting documents to be retained for ten years from the end of the financial year — [Art. 958f of the Code of Obligations](https://www.swissrights.ch/gesetze/Artikel-958f-OR-2025-DE.php?ref=livain.com), and the [electronic bookkeeping rules](https://www.kmu.admin.ch/kmu/en/home/concrete-know-how/finances/accounting-and-auditing/electronic-bookkeeping.html?ref=livain.com) allow that to be digital as long as it stays readable and faithful. Ten years is a long time for three competing filing systems to accumulate in. And this generalises well past accounting. Every dashboard, every gap report, every "we're missing X" alert rests on an index somewhere, and almost nobody checks whether that index sees everything it claims to see. I have made the same mistake on client data — [querying the database I could see rather than the one that mattered](https://www.livain.com/blog/the-database-i-could-see-wasnt-the-database-that-mattered/), and getting an answer that was internally consistent and useless. The leverage from AI here was real and it was not the part people expect. It did not find the missing receipts. It read three and a half thousand documents so that a complete index could exist at all — the tedious, unbounded part that no human does properly. The judgement that mattered was noticing the first report was too dramatic to be true, and going after the index instead of the matcher. Before you believe a report about what is missing, make it show you what it looked at. ### Sources & further reading **External** [Fieldguide — Why the Completeness Assertion Is the Hardest to Test](https://www.fieldguide.io/resource-articles/why-completeness-assertion-hardest-to-test?ref=livain.com) [OWASP — Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets%5FManagement%5FCheat%5FSheet.html?ref=livain.com) [Art. 958f OR — Führung und Aufbewahrung der Geschäftsbücher](https://www.swissrights.ch/gesetze/Artikel-958f-OR-2025-DE.php?ref=livain.com) [KMU Portal (Switzerland) — Electronic bookkeeping](https://www.kmu.admin.ch/kmu/en/home/concrete-know-how/finances/accounting-and-auditing/electronic-bookkeeping.html?ref=livain.com) **Related posts** [I let AI clear two years of receipts. The leverage wasn't speed.](https://www.livain.com/blog/i-let-ai-clear-two-years-of-receipts/) [For the first time ever, I closed a quarter without a missing receipt.](https://www.livain.com/blog/first-quarter-without-a-missing-receipt/) [The database I could see wasn't the database that mattered.](https://www.livain.com/blog/the-database-i-could-see-wasnt-the-database-that-mattered/)