What a controller team can reach by hand

3% sample — realistic coverage of manual invoice-vs-contract review.

The other 97% runs on trust and sampling — exactly where the leak lives.

Source: benchmarks & own history