Saffron Automations

Home · Field Notes

What breaks when automation touches billing

Six ways billing automation fails once nobody is watching — each with the tell that gives it away before it costs you, and the question that finds it on a first call.

2 September 2026Saffron Automations7 min read

Automation earns its keep on the work nobody wants: the reconciliation, the categorisation, the month-end close, the chasing. Billing is where that value is highest, because billing is the work that is both relentless and unforgiving. It is also where the failure modes stop being inconvenient and start being money — a duplicated invoice is not a bug report, it is a phone call from a client.

What follows are six ways billing automation fails once it is running unattended. None of them are exotic. All six have a tell — a way they show up before anyone reconciles — and all six are things you can ask a vendor about on a first call, before you have signed anything.

If you want the general version of this — how to audit any automation vendor, whatever they are automating — that is the previous piece. This one is specifically about the money.

Failure 01

The retry that bills twice

A job runs, gets most of the way through, and the connection drops. The system retries. Whether that retry is safe depends entirely on whether every step it already completed can be repeated without doing anything a second time. Sending an invoice cannot. Charging a card cannot. Posting a journal entry cannot.

This is the single most common way billing automation costs a client money, and it is invisible in a demo, because a demo never has a network failure halfway through.

How it shows up Two invoices with different numbers and identical line items, minutes apart. Or a payment that reconciles to nothing, because the charge succeeded and the record of it did not. The control Every side-effecting step carries a key that makes a repeat a no-op — the second attempt recognises the first and does nothing. Ask to see where that key comes from and what happens when two runs collide.
Failure 02

The partial run that reports success

The job is supposed to process a thousand records. It processes eight hundred, hits something malformed on the eight hundred and first, and stops. Nothing threw an exception that anyone catches, so the run finishes and the status is green.

Two hundred clients were not invoiced this month. You find out when one of them mentions it, or you do not find out at all.

How it shows up Revenue that is slightly low in a way nobody can explain, and a run log that says everything worked. The control The run declares what it expected to do before it starts and reconciles against that at the end. “Processed 800” is not a result. “Processed 800 of an expected 1,000, 200 skipped, here they are” is.
Failure 03

The clock and the period

Billing is the one domain where the calendar is load-bearing. An invoice dated the first of the month but generated at 23:50 on the thirty-first, in a timezone nobody specified, lands in the wrong period. A monthly job scheduled on the 31st does not run in February, April, June, September or November. A job that runs “daily at 2am” runs twice on one day a year and not at all on another.

How it shows up A month that closes short and the next one that closes long, by the same amount. Or a client billed eleven times in a year and nobody notices which month is missing. The control Periods are decided by explicit business dates, not by whenever the job happened to run, and every stored time carries its zone. Ask what the system does on the 31st of a 30-day month — the answer is quick if they have thought about it.
Failure 04

Money arithmetic done in the wrong type

Currency is not a decimal number and it does not behave like one. Held as a floating-point value, money drifts: fractions of a cent accumulate across thousands of line items until a total does not match the sum of its parts. Split a bill three ways and the rounding has to go somewhere; if nobody decided where, it goes somewhere different each time.

How it shows up Totals off by a cent or two that nobody can source, and that get written off rather than explained. It looks trivial until an auditor asks. The control Money is held in minor units as integers, or in a decimal type, never a float — and the rounding rule is written down rather than inherited from whatever the language does by default.
Failure 05

The upstream change nobody versioned

A tax rate changes. A price list is updated. A payment provider renames a field or starts returning a value it did not return before. The automation keeps running. It does not know anything changed, so it applies last quarter's rate to this quarter's invoices, quietly and consistently, until someone reconciles far enough back to find it.

How it shows up A discrepancy with a clean start date. Everything before a certain day is right; everything after it is wrong by the same proportion. The control Rates, prices and tax tables are versioned with effective dates, and an invoice records which version it was calculated under. Then a wrong rate is a query, not an investigation.
Failure 06

No way to unwind it

The last one is the one that turns a small failure into a long week. Something goes out wrong to four hundred clients. Now what? If every action the system takes has a defined inverse — void this invoice, reverse this posting, re-run this period from a known state — the fix is an afternoon. If it does not, the fix is four hundred manual corrections and a note to every client.

Vendors rarely bring this up, because talking about the undo means admitting the do can be wrong.

How it shows up You only discover it at the worst possible moment, which is why it belongs on the list before you sign rather than after. The control Every automated action has a documented reversal, and the reversal has been run at least once on purpose. Ask when they last used it.
A system that cannot be unwound is not automation. It is a decision you only get to make once, four hundred times.

Six questions, for a first call

None of these require you to understand the stack. All six are answerable in a sentence by someone who has built this before, and produce visible discomfort in someone who has not.

  1. If a run fails halfway through and retries, what stops the second attempt re-sending what the first one already sent?
  2. How does a run that processes eight hundred of a thousand records report itself — and to whom?
  3. What decides which period an invoice belongs to: the business date, or the time the job ran?
  4. What type holds the money, and where is the rounding rule written down?
  5. When a tax rate or a price changes, what tells the automation — and can an old invoice still be recalculated under the rate it used?
  6. What is the reversal for each automated action, and when did you last run one for real?

You are not testing whether they have answers. You are testing whether the answers arrive as things they have already thought about, or as things they are working out while you listen.

Where this comes from

Saffron Group is an engineering conglomerate: custom software with no off-the-shelf equivalent, applications, platforms, integrations into systems never designed to be integrated with, web, and the agentic layer on top. Minneapolis and New York.

The specific ground under this piece is The Benchmark Construction in New York — a high-end Manhattan general contractor building on MZM Corp's twenty-five-year legacy across New York, New Jersey and Connecticut. We built their website and their custom billing, accounting and payroll platform. Off-the-shelf construction software could not handle how they run jobs, so we built the system that could. Every failure mode above is on this list because it had to be designed against in something real.

And the reason the list stops where it does: the system takes the reconciliation, the categorisation, the month-end close, the chasing — the work somebody does at eleven at night that nobody became an accountant to do. What it does not take is the judgement. Deciding which client gets the call rather than the letter, when a discrepancy is an error and when it is a conversation, what a number means for a relationship — that stays where it is. Automate everything that dulls the hand. Never the hand itself.

Run the checks on us

Everything above is a standard we would rather be held to than describe.

If you would rather just talk it through, book a call. Bring your worst month.

Published 2 September 2026 by Saffron Automations, a division of Saffron Group. Corrections and disagreements are welcome — if any claim on this page stops being true, it gets changed here with the date on it rather than quietly removed.