Suspicious activity may be found by automated methods and systems that analyze data records to find association rules correlating values in the fields of the records and then analyzing the association rules, as the association rules themselves can be indicative of improprieties. Thus, minimal human intervention is used to find improprieties in even very large datasets. If the data records are records of sales transactions, the finding and the analyzing of association rules as disclosed can flag suspicious-appearing transactions that may have resulted from improprieties, such as human mistakes or intentional frauds. Instructions for performing the disclosed analyses may be stored on non-transitory storage media for access by systems to execute the automated methods.