How is the driver of a month-over-month account change identified?

Short answer

By breaking the change into the transactions behind it, grouped by vendor, entry, or department, until a few items explain most of the movement.

An account balance is the sum of everything posted to it. Finding the driver of a change means comparing the detail from both periods, not the totals, and narrowing it down until the explanation names something specific.

Steps to isolate the driver

Confirm the balances: Make sure both periods are final enough to compare and the trial balance ties. A change caused by an entry still in progress isn't a driver yet.
Pull detail for both periods: Export the GL activity for the account in each month, not just the ending balances.
Group the activity: Sum it by vendor or customer, entry source (AP, payroll, manual journal entries), department, and posting date, then compare each group across the two months.
Rank the differences: Sort the groups by dollar change. One to three groups usually explain most of the movement.
Open the transactions: Read the invoices, contracts, or entries behind the top groups.
Confirm the cause: Check with the budget owner, the vendor, or the person who booked the entry before writing it up.

Common drivers and how they show up

Driver	What it looks like in the detail
Timing	An invoice or accrual that landed in one month last period and the next month this period
Price or volume	The same vendor, with a higher amount per invoice or more invoices
One-time item	A single large entry with no counterpart in the prior month
Accrual error	An accrual that didn't reverse, or reversed without the actual invoice being booked
Miscoding	A vendor's charges in an account they don't usually hit
New vendor or contract	Activity from a vendor with no history in the account

What does a Ramp Stack agent do with a flagged account?

Connect the ledger and the support: The ledger and the places supporting documents live, such as SharePoint or OneDrive, are connected under Stack > Knowledge > Apps. Stack reads spreadsheets and PDFs, including scanned invoices through OCR.
Pull and group the detail: The agent pulls GL activity for the account in both months and sums it by vendor, entry source, and department.
Break the change into drivers: Using the variance analysis skill, it ranks the groups by dollar change and builds a waterfall from last month's balance to this month's.
Read the transactions behind the top drivers: It opens the invoices, contracts, and journal entries it has access to and drafts a narrative that names them, such as a new vendor or an accrual that didn't reverse.
Ask instead of guessing: When the cause depends on context it can't find, such as whether a contract was renegotiated, the agent asks the reviewer.
Leave a trail: The reviewer edits or rejects the draft, and the Session Audit Log records each source, action, and output behind it.