Quick Response Fraud Detection using Data Analytics: Hitting the Ground Running using Technology in a Suspected Fraud Case

Quick Response Fraud
Detection using Data
Analytics: Hitting the
Ground Running using
Technology in a Suspected
Fraud Case
July 31, 2013
Special Guest Presenter:
Rich Lanza

Copyright © 2013 FraudResourceNet™ LLC

About Peter Goldmann, MSc., CFE



President and Founder of White Collar Crime 101

Publisher of White-Collar Crime Fighter
Developer of FraudAware® Anti-Fraud Training
Monthly Columnist, The Fraud Examiner,
ACFE Newsletter

 Member of Editorial Advisory Board, ACFE
 Author of “Fraud in the Markets”
Explains how fraud fueled the financial crisis.


About Jim Kaplan, MSc, CIA, CFE
 President and Founder of
AuditNet®, the global resource
for auditors
 Auditor, Web Site Guru,
Internet for Auditors Pioneer
Recipient of the IIA’s 2007
Bradford Cadmus Memorial
Award.
 Author of “The Auditor’s
Guide to Internet Resources”
2nd Edition

Richard B. Lanza, CPA, CFE, CGMA
• Over two decades of ACL and Excel software usage
• Wrote the first practical ACL publication on how to
use the product in 101 ways (101 ACL Applications)
• Has written and spoken on the use of audit data
analytics for over 15 years.
• Received the Outstanding Achievement in Business
Award by the Association of Certified Fraud
Examiners for developing the publication Proactively
Detecting Fraud Using Computer Audit Reports as a
research project for the IIA
• Recently was a contributing author of:
• Global Technology Audit Guide (GTAG #13) Fraud
in an Automated World - IIA
• Data Analytics – A Practical Approach - research
whitepaper for the Information System
Accountability Control Association.
• “Cost Recovery – Turning Your Accounts Payable
Department into a Profit Center” – Wiley & Sons.
 Please see full bio at www.richlanza.com

Webinar Housekeeping


This webinar and its material are the property of
FraudResourceNet™ LLC. Unauthorized usage or recording of
this webinar or any of its material is strictly forbidden. We will be
recording the webinar and you will be provided access to that
recording within five-seven business days. Downloading or
otherwise duplicating the webinar recording is expressly prohibited.



You must answer the polling questions to qualify for CPE per
NASBA.



Please complete the evaluation to help us continuously improve
our Webinars.



Submit questions via the chat box on your screen and we will
answer them either during or at the conclusion.



If GTW stops working you may need to close and restart. You can
always dial in and listen and follow along with the handout.

Disclaimers


The views expressed by the presenters do not necessarily represent the
views, positions, or opinions of FraudResourceNet LLC (FRN) or the
presenters’ respective organizations. These materials, and the oral
presentation accompanying them, are for educational purposes only and do
not constitute accounting or legal advice or create an accountant-client
relationship.
While FRN makes every effort to ensure information is accurate and
complete, FRN makes no representations, guarantees, or warranties as to
the accuracy or completeness of the information provided via this
presentation. FRN specifically disclaims all liability for any claims or
damages that may result from the information contained in this
presentation, including any websites maintained by third parties and linked
to the FRN website
Any mention of commercial products is for information only; it does not
imply recommendation or endorsement by FraudResourceNet LLC

5

Today’s Agenda
 Which data files should be requested in the area of concern or what
should the data request look like when there is no specific area of
concern.
 Using a fast-track process to validating data and understanding
statistical norms for benchmarking purposes. Statistical techniques
to be utilized include: standard deviation, a unique method of
combining Benford’s Law and other digital analysis techniques,
time/size stratifications, and value/volume difference scattergraphs.
 How the general ledger can provide a digital road map for analytics
for fraud (and errors) within the organization.
 How to quickly gather report ideas and techniques for analysis, as
well as, obtain a list of some of the top fraud tests by process area.
(continued)

Today’s Agenda (continued)
 How to combine your reports for maximum impact and
understanding this concept within a specific review of
accounts payable. Additional report techniques that can be
applied to expected data files include user transaction
analysis, data file change reviews, and external data
mapping.
 Understand a provided Excel macro tool (free as part of the
course) that will quickly map an entire hard drive in
minutes. Various applications of this tool will be presented.
 Your Questions
 Conclusion


The Overall Fraud
Analytic Process
Get the Most Useful Data for Analysis
 General Ledger / Accounts Payable
 Other? / Use external data sources

Develop Fraud Query Viewpoints
 The 5 Dimensions
 Brainstorm report ideas

Analytically Trend
 Benford’s Law
 Statistical averages and simple trending by day, month, day of week
 Post dated changes

Transactional Score Based On the Above


Detection Methods
By Company Size


9

Most Popular Products








Microsoft Excel
ActiveData for Excel
TopCaats
Microsoft Access
ACL
IDEA
WizRule, WizWhy, & WizSame (WizSoft
products)


Tool Selection Considerations









Core processing features
Advanced features
Advanced data import
Scripting
Ease of use
Training / Customer Support / User Groups
Years in business / Company sustainability
Workpaper system integration


Asset Misappropriation
Tops The Charts


Vendor Billing Fraud/Corruption
Is #1 or #2 No Matter Where You Go


13

Mapping Data to Scripts


Page 14

Clear Data Request

 Accounts Payable Data Request.doc

Sample Data Validation – Accounts
Payable Other Questions


Is Your Organization Working
With Banned Companies?

EPLS is the excluded party list service of the U.S. Government as
maintained by the GSA
WWW.SAM.GOV


Is Your Organization
Working With Terrorists?


Are Your Vendors Real?
IRS TIN Matching Program
 Validates U.S. Tax Identification Numbers
 Can submit up to 100,000 TIN submissions at a
time
 Make sure all punctuation is removed
 See http://www.irs.gov/taxpros/ and enter
“TIN matching program” in the search box


Polling Question 1
What is the new name of the EPLS.gov system
A.
B.
C.
D.

GAO.GOV
SAM.GOV
OFAC.GOV
TREASURY.US.GOV


Query Viewpoints


Specific Tests Based
on the 5 W’s
Who
 Summarize journal entries by the persons entering to determine if
they’re authorized.
What
 Summarize journal entries by account and repetitive extracts (more
than 50 instances) and unique account sequences used in the journal
entry (based on the first five debit and credit postings).
 Extract nonstandard or manual journal entries (versus a created system
such as an accounts payable ledger posting) for further analysis.
 Stratify size of journal entries based on amount (using the debit side of
the transaction).
 Summarize general ledger activity on the amount field (absolute value
of debit or credit) to identify the top occurring amounts. Then
summarize activity by account and the amount identified for the top 25
appearing amounts.
 Scatter-graph general ledger account (debit and credit amounts
separately) and numbers of transactions.

Page 22

on the 5 W’s (Continued)
When
 Extract journal entries posted on weekends and holidays.
 Extract journal entries relating to the prior year that were made just
immediately following a fiscal-year end.
 Summarize journal entry credits and debits processing by day, month,
and year.
Where
 Extract journal entries made to suspense accounts and summarize by
the person entering and corresponding account numbers.
 Extract journal entries to general ledger accounts known to be
problems or complex based on past issues (errors of accounting in
journal subsequently corrected by accounting staff or auditors) at the
company or the industry in general.
 Extract debits in revenue and summarize by general ledger account.
Summarize journal entries by the persons entering to determine if
they’re authorized.

Page 23

on the 5 W’s (Continued)
Why
 Extract general ledger transaction amounts (debit or credit) that
exceed the average amounts for that general ledger account by
a specified percentage. (Five times the average is the default.)
 Extract journal entries that equate to round multiples of 10,000,
100,000, and 1,000,000.
 Extract journal entries with key texts such as “plug” and “net to
zero” anywhere in the record.
 Extract journal entries that are made below set accounting
department approval limits especially multiple entries of amounts
below such limits.
 Extract journal entries that don’t net to zero (debits less credits).

Report Brainstorm Tool


Proactively Detecting Fraud
Using Computer Audit Reports

IIA Research Paper / CPE
The purpose of this document is to assist
Course
auditors, fraud examiners, and management in
implementing data analysis routines for
improved fraud prevention and detection.

A comprehensive checklist of data analysis
reports that are associated with each
occupational fraud category per the
Association of Certified Fraud Examiner’s
classification system.

See the IIA’s website at www.theiia.org

Payroll Fraud Report Ideas


Top Reports in Payroll

 Duplicate employee payments
 Payments to the same bank account and a
different employee number
 Overtime trending by department and person
(% of overtime to gross pay, average overtime
by department)
 Match employee data from the human resource
to the payroll system
 Look for inaccurate or incomplete employee
data


It’s The Trends….Right?







Trend categories (meals, hotel, airfare, other)
Trend by person and title
Trend departments
Trend vendors
Trend in the type of receipts
Trend under limits (company policy)


29

Other T&E Reports
 Unmatched query of cardholders to an active employee
masterfile
 Cards used in multiple states (more than 2) in the same day
 Cards processing in multiple currencies (more than 2) in the
same day
 Identify cards that have not had activity in the last six months
 Cardholders that have more than one card
 Extract any cash back credits processed through the card
 Extract declined card transactions and determine if they are
frequent for certain cards
 Summary of card usage by merchant to find newly added
merchants and most active


Some Data Mining Ideas
Personnel Analysis



Adjustments by employee
Processing by employee

Contextual Summarizations


Transaction types

Time Trending




Month, week, and day / Also by department
Last month to first 11 months
Transactions at the end of and start of a fiscal year


Polling Question 2

What is not one of the query viewpoints?
A.
B.
C.
D.

Who
What
How
When


Adding the Analysis Toolpak
Add-In


Above Average / Standard
Deviation


Stratify Data in Excel or with
ActiveData for ExcelTM

 Use Excel Vlookup = TRUE
 Use ActiveData for ExcelTM


How Fraud Grows Over Time


36

Scatter Graph


Scatter Graph Explanation

1 – high dollar change and low count (outliers)
2 – charges that make sense
3 – changes that don’t make sense
4 – inefficiency that is developing


Polling Question 3

Where do you find the Descriptive Statistics
in Excel?
A.
B.
C.
D.

Excel Option
Data Menu
Excel Add-Ins
Insert Menu


Benford’s Law Scoring
Creating the First, First 2, Last 2,
and Difference to Last Year


Calculating Benford’s


The Scoring Calculation Sheet


Polling Question 4

What Excel function is used to copy
scores from the score sheet to the score
summary sheet?
A.
B.
C.
D.

GRAB()
HLOOKUP()
HYPERLINK()
VLOOKUP()


Unique Journal Entry Test
Account Sequencing


Top Fraud Schemes By
Department


Polling Question 5
What ActiveData for Excel function allows for
the development of the account sequence:
A.
B.
C.
D.

Summarize
Stratify
Merge
Top / Bottom Items



Simple Fraud Vendor Scoring
Analysis – How It Started
 Vendors on report 1 vs. report 2 of duplicate payments.
 Duplicate transactions paid on different checks.
 Duplicate transactions with debit amounts in the vendor
account.
 Vendors with a high proportion of round dollar payments.
 Invoices that are exactly 10x, 100x or 1000x larger than
another invoice.
 Payments to any vendor that exceed the twelve month
average payments to that vendor by a specified
percentage (i.e., 200%) or 3x the standard deviation for
that vendor.
 Vendors paid with a high proportion of manual checks.

48

The Sampling “Problem”
Bottom Line Numbers
 Modern tests (round numbers, duplicates, missing fields)
identify thousands of ‘suspicious’ transactions, usually
about 1 in 5 of all transactions get a ‘red flag’
 Historically at least 0.02 – 0.03 % of all transactions have
real problems, such as a recoverable over-payment
 So roughly 0.00025 / 0.2 = 0.00125 or 1 in 800 ‘red flags’
lead to a real problem.

Imagine throwing a random dart at 800 balloons
hoping to hit the right one!!!

Page 49

Transactional Score Benefits


The best sample items (to meet your attributes) are selected based
on the severity given to each attribute. In other words, errors, as
you define them, can be mathematically calculated.



Instead of selecting samples from reports, transactions that meet
multiple report attributes are selected (kill more birds with one
stone). Therefore a 50 unit sample can efficiently audit:
 38 duplicate payments
 22 round invoices
 18 in sequence invoices

….and they are the best given they are
mathematically the most “severe”.

50

Pick Items Rare in Several
Ways

 Don’t choose just ANY weekend invoice
 Choose an UNUSUAL weekend invoice
 Large weekend invoices are the rarest
kind (i.e., only 2 percent of large invoices)
The odds of finding a recoverable error go up
AND since the invoice is large, the value
recovered goes up too!

Page 51

Transactional Scoring

The result is a sampling
methodology that is now
based on Risk as you define


Page 52

Summaries on Various
Perspectives

Summarize by
dimensions (and sub
dimension) to pinpoint
within the cube the
crossover between the top
scored location, time, and
place of fraud based on
the combined judgmental
and statistical score


53

Key Control Reports & Scoring


Page 54

Combining the Scores
ACL Code


Page 55

Using Vlookup to Combine
Scores

 Create a record number
 Relate sheets based on VLookup


Page 56

Severity To Value


57

Transactional Score
Benefit Patterns Example


58

GeoMapping - Map Point


Page 59

Polling Question 6

What graph is used to map value to score
for easier selections of data subsets?
A.
B.
C.
D.

Pie
Line
Bar
Scatter


Free Excel Directory Tool

 Collects all file information by folder
 Provides additional information on the
files
 Be careful – Can take 30 minutes to run
an entire harddrive
 Useful to identify files accessed recently
 Great for backups and cleanups of HDs


Questions?
 Any Questions?
Don’t be Shy!


Coming Up Next Month
 1. Benford’s Law on August 7, 2013
11:00 AM
 2. When Law Enforcement Comes
Knocking on August 14, 2013 1:00 PM
 3. Best Practices in Detecting Accounts
Payable Fraud Using Data Analysis on
August 21, 2013 11:00 AM


Thank You!
Website: http://www.fraudresourcenet.com
Jim Kaplan
FraudResourceNet™
800-385-1625
jkaplan@fraudresourcenet.com
Peter Goldmann
FraudResourceNet™
800-440-2261
pgoldmann@fraudresourcenet.com
Rich Lanza
Cash Recovery Partners, LLC
Phone: 973-729-3944
rich@richlanza.com

Quick Response Fraud Detection using Data Analytics: Hitting the Ground Running using Technology in a Suspected Fraud Case

More Related Content

What's hot (18)

Viewers also liked (16)

Similar to Quick Response Fraud Detection using Data Analytics: Hitting the Ground Running using Technology in a Suspected Fraud Case (20)

More from FraudBusters (12)

Recently uploaded (20)

Quick Response Fraud Detection using Data Analytics: Hitting the Ground Running using Technology in a Suspected Fraud Case