SlideShare a Scribd company logo
W H I T E P A P E R
Fraud Detection and Prevention:
Transactional Analysis for Effective Fraud Detection
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
1
FR AUD MANAGEMENT ISSUES
Fraud is a dominant form of white collar crime that continues to extract a significant toll not
only on the organizations that fall prey to it, but also on investors, financial institutions, and the
economy in general. There are several issues that make effective fraud management a particularly
challenging task. These include: enormous and ever-expanding volumes of data; the growing
complexity of systems; changes in business processes and activities; continuous evolution of
newer fraud schemes to bypass existing detection techniques; risks of false alarms; and
regulatory issues related to employee privacy and discrimination.
As new compliance and standards initiatives such as Sarbanes-Oxley (SOX) and Statement
and Auditing Standards (SAS) No. 99 create an increasingly more complex regulatory
environment for organizations across the globe, demand has increased for greater scrutiny
and visibility into the effectiveness of internal controls to minimize errors and reduce the
opportunity for occupational fraud.
This white paper focuses on the nature and scope of fraud, the limitations of traditional
measures of fraud detection and prevention, and solutions based on transactional data analysis.
THE NATURE OF FR AUD
In its 2004 Report to the Nation on Occupational Fraud and Abuse1, the Association of
Certified Fraud Examiners (ACFE) defines occupational fraud as “the use of one’s occupation
for personal enrichment through the deliberate misuse or misapplication of the employing
organization’s resources or assets”.
Frauds generally fall into three broad categories: asset misappropriations, corruption, and
fraudulent financial statements. Asset misappropriations include revenue skimming, inventory
theft, and payroll fraud. Common examples of corruption include accepting kickbacks and
engaging in activities that represent a conflict of interests. Fraudulent statements generally
involve falsifying an organization’s financial statements by overstating revenues or understating
liabilities and expenses.
The vast majority of frauds surveyed in the ACFE study fell into the first category, asset
misappropriations, which occurred in more than 90 percent of the cases reviewed. Conversely,
fraudulent statements were the least commonly reported fraud (8 percent), but had the highest
median loss ($1,000,000).2 [All figures quoted in US dollars unless otherwise noted.]
In addition to the direct financial costs of fraud, organizations must cope with a range of indirect
costs. Damage to a company’s reputation can have substantial fallout – and lead to punishing
market setbacks. Loss of customer confidence translates directly into reduced revenues and
profits. And employee morale can suffer, impacting organizational productivity and the ability
to attract and retain qualified staff.
1 Association of Certified Fraud Examiners, 2004 Report to the Nation on Occupational Fraud and Abuse, Association
of Certified Fraud Examiners,Austin,TX 2004
2 Association of Certified Fraud Examiners, 2004 Report to the Nation on Occupational Fraud and Abuse, Association
of Certified Fraud Examiners,Austin,TX 2004
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
2
THE EFFECT OF SARBANES-OXLEY
The new requirements of the Sarbanes-Oxley Act of 2002 state that it’s no longer enough
to simply maintain internal controls – management must now assert annually as to the
effectiveness of those controls. According to a report by PriceWaterhouseCoopers, the
Securities and Exchange Commission (SEC) rules regarding implementation of SOX section
404 refer explicitly to controls related to the prevention, identification, and detection of fraud.3
Corporate management must evaluate and test the design and operating effectiveness of
anti-fraud controls on an ongoing basis. Effectively, it’s simply not enough for organizations
to comply with the new SOX regulations – they must also prove they are taking proactive,
significant action to prevent and detect fraud before it becomes an issue resulting in a
material deficiency requiring external reporting.
THE EX TENT AND COSTS OF FR AUD
The ACFE estimates that six percent of organizations’ revenues are lost each year as a
result of occupational fraud and abuse. Within the United States, this translates into losses
of approximately $660 billion. The ACFE 2004 Report covered 508 occupational fraud cases
that resulted in losses of more than $761 million. The median loss for all cases in the study
was $100,000, with 15 percent of the frauds causing losses of at least $1 million, and one
in five causing losses of at least $500,000.
The losses are huge, and according to the ACFE study, once the loss has occurred, the
chance of recovering the funds in full is only 20 percent – and over a third of that recovery
is thanks to adequate insurance coverage. Nearly 40 percent of survey respondents in the
ACFE study reported that they recovered nothing at all. With billions of dollars funneling
through the hands of fraudsters, the cost of timely detection or prevention of fraud is minimal
when compared with the expense and effort expended to attempt recovery of lost funds.
3 PriceWaterhouseCoopers, The Emerging Role of Internal Audit in Mitigating Fraud and Reputation Risks, 2004
Diagram 1:
Distribution of Dollar Losses
1-999
1,000-9,999
10,000-49,999
50,000-99,999
100,000-499,999
500,000-999,999
1,000,000 and up
DollarLossRange
Percent of Cases
0% 5% 10% 15% 20% 25% 30% 35%
1.4%
2.3%
2004
2002
12.3%
10.2%
22.8%
22.9%
12.9%
12.1%
29.2%
27.6%
6.8%
8.5%
14.6%
16.5%
Distribution of Dollar Losses
Source: 2004 Report to the Nation on Occupational Fraud
and Abuse, Association of Certified Fraud Examiners
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
3
Forensic accounting and fraud examination specialists, Summerford Accountancy
PC, were hired by the Los Angeles Unified School District (LAUSD) to perform an
examination of the District’s Belmont Learning Complex project. Mired with problems
and a price tag estimated at over $200 million, the construction project for the high
school became the most expensive in the country before the District was forced to
step in and stop construction. Using ACL data analytics technology, the Summerford
Accountancy investigative audit uncovered:
48 budget transfers authorized by one employee for $49,999 each within
a four-month period circumventing LAUSD’s policy requiring that any spending
greater than $50,000 receive approval from the Board of Education
Overbilling of $2.1 million through payment applications made by the
project developer, construction contractor, and some of the sub-contractors
Circumvention of the proper payment codes using direct payments,
resulting in outstanding encumbrances over a period of five fiscal years
totalling approximately $77.8 million
Globally, fraud is taking its toll as well. Total reported fraud in the UK more than doubled,
from £331 million in 2003 to £756 million in 2004.4 While the actual number of cases was
not dramatically different – 229 cases of fraud over £50,000 reported in 2004 compared to
211 cases in 2003 – their value was much higher, particularly in the areas of tax fraud and
breach of regulations.
In the Ernst & Young 8th Global Survey, nearly 50 percent of respondents reported
experiencing a significant fraud in the previous year.5 When asked what factors were most
likely to prevent or detect fraud, the majority of organizations stated that internal controls
are generally the best-accepted manner in which to do so. However, the E&Y survey revealed
that more often than not, the internal control which was created to prevent or detect the
fraud was either overridden, or not properly understood by staff responsible for implementing
said control.6
HOW FRAUDSTERS EXPLOIT COMPLEX SYSTEMS
Typically, fraudsters detect or stumble upon areas with weak cross-departmental or
cross-organizational controls, often the site of the interfaces between two or more computer
applications or systems. The perpetrator is confident that there is very little regular cross-
system validation, given the challenges inherent in accessing and analyzing frequently
incompatible data formats. Many organizations lack the in-house capability to carry out
such complex tasks efficiently and in a frequent, timely fashion. The complexity grows
geometrically when multiple systems are involved.
4 BDO Stoy Hayward, Fraud Explosion:White collar crime doubles in a year, Spring 2005
5 Ernst & Young, Fraud:The Unmanaged Risk, 8th Global Survey, 2003
6 Ernst & Young, Fraud:The Unmanaged Risk, 8th Global Survey, 2003
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
4
The KPMG Fraud Survey 2003 reported that of the factors contributing to fraud in
the organization, inadequate internal controls rated as the second highest at 39 percent,
and management override of internal controls rated third at 31 percent.7 Continuous review
of the internal controls is required to ensure that the controls that have been established
remain in place and remain effective.
In addition to having adequate controls, the challenge is for auditors and fraud examiners
to look beyond the controls and find loopholes in the system where fraud could occur.
TO PREVENT AND DETECT:
THE TR ADITIONAL APPROACH
Organizations have traditionally sought to detect and prevent fraud by implementing
appropriate internal controls. Internal Audit teams test and validate these controls during
regular audit review processes. They do not, however, usually have direct responsibility for
ensuring that fraud does not occur. Although Internal Audit often uncovers instances of fraud
– 24 percent of detected cases according to the ACFE study – its role is essentially reactive.
Internal controls and external audit are responsible for uncovering a further 30 percent of
detected fraud, while the balance of detected cases come to light through tips or accident.
LIMITATIONS OF TR ADITIONAL APPROACHES
TO FR AUD DETECTION
In many organizations, both systems and their underlying transactions are becoming
increasingly complex with data volumes often growing exponentially. While strong internal
controls and appropriate audit procedures undoubtedly have a degree of effectiveness in
preventing and detecting fraud, it is unrealistic to assume that they are completely effective.
Diagram 2:
Initial Detection of Frauds
DetectionMethod
Initial Detection of Occupation Frauds
1.7%
0.9%
2004
2002
Tip
Internal Audit
By Accident
Internal Controls
External Audit
Notified by Police
Percent of Cases
0% 5% 10% 15% 20% 25% 30% 35% 40% 45%
39.6%
43.0%
23.8%
18.6%
21.3%
18.8%
18.4%
15.4%
10.9%
11.5%
7 KPMG, Fraud Survey 2003, KPMG Forensic, 2004
Source: 2004 Report to the Nation on Occupational Fraud
and Abuse, Association of Certified Fraud Examiners
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
5
In fact, the ACFE study discovered that more frauds were detected by accident (21 percent)
than by the application of either internal controls (18 percent) or external audit (11 percent).
There also remains a strong likelihood for many large organizations that a very significant
number of frauds are simply never detected. The fact that so many frauds are detected by
accident implies that there is great opportunity for organizations to strengthen their internal
controls and audit procedures to more proactively seek out fraud and abuse.
Even when frauds do come to light via traditional avenues, they are often found long after
the fact, when they are well entrenched. Many detection methods, such as traditional point-
in-time audit assessments, only occur on an annual basis or even less frequently in some
instances. They are by nature historical examinations of data. The problem is that the longer
the period the fraud remains undetected, the larger the financial loss is likely to be and the
smaller the chance of recovering the funds from the perpetrator.
The Austrian Ministry of Finance has an annual budget of over €110 billion per
year and is responsible for the coordination of taxation and customs programs
throughout Austria. The Ministry auditors must analyze enormous quantities of
data from a wide variety of computer platforms, while operating under acute time
pressures. In Austria, all companies and individuals must submit their tax data
electronically, but are allowed to do so in many formats.
ACL’s flexible data analytics software has been key to the Ministry’s ability to
improve the scope and effectiveness of its tax audits. In one major initiative,
over a four-year period, the Electronic Data Processing (EDP) audit team used
ACL’s powerful data analytics to identify, and then recover, €85 million in missed
tax revenues – and was able to stop a fraud scheme that had been exploited
by the hospitality sector for years.
BUILDING A BET TER MOUSETR AP:
TR ANSACTIONAL ANALYSIS AND
CONTINUOUS MONITORING
The Association of Certified Fraud Examiners (ACFE),8 The Institute of Internal Auditors (IIA),9
and the American Institute of Certified Public Accountants (AICPA)10 all advocate the use of
data analysis technologies to assist in fraud detection. Data analysis technology allows
auditors and fraud investigators to obtain a quick overview of the company, develop an
understanding of relationships between various data elements, and easily drill down into
specific areas of interest.11
8 Association of Certified Fraud Examiners, 2004 Report to the Nation on Occupational Fraud and Abuse,
Association of Certified Fraud Examiners,Austin,TX 2004
9 The IIA Research Foundation, Proactively Detecting Occupational Fraud Using Computer Audit Reports,
The IIA Research Foundation, 2003
10 American Institute of Certified Public Accountants, The Practicing CPA,“Implementing Data Analysis Software”,
March 2003
11 Accounting Today, “To CAATch a Thief: Use Software to Fight Fraud”,August 9, 2004
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
6
Despite the numerous benefits, many organizations only use such techniques on an occasional
test basis, and often only in a reactive fashion, once a problem is suspected. In many cases,
the tests performed are fairly simplistic and are unlikely to uncover more sophisticated frauds.
The full power of data analysis technology has yet to be exploited by many organizations.
The practice of transactional analysis is one of the most powerful and effective ways of
detecting fraud within an organization. It generally includes a comprehensive series of tests
designed to detect indicators of a wide range of frauds. To maximize its effectiveness as a
fraud detection system, transactional analysis ideally will:
Allow easy comparisons of data and transactions from multiple IT operational systems
Work with a comprehensive set of indicators of potential fraud – taking into account
both the most common fraud schemes and those that relate specifically to the unique
risks a particular organization may face
Analyze all transactions within a given area and test them against the parameters
that highlight indicators of fraud
Perform the analyses and tests as close to the time of the transaction as possible,
ideally even before the transaction has been finalized, and preferably on a continuous
monitoring basis.
By continuously monitoring operational data and transactions, organizations can catch frauds
earlier in the fraud cycle, preventing greater losses, and quite often serving as a deterrent to
other possible frauds.
CHALLENGES TO EFFECTIVE APPLICATION
OF TECHNOLOGY
Despite the proven and potential benefits, there have been significant challenges to
effective, widespread application of transactional analysis and continuous monitoring.
One challenge has been the time, cost, and technical expertise involved in extracting and
comparing transactional data from multiple and different systems to detect a single instance
of suspected fraud. Many indicators of potential fraud only arise when transactional data
from one system is compared to that of another.
Another has been developing flexible, easily adaptable continuous monitoring programs
that can run alongside application systems, test data independently of those systems, and
notify management in a timely manner when fraud indicators are detected. Such programs
traditionally have been costly and time-consuming to create, often requiring existing systems
to be retrofitted.
In some organizations, difficulties arise from limited knowledge of the many types of
possible fraud and how they might be perpetrated given the organization’s operations.
To find fraud, you have to know what it looks like. This requires a thorough understanding
of the organization’s internal controls, and their weaknesses, to design and conduct
transactional analyses that provide meaningful results.
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
7
ACL has developed a dynamic approach to fraud detection and prevention that
overcomes the technological data access, analysis, and monitoring challenges as well
as the lack of organizational knowledge concerning fraud that can stymie effective application
of transactional analysis and continuous monitoring. Before outlining ACL’s combination of
software and fraud detection expertise, we’ll examine a number of statistical data analysis
fraud detection techniques as well as give examples of specific types of fraud and the
practical tests used to uncover those fraud activities.
DATA ANALYSIS TECHNIQUES FOR
FR AUD DETECTION
A number of specific statistical data analysis techniques have proven their effectiveness
in detecting fraud:
Calculation of statistical parameters such as averages, standard deviations,
and highest and lowest values to identify statistical anomalies
Classifications to find patterns and associations among groups of data
Stratifications of numeric values to identify unusual and outlying values
Digital analysis, using Benford’s Law, to identify statistically unlikely occurrences
of numeric amounts
Joining or matching data fields between disparate systems, typically looking for expected
matches or differences for data such as name, address, telephone, or part/serial number
“Sounds like” functions that identify fraudulent variations of valid company
and employee names
Duplicates testing that identifies both simple or complex combinations of duplication
Gaps testing that identifies missing sequential data
Summing and totaling to check control totals that may be falsified
Graphing to provide visual identification of anomalous transactions
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
8
TYPICAL TYPES OF FR AUD AND FR AUD TESTS
Knowing what to look for is critical in building a fraud detection program. The following
examples are based on descriptions of various types of fraud and the tests used to discover
the fraud as found in Fraud Detection, Using Data Analysis Techniques to Detect Fraud.12
Type of Fraud Tests Used to Discover This Fraud
Fictitious vendors Run checks to uncover post office boxes used as addresses and
to find any matches between vendor and employee addresses
and/or phone numbers
Be alert for vendors with similar sounding names or more than
one vendor with the same address and phone number
Altered invoices Search for duplicates
Check for invoice amounts not matching contracts or purchase
order amounts
Fixed bidding Summarize contract amount by vendor and compare vendor summaries
for several years to determine if a single vendor is winning most bids
Calculate days between close for bids and contract submission date
by vendor to see if the last bidder consistently wins the contract
Goods not received Search for purchase quantities that do not agree with
contract quantities
Check if inventory levels are changing appropriate to
supposed delivery of goods
Duplicate invoices Review for duplicate invoice numbers, duplicate date,
and invoice amounts
Inflated prices Compare prices across vendors to see if prices from a particular
vendor are unreasonably high
Excess quantities
purchased
Review for unexplained increases in inventory
Determine if purchase quantities of raw materials are appropriate
for production level
Check to see if increases in quantities ordered compare similarly
to previous contracts or years or when compared to other plants
Duplicate payments Search for identical invoice numbers and payments amounts
Check for repeated requests for refunds for invoices paid twice
Carbon copies Search for duplicates within all company checks cashed; conduct
a second search for gaps in check numbers
Duplicate serial
numbers
Determine if high value equipment a company already owns
is being repurchased by checking serial numbers for duplicates
and involvement of same personnel in purchasing and
shipping processes
Payroll fraud Find out if a terminated employee is still on payroll by comparing
the date of termination with the pay period covered by the paycheck
and extract all pay transactions for departure date less than date
of current pay period
Accounts payable Reveal transactions not matching contract amounts by linking Accounts
Payable files to contract and inventory files and examining contract
date, price, ordered quantity, inventory receipt quantity, invoice
quantity, and payment amount by contract
12 Coderre, David G. Fraud Detection, Using Data Analysis to Detect Fraud,
(Vancouver, BC: Global Audit Publications, 1999): 50-202
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
9
Application Areas for Transactional Analysis
Enterprising fraudsters can and will exploit weakness wherever they find it.
Computerized transactional analysis has proven itself a reliable aid in fraud
detection in a wide range of business processes, including:
Accounts Receivable
Accounts Payable
General Ledger
Materials Management and Inventory Control
Salaries and Payroll
Purchase Order Management
Conflict of Interest
Kickbacks
Bid Rigging
Policy and Administration
Vendor Management
Retail Loss Prevention
Sales Analysis
Work In Progress
Cash Disbursements
Customer Service Management
Loans
Deposits
Real Estate Loans
Credit Card Management
Life Insurance
Travel Claims
IMPLEMENTING A FR AUD
DETECTION PROGR AM
Instead of responding on a reactive basis to fraud within an organization, it’s more effective
to use data access technologies and strong internal controls to detect and, more importantly,
prevent fraud from ever occurring in the first place.
Any complete fraud detection program must include the following steps:13
Build a profile of potential frauds. This profile includes a list of the many different
areas in which fraud may occur and the types of fraud that are possible in that area.
This can be developed as part of a risk assessment.
Test data for possible indicators of fraud. A complete testing program should
include ad hoc or random testing in addition to more formalized or regular tests.
13 ACL Services Ltd., Using ACL to Detect Fraud:An ACL Workshop, October 2004
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
10
Improve controls by implementing continuous monitoring. Strengthen
controls over transaction authorizations and use continuous monitoring to test
and validate the effectiveness of your controls.
Review information from data testing and continuous monitoring.
Investigate patterns and fraud indicators that emerge from the fraud detection tests
and continuous monitoring.
Repeat the steps. This process of building a profile, testing data, improving
controls and reviewing information needs to be repeated on a regular basis.
ACL TECHNOLOGY ENABLES TIMELY
FR AUD DETECTION AND PREVENTION
ACL’s approach to fraud detection and prevention is based on comprehensive analysis of the
transactional data flowing through financial and operational systems. Using ACL technology
to access and analyze unlimited volumes of data from virtually any enterprise application,
organizations can quickly identify suspicious transactions that may represent fraud, error,
and abuse, and close control loopholes before fraud escalates. ACL data analytics technology
supports flexible, exploratory, ad hoc investigations – the kind typically undertaken by skilled
auditors or fraud investigators – while ACL Continuous Controls Monitoring (CCM) solutions
embed automated, pre-defined analytics within core business processes that represent high-
risk areas to the organization for sustainable and scalable analysis.
Data Analytics Technology
ACL’s robust analytics technology enables analysis of even the largest volumes of transactional
data in a fraction of the time once required, so that all pertinent data from any number of
systems can be quickly analyzed for flagging potential indicators of fraud.
Through a unique and powerful combination of data access, analysis, and integrated reporting
capabilities, ACL software reaches data from virtually any source, across any system, through
a consistent user interface – whether housed in mainframes, servers, legacy systems, or PC
networks. By independently comparing and analyzing data from ERP, CRM, SCM, or other
enterprise applications, ACL technology enables immediate insight into the transactional
data underlying core business processes and financial reporting.
In the 2005 Internal Auditor software survey, ACL was selected by 44 percent of the
participants as the tool of choice for fraud prevention and detection.
Fraud Detection/Prevention Software
Reprinted with permission from Internal Auditor (August 2005), published by The Institute of Internal Auditors, Inc. www.theiia.org
Access 8%
Excel 21%
IDEA 8%
PeopleSoft Query 2%
Internally
developed
software 8%
Other 9%
ACL 44%
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
11
Continuous Controls Monitoring
KPMG’s Fraud Survey 2003 revealed that internal controls, internal audit, and notification
by employee are the three leading ways of uncovering fraud, with internal controls being
the fastest growing method. Among newly instituted programs, respondents cite “reviewing
or strengthening internal controls” more frequently than any other type of program.14
Internal controls are increasingly being used as an anti-fraud method by organizations,
a trend driven in part by the pressures of regulatory requirements such as the Sarbanes-Oxley
Act, and in particular, Section 404. To help ensure these internal controls are in place and
operating effectively, many organizations are turning to technologies such as continuous
controls monitoring.
ACL CCM solutions identify fraud, errors, and inefficiencies, by automating internal controls
testing in key financial and operational processes across the enterprise through independent
analysis of business transactions at the source level. Embedding audit “best practices” into
organizations’ day-to-day business operations, CCM solutions apply automated, pre-defined
analytics to critical control points, mapped to the COSO internal controls framework, within
core business processes such as the purchase-to-payment cycle, payroll, purchasing card
programs, the order-to-cash cycle, and general ledger activities. Financial management and
business unit managers gain constant oversight and insight into their business operations,
receiving timely notification of control breaches and gaps, so they can investigate and resolve
potential problems – including possibly fraudulent activities – before they escalate.
ACL CCM solutions access and analyze unlimited volumes of transactional data from all the
different systems and applications supporting your business operations, while maintaining
data integrity. The result – comprehensive insight into control weaknesses and business
risks, enabling informed decision-making and faster response to organizational, market,
and regulatory changes.
FAST IMPLEMENTATION AND FAST PAYBACK
The ease and speed of implementing a complete ACL solution means not only more timely
detection of fraud and faster return on investment, but also more effective, systematic fraud
prevention over the long term. Having an effective system for fraud prevention in place is
part of business assurance – the knowledge that an organization can rely on the accuracy,
reliability, and integrity of all its data and transactions to make decisions with speed and
confidence. ACL solutions provide audit, compliance, and financial professionals with the
confidence that they are seeing the full picture – giving clients the ability to find fraud,
stop overpayments, and improve operational efficiency.
14 KPMG, Fraud Survey 2003, KPMG Forensic, 2004
© 2006 ACL Services Ltd.
WP/FD/110106
ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd.
All other trademarks are the property of their respective owners.
12
CONCLUSION
A well-designed and implemented fraud detection system, based on the transactional
analysis of operational systems, can significantly reduce the chance of fraud occurring
within an organization and then remaining undetected. The sooner that indicators of fraud
are available, the greater the chance that losses can be recovered and address any control
weaknesses. The timely detection of fraud directly impacts the bottom line, reducing losses
for an organization. And effective detection techniques serve as a deterrent to potential
fraudsters; employees who know experts are present and looking for fraud or that continuous
controls monitoring is occurring on a daily basis are less likely to commit fraud because of
a greater perceived likelihood that they will be caught.
Finally, given new regulatory requirements such as SOX, the decision is no longer if an
organization should implement a complete fraud detection and prevention program,
rather how quickly that program can be put into place.
To find out how ACL can help your organization combat fraud, contact us
at +1-604-669-4225 or info@acl.com to arrange for a free consultation.
COMPANY OVERVIEW
ACL is the leading global provider of Business Assurance Analytics to financial executives,
compliance professionals, and auditors. Combining market-leading data analytics software
and professional services expertise, ACL solutions give organizations confidence in the
accuracy and integrity of transactions and the effectiveness of internal controls underlying
increasingly complex business operations. Since 1987, ACL’s proven technology has enabled
financial decision-makers to assure controls compliance, reduce risk, detect fraud, enhance
profitability, and achieve fast payback.
ACL delivers its solutions in more than 130 countries through a global network of ACL
offices and channel partners. Our customers include 70 percent of the Fortune 500
companies and over two-thirds of the Global 500, as well as hundreds of national,
state, and local governments, and the Big Four public accounting firms.
ACL Headquarters
T +1 604 669 4225
F +1 604 669 3557
acl.com
info@acl.com

More Related Content

PDF
Fraud risk assessment
PPT
Fraud Cases in Auditing
PPT
Ais Romney 2006 Slides 05 Computer Fraud And Abuse
DOC
Cambridge anti money laundering lecture 2008
PDF
Forensic line - fraud prevention and detection tool
PDF
PDF
Mind the Gaps: AML and Fraud Global Benchmark Survey
PDF
Red Flags Fraud
Fraud risk assessment
Fraud Cases in Auditing
Ais Romney 2006 Slides 05 Computer Fraud And Abuse
Cambridge anti money laundering lecture 2008
Forensic line - fraud prevention and detection tool
Mind the Gaps: AML and Fraud Global Benchmark Survey
Red Flags Fraud

What's hot (18)

PDF
Sub Material Fraud Risk White Paper
PDF
Grant Thornton - Fraud and governance survey - 2014
PPT
Fight Fraud with Employee Fraud Training
PDF
Findings from India Fraud Survey 2012: Fraud and Corporate Governance - Chang...
 
PPT
Fraud Awareness For Managers
PPTX
What You Need To Know To Protect Your Organization From Fraud
PDF
Protecting Your Organization Against Check and ACH Fraud
PDF
Fraud and Governance: A Review June 2020
PDF
ethiXbase-Anti-Corruption-Compliance-Achieving-100-percent-third-party-due-di...
PDF
Fraud Prevention
PDF
Fraud & Risk Management - A Guide to Good Practice
PDF
5 Ways To Overcome Compliance Challenges In Financial Services
PPTX
2016 - Fraud Detection & Prevention with Internal Controls (Updated for 2016 ...
PDF
deloitte-au-risk-tasmanian-fraud-corruption-survey-2015-010915
PPT
Fraud Deterrence
PPT
Fraud In Our Midst, The Acfe 2010
PPTX
Chapter 11 a:Financial statement fraud
PDF
Anti-Money Laundering and Anti-Bribery and Corruption Systems & controls: Ass...
Sub Material Fraud Risk White Paper
Grant Thornton - Fraud and governance survey - 2014
Fight Fraud with Employee Fraud Training
Findings from India Fraud Survey 2012: Fraud and Corporate Governance - Chang...
 
Fraud Awareness For Managers
What You Need To Know To Protect Your Organization From Fraud
Protecting Your Organization Against Check and ACH Fraud
Fraud and Governance: A Review June 2020
ethiXbase-Anti-Corruption-Compliance-Achieving-100-percent-third-party-due-di...
Fraud Prevention
Fraud & Risk Management - A Guide to Good Practice
5 Ways To Overcome Compliance Challenges In Financial Services
2016 - Fraud Detection & Prevention with Internal Controls (Updated for 2016 ...
deloitte-au-risk-tasmanian-fraud-corruption-survey-2015-010915
Fraud Deterrence
Fraud In Our Midst, The Acfe 2010
Chapter 11 a:Financial statement fraud
Anti-Money Laundering and Anti-Bribery and Corruption Systems & controls: Ass...
Ad

Similar to White paper on fraud detection with acl (send afterwards)~9 (20)

DOCX
The following article is related to deterring employee fraud within .docx
PPTX
PPT
Fraud In Our Midst, The Acfe 2010
PDF
Fraud Prevention, Detection and Investigation in the Payday Advance Industry
PPTX
Public Sector Fraud - Mid-MO AGA
PPTX
Public Sector Fraud - Central MO IIA
PDF
Taking a Closer Look - Assessing Risk of Fraud in the Payday Advance Industry
PDF
White Collar Crime and Criminals - School of Criminal Justice - U of Cincinnati
PPT
Presentation-on-Fraud-Reporting.txt.ppt
PDF
Forensic Accounting – How To Uncover Fraud Jan 2012
PPT
Managing And Assessing The Risk Of Fraudulent Financial Statements
PPT
Ais Romney 2006 Slides 05 Computer Fraud And Abuse
PDF
Role of Internal Audit in fraud prevention and detection
PPTX
7 keys to fraud prevention
PPTX
Risk Management
PPTX
New age of risk for contractors slide presentation
PPTX
Lecture 15 fraud schemes - james a. hall book chapter 3
PPTX
Fraud Prevention & Detection for Local Government
PPT
W:\Scott & Baldwin\Marketing\Business Leadership Seminars\September 2008\...
PPTX
keys to fraud prevention in the public sector
The following article is related to deterring employee fraud within .docx
Fraud In Our Midst, The Acfe 2010
Fraud Prevention, Detection and Investigation in the Payday Advance Industry
Public Sector Fraud - Mid-MO AGA
Public Sector Fraud - Central MO IIA
Taking a Closer Look - Assessing Risk of Fraud in the Payday Advance Industry
White Collar Crime and Criminals - School of Criminal Justice - U of Cincinnati
Presentation-on-Fraud-Reporting.txt.ppt
Forensic Accounting – How To Uncover Fraud Jan 2012
Managing And Assessing The Risk Of Fraudulent Financial Statements
Ais Romney 2006 Slides 05 Computer Fraud And Abuse
Role of Internal Audit in fraud prevention and detection
7 keys to fraud prevention
Risk Management
New age of risk for contractors slide presentation
Lecture 15 fraud schemes - james a. hall book chapter 3
Fraud Prevention & Detection for Local Government
W:\Scott & Baldwin\Marketing\Business Leadership Seminars\September 2008\...
keys to fraud prevention in the public sector
Ad

White paper on fraud detection with acl (send afterwards)~9

  • 1. W H I T E P A P E R Fraud Detection and Prevention: Transactional Analysis for Effective Fraud Detection
  • 2. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 1 FR AUD MANAGEMENT ISSUES Fraud is a dominant form of white collar crime that continues to extract a significant toll not only on the organizations that fall prey to it, but also on investors, financial institutions, and the economy in general. There are several issues that make effective fraud management a particularly challenging task. These include: enormous and ever-expanding volumes of data; the growing complexity of systems; changes in business processes and activities; continuous evolution of newer fraud schemes to bypass existing detection techniques; risks of false alarms; and regulatory issues related to employee privacy and discrimination. As new compliance and standards initiatives such as Sarbanes-Oxley (SOX) and Statement and Auditing Standards (SAS) No. 99 create an increasingly more complex regulatory environment for organizations across the globe, demand has increased for greater scrutiny and visibility into the effectiveness of internal controls to minimize errors and reduce the opportunity for occupational fraud. This white paper focuses on the nature and scope of fraud, the limitations of traditional measures of fraud detection and prevention, and solutions based on transactional data analysis. THE NATURE OF FR AUD In its 2004 Report to the Nation on Occupational Fraud and Abuse1, the Association of Certified Fraud Examiners (ACFE) defines occupational fraud as “the use of one’s occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization’s resources or assets”. Frauds generally fall into three broad categories: asset misappropriations, corruption, and fraudulent financial statements. Asset misappropriations include revenue skimming, inventory theft, and payroll fraud. Common examples of corruption include accepting kickbacks and engaging in activities that represent a conflict of interests. Fraudulent statements generally involve falsifying an organization’s financial statements by overstating revenues or understating liabilities and expenses. The vast majority of frauds surveyed in the ACFE study fell into the first category, asset misappropriations, which occurred in more than 90 percent of the cases reviewed. Conversely, fraudulent statements were the least commonly reported fraud (8 percent), but had the highest median loss ($1,000,000).2 [All figures quoted in US dollars unless otherwise noted.] In addition to the direct financial costs of fraud, organizations must cope with a range of indirect costs. Damage to a company’s reputation can have substantial fallout – and lead to punishing market setbacks. Loss of customer confidence translates directly into reduced revenues and profits. And employee morale can suffer, impacting organizational productivity and the ability to attract and retain qualified staff. 1 Association of Certified Fraud Examiners, 2004 Report to the Nation on Occupational Fraud and Abuse, Association of Certified Fraud Examiners,Austin,TX 2004 2 Association of Certified Fraud Examiners, 2004 Report to the Nation on Occupational Fraud and Abuse, Association of Certified Fraud Examiners,Austin,TX 2004
  • 3. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 2 THE EFFECT OF SARBANES-OXLEY The new requirements of the Sarbanes-Oxley Act of 2002 state that it’s no longer enough to simply maintain internal controls – management must now assert annually as to the effectiveness of those controls. According to a report by PriceWaterhouseCoopers, the Securities and Exchange Commission (SEC) rules regarding implementation of SOX section 404 refer explicitly to controls related to the prevention, identification, and detection of fraud.3 Corporate management must evaluate and test the design and operating effectiveness of anti-fraud controls on an ongoing basis. Effectively, it’s simply not enough for organizations to comply with the new SOX regulations – they must also prove they are taking proactive, significant action to prevent and detect fraud before it becomes an issue resulting in a material deficiency requiring external reporting. THE EX TENT AND COSTS OF FR AUD The ACFE estimates that six percent of organizations’ revenues are lost each year as a result of occupational fraud and abuse. Within the United States, this translates into losses of approximately $660 billion. The ACFE 2004 Report covered 508 occupational fraud cases that resulted in losses of more than $761 million. The median loss for all cases in the study was $100,000, with 15 percent of the frauds causing losses of at least $1 million, and one in five causing losses of at least $500,000. The losses are huge, and according to the ACFE study, once the loss has occurred, the chance of recovering the funds in full is only 20 percent – and over a third of that recovery is thanks to adequate insurance coverage. Nearly 40 percent of survey respondents in the ACFE study reported that they recovered nothing at all. With billions of dollars funneling through the hands of fraudsters, the cost of timely detection or prevention of fraud is minimal when compared with the expense and effort expended to attempt recovery of lost funds. 3 PriceWaterhouseCoopers, The Emerging Role of Internal Audit in Mitigating Fraud and Reputation Risks, 2004 Diagram 1: Distribution of Dollar Losses 1-999 1,000-9,999 10,000-49,999 50,000-99,999 100,000-499,999 500,000-999,999 1,000,000 and up DollarLossRange Percent of Cases 0% 5% 10% 15% 20% 25% 30% 35% 1.4% 2.3% 2004 2002 12.3% 10.2% 22.8% 22.9% 12.9% 12.1% 29.2% 27.6% 6.8% 8.5% 14.6% 16.5% Distribution of Dollar Losses Source: 2004 Report to the Nation on Occupational Fraud and Abuse, Association of Certified Fraud Examiners
  • 4. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 3 Forensic accounting and fraud examination specialists, Summerford Accountancy PC, were hired by the Los Angeles Unified School District (LAUSD) to perform an examination of the District’s Belmont Learning Complex project. Mired with problems and a price tag estimated at over $200 million, the construction project for the high school became the most expensive in the country before the District was forced to step in and stop construction. Using ACL data analytics technology, the Summerford Accountancy investigative audit uncovered: 48 budget transfers authorized by one employee for $49,999 each within a four-month period circumventing LAUSD’s policy requiring that any spending greater than $50,000 receive approval from the Board of Education Overbilling of $2.1 million through payment applications made by the project developer, construction contractor, and some of the sub-contractors Circumvention of the proper payment codes using direct payments, resulting in outstanding encumbrances over a period of five fiscal years totalling approximately $77.8 million Globally, fraud is taking its toll as well. Total reported fraud in the UK more than doubled, from £331 million in 2003 to £756 million in 2004.4 While the actual number of cases was not dramatically different – 229 cases of fraud over £50,000 reported in 2004 compared to 211 cases in 2003 – their value was much higher, particularly in the areas of tax fraud and breach of regulations. In the Ernst & Young 8th Global Survey, nearly 50 percent of respondents reported experiencing a significant fraud in the previous year.5 When asked what factors were most likely to prevent or detect fraud, the majority of organizations stated that internal controls are generally the best-accepted manner in which to do so. However, the E&Y survey revealed that more often than not, the internal control which was created to prevent or detect the fraud was either overridden, or not properly understood by staff responsible for implementing said control.6 HOW FRAUDSTERS EXPLOIT COMPLEX SYSTEMS Typically, fraudsters detect or stumble upon areas with weak cross-departmental or cross-organizational controls, often the site of the interfaces between two or more computer applications or systems. The perpetrator is confident that there is very little regular cross- system validation, given the challenges inherent in accessing and analyzing frequently incompatible data formats. Many organizations lack the in-house capability to carry out such complex tasks efficiently and in a frequent, timely fashion. The complexity grows geometrically when multiple systems are involved. 4 BDO Stoy Hayward, Fraud Explosion:White collar crime doubles in a year, Spring 2005 5 Ernst & Young, Fraud:The Unmanaged Risk, 8th Global Survey, 2003 6 Ernst & Young, Fraud:The Unmanaged Risk, 8th Global Survey, 2003
  • 5. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 4 The KPMG Fraud Survey 2003 reported that of the factors contributing to fraud in the organization, inadequate internal controls rated as the second highest at 39 percent, and management override of internal controls rated third at 31 percent.7 Continuous review of the internal controls is required to ensure that the controls that have been established remain in place and remain effective. In addition to having adequate controls, the challenge is for auditors and fraud examiners to look beyond the controls and find loopholes in the system where fraud could occur. TO PREVENT AND DETECT: THE TR ADITIONAL APPROACH Organizations have traditionally sought to detect and prevent fraud by implementing appropriate internal controls. Internal Audit teams test and validate these controls during regular audit review processes. They do not, however, usually have direct responsibility for ensuring that fraud does not occur. Although Internal Audit often uncovers instances of fraud – 24 percent of detected cases according to the ACFE study – its role is essentially reactive. Internal controls and external audit are responsible for uncovering a further 30 percent of detected fraud, while the balance of detected cases come to light through tips or accident. LIMITATIONS OF TR ADITIONAL APPROACHES TO FR AUD DETECTION In many organizations, both systems and their underlying transactions are becoming increasingly complex with data volumes often growing exponentially. While strong internal controls and appropriate audit procedures undoubtedly have a degree of effectiveness in preventing and detecting fraud, it is unrealistic to assume that they are completely effective. Diagram 2: Initial Detection of Frauds DetectionMethod Initial Detection of Occupation Frauds 1.7% 0.9% 2004 2002 Tip Internal Audit By Accident Internal Controls External Audit Notified by Police Percent of Cases 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 39.6% 43.0% 23.8% 18.6% 21.3% 18.8% 18.4% 15.4% 10.9% 11.5% 7 KPMG, Fraud Survey 2003, KPMG Forensic, 2004 Source: 2004 Report to the Nation on Occupational Fraud and Abuse, Association of Certified Fraud Examiners
  • 6. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 5 In fact, the ACFE study discovered that more frauds were detected by accident (21 percent) than by the application of either internal controls (18 percent) or external audit (11 percent). There also remains a strong likelihood for many large organizations that a very significant number of frauds are simply never detected. The fact that so many frauds are detected by accident implies that there is great opportunity for organizations to strengthen their internal controls and audit procedures to more proactively seek out fraud and abuse. Even when frauds do come to light via traditional avenues, they are often found long after the fact, when they are well entrenched. Many detection methods, such as traditional point- in-time audit assessments, only occur on an annual basis or even less frequently in some instances. They are by nature historical examinations of data. The problem is that the longer the period the fraud remains undetected, the larger the financial loss is likely to be and the smaller the chance of recovering the funds from the perpetrator. The Austrian Ministry of Finance has an annual budget of over €110 billion per year and is responsible for the coordination of taxation and customs programs throughout Austria. The Ministry auditors must analyze enormous quantities of data from a wide variety of computer platforms, while operating under acute time pressures. In Austria, all companies and individuals must submit their tax data electronically, but are allowed to do so in many formats. ACL’s flexible data analytics software has been key to the Ministry’s ability to improve the scope and effectiveness of its tax audits. In one major initiative, over a four-year period, the Electronic Data Processing (EDP) audit team used ACL’s powerful data analytics to identify, and then recover, €85 million in missed tax revenues – and was able to stop a fraud scheme that had been exploited by the hospitality sector for years. BUILDING A BET TER MOUSETR AP: TR ANSACTIONAL ANALYSIS AND CONTINUOUS MONITORING The Association of Certified Fraud Examiners (ACFE),8 The Institute of Internal Auditors (IIA),9 and the American Institute of Certified Public Accountants (AICPA)10 all advocate the use of data analysis technologies to assist in fraud detection. Data analysis technology allows auditors and fraud investigators to obtain a quick overview of the company, develop an understanding of relationships between various data elements, and easily drill down into specific areas of interest.11 8 Association of Certified Fraud Examiners, 2004 Report to the Nation on Occupational Fraud and Abuse, Association of Certified Fraud Examiners,Austin,TX 2004 9 The IIA Research Foundation, Proactively Detecting Occupational Fraud Using Computer Audit Reports, The IIA Research Foundation, 2003 10 American Institute of Certified Public Accountants, The Practicing CPA,“Implementing Data Analysis Software”, March 2003 11 Accounting Today, “To CAATch a Thief: Use Software to Fight Fraud”,August 9, 2004
  • 7. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 6 Despite the numerous benefits, many organizations only use such techniques on an occasional test basis, and often only in a reactive fashion, once a problem is suspected. In many cases, the tests performed are fairly simplistic and are unlikely to uncover more sophisticated frauds. The full power of data analysis technology has yet to be exploited by many organizations. The practice of transactional analysis is one of the most powerful and effective ways of detecting fraud within an organization. It generally includes a comprehensive series of tests designed to detect indicators of a wide range of frauds. To maximize its effectiveness as a fraud detection system, transactional analysis ideally will: Allow easy comparisons of data and transactions from multiple IT operational systems Work with a comprehensive set of indicators of potential fraud – taking into account both the most common fraud schemes and those that relate specifically to the unique risks a particular organization may face Analyze all transactions within a given area and test them against the parameters that highlight indicators of fraud Perform the analyses and tests as close to the time of the transaction as possible, ideally even before the transaction has been finalized, and preferably on a continuous monitoring basis. By continuously monitoring operational data and transactions, organizations can catch frauds earlier in the fraud cycle, preventing greater losses, and quite often serving as a deterrent to other possible frauds. CHALLENGES TO EFFECTIVE APPLICATION OF TECHNOLOGY Despite the proven and potential benefits, there have been significant challenges to effective, widespread application of transactional analysis and continuous monitoring. One challenge has been the time, cost, and technical expertise involved in extracting and comparing transactional data from multiple and different systems to detect a single instance of suspected fraud. Many indicators of potential fraud only arise when transactional data from one system is compared to that of another. Another has been developing flexible, easily adaptable continuous monitoring programs that can run alongside application systems, test data independently of those systems, and notify management in a timely manner when fraud indicators are detected. Such programs traditionally have been costly and time-consuming to create, often requiring existing systems to be retrofitted. In some organizations, difficulties arise from limited knowledge of the many types of possible fraud and how they might be perpetrated given the organization’s operations. To find fraud, you have to know what it looks like. This requires a thorough understanding of the organization’s internal controls, and their weaknesses, to design and conduct transactional analyses that provide meaningful results.
  • 8. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 7 ACL has developed a dynamic approach to fraud detection and prevention that overcomes the technological data access, analysis, and monitoring challenges as well as the lack of organizational knowledge concerning fraud that can stymie effective application of transactional analysis and continuous monitoring. Before outlining ACL’s combination of software and fraud detection expertise, we’ll examine a number of statistical data analysis fraud detection techniques as well as give examples of specific types of fraud and the practical tests used to uncover those fraud activities. DATA ANALYSIS TECHNIQUES FOR FR AUD DETECTION A number of specific statistical data analysis techniques have proven their effectiveness in detecting fraud: Calculation of statistical parameters such as averages, standard deviations, and highest and lowest values to identify statistical anomalies Classifications to find patterns and associations among groups of data Stratifications of numeric values to identify unusual and outlying values Digital analysis, using Benford’s Law, to identify statistically unlikely occurrences of numeric amounts Joining or matching data fields between disparate systems, typically looking for expected matches or differences for data such as name, address, telephone, or part/serial number “Sounds like” functions that identify fraudulent variations of valid company and employee names Duplicates testing that identifies both simple or complex combinations of duplication Gaps testing that identifies missing sequential data Summing and totaling to check control totals that may be falsified Graphing to provide visual identification of anomalous transactions
  • 9. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 8 TYPICAL TYPES OF FR AUD AND FR AUD TESTS Knowing what to look for is critical in building a fraud detection program. The following examples are based on descriptions of various types of fraud and the tests used to discover the fraud as found in Fraud Detection, Using Data Analysis Techniques to Detect Fraud.12 Type of Fraud Tests Used to Discover This Fraud Fictitious vendors Run checks to uncover post office boxes used as addresses and to find any matches between vendor and employee addresses and/or phone numbers Be alert for vendors with similar sounding names or more than one vendor with the same address and phone number Altered invoices Search for duplicates Check for invoice amounts not matching contracts or purchase order amounts Fixed bidding Summarize contract amount by vendor and compare vendor summaries for several years to determine if a single vendor is winning most bids Calculate days between close for bids and contract submission date by vendor to see if the last bidder consistently wins the contract Goods not received Search for purchase quantities that do not agree with contract quantities Check if inventory levels are changing appropriate to supposed delivery of goods Duplicate invoices Review for duplicate invoice numbers, duplicate date, and invoice amounts Inflated prices Compare prices across vendors to see if prices from a particular vendor are unreasonably high Excess quantities purchased Review for unexplained increases in inventory Determine if purchase quantities of raw materials are appropriate for production level Check to see if increases in quantities ordered compare similarly to previous contracts or years or when compared to other plants Duplicate payments Search for identical invoice numbers and payments amounts Check for repeated requests for refunds for invoices paid twice Carbon copies Search for duplicates within all company checks cashed; conduct a second search for gaps in check numbers Duplicate serial numbers Determine if high value equipment a company already owns is being repurchased by checking serial numbers for duplicates and involvement of same personnel in purchasing and shipping processes Payroll fraud Find out if a terminated employee is still on payroll by comparing the date of termination with the pay period covered by the paycheck and extract all pay transactions for departure date less than date of current pay period Accounts payable Reveal transactions not matching contract amounts by linking Accounts Payable files to contract and inventory files and examining contract date, price, ordered quantity, inventory receipt quantity, invoice quantity, and payment amount by contract 12 Coderre, David G. Fraud Detection, Using Data Analysis to Detect Fraud, (Vancouver, BC: Global Audit Publications, 1999): 50-202
  • 10. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 9 Application Areas for Transactional Analysis Enterprising fraudsters can and will exploit weakness wherever they find it. Computerized transactional analysis has proven itself a reliable aid in fraud detection in a wide range of business processes, including: Accounts Receivable Accounts Payable General Ledger Materials Management and Inventory Control Salaries and Payroll Purchase Order Management Conflict of Interest Kickbacks Bid Rigging Policy and Administration Vendor Management Retail Loss Prevention Sales Analysis Work In Progress Cash Disbursements Customer Service Management Loans Deposits Real Estate Loans Credit Card Management Life Insurance Travel Claims IMPLEMENTING A FR AUD DETECTION PROGR AM Instead of responding on a reactive basis to fraud within an organization, it’s more effective to use data access technologies and strong internal controls to detect and, more importantly, prevent fraud from ever occurring in the first place. Any complete fraud detection program must include the following steps:13 Build a profile of potential frauds. This profile includes a list of the many different areas in which fraud may occur and the types of fraud that are possible in that area. This can be developed as part of a risk assessment. Test data for possible indicators of fraud. A complete testing program should include ad hoc or random testing in addition to more formalized or regular tests. 13 ACL Services Ltd., Using ACL to Detect Fraud:An ACL Workshop, October 2004
  • 11. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 10 Improve controls by implementing continuous monitoring. Strengthen controls over transaction authorizations and use continuous monitoring to test and validate the effectiveness of your controls. Review information from data testing and continuous monitoring. Investigate patterns and fraud indicators that emerge from the fraud detection tests and continuous monitoring. Repeat the steps. This process of building a profile, testing data, improving controls and reviewing information needs to be repeated on a regular basis. ACL TECHNOLOGY ENABLES TIMELY FR AUD DETECTION AND PREVENTION ACL’s approach to fraud detection and prevention is based on comprehensive analysis of the transactional data flowing through financial and operational systems. Using ACL technology to access and analyze unlimited volumes of data from virtually any enterprise application, organizations can quickly identify suspicious transactions that may represent fraud, error, and abuse, and close control loopholes before fraud escalates. ACL data analytics technology supports flexible, exploratory, ad hoc investigations – the kind typically undertaken by skilled auditors or fraud investigators – while ACL Continuous Controls Monitoring (CCM) solutions embed automated, pre-defined analytics within core business processes that represent high- risk areas to the organization for sustainable and scalable analysis. Data Analytics Technology ACL’s robust analytics technology enables analysis of even the largest volumes of transactional data in a fraction of the time once required, so that all pertinent data from any number of systems can be quickly analyzed for flagging potential indicators of fraud. Through a unique and powerful combination of data access, analysis, and integrated reporting capabilities, ACL software reaches data from virtually any source, across any system, through a consistent user interface – whether housed in mainframes, servers, legacy systems, or PC networks. By independently comparing and analyzing data from ERP, CRM, SCM, or other enterprise applications, ACL technology enables immediate insight into the transactional data underlying core business processes and financial reporting. In the 2005 Internal Auditor software survey, ACL was selected by 44 percent of the participants as the tool of choice for fraud prevention and detection. Fraud Detection/Prevention Software Reprinted with permission from Internal Auditor (August 2005), published by The Institute of Internal Auditors, Inc. www.theiia.org Access 8% Excel 21% IDEA 8% PeopleSoft Query 2% Internally developed software 8% Other 9% ACL 44%
  • 12. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 11 Continuous Controls Monitoring KPMG’s Fraud Survey 2003 revealed that internal controls, internal audit, and notification by employee are the three leading ways of uncovering fraud, with internal controls being the fastest growing method. Among newly instituted programs, respondents cite “reviewing or strengthening internal controls” more frequently than any other type of program.14 Internal controls are increasingly being used as an anti-fraud method by organizations, a trend driven in part by the pressures of regulatory requirements such as the Sarbanes-Oxley Act, and in particular, Section 404. To help ensure these internal controls are in place and operating effectively, many organizations are turning to technologies such as continuous controls monitoring. ACL CCM solutions identify fraud, errors, and inefficiencies, by automating internal controls testing in key financial and operational processes across the enterprise through independent analysis of business transactions at the source level. Embedding audit “best practices” into organizations’ day-to-day business operations, CCM solutions apply automated, pre-defined analytics to critical control points, mapped to the COSO internal controls framework, within core business processes such as the purchase-to-payment cycle, payroll, purchasing card programs, the order-to-cash cycle, and general ledger activities. Financial management and business unit managers gain constant oversight and insight into their business operations, receiving timely notification of control breaches and gaps, so they can investigate and resolve potential problems – including possibly fraudulent activities – before they escalate. ACL CCM solutions access and analyze unlimited volumes of transactional data from all the different systems and applications supporting your business operations, while maintaining data integrity. The result – comprehensive insight into control weaknesses and business risks, enabling informed decision-making and faster response to organizational, market, and regulatory changes. FAST IMPLEMENTATION AND FAST PAYBACK The ease and speed of implementing a complete ACL solution means not only more timely detection of fraud and faster return on investment, but also more effective, systematic fraud prevention over the long term. Having an effective system for fraud prevention in place is part of business assurance – the knowledge that an organization can rely on the accuracy, reliability, and integrity of all its data and transactions to make decisions with speed and confidence. ACL solutions provide audit, compliance, and financial professionals with the confidence that they are seeing the full picture – giving clients the ability to find fraud, stop overpayments, and improve operational efficiency. 14 KPMG, Fraud Survey 2003, KPMG Forensic, 2004
  • 13. © 2006 ACL Services Ltd. WP/FD/110106 ACL, the ACL logo, the ACL logo with the text “Data you can trust. Results you can see.”, and Audit Command Language are trademarks or registered trademarks of ACL Services Ltd. All other trademarks are the property of their respective owners. 12 CONCLUSION A well-designed and implemented fraud detection system, based on the transactional analysis of operational systems, can significantly reduce the chance of fraud occurring within an organization and then remaining undetected. The sooner that indicators of fraud are available, the greater the chance that losses can be recovered and address any control weaknesses. The timely detection of fraud directly impacts the bottom line, reducing losses for an organization. And effective detection techniques serve as a deterrent to potential fraudsters; employees who know experts are present and looking for fraud or that continuous controls monitoring is occurring on a daily basis are less likely to commit fraud because of a greater perceived likelihood that they will be caught. Finally, given new regulatory requirements such as SOX, the decision is no longer if an organization should implement a complete fraud detection and prevention program, rather how quickly that program can be put into place. To find out how ACL can help your organization combat fraud, contact us at +1-604-669-4225 or info@acl.com to arrange for a free consultation. COMPANY OVERVIEW ACL is the leading global provider of Business Assurance Analytics to financial executives, compliance professionals, and auditors. Combining market-leading data analytics software and professional services expertise, ACL solutions give organizations confidence in the accuracy and integrity of transactions and the effectiveness of internal controls underlying increasingly complex business operations. Since 1987, ACL’s proven technology has enabled financial decision-makers to assure controls compliance, reduce risk, detect fraud, enhance profitability, and achieve fast payback. ACL delivers its solutions in more than 130 countries through a global network of ACL offices and channel partners. Our customers include 70 percent of the Fortune 500 companies and over two-thirds of the Global 500, as well as hundreds of national, state, and local governments, and the Big Four public accounting firms. ACL Headquarters T +1 604 669 4225 F +1 604 669 3557 acl.com info@acl.com