Needles in the Haystack: Data Mining for Fraud Detection

Transcription

1 acumen insight Needles in the Haystack: Data Mining for Fraud Detection ideas attention reach Presented by Angela Morelock, CPA, CFE, CFF, ABV, Certified Forensic Accountant expertise depth agility talent

2 Perp Poetry

3 Straw Vendor Invoice Invoice With 40 % Mark-up Print Job Legit Vendor Employee Graphic Designer Client Company

4 REPORT TO THE NATIONS

5 2012 by the Association of Certified Fraud Examiners, Inc.

6 Common Data Mining Areas Employees and Payroll Vendors and Accounts Payable Expense Reimbursement P Cards & Corporate Credit Cards Loans (financial institutions only) Patient accounting (health care only) Sales Inventory

7 Vendor Trending Analysis Time Series Analysis: Acceleration Vendor: JLM Plumbing Authorized: Janice L. McPhearson Acceleration as confidence builds Getting Greedy Test phase

8 Name Mining - Anagrams

9 Geocoding AP Manager Vinny s Salvage Yard

10 Address Mining - Maildrops Fictitious Vendor with UPS Store Address

11 Name and Address Mining Name and ID analysis Direct matching Phonetic matching (Double Metaphone Hybrid) Compare to known name dictionaries Anagram search Duplicate Employee ID / SSN, Invalid SSNs Address analysis Direct matching No address, invalid address, PO/RR address Proximity by latitude/longitude lookup Address is a known mailbox service (FedEx Kinkos, UPS Store, etc.) Visual Map Analysis

12 Address Matching Address Match Example

13 Employee-Vendor Proximity

14 Benford s Law Analysis

15 Check Sequence Analysis

16 Split Purchase

17 Accounts Payable Mining AP: Fictitious vendors, duplicate payments, etc. Benford s analysis Acronym search on employee name Acceleration (systematic spending increases) via time series analysis Duplicate invoices Duplicate payments Identify invoices in excess of n% of vendor average Compare PO/invoice amount to check amount Identify transactions ending in 5 or 0 Baseline vendor activity against overall activity Classify transactions by clerk/approver Compare multiple vendor master files over 3 years Identify statistical outliers (Z-score method)

18 Payroll Mining Payroll Detail Employees with no deductions PR activity subsequent to termination Employee vs department baselines ($ and hrs) Department vs company baselines ($ and hrs) Benford's analysis of gross / net payroll Time series analysis Employee with no sick/vacation/time off Computed pay rate vs. Employee master rate Compare actual pay rates to rate schedule Other analysis Duplicate phone number(s) Duplicate direct deposit accounts Short duration of hire/termination

19 acumen insight ideas Fictitious Loans attention reach expertise depth agility talent

20 Loan Master File HOME BUS ORIGINAL CUST_NAME ADDRESS1 city state zip PHONE PHONE TIN_SSN AMT P & Q BUILDERS P O BOX 145 SOMEWHERE ST XX093X64X6 0 X10X23X5 600, TERRY CEO PO BOX 145 SOMEWHERE ST XX093X64X6 0 4X22X68X 352, P & Q BUILDERS P O BOX 145 SOMEWHERE ST XX093X64X6 0 X10X23X5 269, P & Q BUILDERS P O BOX 145 SOMEWHERE ST XX093X64X6 0 X10X23X5 200, TERRY CEO PO BOX 145 SOMEWHERE ST XX093X64X6 0 4X22X68X 100, P & Q DISTRIBUTING INC PO BOX 247 CITY ST XX05X53X66 XX05X52X7 X10X23X5 100, P & Q DISTRIBUTING INC PO BOX 247 CITY ST XX05X53X66 XX05X52X7 X10X23X5 10,000.00

21 acumen insight ideas Manipulation of Portfolio Quality attention reach expertise depth agility talent

22 Loan Maintenance File Interest Rate Manipulations Past Due Manipulations Maintenance by User

23 2012 by the Association of Certified Fraud Examiners, Inc.

24 Resources IIA Guidance - GTAG Series GTAG 3 Continuous Auditing: Implications for Assurance, Monitoring & Risk Assessment GTAG 13 Fraud Prevention and Detection in an Automated World GTAG 16 Data Analysis Technologies Other Resources

25 Contact Information Angela Morelock, CPA, CFE, CFF, ABV, Certified Forensic Accountant BKD, LLP 910 E. St. Louis Street Springfield, MO Phone: Fax: Blog: Follow me on

26 acumen insight ideas Questions? attention reach expertise depth agility talent