Fraud Triangle Analytics Anti-Fraud Research and Methodologies

Transcription

1 Fraud Triangle Analytics Anti-Fraud Research and Methodologies Risk Management Committee Meeting American Hotel & Lodging Association November 18, 2009

2 Topics for discussion Why incorporate fraud detection analytics The Fraud Triangle in the current business environment Forensic analytics maturity model Our research: forensic data analytics from a Fraud Triangle perspective Forensic analytics to find hidden money (combining structured and unstructured data) Page 2

3 Why incorporate fraud detection analytics? 7% of company revenues are lost due to fraud per ACFE* Obtain better understanding of company s risks & controls Sets a proper tone at the top Integrates well with internal audit functions and goes beyond controls testing Potential lower D&O premiums *2008 ACFE Report to the Nation on Occupational Fraud Page 3

4 Current environment The perfect storm for fraud Companies and organizations are downsizing which has an immediate effect on internal controls Opportunity Budgets are decreasing. Companies and organizations are doing more with less. Increase use of government funds Layoffs unemployment and unease continue Stock prices levels remain low Credit crisis and other external factors limit liquidity Pressure Internal and External Pressure Opportunity to Commit Fraud Internal Controls Rationalization Stressed and disaffected employees may have greater ability to rationalize improper actions Page 4

5 Where is fraud occurring? Source: ACFE 2008 Report to the Nation On Occupational Fraud Page 5

6 2008 Corruption Perceptions Index X Low High Page 6

7 How is it detected? 66% by tip or accident Source: ACFE 2008 Report to the Nation On Occupational Fraud Page 7

8 Forensic Analytics Maturity Model Become more proactive in detecting fraud Low Detection Rate High Structured Data Traditional Rules-Based Queries & Analytics Model-Based Analysis Visual Analytics Unstructured Data Traditional Keyword Searching Latent Semantic Analysis Natural Language Processing High False Positive Rate Low Page 8

9 Data Sources in Today s Organization Focus of most audits Text OPPORTUNITY for audit Graphics Unstructured Data Structured Data CRM Databases Accounting Systems Presentations & Spreadsheets Page 9 20% 80%

10 Summary of Our Research Incorporated lessons learned from past Change the way we view data 80% of data is unstructured Innovative and aggressive methods to uncover: Fraud Error Misuse Waste Need for a targeted, risk-based approach May/June and July/August issues of FRAUD Magazine Page 10

11 Risk-Based Approach Workflow 1. Perform risk assessment 2. Link risk to business process 3. Link business process to departments 4. Link departments to people 5. Collect data (in or transactional data) 6. Perform analysis Risks Processes Departments People Data Analysis Page 11

12 The Fraud Triangle¹ Applying theory to electronic communications 1. Donald R. Cressey's Fraud Triangle ; Incentive/Pressure, Opportunity and Rationalization are present when fraud exists. Page 12

13 EY / ACFE Library of Keywords (Over 3,000 terms in a half dozen languages so far ) Rationalization Incentive/ Pressure Opportunity I deserve it nobody will find out gray area they owe it to me everybody does it fix it later the company can afford it not hurting anyone won t miss it don t get paid enough make the number don t let the auditor find out don t leave a trail not comfortable why are we doing this pull out all the stops do not volunteer information want no part of this only a timing difference not ethical special fees client side storage off the books cash advance side commission backdate no inspection no receipt smooth earnings pull earnings forward Page 13

14 Predictive Fraud Analysis - output Joint EY and ACFE Research Project Page 14

15 Proactive Fraud Analysis Research Revenue Recognition Fraud Keyword hits as a percentage of total s Incentive/Pressure Terms Opportunity Terms Rationalization Terms Page 15

16 Proactive Fraud Analysis Research Revenue Recognition Fraud Selected Top Keyword Hits During Peak Period Incentive/Pressure Terms problem commit create concern not sure short clarify split spread revise sorry Opportunity Terms correct appropriate reserve miss condition depart discount difficult fail critical Rationalization Terms therefore find out it s OK get w/1 back challenge find it figure out catch complex does not w/1 make sense doesn t w/1 make sense Page 16

17 Proactive Fraud Analysis Research Bribery Case Keyword hits as a percentage of total s Incentive/Pressure Terms Opportunity Terms Rationalization Terms Investigation timeframe, September 2006 to March 2007 Page 17

18 Proactive Fraud Analysis Research Bribery Case Selected Top Keyword Hits During Peak Period Incentive/Pressure Terms Opportunity Terms manage risk short problem commit concern clear fake cover policy fund complain investigate process w/5 fee consult audit offshore renewal Rationalization Terms error therefore challenge complex entitled get w/1 back catch mistake justified find out Page 18

19 Visualizing the Fraud Triangle: Via Online Dashboard Page 19

20 Drill down by custodian, focus on key years Page 20

21 Drill down further into months Terms counts update for the custodian and specified months Page 21

22 If required, drill down to the source or instant message communication Page 22

23 Case Example: Global Consumer Products Company received more than 40 whistleblower hotline complaints from one of the regions in Mexico over a three month period In response, the company s internal audit team performed an investigation on the complaints Company wanted to review s for 28 custodians, in search of evidence that would further bolster the results of the investigations; however, time and budget was limited When EY became involved, we were provided little information pertaining to the various allegations EY processed the PST s using Fraud Triangle Analytics yielding 200,964 s. and attachments were searched using a combination of ACFE-EY Fraud Terms as well as terms provided by the Client ( Client Terms ) related to their various internal investigations. Page 23

24 Analysis of Client Terms Fraud Indicators for the top five custodians for high-risk terms Diesel vs Fraud Score 50 Results from the investigation line key words hits Trend Avg. Diesel_Per Trend Pressure key words hits Trend Avg. IP_Per Trend Avg. OP_Per 40 Opportunity key words hits Trend Trend Avg. RAT_Per Rationalization key words hits Trend Trend Jul 1 07 Sep 1 07 No v 1 07 Jan 1 08 Mar 1 08 May 1 08 Jul 1 08 Sep 1 08 Nov 1 08 Jan 1 09 Mar 1 09 May 1 09 Date Th e tren d of averag e o f Diesel_Per, averag e o f IP_Per, average of O P_Per an d averag e of RAT_Per with Date. Th e data is filtered on Date Year an d name. The Date Year filter has multip le members selected. Th e name filter keeps G ABRIEL ROSAS MORENO, JAVIER QUIROZ CHIAPA, JOSE LUIS HERNNDEZ GARCA (SALVATIERRA), RAFAEL ARREDONDO CARCIA (VALLE DE SANTIAGO) and VICTO R HUG O LO PEZ VALLADARES. Page 24

25 Advanced Analytics WHO WHAT WHEN WHY Social Networking Concept Clustering Communication Over Time Sentiment Analysis Who is talking to whom? about what? over which time period? how do they feel? People-to-people analysis Top words mentioned When communications occur Positive vs. Negative Sentiment Entity-to-entity analysis Map communication lines to organization chart Key concepts / topics Top or unusual dollar amounts Sensitive words / phrases Communication spikes around key business events Top 10 negative journal entries Top 10 angry s Top 10 most concerned s SSN Customer survey analysis CCN Employee survey analysis Page 25

26 Visual Analytics Entity Extraction Geographic view Why so many mentions of Colombia? We don t do business in Colombia! Page 26

27 Considering Structured Data Low Detection Rate High Structured Data Traditional Rules-Based Queries & Analytics Model-Based Analysis Visual Analytics Unstructured Data Traditional Keyword Searching Latent Semantic Analysis Natural Language Processing High False Positive Rate Low Page 27

28 Fraud Risk Areas to Consider Asset Misappropriation Corruption / FCPA Financial Statement Cash Disbursements Bid Rigging Accounts Payable General Ledger Conflicts of Interest Account Receivable Materials Management & Inventory Control Purchase Order Management Salaries & Payroll Travel & Expenses Contract Compliance Kickbacks Materials Management & Inventory Control Purchase Order Management Deposits General Ledger Materials Management & Inventory Control Purchase Order Management Vendor Management Payment Cards Sales Analysis Travel & Expenses Revenue Recognition / Procure to Pay Sales Analysis Note: Some categories may overlap depending on the objectives of the investigation. Page 28

29 Data Analytics Common Areas of Interest 1. Payment stream analysis Altered invoices, goods not received, duplicate invoices, inflated prices, excess quantities purchased 2. Vendor master/employee master comparisons Fictitious vendors, vendor risk ranking, conflicts of interest 3. Employee expenses Over limits, unusual expenses, miscellaneous/sundry expenses, consultant payments 4. P-card expenditures 5. Payroll Over limits, unusual expenses, miscellaneous/sundry expenses Ghost employees, unusual payments, no deductions/evaluations, direct deposit account analysis 6. Bribery & Corruption / FCPA Bid rigging, conflicts of interest, contract compliance, kickbacks, payments to outside consultants Page 29

30 Find Hidden Money Recover Erroneous, Negligent or Fraudulent Payments Different Vendor ID Same Date Exact Same Amount Different Invoice # Same Reference / Job Code Similar names Some with same address Page 30

31 Predictive Modeling Analyze 400,000 transactions for suspected bribery payments (400 man-days) 1. Ernst & Young team reviewed 2,000 transactions from ledger data (text comments, amounts, dates, etc.) Identified 400 suspicious and 1,600 non-suspicious entries 2. Created statistical model: Is Suspicious / Is Not Suspicious Incorporated both structured and unstructured data into the model 3. Applied model to remaining 398,000 additional transactions 4. Identified 14,000 new suspicious transactions With confidence over 95% similar to Is Suspicious Identified over $8 million of highly suspicious payments Page 31

32 Predictive Modeling (Step 2) Perform text analytics Volume contract facilitation Perform Text Analytics on free text fields Conduct term frequency analysis for most occurring or unusual transaction descriptions Capture concepts release expense Page 32

33 Predictive Modeling (Step 3) Prepare the model Perform Variable Analysis These variables were less important when predicting suspicious transactions. Client should focus resources on monitoring efforts for the three leading drivers which accounts for 80% of the predictive value. These three variables were this highest drivers of suspicious transactions Page 33

34 Customized on-line compliance monitoring tools Uploads / integrates with transactional data sources Drill down capabilities by subsidiary or region Dynamic reporting Web-based Rules-based and model based analytics Page 34

35 Monitoring online reports Anomaly Detection Names have been partially redacted Page 35

36 Benford s Law (In naturally occurring numbers) Where d is the leading digit and p is the probability. Source: Wikipedia Page 36

37 Benford s Law Practical Examples Applications: Expense costs, Vendor invoices, Sales Figures, and Insurance Claims should follow Benford s Law 1 Spot dummy vendors in data manipulation schemes Majority of improper purchases begin with 7, 8, or 9 which is just the opposite of Benford s predicted patterns Consequently, fraudulent invoices are easier to detect using Benford s Law than by random sampling. Also identify amounts just below pre-defined cut-offs As shown, the threshold for second approval was $4,000 so invoices often began with 3 (as in $3,999) Analysis of 10,000 vendor invoices 1. Per Mark Nigrini, a Ph.D., and a chartered accountant: After several years of studying Benford s Law, he published his thesis in 1992 demonstrating that Benford s Law could be used to detect fraud and to detect rounded numbers. His studies revealed that sales figures, insurance claim costs, and expense claims should follow Benford s Law. Page 37

38 Final considerations for our clients Assess risk Part of planning, or just a repeat of last year Measure risk Is it just rules based? Consider unstructured (text-based) data Consider incorporating the fraud triangle concept Improve business performance Not just risk mitigation FCPA awareness Find hidden money Reduce costs Page 38

39 Thank you Daniel Torpey, CPA, CITP Partner, Assurance Services Fraud Investigation & Dispute Services Dallas, Texas (214) Vincent Walden, CFE, CPA, CITP Senior Manager, Assurance Services Fraud Investigation & Dispute Services Dallas, Texas (214) Page 39