Presentation

Mining for Gold:
Data Mining & the Internal Audit Function
Presenters:
Calvin E. Webb II
Cherie R. Wright
May 22, 2011
Today’s Agenda
• Why Should We Perform Data Analysis?
• Data – It Has Something To Say!
• What the Heck Should We Be Doing Now?
1

• Inform You
Today’s Objectives
• Educate You
• Motivate You
• Scare You into Action / Change
Hopefully We Will Learn …..
“Insanity: doing the same thing over and over
again and expecting different results.”
Albert Einstein
2

Why Should We Perform Data Analysis?
Who Mentions
“Computer Assisted Audit Techniques”?
• (SAS No. 99 ‐ Consideration of Fraud in a Financial Statement Audit)
“Internal auditors may conduct proactive auditing to search for corruption,
misappropriation i of assets, and financial i statement t tfraud. This may include
the use of computer‐assisted audit techniques to detect particular types of
fraud. Internal auditors also can employ analytical and other procedures to
isolate anomalies and perform detailed reviews of high‐risk accounts and
transactions to identify potential financial statement fraud.”
• Enterprise Risk Management — Integrated Framework Executive Summary
Framework September 2004 (The Committee of Sponsoring Organizations of the
Treadway Commission)
• Managing the Business Risk of Fraud: A Practical Guide (Sponsored by The
Institute of Internal Auditors, The American Institute of Certified Public Accountants and
Association of Certified Fraud Examiners)
3

Data Analysis –The Possibilities
The Cost of Fraud
Annual
Cost
$2.9
Trillion
Average
Loss
5% of
Revenues
"2010 Report to the Nation on Occupational Fraud and Abuse. Copyright
2010 by the Association of Certified Fraud Examiners, Inc."
4

Types of Fraud
Asset
Misappropriationi 86.3% of cases
Median loss
$135,000
Fraudulent
Statementst
t
4.8% of cases
Median loss
$4,100,000
Corruption
32.8% of cases
Median Loss
$250,000
"2010 Report to the Nation on Occupational Fraud and Abuse. Copyright
2010 by the Association of Certified Fraud Examiners, Inc."
Occupational Fraud and Abuse
Classification System
(Continued)
"2010 Report to the Nation on Occupational Fraud and Abuse. Copyright
2010 by the Association of Certified Fraud Examiners, Inc."
5

Occupational Fraud and Abuse
Classification System
"2010 Report to the Nation on Occupational Fraud and Abuse. Copyright
2010 by the Association of Certified Fraud Examiners, Inc."
Detection of Fraud ‐ Government
Fraud Schemes (All Cases) – Median length of time prior to detection is 18 months
for all entity types – Range 12 months to 27 months
"2010 Report to the Nation on Occupational Fraud and Abuse. Copyright
2010 by the Association of Certified Fraud Examiners, Inc."
6

Why Perform Data Analysis?
Convert the 5% By Accident to Not By Accident
Find It On Your Terms Not Someone Elseʹs
All organizations should perform
comprehensive Data Analysis
Why Perform Data Analysis? (con’t)
• How many of you in the audience sign the year‐end
representation letter to the external auditors?
• Key representations:
– Responsible for internal control environment
– No known significant deficiencies in the design of or
operation of internal controls
– Acknowledge responsibility for the design and
implementation of programs and controls to prevent and
detect fraud
– No known material instances of fraud
• Fiduciary responsibility as a member of the executive
management team
• Convert the “Isolated Occurrence” comment to a thing of the
past
7

Data –It Has Something To Say!
Significant assets of an Organization
•People
• Cash h& investments
t
• Property, plant & equipment
• Intellectual property
• Reputation
• Financial & operational data (one of the most
underutilized assets)
•Many others
8

Various Types of Data
Capital Assets
Property Tax
Vendors
Payroll
Many Others
Employees
(HR)
Receivables
Disbursements
Purchasing Cards
General Ledger
Traditional View of Data
• Assets, Liabilities and Equity
• Revenues versus Expenses
•Budget versus Actual
•Ratios, etc.
9

A New View of Data
Application Areas for Transactional
Data Analysis
• Accounts Payable
• Accounts Receivable
• Bid Rigging
• Cash Disbursements
• Conflict of Interest
• Credit Card Management
• Customer Service
Management
• Deposits
• General Ledger
• Kickbacks
• Life Insurance
• Loans
• Materials Management and
Inventory Control
• Policy and Administration
• Purchase Order Management
• Real Estate Loans
• Retail Loss Prevention
• Salaries and Payroll
• Sales Analysis
• Travel Claims
• Vendor Management
• Work In Progress
ACL – White Paper - Analyze Every Transaction in the Fight Against
Fraud: Using Technology for Effective Fraud Detection
• Operational
A New View of Data (con’t)
• Vendors & Disbursements
• Human Resources & Payroll
• Vendors Compared to Human Resources
• Property Tax versus Utility Billings
• Eligibility – Federal and State programs
• Delinquent Taxes / Assumed Names / Vendors
DATA ANALYSIS – LIMITED ONLY TO
ELECTRONIC DATA AND YOUR
IMAGINATION
10

Dallas County
Best Practice Award Project
Financial / General Management Category
Surprise Audits
• Effective, yet underutilized
•Less than 30% of victim organizations
conducted surprise audits
•Lower fraud losses and detect frauds more
quickly
•Perception of detection
"2010 Report to the Nation on Occupational Fraud and Abuse. Copyright
2010 by the Association of Certified Fraud Examiners, Inc."
11

Applications
• Collect information about current/ potential
customers
•Credit card companies track patterns and
identify stolen cards
• Department of Defense tracks passport and visa
applications, i work permits, driver’s di licenses,
etc.
Applications
12

Irregularities
• Accounts Payable
– Duplicate payments
–Rounded amounts
– Just below thresholds
–Check theft
–Abnormal volume
– Cancelled checks
–Above average payments
– Vendor/employee crosscheck
– Mail drop addresses
ROW VND NAM INV NUM INV DATE INV AMT
CHECK
NUM
PAY DATE
PROCESS
TIME APP PO AMT
1 ROBINSO 94225 12/13/2008 399.50 174709 10/25/2009 1:31 PM GH 400.00
2 SOUTHCO JT5941511 11/14/2009 4,999.99 174915 12/6/2009 2:33 PM GH 4,999.99
3 Q COAT JT6134612 12/20/2009 30.73 175144 2/13/2010 9:10 AM GH 35.00
4 ONETIME 11637 4/30/2010 5,093.38 175779 6/6/2010 1:32 AM SK 5,000.00
5 NEWMAN 4334 11/28/2009 1,086.88 175201 2/7/2010 12:32 PM GH 1,500.00
6 ONETIME 106040 6/11/2010 49.76 175957 7/11/2010 12:34 PM GH 45.00
7 ONETIME 185396 1/26/2010 1,398.25 175229 2/14/2010 4:01 PM GH 1,350.00
8 DESARIO 12126 6/8/2010 23.00 175896 7/4/2010 3:43 PM GH 25.00
9 FILTERS 69688 10/18/2009 175.00 174762 11/8/2009 1:33 PM GH 200.00
10 BOWIE 6573 10/10/2009 1,412.71 174649 10/17/2009 5:05 PM GH 1,500.00
11 ONETIME 37338 11/7/2009 296.10 174929 12/13/2009 5:45 PM GH 275.00
12 Q COAT JT61346‐12 12/21/2009 30.73 175239 2/14/2010 2:35 PM GH 35.00
13 ONETIME 01104666I 4/23/2010 42.30 175680 5/16/2010 9:01 AM GH 45.00
14 HOUWATE 78763 11/20/2009 55,000.00 174950 12/25/2009 11:43 AM GH 55,000.00
15 ONETIME 0109‐8635 1/10/2010 50.00 175174 1/31/2010 1:01 AM SK 45.00
16 WATKINS 8219 3/8/2010 525.81 175830 6/13/2010 7:43 AM GH 525.00
17 SOUTHCO JT5941622 11/16/2009 4,999.99 174932 12/10/2009 4:23 PM GH 4,999.99
13

Irregularities
•Payroll
–Gross equal net pay
–Ghost employees
–Off‐cycle payments
– Payments to terminated employees
–False social security numbers
–High overtime
ROW
EMP
NUM
GROSS
PAY PAY DATE NET PAY SS HIRE DATE TERM DATE
DD BANK
ACCT NUM
1 1123 2,250.00 5/15/2009 1,346.17 579627851 8/20/1973 23896
2 1156 2,060.00 11/15/2009 1,335.91 396152031 9/13/2008 12/24/2009 89000567
3 1178 1,800.01 11/30/2009 1,800.01 123456789 3/4/1980 65324
4 1198 2,370.00 11/15/2009 1,716.47 543945471 3/16/1994 7832112
5 2134 2,370.94 5/15/2009 1,592.08 417337241 11/12/2008 455599021
6 2346 288.75 8/31/2009 126.33 308801411 5/15/2008 78345
7 2389 1,725.00 8/15/2009 1,118.67 294624211 6/30/2008 12/1/2008 9998001326
8 2399 7,754.00 8/15/2009 5,251.79 256024861 6/15/2009 78231
9 1101 4,647.00 2/15/2010 2,668.53 142422251 1/19/2009 90433389
10 1109 2,657.00 11/15/2009 1,563.65 605843191 12/15/2009 51938215
11 2369 1,000.00 8/15/2009 65.01 634999999 4/5/1992 1/14/2010 89000567
12 1178 2,250.00 11/30/2009 1,459.14 341549121 3/4/2008 21903198
13 2478 2,550.00 5/15/2009 1,640.92 303764511 9/14/1991 89100026
14 1103 2,095.76 5/15/2009 1,231.26 626829921 9/8/2008 9875
15 2198 3,093.00 11/15/2009 2,291.15 243454611 8/3/1995 2999843
14

Irregularities
• General Ledger
– Duplicate or missing JEs
–JEs posted on specific dates
–JEs with large amounts
Irregularities
• Receivables
– Duplicate invoices
–Debtors with balances over credit limits
–Debtors with credit balances
– Large write‐offs
15

Irregularities
• Capital Assets
– Depreciation recalculation
– Duplicate tag numbers
– Depreciation exceeding cost
– Comparison of listings
Systematic Approach
• Identify inherent fraud scheme
• Build fraud scenario
•Obtain data
• Identify and link data to fraud scenario
• St Set up Proactive Fraud Monitors
16

Data Interrogation
• Pattern and frequency
• Circumvention strategies
• Duplicate analysis
• Changes
• Illogical
•Trends
•Mistakes or unsophisticated perpetrator
•Data interpretation challenge or sophisticated
perpetrator
•Master file
• Transactional history
• Overt vs. covert
Benford’s Law
Place
Digit 1 2 3 4
0 11.97% 10.18% 10.02%
1 30.10% 11.39% 10.14% 10.01%
2 17.61% 10.88% 10.10% 10.01%
3 12.49% 10.43% 10.06% 10.01%
4 9.69% 10.03% 10.02% 10.00%
5 7.92% 9.67% 9.98% 10.00%
6 6.69% 9.34% 9.94% 9.99%
7 5.80% 9.04% 9.90% 9.99%
8 5.12% 8.76% 9.86% 9.99%
9 4.58% 8.50% 9.83% 9.99%
17

Benford’s Law Analysis
•Number sets result from mathematical
combination
– Accounts Payable (number purchased * price)
•Transaction‐level data
–Disbursements, se e s, expenses, ses,sales
•Large data sets
–A full year or multiple years’ set of transactions
18

Benford’s Law Analysis
•Data set comprised of assigned numbers
–Check numbers, invoice numbers
• Accounts with firm‐specific numbers
–An account with a large number of $100 transactions
Data Mining Example
•GAO purchase and travel card program audits
– Nature of transaction
–Merchants
– Timing
– Dollar amount
–Other characteristics
19

What the Heck Should We Be Doing Now?
COSO Framework
Source: The Committee of Sponsoring Organizations of the Treadway Commission
20

34
.
2
1
I
dm
ep
nl
te
im
fe
yn
t
I
nM
fo
on
ri
mt
ao
tr
i
on
ng
4. Develop and
implement costeffective
procedures to
evaluate that
persuasive information
.
I
P
d
r
e
i
n
o
t
r
i
f
t
y
i
z
C
e
o
n
R
t
i
r
s
o
k
l
s
Monitoring
1. Understand and
prioritize risks to
organizational
objectives
3. Identify information
that will persuasively
indicate whether the
internal control system
is operating effectively
2. Identify key controls
across the internal
control system that
address those
prioritized risks
Source: The Committee of Sponsoring Organizations of the Treadway Commission
The Cost of Fraud
21

Thanks For
Your
Involvement!
22