Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Audit,fraud detection Using Picalo


Published on

Detectlets for Better Fraud Detection,audit and continous auditing,continous monitoring,Dogbatse,Conan C. Albrecht,Picalo,data quality

Published in: Economy & Finance, Technology
  • Be the first to comment

Audit,fraud detection Using Picalo

  1. 1. Detectlets for Better Fraud Detection Conan C. Albrecht, PhD Marriott School of Management Brigham Young University
  2. 2. Today’s Presentation <ul><li>Give a few fraud stories </li></ul><ul><li>Outline the Detectlet vision and Picalo Architecture </li></ul><ul><li>Show example code and working products </li></ul><ul><li>Describe future research directions and solicit help </li></ul>
  3. 3. Two Types of Fraud <ul><li>Fraud on behalf of an organization </li></ul><ul><ul><li>Financial statement manipulation to make the company look better to stockholders </li></ul></ul><ul><ul><li>Also called management fraud </li></ul></ul><ul><li>Fraud against an organization </li></ul><ul><ul><li>Stealing assets, information, etc. </li></ul></ul><ul><ul><li>Also called employee or consumer fraud </li></ul></ul>
  4. 4. ACFE Report to the Nation Occupational Fraud and Abuse <ul><li>2 1/2 year study of 2608 Frauds totaling $15 million </li></ul><ul><ul><li>Fraud costs U.S. organizations more than $400 billion annually. </li></ul></ul><ul><ul><li>Fraud and abuse costs employers an average of $9 a day per employee </li></ul></ul><ul><ul><li>The average organization loses about 6 percent of its total annual revenue to fraud and abuse admitted to by its own employees </li></ul></ul>
  5. 5. Ernst & Young Fraud Study 2002 (Europe) <ul><li>One in five workers are aware of fraud in their workplace </li></ul><ul><li>80% would be willing to turn in a colleague but only 43% have </li></ul><ul><li>Employers lost 20 cents on every dollar to workplace fraud </li></ul><ul><li>Types of fraud </li></ul><ul><ul><li>Theft of office items—37% </li></ul></ul><ul><ul><li>Claiming extra hours worked—16% </li></ul></ul><ul><ul><li>Inflating expenses accounts—7% </li></ul></ul><ul><ul><li>Taking kickbacks from suppliers—6% </li></ul></ul>
  6. 6. Cost of Fraud <ul><li>Fraud Losses Reduce Net Income $ for $ </li></ul><ul><li>If Profit Margin is 10%, Revenues Must Increase by 10 times Losses to Recover Affect on Net Income </li></ul><ul><ul><li>Losses……. $1 Million </li></ul></ul><ul><ul><li>Revenue….$1 Billion </li></ul></ul>Revenues $100 100% Expenses 90 90 % Net Income $ 10 10% Fraud 1 Remaining $ 9 To restore income to $10, need $10 more dollars of revenue to generate $1 more dollar of income.
  7. 7. <ul><li>Large Bank </li></ul><ul><ul><li>$100 Million Fraud </li></ul></ul><ul><ul><li>Profit Margin = 10 % </li></ul></ul><ul><ul><li>$1 Billion in Revenues Needed </li></ul></ul><ul><ul><li>At $100 per year per Checking Account, 10 Million New Accounts </li></ul></ul>Fraud Cost….Two Examples <ul><li>Automobile Manufacturer </li></ul><ul><ul><li>$436 Million Fraud </li></ul></ul><ul><ul><li>Profit Margin = 10% </li></ul></ul><ul><ul><li>$4.36 Billion in Revenues Needed </li></ul></ul><ul><ul><li>At $20,000 per Car, 218,000 Cars </li></ul></ul>
  8. 8. A Recent Fraud <ul><li>Large Fraud of $2.6 Billion over 9 years </li></ul><ul><ul><li>Year 1 $600K </li></ul></ul><ul><ul><li>Year 3 $4 million </li></ul></ul><ul><ul><li>Year 5 $80 million </li></ul></ul><ul><ul><li>Year 7 $600 million </li></ul></ul><ul><ul><li>Year 9 $2.6 billion </li></ul></ul><ul><li>In years 8 and 9, four of the world’s largest banks were involved and lost over $500 million </li></ul>Some of the organizations involved: Merrill Lynch, Chase, J.P. Morgan, Union Bank of Switzerland, Credit Lynnaise, Sumitomo, and others.
  9. 9. Every Person Has A Price <ul><li>Abraham Lincoln once threw a man out of his office, angrily turning down a substantial bribe. “Every man has his price”, explained Lincoln, “and he was getting close to mine.” </li></ul>
  10. 10. Examples of Data-Based Detection
  11. 11. Superhuman Workers <ul><li>Summed all hours (normal, OT, DT) per two week period, regardless of invoice or timecard) </li></ul><ul><li>Workers were logging hours on two timecards for simultaneous jobs </li></ul>
  12. 12. The Family Business Work Orders Authorized By Purchaser
  13. 13. The Family Business Invoice Charges Authorized By Purchaser
  14. 14. The Family Business Work Orders Given To Contractor Crew
  15. 15. The Family Business <ul><li>Tip stated that kickbacks were occurring with a certain company </li></ul><ul><li>We researched the company and determined which purchaser authorized the work </li></ul><ul><li>A contractor crew and company purchaser were family </li></ul>
  16. 16. Systematic Increases In Spending
  17. 17. Systematic Increases In Spending
  18. 18. Unexpected Peaks In Spending
  19. 19. Increases In Only Part Of A Trend
  20. 20. Caught by his Pool…
  21. 21. Research Background
  22. 22. Accounting History <ul><li>1940 SEC Statement: “Accountants can be expected to detect gross overstatements of assets and profits whether resulting from collusive fraud or otherwise” (Accounting Series Release 1940) </li></ul><ul><li>1961: “If the ten (auditing) standards now accepted were satisfactory for their purpose we would not have the pleas for guidance on the extent of (auditors’) responsibility for the detection of irregularities we now find in our professional literature.” (Mautz & Sharaf 1961) </li></ul><ul><li>1997 - SAS 82 </li></ul><ul><li>2002 - SAS 99 </li></ul>Expectation Gap
  23. 23. Historical Fraud Research <ul><li>Excellent literature review by Nieschwietz, Shultz, & Zimbelman (2000) </li></ul><ul><ul><li>Who commits fraud </li></ul></ul><ul><ul><li>Red flags </li></ul></ul><ul><ul><li>Expectation gap </li></ul></ul><ul><ul><li>Auditor expectations </li></ul></ul><ul><ul><li>Game theory between auditors and management </li></ul></ul><ul><ul><li>Auditor-client relationships </li></ul></ul><ul><ul><li>Risk assessment, decision aids </li></ul></ul><ul><ul><li>Management factors affecting fraud </li></ul></ul>
  24. 24. FS Fraud using Ratio Analysis <ul><li>Hansen, et. al (1996) developed a generalized qualitative-response model from internal sources </li></ul><ul><li>Green and Choi (1997) used neural networks to classify fraudulent cases </li></ul><ul><li>Summers and Sweeny (1998) identified FS fraud using external and internal information </li></ul><ul><li>Benish (1999) developed a probit model using ratios for fraud identification </li></ul><ul><li>Bell and Carcello (2000) developed a logistic regression model to identify fraud </li></ul><ul><li>Current work by McKee and by Cecchini and by Albrecht </li></ul><ul><li>None have found the “silver bullet” in using external information to identify fraud </li></ul><ul><ul><li>Management (FS) fraud is very difficult to find </li></ul></ul>
  25. 25. What are the Big 4 Doing? <ul><li>Each firm seems to have different groups working on fraud detection </li></ul><ul><ul><li>No best practices model has emerged </li></ul></ul><ul><li>IT auditors perform control testing on company systems, not fraud detection </li></ul><ul><li>Meeting with Bill Titera of EY </li></ul>
  26. 26. Why Don’t “They” Find Fraud? <ul><li>Limited time </li></ul><ul><ul><li>Our most precious resource is our attention </li></ul></ul><ul><li>History </li></ul><ul><ul><li>Heavy use of sampling - lack of detail </li></ul></ul><ul><ul><li>Lack of historical fraud detection instruction </li></ul></ul><ul><li>Lack of fraud symptom expertise </li></ul><ul><li>Lack of fraud-specific tools </li></ul><ul><li>Lack of analysis skills </li></ul><ul><li>Lack of expertise in technology </li></ul><ul><li>Auditors do find 20-30 percent of fraud </li></ul><ul><ul><ul><ul><ul><li>ACFE 2004 Report to the Nation </li></ul></ul></ul></ul></ul>
  27. 27. Isn’t there a better way? Reasonable time requirements Within reach of most auditors (highly technical skills not required) Cost effective Integrate easily into different database schemas Integrate AI and auto-detection
  28. 28. Initial Thoughts <ul><li>A small “manual” about frauds </li></ul><ul><ul><li>Cliff notes about different types of fraud </li></ul></ul><ul><ul><li>Describes the scheme </li></ul></ul><ul><ul><li>Describes the indicators of the scheme </li></ul></ul><ul><li>Worldwide repository wth contributions from many different industries </li></ul><ul><li>Primary focus was training </li></ul>
  29. 29. Detectlets <ul><li>A detectlet encodes: </li></ul><ul><ul><li>Background information on a scheme </li></ul></ul><ul><ul><li>Detail on a specific indicator of the scheme </li></ul></ul><ul><ul><li>Wizard interface to walk the user through input selection </li></ul></ul><ul><ul><li>Algorithm coded in standard format </li></ul></ul><ul><ul><li>“ How to interpret results” follow-up </li></ul></ul><ul><li>Input is one or more table objects </li></ul><ul><li>Output is one or more table objects </li></ul>
  30. 30. Detectlet Demonstration <ul><li>Bid rigging where one person prepares all bids </li></ul>
  31. 31. Potential Supporting Platforms <ul><li>MS Access </li></ul><ul><li>ACL or IDEA </li></ul><ul><li>Build ground up application </li></ul><ul><ul><li>Allows total control over platform </li></ul></ul><ul><ul><li>Stays with open source rather than tying the program to a particular platform </li></ul></ul><ul><ul><ul><li>For example, consider PowerBuilder </li></ul></ul></ul><ul><ul><li>Supports Windows, Unix, Linux, Mac </li></ul></ul><ul><ul><li>Allows embedded use within a greater platform </li></ul></ul><ul><ul><li>Personal preference was Python </li></ul></ul>
  32. 32. Picalo: The Supporting Platform
  33. 33. Central Detectlet Repository
  34. 34. How Detectlets Address the Problem <ul><li>Limited Time : Detectlets provide a wizard interface for quick execution; they can be chained and automated into a larger system </li></ul><ul><li>High Cost : Detectlets are based in open source software, putting them within reach of small and large accounting firms; they also create a community environment for fraud detection </li></ul>
  35. 35. How Detectlets Address the Problem <ul><li>Lack of fraud symptom expertise : Detectlets provide a large library of available routines to both train and walk auditors through the detection process </li></ul><ul><li>Lack of fraud-specific tools : Picalo provides an open solution that we can improve over time; it puts a fraud-specific toolkit in the hands of auditors </li></ul>
  36. 36. How Detectlets Address the Problem <ul><li>Lack of analysis skills : Detectlets encode full algorithms and code, allowing the auditor to stay at the conceptual level rather than the implementation level </li></ul><ul><li>Lack of expertise in technology : Detectlets provide a wizard-based solution that are easy to use; Picalo provides an Excel-like user interface </li></ul>
  37. 37. Picalo Level 1 API
  38. 38. Data Structures <ul><li>The Table object is the basic data structure. Nearly all routines both input and return tables, allowing them to be chained. Its methods include sorting, column operations, row operations, import/export from delimited text and Excel formats. </li></ul><ul><li>Column types include Boolean, Integer, Floating Point, Date, DateTime, String, etc. </li></ul>
  39. 39. Simple Module <ul><li>Provides joining, matching, fuzzy matching, and selection. </li></ul><ul><li>col_join, col_left_join, col_right_join, col_match, col_match_same, col_match_diff, compare_records, custom_match, custom_match_same, custom_match_diff, describe, expression_match, find_duplicates, find_gaps, fuzzysearch, fuzzymatch, fuzzycoljoin, get_unordered, join, left_join, right_join, select, select_by_value, select_outliers, select_outliers_z, select_nonoutliers, select_nonoutliers_z, select_records, soundex, soundexcol , sort, etc. </li></ul>
  40. 40. Benfords Module <ul><li>calc_benford : Calculates probability for a single digit </li></ul><ul><li>get_expected : Calculates probability for a full number </li></ul><ul><li>analyze : Analyzes an entire data set and calculates summarized results </li></ul>
  41. 41. Crosstable Module <ul><li>pivot : Similar to Excel’s pivot table function </li></ul><ul><li>pivot_table : Pivots and keeps detail in each cell </li></ul><ul><li>pivot_map : Pivots and keeps results in a dictionary rather than a grid </li></ul><ul><li>pivot_map_detail : Pivots and keeps results in a very detailed fashion using a dictionary </li></ul>
  42. 42. Database Module <ul><li>OdbcConnection : Connects to any ODBC-compliant database </li></ul><ul><li>PostgreSQLConnection : Connects to PostgreSQL </li></ul><ul><li>MySQLConnection : Connects to MySQL </li></ul><ul><li>Also includes various query helper functions, such as query creation, results analysis, etc. </li></ul>
  43. 43. Financial Module <ul><li>Calculates various financial ratios to help in financial statement analysis: </li></ul><ul><li>Current ratio </li></ul><ul><li>Quick ratio </li></ul><ul><li>Net working capital </li></ul><ul><li>Return on assets </li></ul><ul><li>Return on equity </li></ul><ul><li>Return on common equity </li></ul><ul><li>Profit margin </li></ul><ul><li>Earnings per share </li></ul><ul><li>Asset turnover </li></ul><ul><li>Inventory turnover </li></ul><ul><li>Debt to equity </li></ul><ul><li>Price earnings </li></ul>
  44. 44. Grouping Module <ul><li>Stratification gives the details behind SQL GROUP BY. It keeps the detail tables rather than summarizing them. </li></ul><ul><li>stratify : Stratifies a table into N number of tables </li></ul><ul><li>stratify_by_expression : Stratifies a table using an arbitrary expression </li></ul><ul><li>stratify_by_value : Stratifies on unique values </li></ul><ul><li>stratify_by_step : Stratifies based on a set numerical range </li></ul><ul><li>stratify_by_date : Stratifies based on a date range </li></ul><ul><li>Summarizing is similar to SQL GROUP BY, but it allows any type of function to be used for summarization (GROUP BY generally only allows sum, stdev, mean, etc.) This can by done in the same ways as stratification. </li></ul>
  45. 45. Trending Module <ul><li>Various ways of analyzing trends and patterns over time. </li></ul><ul><li>cusum, highlow_slope, average_slope, regression, handshake_slope </li></ul>
  46. 46. Python Libraries <ul><li>Powerful yet easy language with a significant online community </li></ul><ul><li>Full object-oriented support (classes, inheritance, etc.) </li></ul><ul><li>Text maniuplation and analysis routines </li></ul><ul><li>Web site spidering routines </li></ul><ul><li>Email analysis routines </li></ul><ul><li>Random number generation </li></ul><ul><li>Connection to nearly all databases </li></ul><ul><li>Web site development and maintenance </li></ul><ul><li>Countless libraries available online (almost all are open source) </li></ul>
  47. 47. Research Directions
  48. 48. Level 1 Research <ul><li>Foundation routines for fraud detection </li></ul><ul><ul><li>Development, testing, empirical use, field studies </li></ul></ul><ul><li>Connections to production software </li></ul><ul><ul><li>Standard SAP, Oracle, Peoplesoft, JD Edwards, etc. modules </li></ul></ul><ul><li>Application of CS, statistics, other techniques to fraud detection </li></ul><ul><ul><li>Time series analysis </li></ul></ul><ul><ul><li>Pattern recognition for fraud detection </li></ul></ul>
  49. 49. Level 2 Research <ul><li>Studies about detectlet presentation, user interface </li></ul><ul><li>Creation and testing of detectlets for industries, data schemas, etc. </li></ul><ul><li>Detectlets for financial statement fraud detection </li></ul><ul><li>Testing of detectlet vs. traditional ACL-type fraud detection </li></ul><ul><li>Patterns of detectlet development, best practices </li></ul>
  50. 50. Level 3 Research <ul><li>Automatic mapping of field schemas to a common schema </li></ul><ul><li>Application of expert system, learning models for automatic detection </li></ul><ul><ul><li>Decision trees </li></ul></ul><ul><ul><li>Classification models </li></ul></ul><ul><li>Meta-detectlets to combine various Level 2 detectlets into higher-level logic </li></ul>
  51. 51. Other Research <ul><li>Group-oriented processes for the central repository </li></ul><ul><ul><li>Searching, categorization </li></ul></ul><ul><ul><li>Testing, rating systems </li></ul></ul><ul><li>Marketplaces for detectlets </li></ul><ul><li>Development of Picalo itself </li></ul>
  52. 52. My Hope <ul><li>In 5 years we’ll have a large repository of detectlets to: </li></ul><ul><ul><li>Support both external and internal auditors </li></ul></ul><ul><ul><li>Teach students in fraud classes </li></ul></ul><ul><ul><li>Conduct theoretical and empirical research </li></ul></ul>