Quick Response Fraud Detection

6/18/2014
1
Copyright © FraudResourceNet LLC
Quick Response Fraud Detection using Data Analytics:
Hitting the Ground Running using Technology in a
Suspected Fraud Case
June 18, 2014
Special Guest Presenter:
Rich Lanza
President and Founder of White Collar Crime 101
 Publisher of White-Collar Crime Fighter
 Developer of FraudAware® Anti-Fraud Training
 Monthly Columnist, The Fraud Examiner, ACFE
Newsletter
Member of Editorial Advisory Board, ACFE
Author of “Fraud in the Markets”
• Explains how fraud fueled the financial crisis.
About Peter Goldmann, MSc., CFE

6/18/2014
2
About Jim Kaplan, MSc, CIA, CFE
• President and Founder of
AuditNet®, the global resource for
auditors (now available on Apple
and Android devices)
• Auditor, Web Site Guru,
• Internet for Auditors Pioneer
• Recipient of the IIA’s 2007
Bradford Cadmus Memorial
Award.
• Author of “The Auditor’s Guide to
Internet Resources” 2nd Edition
Richard B. Lanza, CPA, CFE, CGMA
• Over two decades of ACL and Excel software usage
• Wrote the first practical ACL publication on how to
use the product in 101 ways (101 ACL
Applications)
• Has written and spoken on the use of audit data
analytics for over 15 years.
• Received the Outstanding Achievement in Business
Award by the Association of Certified Fraud
Examiners for developing the publication
Proactively Detecting Fraud Using Computer Audit
Reports as a research project for the IIA
• Recently was a contributing author of:
• Global Technology Audit Guide (GTAG #13) Fraud
in an Automated World - IIA
• Data Analytics – A Practical Approach - research
whitepaper for the Information System
Accountability Control Association.
• “Cost Recovery – Turning Your Accounts Payable
Department into a Profit Center” – Wiley & Sons.
Please see full bio at www.richlanza.com

6/18/2014
3
The CPE certificates and link to the
recording will be sent to the email
address you registered with in GTW.
We are not responsible for delivery
problems due to spam filters,
attachment restrictions or other
controls in place for your email client.
Submit questions via the chat box on
your screen and we will answer them
either during or at the conclusion.
After the Webinar is over you will have
an opportunity to provide feedback.
Please complete the feedback
questionnaire to help us continuously
improve our Webinars
If GTW stops working you may need to
close and restart. You can always dial
in and listen and follow along with the
handout.
This webinar and its material are the
property of FraudResourceNet LLC.
Unauthorized usage or recording of
this webinar or any of its material is
strictly forbidden. We are recording the
webinar and you will be provided with a
link access to that recording as
detailed below. Downloading or
otherwise duplicating the webinar
recording is expressly prohibited.
Webinar recording link will be sent via
email within 5-7 business days.
NASBA rules require us to ask polling
questions during the Webinar and CPE
certificates will be sent via email to
those who answer ALL the polling
questions
Webinar Housekeeping
The views expressed by the presenters do not necessarily represent the views,
positions, or opinions of FraudResourceNet LLC (FRN) or the presenters’
respective organizations. These materials, and the oral presentation
accompanying them, are for educational purposes only and do not constitute
accounting or legal advice or create an accountant‐client relationship.
While FRN makes every effort to ensure information is accurate and complete,
FRN makes no representations, guarantees, or warranties as to the accuracy or
completeness of the information provided via this presentation. FRN
specifically disclaims all liability for any claims or damages that may result from
the information contained in this presentation, including any websites
maintained by third parties and linked to the FRN website
Any mention of commercial products is for information only; it does not imply
recommendation or endorsement by FraudResourceNet LLC
6
Disclaimers

6/18/2014
4
Today’s Agenda
 Which data files should be requested in the area of concern or
what should the data request look like when there is no specific
area of concern.
 Using a fast-track process to validating data and understanding
statistical norms for benchmarking purposes. Statistical
techniques to be utilized include: standard deviation, a unique
method of combining Benford’s Law and other digital analysis
techniques, time/size stratifications, and value/volume difference
scattergraphs.
 How the general ledger can provide a digital road map for analytics
for fraud (and errors) within the organization.
 How to quickly gather report ideas and techniques for analysis, as
well as, obtain a list of some of the top fraud tests by process area.
(continued)
Today’s Agenda (continued)
 How to combine your reports for maximum impact and
understanding this concept within a specific review of accounts
payable. Additional report techniques that can be applied to
expected data files include user transaction analysis, data file
change reviews, and external data mapping.
 Understand a provided Excel macro tool (free as part of the
course) that will quickly map an entire hard drive in minutes.
Various applications of this tool will be presented.
 Your Questions
 Conclusion

6/18/2014
5
Most Popular Products
 Microsoft Excel
 ActiveData for Excel
 TopCaats
 Microsoft Access
 ACL
 IDEA
 WizRule, WizWhy, & WizSame
(WizSoft products)
Tool Selection
Considerations
 Core processing features
 Advanced features
 Advanced data import
 Scripting
 Ease of use
 Training / Customer Support / User Groups
 Years in business / Company sustainability
 Workpaper system integration

6/18/2014
6
Proposal Decision Analysis
Page 11
http://www.caseware.com/products/idea#_research_reports
Detection Methods
By Company Size

6/18/2014
7
Asset Misappropriation
Tops The Charts
Vendor Billing Fraud/Corruption
Is #1 or #2 No Matter Where You Go

6/18/2014
8
Fraud Is It Really Hard
To Find
Ask a CPA firm to FIND FRAUD AT YOUR
COMPANY – A Fraud Audit to Find the 6% of
Revenues Lost to Fraud – Will that be cheap or
REALLY expensive?
How many people find or research a committed
fraud provided to you daily, weekly, monthly,
quarterly, annually?
What if technology could find it for you quarterly
and we or someone else could tell you exactly how
to find it?….but it’s there (on average) at
companies…..
 If this were true, why are we not all running back to
our desks now!?
 Caveat ‐ Probably will take a few hundred hours at
minimum to research the data and present findings
unless they are “right on top”
Have to Start Somewhere
Report Mapping

6/18/2014
9
Mapping Data to Scripts
Map Your Reports to Your
Data Needs
Clear Data Request
Accounts Payable Data Request.doc

6/18/2014
10
Sample Data Validation – Accounts
Payable Other Questions
Polling Question 1
What comes first in the analytic process?
A. Get data
B. Run reports
C. Identify reports to run
D. Deliver reports to client

6/18/2014
11
The Overall Fraud
Analytic Process
Get the Most Useful Data for Analysis
General Ledger / Accounts Payable
Other? / Use external data sources
Develop Fraud Query Viewpoints
The 5 Dimensions
Brainstorm report ideas
Analytically Trend
Benford’s Law
Statistical averages and simple trending by day, month, day of week
Post dated changes
Transactional Score Based On the Above
Is Your Organization Working
With Banned Companies?
EPLS is the excluded party list service of the U.S. Government as
maintained by the GSA
WWW.SAM.GOV

6/18/2014
12
Is Your Organization
Working With Terrorists?
Are Your Vendors Real?
IRS TIN Matching Program
Validates U.S. Tax
Identification Numbers
Can submit up to 100,000
TIN submissions at a time
Make sure all punctuation is
removed
See
http://www.irs.gov/taxpro
s/ and enter “TIN matching
program” in the search box

6/18/2014
13
SSN – Death File
The Overall Fraud
Analytic Process
Get the Most Useful Data for Analysis
General Ledger / Accounts Payable
Other? / Use external data sources
Develop Fraud Query Viewpoints
The 5 Dimensions
Brainstorm report ideas
Analytically Trend
Benford’s Law
Statistical averages and simple trending by day, month, day of week
Post dated changes
Transactional Score Based On the Above

6/18/2014
14
Query Viewpoints
Specific Tests Based
on the 5 W’sWho
Summarize journal entries by the persons entering to determine if they’re
authorized.
What
 Summarize journal entries by account and repetitive extracts (more than 50
instances) and unique account sequences used in the journal entry (based on
the first five debit and credit postings).
 Extract nonstandard or manual journal entries (versus a created system such as
an accounts payable ledger posting) for further analysis.
 Stratify size of journal entries based on amount (using the debit side of the
transaction).
 Summarize general ledger activity on the amount field (absolute value of debit
or credit) to identify the top occurring amounts. Then summarize activity by
account and the amount identified for the top 25 appearing amounts.
 Scatter‐graph general ledger account (debit and credit amounts separately)
and numbers of transactions.

6/18/2014
15
When
 Extract journal entries posted on weekends and holidays.
 Extract journal entries relating to the prior year that were made just
immediately following a fiscal‐year end.
 Summarize journal entry credits and debits processing by day, month, and
year.
Where
 Extract journal entries made to suspense accounts and summarize by the
person entering and corresponding account numbers.
 Extract journal entries to general ledger accounts known to be problems or
complex based on past issues (errors of accounting in journal subsequently
corrected by accounting staff or auditors) at the company or the industry in
general.
 Extract debits in revenue and summarize by general ledger account.
Summarize journal entries by the persons entering to determine if they’re authorized.
on the 5 W’s (Continued)
Why
 Extract general ledger transaction amounts (debit or credit) that
exceed the average amounts for that general ledger account by a
specified percentage. (Five times the average is the default.)
 Extract journal entries that equate to round multiples of 10,000,
100,000, and 1,000,000.
 Extract journal entries with key texts such as “plug” and “net to zero”
anywhere in the record.
 Extract journal entries that are made below set accounting
department approval limits especially multiple entries of amounts
below such limits.
 Extract journal entries that don’t net to zero (debits less credits).
on the 5 W’s (Continued)

6/18/2014
16
Report Brainstorm Tool
Proactively Detecting Fraud
Using Computer Audit Reports
IIA Research Paper / CPE Course
See the IIA’s website at www.theiia.org
The purpose of this document is to assist
auditors, fraud examiners, and management in
implementing data analysis routines for
improved fraud prevention and detection.
A comprehensive checklist of data analysis
reports that are associated with each
occupational fraud category per the
Association of Certified Fraud Examiner’s
classification system.

6/18/2014
17
Payroll Fraud Report Ideas
Top Reports in Payroll
 Duplicate employee payments
 Payments to the same bank account
and a different employee number
 Overtime trending by department and
person (% of overtime to gross pay,
average overtime by department)
 Match employee data from the human
resource to the payroll system
 Look for inaccurate or incomplete
employee data

6/18/2014
18
Other T&E Reports
 Unmatched query of cardholders to an active employee
masterfile
 Cards used in multiple states (more than 2) in the same day
 Cards processing in multiple currencies (more than 2) in the
same day
 Identify cards that have not had activity in the last six months
 Cardholders that have more than one card
 Extract any cash back credits processed through the card
 Extract declined card transactions and determine if they are
frequent for certain cards
 Summary of card usage by merchant to find newly added
merchants and most active
T&E ‐ It’s The Trends…Right?
 Trend categories (meals, hotel,
airfare, other)
 Trend by person and title
 Trend departments
 Trend vendors
 Trend in the type of receipts
 Trend under limits (company policy)
36

6/18/2014
19
Other Data Mining Ideas
Personnel Analysis
 Adjustments by employee
 Processing by employee
Contextual Summarizations
 Transaction types
Time Trending
 Month, week, and day / Also by department
 Last month to first 11 months
 Transactions at the end of and start of a fiscal year
Polling Question 2
What is not one of the query viewpoints?
A. Who
B. What
C. How
D. When

6/18/2014
20
Adding the Analysis
Toolpak Add‐In
Above Average / Standard
Deviation

6/18/2014
21
Stratify Data in Excel or with
ActiveData for ExcelTM
Use Excel Vlookup = TRUE
Use ActiveData for ExcelTM
How Fraud Grows Over Time
42

6/18/2014
22
Scatter Graph
Scatter Graph Explanation
1 – high dollar change and low count (outliers)
2 – charges that make sense
3 – changes that don’t make sense
4 – inefficiency that is developing

6/18/2014
23
Polling Question 3
Where do you find the Descriptive Statistics in
Excel?
A. Excel Option
B. Data Menu
C. Excel Add‐Ins
D. Insert Menu
Unique Journal Entry Test
Account Sequencing
The Sampson Index

6/18/2014
24
Normalize and test general ledger data consistently on all locations
 Most internal audit shops obtain general ledger data quarterly for their external
auditors anyway – no excuse
G/L data is the lifeblood of the organization
 It is the first data set with enough detail to effectively comb through
 Planning will improve as focus can be placed on key accounts, entries, timeframes,
enterers, etc. and will guide future data extracts
 Most systems post in detail (even down to inventory movements) which can allow
detailed review of subledgers….using G/L data
Identify savings, better ideas,…and fraud
 Fraud has been the focus and we should still test for it
 Savings in cost recoveries can now become more of a focus
 Better ideas leveraged through technology
 Efficiency (to help a faster close)
 Revenue and business enhancement
Key Mantras of G/L
Analytic Auditing
Polling Question 4
What ActiveData for Excel function allows for
the development of the account sequence:
A.Summarize
B.Stratify
C.Merge
D.Top / Bottom Items

6/18/2014
25
Simple Fraud Vendor Scoring Analysis
– How It Started
 Vendors on report 1 vs. report 2 of duplicate payments.
 Duplicate transactions paid on different checks.
 Duplicate transactions with debit amounts in the vendor
account.
 Vendors with a high proportion of round dollar payments.
 Invoices that are exactly 10x, 100x or 1000x larger than
another invoice.
 Payments to any vendor that exceed the twelve month
average payments to that vendor by a specified percentage
(i.e., 200%) or 3x the standard deviation for that vendor.
 Vendors paid with a high proportion of manual checks.
49
The Sampling “Problem”
Bottom Line Numbers
 Modern tests (round numbers, duplicates, missing fields)
identify thousands of ‘suspicious’ transactions, usually about 1 in
5 of all transactions get a ‘red flag’
 Historically at least 0.02 – 0.03 % of all transactions have real
problems, such as a recoverable over‐payment
 So roughly 0.00025 / 0.2 = 0.00125 or 1 in 800 ‘red flags’ lead to a
real problem.
Imagine throwing a random dart at 800 balloons hoping to hit
the right one!!!

6/18/2014
26
Transactional Score
Benefits
The best sample items (to meet your attributes) are
selected based on the severity given to each attribute.
In other words, errors, as you define them, can be
mathematically calculated.
Instead of selecting samples from reports, transactions
that meet multiple report attributes are selected (kill
more birds with one stone). Therefore a 50 unit sample
can efficiently audit:
 38 duplicate payments
 22 round invoices
 18 in sequence invoices
….and they are the best given they are
mathematically the most “severe”.
51
Pick Items Rare in
Several Ways
 Don’t choose just ANY weekend invoice
 Choose an UNUSUAL weekend invoice
 Large weekend invoices are the rarest kind (i.e.,
only 2 percent of large invoices)
 The odds of finding a recoverable error go up
AND since the invoice is large, the value
recovered goes up too!

6/18/2014
27
Summaries on
Various Perspectives
53
Summarize by
dimensions (and sub
dimension) to pinpoint
within the cube the
crossover between the top
scored location, time, and
place of fraud based on
the combined judgmental
and statistical score
ALL TIES BACK TO THE
ORIGINAL ANALYTIC
APPROACH
Key Control Reports
& Scoring

6/18/2014
28
Combining the Scores
ACL Code
Using Vlookup to
Combine Scores
Create a record number
Relate sheets based on VLookup

6/18/2014
29
Charting the Score
Transactional Score
Benefit Patterns Example
58

6/18/2014
30
GeoMapping ‐ Map Point
Polling Question 5
What graph is used to map value to score for easier
selections of data subsets?
A. Pie
B. Line
C. Bar
D. Scatter

6/18/2014
31
Free Excel Directory Tool
 Collects all file information by folder
 Provides additional information on the
files
 Be careful – Can take 30 minutes to run
an entire harddrive
 Useful to identify files accessed recently
 Great for backups and cleanups of HDs
Questions?
Any Questions?
Don’t be Shy!

6/18/2014
32
Coming Up Next Month
1. Think Like a Fraudster to Catch a
Fraudster July 9, 2014, 1:00 PM
2. Secrets of Finding Fraudulent
Documentation, July 16, 11:00 AM
3. How to Build Fraud‐Focused Data
Analytics Into Your Audit & Risk
Assessment , July 23, 11:00 AM
The best information newsletter
on fraud and white collar crime is
now available for free!
Sign Up Now
Please share with your network!
WCC Fighter News ‐ Free

6/18/2014
33
AuditSoftwareVideos.com
Now Free!
Videos accessible for FREE subscriptions
Repeat video and text instruction as much as you need
Sample files, scripts, and macros in ACL™, Excel™, etc.
available for purchase
Bite-size video format (3 to 10 minutes)
>> Professionally produced videos by
instructors with over 20 years
experience in ACL™, Excel™ , and
more
Thank You!
Website: http://www.fraudresourcenet.com
Jim Kaplan
FraudResourceNet™
800‐385‐1625
jkaplan@fraudresourcenet.com
Peter Goldmann
FraudResourceNet™
800‐440‐2261
pgoldmann@fraudresourcenet.com
Rich Lanza
Cash Recovery Partners, LLC
Phone: 973‐729‐3944
rich@richlanza.com

Quick Response Fraud Detection

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (18)

Similar to Quick Response Fraud Detection

Similar to Quick Response Fraud Detection (20)

More from FraudBusters

More from FraudBusters (18)

Recently uploaded

Recently uploaded (20)

Quick Response Fraud Detection