Since the spread of IT systems has made it a pre-requisite that auditors as well as management have the ability to examine high volumes of data and transaction in order to determine patterns and trends. In addition, the increasing need to continuously monitor and audit IT systems has created an imperative for the effective use of appropriate data mining tools. While a variety of powerful tools are readily available today, the skills required to utilize such tools are not. Not only must the correct testing techniques be selected but the effective interpretation of outcomes presented by the software is essential in the drawing of appropriate conclusions based on the data analysis. This 6 webinar series, based on Richard Cascarino’s book “Data Analytics for Internal Auditors” covers these skills and techniques. Webinar 3 Analytics Techniques Conducting the Audit Obtaining Information from IT Systems for Analysis Use of Computer Assisted Audit Techniques Analysis of Big Data Results Analysis and Validation Fraud Detection using Data Analysis Root Cause Analysis

1. 3/27/2019
1
Data Analytics - 3
Analytics Techniques
based on Data Analytics for
Internal Auditors
by Richard Cascarino
About Jim Kaplan, CIA, CFE
 President and Founder of AuditNet®,
the global resource for auditors (now
available on iOS, Android and
Windows devices)
 Auditor, Web Site Guru,
 Internet for Auditors Pioneer
 Recipient of the IIA’s 2007 Bradford
Cadmus Memorial Award.
 Author of “The Auditor’s Guide to
Internet Resources” 2nd Edition
Page 2
1
2

2. 3/27/2019
2
About AuditNet® LLC
• AuditNet®, the global resource for auditors, is available on the
Web, iPad, iPhone, Windows and Android devices and features:
• Over 3,000 Reusable Templates, Audit Programs,
Questionnaires, and Control Matrices
• Training without Travel Webinars focusing on fraud, data
analytics, IT audit, and internal audit
• Audit guides, manuals, and books on audit basics and using
audit technology
• LinkedIn Networking Groups
• Monthly Newsletters with Expert Guest Columnists
• Surveys on timely topics for internal auditors
• NASBA Approved CPE Sponsor
Introductions
Page 3
The views expressed by the presenters do not necessarily represent
the views, positions, or opinions of AuditNet® LLC. These materials,
and the oral presentation accompanying them, are for educational
purposes only and do not constitute accounting or legal advice or
create an accountant-client relationship.
While AuditNet® makes every effort to ensure information is
accurate and complete, AuditNet® makes no representations,
guarantees, or warranties as to the accuracy or completeness of the
information provided via this presentation. AuditNet® specifically
disclaims all liability for any claims or damages that may result from
the information contained in this presentation, including any
websites maintained by third parties and linked to the AuditNet®
website.
Any mention of commercial products is for information only; it does
not imply recommendation or endorsement by AuditNet® LLC
3
4

3. 3/27/2019
3
About Richard Cascarino, MBA,
CIA, CISM, CFE, CRMA
• Principal of Richard Cascarino &
Associates based in Colorado USA
• Over 28 years experience in IT audit
training and consultancy
• Past President of the Institute of
Internal Auditors in South Africa
• Member of ISACA
• Member of Association of Certified
Fraud Examiners
• Author of Data Analytics for Internal
Auditors
5
Today’s Agenda
 Analysis of Big Data
 Big Data Structures
 OLAP
 Statistical Analysis and Big Data
 Results Analysis and Validation
 Substantive Analytical Procedures
 Validation
 Questionnaire Analysis and Likert Scales
 Statistical Reliability Analysis
 Fraud Detection using Data Analysis
 Red Flags and Indicators
 Nature of Computer Fraud
 Seeking Fraud Evidence
 Planning the Fraud Analysis
 Common mistakes in Forensic Analysis
 Root Cause Analysis
Page 6
5
6

4. 3/27/2019
4
Apache Hadoop
 Hadoop Common - contains libraries and utilities
needed by other Hadoop modules
 Hadoop Distributed File System (HDFS) - a distributed
file-system that stores data on commodity machines,
providing very high aggregate bandwidth across the
cluster.
 Hadoop YARN - a resource-management platform
responsible for managing compute resources in clusters
and using them for scheduling of users' applications.
 Hadoop MapReduce - a programming model for large
scale data processing.
Hadoop Core Components
 Hadoop Distributed File System (HDFS)
 Massive redundant storage across a
commodity cluster
 MapReduce
 Map: distribute a computational problem
across a cluster
 Reduce: Master node collects the
answers to all the sub-problems and
combines them
 Many distros available
7
8

5. 3/27/2019
5
Hadoop & Databases
Deficiencies of Traditional
Approach
 Retrospective view
analysis frequently occurs long after transaction has
taken place, too late for action
 Lack of timely visibility into control risks and
deficiencies
 Alternatively
Independently test all transactions for compliance with
controls at, or soon after, point at which they occur
Not feasible with Big Data
9
10

6. 3/27/2019
6
Control Objectives
Haven’t Changed
 Accuracy
 Authorization
 Completeness
 Validity
 Efficiency and Effectiveness
 Segregation of Duties
 Regulatory Compliance
Continuous Auditing can
be used for
 Continuous control assessment
Identification of control deficiencies
Identification of fraud, waste, abuse
 Continuous risk assessment
Examination of consistency of processes
Development of enterprise audit plan
Support to individual audits
Follow-up on audit recommendations
11
12

7. 3/27/2019
7
Required to Audit /Examine
 Identify the control objectives for each business process
area
 Establish tests that, using transactional data analysis, will
validate the achievement of each control objective
 Establish tests that will identify suspect transactions, using
transactional profiling techniques
 Subject all transactions to a test bed of interrogations on a
regular, timely basis
 Identify all transactions that fail the metrics
 Notify the appropriate personnel
 Investigate any discrepancies and, as appropriate,
Correct the transactions
Correct the control problem
Required of Continuous
Auditing
 Able to access and normalize disparate data from across the
enterprise
 Offer comprehensive range of tests to effectively address
control objectives
 Provide flexibility of tests as control opportunities change
 Provide timely testing of data and reporting of results
 Handle large transactional volumes with no negative impact
on operational system performance
 Provide variable parameters for tests
 Provide for alert notifications
 Maintain security and integrity of tests and results
13
14

8. 3/27/2019
8
Challenges for the Auditor /
Examiner
 Obtaining appropriate data access
 Defining appropriate measurement metrics
 Setting appropriate thresholds for exceptions
reporting
 Developing appropriate metrics to prioritize
exceptions
 Minimizing impact on systems’ operational
performance
Where to Start
 Establish audit objectives and requirements
 Gain executive-level support
 Ascertain degree to which management is
performing monitoring role
 Select appropriate technology solutions
 Identify information sources and gain access
 Understand business processes and identify
key controls and risks
 Build audit skill set
 Manage and report results
15
16

9. 3/27/2019
9
Implement Repetitive Scripts
Timing
 Extensive front-end work required
 Monitoring of system changes
 Alarm based intervention
Defining the appropriate metrics
 Automated interim work
 Continuous confirmation
 Detailed testing only when exceptions noted
17
18

10. 3/27/2019
10
OLAP Conceptual Data Model
 Goal of OLAP is to support ad-hoc querying for the
business analyst
 Business analysts are familiar with spreadsheets
 Extend spreadsheet analysis model to work with
warehouse data
 Multidimensional view of data is the foundation of
OLAP
OLAP
Data Warehouse vs. Data Marts
20
CS 336
 Enterprise warehouse: collects all information about subjects
(customers,products,sales,assets, personnel) that span
the entire organization
Requires extensive business modeling (may take years to design and
build)
 Data Marts: Departmental subsets that focus on selected
subjects
Marketing data mart: customer, product, sales
Faster roll out, but complex integration in the long run
 Virtual warehouse: views over operational dbs
Materialize sel. summary views for efficient query processing
Easy to build but require excess capability on operat. db servers
19
20

11. 3/27/2019
11
 On-Line Transaction Processing (OLTP):
 technology used to perform updates on operational
or transactional systems (e.g., point of sale
systems)
 On-Line Analytical Processing (OLAP):
 technology used to perform complex analysis of
the data in a data warehouse
 OLAP is a category of software technology that enables
analysts, managers, and executives to gain insight into data
through fast, consistent, interactive access to a wide variety of
possible views of information that has been transformed from
raw data to reflect the dimensionality of the enterprise as
understood by the user. [source: OLAP Council:
www.olapcouncil.org]
OLTP vs. OLAP
OLTP vs. OLAP
 Clerk, IT Professional
 Day to day operations
 Application-oriented (E-R
based)
 Current, Isolated
 Detailed, Flat relational
 Structured, Repetitive
 Short, Simple transaction
 Read/write
 Index/hash on prim. Key
 Tens
 Thousands
 100 MB-GB
 Trans. throughput
 Knowledge worker
 Decision support
 Subject-oriented (Star,
snowflake)
 Historical, Consolidated
 Summarized, Multidimensional
 Ad hoc
 Complex query
 Read Mostly
 Lots of Scans
 Millions
 Hundreds
 100GB-TB
 Query throughput, response
User
Function
DB Design
Data
View
Usage
Unit of work
Access
Operations
# Records accessed
#Users
Db size
Metric
OLTP OLAP
Source: Datta, GT
21
22

12. 3/27/2019
12
Approaches to OLAP
Servers
 Multidimensional OLAP (MOLAP)
Array-based storage structures
Direct access to array data structures
Example: Essbase (Arbor)
 Relational OLAP (ROLAP)
Relational and Specialized Relational DBMS to store and
manage warehouse data
OLAP middleware to support missing pieces
Optimize for each DBMS backend
Aggregation Navigation Logic
Additional tools and services
Example: Microstrategy, MetaCube (Informix)
The Complete Decision Support
System
24
Information Sources Data Warehouse
Server
(Tier 1)
OLAP Servers
(Tier 2)
Clients
(Tier 3)
Operational
DB’s
Semistructured
Sources
extract
transform
load
refresh
etc.
Data Marts
Data
Warehouse
e.g., MOLAP
e.g., ROLAP
serve
Analysis
Query/Reporting
Data Mining
serve
serve
23
24

13. 3/27/2019
13
Tools: Warehouse Servers
 The RDBMS dominates:
Oracle 8i/9i
IBM DB2
Microsoft SQL Server
Informix (IBM)
Red Brick Warehouse (Informix/IBM)
NCR Teradata
Sybase…
Tools: OLAP Servers
 Support multidimensional OLAP queries
 Often characterized by how the underlying data stored
 Relational OLAP (ROLAP) Servers
Data stored in relational tables
Examples: Microstrategy Intelligence Server, MetaCube
(Informix/IBM)
 Multidimensional OLAP (MOLAP) Servers
Data stored in array-based structures
Examples: Hyperion Essbase, Fusion (Information Builders)
 Hybrid OLAP (HOLAP)
Examples: PowerPlay (Cognos), Brio, Microsoft Analysis
Services, Oracle Advanced Analytic Services
25
26

14. 3/27/2019
14
Statistical Analysis
 Big Data and Analytics is generally thought to be about:
Business Intelligence and Analytics
Computational Science
 But also includes:
Demographic Analysis
Geointelligence: Spatial Analysis
The Grand Challenges in Science
Medicine: Processing 3-D hyperspectral high resolution images for
diagnostics, genomic research, Proteonomics, etc.
Media Analysis: Processing text, audio, video, imagery
And much, much more …..
Advanced Analytics
 Go beyond data mining and statistical processing methods
encompass logic-based methods, qualitative analytics, and non-
statistical quantitative methods.
 Diverse set of techniques that require new software
architectures and application frameworks to solve complex
problems.
 New metrics focus on the contributions of the value of the
analysis as a holistic result are required to assess and
evaluate the outcomes of advanced analytics.
28
27
28

15. 3/27/2019
15
Types of Analytics
 Descriptive: A set of techniques for reviewing and examining the data
set(s) to understand the data and analyze business performance.
 Diagnostic: A set of techniques for determine what has happened and
why
 Predictive: A set of techniques that analyze current and historical data to
determine what is most likely to (not) happen
 Prescriptive: A set of techniques for computationally developing and
analyzing alternatives that can become courses of action – either tactical
or strategic – that may discover the unexpected
 Decisive: A set of techniques for visualizing information and
recommending courses of action to facilitate human decision-making when
presented with a set of alternatives.
30
Analytics and Assertions
Assertions
 Existence or Occurrence
 Completeness
 Rights & Obligations
 Valuation or Allocation
 Presentation & Disclosure
29
30

16. 3/27/2019
16
31
Substantive Tests
 Tests of details
Transactions
Balances
 Analytical tests
32
Analytical Procedures
 Evaluations of financial information made by
a study of plausible relationships among both
financial and nonfinancial data
SAS No. 56
31
32

17. 3/27/2019
17
33
Tests of Details VS. Analytical
Tests
 Comparisons
Tests of details tests all 5 assertions but
analytical procedures do not support existence or
rights & obligations
Analytical procedures are high level tests
Tests of details lead to conclusions about
aggregated data but analytical procedures test
aggregated data
GBW 8th ed., Ch. 6
Types of Analytical Procedures
 Trend analysis
 Ratio analysis
Activity ratios
Profitability ratios
Liquidity ratios
Solvency ratios
 Modeling
Statistical tests, i.e., regression
33
34

18. 3/27/2019
18
Data Validation
 Process by which the auditor verifies the
accuracy and completeness of information
obtained or derived prior to analysis
 Inconsistencies identified at this stage need
to be examined and, where appropriate,
corrected prior to the actual analysis taking
place
35
Validation may be done by
 Data Type Validation
 Format checking
 Length checking
 Existence checks
 Range checks
 Cross-reference verification
 Referential integrity validation
 Check digit validation
 Data Cardinality
 Hash checking
 Data field uniqueness validation
36
35
36

19. 3/27/2019
19
Questionnaire Analysis and
Likert Scales
37
Likert
 commonly associated with interval data
The difference between +2 and +1 is the same
as the difference between +1 and 0)
 Although the response levels have relative
position they are not interval scales and cannot
be treated as such from a statistical standpoint
Average of Strongly Agree and Agree cannot be
said to be Agree and ½
38
37
38

20. 3/27/2019
20
Statistical Reliability
 Whether it produces identical results in
repeated applications
Stability
 Ensuring consistent results with repeated measurement on the same scale
Equivalence
 Determining how much error was introduced by different investigators or different
samples
Internal Consistency
 Considers the consistency or homogeneity among the items of an instrument
 External Validity measures the ability to be
generalised
39
Internal Validity
 Content or Face Validity
determines whether the measuring instrument provides
adequate coverage of the topic
 Criterion-related Validity
determines the success of the measures used for
empirical estimating purposes
 Construct Validity
both Convergent and Discriminant involve comparison to
previously assessed results
 Measured by: Cronbach’s alpha (or coefficient
alpha)
40
39
40

21. 3/27/2019
21
“Fraud and deceit abound in
these days more than in
former times”.
SIR EDWARD COKE Twyne's Case (1602)
Occupational Fraud and Abuse
Asset
Misappropriations
Corruption
Fraudulent
Statements
Conflicts
of Interest
Bribery
Illegal
Gratuities
Economic
Extortion
Inventory &
All Other Assets
Cash
Nonfinancial
Financial
41
42

22. 3/27/2019
22
Jargon
Skimming: Taking funds before they are recorded into company records
Cash Larceny: Taking funds (e.g., check) that company recorded as going
to another party
Lapping: Theft is covered with another person’s check (and so on)
Check Tampering: Forged or altered check for gain
Shell Company: Payments made to fake company
Payroll Manipulation: Ghost employees, falsified hours, understated
leave/vacation time
Fraudulent Write-off: Useful assets written off as junk
Collusion: Two or more employees or employee & vendor defraud together
False Shipping Orders or Missing/Defective Receiving Record: Inventory
theft
43
Nature of Computer Fraud
Trojan Horse / Logic Bombs / Trap Doors
Use of Unauthorized Coding
Salami Techniques
A small amount from everyone
Viruses
Mainframe as well as Micro
Sabotage and Industrial Espionage
Degrading Systems Performance
Leaking Confidential Information
Management Fraud
Cooked Books
44
43
44

23. 3/27/2019
23
Fraud Example
45
Dummy 1 Dummy 5Dummy 2 Dummy 3 Dummy 4
Customer
Account
Aus UK Switz HK USA
Timescale
 Over 15 years
 Discovered by accident
 +/- $ 300m
 Multiple Country
 Multiple Banks
 Using a variety of IT
46
45
46

24. 3/27/2019
24
From Excel
47
And Also
48
47
48

25. 3/27/2019
25
Into IDEA
49
And More
50
49
50

26. 3/27/2019
26
Detection
 Commonly detected by
Operating performance anomalies.
 Organisational Structure.
 Management characteristics.
 Accounting anomalies.
 Internal control weaknesses.
 Analytical anomalies.
 Unusual behaviour.
51
Methodology
 Pre-incident Preparation
 Detection of incidents
 Initial response
 Response strategy formulation
 Forensic Backups
 Investigation
 Security restoration implementation
 Network monitoring
 Recovery
 Reporting
 Follow-up
52
51
52

27. 3/27/2019
27
IT Forensic Jargon
Evidence media
 The original media to be investigated
Target media
 the media duplicated onto
Restored image
 copy of the forensic image restored to its original bootable form
Native operating system
 the OS used on the restored image
Live analysis
 analysis conducted on the actual evidence media
Offline analysis
 analysis conducted using the target media or restored image
53
Forensic Analysis
 Physical Analysis
String search DOS-based StringSearch - http://www.maresware.com
Search and extract
eg $4A $46 $49 $46 $00 $01 is start of a JPEG file
http://www.wotsit.org
File slack and free space extraction
http://www.nti.com
 Logical Analysis
Logical File space
Slack space
Unallocated space
54
53
54

28. 3/27/2019
28
Computer Evidence...
...is like any other evidence, it must be:
 admissible
 authentic
 accurate
 complete
 convincing to juries
Computer Evidence...
authentic
 can we explicitly link files, data to specific
individuals and events?
access control
logging, audit logs
collateral evidence
crypto-based authentication
55
56

29. 3/27/2019
29
Computer Evidence...
accurate
 reliability of computer process not data content
 can we explain how an exhibit came into being?
what does the computer system do?
what are its inputs?
what are the internal processes?
what are the controls?
58
Authentication
 Must offer evidence “sufficient to support a finding that the [computer
record or other evidence] in question is what its proponent claims.”
 Degree of authentication does not vary simply because a record
happens to be (or has been at one point) in electronic form
 Challenges to authenticity
 Were the records altered, manipulated or damaged after they were
created?
 Courts are skeptical of unsupported claims or alteration
 Reliability of the computer program that generated the records
 Program routinely relied upon in the normal course of business
 Identity of the author of the records
 Corroborate with circumstantial evidence
57
58

30. 3/27/2019
30
59
Hearsay Problems
 Computer records may or may not be “hearsay
evidence”
Contents of records with assertions attributed to a third
party and presented as evidence may be considered
hearsay
Documents written by a person and produced by the computer
Computer generated records where humans were not
involved in any way (i.e., internally generated by the
computer) are not hearsay
Logs
The Business Records Rule
 “Records of regularly conducted activity. A memorandum, report,
record, or data compilation, in any form, of acts, events, conditions,
opinions, or diagnoses, made at or near the time by, or from
information transmitted by, a person with knowledge, if kept in the
course of a regularly conducted business activity, and if it was the
regular practice of that business activity to make the memorandum,
report, record, or data compilation, all as shown by the testimony of
the custodian or other qualified witness, or by certification that
complies with Rule 902(11),Rule 902(12), or a statute permitting
certification, unless the source of information or the method or
circumstances of preparation indicate lack of trustworthiness.”
 -- Fed. R. Evid. 803(6)
60
59
60

31. 3/27/2019
31
Common Mistakes
 Ensure that proper documentation is maintained of
all processes carried out in the execution of the
analysis
 Failing to control the digital
 Altering date and time stamps on evidence systems
before recording them
 Using un-trusted commands and tools
 Accidentally overwriting evidence when installing
audit interrogation tools
 Termination of rogue processes prematurely
61
“It’s just a non-transaction.
It’s an error. It’s a back office
glitch. Don’t worry about it!”
JAMES BAX (BARINGS BANK)
61
62

32. 3/27/2019
32
Root Cause Analysis
 The fishbone diagram (Ishikawa Diagram)
63
Root Cause Analysis
 Process mapping
each step of a process is mapped out so that problem
areas/bottlenecks in the process can be identified and improved.
 The five why’s
asking the question why something has happened five times – each
times drilling down further to get to the root cause of the problem.
 Tree diagrams
in which the auditor will state the problem with causes listed as
branches to the right of the problem. Causes continue to be clarified
drawing additional branches to the right until each branch reaches its
logical end.
64
63
64

33. 3/27/2019
33
Root Cause Analysis
 Event and causal factor analysis
An extended version of the Ishikawa diagram
used for multifaceted problems or for the analysis of long and
complex causal factor chains
 Pareto analysis
named after the Italian economist Vilfredo Pareto (1907)
described the unequal wealth of the country in terms that 20% of
the population owned 80% of the resources
 Change analysis
used when a problem is obscure, typically a single occurrence, and
focuses on those items in the environment which have changed since
the non-problematic state
65
Questions?
Any Questions?
Don’t be Shy!
65
66

34. 3/27/2019
34
AuditNet® and cRisk Academy
If you would like
forever access to this
webinar recording
If you are watching
the recording, and
would like to obtain
CPE credit for this
webinar
Previous AuditNet®
webinars are also
available on-demand
for CPE credit
http://criskacademy.com
http://ondemand.criskacade
my.com
Use coupon code: 50OFF
for a discount on this
webinar for one week
Thank You!
Jim Kaplan
AuditNet® LLC
1-800-385-1625
Email:info@auditnet.org
www.auditnet.org
Follow Me on Twitter for Special Offers - @auditnet
Join my LinkedIn Group –
https://www.linkedin.com/groups/44252/
Like my Facebook business page
https://www.facebook.com/pg/AuditNetLLC
Richard Cascarino & Associates
Cell: +1 970 819 7963
Tel +1 303 747 6087 (Skype Worldwide)
Tel: +1 970 367 5429
eMail: rcasc@rcascarino.com
Web: http://www.rcascarino.com
Skype: Richard.Cascarino
Page 68
67
68