This document summarizes a presentation on using data analytics for compliance, due diligence, and investigations. The presentation features four speakers: Raul Saccani of Deloitte, Dave Stewart of SAS Institute, John Walsh of SightSpan, and John Walsh of SAS Institute. It discusses challenges related to big data including volume, variety, and velocity of data. It provides examples of how financial institutions have used analytics for anti-money laundering model tuning and illicit network analysis. It also outlines the analytics lifecycle and considerations for adopting a proactive analytics strategy.

1. Making Big Data Your Ally
Using data analytics to improve
compliance, due diligence and
investigations
Thursday, February 6, 2014 | 3:00 - 4:00 PM
Speakers:
Raul Saccani, Dave Stewart, John Walsh

2. John Walsh
CEO
SightSpan
Charlotte, NC

3. Dave Stewart
Director, Fraud and Financial Crimes Practice
SAS Institute
Cary, NC

4. Raul Saccani
Partner, Forensic and Dispute Services
Deloitte
Buenos Aires

5. John Walsh
CEO
SightSpan
Charlotte, NC

6. Dave Stewart
Director, Fraud and Financial Crimes Practice
SAS Institute
Cary, NC

7. The Challenge
THRIVING IN THE BIG DATA ERA
VOLUME
DATA SIZE
VARIETY
VELOCITY
VALUE
TODAY
THE FUTURE
Copyright © 2012, SAS Institute Inc. All rights reserved.

8. The Analytics Lifecycle
BUSINESS
MANAGER
Domain Expert
Makes Decisions
Evaluates Processes and ROI
EVALUATE /
MONITOR
RESULTS
IDENTIFY /
FORMULATE
PROBLEM
DATA
PREPARATION
DEPLOY
MODEL
IT SYSTEMS /
MANAGEMENT
Model Validation
Model Deployment
Data Preparation
DATA
SCIENTIST
Data Exploration
Data Visualization
Report Creation
DATA
EXPLORATION
ANALYST
DATA MINER
VALIDATE
MODEL
TRANSFORM
& SELECT
BUILD
MODEL
Exploratory Analysis
Descriptive Segmentation
Predictive Modeling

9. Case Studies
• Tier I Asian Bank
– Visual analytics of Group Security Operations
– Cross-border sharing of summary data
• Tier I Global Bank
– AML model tuning & optimization
– Large volume peer group analysis
• Tier I Global Bank
– “Safety Net” approach for controlling affiliate risk
– Ad hoc builds of illicit networks

10. Observations
• New capabilities require new thinking about business
as usual
• Variety of data & techniques requires new skills
within lines of business
• Adopt a pro-active/pre-emptive analytics strategy
• Understand your company’s technology roadmap
and get on board

11. Raul Saccani
Partner, Forensic and Dispute Services
Deloitte.
Buenos Aires

12. Raúl Saccani´s presentation contents
• Data privacy standards in Latin America,
compared to US and EU standards, and
• How data privacy rules, limitations on crossborder data sharing can impact compliance
functions and internal investigations
• Role of e-discovery in financial crime
investigations, including internal investigations
• Sources of data in internal investigations,
including structured and unstructured data

13. Privacy and Data Protection
1)
2)
3)
4)
The context
Data protection and electronic evidence
EU law on privacy and data protection
Practical considerations

14. (1) Context
Most personal information and most evidence are digital
Lawyers and judges need to know significance of digital
information
Need to know and understand the :
• nature of digital evidence
• data protection rules of the road
Otherwise no :
• remedy for the data subject
• fair trial for the accused
• convictions for the prosecutor

15. No. of countries with privacy laws
The growth of global privacy laws
Time Period

16. (2) Data Protection and
Electronic Evidence
•
•
•
•
Overlapping Scope
Data protection rules apply to the courts
Fruits of the Poisoned Tree
precautions to ensure admissibility of eevidence

17. (3) EU Law on Privacy:
two fundamental rights
(a) the Right to Privacy
ECHR (1950), Article 8
Everyone has the right to respect for
his or her private and family life, home
and correspondence
EU Charter (2000), Article 7 :
…and communications.

18. (b) the Right to
Protection of Personal Data
an autonomous fundamental right to selfdetermination in the Information Society
Article 16, EU Treaty
EU Charter, Article 8 :
1. Everyone has the right to the protection of
personal data concerning him or her.

19. 2. Such data must be processed fairly for
specified purposes and on the basis of the
consent of the person concerned or some
other legitimate basis laid down by law.
Everyone has the right of access to data
which has been collected concerning him or
her, and the right to have it rectified.
3. Compliance with these rules shall be subject
to control by an independent authority

20. Data Privacy
• What is a Data Controller?
– Person or entity who determines purpose and manner of
processing
– EU Directive imposes obligation to protect personal data
– Potential liability for failure to fulfill obligations
– Responsible for directing and controlling actions of Data
Processor
• What is a Data Processor?
– Processes data on behalf of and at the direction of Data
Controller
– Must follow instructions of Data Controller

21. Practical Considerations
• Now you are in a position to make the necessary cost-benefit
analysis. Ask yourself the following questions:
– What is the true value of this source of information
relative to (a) other more easily accessible sources of
information and (b) the litigation as a whole?
– What are the projected costs of complying with the EU
Data Protection Directive?
– What are the projected costs of defending a discovery
dispute?
– What are the relative strengths and weaknesses of each
side on discovery issues?

22. Outsourcing Personal Data Processing
Contractual means:
 All practicable security measures
 Timely return, destruction or deletion
of data
 Prohibition against any use or
disclosure for other purposes
 Prohibition against sub-contracting
 Right to audit and inspect

24. Forensic Technology
Identification
Preservation
Pre-processing
Processing
Review
* Forensic methodology
* Chain of custody
* Integrity
* Confidentiality

25. Forensic Technology
Identification
Preservation
(Pre-processing tasks)
Pre-processing
Processing
Review
* Integrity verification
* Formats conversion and standardization
* Chain of custody
* Additional copies

26. Forensic Technology
Identification
Preservation
Pre-processing
Processing
Review
(Obtain value from information without modifying it)
*Deleted documents or e-mails
*Information in hidden sectors or partitions
*Encrypted files
*Files with modified extensions
*Internet devices, MSN, Y!, social networks
*Applications audit trails / SO

27. Forensic Technology
Identification
Preservation
Pre-processing
Processing
Review
(Review platform)
*Do not modify evidence
*Eliminate duplicates
*Early Case Assessment (ECA)
*Keywords / tags
*Produce evidence
*Bates stamping
*Audit logs

28. The Change is Driving Big Data
Petabytes
Terabytes
Gigabytes
Megabytes
Data Complexity, Variety and Velocity

29. Big Data Is…
Big Data represents the
Trends, Technologies and
Potential for organizations
to obtain valuable insight
from large amounts of
Structured, Unstructured
and fast-moving data.
80%
Unstructured Data
Click Stream
Videos
Images
Text
Sensors

30. Where Does Big Data Come From?
• Our Data-driven World
– Science
• Data bases from astronomy, genomics,
environmental data, transportation data, …
– Humanities and Social Sciences
• Scanned books, historical documents, social
interactions data, new technology like GPS, …
– Business & Commerce
• Corporate sales, stock market transactions, census,
airline traffic, …
– Entertainment
• Internet images, Hollywood movies, MP3 files, …
– Medicine
• MRI & CT scans, patient records, …

31. Structured vs unstructured data
• Structured data : information in “tables”
Employee
Manager
Salary
Smith
Jones
50000
Chang
Smith
60000
Ivy
Smith
50000
Typically allows numerical range and exact match
(for text) queries, e.g.,
Salary < 60000 AND Manager = Smith.

32. Unstructured data
• Typically refers to free text
• Allows
– Keyword-based queries including operators
– More sophisticated “concept” queries, e.g.,
• find all web pages dealing with drug abuse

33. Forensic Data Analytics - Definition
Core objectives:
Identifying, preserving, recovering, processing, and analyzing structured,
standardized and/or codified digital information for the purpose of
generating evidence that may be used as such in an investigation, and
that may ultimately serve as legal actions support in litigation.
Source of information:
Company’s accounting system (ERP), proprietary or third partydeveloped vertical applications, intersystem interfaces, financial
reporting worksheets.

34. How data analytics works?
Data Acquisition, Accounting
Integrity Control and Data Mapping
Evaluation of fraud and misconduct
risk indicators
Routines and tests
Identification of unusual or
irregular trends and patterns
Analysis of preidentified
transactions

35. Usual procedures - Overview
How data analytics works?
– Reviews with focus in red flags detected.
– Master vendor and customer files analysis:
• Databases cross analysis between company databases and public databases
and records. Some examples are:
 Clients related to public biddings
 Vendors/Clients with invalid or incomplete key data
 Vendors/Clients with potential tax irregularities
 Vendors/Clients with unusual activities
 Vendors/Clients with unusual characteristics
 Vendors/Clients with unusual transactional activity
 Duplicate Vendors/Clients
 Vendors/Clients related to employees or other Vendors/Clients
 Employees related to other employees

36. Employee - Vendor Matching: identical domicile as per external databases
Masters
External databases
CODE
VENDOR
DOMICILE
100911 TRANSPORTES PARANÁ ARANÁ 1
P
CODE
EMPLOYEE
502435 JUAN PEREZ
CITY
Taxpayer ID
CAP. FED. 30-70867893-0
DOMICILE
CITY
Employee ID
AV PUEYRREDÓN 1111 AP. FED. 23-20667877-4
C
Apparently
unrelated
COMPANY
ALTERNATIVE
DOMICILE
NAME
DOMICILE
30-70867893-0MARÍA PEREZ PARANÁ 1
AV. CÓRDOBA 999 PISO 3
Taxpayer ID
Employee ID
NAME
DOMICILE
CITY
23-20667877-4JUAN PEREZ CÓRDOBA 999 PISO 3 FED.
CAP.
The difference might
arise from the
fantasy name –
company name
Unusual
relationship

37. Examples of results per vendor
He/she external public
Based onwould be
working under a
sources, he/she would be
working under a contract
contract of
of employment
employment
Individual
Individual
Related to
Related to a a
potentially irregular
potentially irregular
entity
entity
services
Sequentially
Sequentially
numbered invoices
numbered invoices
Entity showing no
tax activity
Company name
does not match the
information filed
with AFIP
Vendor :
Vendor C: Provider
Provider of
of advertising
advertising
services
Significant number
of legal actions
Data quality issues
(incomplete
information)
Vendor :
Advisory
services fees

38. Vendor
Name
High risk fraud alert
Unusual activity
Master data changes
Unusual Behaviour
Inconsistent names
Potential tax irregularities
Connected entities
Suspicious tax payer ID
Suspicious address
Suspicious telephone
Unusual information
Other Potential irregularities
Data Quality - Invalid key data
Data Quality - Missing key data
Duplicates
TOTAL SCORING
Test 001
Test 002
Test 100
TOTAL TESTS
Vendors with higher scoring
100123
100981
100789
101000
102078
Vendor 1
Vendor 2
Vendor 3
Vendor 4
Vendor 5
100
100
100
100
100
10
10
10
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
3
2
3
2
1
7
8
4
7
3
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
2
0
0
3
0
1
0
0
0
0
0
0
0
0
0
0
2
4
3
4
5
122
121
120
109
107
1
1
1
0
0
0
1
0
0
0
0
0
0
1
1
1
2
1
1
1
Each routine is classified into these groups considering the
estimated risk inherent to each test.
Note: for instance, only three routines are identified in the chart.
The complete analysis includes over 200 routines.

39. Manual Journal Entries Ranking
•
Night shifts
•
Unbalanced entries
•
Reclassifications
•
Weekends
•
Rarely used accounts
•
Benford Law
•
Holidays
•
Adjustments
•
Round numbers
•
Reversals

40. Your
Questions