The document provides information about data analytics for auditors, featuring insights from experts Jim Kaplan and Richard Cascarino, along with details about auditnet®, a comprehensive resource for audit professionals. It covers topics such as probability theory, fraud detection techniques, data mining, and statistical analysis relevant to internal audit practices. Furthermore, it outlines the necessary conditions and procedures for obtaining CPE credits during webinars conducted by auditnet®.

1. 9/18/2017
1
Data Analytics
September 19, 2017
About Jim Kaplan, CIA, CFE
 President and Founder of AuditNet®,
the global resource for auditors (now
available on iOS, Android and
Windows devices)
 Auditor, Web Site Guru,
 Internet for Auditors Pioneer
 Recipient of the IIA’s 2007 Bradford
Cadmus Memorial Award.
 Author of “The Auditor’s Guide to
Internet Resources” 2nd Edition
Page 2

2. 9/18/2017
2
About Richard Cascarino, MBA,
CIA, CISM, CFE, CRMA
• Principal of Richard Cascarino &
Associates based in Colorado USA
• Over 28 years experience in IT audit
training and consultancy
• Past President of the Institute of
Internal Auditors in South Africa
• Member of ISACA
• Member of Association of Certified
Fraud Examiners
• Author of Data Analytics for Internal
Auditors
3
About AuditNet® LLC
• AuditNet®, the global resource for auditors, is available on the
Web, iPad, iPhone, Windows and Android devices and features:
• Over 2,700 Reusable Templates, Audit Programs,
Questionnaires, and Control Matrices
• Training without Travel Webinars focusing on fraud, data
analytics, IT audit, and internal audit
• Audit guides, manuals, and books on audit basics and using
audit technology
• LinkedIn Networking Groups
• Monthly Newsletters with Expert Guest Columnists
• Surveys on timely topics for internal auditors
• NASBA Approved CPE Sponsor
Introductions
Page 4

3. 9/18/2017
3
Housekeeping
This webinar and its material are the property of AuditNet® and its Webinar partners. Unauthorized
usage or recording of this webinar or any of its material is strictly forbidden.
 If you logged in with another individual’s confirmation email you will not receive CPE as the
confirmation login is linked to a specific individual
 This Webinar is not eligible for viewing in a group setting. You must be logged in with your unique
join link.
 We are recording the webinar and you will be provided access to that recording after the webinar.
Downloading or otherwise duplicating the webinar recording is expressly prohibited.
 If you have indicated you would like CPE you must answer the polling questions (all or minimum
required) to receive CPE per NASBA.
 If you meet the NASBA criteria for earning CPE you will receive a link via email to download your
certificate. The official email for CPE will be issued via NoReply@gensend.io and it is important to
white list this address. It is from this email that your CPE credit will be sent. There is a processing
fee to have your CPE credit regenerated post event.
 Submit questions via the chat box on your screen and we will answer them either during or at the
conclusion.
 Please complete the evaluation questionnaire to help us continuously improve our Webinars.
IMPORTANT INFORMATION
REGARDING CPE!
 SUBSCRIBERS/SITE LICENSE USERS - If you attend the Webinar and answer the polling
questions (all or minimum required) you will receive an email with the link to download your CPE
certificate. The official email for CPE will be issued via NoReply@gensend.io and it is important
to white list this address. It is from this email that your CPE credit will be sent. There is a
processing fee to have your CPE credit regenerated post event.
 NON-SUBSCRIBERS/NON-SITE LICENSE USERS - If you attend the Webinar and answer the
polling questions (all or minimum required) and requested CPE you must pay a fee to receive
your CPE. No exceptions!
 We cannot manually generate a CPE certificate as these are handled by our 3rd party provider.
We highly recommend that you work with your IT department to identify and correct any email
delivery issues prior to attending the Webinar. Issues would include blocks or spam filters in your
email system or a firewall that will redirect or not allow delivery of this email from Gensend.io
 Anyone may register, attend and view the Webinar without fees if they opted out of receiving
CPE.
 We are not responsible for any connection, audio or other computer related issues. You must
have pop-ups enabled on you computer otherwise you will not be able to answer the polling
questions which occur approximately every 20 minutes. We suggest that if you have any
pressing issues to see to that you do so immediately after a polling question.

4. 9/18/2017
4
The views expressed by the presenters do not necessarily represent
the views, positions, or opinions of AuditNet® LLC. These materials,
and the oral presentation accompanying them, are for educational
purposes only and do not constitute accounting or legal advice or
create an accountant-client relationship.
While AuditNet® makes every effort to ensure information is
accurate and complete, AuditNet® makes no representations,
guarantees, or warranties as to the accuracy or completeness of the
information provided via this presentation. AuditNet® specifically
disclaims all liability for any claims or damages that may result from
the information contained in this presentation, including any
websites maintained by third parties and linked to the AuditNet®
website.
Any mention of commercial products is for information only; it does
not imply recommendation or endorsement by AuditNet® LLC
Today’s Agenda
 Probability theory in Data Analysis
 Types of Evidence
 Population Analysis
 Correlations and Regressions
 Fraud Detection using Data Analysis
 Data Analysis and Continuous Monitoring
 Continuous Monitoring
 Financial Analysis
Page 8

5. 9/18/2017
5
Today’s Agenda
 Data preprocessing techniques for detection, validation,
error correction, and filling up of missing or incorrect data
 Calculating various statistical parameters such as
averages, quantities, performance metrics and probability
distributions risk measurement, reporting and control
 Computing user profiles
 Expert systems to encode expertise for detecting fraud in
the form of rules
 Time-series analysis of time-dependent data
 Machine learning techniques to automatically detect
characteristics of fraud
Page 9
Data Mining Techniques
Copyright Richard Cascarino & Associates 10
Data mining is the exploration and analysis of large quantities of data in order to
discover valid, novel, potentially useful, and ultimately understandable patterns
in data.
Valid: The patterns hold in general.
Novel: We did not know the pattern beforehand.
Useful: We can devise actions from the patterns.
Understandable: We can interpret and comprehend the
patterns.

6. 9/18/2017
6
Mining for Fraud
11
Using database queries
and other methods to
determine if frauds may
actually exist
What are Anomalies?
 Anomaly is a pattern in the data that does
not conform to the expected behavior
 Also referred to as outliers, exceptions,
peculiarities, surprise, etc.
 Anomalies translate to significant (often
critical) real life entities
Cyber intrusions
Credit card fraud

7. 9/18/2017
7
Simple Example
 N1 and N2 are
regions of normal
behavior
 Points o1 and o2
are anomalies
 Points in region
O3 are anomalies
X
Y
N1
N2
o1
o2
O3
POLLING QUESTION

8. 9/18/2017
8
Copyright © 2017 AuditNet® and Richard Cascarino & Associates
Proactive Method of Fraud
Detection
Exploratory Data Analysis
16

9. 9/18/2017
9
Decision Tree Analysis
17
Classification
 Decision trees are one approach to
classification.
 Other approaches include:
Linear Discriminant Analysis
k-nearest neighbor methods
Logistic regression
Neural networks
Support Vector Machines

10. 9/18/2017
10
Techniques for finding fraud:
 Build a profile of
the characteristics
of fraudulent
behavior.
 Pull out the cases
that meet the
historical
characteristics of
fraud.
Decision Trees and Rules
Neural Networks
20

11. 9/18/2017
11
In Data Mining terms…
 Classification?
Classify into fraudulent and non-fraudulent
behavior
What do we need to do this?
 Outlier Detection
Assume non-fraudulent behavior is normal
Find the exceptions
Data mining is not
 “Blind”application of analysis/modeling
algorithms
 Brute-force crunching of bulk data
 Black box technology
 Magic

12. 9/18/2017
12
POLLING QUESTION
Techniques used to
identify fraud
Predict and Classify
Regression
algorithms (predict
numeric outcome):
neural networks,
CART, Regression,
GLM
Classification
algorithms (predict
symbolic outcome):
CART, C5.0, logistic
regression
Group and Find Associations
Clustering/Grouping
algorithms: K-
means, Kohonen,
2Step, Factor
analysis
Association
algorithms: apriori,
GRI, Capri,
Sequence

13. 9/18/2017
13
Techniques for finding fraud:
 Predict the expected
value for a
transaction, compare
that with the actual
value of the
transaction.
 Those cases that fall
far outside the
expected range
should be evaluated
more closely
Techniques for finding fraud:
 Group behavior
using a
clustering
algorithm
 Find groups of
events using the
association
algorithms
 Identify outliers
and investigate
Clustering and Associations

14. 9/18/2017
14
Input Data – Nature of
Attributes
Nature of attributes
Binary
Categorical
Continuous
Hybrid
Tid SrcIP Duration Dest IP
Number
of bytes
Internal
1 206.163.37.81 0.10 160.94.179.208 150 No
2 206.163.37.99 0.27 160.94.179.235 208 No
3 160.94.123.45 1.23 160.94.179.221 195 Yes
4 206.163.37.37 112.03 160.94.179.253 199 No
5 206.163.37.41 0.32 160.94.179.244 181 No
Types of Statistical
Techniques
 Parametric Techniques
Assume that the normal (and possibly anomalous) data is generated
from an underlying parametric distribution
Learn the parameters from the normal sample
Determine the likelihood of a test instance to be generated from this
distribution to detect anomalies
 Non-parametric Techniques
Do not assume any knowledge of parameters
Use non-parametric techniques to learn a distribution – e.g. parzen
window estimation

15. 9/18/2017
15
Data Analysis Software
 ACL Audit Analytics
Powerful program for data analysis
Most widely used by auditors worldwide
 CaseWare’s IDEA
Recent versions include an increasing number of
fraud techniques
ACL’s primary competitor
Data Analysis Software
 Microsoft Office + ActiveData
a plug-in for Microsoft Office
provides data analysis procedures
based in Excel and Access
less expensive alternative to ACL and IDEA
 SAS and SPSS
Statistical analysis programs with available fraud modules
 R Free software (Shareware)
Foundation for Statistical Computing

16. 9/18/2017
16
Obstacles to Data Analysis
 Obtaining access privileges to data
 Getting physical access to the data
 Reliability and integrity of data received
 Understanding data storage and format
 Downloading the data
 Transferring the data to the auditor
 Importing the data into the data analysis
software
31
Planning for Data Analysis
Why You Need to Know How to Use CAATs
 Today, if you can’t follow a computerized audit trail, you can’t audit!
 Specialized Audit Software
SMF Analyzer
Languard
Clementine
Netmap
 Generalized Audit Software
IDEA (Caseware)
ACL
Access
Excel
SAS
Monarch
32

17. 9/18/2017
17
Acquiring the Data
Ensuring the Data is Clean
• Use of control totals and Hash
totals
• Use of Data Verification
• Cleaning up data for
interrogation
• Recording all clean-ups
• Using IT to help Keep it Clean
33
POLLING QUESTION

18. 9/18/2017
18
Acquiring and Importing Data
IDEA Importation Example
35
Benford’s Law History
 Simon Newcomb – 1881
 Frank Benford – 1938
 Roger Pinkham – 1961
 Theodore Hill – 1995

19. 9/18/2017
19
History – Accounting Data
 Benford’s Law was first used by accountants
in late 1980
 Nigrini
What Is Benford’s Law
 BENFORD’S LAW FORMULA
The probability of any number “d” from
1 through 9 being the first digit is….
Log10 (1 + 1/d)

20. 9/18/2017
20
What Is Benford’s Law?
 Benford’s law gives the probability of
obtaining digits 1 through 9 in each position
of a number.
 For example, 3879
3 - first digit
8 - second digit
7 - third digit
9 – fourth digit
What Is Benford’s Law
 Most people assume the probability is 1/9
that the first digit will be 1 - 9
 This would mean digits are equally likely to
occur, but this is not the case
 According to Benford’s Law the probability of
obtaining a 1 in the first digit position is
30.1%

21. 9/18/2017
21
Expected Frequencies Based
on Benford’s Law
Digit 1
st
Place 2
nd
Place 3
rd
Place 4
th
Place
0 0.11968 0.10178 0.10018
1 0.30103 0.11389 0.10138 0.10014
2 0.17609 0.19882 0.10097 0.1001
3 0.12494 0.10433 0.10057 0.10006
4 0.09691 0.10031 0.10018 0.10002
5 0.07918 0.09668 0.09979 0.09998
6 0.06695 0.09337 0.0994 0.09994
7 0.05799 0.0935 0.09902 0.0999
8 0.05115 0.08757 0.09864 0.09986
9 0.04576 0.085 0.09827 0.09982
Source: Nigrini, 1996.
Types of Data That Conform
 Accounts payable data
 Accounts receivable data
 Estimations in the general ledger
 Relative size of inventory unit prices among
locations
 New combinations of selling prices
 Customer refunds
 Duplicate payments

22. 9/18/2017
22
Uses in Fraud Investigations
 Invented or altered numbers are not likely to
follow Benford’s Law
Human choices are not random
 1993, State of Arizona v.Wayne James
Nelson
POLLING QUESTION

23. 9/18/2017
23
Multidimensionality
 Multidimensionality
The ability to organize, present, and analyze
data by several dimensions, such as sales by
region, by product, by salesperson, and by
time (four dimensions)
 Multidimensional presentation
Dimensions
Measures
Time
Multidimensionality
 Multidimensional database
A database in which the data are organized
specifically to support easy and quick
multidimensional analysis
 Data cube
A two-dimensional, three-dimensional, or
higher-dimensional object in which each
dimension of the data represents a measure
of interest

24. 9/18/2017
24
Multidimensionality
 Cube
A subset of highly interrelated data that is
organized to allow users to combine any
attributes in a cube (e.g., stores, products,
customers, suppliers) with any metrics in the
cube (e.g., sales, profit, units, age) to create
various two-dimensional views, or slices, that
can be displayed on a computer screen
POLLING QUESTION

25. 9/18/2017
25
IDEA Data Import
49
Capturing from ODBC

26. 9/18/2017
26
Capturing ODBC File
Data Visualization
 Data visualization
A graphical, animation, or video presentation
of data and the results of data analysis
The ability to quickly identify important trends in
corporate and market data can provide
competitive advantage
Check their magnitude of trends by using
predictive models that provide significant
business advantages in applications that drive
content, transactions, or processes

27. 9/18/2017
27
Data Visualization
 New directions in data visualization
 Since the 1990s data visualization has
moved into:
Mainstream computing, where it is integrated
with decision support tools and applications
Intelligent visualization, which includes data
(information) interpretation
Real-Time Monitoring

28. 9/18/2017
28
From Intellinx
From Intellinx

29. 9/18/2017
29
From Intellinx
From Intellinx

30. 9/18/2017
30
Keys to detecting and
preventing fraud
 Learn from the past
High quality, evidence based decisions
 Predict
Prevent future instances
 React to changing circumstances
Models kept current, from latest data
POLLING QUESTION

31. 9/18/2017
31
Questions?
Any Questions?
Don’t be Shy!
AuditNet® and cRisk Academy
If you would like
forever access to this
webinar recording
If you are watching
the recording, and
would like to obtain
CPE credit for this
webinar
Previous AuditNet®
webinars are also
available on-demand
for CPE credit
http://criskacademy.com
http://ondemand.criskacade
my.com
Use coupon code: 50OFF
for a discount on this
webinar for one week

32. 9/18/2017
32
Thank You!
Jim Kaplan
AuditNet® LLC
1-800-385-1625
Email:info@auditnet.org
www.auditnet.org
Richard Cascarino & Associates
Cell: +1 970 819 7963 - South Africa +27 (0)78 980 7685
Tel +1 303 747 6087 (Skype Worldwide)
Tel: +1 970 367 5429
eMail: rcasc@rcascarino.com
Web: http://www.rcascarino.com
Skype: Richard.Cascarino
Page 63