Fraud Triangle Analytics Anti-Fraud Research and Methodologies

Fraud Triangle Analytics

Anti-Fraud Research and Methodologies

Risk Management Committee Meeting

American Hotel & Lodging Association

November 18, 2009

Topics for discussion

►

Why incorporate fraud detection analytics

►

The Fraud Triangle in the current

business environment

►

Forensic analytics maturity model

►

Our research: forensic data analytics

from a Fraud Triangle perspective

►

Forensic analytics to find hidden money

Why incorporate fraud detection analytics?

►

7% of company revenues are lost due to fraud – per ACFE*

►

Obtain better understanding of company’s risks & controls

►

Sets a proper “tone at the top”

►

Integrates well with internal audit functions

and goes beyond “controls testing”

►

Potential lower D&O premiums

Current environment

The perfect storm for fraud

Internal Controls Internal and External

Pressure Layoffs unemployment and unease continue Stock prices levels remain low

Opportunity to Commit Fraud

Credit crisis and other external factors limit liquidity Budgets are decreasing. Companies and organizations are

doing more with less. Companies and organizations are downsizing which has an immediate effect on internal controls Stressed and disaffected employees may have greater ability to rationalize improper actions Pressure Opportunity Rationalization Increase use of government funds

Where is fraud occurring?

2008 Corruption Perceptions Index

X

Low

How is it detected?

Source: ACFE 2008 Report to the Nation On Occupational Fraud

66% by tip

or accident

Forensic Analytics Maturity Model

Become more proactive in detecting fraud…

Detection Rate

Low

High

False Positive Rate

High

Low

Structured

Data

Unstructured

Data

Traditional Rules-Based

Queries & Analytics

Traditional Keyword

Searching

Model-Based Analysis

Visual Analytics

Latent Semantic Analysis

Natural Language

Data Sources in Today’s Organization

Text

Graphics

Email

Presentations & Spreadsheets

Unstructured Data

20%

80%

Structured Data

Summary of Our Research

►

Incorporated lessons learned from past

►

Change the way we view data

►

80% of data is unstructured

►

Innovative and aggressive

methods to uncover:

►

Fraud

►

Error

►

Misuse

►

Waste

►

Need for a targeted,

risk-based approach

May/June and

July/August

issues of

Risk-Based Approach

Workflow

1. Perform risk assessment

2. Link risk to business process

3. Link business process to departments

4. Link departments to people

5. Collect data (in e-mail or transactional data)

6. Perform analysis

Risks

The Fraud Triangle¹

Applying theory to electronic communications

EY / ACFE Library of ‘Keywords’

(Over 3,000 terms in a half dozen languages so far…)

Rationalization

Incentive/ Pressure

Opportunity

…I deserve it

…nobody will find out …gray area

…they owe it to me …everybody does it …fix it later

…the company can afford it …not hurting anyone

…won’t miss it

…don’t get paid enough

…make the number

…don’t let the auditor find out …don’t leave a trail

…not comfortable

…why are we doing this …pull out all the stops

…do not volunteer information …want no part of this

…only a timing difference …not ethical

…special fees

…client side storage …off the books …cash advance …side commission …backdate …no inspection …no receipt …smooth earnings …pull earnings forward

Predictive Fraud Analysis - output

Proactive Fraud Analysis – Research

Revenue Recognition Fraud

Incentive/Pressure Terms

Keyword hits as a percentage of total emails

Opportunity Terms

Proactive Fraud Analysis – Research

Revenue Recognition Fraud

Incentive/Pressure Terms

Selected Top Keyword Hits During Peak Period

Opportunity Terms

Rationalization Terms

problem commit create concern not sure short clarify split spread revise sorry

correct appropriate reserve miss condition depart discount difficult

fail critical

therefore find out it’s OK get w/1 back challenge find it figure out catch complex does not w/1 make sense

Proactive Fraud Analysis – Research

Bribery Case

Incentive/Pressure Terms

Keyword hits as a percentage of total emails

Opportunity Terms

Rationalization Terms

Proactive Fraud Analysis – Research

Bribery Case

Incentive/Pressure Terms

Opportunity Terms

Rationalization Terms

Selected Top Keyword Hits During Peak Period

manage risk short

problem commit concern

clear fake cover

policy fund complain investigate process w/5 fee consult audit offshore renewal error therefore challenge complex entitled get w/1 back catch mistake justified

Visualizing the Fraud Triangle:

Via Online Dashboard

Drill down further into months

Terms counts update for the custodian and specified months

If required, drill down to the source e-mail or

instant message communication

Case Example: Global Consumer Products

► Company received more than 40 whistleblower hotline complaints from one of the regions in Mexico over a three month period

► In response, the company’s internal audit team performed an investigation on the

complaints

► Company wanted to review emails for 28 custodians, in search of evidence that would further bolster the results of the investigations; however, time and budget was limited ► When EY became involved, we were provided little information pertaining to the

various allegations

► EY processed the PST’s using Fraud Triangle Analytics yielding 200,964 emails.

► Email and attachments were searched using a combination of ACFE-EY Fraud Terms

as well as terms provided by the Client (“Client Terms”) related to their various

Analysis of Client Terms

Fraud Indicators for the top five custodians for “high-risk” terms

J u l 1 0 7 S e p 1 0 7 N o v 1 0 7 J a n 1 0 8 M a r 1 0 8 M a y 1 0 8 J u l 1 0 8 S e p 1 0 8 N o v 1 0 8 J a n 1 0 9 M a r 1 0 9 M a y 1 0 9 D a t e 0 1 0 2 0 3 0 4 0 5 0 A vg. D ies el _P er 0 1 0 2 0 3 0 4 0 5 0 A vg. IP _P er 0 1 0 2 0 3 0 4 0 A vg. O P _P er 0 5 1 0 1 5 Av g. R A T_ P er 2 1 .0 5 1 5 .0 0 2 1 . 2 1 6 .0 6 6 . 2 5 _{4 . 6 5} 5 .8 8 6 .8 0 7 .0 3 6 .8 8 2 9 .1 6 1 0 . 6 0 1 1 . 5 8 9 .2 4 4 4 .4 4 4 2 .5 3 4 6 .0 1 4 5 . 9 4 7 .3 7 2 . 5 0 3 .0 3 6 .0 6 7 . 1 4 4 . 6 5 2 .9 4 5 .2 0 2 .3 4 2 .4 3 8 . 6 1 4 .6 1 2 .1 6 4 . 3 5 2 7 . 7 8 4 8 .2 8 4 2 .5 1 3 6 . 5 0 3 6 .0 4 3 5 . 8 2 9 .4 7 3 . 7 5 1 5 . 1 5 4 . 4 6 4 . 6 5 1 0 . 2 9 1 0 .0 0 5 .4 7 4 .8 6 4 . 3 1 4 .1 5 5 .9 9 9 . 2 4 3 8 .8 9 3 7 .2 4 3 3 .2 7 2 9 .4 6 3 1 . 4 5 2 7 . 3 3 3 . 0 3 1 . 7 9 0 .4 9 0 .8 0 0 . 2 0 0 .3 7 1 .0 4 0 .5 4 1 1 . 1 1 1 5 .0 1 1 1 .4 2 9 . 2 4 8 .9 6 1 0 . 0 6 T r e n d T r e n d T r e n d T r e n d T r e n d T r e n d T r e n d T r e n d D i e s e l v s F r a u d S c o r e T h e tr e n d o f a v e r a g e o f D i e s e l _ P e r , a v e r a g e o f IP _ P e r , a v e r a g e o f O P _ P e r a n d a v e r a g e o f R A T _ P e r w i t h D a te . T h e d a t a i s f i l te r e d o n D a t e Y e a r a n d n a m e . T h e D a t e Y e a r fi l te r h a s m u l t i p l e m e m b e r s s e l e c te d . T h e n a m e f i l te r k e e p s G A B R I E L

Results from the investigation line key words hits

Pressure key words hits

Opportunity key words hits

Advanced E-mail Analytics

WHO

WHAT

WHEN

WHY

• People-to-people analysis • Entity-to-entity analysis • Map communication lines

to organization chart

• Top words mentioned • Key concepts / topics

• Top or unusual dollar amounts • Sensitive words / phrases

• SSN • CCN

• When communications occur • Communication spikes

around key business events

• Positive vs. Negative Sentiment • Top 10 negative journal entries • Top 10 angry emails

• Top 10 most concerned emails • Customer survey analysis • Employee survey analysis

“Who is talking to whom?

Social Networking Concept Clustering Communication Over Time Sentiment Analysis

Visual Analytics – Entity Extraction

Geographic view

Why so many mentions of Colombia?

We don’t do business in Colombia!

Considering Structured Data

Detection Rate

Low

High

False Positive Rate

Structured

Data

High

Low

Unstructured

Data

Traditional Rules-Based

Queries & Analytics

Traditional Keyword

Searching

Model-Based Analysis

Visual Analytics

Latent Semantic Analysis

Natural Language

Fraud Risk Areas to Consider

►

Cash Disbursements

General Ledger

►

Materials Management &

Inventory Control

►

Purchase Order

Management

►

Salaries & Payroll

Travel & Expenses

Vendor Management

Payment Cards

Asset Misappropriation

Bid Rigging

Conflicts of Interest

Contract Compliance

Kickbacks

Materials Management

& Inventory Control

►

Purchase Order

Management

►

Sales Analysis

►

Travel & Expenses

Corruption / FCPA

Accounts Payable

Account Receivable

Deposits

General Ledger

Materials Management

& Inventory Control

►

Purchase Order

Management

Revenue Recognition /

Procure to Pay

Sales Analysis

Financial Statement

Data Analytics

Common Areas of Interest

Payment stream analysis

► Altered invoices, goods not received, duplicate invoices, inflated prices, excess quantities purchased

2.

Vendor master/employee master comparisons

► Fictitious vendors, vendor risk ranking, conflicts of interest 3.

Employee expenses

► Over limits, unusual expenses, miscellaneous/sundry expenses, consultant payments 4.

P-card expenditures

► Over limits, unusual expenses, miscellaneous/sundry expenses 5.

Payroll

► Ghost employees, unusual payments, no deductions/evaluations, direct deposit account analysis

6.

Bribery & Corruption / FCPA

► Bid rigging, conflicts of interest, contract compliance, kickbacks, payments to outside consultants

Find Hidden Money…

Recover Erroneous, Negligent or Fraudulent Payments

Different

Vendor ID SameDate

Exact Same Amount

Different

Invoice # Same Reference /_{Job Code}

Analyze 400,000 transactions for suspected bribery payments

1.

Ernst & Young team reviewed 2,000 transactions from ledger data (text

comments, amounts, dates, etc.)

►

Identified 400 suspicious and 1,600 non-suspicious entries

2.

Created statistical model: “Is Suspicious” / “Is Not Suspicious”

►

Incorporated both structured and unstructured data into the model

3.

Applied model to remaining 398,000 additional transactions

4.

Identified 14,000 new suspicious transactions

►

With confidence over 95% similar to “Is Suspicious”

Identified over $8 million of highly suspicious payments

►

Perform Text Analytics

on free text fields

►

Conduct “term

frequency” analysis for

most occurring or

unusual transaction

descriptions

►

Capture ‘concepts’

Predictive Modeling

(Step 2) Perform text analytics

“Volume contract facilitation”

These three variables were this highest drivers of suspicious transactions

These variables were less important when

predicting suspicious transactions. Client should focus resources on monitoring efforts for the three leading drivers which accounts for 80% of the predictive value.

Perform Variable

Analysis

Predictive Modeling

Customized on-line compliance monitoring tools

Uploads / integrates

with transactional

data sources

Drill down

capabilities by

subsidiary or region

Dynamic reporting

Web-based

Rules-based and

model based

analytics

Monitoring online reports

Anomaly Detection

Benford’s Law

(In naturally occurring numbers)

Where “d” is the leading digit and “p” is

the probability.

Benford’s Law Practical Examples

► Spot dummy vendors in data manipulation schemes

► Majority of improper purchases begin with 7, 8, or 9 which is just the

opposite of Benford’s predicted patterns

► Consequently, fraudulent invoices are easier to detect using Benford’s Law than by random sampling.

► Also identify amounts just below pre-defined cut-offs

► As shown, the threshold for “second approval” was $4,000 so invoices often began with “3” (as in $3,999)

Analysis of 10,000 vendor invoices

Applications: Expense costs, Vendor invoices, Sales Figures, and Insurance

Claims should follow Benford’s Law

1. Per Mark Nigrini, a Ph.D., and a chartered accountant: After several years of studying Benford’s Law, he published his thesis in 1992 demonstrating that Benford’s Law could be used to detect fraud and to detect rounded numbers. His studies revealed that sales figures, insurance claim costs, and expense claims should follow Benford’s Law.

Final considerations for our clients

►

Assess risk

►

Part of planning, or just a repeat of last year

►

Measure risk

►

Is it just rules based?

►

Consider unstructured (text-based) data

►

Consider incorporating the fraud triangle concept

►

Improve business performance

►

Not just “risk mitigation”

►

FCPA awareness

►

Find hidden money

Thank you

Vincent Walden, CFE, CPA, CITP

Senior Manager, Assurance Services

Fraud Investigation & Dispute Services

Dallas, Texas

(214) 754-3941

[email protected]

Daniel Torpey, CPA, CITP

Partner, Assurance Services

Fraud Investigation & Dispute Services

Dallas, Texas

(214) 969-8373