Using Data Analysis to Detect Fraud - IIA Dallas Chapter

“There is a tendency to mistake data for wisdom, just as there has alwaysbeen a tendency to confuse logic with values, intelligence with insight.Unobstructed access to facts can produce unlimited good only if it is matchedby the desire and ability to find out what they mean and where they lead.Facts are terrible things if left sprawling and unattended. They are too easilyregarded as evaluated certainties rather than as the rawest of raw materialscrying to be processed into the texture of logic. It requires a very unusualmind, Whitehead said, to undertake the analysis of a fact. The computer canprovide a correct number, but it may be an irrelevant number until judgment ispronounced.”Norman Cousins (1912–1990), U.S. editor,author. “Freedom as Teacher,” HumanOptions: An Autobiographical Notebook,Norton (1981).Using Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 3

Using Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 5

Who detects fraud?Source:PricewaterhouseCoopers’Global Economic CrimeSurvey 2005http://www.pwc.com/extweb/insights.nsf/docid/D1A0A606149F2806852570C0006716C0Using Data Analysis to Detect and Deter FraudMarch 2007PricewaterhouseCoopersSlide 6

OutlineData Analysis FrameworkAnalytic TechniquesTechnology

Data Analysis FrameworkIndustry & Company KnowledgeCompany DataPaymentsPurchasingVendorEmployeeIndustry DataIdentify and Develop AnalyticsApply Analytics to DataResearch LeadsRefine AnalyticsInvestigativeProceduresHigh Priorityof InterestNo ActionConsortiumAddressesRepositoryPublic RecordsUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 8

Using Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 10

Analytic TechniquesCompare suppliers to employeesStandard test to show potential conflicts of interestUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 11

Analytic TechniquesAnalyze vendor activityDo you see an anomaly?Sequential invoice numbersVendorNumber Vendor NameInvoiceNumber Invoice DateInvoiceAmount10034578 CPG Air Freight 3041 7/12/2006 12,72310034578 CPG Air Freight 3042 8/18/2006 11,86310034578 CPG Air Freight 3043 9/8/2006 14,77110034578 CPG Air Freight 3044 10/4/2006 14,75010034578 CPG Air Freight 3045 11/17/2006 18,99210034578 CPG Air Freight 3046 12/1/2006 18,97210034578 CPG Air Freight 3047 12/22/2006 18,990Total Invoiced: 111,061Using Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 12

Analytic TechniquesGhost employeesDo you see the anomaly?Direct deposit numbers are identical forthree employees in three geographiesEmployeeID Employee Name LoctionDirect DepositAccountDepositAmount10078 William Kayak Buffalo, NY 000756227 3,24311265 Edward Cook Miami, FL 000756227 5,53813655 Nancy Wright Chicago, IL 000756227 2,236Total Paid: 11,017Using Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 13

Analytic TechniquesUnrecorded paymentsGaps in Check Numbers by issuing bankUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 14

Analytic TechniquesBenford’s LawUtilizes digit and numberpatterns to detect fraud,errors, biases, andirregularities. Significantdifferences between a dataset’s digit distribution and thedigit distribution of Benford’sLaw serve as a flag formanufactured or manipulateddata and suggest that furtheranalysis may be necessary.Areas for furtheranalysisUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 15

Analytic TechniquesWho can pronounce this word?INVIGILATION:Keep an eye on, watch over, observe, followCompare “fraud free” locations to other locationsHQBranchABranchBBranchGBranchDBranchCBranchEBranchFUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 16

Analytic TechniquesHow do you analyze 100 million transactions?a. One at a timeb. Run a queryc. Grouping and sequencing170 stores8,500 employees80,000 suppliers100 millionUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopers1,150,000 customersMarch 2007Slide 17

Analytic TechniquesCombining several sources of dataOrdersInventoryMovementsShippingDisbursementsFreight BillsOrders Inventory Shipping Freight Disbursements BillingCashReceipts10101010 10101010 10101010 10101010 10101010 10101010 1010101001010101 01010101 01010101 01010101 01010101 01010101 0101010110101010 10101010 10101010 10101010 10101010 10101010 1010101001010101 01010101 01010101 01010101 01010101 01010101 01010101Cash ReceiptsCustomerBillingUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 18

Analytic TechniquesTesting across combined attributesOrders Inventory Shipping Freight Disbursements BillingCashReceipts10101010 10101010 10101010 10101010 10101010 10101010 1010101001010101 01010101 01010101 01010101 01010101 01010101 0101010110101010 10101010 10101010 10101010 10101010 10101010 1010101001010101 01010101 01010101 01010101 01010101 01010101 01010101A B C D E F Count TotalY Y Y Y Y Y 894 470,356Y Y Y Y Y N 273 (21,754)Y Y Y Y N N 122 (9,274)Y Y N N Y Y 165 (11,666)Y Y N N N N 65 (7,249)Y N N N N N 13 (3,254)N N N N N N 43 (64,089)Using Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 19

Analytic TechniquesClusteringGrouping of matched entities by property typeA=B, B=C; therefore, A=B=C- A = Bob Jones- B = Trucking Inc (Attn: Robert Jones)- C = NY Trucking IncBob JonesName, AddressTrucking Inc(Attn Robert Jones)Trucking Inc(Attn Robert Jones)NameNY Trucking IncUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 20

Data Quality ChallengesNo uniquekeyNo consistentnaming conventionSpellingErrorsData EntryErrorsMissingValuesFreeFormTextID# Name Address City State Zip Note5154155 LaneM. Hitchcock 91017 th Street NW Washinton DC 20006A1617 LaneHitchcock, M., 910SeventeenthStreet NW DX 20006 021115146261 MyronStucky 110EyeSt. N.W. Washington DC 20005 CHKID87121 Stucky, Myron 110I Street 1 st floor DC FRAlert87458 Fisher &SmithInc 3197 th St. S.E. Washington DC 20003CompanyNamesBuriedInformationData inWrong FieldUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 21

Data Quality Challenges – Transliteration of NamesWest AfricaHage Imhemed OtmaneAbderaqibLevantineMuhamad UsmanAbdel RaqeebIraqHajj Mohamed Uthman AbdAl RagibEast AfricaHag Muhammad OsmanAbdurra’ibPersian GulfPersian GulfHaj Mohd OthmanAbdul RajeebUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 22

Data Quality Challenges – Transliteration of NamesZhang QiusuChang Ch’iu-SuMyanmar(Burma)ChinaTaiwanLaosHong KongMacauThailandPhilippinesCambodiaVietnamMalaysiaSingaporeChiusu Sae ChangCheung Yiau SoCheung Yau SoIndonesiaUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 23

Data CleansingPersonal Name Cleanse:Organization Name Cleanse:Address Cleanse:Using Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 24

OutlineData Analysis FrameworkAnalytic TechniquesTechnology

TechnologyA sampling of technologyData Cleansing• Data Flux• FirstLogic• LAS• USPS• SSN• Addresses• OFAC• World Check• World ComplianceUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 26

TechnologyA sampling of technologyContinuous Monitoring• ACL Continuous Controls Monitoring (“CCM”)• Oversight Systems• PwC General Ledger Tool• PwC Transaction Risk Identification & Analysis (“TRIA”)Using Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 27

TechnologyAbout Transaction Risk Identification & Analysis (“TRIA”)TRIA provides analysis of data at the sub-ledger level. The depthof the TRIA has been expanded to contain approximately 180reports related to the following business cycles:• Accounts payable• Revenue• Inventory• Payroll•Fixed assetsUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 28

TRIA HighlightsTRIA applies machine intelligence to solve matching and pattern detectionproblems.Key features of TRIA:• Combines machine intelligence with human intelligence- Computer matching + Manual review process• Utilizes USPS Address Standard and Firstlogic*• Interacts with outside database and third party software resources (e.g. knownfraudulent names/addresses, validity checks)- World Compliance** - World Check** - Mail Box etc. list- Name Variations* - SSN* * - DUNS Number*• Flexible Design- User configurable clustering engine- Matching and pattern detection algorithms can be customized• Provides an online environment to review matches• Provides multi-year analysis across application/ERP boundaries• Ability to dynamically design ad-hoc reports/analysis (ORACLE DBMS)Using Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 29

Analytic TechniquesTRIA HighlightVendors with addresses on the “common hotlist”Entity Type Full Name 1No. ofPaymentsTotalPayment AmountABC Vendor UNITED WAY OF SCIOTO CO INC 249 $10,963.60Common Hotlist CASH FOR NOWABC Vendor FORT WAYNE, CITY OF 82 $4,441,645.28ABC Vendor CITY UTILITIES 217 $212,582.76ABC Vendor CRICK, PATRICIA J RECORDER 34 $5,608.00Common Hotlist ALLEN COUNTY JAILABC Vendor PROCESS SOLUTIONS 129 $486,981.48ABC Vendor PROCESS SOLUTIONS INC 6 $136,176.18Common Hotlist HAMILTON COUNTY COLLECTIONHotlist DescriptionCHECK CASHING SERVICECOUNTY GOVT-CORRECTIONALINSTITUTIONSCOLLECTION AGENCIESUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 30

TRIA HighlightDisbursements within $500 of $10,000 approval limitUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 31

TechnologyTRIA DemoUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 32

Questions© 2007 PricewaterhouseCoopers LLP. All rights reserved. "PricewaterhouseCoopers" refers toPricewaterhouseCoopers LLP (a Delaware limited liability partnership) or, as the context requires, other memberfirms of PricewaterhouseCoopers International Ltd., each of which is a separate and independent legal entity.*connectedthinking is a trademark of PricewaterhouseCoopers LLP.

AppendixReport List

Accounts Payable1. Vendor Invoices With No Corresponding Purchase Order2. Unique General Ledger Entries3. Manual Checks4. Disbursements Paid to Vendors With No Corresponding Invoice5. Payments to Vendors not Listed in the Vendor Master File6. Vendors With No Tax ID Information in the Vendor Master File7. Disbursements within a Specified Range and Approval Limit8. Round dollar disbursements9. Sequential Invoice Numbers (by Vendor)10.Disbursements to Payees Labeled as “Cash”, “Do Not Use”, or isBlank11.Voided Checks12.Duplicate on Vendor Number and Payment AmountUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopers13.Receipt of Inventory Coded as ObsoleteMarch 2007Slide 35

Accounts Payable (Continued)16. Cash Disbursement - Invoice Age17. Vendor master file controls and maintenance18. Working Capital Analysis - Days Payable Outstanding (DPO)19. Vendors With No Phone Number Listed20. Vendors With No Terms Listed21. Vendors With No Addresses Listed22. Segregation of Duties - Disbursement and Vendor Master File23. Duplicate on Invoice Number, Invoice Date and Payment Amount24. Duplicate on Vendor Number, Invoice Date and Invoice Number25. Payments Stratified by Transparency International Corruption Indexand Country26. Payments to government owned entities27. Payments to agentsUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopers28. Payments to Agents with the Same AddressMarch 2007Slide 36

Accounts Payable (Continued)31. Payments Made to Foreign Bank Accounts32. Zero Dollar and Negative Disbursements33. Duplicates on Vendor Number and Check Date34. Duplicates on Vendor Number, Invoice Number, and PaymentAmount35. Comparison of Sales Versus Expenses by Country36. Compare Vendors with Government Entity List / Politically ExposedPeople37. Actual Vendor List38. Vendors on UN Oil for Food Report39. Vendors with Domestic Address and Foreign Bank40. Vendors with Only One Payment41. Vendor Accounts with a Debit BalanceUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopers42. Inventory Received in Excess of InvoicedMarch 2007Slide 37

Accounts Payable (Continued)46. Aggregate Payments in Alphabetical Order47. Aggregate Payments in Descending $ Order48. Cancelled Checks49. Check Amounts Sum of Invoice Amount50. Check Number Gaps51. Check Register Vendor Vendor List52. Checks with Multiple Names or Vendor Numbers53. Compare vendors address with customer address54. Compare vendors with common hotlist that have same address55. Compare vendors with project hotlist that have same name or sameaddress56. Duplicate Check Amounts57. Duplicate Check NumbersUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopers58. Entities with same addressMarch 2007Slide 38

Accounts Payable (Continued)61. Entities with same tax id62. First Digit of Check Amount63. First Digit of Invoice Amount64. Min/Max Check Amounts and Dates65. Payment Frequencies in Alphabetical Order66. Payment Frequencies in Descending $ Order67. Vendors with same address68. Vendors with same address and different name69. Vendors with same name70. Vendors with same name and different address71. Vendors with same phone number72. Vendors with same tax id73. Voided ChecksUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopers74. Whole Dollar Amount ChecksMarch 2007Slide 39

Revenue76.Segregation of Duties - Sales Orders and Customer Master File77.Duplicate Invoice Amounts to Customers78.Customers With No Phone Number Listed79.Unique General Ledger Entries80.Customers with an Address Match on the Common Hotlist81.Quantity of Products Invoiced Exceeds the Quantity of ProductsShipped82.Invoice Dollar Amount Exceeds Purchase Order Dollar Amount83.Round Dollar Customer Invoices84.Percentage of Customer Returns Compared to Customer Sales (byCustomer)85.Unusual Customer Trends (Based on Sales and Return Amounts)86.Discount Applied Differs from what is Stated in the Credit Terms87.Unauthorized Ship to AddressUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersInvoice Date Prior To Ship DateMarch 2007Slide 40

Revenue91. Customer Ship Address Same as Employee Address92. Shipping Address is on the Common Hotlist93. Sales to Customers Not In Customer Master File94. Cash Receipts and Credit Memo Analysis by Customer95. Top Customer Case Receipts/Payments Analysis (80/20 Rule)96. Sales Invoice/Cash Receipts Stratification97. Working Capital Analysis on Customer Receipts98. Days Sale Outstanding by Terms and Working Capital Analysis99. Customer master file controls and maintenance100.Deviation of invoice terms from master file101.Credit memo analysis - customer102.Unauthorized price changes103.Credit Memo Analysis by CreatorUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopers104.Credit memo analysis - reason codeMarch 2007Slide 41

Revenue106.Customers With No Terms Listed107.Customer Invoices With No Corresponding Sales Order108.Sales Stratified by Transparency International Corruption Index andCountry109.Sales to Government Owned Entities110.Actual Customer List111.Customers Matching Government Entities or Politically ExposedPeople112.Customer Accounts with a Credit Balance113.Sales by Country114.Sales to Country Different from Ship to Country115.Fixed Asset Additions Analysis116.Compare customers with common hotlist that have same addressUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopers117.Compare customers with project hotlist that have same name orsame addressMarch 2007Slide 42

Revenue121.Customers with same tax id122.Entities with same address123.Entities with same name124.Entities with same phone number125.Entities with same tax idUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 43

Payroll126. Compare employees with common hotlist that have same address127. Compare employees with project hotlist that have same name orsame address128. Employees with same address129. Employees with same address and different name130. Employees with same banking information131. Employees with same DOB132. Employees with same name133. Employees with same name and different address134. Employees with same phone number135. Employees with same tax id136. Entities with same address137. Entities with same nameUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopers138. Entities with same phone numberMarch 2007Slide 44

Inventory140.Unique General Ledger Entries141.Shipping Address is on the Common Hotlist142.Receipt of Inventory Coded as Obsolete143.Inventory Adjustment Analysis144.Inventory Received in Excess of Invoiced145.Item Classification146.Inventory Cycle Count Program - Last Count Analysis147.Inventory Cycle Count Program - Location AnalysisUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 45

Fixed Assets148.Unique General Ledger Entries149.Fixed Asset Additions AnalysisUsing Data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Slide 46