Detecting Fraud With Data Mining Slides

8/10/2019 Detecting Fraud With Data Mining Slides

1/45

CPAs & ADVISORS

IDEA Webinar Series

Detecting Fraud with Data Mining

Presented by

Jeremy Clopton, CPA, CFE, ACDA


2/45

How Fraud is Detected


3/45

Intriguing Quote on Big Data

As of 2012, about 2.5 exabytes of data are

created each day, and that number is doubling

every 40 months or so.

Harvard Business Review, Big Data: The

Management Revolution


4/45

Growth of Unstructured Data


5/45

Paper-based & limitedelectronic testing

(Sampling)

Reactive ProactiveResponsiveness


6/45

Problems with the old method

Ineffective

Inefficient

Reactive Hindsight

Prevalence of Big Data


7/45

The new method: a wish list

Do more with less

100 percent coverage

Increase effectiveness More insight

Not overly complex


8/45

The New Method: Data Analytics

processes & activities designed to obtain & evaluatedata to extract useful information...

Useful information includesConflicts of interest

Unknown relationships

Abnormal patterns of activity

Errors in key processesControl weaknesses

Hindsight, insight, foresight


9/45


10/45

Common Data Mining Areas

Vendors & accounts payable

Employees & payroll

Expense reimbursement

Travel & entertainment

General ledger


11/45

Vendor Attribute Capture

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

TIN

Address

Name

TIN Address Name

Attribute Present 29,276 68,804 69,535

Attribute Missing 40,259 731 -


12/45

Vendor Activity Assessment

FY 2012 FY 2011 FY 2010 FY 2009 pre-FY 2009

10,051 5,765 5,443 4,598 43,678

-

5,000

10,000

15,000

20,000

25,000

30,000

35,000

40,000

45,000

50,000


13/45

Name Mining

Mick E. Mowse

Princess Ariel

George Ruth

John Dough

1. Acronym / Initials

2. Anagrams

3. Fictitious Names

4. OthersSubstitution

Insertion or Omission

Transposition

Numb3r Subst1tut10n


14/45

Employee/Vendor Relationships

Matching

Attributes

Employee

ID

First

Name

Middle

Initial Last Name Vendor ID Name City State

Total

Payments

Address 123456789 Jeremy R Clopton 987654321 Vendor Name Anytown MO 16,040


15/45

Conflicts of Interest

Matching

Attributes Employee ID

First

Name

Middle

Initial Last Name Vendor ID Name City State

Total

Payments

Address 131313131 Beth E DavisD58468431Davis Designs Anytown MO 5,768

Address, TIN 687431598 George R Davis


16/45

Address Mining Mailbox Services


17/45

Address Mining Proximity


18/45

Address Mining Proximity

Employer

UPS Store

Employee

Home


19/45

Proximity Analysis

Vendor (A)

Jeremys Design Company, 123 5thStreet, Anytown, MO (Total Payments = $84,337)

Employee (B)

Jeremy Clopton, 4300 Oak Street, Anytown, MO


20/45

Proximity Analysis

AP Manager

Vinnys

Salvage

Yard


21/45

Proximity Analysis


22/45

Vendor Trending Analysis

Vendor: JLM Plumbing Authorized: Janice L. McPhearson

Test phase

Acceleration as

confidence builds

Getting

Greedy


23/45

Vendor Trending

Acceleration Patterns:Vendors exhibiting a pattern of

increased activity over multiple

consecutive periods.

Valley Patterns:Vendors exhibiting a pattern of activity

characterized by long periods of

inactivity between periods of activity.

Spike Patterns:Vendors exhibiting a pattern of activity

characterized by unusually high

payments in a single period.


24/45

Payment Trend Analysis

By Day of Week

By Day of Month

By Month


25/45

Benfords Law Analysis Expected

FrequenciesFirst Digit Expected Frequency Second Digit Expected Frequency

1 30.10% 0 11.97%

2 17.61% 1 11.39%

3 12.49% 2 10.88%

4 9.69% 3 10.43%

5 7.92% 4 10.03%

6 6.69% 5 9.67%

7 5.80% 6 9.34%

8 5.12% 7 9.04%

9 4.58% 8 8.76%

9 8.50%


26/45

Benfords Law A/P


27/45

Benfords Law A/P


28/45

Benfords Law Expense Accounts


29/45

Check Sequence analysis


30/45

Purchasing Cards Split Transactions


31/45

Analysis of Overtime Hours (654 hrs)

-

20

40

60

80

100

120

140

160

180

Regular Pay Overtime 1.5 Holiday Pay Vacation Pay Sick Leave


32/45

Analysis of Vacation Hours (426 hrs)

-

20

40

60

80

100

120

Regular Pay Overtime 1.5 Holiday Pay Vacation Pay Sick Leave Personal Circumstance Leave


33/45

Analysis Of Holiday Hours (182 hrs)

-

10

20

30

40

50

60

70

80

90

Regular Pay Overtime 1.5 Holiday Pay Vacation Pay Sick Leave


34/45

Other Areas of Application

Access log controls testing

Maintenance file analysis Vendors

Customers Loans

Credit cards & purchasing cards

Employee expense reimbursements

General ledger


35/45

Whats Next?

Automated testing

Analytics at the speed of business

Foresightin addition to hindsight & insight


36/45

Paper-based & limitedelectronic testing

(Sampling)

Data Analytics

(100% coverage, ad hoc

electronic testing)

Continuous Auditing

(Automated analytics,100% coverage)

Reactive ProactiveResponsiveness


37/45

Example 1 Manufacturing

Company Description

Revenues: $7.9 billion

Internal audit staff: 5

Operating divisions: 20Vendors: 100,000

Employees: 7,000

Payments per year: 250,000

Application of ContinuousAuditing

Risk #1: Conflicts of interest

Solution:Annual employee/vendormatching

Risk #2:Duplicate payments

Solution:Annual analysis of all invoicesfor potential duplicates


38/45

Example 2 Public University

Company Description

Revenues: $1 billion

Internal audit staff: 5

Vendors: 83,000Employees: 3,900

Purchasing card users: 1,100

Application of ContinuousAuditing

Risk #1:Duplicate payments

Solution:Quarterly analysis of allinvoices for potentialduplicates

Risk #2: Split transactionsSolution:

Quarterly analysis ofcardholder transaction details


39/45

Critical Information on Continuous

Auditing

Continuous auditing continuous monitoring

Continuous auditingOwned by internal audit

Risk & control assessmentProcess focused

Continuous monitoring

Owned by managementEffectiveness & adequacy of controls

Control focused


40/45

A PLAN TO GET YOU THERE


41/45

Assess Risk

DefineObjectives

Obtain Data

Develop & ApplyProcedures

Analyze Results

Manage Results


42/45

Progression of Procedure

Development

Single-Purpose(Individual) Tests

Groups of Similar

Tests

Repetitive

Individual Tests

Automation ofGroups of Tests

Groups ofRepetitive Similar

Tests


43/45

Challenge to Consider Data Quality

417-865-8701, (417)865-8701, 8658701, 417-8658701

Missoura, MO, Mis, Miss, MZ, MS, Miz, Mizz

PO Box 34, P.O. Box 34, Box 34, Bx 34, P.O Box 34

Clopton, Clapton, Clompton, Clampton, Cloptin

12345, 12345a, 12345-1, 012345


44/45

Resources

IIA Global Technology Audit Guides Continuous Auditing

Fraud Prevention and Detection in an AutomatedWorld

Data Analysis

ISACA White Paper

Data Analytics A Practical Approach

http://www.audimation.com


45/45

Contact Information

Jeremy Clopton, CPA, CFE, ACDA

Managing Consultant | BKD, LLP Forensics & Valuation Services Group

910 East St. Louis Street, Suite 200

Springfield, Missouri 65806

417.865.8701

[email protected]

Social Media

Blog: bkdforensics.com

Twitter: @j313

LinkedIn: http://www.linkedin.com/in/jeremyclopton/

Documents

Detecting Fraud With Data Mining Slides