Data Driven Fraud Detection

September 16, 2015

Keith L. JonesGeorge Mason University

HealthSouth Trial

The prosecutor noted that twice during the seven-year fraud, revenues and assets increased even though the number of HealthSouth facilities decreased.

“And that’s not a red flag to you?”

- Prosecutor Colleen Conry

Analytic Procedures:Analytic Procedures Sources of Information

Comparison of current-year account balances to those of one or more comparable periods

Financial account information for comparable periods.

Comparison of the current-year account balances to anticipated results found in the company’s budgets and forecasts.

Company budgets and forecasts.

Evaluation of the relationships of current-year balances to other current-year balances for conformity with predicable patterns based on the company’s experience.

Financial relationships among accounts in the current period (ratios).

Comparison of the current-year account balances and ratios with similar industry information.

Industry statistics.

Study of the relationships of current-year balances with relevant nonfinancial information (e.g., production statistics).

Nonfinancial information, such as production statistics.

Sustainable?????

Background

What are NFMs?

Measures of business activity: sometimes managerial accounting data often in 10K, not audited produced internally and externally SEC wants you to explain your financial results

NFMs may be less vulnerable to manipulation and/or are more easily verified than financial data (Bell et al. 2005; PCAOB 2007). Often independent sources or sources outside accounting /

finance Not estimates Collusion may be required

Background Examples from our study:

Number of employees (Compustat)Number of retail outletsNumber of patient visitsSquare footage of production facilitiesNumber of products

Number of patents or trademarks

Brazel, Jones, Zimbelman (2009)

Using Nonfinancial Measures to Assess Fraud Risk

- Journal of Accounting Research

RQ: If NFMs serve as a good benchmark for the financial statements, do fraud firms exhibit abnormal inconsistencies?

Example: Del Global Technologies

1997Income: Overstated $3.7 million.Revenue: 25% from PY.Employees: 6% (440 to 412)Distribution Dealers: 38% (400 to 250)

Fischer Imaging Corp:Revenue: 27%Employees: 20%Distribution Dealers: 7%

DIFF = Growth in Revenue – Growth in NFMs

Variable   N Mean Difference  CAPACITY DIFF

Fraud Firms 50 0.30 ABNORMAL Competitors 50 0.110.19**

EMPLOYEE DIFF

Fraud Firms 110 0.20 ABNORMAL

Competitors 110 0.04 0.16***

Problems

F/S comparative, NFM disclosures for CY only

NFM data scattered in 50-100 page 10-K

What specific NFMs should I look for? What are the benchmarks for my investment/client and industry?

So, using NFMs is too hard and too time consuming (5-6 hours to hand collect per company)

FINRA grants → Create a website/tool to solve problems based on research

10

11

12

13

14

ITT EDUCATIONAL SERVICES INC

12/31/2007 12/31/2008 Change

Revenues 540,953 623,859 0.153259

Total Assets 869,508 1,015,333 0.16771

NFMs

Students 53,000 62,000 0.169811

Full-time employees 3,960 4,620 0.166667

Part-time employees 2,900 3,960 0.365517

States with facilities 34 37 0.088235

Degree programs 29 33 0.137931

Institutions 97 105 0.082474

0.168439

DIFF for Revenue -0.015180142

DIFF for Assets -0.000729512

Low DIFF Example

High DIFF ExampleGREEN MOUNTAIN COFFEE ROASTERS INC

9/27/2008 9/26/2009 Change

Revenues 500,277 803,045 0.60520

Total Assets 357,648 813,839 0.56054

NFMs

Varieties of coffees and teas 200 200 0

Pounds of coffees held in futures contracts 1,162,500 1,125,000 -0.03226

Places distributed to 5,000 5,000 0

US patents 32 33 0.03125

International patents 69 73 0.05797Pounds of coffee sold in millions 32 40 0.25Stopped disclosing pounds in 2011!! Greenlight /Einhorn 0.05116

DIFF for Revenue 0.5540402

DIFF for Assets 0.509382

September 28, 2010 Green Mountain 8-K:

SEC inquiry On September 20, 2010, the staff of the SEC’s Division of Enforcement informed the Company that it was conducting an inquiry and made a request for a voluntary production of documents and information. Based on the request, the Company believes the focus of the inquiry concerns certain revenue recognition practices and the Company’s relationship with one of its fulfillment vendors.

17

18

Ex-post:Green Mountain restates 2007-2010 financial statementsClass-action litigation alleges illegal insider tradingFounder of Green Mountain fired

David Einhorn and Greenlight Capital become richer

19

-1-0

.9-0

.8-0

.7-0

.6-0

.5-0

.4-0

.3-0

.2-0

.1 00.

10.

20.

30.

40.

50.

60.

70.

80.

9 10

50

100

150

200

250

300

Fre

qu

en

cy

Revenue DIFF Frequency Distribution N = 1,585 Ob-servations (Company/Years)

DIFF = Change in Revenue - Average Change in NFMs

Future Options

1. Tag Nonfinancial Information

2. Consider requiring a footnote (FASB) or disclosure (SEC) with changes in financial measures (revenues, total assets, etc.) directly alongside changes in relevant NFMs (number of employees, retail outlets, distribution centers, products, etc).

Tenet Healthcare -- 2009 10-K (page 48)Admissions, Patient Days and Surgeries    2009   2008  

Increase (Decrease)  

Commercial managed care admissions    133,511   140,030   (4.7)% Governmental managed care admissions    118,129   109,450   7.9% Medicare admissions    156,104   161,493   (3.3)% Medicaid admissions    64,405   64,411   —  % Uninsured admissions    23,205   24,039   (3.5)% Charity care admissions    10,435   9,284   12.4% Other admissions    13,601   13,906   (2.2)% 

Total admissions    519,390   522,613   (0.6)% Paying admissions (excludes charity and uninsured)    485,750   489,290   (0.7)% Total government program admissions    338,638   335,354   1.0% Charity admissions and uninsured admissions    33,640   33,323   1.0% Admissions through emergency department    297,911   293,350   1.6% Commercial managed care admissions as a percentage of total admissions    25.7%  26.8%  (1.1)%(1) Emergency department admissions as a percentage of total admissions    57.4%  56.1%  1.3%(1) Uninsured admissions as a percentage of total admissions    4.5%  4.6%  (0.1)%(1) Charity admissions as a percentage of total admissions    2.0%  1.8%  0.2%(1) Surgeries – inpatient    152,846   154,268   (0.9)% Surgeries – outpatient    209,294   202,195   3.5% 

Total surgeries    362,140   356,463   1.6% Patient days – total    2,530,528   2,586,187   (2.2)% Adjusted patient days(2)    3,748,764   3,734,085   0.4% Patient days – commercial managed care    535,345   563,018   (4.9)% Average length of stay (days)    4.9   4.9   —  (1) Adjusted patient admissions(2)    774,630   759,976   1.9% Number of general hospitals (at end of period)    48   48   —  (1) Licensed beds (at end of period)    13,326   13,287   0.3% Average licensed beds    13,309   13,274   0.3% Utilization of licensed beds(3)    52.1%  53.2%  (1.1)%(1) 

Company is the Victim

Conducting a Pro-Active Fraud Audit: A Case Study

Albrecht, Albrecht, and Dunn

Journal of Forensic Accounting

Vendor Fraud

• Overcharging• Providing poor quality• Billing more than

once

• Price increases greater than 30% for four years.

• Work orders and cost overruns >50%

• $ amount, # and % of good returned to vendor

• Duplicate invoice numbers• Vender with invoices for the

same amount on same day• Vendors with sequential

invoices

Employee Fraud

• Dummy vendors

• Purchasing goods for personal use

• Two or more suppliers with same telephone and/or address

• Compare vendors paid to Dun and Bradstreet listing

• Contractors with common names – first two letters match and 90% of the name is the same

• Employee and vender addresses are the same

• Invoices without purchase orders or purchase orders with zero dollar amounts

Vendor/Employee Collusion

• Kickbacks or other favors

• Price increases greater than 30% for four years.

• $ amount, # and % of good returned to vendor

• Payments without receiving reports

• Increased volume of purchases by vendor and buyer

• Combination of increased prices and increased purchases from specific vendors

Contractor Fraud

• Charging more hours than worked

• Excessive overtime• Over-billing• Fake employees

• Rank hours worked by contract employee

• Rank overtime hours worked per two-week pay periods by contractor and employee

• Ranking contractors with rising overtime charges

• Contractors with significant jumps in labor rates

• Outliers in rates per hour• Sort contractor social security

numbers by ascending numbers.

Contractor Fraud

• Charging more hours than worked

• Excessive overtime• Over-billing• Fake employees

• Rank hours worked by contract employee

• Rank overtime hours worked per two-week pay periods by contractor and employee

• Ranking contractors with rising overtime charges

• Contractors with significant jumps in labor rates

• Outliers in rates per hour• Sort contractor social security

numbers by ascending numbers.

Findings at Refinery

• The refinery was rejecting over 50 % of goods received from three vendors, due to poor quality. Two were small, but one represented a purchase relationship with one of the refinery’s largest vendors.

• Six invoices were all found for the same amounts from the same vendor on the same day – all for $1,044,000. Three invoices from the same vendor, on the same day, for the same items, each for $900,000

• One company had increased prices 581,700 percent and another that had increased prices during the four-year period by 331,879 percent. In total, there were 35 companies that had raised prices over 1,000 percent and 202 companies that had raised prices over 100 percent.

Findings at Refinery

• Six employees had the same addresses as vendors.

• There were 20 purchases over $100,000 where the quantity paid for was greater than the quantity received.

• From one vendor, the company paid $56,201 for items with unit prices of 19 cents and 12 cents each. The company did not need anywhere near this volume of these items.

Findings at Refinery

• There were four contractors whose employees were reported to have worked over 150 hours for over 20 consecutive 2-week pay periods. Employees of one company were submitting time cards from different locations for the same time periods. There was one contractor where employees had an average of 2,046 hours of overtime for the year.

• In examining the average rate per craft by company and employee, per-hour charges ranged from $56.11 to $15.43 per hour for the same craft.

Findings at Refinery

• There were seven companies whose invoices exceeded purchase order amounts by over $100,000. The largest difference was $713,791 on an original invoice of $21,621.

• Searching for vendors with sequential invoices revealed 19 vendors where over 50 percent of all invoices submitted were sequential. With one vendor, over 83 percent of the invoices submitted were sequential.

• There were three companies from which goods had been purchased with zero amount purchase orders. With all three companies, there were over 100 zero amount invoices.

• There were nine contractors with cost over-runs exceeding 50% and $100,000. The highest percentage cost over-run was 2431%

Thank You