essentials of using data analytics in forensic and fraud audits

Copyright © FraudResourcNet LLC

Essentials of Using Data Analytics To Conduct Forensic and Fraud Audits

Special Guest Presenter: David Zweighaft, CPA/CFF, CFE, DSZ Forensic Accounting & Consulting Services LLC

Jan. 29, 2014

Copyright © 2013 FraudResourceNet™ LLC

About Peter Goldmann, MSc., CFE

President and Founder of White Collar Crime 101

Publisher of White-Collar Crime FighterDeveloper of FraudAware® Anti-Fraud Training

Monthly Columnist, The Fraud Examiner, ACFE Newsletter

Member of Editorial Advisory Board, ACFE Author of “Fraud in the Markets”

Explains how fraud fueled the financial crisis.


About Jim Kaplan, MSc, CIA, CFE

President and Founder of AuditNet®, the global resource for auditors (now available on Apple and Android devices)

Auditor, Web Site Guru,

Internet for Auditors Pioneer

Recipient of the IIA’s 2007 Bradford Cadmus Memorial Award.

Author of “The Auditor’s Guide to Internet Resources” 2nd Edition


About David Zweighaft CPA/CFF, CFE

Principal at DSZ Forensic Accounting & Consulting Services LLC

David has been practicing Litigation Consulting and Forensic Accounting for over 20 years

Assisted the US Dept. of Justice in identifying and tracing asserts

He managed the largest Swiss bank Holocaust Asset investigation in New York for the NYS Banking Department


Webinar Housekeeping This webinar and its material are the property of FraudResourceNet

LLC. Unauthorized usage or recording of this webinar or any of its material is strictly forbidden. We are recording the webinar and you will be provided with a link access to that recording as detailed below. Downloading or otherwise duplicating the webinar recording is expressly prohibited.

Webinar recording link will be sent via email within 5-7 business days. NASBA rules require us to ask polling questions during the Webinar and

CPE certificates will be sent via email to those who answer ALL the polling questions

The CPE certificates and link to the recording will be sent to the email address you registered with in GTW. We are not responsible for delivery problems due to spam filters, attachment restrictions or other controls in place for your email client.

Submit questions via the chat box on your screen and we will answer them either during or at the conclusion.

After the Webinar is over you will have an opportunity to provide feedback. Please complete the feedback questionnaire to help us continuously improve our Webinars

If GTW stops working you may need to close and restart. You can always dial in and listen and follow along with the handout.


Disclaimers

5

The views expressed by the presenters do not necessarily represent the views, positions, or opinions of FraudResourceNet LLC (FRN) or the presenters’ respective organizations. These materials, and the oral presentation accompanying them, are for educational purposes only and do not constitute accounting or legal advice or create an accountant-client relationship.

While FRN makes every effort to ensure information is accurate and complete, FRN makes no representations, guarantees, or warranties as to the accuracy or completeness of the information provided via this presentation. FRN specifically disclaims all liability for any claims or damages that may result from the information contained in this presentation, including any websites maintained by third parties and linked to the FRN website

Any mention of commercial products is for information only; it does not imply recommendation or endorsement by FraudResourceNet LLC


Agenda

Introduction

Standards & Essentials

What is a “Forensic Audit”?

Pre-Planning & Brainstorming

Data Analysis Tools to Manage Big Data

Data Analysis Techniques

6


Fraud: The Big Picture

According to major accounting firms, professional fraud examiners and law enforcement:

Fraud jumps significantly during tough economic times

Business losses due to fraud increased 20% in last 12 months, from $1.4 million to $1.7 million per billion dollars of sales. (Kroll 2010/2011 Global Fraud Report)

Average cost to for each incident of fraud is $160,000 (ACFE) Of Financial Statement fraud: $2 million

Approx. 67% of corporate fraud committed by insiders (Kroll)

Approx. 50% of employees who commit fraud have been with their employers for over 5 years (ACFE)


Data Analytics: Introduction


Data Analytics: Introduction


Analytics in Audit Planning



From SAS 99, “Consideration of Fraud in a Financial Statement Audit”:Discussion Among Engagement Personnel Regarding the Risks of Material Misstatement Due to Fraud…

Prior to or in conjunction with the information-gathering proceduresdescribed [this document], members of the audit team should discuss the potential for material misstatement due to fraud. The discussion should include:An exchange of ideas or "brainstorming" among the audit team members,including the auditor with final responsibility for the audit, about how and where they believe the entity's financial statements might besusceptible to material misstatement due to fraud, how managementcould perpetrate and conceal fraudulent financial reporting, and howassets of the entity could be misappropriated.

Continued…


Identifying the Detailed Payroll Transaction Data

TYPES OF FRAUD RISK Financial Reporting Risk

(1) Tone set by top management, (2) internal accounting and audit functions, (3) Audit committee, (4) management and audit committee reports, (5) practice of seeking second opinions from independent public accountants, and (6) quarterly reporting. Operational risk

Risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. Operational risk is the amount of exposure an organization has as a result of its operational structure. This includes risk due to processes, organizations, and technologies. Strategic Risk

The risk associated with future business plans and strategies. This risk category includes plans for entering new business lines, expanding existing services through mergers and acquisitions, and enhancing infrastructure (e.g., physical plant and equipment and information technology and networking). Strategic plans that include market expansion or addition of new products.


Identifying the Detailed Payroll Transaction Data

TYPES OF FRAUD RISK (continued)

Reputation RiskBusiness reputation is established by gaining and retaining the confidence and trust of the stakeholders in the business: customers, suppliers and employees, as well as shareholders. Reputation is gained over time. Regulatory/Compliance RiskRisk of Civil and Criminal violations. Regulatory risk, a term describing the problems arising from new or existing regulations, is now one of the greatest threats to business. Compliance with regulatory requirements and ethical conduct standards is a major concern of Boards of Directors and Audit Committees.



Common Fraud Scenarios, or “If I were going tocommit fraud, I’d….”

Per SAS 99, PCAOB, AS 2 and 5, fraud risk must be considered using a Common Fraud Scenario approach.

This allows the auditor to enlist the detailed knowledge of the stakeholders in the organization in identifying and prioritizing fraud risks at both the entity, process and account levels.



Common Fraud Scenarios, or “If I were going tocommit fraud, I’d….”

Fraud Scenarios – Treasury – Cash

Executive management in Australia sets up two bank accounts for deposit of COMPANY receipts. Funds deposited to the first account is reported to COMPANY Corporate headquarters. Funds deposited to the second account are used for the personal pleasure of Executive management in Australia. Bank reconciliations are conducted by COMPANY Executive management in Australia and no other accounting is reported to COMPANY headquarters Continued


Polling Question 1

Detecting ghost employees is NOT one of the areas best suited for using data analyticsa. True b. False



Common Fraud Scenarios, or “If I were going to commit fraud, I’d….”Fraud Scenario – Tax LawBribes are paid to tax authorities in China to reduce outstanding liabilities and/or audit adjustments. The bribe payments are disguised as consulting or contracting expense.Fraud Scenarios - PayrollThe payroll analyst records time and attendance and a salary of $500,000.00 per year for her boyfriend who never worked at XXXX. Subsequent to the time the payroll information is sent to ADP but prior to the time the payroll report is reviewed by the Payroll Supervisor, the payroll analyst reverses the entry. The disbursement to the boyfriend is made by ADP but does not show up on payroll reports.



Identifying and Prioritizing Fraud Risk

By brainstorming the types of fraud schemes the organization is potentially vulnerable to, the team and the stakeholders can make estimates of …

i) Vulnerability - how likely the occurrence of these schemes are (very low to very high), and

ii) Magnitude - what is the potential qualitative impact (very low to very high).

Using the vulnerability criteria discussed previously, auditors can produce a risk “heat map” that can assist in identifying HIGH RISK accounts and processes.



Controls, testing, monitoring & reporting are very effective; no previous adverse experience, very significant skills influence & knowledge to mitigate risk

Very Low 1

Remote Controls, testing, monitoring & reporting are effective; previous minor adverse experience, significant skills, influence & knowledge to mitigate risk; and/or no process or system issue.

Low 2

Reasonably Possible

Controls, testing, monitoring & reporting are somewhat effective; previous moderate adverse experience, minor skills, influence & knowledge to mitigate risk; and/or moderate process or system issue.

Medium 3

Probable Controls, testing, monitoring & reporting are minimally effective; previous major adverse experience; limited skills, influence & knowledge to mitigate risk; and/or major process or system issue.

High 4

Almost Certain

Very High

Probability Per Occurrence

Vulnerability Description Descriptor Level

5

Rare

Controls, testing, monitoring & reporting are non-existent or ineffective; previous significant adverse experience; lack of skills, influence & knowledge to mitigate risk; and/or significant process or system issue.



< $500,000 Insignificant business impact, low financial loss

Very Low 1

> $500,000 to < $1 million

Business impact easily mitigated, medium/low financial loss

Low 2

> $1 million < $5 million

Business impact may require (mainly internal) additional resources, medium/high financial loss

Medium 3

> $5 million to < $20 million

Business impact requires significant additional resources to mitigate (internal or external), high financial loss

High 4

> $20 million High damage control requiring public / regulatory communication, huge financial loss, fraud perpetrated by senior mgmt

Very High 5

Business Impact Per Occurrence

Magnitude Description Descriptor Level



1

2

3

4

5

6

7

8 9

10

11

12

13

14

15

16

17

18

1920

0 GA

0

2

4

6

8

10

12

14

16

18

0 2 4 6 8 10 12 14 16 18 20

Vu

lner

abili

ty

Magnitude

Identification & Prioritization of Fraud Risk 1 Facilities

2 Fixed Assets

3 Inventory

4 Information Technology

5 CATS-A/P

6 CATS-Procurement

7 Customer Support

8 Direct Sales

9 Entity Level Controls

10 Finance-Accounting

11Finance-Payroll

12 Finance Regulatory

13 Finance Tax

14 Finance-TreasuryCash15 HR-Benefits

16 Indirect Sales

17 Law

18 Marketing

19 R&D

20 Sales

0 GALow Magnitude/Low Vulnerability

High Magnitude/High VulnerabilityHigh Vulnerability/Low Magnitude

High Magnitude/Low Vulnerability


Polling Question 2

Who should participate in the identification and prioritization of fraud exercise?a. Financeb. Legalc. Internal Auditd. All of the above



Identify Relevant Data Sources within the organization:

Financial – General Ledger, Sub Ledgers, Payroll

Non-Financial – Personnel files, Access logs, Emails, Vendor Files

Assess Resources Needed for the Audit:

Staffing – Headcount, locations

Skills – Languages, Experience, Expertise (CFEs, IT skills)

Tools – Computer Automated Analytic Tools (CAATs) Software

Identify data sources Analyze dataAreas or issues of focus Interpret dataCollect or gather data Monitor resultsPrepare data (“data normalization”)

Identify issues for further research or investigation


Data Analysis - Forensic Audit

Data Analysis Techniques



Analytical Approaches to Planning

Industry Comparatives – Benchmarking

Time Series (Horizontal) Analysis

Common Size (Vertical) Analysis



Analytical Approaches to Planning

Vertical – a/k/a “common-sized statements”Analyzes each line as a % of its relevant totalIncome items as a % of total revenueExpenses as a % of total expense

Identifies disproportionate items Identifies fluctuations between periods

Horizontal – a/k/a “time-series analysis”Measures $ and % changes from period to periodIdentifies fluctuations and seasonality


Demo Horizontal & Vertical Analysis

Demo: Performing Financial Statement Analyses

Learn How to:

Identify patterns and anomalies in financial statements


Demo Account Reconciliations

Demo: Converting and Matching Sub ledger Data to the General Ledger

Learn How to:

Extract data from legacy systems and reconcile to General Ledger data



Top-Down vs. Bottom-Up Approach

Depending on the area being audited, the auditor may choose between

Top-Down Approach – Best for entity-level controls and compliance policies Code of conduct issues Corporate Governance Vendor selection policies

Bottom-Up Approach – Best for process-level and account detail testing Travel & Expense reporting Cash disbursements and approvals


Polling Question 3

When comparing companies in the same industry, which analytic tool is least helpful?a. Industry benchmarks b. Time series analysisc. Common-sized statementsd. None of the above


Data Analysis - Forensic Audit

Data Analysis Tools To Manage Big Data


Analytics in Forensic Audits

BIG DATAForget the cloud; Big Data is the new thing. Here are some commonly available tools to help manage, analyze and present findings:

ACL or IDEA – data interrogator, capable of extracting information from a variety of file formats. Can run pre-scripted tests and handle unlimited amount of data. Interfaces with Excel and Access.

MICROSOFT ACCESS – database program, programmable input screens, data validation, ad hoc queries and formatted report outputs.

MICROSOFT EXCEL– spreadsheet program, versatile and almost universally accepted business and data analysis tool. Pivot tables can present field-by-field analytical views of huge data files


Case Study Background

Hey Big SpenderEmbezzled union retirement funds

Cost to the Company: $42.6 M over 6 years

Fraudster Profile

Fund Administrator; Female

Wrote checks to herself and her family

Used multiple credit card accounts for friends & family

No monitoring or oversight of her work

Spent money on travel, cars, horses, jeweler


Demo Pivot Tables

Demo: Presenting Big Data

Learn How to:

Present Travel & Expense Fraud findings using Pivot Tables


Polling Question 4

Detecting lack of segregation of duties is NOT one of the areas best suited for using data analyticsa. True b. False



The Out-of-Control Controller

Perpetrator failed to reconcile accounts

Cost to the Company: $6.8 M over 4 years

Fraudster Profile

Financial Operations Sr VP; Male

Prepared fictitious support for account reconciliations

Directed staff to post fraudulent J/Es to the G/L

No monitoring or oversight of his work



The Out-of-Control Controller (cont’d)

Additional Tests – Segregation of Duties

Matching Journal Entry originators to authorizers

Identifying E-mails to staff instructing them to post fictitious Journal Entries


Demo Account Reconciliations

Demo: Matching Data Fields for Segregation of Duties Testing

Learn How to:

Match Journal Entry Initiators to Authorizers to identify SOD violations


Polling Question 5

The best approach for using data analytics for auditing at the process level is:a. Bottom-up approachb. Top-down approachc. Aggregated approachd. None of the above


Questions?

Any Questions?Don’t be Shy!


Thank You!

Peter GoldmannFraudResourceNet LLC

800-440-2261www.fraudresourcenet.com

[email protected]

Jim KaplanFraudResourceNet LLC

800-385-1625 www.fraudresourcenet.com

[email protected]

David ZweighaftDSZ Forensic Accounting Services LLC

212-699-0901Email: [email protected]

http://www.dszforensic.com


Coming Up

February Anti-Fraud Webinars…

"Fraud in Not-for-Profit Organizations: Detection and Prevention Best Practices”, Feb. 13

"Is Your Payroll Being Plundered? Using Data Analytics to Uncover Fraud ”, Feb. 17

Sign up at:

http://www.fraudresourcenet.com

essentials of using data analytics in forensic and fraud audits

Business

case study

material misstatement

consulting

common fraud

demo account

pivot tables

financial

data analysis