Use of Technology (ACL) in Audits

Agenda Overview of Generalized Audit Software Overview of Generalized Audit Software How to Get Started How to Get Started Getting Basic File Information Getting Basic File Information Looking for Anomalies Looking for Anomalies Detailed Transaction Analysis Detailed Transaction Analysis Example – Procurement Card Case Study Example – Procurement Card Case Study

Overview What does it do? Allows auditors to extract and analyze data independent of programmers and auditees Allows auditors to extract and analyze data independent of programmers and auditees Summarizes large amounts of data Summarizes large amounts of data 100% testing of large populations 100% testing of large populations –Increases probability of detecting errors and omissions –Increases probability of detecting fraud

Getting Started Know Your Data! Know where to get it Know where to get it –Platform (PC/mainframe/other) and format –Quantity and extract options –Knowledgeable staff Know what it should look like Know what it should look like –Important fields –Statistical expectations Check key fields for validity Check key fields for validity –Numeric / alphanumeric –Blank / non-blank –Valid codes

Get Basic Information Generate summaries and statistics on key fields Generate summaries and statistics on key fields –Record count –Totals and key subtotals –Average, maximum, minimum values Run “overview” reports (Classify, Summarize) Run “overview” reports (Classify, Summarize)

Look for Anomalies Exception reports Exception reports Statistical deviance and digital analysis Statistical deviance and digital analysis –Benford’s Law –Rounding of amounts –Even dollar amounts Stuff to Read: Using Audit Tools Case Studies Digital Analysis

Look for Anomalies

Detailed Transaction Analysis Extract “suspect” records for review Extract “suspect” records for review Select statistically valid sample for review and extract Select statistically valid sample for review and extract

ACL Exercises Go to: Download all files. Open CARDUSE.ACL using ACL Workbook and follow instructions in EXERCISES.DOC.

Example Procurement Card Fraud Background Fiscal Year 2000 Audit Plan – Spot Check Fiscal Year 2000 Audit Plan – Spot Check Procurement Card Program Fiscal Year 99 Procurement Card Program Fiscal Year 99 Follow up to 1997 audit Follow up to 1997 audit Statistics Statistics –Over 300 departments and 1,680 cards –281,000 transactions (through 5/31/2002) (78,463 in FY01, 63,559 in FY02 through 5/31) –$41.3M ($12.0M in FY01, $9.3M in FY02 through 5/31)

Obtaining Data for Analysis Card Data Transaction Data Merchant Classes Accounting/Payment Data Data from Bank of America Data from UT Accounting System Merged Transaction Data File in ACL

Data Analysis Using ACL Summaries & Statistics  High volume cardholders  High dollar cardholders  High volume merchants  High dollar merchants Exceptions & Anomalies  Policy violations  Other unusual transactions

Created reports based on merchant class code to identify unusual types of purchases International itemsClothing storesPets GasFlowersBicycle shop GiftsCharitiesSchools Equipment RentalCollegesTravel-related Postal ServiceUtilities (including telephone services) InternetGrocery stores TransportationAntiques Policy Violations Type of Purchase

Other Policy Violations and Unusual Transactions Transactions over $ limit Transactions over $ limit Split Orders – multiple transactions to single vendor on single day with total amount over $ Split Orders – multiple transactions to single vendor on single day with total amount over $ Even dollar amounts Even dollar amounts Sales tax paid to Texas merchants Sales tax paid to Texas merchants

Match Suspect Transactions to Accounting Records Complicated account postings and transfers between accounts Complicated account postings and transfers between accounts Matched dollar amounts and dates using ACL’s Duplicate function to identify movement of funds between accounts Matched dollar amounts and dates using ACL’s Duplicate function to identify movement of funds between accounts Scrutinized electronic routing and approval of electronic payment documents to identify weaknesses in segregation of duties and/or insufficient account/transaction reviews Scrutinized electronic routing and approval of electronic payment documents to identify weaknesses in segregation of duties and/or insufficient account/transaction reviews

Initial Investigation n Reviewed Existing Reports n Ran Additional Reports - Single Card Use n Collection of Receipts n Meeting with Principal Investigators n Personnel Actions n Secure Electronic Hardware/ Files/ etc. n Coordination with Police and District Attorney’s Office n Arrest of subject

Compilation of Evidence n Problems Card Use (10/97 - 4/00) Card Use (10/97 - 4/00) Transactions: 1,840Transactions: 1,840 Volume: $209,403Volume: $209,403 Post 4/99 Receipts Destroyed (65%) Post 4/99 Receipts Destroyed (65%) Complicated Account Postings Complicated Account Postings Number/Type of Vendors Number/Type of Vendors

Compilation of Evidence n Approach 3Document Each Transaction 3Evaluate Source Documents: Original receiptOriginal receipt Receipt copy - On request or by subpoenaReceipt copy - On request or by subpoena Vendor web sites - order history & account infoVendor web sites - order history & account info purchase & shipping confirmations purchase & shipping confirmations

Compilation of Evidence n Case I 3Receipts 3Online order history 3 confirmations 3Returns for credit on personal cards n Case II 3Receipt with forgery 3Online order history 3 confirmations

n Case I - Receipts

n Case I – Online Order History

n Case I – Confirmation

n Case I – Returns Order Return Credit

n Case II – Receipt With Forgery Forged Receipt

n Case II – Receipt With Forgery Actual Receipt Forged Receipt

Control Issues Separation of Duties Separation of Duties Sharing of Passwords Sharing of Passwords Account Reconciliations Account Reconciliations Minimal Account Reviews Minimal Account Reviews

Corrective Steps n Letters to Deans, Directors, Principal Investigators, etc. n Follow-up Confirmations to Hierarchical Groups n Improvement of Control Structure n On-going Part of Compliance Program

Improvement of Control Structure Website Information Website Informationhttp:// Testing of new cardholders Testing of new cardholdershttp:// Tightened card use limits Tightened card use limits Review/acknowledge voucher approval Review/acknowledge voucher approval

On-going Compliance Activities Inclusion in Compliance Verification System Inclusion in Compliance Verification System Approvals of monthly vouchers Approvals of monthly vouchers Quarterly reviews using ACL Quarterly reviews using ACL

Quarterly ACL Reviews Card Use Reports Card Use Reports –Ranks by $ amount –Ranks by # transactions

Card Use Summary

Quarterly ACL Reviews Card Use Reports Card Use Reports –Ranks by $ amount –Ranks by # transactions Compliance/Miscellaneous Reports Compliance/Miscellaneous Reports –Transactions > $ –Potential Split Orders –Posting delays > 30 days

Compliance/Misc. Summary

Quarterly ACL Reviews Card Use Reports Card Use Reports –Ranks by $ amount –Ranks by # transactions Compliance/Miscellaneous Reports Compliance/Miscellaneous Reports –Transactions > $ –Potential Split Orders –Posting delays > 30 days College/Department Level Reports College/Department Level Reports

Quarterly ACL Reviews Merchant Summary Reports Merchant Summary Reports –High $ Merchants –“Suspect” Merchants –Merchant Types Specific Card Investigations/Watches Specific Card Investigations/Watches

Procard Review Procedures Reports Reports Coordination with Other Departments Coordination with Other Departments –Internal Audits –Purchasing –Accounts Payable Follow-up Follow-up