1. #ibmiod IBM Intelligent Investigation Manager (IIM) Alvin Ng ECM Solutions, IBM

2. Please note IBM’s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM’s sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion. Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user’s job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here. 1

3. Acknowledgements and Disclaimers : © Copyright IBM Corporation 2012. All rights reserved. – U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. IBM, the IBM logo, ibm.com, DB2, WebSphere, and FileNet are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol (® or ™), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at “Copyright and trademark information” at www.ibm.com/legal/copytrade.shtmlwww.ibm.com/legal/copytrade.shtml Other company, product, or service names may be trademarks or service marks of others. Availability. References in this presentation to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. The workshops, sessions and materials have been prepared by IBM or the session speakers and reflect their own views. They are provided for informational purposes only, and are neither intended to, nor shall have the effect of being, legal or other guidance or advice to any participant. While efforts were made to verify the completeness and accuracy of the information contained in this presentation, it is provided AS-IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this presentation or any other materials. Nothing contained in this presentation is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. All customer examples described are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics may vary by customer. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results. 2

4. Agenda The challenge of fraud management IBM’s approach to fraud management Demonstration Overview of Intelligent Investigation Manager Summary 3

5. BANKING FBI reported that U.S. cybercrime had exceeded drug trafficking, and was estimated at more than $1 billion, in 2009. National Health Care Anti-fraud Association (NHCAA) estimates that between 3% and 10% of all claims in the US are fraudulent or abusive, in 2009 this was estimated at $65 billion, Latest national estimate for claims fraud in the U.S. is $79 billion. INSURANCE HEALTHCARE Sources: Banking – BBC News; Energy and Utilities – Electric Light and Power Magazine; Taxation – The Economist; Healthcare – National Health Care Anti-fraud Association; Insurance – Coalition Against Insurance Fraud; Warranties – Warranty Week; Worker’s Compensation – US Chamber of Commerce; Travel – Business Travel News,, Gartner Customers have stolen power for decades, costing utilities 1% to 3% of revenue — or about $6 billion industry-wide ENERGY and UTILITIES “U.S. organizations lose an estimated 7 percent of annual revenues to fraud… this percentage indicates a staggering estimate of losses around $994 billion among organizations, despite increased emphasis on anti- fraud controls and recent legislation to combat fraud.” - Association of Certified Fraud Examiners The IRS estimates that 15% of all taxes owed are never paid TAXATION Upwards of 10% to 15% of claims are in some way suspect WARRANTIES 25 percent of all workers compensation claims are fraudulent. WORKERS’ COMPENSATION The average expense reimbursement scheme now costs a company $60,000, lasting on average two years before detection. TRAVEL Fraud costs private and public sector enterprises hundreds of billions in revenues each year 4

6. © 2012 IBM Corporation IBM CONFIDENTIAL Fraud Use Cases Banking Insurance Public Sector Health Care Anti Money Laundering Online Fraud Account takeover Account skimming ATM Fraud Integrated Web Fraud Transactional Fraud Credit Cards Securities and stock Internal/Employee Fraud Loan Fraud Claims Fraud Cash for Crash Staged accidents / thefts Exaggerated claims Provider fraud Policy fraud Fake policies / documents Rate jumping Online fraud Internal / Employee fraud Fake policies / documents Pocketing premiums Workers Compensation Tax/Revenue IRS, SSA Healthcare Medicaid Medicare DoD others Food & Nutrition Programs Food Stamps WIC Compliance and Audit Departments Agencies Social Services Provider/Vendor Fraud Pharmaceutical Fraud Physician / Employee Fraud 5

7. © 2012 IBM Corporation IBM CONFIDENTIAL The information tidal wave is making it harder to apply analytics effectively, just when it matters most… A deluge of data – volume, variety, and velocity Inefficient Access Lack of Insight Variety of Information Volume of Digital Data Velocity of Decision Making Source: IBM Institute for Business Value “…40 exabytes of data created in 2008… more than created in the previous 5,000 years combined…”  Scope & Size of Data Sets  Complexity, Connectedness and Growth Rates  Context & Importance Of Integration Detecting and Investigating is becoming even more complicated Inability to Predict 6

8. Prevent Intervene if it appears the main purpose of the activity is to provide benefit to a fraudster Today: Little is done to prevent fraud from occurring Detect Detect if a transaction is likely a willful act to achieve financial gain through misrepresentation and/or falsification; and take steps to stop or send to Investigation Today: Relies heavily on people to detect Discover Continuous comparison of customer, account or transaction data to the data of cases known to be fraudulent in order to identify fraud that was not previously detected Today: Not really done Investigate Case management and visualization tools to aid investigators in building a case against fraudsters. Today: Special investigations unit with manual adjusters Managing fraud across its lifecycle Build a case for prosecution or denial of benefits Stop fraud before it is reported Detect fraud once it is reported – and react accordingly Discover fraud after it occurs Prevent Investigate Discover Detect Fraudster Report/ Monitor Model Learn 7

9. Introducing IBM Intelligent Investigation Manager A new solution for optimizing fraud investigation Leverages capabilities of IBM Case Manager, IBM i2 Fraud Intelligence Analysis and IBM Content Analytics Efficiently process cases and coordinate activity across the investigative team Conduct forensic analysis, generate leads, visualize the scope of the fraud and gather evidence. Capture results directly into the case. Discover new entities, patterns and insights by searching through structured and unstructured content Facilitate the management of the case including the handoff to supervisors, litigators or other authorities Provide transparency into the effectiveness of the investigative process using integrated KPI reporting and analytics Intelligent Investigation Manager provides key capabilities for the IBM Anti-fraud signature solutions 8

10. DiscoveryInvestigation & Remediation ReportingManage Data Detection IBM InfoSphere Identity Insight IBM Cognos IBM SPSS IBM Operational Decision Management IBM InfoSphere Information Server IBM Information Management Foundation Policy, Compliance, and Governance IBM i2 Fraud Intelligence Analysis IBM Content Analytics IBM Case Manager IBM Intelligent Investigations Manager IBM Technology applied to fraud management HEALTHCARE GOVERNMENT INTERNAL AUDIT INSURANCE Solutions BANKING Vendor Risk Mgmt Pharmaceutical fraud Tax and Revenue Social Services Customs Background checks Rate fraud Policy fraud Workers compensation KYC / AML First Party Account Takeover Employee fraud

11. Raw Data – Customer data, Transaction data, Account information Billing statements, Applications, correspondence Scores the claims daily “If a customer shows a relationship to someone on a watch list, generate an alert.” IBM Case Manager Case populated with alert details, Customer and account data, Billing statements, and alert History. Lead investigator triages the alerts. Creates Work item for forensic analysis” IBM i2 Uncovers a pattern of anomalous activity. Clarifies The relationship between K. Park and watch list person. Publishes evidence into case. IBM Content Analytics Crawls new claims, case histories, And other content. Extracts entities and adds them to the data repository. Nelson Claims, Nellson Claims… K. Park generates a watch list alert and is showing unusual account activity.” Risk Score: 565 Background checks reveal ties to terrorist organization. Case Histories Public Domain, Watch lists Correspondence Holds placed on accounts; SAR filed. A package is created For supervisor review Example in banking: Transactional Fraud (first party fraud) 10

12. Demo Scenario

13. Intelligent Investigation Manager Components IBM Case Manager for delivering customizing investigative solutions that enable investigative teams to efficiently manage an investigation IBM i2 Fraud Intelligence Analysis for conducting forensic analysis in the context of the investigation IBM Content Analytics for driving the discovery process across all available data during the investigation IBM i2 FIA IBM Content Analytics IBM Advanced Case Manager IBM Intelligent Investigations Manager 12 Available through the Industry Solutions Asset Library

14. IBM Intelligent Investigation Manager Intelligent Investigation Manager packaging IIM assets IBM i2 Intelligent Analysis Platform ICM Investigation Services Case Manager Plugin IBM i2 Analyst’s Notebook (iANB) IBM Case Manager I2 investigation services I2 investigation services Existing Products Intelligent Investigation solution pkg Intelligent Investigation solution pkg SPSS Decision Management SPSS Decision Management IBM Identity Insights IBM Identity Insights Optional add-on software IBM i2 Fraud Investigation Analysis IBM Content Analytics 13

15. 14 IBM Case Manager Simplifying the delivery of investigative solutions Built on IBM FileNet P8 Business Process Manager Includes Content Analytics, WebSphere ILOG jRules, Cognos RTM, Lotus Sametime and Mashups – for use within case solutions Extensible to the entire ECM portfolio Deep integration to WebSphere Process Server for connectivity 14

16. IBM i2 Fraud Intelligence Analysis Information  Intelligence  Action…… …to investigate, document and disrupt complex fraud 15

17. Content Analytics enables agencies to ingest, search and analyze unstructured and structured data from multiple sources Content Analytics for Fraud Investigation Enables investigators to ingest and analyze investigative documents Correlation of data Correlate unstructured information (reports, notes) to structural systems Analysis of unstructured information Derive and identify new trends, patterns and anomalies Connections between structured and unstructured data Provide a 360-degree view of suspects and relationships Advanced analytical features Semantic searching, risk alerting, SNA etc… help turn volumes of data into a wealth of insights 16

18. The value of case management to fraud investigation Provides more efficiency and transparency to the investigative process Provides coordination and management of overall investigation o Routing of work to investigative team o Integration of collaborative elements o Management of investigation documents o Support for ad-hoc work that occurs during an investigation Preparation of ‘case ready’ reports for negotiation or prosecution Improve efficiencies o KPIs – investigations, $ saved o As the investigation is occurring o After the investigation has completed 17

19. The value of forensic analysis… Improve context by delivering more insight into the relationships between data points o Model does not show correlations between individuals Visualizes connections that otherwise would have to be picked up the case investigator Allows analysts to be more effective – ability to receive deeper insight into investigation process o Provides evidence/output for criminal or civil prosecution

20. Intelligence Analysis and Content Analytics Fraud Intelligence Analysis Any data source Risk scorecard Cross channel analysis Multi-stakeholder investigation Role based briefing Content Analytics Configure raw internal and external content Process with natural language processing and enhanced content analytics Understand trends, patterns, correlations, anomalies, more Visualize suspected fraud characteristics Visual analysis using entity link tools Detection and forensic analysis Search/ Mine structured & unstructured sources Investigation/enrichment of intelligence Intelligence dissemination, reporting Enhances i2 Fraud Intelligence Analysis Search, analyze and extract entities from unstructured data and deliver to Identity Insight for normalization Discover suspicious patterns in unstructured data Flexible search, visualization and exploration across structured and unstructured data Analytics on identities and relationships pre- calculated and perpetually updated Scales to big data volumes and available for real- time text and content analytics 19

21. IBM’s unparalleled capabilities in Security and Fraud Industry Recognition 2011 Top Analytics and Business Intelligence Service Provider (Gartner Group) 2010 Best Security Company (SC Magazine) 2009 #1 Identity and Access Management (IDC Market Share Leadership) 2011 Dynamic Case Management Strategy Leader (Forester Report) 2008 Leading analytic model solution (last Gartner Group Report) Broad and Deep Domain Expertise Broad expertise & experience across all of Financial Crimes (AML, Fraud, Case Management, Sanctions, Governance, Enterprise Risk, Identity and Access Mgmt) Tested reference models for financial crimes (architecture, workflows, business processes, risk assessments, scoring models, scenarios, IAM) Proven IBM-WWPMM project management methodology System Implementation Accelerators Capabilities and Experience 1500 Risk & Compliance consultants globally who have actually developed parts of the key solutions in the industry 125-person Risk and Compliance CoE 100-person Analytics CoE, 75% of whom had graduate or Ph.D. level degrees in related fields, growing at 25% annually 7 IBM Research Labs worldwide, producing cutting-edge analytical methods and solutions 9 Security Research Centers (two more under construction) and 11 Security Development Labs Over 900 Professional Security Consultants Proven Track Record Delivered measurable results in our past engagements Managed entire lifecycle of implementations with ability to establish strong project management and governance Deep relationships with top Financial Institutions around the globe Existing Relationship Local team of industry consultants who have prior experience at your institution across numerous projects Dedicated team within IBM focused on understanding your architecture and current business challenges in order to identify solutions 20

22. How it works IBM Smarter Analytics Signature Solution Anti-Fraud, Waste and Abuse Information Management Foundation Trusted Data Integration & Delivery Business Intelligence Workload Management Enterprise Data Security & Compliance Assess Vulnerability Identify significant schemes and vulnerabilities Build and test predictive models Measure financial and reputational risk Manage case load, investigate suspects Assign, manage cases Monitor case load Analyze case intelligence Conduct link analysis Document & share case intelligence Enforce compliance plan Measure results Feedback results for closed loop learning Detect and Stop Fraud Generate smart business rules based on statistical scoring and outlier detection Generate highly-sophisticated predictive models Real-time scoring Integrate rules and models with claims processing systems Take direct and pre-emptive action Identify and intercept suspicious cases, pre-payment Advanced analytics used to detect fraud, manage case volume, investigate fraud schemes and support prosecution 21

23. DiscoveryInvestigation & Remediation ReportingManage Data Detection IBM InfoSphere Identity Insight IBM Cognos IBM SPSS IBM Operational Decision Management IBM InfoSphere Information Server IBM Information Management Foundation Policy, Compliance, and Governance IBM i2 IBM Content Analytics IBM Advanced Case Manager IBM Intelligent Investigations Manager HEALTHCARE TAX/REVENUEINTERNAL AUDIT CUSTOMS INSURANCE SOCIAL SERVICES Fraud Use Case Libraries and Templates GBS Services & Intellectual Property BANKING IBM Smarter Analytics Signature Solution – Anti-Fraud, Waste & Abuse 22

24. Intelligent Investigation Manager Components 23

25. About Intelligent Investigation Manager Intelligent Investigation Manager Components Intelligent Investigation Manager Assets include two parts: o i2 asset to be deployed on ANB and IAP o ICM asset to be deployed on ICM The assets bridge i2 and ICM systems for investigation collaboration between analysts (who work on i2) and case worker (who work on ICM) IBM i2 Intelligence Analysis Platform IBM i2 Analyst's NoteBook Premium Intelligent Investigation Manager Assets IBM Content Analytics IBM Case Manager Product Asset

26. 25

27. 26