1. Joint meeting of RDU IIA and ISACA November 11, 2008, Capitol Club, Raleigh, North Carolina Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Slide Slide 1 ProcurementFraud Procurement Fraud Detection and Prevention November 11, 2008 Mike Blakley

2. Slide 2 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Session objectives 1.Current trends, techniques and best practices 2.Understand statistical basis for analysis 3.Procurement cards (p- cards) 4.Understand use of Excel

3. Slide 3 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Top Six Indicators That you might have a fraud 6. System designed to do “three way match”, but only does two way 5. Procurement software system doesn’t do a match 4. When auditors ask to help them out, they point to the door 3. No procurement software system 2. Procurement clerk drives a Porsche 1. Clerk’s kids drive Porsches between mountain home and beach home

4. Slide 4 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Overview Fraud patterns detectable with digital analysis Basis for digital analysis approach Usage examples Using Excel

5. Slide 5 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC The Why and How Two brief examples IIA Guidance Paper Auditors “Top 10” Process Overview Who, What, Why, When & Where Objective 1

6. Slide 6 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Example 1 School Bus Transportation Fraud Supplier Kickback – School Bus parts $5 million Jail sentences Period of years Objective 1

7. Slide 7 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Regression Analysis Stepwise to find relationships –Forwards –Backwards Intervals –Confidence –Prediction Objective 1

8. Slide 8 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Data outliers Objective 1 Sometimes an “out and out Liar” But how do you detect it?

9. Slide 9 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Data Outliers Plot transportation costs vs. number of buses “Drill down” on costs –Preventive maintenance –Fuel –Inspection Objective 1

10. Slide 10 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Scatter plot with prediction and confidence intervals

11. Slide 11 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Medicare HIV Infusion Costs Objective 1 CMS Report for 2005 South Florida - $2.2 Billion Rest of the country combined - $.1 Billion

12. Slide 12 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Pareto Chart Objective 1

13. Slide 13 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Guidance Paper A proposed implementation approach “Managing the Business Risk of Fraud: A Practical Guide” http://tinyurl.com/3ldfza http://tinyurl.com/3ldfza Five Principles Fraud Detection Coordinated Investigation Approach Objective 1

14. Slide 14 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Managing the Business Risk of Fraud: A Practical Guide IIA, AICPA and ACFE Report issued 5/2008 Section 5 – Fraud Detection Objective 1

15. Slide 15 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Section 5 – Fraud Detection Detective Controls Process Controls Anonymous Reporting Internal Auditing Proactive Fraud Detection Objective 1

16. Slide 16 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Proactive Fraud Detection Data Analysis to identify: –Anomalies –Trends –Risk indicators Objective 1

17. Slide 17 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Specific Examples Cited Journal entries – suspicious transactions Identification of relationships Benford’s Law Continuous monitoring Objective 1

18. Slide 18 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Data Analysis enhances ability to detect fraud Identify hidden relationships Identify suspicious transactions Assess effectiveness of internal controls Monitor fraud threats Analyze millions of transactions Objective 1

19. Slide 19 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Peeling the Onion Fraud Items Possible Error Conditions Population as Whole Objective 1c

20. Slide 20 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Fraud Pattern Detection Target Group Round Numbers Benford’s Law GapsUnivariateDuplicatesDay of WeekHolidayTrend LineStratification Market Basket Objective 1d

21. Slide 21 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Who Uses Analytics Traditionally, IT specialists With appropriate tools, audit generalists (CAATs) Growing trend of business analytics Essential component of continuous monitoring Objective 1e

22. Slide 22 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Analytics – what is it? Using software to: –Classify –Quantify –Compare Both numeric and non- numeric data Objective 1e

23. Slide 23 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC How - Assessing fraud risk Basis is quantification Software can do the “leg work” Statistical measures of difference –C–Chi square –K–Kolmogorov-Smirnov –D–D-statistic Specific approaches Objective 1e

24. Slide 24 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Why - Advantages Automated process Handle large data populations Objective, quantifiable metrics Can be part of continuous monitoring Can produce useful business analytics 100% testing is possible Quantify risk Repeatable process Objective 1e

25. Slide 25 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Why - Disadvantages Costly (time and software costs) Learning curve Requires specialized knowledge Objective 1e

26. Slide 26 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC When to Use Analytics Traditional – intermittent (one off) Trend is to use it as often as possible Continuous monitoring Scheduled processing Objective 1e

27. Slide 27 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Where Is It Applicable? Any organization with data in digital format, and especially if: –Volumes are large –Data structures are complex –Potential for fraud exists Objective 1e

28. Slide 28 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Objective 1 Summarized Two brief examples IIA Guidance Paper “Top 10” Metrics Process Overview Objective 1

29. Slide 29 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Objective 1 - Summarized 1.Understand why and how 2.Understand statistical basis for quantifying differences 3.Identify ten general tools and techniques Next is the basis …

30. Slide 30 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Basis for Pattern Detection Analytical review Isolate the “significant few” Detection of errors Quantified approach Objective 2

31. Slide 31 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Trapping anomalies Objective 3 Objective 2

32. Slide 32 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Understanding the Basis Quantified Approach Population vs. Groups Measuring the Difference Stat 101 – Counts, Totals, Chi Square and K-S The metrics used Objective 2

33. Slide 33 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Quantified Approach Based on measureable differences Population vs. Group “Shotgun” technique Objective 2a

34. Slide 34 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Detection of Fraud Characteristics Something is different than expected Objective 2a

35. Slide 35 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Fraud patterns Common theme – “something is different” Groups Group pattern is different than overall population Objective 2b

36. Slide 36 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Measurement Basis Transaction counts Transaction amounts Objective 2c

37. Slide 37 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC How is digital analysis done? Comparison of group with population as a whole Can be based on either counts or amounts Difference is measured Groups can then be ranked using a selected measure High difference = possible error/fraud Objective 2d

38. Slide 38 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Histograms Attributes tallied and categorized into “bins” Counts or sums of amounts Objective 2d

39. Slide 39 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Two histograms obtained Population and group Objective 2d

40. Slide 40 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Compute Cumulative Amount for each Objective 2d

41. Slide 41 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Are the histograms different? Two statistical measures of difference Chi Squared (counts) K-S (distribution) Both yield a difference metric Objective 2d

42. Slide 42 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Chi Squared Classic test on data in a table Answers the question – are the rows/columns different Some limitations on when it can be applied Objective 2d

43. Slide 43 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Chi Squared Table of Counts Degrees of Freedom Chi Squared Value P-statistic Computationally intensive Objective 2d

44. Slide 44 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Kolmogorov-Smirnov Two Russian mathematicians Comparison of distributions Metric is the “d-statistic” Objective 2d

45. Slide 45 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC How is K-S test done? Four step process 1.For each cluster element determine percentage 2.Then calculate cumulative percentage 3.Compare the differences in cumulative percentages 4.Identify the largest difference Objective 2d

46. Slide 46 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Kolmogorov-Smirnov Objective 2d - KS

47. Slide 47 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Classification by metrics Stratification Day of week Happens on holiday Round numbers Variability Benford’s Law Trend lines Relationships (market basket) Gaps Duplicates Objective 2e

48. Slide 48 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Fraud Pattern Detection Target Group Round Numbers Benford’s Law GapsUnivariateDuplicatesDay of WeekHolidayTrend LineStratification Market Basket Objective 3

49. Slide 49 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC What can be detected Made up numbers – e.g. falsified inventory counts, tax return schedules Objective 2

50. Slide 50 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Benford’s Law using Excel Basic formula is “=log(1+(1/N))” Workbook with formulae available at http://tinyurl.com/4vmcfs http://tinyurl.com/4vmcfs Obtain leading digits using “Left” function, e.g. left(Cell,1) Objective 2

51. Slide 51 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Made up numbers Benford’s Law Check Chi Square and d-statistic First 1,2,3 digits Last 1,2 digits Second digit Sources for more info

52. Slide 52 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC How is it done? Decide type of test – (first 1-3 digits, last 1-2 digit etc) For each group, count number of observations for each digit pattern Prepare histogram Based on total count, compute expected values For the group, compute Chi Square and d-stat Sort descending by metric (chi square/d-stat) Objective 2

53. Slide 53 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Invoice Amounts tested with Benford’s law - Example Results During tests of invoices by store, two stores, 324 and 563 have significantly more differences than any other store as measured by Benford’s Law. StoreHi DigitChi SqD-stat 324795,2340.9802 563894,7350.97023 432234760.321 217743120.2189 Objective 2

54. Slide 54 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Next Metric 1.Outliers 2.Stratification 3.Day of Week 4.Round Numbers 5.Made Up Numbers 6.Market basket 7.Trends 8.Gaps 9.Duplicates 10.Dates Objective 2

55. Slide 55 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Duplicates Why is there more than one? Same, Same, Same, and Same, Same, Different Objective 2

56. Slide 56 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Two types of (related) tests Same items – same vendor, same invoice number, same invoice date, same amount Different items – same employee name, same city, different social security number Objective 2

57. Slide 57 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Duplicate Payments High payback area “Fuzzy” logic Overriding software controls Objective 2

58. Slide 58 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Fuzzy matching with software Levenshtein distance Soundex “Like” clause in SQL Regular expression testing in SQL Vendor/employee situations Russian physicist Objective 2

59. Slide 59 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC How is it done? First, sort file in sequence for testing Compare items in consecutive rows Extract exceptions for follow-up Objective 2

60. Slide 60 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Possible Duplicates - Example Results Five invoices may be duplicates. Vendor Invoice Date Invoice AmountCount 102456/15/20073,544.784 102458/31/20072,010.372 175462/12/20071,500.002 Objective 2

61. Slide 61 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Next Metric 1.Outliers 2.Stratification 3.Day of Week 4.Round Numbers 5.Made Up Numbers 6.Market basket 7.Trends 8.Gaps 9.Duplicates 10.Dates Objective 2

62. Slide 62 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Holiday Date Testing Red Flag indicator Objective 2

63. Slide 63 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Typical audit areas Invoices Receiving reports Purchase orders Objective 2

64. Slide 64 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Federal Holidays Established by Law Ten dates Specific date (unless weekend), OR Floating holiday Objective 2

65. Slide 65 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Understanding the Basis Quantified Approach Population vs. Groups Measuring the Difference Stat 101 – Counts, Totals, Chi Square and K-S The metrics used Objective 2

66. Slide 66 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Objective 2 - Summarized 1.Understand why and how 2.Understand statistical basis for quantifying differences 3.Procurement cards 4.Understand examples done using Excel Next up: p-cards … Objective 2

67. Slide 67 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Testing Procurement Card Transactions 1.Understand Merchant Charge Codes (MCC) 2.Understand common policies 3.Test procurement card transactions contained on worksheets using VBA 4.Ability to test procurement card transactions in a file using VBA 5.Perform an audit of procurement card transactions in a more efficient and effective manner using the concepts and techniques presented Objective 3

68. Slide 68 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Audit Benefits (How this test supports the audit) Test compliance with policy on an account by account basis Test compliance with policies on account limits Enable 100% testing of transactions Audit process which can be tailored for policy changes Repeatable audit process Objective 3

69. Slide 69 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC MCC Structure Major Categories Airlines 30XX – 32XX Car Rental 33XX, 34XX Hotels 35XX – 37XX All Other Objective 3

70. Slide 70 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Policy Structure Prohibited Codes Codes allowed with a monthly limit Codes allowed without limit Overall card limit Objective 3

71. Slide 71 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Summary and Wrap Up 1.Understand Merchant Charge Codes (MCC) 2.Understand common policies 3.Test procurement card transactions contained on worksheets using VBA 4.Ability to test procurement card transactions in a file using VBA 5.Perform an audit of procurement card transactions in a more efficient and effective manner using the concepts and techniques presented Objective 3

72. Slide 72 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Objective 3 - Summarized 1.Understand why and how 2.Understand statistical basis for quantifying differences 3.Procurement cards 4.Understand examples done using Excel Next up: Excel …

73. Slide 73 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Use of Excel Built-in functions Add-ins Macros Database access Objective 4

74. Slide 74 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Excel – Univariate statistics Work with Ranges =sum, =average, =stdevp =largest(Range,1), =smallest(Range,1) =min, =max, =count Tools | Data Analysis | Descriptive Statistics Objective 4

75. Slide 75 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Excel Histograms Tools | Data Analysis | Histogram Bin Range Data Range Objective 4

76. Slide 76 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Excel Gaps testing Sort by sequential value =if(thiscell-lastcell <> 1,thiscell-lastcell,0) Copy/paste special Sort Objective 4

77. Slide 77 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Detecting duplicates with Excel Sort by sort values =if testing =if(=and(thiscell=l astcell, etc.)) Objective 4

78. Slide 78 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Performing audit tests with macros Repeatable process Audit standardization Learning curve Streamlining of tests Examples - http://tinyurl.com/576tp8 http://tinyurl.com/576tp8 Objective 4

79. Slide 79 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Use of Excel Built-in functions Add-ins Macros Objective 4

80. Slide 80 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Objective 4 - Summarized 1.Understand why and how 2.Understand statistical basis for quantifying differences 3.Identify ten general tools and techniques 4.Understand examples done using Excel

81. Slide 81 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Questions?

82. Slide 82 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Links for more information Kolmogorov-Smirnov http://tinyurl.com/y49sec Benford’s Law http://tinyurl.com/3qapzu http://tinyurl.com/3qapzu Chi Square tests http://tinyurl.com/43nkdh http://tinyurl.com/43nkdh Continuous monitoring http://tinyurl.com/3pltdl http://tinyurl.com/3pltdl

83. Slide 83 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Excel macros used in auditing Excel as an audit software http://tinyurl.com/6h3ye7 http://tinyurl.com/6h3ye7 Selected macros - http://tinyurl.com/576tp8 http://tinyurl.com/576tp8 Spreadsheets forever - http://tinyurl.com/5ppl7t http://tinyurl.com/5ppl7t

84. Slide 84 Joint meeting of the RDU IIA and ISACA chapters November 11, 2008, Capitol Club, Raleigh, NC Contact info E-mail: Mike.Blakley@ezrstats.com Mike.Blakley@ezrstats.com Web: http://ezrstats.com