1. Continuous Monitoring as a tool for Fraud Detection Anton Bouwer CQS Technology Holdings antonb@cqs.co.za

2. The Market

3. Agenda Summary: Keys to Success Insight & Detail Continuous Monitoring – Continuous SAP Monitoring Continuous Monitoring Evolved Data access Programming knowledge required Difficult to identify analytics Difficult to implement analytics Difficult to automate Difficult to manage Fraud Detection Defined

4. Fraud is an intentional deception made for personal gain or to damage another individual; the related adjective is fraudulent.. Wikipedia – 2011 "… any illegal act characterized by deceit, concealment, or violation of trust. These acts are not dependent upon the threat of violence or physical force. Frauds are perpetrated by parties and organizations to obtain money, property, or services; to avoid payment or loss of services; or to secure personal or business advantage.“ Institute of Internal Auditors’ International Professional Practices Framework (IPPF) Data analysis technology enables auditors and fraud examiners to analyze an organization’s business data to gain insight into how well internal controls are operating and to identify transactions that indicate fraudulent activity or the heightened risk of fraud. Data analysis can be applied to just about anywhere in an organization where electronic transactions are recorded and stored. ACL - 2011

5. IPPF Standards The International Professional Practices Framework (IPPF) contains the following Standards on fraud and internal audit’s role: 1200 – Proficiency and Due Professional Care 1220 – Due Professional Care 2060 – Reporting to Senior Management and the Board 2120 – Risk Management 2210 – Engagement Objectives

6. Continuous Monitoring Evolved Data access Programming knowledge required Difficult to identify analytics Difficult to implement analytics Difficult to automate Difficult to manage

7. Just do it Import as often as possible. Each attempt gets easier. Practice makes perfect FACT: ALL FILES CAN BE ACCESSED! Establish environment Obtain user ID Get IT on your side Scrutinise data tables Create data dictionaries GOOGLE!!! Maximum 10 tables! (Not 35k) Types of data access methodologies ODBCSAP Direct Link Report files & PDF XML; XBRLAX DatasourceDelimited; DBF Assumption: Any data table can be accessed. Kiss

8. Software Solutions for Financial Integrity and Control

9. Fable: Programming knowledge required

10. Software Solutions for Financial Integrity and Control

12. Fable: Difficult to identify forensic analytics

13. Types of Analytics in all areas SoD Adherence to control objectives Accuracy Completeness (over & under) Data Quality Industry specific Software Solutions for Financial Integrity and Control Don’t complicate matters!!

14. Keep it Simple: Can you explain your findings?

15. Analytic Repositories

16. ACL D/B Interface Connections from AX Core Enterprise Data Enterprise Data Exceptions distributed via web-based viewer Apply proven analytics Forensic Investigators ACL Specialist SQL ER P Business Stakeholders Manage All Types of Forensic Content Project sA nalyticsDataExce l WordCrystal Reports PDFAudioPowerPoi nt Results Fable: Difficult to implement, automate & maintain

17. Case Study Continuous SAP Fraud Detection

18. Client Environment & Requirements SAP in different countries Needed standardised analytics for all investigators Automated data downloads to central repository Exception management through workflow

19. Solution – ACL SAP ACLelerator Software Solutions for Financial Integrity and Control

20. Data Repository AX Link download of SAP tables Software Solutions for Financial Integrity and Control ER P Download from 6 countries AX server in SA and Europe Encrypted and compressed

21. Software Solutions for Financial Integrity and Control Schedule data downloads and SAP accelerator

22. Software Solutions for Financial Integrity and Control Email forensic investigator when exceptions are ready for review Email management link to findings

23. Software Solutions for Financial Integrity and Control

24. Continuous Monitoring Final Solution: Frontend Used by: Forensic Investigators Internal Audit External Audit Management

25. Running Ad-Hoc Investigations Running any Analytic on Request Running Analytics with parameters View results Filter source data Download results

26. Benefits Data available to entire forensic team Data accuracy and analytic quality assured + standardised Forensic skills applied on exceptions, not samples Business knowledge & understanding increased Same data used by forensic team, internal audit, external audit and management Duplicated payments identified before payment takes place Exceptions management enforced through workflow

27. ACLerator Business Integrity, Insight and Beyond

28. Conclusion Continuous monitoring is a reality. No fable. Forensic skills needed; in fact required for CM to succeed Data access – No mystery; only commitment needed. Which analytics to include? Large repositories exist, simple framework High levels of programming skills required to start? No; cut, paste & map will do. Technology exist. Much lower investment required than before FACT: In 5 years very few forensic departments will function without continuous monitoring.

29. Questions at Stand 14