10 31 2012 presentation
TRANSCRIPT
-
7/22/2019 10 31 2012 Presentation
1/44
Internal InvestigationsTools Used to Uncover the Truth
James A. Snyder , J.D., CFE
Managing Partner
Forensics & Valuation Services
Tom Haldiman, CPA, CFE
Supervising Consultant
Forensics & Valuation Services
October 31, 2012
-
7/22/2019 10 31 2012 Presentation
2/44
Geocoding
Tools: Google Earth, Batchgeo
2
-
7/22/2019 10 31 2012 Presentation
3/44
Data Analytics
3
-
7/22/2019 10 31 2012 Presentation
4/44
Data Analysis Process
1) Identify & gather relevant data
2) Process that data with an appropriate tool
3) Analyze output generated by that tool
4
-
7/22/2019 10 31 2012 Presentation
5/44
Search for Conflicts of Interest
1) Identify & gather relevant data
-Vendor Listing, Employee Listing, Secretary of State
Websites, Land and Property Records, Invoices, Email,
Facebook
2) Process that data with an appropriate tool
-Relationship Mapping Software such as IBM i2
AnalystsNotebook, Node XL or Gephi
3) Analyze the output generated by that tool
5
-
7/22/2019 10 31 2012 Presentation
6/44
Identify and Gather Relevant Data
Christopher Andrews is an employee of Diamond Design Jackal, Inc. is a vendor of Diamond Design
Jerome Johnston is an owner of Jackal, Inc.
Jerome Johnston is also an owner of Imperial Design
Imperial Design shares an address with Coldwater Constructors
Beth Woodard is an owner of Coldwater Constructors
Beth Woodard has the same phone number on file as Jerome Johnston, &they are married
Slimline Architects sends invoice to Jackal, Inc., which is then marked up byJackal, Inc. & sent to Diamond Design
Eugene Graham is an owner of Slimline Architects
Steve Andrews is the father of Christopher Andrews
Steve Andrews is an owner of Imperial Building
Imperial Building is a vendor of Diamond Design
6
-
7/22/2019 10 31 2012 Presentation
7/44
Process that Data with an Appropriate Tool
7
-
7/22/2019 10 31 2012 Presentation
8/44
Analyze the Output Generated by that Tool
8
-
7/22/2019 10 31 2012 Presentation
9/44
-
7/22/2019 10 31 2012 Presentation
10/44
-
7/22/2019 10 31 2012 Presentation
11/44
11
-
7/22/2019 10 31 2012 Presentation
12/44
Tools: Analysts Notebook, Node XL, Gephi
12
-
7/22/2019 10 31 2012 Presentation
13/44
Relationship Mapping
DegreeNumber of links to other entitiesFind entities who may be the most active in the network based on number ofdirect links to other entities
BetweennessNumber of paths through each entityFind gatekeeper entities who may control information flow betweendifferent parts of the network
Closeness/CentralityProximity of entity to other entitiesFind entities who may have the best access to other parts of the network &
visibility of activities within the rest of the network
Eigenvector (Hubs/Authorities)Closeness to key playersFind entities that may have strong influence in the network due to their directlinks to other highly active or well connected entities
13
Social Network Analysis
-
7/22/2019 10 31 2012 Presentation
14/44
Relationship Mapping
Social Network Analysis
DegreeNumber of links to other entities
Find entities who may be most active in the network based on
the number of direct links to other entities
14
-
7/22/2019 10 31 2012 Presentation
15/44
Relationship Mapping
Social Network Analysis
BetweennessNumber of paths through each entity
Find gatekeeper entities who may control information
flow between different parts of the network
15
-
7/22/2019 10 31 2012 Presentation
16/44
Relationship Mapping
Social Network Analysis
Closeness/CentralityProximity of entity to other entitiesFind entities who may have the best access to other parts ofnetwork & visibility of activities within the rest of the network
16
-
7/22/2019 10 31 2012 Presentation
17/44
17
-
7/22/2019 10 31 2012 Presentation
18/44
Theatre Map
18
-
7/22/2019 10 31 2012 Presentation
19/44
Theory 1: Tickets Sold at a Price of Zero (Comped)
19
-
7/22/2019 10 31 2012 Presentation
20/44
Theory 2: Unsold Seats were Actually Sold at Zero
Cost, Then Reclassified as Unsold
20
-
7/22/2019 10 31 2012 Presentation
21/44
Theory 3: Tickets Sold Below Market
21
-
7/22/2019 10 31 2012 Presentation
22/44
Applicability to Other Companies
All CompaniesPayment detail, payroll detail,vendor listing, employee listing, general ledger detail
ManufacturingCost of goods sold & inventory
detail Health carePatient accounting detail
BankingLoan maintenance file
Every company has unique data that should be
considered
22
-
7/22/2019 10 31 2012 Presentation
23/44
Sequential Checks to the Same Vendor
Tools: ACL, Access, Excel, or IDEA
23
-
7/22/2019 10 31 2012 Presentation
24/44
Missing Checks
Tools: ACL, Access, Excel, or IDEA
24
Oth D t Mi i P d i di ti f
-
7/22/2019 10 31 2012 Presentation
25/44
Other Data Mining Procedures indicative of
a Vendor/Billing Scheme
Name similarity (phonetics, acronyms, etc.) Acceleration (systematic spending increases)
Employee address matches customer/vendor address
Customer Tax ID matches another customer Tax ID
Customer/vendor phone number matches employee phone
Duplicate invoices or slightly altered attributes
Sudden spike in invoice volume or activity
Missing contact information (address, phone, names)
High volume of transactions ending in 0 or 5
Unusual activity compared to similar vendors or customers
Weekend or holiday transaction dates
Transactions processed at unusual hours Address is PO Box, maildrop, prison
Dormant account suddenly active
25
-
7/22/2019 10 31 2012 Presentation
26/44
Computer Forensics
-
7/22/2019 10 31 2012 Presentation
27/44
Computer Forensics
Computer forensics (more accurately digitalforensics) is the science of recovering digital data in a
manner that will withstand courtroom scrutiny
Must follow proper chain of custody procedures
Must maintain data integrity
Not strictly an IT pursuit
Typically includes analysis in addition to recovery,
which includes review of deleted files, unallocated
clusters & metadata
27
-
7/22/2019 10 31 2012 Presentation
28/44
Not Only Computers
28
-
7/22/2019 10 31 2012 Presentation
29/44
E-discovery
Discovery of evidence in an electronic format,also referred to as electronically stored
information (ESI), searched in the course of
litigation
Covers a variety of data, including
documents, email, audio files, photos,
metadata & more
29
-
7/22/2019 10 31 2012 Presentation
30/44
Computer Forensics E-Discovery
STEP 1: Acquisition
STEP 2: Analysis/
Review
Computer Forensics Technician
Computer Forensics Technician Lawyers & Other Investigators
Computer Forensics Technician
30
-
7/22/2019 10 31 2012 Presentation
31/44
Predictive Coding
Analysis & identification of relevant electronicdata assisted by artificial intelligence
Also known as Technology-Assisted Review
31
-
7/22/2019 10 31 2012 Presentation
32/44
Growth of Unstructured Data
Explosion of text data +
Rapid growth in storage
capacity +
Over 95% of data never
leaves the digital domain =
Overwhelming volume to
review by traditional means
32
-
7/22/2019 10 31 2012 Presentation
33/44
Evolution: Keyword Search
Brute force search for exact, specific term
car
33
-
7/22/2019 10 31 2012 Presentation
34/44
Evolution: Thesaurus search
Expansion of original term, but still applied as a brute force search
car
automobile
auto
motorcar
34
-
7/22/2019 10 31 2012 Presentation
35/44
Evolution: Hyper-Thesaurus search
Expands to troponyms, hypo/hypernyms, meronyms, entailments, slang, etc
automobile
auto
motorcar
tire
engine
hood
chrome
headlightscar
vehicle
garage
freeway
parking lot
ridehotrod
clunkerbeamer
MustangFord
A8Chevy
35
-
7/22/2019 10 31 2012 Presentation
36/44
Evolution: Concept Searching
Performs true latent semantic analysis machine learning of text to do
find more like this searches
To: Vendor
From: Employee
---------------------------------------------
Thank you for the giftit looksgreat in my driveway! I cant wait
to take it out on the open road. I
promise I wont tell anyone where
it came from.
Documentsrelated to
topic
Emails
related to
topic
36
-
7/22/2019 10 31 2012 Presentation
37/44
Evolution: Predictive Coding
Uses concept search technology but incorporates statistical predictions of
relevance based on observation of & interaction with, the user
Senior attorney codes an initial sample set as relevant or not
Artificial Intelligence learns from this set & presents another
Iterations continue until predictions match reality
Alternative approachAI watches reviewers as they code
documents & learns from them, then begins presenting
predicted relevant documents
37
-
7/22/2019 10 31 2012 Presentation
38/44
Issues
Courts still largely undecidedits a legal minefield
Works best on documents rich in text (email, word processing,
PDFs, etc.)it doesnt on spreadsheets, databases & others
Multi-lingual data sets can cause strange results
Our experience has shown it to struggle with jargon,
abbreviations, innuendo, sarcasm, slang & effect of emoticons
Can only predict relevance based on what youteach ititdoesnt have a crystal ball
38
-
7/22/2019 10 31 2012 Presentation
39/44
Best Uses
In litigation, only in large cases & by agreement of both parties
& consent of the court
Early case assessment (ECA) to rapidly identify relevant material
or to cull down corpus to a more manageable size
Post-review quality controlhelps answer What did we miss?
Forensic investigationsas a supplement to traditional
computer forensics & data mining efforts
39
-
7/22/2019 10 31 2012 Presentation
40/44
Summary
40
-
7/22/2019 10 31 2012 Presentation
41/44
James A. Snyder J.D., CFE | Managing Partner | 816.701.0260 | [email protected]
Tom Haldiman CPA, CFE | Supervising Consultant | 816.221.6300 | [email protected]
-
7/22/2019 10 31 2012 Presentation
42/44
BKD Forensics Institute Upcoming Schedule
Deciphering Financial Statements: Tips & Tricks for Attorneyso Wednesday, November 7, 2012
o 11:30 a.m.12:30 p.m. CST
o Presented by Jeff Roberts,CPA, CFE, CFF
Data Visualization: Taking Your Analytics from Blah to Bam!
o Wednesday, November 14, 2012
o 11:30 a.m.12:30 p.m. CST
o Presented by Jeremy Clopton,CPA, ACDA, CFE
bkd.com/fi
42
-
7/22/2019 10 31 2012 Presentation
43/44
Starbucks Gift Card & Certificate
To help promote the event as an associate trainingtool, we are offering a bonus
o Associates who attend all three sessions will receive a
Starbucks gift card & Certificate of Participation from BKD
43
-
7/22/2019 10 31 2012 Presentation
44/44
Slides & Webinar Archive
Todays presentation slides are available atbkd.com/fi. A recorded copy of the webinar will be
available at the same location at the conclusion of
webinar series
If you have any questions, please contact
Dane Ryals @ [email protected]
Thank you for attending today
44
mailto:[email protected]:[email protected]