forensic auditing: a public sector perspective forensic auditing: a public sector perspective israel...

Welcome!Forensic Auditing: A Public Sector Perspective

Israel Sadu, Ph.D., MBA, CFE, CIA,

CISA, CRMA, CIPSFR

Internal Auditor

Office of the Internal Oversight Services

United Nations

2

Forensic Auditing: A Public Sector Perspective

2017 ACFE Middle East FRAUD CONFERENCE

29-31 January 2017Atlantis, The Palm

Crescent Road Dubai, UAEMonday, 30 January 2017

Profile of the Speaker

Experience• 25 years of public sector auditing

• Provincial head of audit; and assisted a number of legislativeaudit oversight committees.

• Head of a Centre of Excellence in Audit of Frauds, FraudDetection Techniques, and Forensic Audits; and authoredseveral case studies and research papers on subject.

• Capacity building expert to the Supreme Audit Institutions in:Seychelles (Information Technology auditing); Nepal(Procurement and Public Works); and Uganda (Value forMoney auditing).

• External Audit of the United Nations-Procurement Division,New York; ‘IT security in SAP’-IMO, London; and WIPO,Geneva.

• Capacity building of audit professionals from over 20countries in Audit of Frauds, Performance auditing, andInformation Technology auditing.

PhD, MBA , CFE, CIA, CISA, CRISC, CRMA, CIPSFR

3

Dr. Israel SaduInternal Auditor, Office ofthe Internal OversightServices, United Nations.(Former Principal Directorof Audit, Supreme AuditInstitution, India)

[email protected]+962-6-5100460-2903

Education

mailto:[email protected]

Perspectives of Fraud in the Public Sector

The Magnitude of Losses

Institutional Arrangements in Place for Fighting Frauds in the Public Sector

Traditional/Statutory Audit Versus Forensic Audit

Role of Forensic Auditors

Audit Mandate of the Supreme Audit Institutions

Digital Forensics and Data Mining- A Case Study

Challenges and the Way Forward

Presentation Plan

Omnipresence of Fraud!

• Fraud is omnipresent and it isas old as human civilisation!

• Kautilya, ancient Indianstatesman (2nd century B.C)-well known for his famoustreatise on statecraft andpolicy, ‘Arthashastra’,described in detail– forty different ways in which

state funds could be embezzledduring his time; and

– laid down an elaboratepunishment procedure.

“Whether one wishes or not,honey or poison kept on tonguegets tasted eventually. So it is,corruption and wealthaccumulation by governmentofficials. It is highly likely thatthey do accumulate more or lesswealth by corruption in theirtenure.”

– Kautilya

6

7

Federal Government

State owned undertakings/

corporations

Public private partnerships

Provincial Government

State owned undertakings/ corporations

Public private partnerships

Local government

Typical Public Sector Audit Jurisdiction








Digital Forensics and Data Mining- A case study

The Magnitude of LossesACFE

• Approximately two-thirdsof the cases reportedtargeted privately held orpublicly ownedcompanies and these for-profit organizationssuffered the largestmedian losses among thetypes of organizationsanalysed, at $180,000and $178,000,respectively.

• Of the cases involving agovernment victim, thosethat occurred at thefederal level reported thehighest median loss($194,000), compared tostate or provincial($100,000) and localentities ($80,000).

• (ACFE 2016 Report to the Nations on Fraud and Abuse)

PwC

• 41 percent of therespondents fromgovernment/state ownedenterprises reported thattheir organisations hadsuffered economic crimein the last 12 months.

• The same survey showsthat: (a) procurementfraud has more thandoubled in the publicsector since 2012; and (b)24 percent of thegovernmentorganisations surveyedworldwide sufferedlosses in the past 24months that were inexcess of $1 million.

• (2014 PwC Global Economic Crime

Survey)

My Study

• Based on secondary data;

• Losses of over $40 millionin five years;

• Almost every departmentof the government hadsuffered frauds;

• The perpetrators wereinsiders in 80 percent ofthe cases reported;

• Cash-on-handmisappropriation was themost frequently followedscheme; and

• 80 percent of therevenue was lost beforecrediting (skimming); andthe primary (61 percent)reason for the controlweaknesses was ‘notfollowing the prescribedchecks’.

• http://rtinagpur.cag.gov.in/research-paper.php

9

Results of My Study…A Summary of Fraud Schemes Followed

10

Results of My Study contd.,Revenue Loss

11

Results of My Study contd.,Control Weaknesses

13


Institutional Arrangements in Place for Fighting Frauds







15

Legislature

Internal Oversight

SAIRegional working Group

INTOSAI

Regional working Group

Regional working Group

Investigating authorities

INTOSAI Regional Working Groups

16

OLACEFS-Organization of Latin American and Caribbean Supreme Audit Institutions CAROSAI-Caribbean Organisation of Supreme Audit Institutes EUROSAI-European Organization of Supreme Audit Institutions CREFIAF- Supreme Audit Institutions of French-speaking sub-Saharan African countries ARABOSAI-Arab Organization of Supreme Audit Institutions AFROSAI-African Organization of Supreme Audit Institutions ASOSAI-Asian Organization of Supreme Audit Institutions PASAI-Pacific Association of Supreme Audit Institutions







Challenges and Way Forward


18

Statutory Audit Versus Forensic Audit- How Do They Differ?

Characteristics of a Forensic Auditor

21

Mandates of the Supreme Audit Institutions-A Comparison Between 2010 and 2014

Source: INTOSAI publication, ‘Performance, Capacities, and Needs of SAIs. Global SAIs stocktaking Report, 2014.’

23

24

Some Commonly Followed Practices Among SAIs

Investigation with the help of forensic teams

Part of the investigating

agencies’ teams

Keep off after handing over

the evidence to the investigating

agencies

??

25

Barring few SAIs, in most of thecases, there are other agenciesresponsible for investigatingfraud and corruption.

Government AccountabilityOffice, USA, and National AuditOffice, UK, Office of the AuditorGeneral, South Africa havespecialized forensic investigationteams

The 2014 Global Surveyconducted by INTOSAI advisedSAIs to undertake specialisedaudits that included investigativeor forensic audits

The member countries of theAsian Organisation of SupremeAudit Institutions (ASOSAI) hadthe following statuses:

Forensic Auditing by

SAIs

26

• Indonesia, Iraq, Korea, and Philippines: Ranked forensicaudit as the foremost instrumental audit service inprevention of fraud and corruption while Russia ranked itsecond.

• Philippines: Established a Fraud Audit Office, whichconducts audits of government agencies with probablefraudulent transactions to safeguard government assetsagainst abuse and fraud and to respond to the increasingpublic demand for fidelity in the use of government fundsand property.

• Malaysia: Investigative audit is a part of regular auditing. Inthe course of an audit, indications of fraud are investigatedby the team that conducts the audit.

Source: 10th ASOSAI Research Project, 2015.

27

• Indonesia: Developed an investigative audit task force (adhoc).

• Thailand: Conducts investigative audits and established aForensic Audit Unit.

• China, India, Iran, and Turkey: Did not have forensic auditunits.

• Iran: The General Inspection Organization of Iranperformed the task of investigative auditing; and

• Turkey: Did not have a separate forensic audit unit and didnot have a plan to establish one in the future.

Source: 10th ASOSAI Research Project, 2015.






Audit Mandate of the Supreme Audit Institutions on Forensic Audit



29

Seizure :To understand whether theauditor has the authority to seize thedigital equipment as well asknowledge of the propermethodology to use so that evidenceis not destroyed or tainted.

Image Acquisition: Use of decision-making processes to determine thebest method for acquiring an imageof the suspect system and the properuse of software and hardware toolsto facilitate the image capturemaintaining ‘chain of custody.’

Analysis : Use of specialized toolsdesigned to give the examiner themeans to locate and extract artefactsthat will be used as evidence in theinvestigation.

Reporting and Testifying: A qualifiedcomputer forensic expert may beasked to render an opinion about theuse or misuse of the system.

Digital Forensics

Some Commonly Used Detection Techniques

30

• Data Mining: To discover previously hiddenpatterns and attributes in data, pointing not onlyto fraudulent transactions, but also to newmarkets and products, is the new challenge forInformation Systems auditors.

• Other techniques: Case-based reasoning tools andneural networks, data matching etc.,

31

Estimates of requirements prepared in piecemeal to avoid procurement procedures set for high value purchases.

Specifications prepared to exclude all but certain favoured suppliers.

Estimates prepared using costs higher than the market price.

Single work divided into several small components so that it can be approved within the initiator’s authority.

Material purchased directly at the manufacturer’s price that falsely claim to meet the required specifications.

Unusually low time given for bidding to avoid competition.

Tailored conditions of payment allow unconditional secured advance, mobilisation advance etc.,

Source: Speaker’s publication, ‘Red flags and anti-fraud measures in Public Works ‘at http://rtinagpur.cag.gov.in/research-paper.php

Indicators of Fraudulent Practices, Red Flags, a Good Starting Point-An Example of Public Works

32

Taxation sub-systems

(Data sources)

Data aggregation

Staging Analysis Investigation

>Income tax collections (2013-14) in the province-$3448 million >Sustained interface between Tax Administration offices and Statutory Audit offices>Taxation offices/tax payers identified by unique identification numbers>Taxation systems: Income tax, VAT, excise duty on manufacturing, and customs duty>Lack of interface between different taxation systems in the audit office

Stages involved

33

PROCESS DESIGN

IT SYSTEMS

PEOPLE

Taxation data

Fraud analytics through data

mining

Investigation/

risk analysis

OBJECTIVE

Components

Challenges: Large volumes of data Data acquisition Integration errors Soft skills and controls Resources

INTEGRATION PLAYED A KEY ROLE!

34

Taxation sub-systems

(Data sources)

Data aggregation

Staging Analysis Investigation

VAT

Manufacturing

Real Estate

Import/

Export

MASTER

DATA

Data warehouse

P

A

T

T

E

R

N

S

R

U

L

E

S

D

A

T

A

M

I

N

I

N

G

R

E

P

O

R

T

S

Rules identification(some examples)>Sudden rise/fall in the tax paid,>Abnormal spike in tax holidays enjoyed, >Taxable income not commensurate with the known activities.

Income Tax








Digital Forensics and Data Mining- A Case Study on an Audit of the Indian Taxation System

36

Institutional

arrangements

• Securing appropriate audit mandate

• Well-defined relationships with investigating agencies

• Infrastructure for evidence preservation and analysis

Professional practices

• Entities’ profiling integrating forensic principles

• Developing red flags/fraud patterns/rules

• Proactive role through facilitating control self assessment-sensitising clients

• Advocate for integration of forensic principles in the business systems

Capacity building

• SAIs staff-recruitment, specialists cadre

• Entities’ staff

• Joint seminars/workshops for knowledge and experience sharing

The Way Forward

37

“Corruption,embezzlement, fraud,these are allcharacteristics whichexist everywhere. It isregrettably the wayhuman nature functions,whether we like it ornot. What successfuleconomies do is keep itto a minimum. No onehas ever eliminated anyof that stuff.”

Allan GreenspanAmerican Economist

Five Ps of Internal Controls-who

holds the key?

Thank You

38

Questions?

39

Welcome!Forensic Auditing: A Public Sector Perspective

Israel Sadu, Ph.D., MBA, CFE, CIA,

CISA, CRMA, CIPSFR

Internal Auditor

Office of the Internal Oversight Services

United Nations

forensic auditing: a public sector perspective forensic auditing: a public sector perspective israel...

Documents