merging forensics w data analytics
TRANSCRIPT
Merging Forensics with Data Analytics Monday, September 28, 2015
Time
Josh Shilts, CPA/CFF/CGMA, CFE
Presentation will be available at:
www.misti.com/downloadDownload password is available in your Show Guide
MIS Training Institute Holdings, Inc. Slide 3©
Big Data Phenomenon and its’ Effect on Organizations & Audit Departments
Data Analytic Program Landscape Forensics + Data Analytics = Mitigated Risk Continuous Auditing Evolution Data Analytics Future: Organization and Audit
Department Affects
Key Points
MIS Training Institute Holdings, Inc. Slide 4©
The BIG Data Phenomenon
“Information is the oil of the 21st century, and analytics is the combustion engine.”
- Peter Sondergaard, Gartner Research
MIS Training Institute Holdings, Inc. Slide 5©
The BIG Data Phenomenon
“Ninety percent of the world’s data has been created in the last two years… The ultimate question is really what insight and value can we draw from that data.”
- George Lee, Chief Information Officer, Investment Banking Division, Goldman Sachs, Sept. 2014
MIS Training Institute Holdings, Inc. Slide 6©
The BIG Data Phenomenon
“Big data is not about the data.”
- Gary King, Harvard University, making the point that while data is plentiful and easy to collect, the real value is in the analytics
“Hiding within those mounds of data is knowledge that could change the life of a patient, or change the world.”
- Atul Butte, Stanford School of Medicine
MIS Training Institute Holdings, Inc. Slide 7©
The BIG Data Phenomenon
“Figures often beguile me, particularly when I have the arranging of them myself…
…there are three kinds of lies: lies, damned lies, and statistics.”
- Mark Twain, 1906
MIS Training Institute Holdings, Inc. Slide 8©
Employee & Customer Behavior Supply Chain Efficiency Faster Decision Making Push to understand Data Structure and Advanced
Analytical Tools Identify Data Analytics Talent Embedding Big Data
This creates a lot of unanswered questions…How is big data going to improve our performance as a business? What will the company focus on? etc…
Effect on Organizations
MIS Training Institute Holdings, Inc. Slide 9©
“Trickle Down” to Audit Departments Employee & Customer Behavior Supply Chain Efficiency Faster Decision Making Push to understand Data Structure
and Advanced Analytical Tools Identify Data Analytics Talent Embedding Big Data
This creates a lot of unanswered questions…How is big data going to improve our performance or the audit plan? What will the audit plan focus on? etc…
MIS Training Institute Holdings, Inc. Slide 10©
Use of “Scripts” defined by software companies, large internal audit consulting shops and well known professional associations (i.e. IIA, ACFE)
Excel, ACL and IDEA used to identify duplicates, quantitative outliers (e.g. aberrations, deviations)
No defined method for script implementation No use of existing resources Audit Management “forcing” use of analytics with no
other reason to do so than meet professional association guidance
Current Data Analytic Landscapes
MIS Training Institute Holdings, Inc. Slide 11©
“If you want to give yourself a fair chance to succeed, never expect too much too soon”
– Po Bronson
Data Analytic Program Landscape
MIS Training Institute Holdings, Inc. Slide 12©
- Don’t put the cart before the horse…
MIS Training Institute Holdings, Inc. Slide 13©
To succeed you must utilize existing knowledge as well as existing tools to build the “base” of your program…
Magnitude
Major >$50M 5
Substantial
>$25M 4
Moderate >$ 10M 3
Minor >$1M 2
Insignificant <$1M 1
Define how Financial Impact is measured (i.e. Net Income, Revenues, etc.)
1 2 3 4 5
Remote Unlikely Possible Likely Almost Certain
Likelihood
12
11
3
10
4
6
5
14
13
15
9
8
1
7
MIS Training Institute Holdings, Inc. Slide 14©
Before even the discussion of a analytic tool consider using existing information…
Employee Turnover %
Income Statements
SEC Enforcement Actions
Hotline Statistics
User Access Reports
Customer Surveys
Inventory Ratios
MIS Training Institute Holdings, Inc. Slide 15©
Forensics + Data Analytics
Employee Turnover %Income Statements
SEC Enforcement Actions
Hotline Statistics
User Access Reports
Customer Surveys
Inventory Ratios
Magnitude
Major >$50M 5
Substantial
>$25M 4
Moderate >$ 10M 3
Minor >$1M 2
Insignificant <$1M 1
Define how Financial Impact is measured (i.e. Net Income, Revenues, etc.)
1 2 3 4 5Remote Unlikely Possible Likely Almost
Certain
Likelihood
9
MIS Training Institute Holdings, Inc. Slide 16©
Some forensic accountants specialize in forensic analytics which is the procurement and analysis of electronic data to reconstruct, detect, or otherwise support a claim of financial fraud. The main steps in forensic analytics are (a) data collection, (b) data preparation, (c) data analysis, and (d) reporting. For example, forensic analytics may be used to review an employee's purchasing card activity to assess whether any of the purchases were diverted or divertible for personal use.
Wikipedia
How Does Forensics Relate
MIS Training Institute Holdings, Inc. Slide 17©
Equals Mitigated RiskContinuous audit, much like the disciplines currently employed within forensic audit, focuses on the prevalence of a risk and/or the effectiveness of a control…
…with automated, frequent analyses of data, you will be able to perform control and risk assessments in real time or near real time. Thus, giving you the ability to analyze key systems for anomalies at the transaction level.
MIS Training Institute Holdings, Inc. Slide 18©
Representative Examples
1. Invalid Tax ID – generate a report to identify all expense payments sorted by Tax ID. Investigate all payments wherein there is no Tax ID, Tax ID is all 9s, or contains alpha characters.
2. Duplicate Payments – Captures payments either same $ paid to the same payee and/or check #
3. PO Box Payments – Captures all payments made on an insurance claims that included a PO box as the address.
The majority of “canned” scripts focus on cash misuse and/or larceny fraud schemes…
MIS Training Institute Holdings, Inc. Slide 19©
Representative ExamplesHowever; focus should be on “real” fraud risks and not utilizing resources to complete “common” tests…
Scenario Fraud Risk Potential TestCompany has a significant # of employees who travel.
Abuse of company credit card.
Identify how many charges per employee are incurred in their hometown.
Technology company incurs high percentage of employee turnover below the manager level.
Inappropriate access with non-existent employee IDs
Run a report to compare employee leaves vs. change management activity.
Insurance company who prides itself on making timely payments to customers.
Payments are made without appropriate approvals or support.
Run a report to identify claims made within 5 days of endorsement to identify if payment is made on an excluded loss.
MIS Training Institute Holdings, Inc. Slide 20©
Forensics has long been a discipline that focuses on a specific risk or situation and utilizes tools and knowledge to pinpoint its cause…
My Point
…data analytics builds on the “Forensic Objective” by allowing professionals to decipher mounds of data and information and focus on more than just fraud within a set of data.
MIS Training Institute Holdings, Inc. Slide 21©
Continuous Audit Process Implementation Graph
Continuous Audit Process
Implementation Steps
1Establish Priority Areas
6Report Results
5Manage
Results & Follow Up
4Configure
Parameters & Execute
3Determine Process
Frequency
2Identify Audit
Rules
7Assess
Emerging Risk & Add to Register
MIS Training Institute Holdings, Inc. Slide 22©
Continuous Auditing Evolution
MIS Training Institute Holdings, Inc. Slide 23©
CONTINUOUS AUDIT RISK/CONTROL
ASSESSMENT
FACT FIND
DATA ANALYTIC INITIATION
CONTINUOUS AUDIT
ACTIVITY PLAN
DATA ANALYTIC STORAGE
REPORTING
Qn REVIEW & ASSESSMENT
IntakeAssess
Emerging
Plan Changes
Resource Allocation
Process & System Reviews
Other Activity
Integration
1st & 2nd Lines
Monitoring
Ratios / Trends
Script Initiation
Evaluation
Periodic
Process Mngt.
Tools
Quarterly
Annual
Continuous Audit Process
Implementation Steps
1Establish Priority Areas
6Report Results
5Manage
Results & Follow Up
4Configure
Parameters & Execute
3Determine Process
Frequency
2Identify Audit
Rules
7Assess
Emerging Risk & Add to RegisterTh
e Com
plex F
uture
MIS Training Institute Holdings, Inc. Slide 24©
The Future
Improve Existing Products and Services Improve Internal Processes Building New Products or Services Transforming Business Models
The business of Forensics by improving the determination of priorities and picking the right angle to review.
MIS Training Institute Holdings, Inc. Slide 25©
Big Data is in fact a phenomenon that has a lot of theory behind it. Problem is most of it is theory…
Some problems the theorists forgot to think about is: Data Integrity Core Value and Missions
Continuous Control Monitoring is complex and requires the appropriate number of resources and allocated time.
You need very creative individuals to implement.
The Realities
MIS Training Institute Holdings, Inc. Slide 26©
Don’t let the Big Data phenomenon distract you from your core values and mission
Focus on “easy” wins by using ‘canned’ scripts
Build slowly: know what works for you and don’t get caught up in an “arms race”
Audit the Data!!!
Summary
THANK YOU!
Please Remember To Fill Out Your
Session Evaluation Forms!