Forensic Data Analytics
Key to unlocking invisible information using forensic “lookback” Forensic Data Analytics as a topic and its adoption within the industry had long been overdue. With the advent of technology and increasing incidents of fraud, there has been a significant rise in adoption of Forensic Data Analytics. Due to this, company appointed auditors and independent directors are now seeking to implement proactive fraud-prevention solutions and are avoiding postincident remediation processes. Forensic Data Analytics is a science used to proactively seek opportunities to prevent and detect fraud, waste and abuse by leveraging information in corporate data assets. It enables identification of meaningful patterns and correlations in existing historic data to predict future events and assess the reasons for various fraudulent activities. Such insightful predictive information is generally “invisible,” but provides a platform on which organizations can take business decisions related to fraud, disputes and misconduct.
“
“
The greatest value of forensic analytics is when it forces us to notice what we did not expect to see.
Evolution of forensic data analytics Big data is a reality: The volume, variety and velocity of data coming into the organization have reached unprecedented levels. About 2.5 exabytes of data are created each
1. Big data
Without big data analytics, companies are blind and deaf, meandering aimlessly like a deer on freeway day, and that number is doubling every 40 months
Torture the data, and it will confess to anything
Issues in managing big data: Big data requires high performance analytics to process billions of rows of data with hundreds of millions of data combinations. The traditional
data warehousing techniques may not be able to identify anomalies in the existing data set thus preventing proactive fraud management
2. Manage data
Absence of forensic evidence is not evidence of forensic absence
3. Key Risk Events
Recent scams in the limelight: In the recent times, India has been hit with multi billion value scams associated with the following: •
• •
•
Anti Money Laundering
Bribery and Corruption Procurement fraud and collusion in bidding process Accounting misstatement
Forensic analytics is the oil of the 21st century which protects organizations combustion engine from going bust
Adoption of forensic data analytics: The associated risks could have been mitigated if key stakeholders would have paid attention to anomalies at an earlier stage. This could have been
possible if existing data assets were analyzed from forensic perspective to avoid wrongful or criminal deception intended to result in financial or personal gain.
4. Forensic Data Analytics
How does forensic data analytics help organizations? • •
Proactive fraud prevention management Controlling the magnitude of fraud in a reactive set up
•
Effective and focused internal controls
•
Improving regulatory and compliance environment
Forensic Data Analytics
3
Capability landscape Forensic Data Analytics can be used as a standalone service or in conjunction with existing practices such as investigations, audits, process review and due diligence. In the current context, data exists in structured (multiple form of databases) and unstructured forms (emails, office documents, presentations, Excel sheets, PDF files, archive files, text and image files) in organizations. Using EY’s proprietary tools, raw data can be transformed into formats that can be analyzed, and with the help of advanced analytical capabilities, anomalies can be identified that may indicate potential fraud. Some of our key offerings include, but not limited to, identification of fraud in vendor, customer and employee registration, procurement to pay, order to cash, sales and distribution, travel and entertainment, payroll disbursment.
Our forensic analytic models are developed to identify variances in data sets, which may impact an organization’s profit and loss statement. This model also touches on various aspects, from simple narration captured in a transaction to complicated sentiments and tone analysis. It also includes data within applications and data recorded on social and professional networks for further analysis. This analysis helps a company to move beyond identification of low value pilferage to implementing controls on existing and potential weak areas. Any dataset in historic, near real time and real time form can be assimilated through big data solutions to help a company improve its bottom line by checking fraudulent activities
Unstructured data
Forensic data analytics
S ample Das hboard J ournal E ntries and Amount P er User
50K
50,276
2,541
1,864
9,131 716
333
91
291 34
4
2
2,393 3,705
4,869
0K
Dis tinct count of J ournal_ID
Amount
0M
C redit
E Y_Account_Name NL trading account NX
60,565,488
T rade R ec'bles - R eceivables
58,874,500
79,779
200M
100M
Debit/C redit
Amount per Account Name
Us er_ID
Debit E Y_C las s As s ets
Agency Billing S ettlement Ac..
C os t of R evenue
F S MA R evenue - O ther Dis c..
E xpens e
R ental R ev. - S hort T erm R e..
E xpens es -60M
-40M
-20M
0M Amount
20M
40M
60M
Local Legal Accounts (.. O ther income and ded.. E Y_A ccount_Name P roduct/P rogram R ela..
E Y_S ub_C ategory Accounts R eceivable: T rade
58,874,500
P urchas es not capitali..
S KAYA
TS MITS
S AME IE R
TKO P P E NS
NWINTE R
P WE NNE KE S
R VBE US E KO M
J HAMAKE R
G G OOSEN
BJ ANKI
C KLE IN
C LABR AVE G A
ANVS C HAIK
BATC HUS E R
AKLE R K
O ther C urrent As s ets : Mis cel.. Due to (from) T rade and O th..
F unctional T rans fer Ac.. Liabilities & S tockholde..
Amount per S ub C ategory
-67,944,770
(G )/L on S ales of E quip..
67,944,770
13th Month S alaries #1
R ental R evenue: R ental Agr..
A&P - C us tomer E vents A&P - T rade s hows
Deferred R ental R evenue
A&P C ollaterals - P rod..
Deferred R evenue Managed..
-60M
-40M
-20M
0M Amount
20M
40M
60M
A/P - C redit out of Debi.. E Y_T IME _T A G After office hours entries
Account name per month (C alculated B ased on Document Number)
W ithin O ffice hours ent..
E ffective_Date 2011 Account Name
J uly
Augus t
2012
S eptember
O ctober
Agency Billing S ettlement Ac..
November
December
-393,707
-192,406
J anuary
F ebruary
-254,811
Monday T ues day
Agency Billing S ettlement Ac.. Billing S ettlement A (165799..
-943,525
Deferred R ev. - F M (213009..
-620,377
-615,525
-83,159
-274,752 -454,933
T hurs day S aturday
Deferred R evenue - R ental (.. -801,576
E Y_E ntry_month_end No
F M R ev. - F S MA R ev. Varia.. -10M
0M Amount
10M
-10M
0M 10M Amount
-10M
0M Amount
10M
-10M
0M 10M Amount
-10M
0M Amount
10M
-10M
0M 10M Amount
-10M
0M Amount
10M
-10M
0M 10M Amount
Figure 1: Structured output from unstructured data
4
W ednes day F riday
Deferred R ev. - F S MA (2130.. F M R ev. - Additional S ales (..
E Y_E ntry_week_day S unday
Forensic Data Analytics
Yes
Structured output
Our key differentiator in forensic data analytics At EY, data analytic techniques applied to internal or external fraud follows a four pillar approach — WHOWHAT-WHEN- WHY. This approach looks at any situation from all possible angles and highlights key issues. This does not only help in managing risks, but also in identification of potential growth areas. Increasing concerns about fraud and vulnerability can be alleviated by a range of forensic techniques, some of which are presented below.
“
Link Analysis Link Analysis is a data-analysis technique used to evaluate relationships (connections) between nodes, including organizations, people and transactions. Key applications of this technique include analysis of EPBX data, mobile bills and user logical access records that help a company map its user footprint. In a recent incident in a manufacturing company, its phone records were analyzed across different zones to determine the nexus between its employees and selected vendors on procurement and disposal of scrap. Using Link Analysis, we were able to establish “hidden” relationships and information leakage from suspected employees to identified vendors for possible “kickbacks.”
”
The key to identify fraud lies in the ability to comprehend what lies beneath.
Employee group
Employeevendor nexus
The size and width of connectors indicate frequency of the calls Third party
Vendor group
Figure 2: Link Analysis
Forensic Data Analytics
5
Social Network Analysis India lead managing business throughout India through relatives as key distributors
India sales head Vendor network in east Vendor network in west Relatives as key distributors Vendor network in south
Social Network Analysis views relationships in terms of network theory, which consists of nodes and ties. Nodes represent individual “actors” within the network and Ties represent relationships between individuals, e.g., friendships, kinship, organizational position, etc. Social Network Analysis, along with Link Analysis, helps to identify related parties, conflict of interest, bid rigging, among other fraud. In a large consumer products company, the India lead had appointed his relatives as distributors, and through known vendors, managed distribution of products in key states. Social Network Analysis, followed with a background check, helped to reveal the nexus. This led to a full-blown investigation and the company now undergoes vendor due diligence before it carries out any business.
Vendor network in north
Figure 3: Social Network Analysis
Concept Clustering Concept Clustering involves grouping similar entities or behavior into tight semantic clusters for the purpose of identifying anomalies or red flag. It is used actively, along with an electronic data review. In this example, Concept Clustering was executed on more than a million documents to identify all the information with terms such as “gifts,” “incentive” and “facilitation.” We were able to bring these down to a sizable volume with the required criteria that was analyzed in a timebound manner. Concept Clustering can be effectively used on structured and unstructured data. Miscellaneous
Fraud
Cash
Gift
Figure 4: Concept Clustering
Sentiment Analysis
Angry
Surprised
Confused
Figure 5: Sentiment Analysis
6
Cursing
Derogatory
Known as behavioral analysis, this refers to the application of text analytics to identify and extract subjective information including the attitudes of writers, their affective state and the intended emotional quotient. It determines whether expressed opinions in a document are positive, negative or neutral. The “fraud triangle” can be applied to categorize events into rationalization, opportunity and pressure to identify sentiments. Organizations use this data to conduct behavioral training, stem attrition, and identify disgruntled employees and potential fraud conversation.
Forensic Data Analytics
Data Visualization — identifying the “hidden” from “not so apparent” Data Visualization techniques have proved to be effective, since humans can better absorb large pieces of information in a visual format than that displayed in numbers or text. When the result of a fraud identification query is combined with Data Visualization, e.g., an account payable or journal entry data, a significant amount of useful and previously invisible information can be reviewed at one go.
Tag Cloud One of the most widely used visual techniques is a Tag Cloud. This is a good example of expressing complex data that can be understood intuitively. A Tag Cloud is the visual representation of communication relating to transactional data entries. It is represented by a combination of words in varied fonts, sizes or colors. This format is useful for quickly determining the important terms to identify key fraud issues
Figure 6: Tag Cloud
Interactive CXO dashboards A useful feature of analytics is that an entire data set can be converted to a meaningful dashboard for a CXO analysis. Such dashboards help in understanding databases and spreadsheets of any size with their easy drag and drop interface. They not only display information visually in seconds, but also create interactive maps with the click of a mouse. They can effectively analyze time series from years to months to the actual time in a day. Their most helpful feature is their capability to combine different databases to a single view and publish interactive dashboards on the Web.
Figure 7: Interactive CXO Dashboard
Here, we have sliced the entire expense dump of an organization from four key lenses including WHERE (geography), WHAT (type of expense), HOW (expense description) and WHO (the employee who incurred the expense). Having multi-dimensional data on a common platform helps a company perform an insightful analysis to determine the tests that need to be performed on expense data.
Forensic Data Analytics
7
Ernst & Young LLP EY | Assurance | Tax | Transactions | Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization and may refer to one or more of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com. About EY’s Fraud Investigation & Dispute Services Dealing with complex issues of fraud, regulatory compliance and business disputes can detract from efforts to achieve your company’s potential. Better management of fraud risk and compliance exposure is a critical business priority — no matter the industry sector. With our more than 2,000 fraud investigation and dispute professionals around the world, we assemble the right multidisciplinary and culturally aligned team to work with you and your legal advisors. And we work to give you the benefit of our broad sector experience, our deep subject matter knowledge and the latest insights from our work worldwide. It’s how EY makes a difference. Ernst & Young LLP is one of the Indian client serving member firms of EYGM Limited. For more information about our organization, please visit www.ey.com/in. Ernst & Young LLP is a Limited Liability Partnership, registered under the Limited Liability Partnership Act, 2008 in India, having its registered office at 22 Camac Street, 3rd Floor, Block C, Kolkata - 700016 © 2013 Ernst & Young LLP. Published in India. All Rights Reserved. EYIN1212-108 ED None This publication contains information in summary form and is therefore intended for general guidance only. It is not intended to be a substitute for detailed research or the exercise of professional judgment. Neither Ernst & Young LLP nor any other member of the global Ernst & Young organization can accept any responsibility for loss occasioned to any person acting or refraining from action as a result of any material in this publication. On any specific matter, reference should be made to the appropriate advisor.
Our offices Kolkata 22, Camac Street 3rd Floor, Block C” Kolkata-700 016 Tel: +91 33 6615 3400 Fax: +91 33 2281 7750
Ahmedabad 2nd floor, Shivalik Ishaan Near. C.N Vidhyalaya Ambawadi Ahmedabad-380 015 Tel: +91 79 6608 3800 Fax: +91 79 6608 3900 Bengaluru 12th & 13th floor “U B City” Canberra Block No.24, Vittal Mallya Road Bengaluru-560 001 Tel: +91 80 4027 5000 +91 80 6727 5000 Fax: +91 80 2210 6000 (12th floor) Fax: +91 80 2224 0695 (13th floor) 1st Floor, Prestige Emerald No.4, Madras Bank Road Lavelle Road Junction Bengaluru-560 001 India Tel: +91 80 6727 5000 Fax: +91 80 2222 4112 Chandigarh 1st Floor SCO: 166-167 Sector 9-C, Madhya Marg Chandigarh-160 009 Tel: +91 172 671 7800 Fax: +91 172 671 7888 Chennai Tidel Park 6th & 7th Floor A Block (Module 601,701-702) No.4, Rajiv Gandhi Salai Taramani Chennai-600 113 Tel: +91 44 6654 8100 Fax: +91 44 2254 0120 Hyderabad Oval Office 18, iLabs Centre Hitech City, Madhapur Hyderabad - 500 081 Tel: +91 40 6736 2000 Fax: +91 40 6736 2200 Kochi 9th Floor “ABAD Nucleus” NH-49, Maradu PO Kochi - 682 304 Tel: +91 484 304 4000 Fax: +91 484 270 5393
Mumbai 14th Floor, The Ruby 29 Senapati Bapat Marg Dadar (west) Mumbai-400 028, India Tel: +91 22 6192 0000 Fax: +91 22 6192 1000 5th Floor Block B-2 Nirlon Knowledge Park Off. Western Express Highway Goregaon (E) Mumbai-400 063, India Tel: +91 22 6192 0000 Fax: +91 22 6192 3000 NCR Golf View Corporate Tower – B Near DLF Golf Course Sector 42 Gurgaon–122 002 Tel: +91 124 464 4000 Fax: +91 124 464 4050 6th floor, HT House 18-20 Kasturba Gandhi Marg New Delhi-110 001 Tel: +91 11 4363 3000 Fax: +91 11 4363 3200 4th & 5th Floor, Plot No 2B Tower 2, Sector 126 Noida-201 304 Gautam Budh Nagar, U.P. India Tel: +91 120 671 7000 Fax: +91 120 671 7171 Pune C—401, 4th floor Panchshil Tech Park Yerwada (Near Don Bosco School) Pune-411 006 Tel: +91 20 6603 6000 Fax: +91 20 6601 5900
EY contacts Arpinder Singh Partner and National Leader Direct: +91 22 6192 0160 Email:
[email protected]
Mukul Shrivastava Partner Direct: +91 22 61922777 Email:
[email protected]
Sudesh Shetty Director Direct: +91 22 61921957 Email:
[email protected]
