Using Data Analysis to Detect Fraud - Dallas …

1 IIA Dallas Chapter MeetingUsing data Analysis to Detect FraudEdward Glynn, DirectorPwC Technology, Forensics & AnalyticsMarch 2007 For more information, contact:Edward Glynn2001 Ross Avenue, Suite 1800 Dallas , TX 75214(214) data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 DisclaimerDisclaimerThe views in this presentation are those of Mr. Glynn. Althoughheworks for us, he has a tendency to get carried away in large grouppresentations and he may, with the express hope that the audience willremember and find useful something/anything he said:Show off;Try to be humorous;Misconstrue language (English and others)Knowing Mr.

2 Glynn as we do, achieving his presentation objectives islikely not possible. As a result, PricewaterhouseCoopers disclaimsany and all responsibility for just about everything Mr. Glynn may do orsay to you alignment of Mr. Glynn s views and those of PwC are thereforelargely Risk & Quality PartnerPricewaterhouseCoopers LLPP rovoke;Exaggerate; or13-Slide3 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 There is a tendency to mistakedataforwisdom, just as there has alwaysbeen a tendency to confuse logic with values, intelligence access to facts can produce unlimited good only ifit is matchedby the desire and ability to find out what they mean and where they are terrible things if left sprawling and unattended.

3 Theyare too easilyregarded as evaluated certainties rather than as the rawest of raw materialscrying to be processed into the texture of logic. It requires avery unusualmind, Whitehead said, to undertake the Analysis of a fact. The computer canprovide acorrect number, but it may be anirrelevant numberuntiljudgmentispronounced. Norman Cousins (1912 1990), editor,author. Freedom as Teacher, HumanOptions: An Autobiographical Notebook,Norton (1981).Slide4 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Whygoodpeople dobadthingsPressureRationalizationOpport unitySlide5 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Slide6 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Whodetectsfraud?

4 Source:PricewaterhouseCoopers Global Economic CrimeSurvey 2005 Analysis FrameworkAnalytic TechniquesTechnologySlide8 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Industry & Company KnowledgePaymentsCompany DataIndustry DataPurchasingEmployeeVendorConsortiumAd dressesPublic RecordsRepositoryIdentify and Develop AnalyticsApply analytics to DataResearch LeadsRefine AnalyticsInvestigativeProceduresHigh Priorityof InterestNo ActionData Analysis FrameworkOutlineData Analysis FrameworkAnalytic TechniquesTechnologySlide10 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Slide11 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Compare suppliers to employeesStandard test to show potential conflicts of interestAnalytic TechniquesSlide12 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Analyze vendor activityDo you see an anomaly?

5 Analytic TechniquesVendorNumberVendor NameInvoiceNumberInvoice DateInvoiceAmount10034578 CPG Air Freight30417/12/200612,72310034578 CPG Air Freight30428/18/200611,86310034578 CPG Air Freight30439/8/200614,77110034578 CPG Air Freight304410/4/200614,75010034578 CPG Air Freight304511/17/200618,99210034578 CPG Air Freight304612/1/200618,97210034578 CPG Air Freight304712/22/200618,990 Total Invoiced:111,061 Sequential invoice numbersSlide13 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007Do you see the anomaly?

6 Ghost employeesAnalytic TechniquesEmployeeIDEmployee NameLoctionDirect DepositAccountDepositAmount10078 William KayakBuffalo, NY0007562273,24311265 Edward CookMiami, FL0007562275,53813655 Nancy WrightChicago, IL0007562272,236 Total Paid:11,017 Direct deposit numbers are identical forthree employees in three geographiesSlide14 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Gaps in Check Numbers by issuing bankUnrecorded paymentsAnalytic TechniquesSlide15 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Benford s LawUtilizes digit and numberpatterns to Detect Fraud ,errors, biases, andirregularities.

7 Significantdifferences between a dataset s digit distribution and thedigit distribution ofBenford sLaw serve as a flag formanufactured or manipulateddata and suggest that furtheranalysis may be TechniquesAreas for furtheranalysisSlide16 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Who can pronounce this word?INVIGILATION:Compare Fraud free locations to other locationsAnalytic TechniquesKeep an eye on, watch over, observe, followHQBranchGBranchBBranchCBranchDBran chABranchEBranchFSlide17 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 How do you analyze 100 million transactions?

8 At a a and sequencingAnalytic Techniques100 million8,500 employees170 stores80,000 suppliers1,150,000 customersSlide18 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Combining several sources of dataAnalytic TechniquesInventoryMovementsOrdersShippi ngFreight BillsCustomerBillingCash ReceiptsDisbursementsOrdersInventoryShip pingFreightDisbursementsBillingCashRecei pts1010101010101010101010101010101010101 0101010101010101010010101010101010101010 1010101010101010101010101010101010110101 0101010101010101010101010101010101010101 0101010101001010101010101010101010101010 101010101010101010101010101

9 Slide19 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 Testing across combined attributesAnalytic TechniquesOrdersInventoryShippingFreight DisbursementsBillingCashReceipts10101010 1010101010101010101010101010101010101010 1010101001010101010101010101010101010101 0101010101010101010101011010101010101010 1010101010101010101010101010101010101010 0101010101010101010101010101010101010101 0101010101010101 ABCDEFC ountTotalYYYYYY894470,356 YYYYYN273(21,754)YYYYNN122(9,274)YYNNYY1 65(11,666)YYNNNN65(7,249)YNNNNN13(3,254) NNNNNN43(64,089)Slide20 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 ClusteringGrouping of matched entities by property typeA=B, B=C; therefore, A=B=C-A = Bob Jones-B = Trucking Inc (Attn: Robert Jones)-C = NY Trucking IncAnalytic TechniquesBob JonesTrucking Inc(Attn Robert Jones)Name, AddressTrucking Inc(Attn Robert Jones)NY Trucking IncNameSlide21 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007ID#NameAddressCityStateZipNote515415 5 Lane M.

10 Hitchcock910 17thStreet NWWashintonDC20006A1617 Lane Hitchcock, M.,910 Seventeenth Street NWDX20006021115146261 MyronStucky110 Eye St. ID87121 Stucky, Myron110 I Street 1stfloorDCFR Alert87458 Fisher & Smith Inc319 7thSt. DC20003 data inWrong FieldFreeFormTextNo uniquekeyMissingValuesSpellingErrorsComp anyNamesData EntryErrorsData Quality ChallengesBuriedInformationNo consistentnaming conventionSlide22 Using data Analysis to Detect and Deter FraudPricewaterhouseCoopersMarch 2007 data Quality Challenges Transliteration of NamesWest AfricaWest AfricaHageImhemed OtmaneAbderaqibLevantineLevantineMuhamad UsmanAbdel RaqeebIraqIraqHajj Mohamed Uthman AbdAl RagibEast AfricaEast AfricaHag Muhammad OsmanAbdurra ibPersian GulfPersian GulfHaj Mohd