The use of traditional data analytics continues to gain traction in the world of auditing to identify the patterns and trends indicative of fraud; however, these tactics may simply not be enough anymore. Looking beyond traditional analytics to the analysis of unstructured data may help paint a clearer picture and uncover a wealth of evidence that could have gone undetected with traditional analytics. When faced with disparate information systems or spotty evidence, the analysis of unstructured data can be especially helpful.
Let’s look at an example of how data analytics can help reveal the truth in an investigation.
Troubled by questions arising from unexplained growth in a national advertising agency’s line of credit, our team was called to help find the truth behind the numbers. The line of credit was expected to naturally ebb and flow to meet cash needs, including capital expenditures, repayment of term debt, client advances and bonuses to key employees.
Looking for a Needle in a Haystack
Where should investigators begin with so little information to go on? While the techniques used for the assessment and examination of fraud can differ considerably from those used in financial statement auditing, one thing is clear: the use of data analytics to identify the exposures to wrongdoing is a valuable tool in the investigation toolbox.
A picture says a thousand words—and nothing tells a story better than electronic data. Accounts that have been manipulated to conceal wrongdoing usually show unusual relationships with other accounts that have not been manipulated. Data analytics are invaluable when combined with interviews to gain an understanding of business operations, accounting processes and accounting information systems. Beyond the basics, advanced analytics of unstructured data can further an investigation to help ferret out the truth.
When looking for a needle in a haystack, casting a wide net over the financial statements can help identify an investigative focus. Our journey with the advertising agency started with a comparative analysis of the financial statements. While the numbers themselves were interesting, data visualization helped bring the story to life.
The line of credit fluctuated as expected with the exception of its relationship to a wildly increasing intra-agency receivable. The receivable represented an anomaly that should be explained by cash requirements for client advances. Our analysis of the client advances did not support such a theory.
Analysis of the Structured Data
While some financial improprieties are more difficult than others to detect when controls have been circumvented, most can be detected far sooner through analytics designed to drill down into financial data to identify suspicious transactions.
Using data analytics for expenditures (e.g. duplicates, gaps, stratify, classify, Benford’s analysis) many suspicious transactions related to one vendor were exposed:
• Payments to one vendor increased 342 percent from 2011 to 2012.
• Analysis of invoices under the limit requiring an executive’s signature showed that two-thirds of the vendor’s invoices were just below the $1,500 limit.
• Nearly 100 percent of invoices from the vendor were less than $1,500 limit.
• An analysis of invoice dates revealed that on 75 occasions 50 or more of the vendor’s invoices had the same date and most bore consecutive invoice numbers.
The patterns were interesting—but more work was needed before jumping to conclusions. They provided no explanation for the continued rise of the receivable once the client advances leveled off.
Analysis of the Unstructured Data
Challenged by the lack of access to structured accounting data? With the growing volume of data—and the variety of unstructured data available (e.g. email, text, voicemail, etc.) —unstructured data is becoming equally valuable. Knowing where to look and how to gain access can make or break an investigation—and the agency case was a prime example.
The process of recording cash receipts and reporting fees to corporate accounting involved the creation of a daily report by an accounting clerk and a chain of emails through the Production accounting department before being sent to corporate accounting. No one, including the controller, maintained a copy of the daily report. However, their emails told a much different story.
An extraction of all email boxes allowed us to resurrect nearly every daily report, from the sent boxes of the accounting clerks to the inbox and sent box of the controller and corporate accounting. A side-by-side reconstruction of each version of the daily report blew our investigation wide open, revealing unexplained alterations of revenue.
The common thread? The controller.
Isolating the analysis to a single month, we were able to hone in on the flow of the reporting of production fees—every alteration of fees occurred between the inbox and outbox of the controller. The metadata revealed that many of the alterations occurred within seconds of receipt from the clerk and sending to corporate accounting—conveniently in multiples of $10,000. For example, if the fee initially recorded by the clerk was $1,234, a one was added to the first position reporting the fee as $11,234. In that single month, production fees were overstated by several hundred thousand dollars.
The Turning Point
The identification of the altered revenue and our target was the turning point in our investigation. Using additional investigative techniques, we further developed the evidence of millions in overstated revenue and a fictitious vendor related to the controller. Armed with the evidence, we conducted an admission seeking interview of the controller who ultimately confessed to both schemes. Starting off small with the fictitious vendor scheme, he soon found the large bonus created from fictitious revenue to far outweigh the benefit of his fictitious vendor scheme.
Traditional data analytics proved successful in identifying the focus of our investigation and the patterns indicative of a fictitious vendor—and many would have stopped there. However, when we combined traditional analytics with the analysis of unstructured data, we drilled deep to uncover two fraud schemes, and ultimately, the truth.
