Data-Driven Approaches to Identifying Risk and Indicators of Fraud November 2013

Transcription

1 Data-Driven Approaches to Identifying Risk and Indicators of Fraud November 2013 David Coderre Public Servant in Residence Office of the Comptroller General of Canada 1

2 Agenda The problem Subjective and qualitative analysis Yearly review The solution Quantitative analysis Ongoing assessment of risk

3 Issues Risk assessment is primarily qualitative and subjective Corporate risk profile does not allow you to examine risk at the organizational entity level Corporate risk profile does not allow you to examine the different risk categories (e.g. financial, HR, operational, strategic) Risk profile is time consuming to update Risks are typically only updated once a year

4 Misconduct/Fraud Occurrence Globally 70% of companies suffer from at least one type of fraud last year Cost of fraud is 5% of revenue - projected worldwide, this is $3.5 trillion dollars per year Fraud takes 18 months to detect (median) 73% have witnesses misconduct during the last 12 months 56% feel the misconduct could cause a serious loss of public trust Serious misconduct in: healthcare, banking and finance, aerospace and defence, government and technology Sources: Kroll Global Fraud Report; ACFE - Report to the Nations 2012; and the KPMG Integrity Survey 2013.

5 Data-driven Risk Indicators Data Analytics risk identification and assessment Ideally: Quantitative indicators By-product of operational systems (e.g. financial and HR systems) React to changes in risk levels Support the assessment risk at any level Support annual risk assessment process Easy to update (monthly/quarterly)

6 Risk Categories - example External environment Legal and regulatory Strategy Governance Operational Information Human resources Technology Financial and administrative

7 Risk Assessment Risk indicators Objective: to assess each organizational entity on each risk category to arrive at a measure of overall risk ranking (Low, Medium, High) for each entity. For example: Org Entity Finance HR Operations Strategic Rank Entity 1 30% 5 18% % % Low Entity 2 13% 8 35% % % Med Entity X 4% 16 3% % % High 7

8 Overall Risk - Rating by Region 3 NF NWT 2.5 NB 2 BC NS AB PEI SK QC MB ON 8

9 Overall Risk- by Region by Risk Category 1 NF HR Fin Legal NWT NB Strat BC NS AB PEI SK QC MB ON 9

10 Data-driven Risk Indicators Risk > Probability and Impact Probability is affected by: Variability / Change Complexity of environment / framework / controls Impact is affect by: Materiality / Volume / Size 10

11 Data-driven Risk Indicators Risk > Probability and Impact Risk -> Variability/Change, Complexity, Volume 11

12 HR - Risk indicators Risk Sub-category Risk Risk Indicator Human Resource Risks: Recruiting failure to attract people with the right competencies. Lack of resources Lack of skills? Vacancies Acting appointments? Resource Allocation failure to allocate resources in an effective manner to support the achievement of goals and objectives. Retention failure to retain people with the right competencies and match them to the right jobs. Inappropriate resources for tasks? Demographics Low experience levels turnover Type of employee Employee classifications Status of employee Unions? Years of pensionable service Average age Average years in position? Work environment failure to treat people with value and respect. Unhappy workforce High sick leave Average sick leave/vacations Percentage departures?

13 HR Data-driven Risk Indicators Volume / Size # of employees Variability/Change Avg age; avg age of senior managers Avg years of pensionable service; % who can retire < 2 years Experience years in dept / position / classification % Fulltime employees; % affected by org change % acting ; % new hires Leave: total leave taken; avg sick; avg vacation; avg unpaid Complexity Other # types of employee; # classifications; # locations; # unions % employee with non-std hours % Sex (M/F); % FOL (Eng/Fr) 13

14 HR Data-driven Risk Indicators Objective: to support the assessment of HR risk for each audit entity. Audit Entity Volume Variability/Change Complexity Rank Entity % % Medium Entity % % High Entity X % % Low 14

15 HR Risk Rating by Region 1 NF Volume BC NB Variability Complexity AB NS SK PEI MB QC ON 15

16 HR Risk Rating by Region HR - Complexity NWT NF NB Num_EmpTypeR Num_ClassR Num_RegionR Num_UnionR BC NS Pct_NoStdWWR AB PEI High-level of HR Risk SK QC MB ON 16

17 Finance - Data-driven Risk Indicators Volume Total Expenses, Revenue and Assets Variability/Change Percentage of discretionary spending Percentage of expenditures in Period 12, 13+ Total and number of JVs / Suspense account transactions Total and number of Reversal documents / Loss transactions Complexity Number of Funds / Fund centres / Cost centres Number of Economic object categories / GLs Number of Currencies / Document types Use of Internal Orders / Purchase orders / Fund reservations Use of Materiel and Asset numbers / Real estate blocks / WBS Number of employees Number of P-Cards

18 Overall Risk Objective: to support the assessment of Financial risk for each organizational entity. Org Entity Financial HR Operational Rank Entity Low Entity High Entity X Medium 18

19 Fraud Risk Data-driven indicators of fraud risk: Control weaknesses / exposures Symptoms of fraud in the data Known symptoms Unknown symptoms

20 Assessing Fraud Risk Control Weakness Fraudster Data Fields Data Analysis Tests Start by defining control weaknesses Start by defining key data fields * Computer-Aided Fraud Prevention and Detection: A Step-by-Step Guide 20

21 Fraud Risk Approach #1 Consider Control Weakness - from the Fraudster s Perspective: Who could Benefit? How could they be Involved? What can they Affect/Manipulate or Control to Allow Fraud to Happen? Can they Act Alone or is Collusion Required? What data analysis would identify the control exposures? 21

22 No Control over Quantity Received vs Ordered: Source - Contract info / Receipt Data Data - Ordered data / Quantity Received Analysis - Received Qty > Ordered Qty Possible fraudsters: Contracting Officer kickbacks Vendor increase sales Receiving Clerk steal excess items???? 22

23 Fraud Risk Approach #2 Info? Key data fields Who? Enter Modify Delete Why? Motivation Objective What? Key Controls Tests? Source Integrity 23

24 Info Who Why Control Test Vendor Clerk Vendor Duplicates Fictitious Change address/ bank account Duplicates Vendor creation / modification Log Duplicates Blanks in key fields Classify on Created by Vendor Usage by clerk Modifications by clerk Duplicates Invoice number Clerk Vendor Duplicates Duplicates Duplicates Duplicates Duplicates Amount Clerk Over payment Pymt terms 3-way matching Vendor table IR <> GR or Contract Crosstab Vendor by payment terms Vendor Over charge 3-way matching IR <> GR or Contract 241

25 Data-driven Risk Indicators Use operational system information Can easily be updated (e.g. monthly/quarterly) Quantitative Provide relative risk ranking for each organizational entity Support the risk identification and assessment process Focused interviews with senior management Support risk management activities Support the ongoing update of the corporate risk profile

26 26