acumen

insight
ideas
attention
Forensic Data Mining:
Finding Needles in Haystack reach
expertise
Presented by
depth
Angela Morelock, CPA, CFE, CFF, ABV
agility
Certified Forensic Accountant
BKD, LLP talent

acumen
insight
ideas
attention
reach
expertise
depth
agility
talent

2008 by the Association of Certified Fraud Examiners, Inc.

Cost of Fraud & Abuse
$994 billion
annually
7% of revenues
42% recover
nothing after fraud
discovered

Victim Organizations
2008 by the Association of Certified Fraud Examiners, Inc.
 How Occupational Fraud is Committed

Breakdown of All Occupational Fraud Schemes Frequency3

3The sum of percentages in this chart exceeds 100 percent because several cases involved multiple schemes from more than one category.

5
2008 by the Association of Certified Fraud Examiners, Inc.

Victim Organizations

Occupational Fraud Schemes in Government

and Public Administration (106 cases)12

12The sum of percentages in this chart exceeds 100 percent because several cases involved multiple schemes from more than one category.

6
2008 by the Association of Certified Fraud Examiners, Inc.
 Victim Organizations

Occupational Fraud Schemes in the

Education Industry (59 cases)16

16The sum of percentages in this chart exceeds 100 percent because several cases involved multiple schemes from more than one category.

7
2008 by the Association of Certified Fraud Examiners, Inc.

Damages to Victims Beyond

Dollars & Cents
Reputation
Loss of public confidence
Detrimental to attracting new potential
donors & volunteers
Damage to relationships
Sagging staff morale
Distraction from mission
Accounts Payable & Purchasing
Personal bills
Fictitious suppliers
Kickbacks
Ordering personal
items
Petty cash funds
Employee expense
accounts
Credit cards

Data Analysis vs. Data Mining

Why Forensic Data Mining?
30% of all frauds are found by analysis vs. tips, accidental
discovery and disclosure (Coderre, Fraud Detection)

More efficient & effective than traditional sampling

Find needle in haystack

100% analysis is the most effective way to analyze for fraud (Dr.
Conan Albrecht, BYU)

Components of Project
Data Cleansing
417-865-8701, (417)865-8701, 8658701, 417-8658710
Missoura, MO, Mis, Miss, MZ, MS, Miz, Mizz
507-02-4567, 507024567, 507 02 4567
PO Box 34, P.O. Box 34, Box 34, Bx 34, P.O Box 34
Mallery, Malery, Mallrey, Mallory, Malory

Common Data Mining Areas

Employees & payroll
Vendors & accounts payable
Expense reimbursement
Loans (for financial institutions only)
Sales
Inventory
Vendor Trending Analysis
Time Series Analysis: Acceleration
Vendor: JLM Plumbing Authorized: Janice L. McPhearson

Getting
greedy
Acceleration
as confidence
builds

Test
phase

Name Mining - Anagrams

Name Mining - Anagrams

Name & Address Mining

Name & ID analysis
Direct matching
Phonetic matching (Double metaphone hybrid)
Compare to known name dictionaries
Anagram search
Duplicate employee ID/SSN, invalid SSNs
Address analysis
Direct matching
No address, invalid address, PO/RR address
Proximity by latitude/longitude lookup
Address is known mailbox service (FedEx Kinkos, UPS Store, etc.)
Visual map analysis
Address Matching
Address Match Example

Employee-Vendor Proximity
Benfords Law Analysis

Benfords Law Payroll

Normal Pattern
Benfords Law Payroll

Abnormal Pattern

Benfords Law A/P

Benfords Law A/P

Check Sequence Analysis

Accounts Payable Mining
AP: Fictitious vendors, duplicate payments, etc.
Benfords analysis
Acronym search on employee name
Acceleration (systematic spending increases) via time series analysis
Duplicate invoices
Duplicate payments
Identify invoices in excess of n% of vendor average
Compare PO/invoice amount to check amount
Identify transactions ending in 5 or 0
Baseline vendor activity against overall activity
Classify transactions by clerk/approver
Compare multiple vendor master files over 3 years
Identify statistical outliers (Z-score method)

Payroll Mining
Payroll detail
Employees with no deductions
PR activity subsequent to termination
Employee vs. department baselines ($ & hrs)
Department vs. company baselines ($ & hrs)
Benford's analysis of gross/net payroll
Time series analysis
Employee with no sick/vacation/time off
Computed pay rate vs. employee master rate
Compare actual pay rates to rate schedule
Other analysis
Duplicate phone number(s)
Duplicate direct deposit accounts
Short duration of hire/termination
Questions?
Angela Morelock, CPA, CFE, CFF, ABV
Certified Forensic Accountant
BKD, LLP
901 E. St. Louis Street
Springfield, MO 65806
Phone: 417.865.8701
Fax: 417.865.0682
Email: amorelock@bkd.com