《Detectlets for Better Fraud Detection.ppt》由会员分享，可在线阅读，更多相关《Detectlets for Better Fraud Detection.ppt（52页珍藏版）》请在三一文库上搜索。
1、Detectlets for Better Fraud Detection,Conan C. Albrecht, PhDMarriott School of ManagementBrigham Young University,Todays Presentation,Give a few fraud storiesOutline the Detectlet vision and Picalo ArchitectureShow example code and working productsDescribe future research directions and solicit help
2、,Two Types of Fraud,Fraud on behalf of an organizationFinancial statement manipulation to make the company look better to stockholdersAlso called management fraudFraud against an organizationStealing assets, information, etc.Also called employee or consumer fraud,ACFE Report to the Nation Occupation
3、al Fraud and Abuse,2 1/2 year study of 2608 Frauds totaling $15 millionFraud costs U.S. organizations more than $400 billion annually.Fraud and abuse costs employers an average of $9 a day per employeeThe average organization loses about 6 percent of its total annual revenue to fraud and abuse admit
4、ted to by its own employees,Ernst & Young Fraud Study 2002 (Europe),One in five workers are aware of fraud in their workplace80% would be willing to turn in a colleague but only 43% haveEmployers lost 20 cents on every dollar to workplace fraudTypes of fraudTheft of office items37%Claiming extra hou
5、rs worked16%Inflating expenses accounts7%Taking kickbacks from suppliers6%,Revenues$100100%Expenses 90 90%Net Income$ 10 10%Fraud 1Remaining $ 9To restore income to $10, need $10 more dollars of revenue to generate $1 more dollar of income.,Cost of Fraud,Fraud Losses Reduce Net Income $ for $If Prof
6、it Margin is 10%, Revenues Must Increase by 10 times Losses to Recover Affect on Net IncomeLosses. $1 MillionRevenue.$1 Billion,Large Bank$100 Million FraudProfit Margin = 10 %$1 Billion in Revenues NeededAt $100 per year per Checking Account, 10 Million New Accounts,Fraud Cost.Two Examples,Automobi
7、le Manufacturer$436 Million FraudProfit Margin = 10%$4.36 Billion in Revenues NeededAt $20,000 per Car, 218,000 Cars,Some of the organizations involved: Merrill Lynch, Chase, J.P. Morgan, Union Bank of Switzerland, Credit Lynnaise, Sumitomo, and others.,A Recent Fraud,Large Fraud of $2.6 Billion ove
8、r 9 yearsYear 1$600KYear 3$4 millionYear 5$80 millionYear 7$600 millionYear 9$2.6 billionIn years 8 and 9, four of the worlds largest banks were involved and lost over $500 million,Every Person Has A Price,Abraham Lincoln once threw a man out of his office, angrily turning down a substantial bribe.
9、“Every man has his price”, explained Lincoln, “and he was getting close to mine.”,Examples of Data-Based Detection,Superhuman Workers,Summed all hours (normal, OT, DT) per two week period, regardless of invoice or timecard)Workers were logging hours on two timecards for simultaneous jobs,The Family
10、Business,Work Orders Authorized By Purchaser,The Family Business,Invoice Charges Authorized By Purchaser,The Family Business,Work Orders Given To Contractor Crew,The Family Business,Tip stated that kickbacks were occurring with a certain companyWe researched the company and determined which purchase
11、r authorized the workA contractor crew and company purchaser were family,Systematic Increases In Spending,Systematic Increases In Spending,Unexpected Peaks In Spending,Increases In Only Part Of A Trend,Caught by his Pool,Research Background,Accounting History,1940 SEC Statement: “Accountants can be
12、expected to detect gross overstatements of assets and profits whether resulting from collusive fraud or otherwise” (Accounting Series Release 1940)1961: “If the ten (auditing) standards now accepted were satisfactory for their purpose we would not have the pleas for guidance on the extent of (audito
13、rs) responsibility for the detection of irregularities we now find in our professional literature.” (Mautz & Sharaf 1961)1997 - SAS 822002 - SAS 99,Expectation Gap,Historical Fraud Research,Excellent literature review by Nieschwietz, Shultz, & Zimbelman (2000)Who commits fraudRed flagsExpectation ga
14、pAuditor expectationsGame theory between auditors and managementAuditor-client relationshipsRisk assessment, decision aidsManagement factors affecting fraud,FS Fraud using Ratio Analysis,Hansen, et. al (1996) developed a generalized qualitative-response model from internal sourcesGreen and Choi (199
15、7) used neural networks to classify fraudulent casesSummers and Sweeny (1998) identified FS fraud using external and internal informationBenish (1999) developed a probit model using ratios for fraud identificationBell and Carcello (2000) developed a logistic regression model to identify fraudCurrent
16、 work by McKee and by Cecchini and by AlbrechtNone have found the “silver bullet” in using external information to identify fraudManagement (FS) fraud is very difficult to find,What are the Big 4 Doing?,Each firm seems to have different groups working on fraud detectionNo best practices model has em
17、ergedIT auditors perform control testing on company systems, not fraud detectionMeeting with Bill Titera of EY,Why Dont “They” Find Fraud?,Limited timeOur most precious resource is our attentionHistoryHeavy use of sampling - lack of detailLack of historical fraud detection instructionLack of fraud s
18、ymptom expertiseLack of fraud-specific toolsLack of analysis skillsLack of expertise in technologyAuditors do find 20-30 percent of fraudACFE 2004 Report to the Nation,Isnt there a better way?,Reasonable time requirements,Within reach of most auditors(highly technical skills not required),Cost effec
19、tive,Integrate easily into differentdatabase schemas,Integrate AI andauto-detection,Initial Thoughts,A small “manual” about fraudsCliff notes about different types of fraudDescribes the schemeDescribes the indicators of the schemeWorldwide repository wth contributions from many different industriesP
20、rimary focus was training,Detectlets,A detectlet encodes:Background information on a schemeDetail on a specific indicator of the schemeWizard interface to walk the user through input selectionAlgorithm coded in standard format“How to interpret results” follow-upInput is one or more table objectsOutp
21、ut is one or more table objects,Detectlet Demonstration,Bid rigging where one person prepares all bids,Potential Supporting Platforms,MS AccessACL or IDEABuild ground up applicationAllows total control over platformStays with open source rather than tying the program to a particular platformFor exam
22、ple, consider PowerBuilderSupports Windows, Unix, Linux, MacAllows embedded use within a greater platformPersonal preference was Python,Picalo: The Supporting Platform,Central Detectlet Repository,How Detectlets Address the Problem,Limited Time: Detectlets provide a wizard interface for quick execut
23、ion; they can be chained and automated into a larger systemHigh Cost: Detectlets are based in open source software, putting them within reach of small and large accounting firms; they also create a community environment for fraud detection,How Detectlets Address the Problem,Lack of fraud symptom exp
24、ertise: Detectlets provide a large library of available routines to both train and walk auditors through the detection processLack of fraud-specific tools: Picalo provides an open solution that we can improve over time; it puts a fraud-specific toolkit in the hands of auditors,How Detectlets Address
25、 the Problem,Lack of analysis skills: Detectlets encode full algorithms and code, allowing the auditor to stay at the conceptual level rather than the implementation levelLack of expertise in technology: Detectlets provide a wizard-based solution that are easy to use; Picalo provides an Excel-like u
26、ser interface,Picalo Level 1 API,Data Structures,The Table object is the basic data structure. Nearly all routines both input and return tables, allowing them to be chained. Its methods include sorting, column operations, row operations, import/export from delimited text and Excel formats.Column typ
27、es include Boolean, Integer, Floating Point, Date, DateTime, String, etc.,Simple Module,Provides joining, matching, fuzzy matching, and selection.col_join, col_left_join, col_right_join, col_match, col_match_same, col_match_diff, compare_records, custom_match, custom_match_same, custom_match_diff, d
28、escribe, expression_match, find_duplicates, find_gaps, fuzzysearch, fuzzymatch, fuzzycoljoin, get_unordered, join, left_join, right_join, select, select_by_value, select_outliers, select_outliers_z, select_nonoutliers, select_nonoutliers_z, select_records, soundex, soundexcol, sort, etc.,Benfords Mo
29、dule,calc_benford: Calculates probability for a single digitget_expected: Calculates probability for a full numberanalyze: Analyzes an entire data set and calculates summarized results,Crosstable Module,pivot: Similar to Excels pivot table functionpivot_table: Pivots and keeps detail in each cellpiv
30、ot_map: Pivots and keeps results in a dictionary rather than a gridpivot_map_detail: Pivots and keeps results in a very detailed fashion using a dictionary,Database Module,OdbcConnection: Connects to any ODBC-compliant databasePostgreSQLConnection: Connects to PostgreSQLMySQLConnection: Connects to
31、MySQLAlso includes various query helper functions, such as query creation, results analysis, etc.,Financial Module,Calculates various financial ratios to help in financial statement analysis:Current ratioQuick ratioNet working capitalReturn on assetsReturn on equityReturn on common equityProfit marg
32、inEarnings per shareAsset turnoverInventory turnoverDebt to equityPrice earnings,Grouping Module,Stratification gives the details behind SQL GROUP BY. It keeps the detail tables rather than summarizing them.stratify: Stratifies a table into N number of tablesstratify_by_expression: Stratifies a tabl
33、e using an arbitrary expressionstratify_by_value: Stratifies on unique valuesstratify_by_step: Stratifies based on a set numerical rangestratify_by_date: Stratifies based on a date rangeSummarizing is similar to SQL GROUP BY, but it allows any type of function to be used for summarization (GROUP BY
34、generally only allows sum, stdev, mean, etc.)This can by done in the same ways as stratification.,Trending Module,Various ways of analyzing trends and patterns over time.cusum, highlow_slope, average_slope, regression, handshake_slope,Python Libraries,Powerful yet easy language with a significant on
35、line communityFull object-oriented support (classes, inheritance, etc.)Text maniuplation and analysis routinesWeb site spidering routinesEmail analysis routinesRandom number generationConnection to nearly all databasesWeb site development and maintenanceCountless libraries available online (almost a
36、ll are open source),Research Directions,Level 1 Research,Foundation routines for fraud detectionDevelopment, testing, empirical use, field studiesConnections to production softwareStandard SAP, Oracle, Peoplesoft, JD Edwards, etc. modulesApplication of CS, statistics, other techniques to fraud detec
37、tionTime series analysisPattern recognition for fraud detection,Level 2 Research,Studies about detectlet presentation, user interfaceCreation and testing of detectlets for industries, data schemas, etc.Detectlets for financial statement fraud detectionTesting of detectlet vs. traditional ACL-type fr
38、aud detectionPatterns of detectlet development, best practices,Level 3 Research,Automatic mapping of field schemas to a common schemaApplication of expert system, learning models for automatic detectionDecision treesClassification modelsMeta-detectlets to combine various Level 2 detectlets into high
39、er-level logic,Other Research,Group-oriented processes for the central repositorySearching, categorizationTesting, rating systemsMarketplaces for detectletsDevelopment of Picalo itself,My Hope,In 5 years well have a large repository of detectlets to:Support both external and internal auditorsTeach students in fraud classesConduct theoretical and empirical research,http:/www.picalo.org/,