Evolution of Forensic Data Analytics - EY India

1. Forensic Data Analytics

2. Key to unlocking invisible information using forensic “lookback” Forensic Data Analytics as a topic and its adoption within the industry had long been overdue. With the advent of technology and increasing incidents of fraud, there has been a significant rise in adoption of Forensic Data Analytics. Due to this, company appointed auditors and independent directors are now seeking to implement proactive fraud-prevention solutions and are avoiding post- incident remediation processes. Forensic Data Analytics is a science used to proactively seek opportunities to prevent and detect fraud, waste and abuse by leveraging information in corporate data assets. It enables identification of meaningful patterns and correlations in existing historic data to predict future events and assess the reasons for various fraudulent activities. Such insightful predictive information is generally “invisible,” but provides a platform on which organizations can take business decisions related to fraud, disputes and misconduct. “ “ The greatest value of forensic analytics is when it forces us to notice what we did not expect to see.

3. Evolution of forensic data analytics Without big data analytics, companies are blind and deaf, meandering aimlessly like a deer on freeway day, and that number is doubling every 40 months Big data is a reality: The volume, variety and velocity of data coming into the organization have reached unprecedented levels. About 2.5 exabytes of data are created each 1. Big data Torture the data, and it will confess to anything data warehousing techniques may not be able to identify anomalies in the existing data set thus preventing proactive fraud management Issues in managing big data: Big data requires high performance analytics to process billions of rows of data with hundreds of millions of data combinations. The traditional 2. Manage data Absence of forensic evidence is not evidence of forensic absence Recent scams in the limelight: In the recent times, India has been hit with multi billion value scams associated with the following: Bribery and Corruption • 3. Key Risk Events Procurement fraud and collusion in bidding process • Accounting misstatement • Anti Money Laundering • Forensic analytics is the oil of the 21st century which protects organizations combustion engine from going bust 4. possible if existing data assets were analyzed from forensic perspective to avoid wrongful or criminal deception intended to result in financial or personal gain. Adoption of forensic data analytics: The associated risks could have been mitigated if key stakeholders would have paid attention to anomalies at an earlier stage. This could have been Forensic Data Analytics How does forensic data analytics help organizations? Proactive fraud prevention management Controlling the magnitude of fraud in a reactive set up Effective and focused internal controls Improving regulatory and compliance environment • • • • 3 Forensic Data Analytics

4. Capability landscape Forensic Data Analytics can be used as a standalone service or in conjunction with existing practices such as investigations, audits, process review and due diligence. In the current context, data exists in structured (multiple form of databases) and unstructured forms (emails, office documents, presentations, Excel sheets, PDF files, archive files, text and image files) in organizations. Using EY’s proprietary tools, raw data can be transformed into formats that can be analyzed, and with the help of advanced analytical capabilities, anomalies can be identified that may indicate potential fraud. Some of our key offerings include, but not limited to, identification of fraud in vendor, customer and employee registration, procurement to pay, order to cash, sales and distribution, travel and entertainment, payroll disbursment. Our forensic analytic models are developed to identify variances in data sets, which may impact an organization’s profit and loss statement. This model also touches on various aspects, from simple narration captured in a transaction to complicated sentiments and tone analysis. It also includes data within applications and data recorded on social and professional networks for further analysis. This analysis helps a company to move beyond identification of low value pilferage to implementing controls on existing and potential weak areas. Any dataset in historic, near real time and real time form can be assimilated through big data solutions to help a company improve its bottom line by checking fraudulent activities Unstructured data Forensic data analytics Sample Dashboard Debit/Credit Credit Journal Entries and Amount Per User Amount per Account Name User_ID EY_Account_Name NL trading account NX Debit 60,565,488 79,779 200M EY_Class Assets Cost of Revenue Expense Expenses Functional Transfer Ac.. Liabilities & Stockholde.. Local Legal Accounts (.. Other income and ded.. EY_Account_Name Product/Program Rela.. Purchases not capitali.. (G)/L on Sales of Equip.. 13th Month Salaries #1 A&P - Customer Events A&P - Trade shows A&P Collaterals - Prod.. A/P - Credit out of Debi.. EY_TIME_TAG After office hours entries Within Office hours ent.. Trade Rec'bles - Receivables 58,874,500 Agency Billing Settlement Ac.. Distinct count of Journal_ID FSMA Revenue - Other Disc.. 50K 50,276 Rental Rev. - Short Term Re.. 100M Amount -60M -40M -20M 0M 20M 40M 60M Amount 9,131 Amount per Sub Category Structured output 2,541 1,864 716 333 291 4,869 0M 0K 2,3933,705 91 34 EY_Sub_Category 4 2 Accounts Receivable: Trade 58,874,500 Other Current Assets: Miscel.. Due to (from) Trade and Oth.. -67,944,770 67,944,770 RVBEUSEKOM CLABRAVEGA SKAYA BJANKI CKLEIN GGOOSEN ANVSCHAIK AKLERK PWENNEKES TKOPPENS TSMITS BATCHUSER NWINTER JHAMAKER SAMEIER Rental Revenue: Rental Agr.. Deferred Rental Revenue Deferred Revenue Managed.. -60M -40M -20M 0M 20M 40M 60M Amount Account name per month (Calculated Based on Document Number) Effective_Date 2011 2012 EY_Entry_week_day Sunday Monday Tuesday Wednesday Thursday Friday Saturday Account Name July August September October November December January February Agency Billing Settlement Ac.. -393,707 -192,406 -254,811 Agency Billing Settlement Ac.. Billing Settlement A (165799.. -943,525 -615,525 -274,752 -83,159 Deferred Rev. - FM (213009.. -620,377 -454,933 Deferred Rev. - FSMA (2130.. Deferred Revenue - Rental (.. FM Rev. - Additional Sales (.. -801,576 EY_Entry_month_end No Yes FM Rev. - FSMA Rev. Varia.. -10M 0M 10M -10M 0M 10M -10M 0M 10M -10M 0M 10M -10M 0M 10M -10M 0M 10M -10M 0M 10M -10M 0M 10M Amount Amount Amount Amount Amount Amount Amount Amount Figure 1: Structured output from unstructured data 4 Forensic Data Analytics

5. Our key differentiator in forensic data analytics At EY, data analytic techniques applied to internal or external fraud follows a four pillar approach — WHO- WHAT-WHEN- WHY. This approach looks at any situation from all possible angles and highlights key issues. This does not only help in managing risks, but also in identification of potential growth areas. “ The key to identify fraud lies in the ability to comprehend what lies beneath. ” Increasing concerns about fraud and vulnerability can be alleviated by a range of forensic techniques, some of which are presented below. Link Analysis Employee group Link Analysis is a data-analysis technique used to evaluate relationships (connections) between nodes, including organizations, people and transactions. Key applications of this technique include analysis of EPBX data, mobile bills and user logical access records that help a company map its user footprint. Employee- vendor nexus In a recent incident in a manufacturing company, its phone records were analyzed across different zones to determine the nexus between its employees and selected vendors on procurement and disposal of scrap. Using Link Analysis, we were able to establish “hidden” relationships and information leakage from suspected employees to identified vendors for possible “kickbacks.” The size and width of connectors indicate frequency of the calls Third party Vendor group Figure 2: Link Analysis 5 Forensic Data Analytics

6. Social Network Analysis Social Network Analysis views relationships in terms of network theory, which consists of nodes and ties. Nodes represent individual “actors” within the network and Ties represent relationships between individuals, e.g., friendships, kinship, organizational position, etc. Social Network Analysis, along with Link Analysis, helps to identify related parties, conflict of interest, bid rigging, among other fraud. India lead managing business throughout India through relatives as key distributors In a large consumer products company, the India lead had appointed his relatives as distributors, and through known vendors, managed distribution of products in key states. Social Network Analysis, followed with a background check, helped to reveal the nexus. This led to a full-blown investigation and the company now undergoes vendor due diligence before it carries out any business. India sales head Vendor network in east Vendor network in west Relatives as key distributors Vendor network in south Vendor network in north Figure 3: Social Network Analysis Concept Clustering Concept Clustering involves grouping similar entities or behavior into tight semantic clusters for the purpose of identifying anomalies or red flag. It is used actively, along with an electronic data review. In this example, Concept Clustering was executed on more than a million documents to identify all the information with terms such as “gifts,” “incentive” and “facilitation.” We were able to bring these down to a sizable volume with the required criteria that was analyzed in a time- bound manner. Concept Clustering can be effectively used on structured and unstructured data. Miscellaneous Fraud Cash Gift Figure 4: Concept Clustering Sentiment Analysis Known as behavioral analysis, this refers to the application of text analytics to identify and extract subjective information including the attitudes of writers, their affective state and the intended emotional quotient. It determines whether expressed opinions in a document are positive, negative or neutral. The “fraud triangle” can be applied to categorize events into rationalization, opportunity and pressure to identify sentiments. Organizations use this data to conduct behavioral training, stem attrition, and identify disgruntled employees and potential fraud conversation. Angry Surprised Confused Cursing Derogatory Figure 5: Sentiment Analysis 6 Forensic Data Analytics

7. Data Visualization — identifying the “hidden” from “not so apparent” Data Visualization techniques have proved to be effective, since humans can better absorb large pieces of information in a visual format than that displayed in numbers or text. When the result of a fraud identification query is combined with Data Visualization, e.g., an account payable or journal entry data, a significant amount of useful and previously invisible information can be reviewed at one go. Tag Cloud One of the most widely used visual techniques is a Tag Cloud. This is a good example of expressing complex data that can be understood intuitively. A Tag Cloud is the visual representation of communication relating to transactional data entries. It is represented by a combination of words in varied fonts, sizes or colors. This format is useful for quickly determining the important terms to identify key fraud issues Figure 6: Tag Cloud Interactive CXO dashboards A useful feature of analytics is that an entire data set can be converted to a meaningful dashboard for a CXO analysis. Such dashboards help in understanding databases and spreadsheets of any size with their easy drag and drop interface. They not only display information visually in seconds, but also create interactive maps with the click of a mouse. They can effectively analyze time series from years to months to the actual time in a day. Their most helpful feature is their capability to combine different databases to a single view and publish interactive dashboards on the Web. Figure 7: Interactive CXO Dashboard Here, we have sliced the entire expense dump of an organization from four key lenses including WHERE (geography), WHAT (type of expense), HOW (expense description) and WHO (the employee who incurred the expense). Having multi-dimensional data on a common platform helps a company perform an insightful analysis to determine the tests that need to be performed on expense data. 7 Forensic Data Analytics

8. Our offices Ernst & Young LLP EY | Assurance | Tax | Transactions | Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. Ahmedabad 2nd floor, Shivalik Ishaan Near. C.N Vidhyalaya Ambawadi Ahmedabad-380 015 Tel: +91 79 6608 3800 Fax: +91 79 6608 3900 Kolkata 22, Camac Street 3rd Floor, Block C” Kolkata-700 016 Tel: +91 33 6615 3400 Fax: +91 33 2281 7750 Mumbai 14th Floor, The Ruby 29 Senapati Bapat Marg Dadar (west) Mumbai-400 028, India Tel: +91 22 6192 0000 Fax: +91 22 6192 1000 Bengaluru 12th & 13th floor “U B City” Canberra Block No.24, Vittal Mallya Road Bengaluru-560 001 Tel: +91 80 4027 5000 +91 80 6727 5000 Fax: +91 80 2210 6000 (12th floor) Fax: +91 80 2224 0695 (13th floor) EY refers to the global organization and may refer to one or more of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com. 5th Floor Block B-2 Nirlon Knowledge Park Off. Western Express Highway Goregaon (E) Mumbai-400 063, India Tel: +91 22 6192 0000 Fax: +91 22 6192 3000 About EY’s Fraud Investigation & Dispute Services Dealing with complex issues of fraud, regulatory compliance and business disputes can detract from efforts to achieve your company’s potential. Better management of fraud risk and compliance exposure is a critical business priority — no matter the industry sector. With our more than 2,000 fraud investigation and dispute professionals around the world, we assemble the right multidisciplinary and culturally aligned team to work with you and your legal advisors. And we work to give you the benefit of our broad sector experience, our deep subject matter knowledge and the latest insights from our work worldwide. It’s how EY makes a difference. 1st Floor, Prestige Emerald No.4, Madras Bank Road Lavelle Road Junction Bengaluru-560 001 India Tel: +91 80 6727 5000 Fax: +91 80 2222 4112 NCR Golf View Corporate Tower – B Near DLF Golf Course Sector 42 Gurgaon–122 002 Tel: +91 124 464 4000 Fax: +91 124 464 4050 Chandigarh 1st Floor SCO: 166-167 Sector 9-C, Madhya Marg Chandigarh-160 009 Tel: +91 172 671 7800 Fax: +91 172 671 7888 Ernst & Young LLP is one of the Indian client serving member firms of EYGM Limited. For more information about our organization, please visit www.ey.com/in. 6th floor, HT House 18-20 Kasturba Gandhi Marg New Delhi-110 001 Tel: +91 11 4363 3000 Fax: +91 11 4363 3200 Chennai Tidel Park 6th & 7th Floor A Block (Module 601,701-702) No.4, Rajiv Gandhi Salai Taramani Chennai-600 113 Tel: +91 44 6654 8100 Fax: +91 44 2254 0120 Ernst & Young LLP is a Limited Liability Partnership, registered under the Limited Liability Partnership Act, 2008 in India, having its registered office at 22 Camac Street, 3rd Floor, Block C, Kolkata - 700016 © 2013 Ernst & Young LLP. Published in India. All Rights Reserved. 4th & 5th Floor, Plot No 2B Tower 2, Sector 126 Noida-201 304 Gautam Budh Nagar, U.P. India Tel: +91 120 671 7000 Fax: +91 120 671 7171 EYIN1212-108 ED None This publication contains information in summary form and is therefore intended for general guidance only. It is not intended to be a substitute for detailed research or the exercise of professional judgment. Neither Ernst & Young LLP nor any other member of the global Ernst & Young organization can accept any responsibility for loss occasioned to any person acting or refraining from action as a result of any material in this publication. On any specific matter, reference should be made to the appropriate advisor. Hyderabad Oval Office 18, iLabs Centre Hitech City, Madhapur Hyderabad - 500 081 Tel: +91 40 6736 2000 Fax: +91 40 6736 2200 Pune C—401, 4th floor Panchshil Tech Park Yerwada (Near Don Bosco School) Pune-411 006 Tel: +91 20 6603 6000 Fax: +91 20 6601 5900 Kochi 9th Floor “ABAD Nucleus” NH-49, Maradu PO Kochi - 682 304 Tel: +91 484 304 4000 Fax: +91 484 270 5393 EY contacts Mukul Shrivastava Partner Direct: +91 22 61922777 Email: mukul.shrivastava@in.ey.com Sudesh Shetty Director Direct: +91 22 61921957 Email: sudesh.shetty@in.ey.com Arpinder Singh Partner and National Leader Direct: +91 22 6192 0160 Email: arpinder.singh@in.ey.com