utilizing data to drive competitive advantages devin amato mike ostendorf jeff roy deloitte &...

64
Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

Upload: zoe-may

Post on 11-Jan-2016

221 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

Utilizing Data to Drive Competitive AdvantagesUtilizing Data to Drive Competitive Advantages

Devin AmatoMike OstendorfJeff Roy

Deloitte & Touche LLPMarch 13, 2008 ISACA

Kansas City

Page 2: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.2

AGENDA

What is Data Quality & Integrity (DQI)? Risks of Poor DQI Management and DQI Benefits Implementing a DQI Approach Applying Data Analysis

Page 3: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

What is Data Quality and Integrity? (DQI)What is Data Quality and Integrity? (DQI)

Page 4: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.4

Data Quality & Integrity

In order for organizations to perform business processes, reliance is placed on the organization’s data. Business success is based on good decisions and almost all decisions are based, either directly or indirectly, on data.

Minimize ExpensesMake Sound

Business Decisions

Maximize Revenue

Manage Business Alliances

Manage Resources

Meet Financial Goals

Manage Information

Meet Regulatory

RequirementsManage People

Page 5: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.5

What is Data Quality and Integrity?

Data Quality and Integrity (DQI) is data that is:

• Complete Are vendor records complete?

• Valid Are vendor records up to date?

• Consistent Are vendor records consistent across various applications?

Using this definition, DQI is more than just having valid data – it is also about the completeness and consistency of the data. However, data has more than three dimensions…

Page 6: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.6

What is Data Quality and Integrity?

Data Quality and Integrity (DQI) is data that is also:

• Availability Is the data available

• Trusted Does it have a reputation for being trusted and reliable

• Relevant Does it answer the questions the organization

• Other Dimensions

Page 7: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.7

DQI - The Value Proposition DQI recognizes data as a precious business asset

It asks questions regarding the ownership and treatment of data and the configuration surrounding repositories that house data.

Like other business assets, data can experience:• Spoilage• Theft• Misuse• Hording

DQI diagnoses problems and examines processes that work to preserve the value of business data

Page 8: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

Risks of Poor DQI ManagementRisks of Poor DQI Management

Page 9: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.9

Effect of Data DefectsData defects can affect organizations in a wide variety of ways

• Implementations/Conversions System changes often highlight data quality defects within the data being

converted Delays in cutover to new systems Increase in project costs

• Financial Reporting Delays in closing process due to invalid data Misrepresentation of financials Revenue leakage

• Regulatory Compliance Efforts Data defects may indicate that certain controls are ineffective Misrepresentation of financials or performance metrics

• Customer Relations Invalid or outdated customer data Slow response to customers

Page 10: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.10

The Hidden Costs of Data Defects

Potential Effect of Data Defects Potential CostDelayed system implementation due to data quality defects

Resources spent fixing data quality defects manually

Delayed closing of books at year-end due to transactions with invalid account numbers

Staff accountants manually reclassifying transactions to valid accounts

Inaccurate metrics, misrepresentation of performance

Regulatory penalties, other punitive action

Increased opportunity for fraud Loss of revenue, negative publicity, damaged public image

Inaccurate billing, tax allocation Revenue leakage

The costs of data defects are hard to quantify – but it is easy to see how the impacts can be costly

Page 11: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.11

Poor prioritization of work effort and inappropriate allocation of resources to address data quality issues

Managing the wide range of data quality issues with traditional approaches is less effective

Consequences:Traditional approaches:

Attempt to manage data quality without attempting to measure data quality and the impacts of poor data quality

Manage data standards and definitions within functional or application “silos”, even though the data is shared across the organization

Focus on “data cleansing”, without focusing on processes to manage and monitor data quality

Data is “clean” at one point in time, but quality degrades over time

Inconsistencies in data definitions, standards, and business rules often cause operational inefficiencies and poor business decisions

Page 12: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Data Quality Benefits

Immediate benefits are derived from cleansing efforts during a ERP or e-business transformation. Significant additional benefits can be derived from optimization efforts.

Data Cleansing Benefits

Cleaner transformation from legacy to ERP

Increased value on software implementation and systems integration

Requirement to succeed in transformation to e-business

Potential reduced risk exposure

Sustained competitive advantage through cleaner information for front- and back-office collaboration

Enabler for improved customer service

Data Optimization Benefits

Improve cash flow

Increased understanding of relationships with trading partners across organization

Analysis that support strategic decisions

Improved utilization of resources by focusing on areas of the business that will deliver largest results

Reduction of risks within customer and supplier base

Page 13: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

Implementing a DQI ApproachImplementing a DQI Approach

Page 14: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.14

How to Begin

Build awareness and acceptance of DQI as a key management item

Establish a formal group responsible for defining DQI management approaches

Implement a structured approach for assessing both the extent and the impact of data quality problems in the organization

Define a DQI strategy for moving the organization forward

Based on our experience, the most effective DQI improvement initiatives are driven by experienced, cross-functional teams applying structured approaches and tools.

Page 15: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.15

BuildBuildBuildBuildGap AnalysisGap AnalysisGap AnalysisGap AnalysisDesignDesignDesignDesignCurrent State Current State AssessmentAssessment

Current State Current State AssessmentAssessment

Scoping & Scoping & PlanningPlanning

Scoping & Scoping & PlanningPlanning

Identify DQI

Leaders

Design Corrective

Actions

Perform Data

Analysis

Understand Business and Data Flows

Perform Risk Assessment

Perform Root Cause

Analysis

Implement & Monitor

Corrective Actions

Design Process &

Organization

Develop DQI

Workplan & Timeline

Ensure integration

of DQ Standards

Change Management

Implement Process and Organization

Implement Sustainment

Cycle

Design Sustainment

Cycle

Perform Gap

Analysis

Develop Implementation plan

Enhance Data QualityStandardization

Page 16: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.16

DQI Management Initiatives

Revenue Assurance• Examination and verification of events transpiring throughout the

revenue life cycle for the purpose of identifying and eliminating leakage

Cost Savings and Recovery• Provide assurance that a company is managing its expenditures’

processes in a controlled manner and capitalizing on any opportunities for better cost management

Inventory Analysis and Estimation• Applies quantitative methods to reduce costs associated with

inventory management business processes

Complex Accounting Analysis• Assist in reviewing complex accounting and transactions. Ensuring

regulatory compliance.• FAS123R

Page 17: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.17

DQI Management Initiatives

Content Quality• Implementing a data management strategy that addresses data

quality standards, data maintenance controls, and data optimization

Systems Implementation Support• Provides a risk-based methodology to evaluate and improve data

quality before, during, and after systems implementations and conversions

Continuous Monitoring• An optimal approach to monitor business processes and controls

real-time by leveraging existing data sources in conjunction with analytical tools and customized business metrics

Page 18: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

Applying Data AnalysisApplying Data Analysis

Page 19: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Applying Data Analysis

A variety of topics in the field of auditing are gaining new attention as data analysis applications are being developed to support them. We will explore some of these topics.

Continuous Monitoring Cost Savings / Cost Recovery Revenue Assurance Fraud Detection Supplementing the Financial Audit

Page 20: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Objective

The primary objective of a Continuous Audit Monitoring approach / methodology would be to assist management in accomplishing the strategic goals and objectives of the company through risk mitigation. This can be accomplished through:

Identifying key risk indicators related to• achievement of business objectives,• reliability and accuracy of financial information• compliance with laws, regulations, and company policies• IT systems and interfaces.

Designing automated processes, tools, and a management reporting system to enable Internal Audit to continuously monitor these key risk indicators.

Page 21: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Metrics

Special attention should be offered to the design of the Continuous Monitoring system. In particular, the design of the metrics that are monitored affect the quality and value of the system.

Performance Financial

Marketing Response Rates Days in Accounts Receivable

Order Fulfillment Times Accounts Payable Debit Balances

Ratio of Return Customers Duplicate Claims / Payments

Vendor Lead Times Inventory Turns & Obsolesce

Loan Default Rates Shrink Percentages by Location

Customer Service Responses Cash Disbursement Anomalies

Product Returns Analyses Gross Margin Target Variances

Page 22: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Implementation Approach

Assess• Risk, Metrics, and Data

Design• Transform Data & Metrics

Deliver• Provide Business Intelligence

Sustain• On-going Monitoring & Executive Reporting

Assess Design Deliver Sustain

Page 23: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Gain Understanding • Develop Risk Assessment Strategy• Perform Operations Risk Assessment & Prioritization • Determine risk and performance measurement

objectives and prioritization• Identify relevant business and best practice metrics

Assess Design Deliver Sustain

Page 24: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Develop Analytical Structure & Collect Metrics Data

• Collect and aggregate metric data• Validate integrity and completeness of metric data• Develop appropriate analytical methods for

benchmarking scoring & indexing• Analyze and compare metrics and benchmarks

Assess Design Deliver Sustain

Page 25: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Business Intelligence Delivery• Implement most relevant metrics benchmarks and

indices• Determine and implement optimal architecture• Determine and implement reporting interface

Assess Design Deliver Sustain

Page 26: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Ongoing Monitoring & Executive Reporting• Monitor and measure performance and risk

indicators• Identify potential, problems requiring corrective

action• Reassess/refine business intelligence model as

necessary

Assess Design Deliver Sustain

Page 27: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Benefits

Value-added management tool for “real time” analysis Audit wider range of balances, transactions, attributes, etc.

through automated tools and exception-only reports (population vs. samples)

Opportunity to reduce / replace traditional audit procedures Assists in migration towards on-going risk assessment vs.

annual audit plan/budget development Enhances efficiency of control and compliance procedures Provides meaningful management summaries Enables trend analysis and benchmarking Generate quantifiable results Provides cost saving ideas

Page 28: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Opportunities for Cost Savings

Vendor Consolidation Payment Optimization Exploiting discounts Improvement in contract terms and/or pricing Freight Optimization Cleanse and optimize Vendor Master File Reduction in maverick spend Competitive Pricing Lower transaction processing costs

Page 29: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Opportunities for Cost Recovery

Duplicate payment analysis Missed Discounts

• Individual invoice• Vendor contract discounts

Purchase orders outside of existing vendor contracts Freight Recovery Price variances Rebates and/or promotions Sales and Use Tax

Page 30: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Vendor Master Data Tests

Duplicate Vendor Analysis• Vendor Number • Vendor Name• Vendor Address• Taxpayer ID Number• D-U-N-S® Number

Cross-referencing of vendor and employee master data• Same address or name• Must first understand handling of expense reimbursements

Vendor Activity Analysis• Dormant vendors• Unusually active vendors (may require a baseline)

Page 31: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Expenditures Tests

Strategic Analysis (A/P Invoices, Disbursements, and Goods Receipts)• Reporting volumes, amounts, and averages by vendor• Reporting negative and zero dollar transactions• Identifying outliers (largest and smallest)• Stratification of transactions to identify potential risk areas and/or thresholds• Benford analysis

Data Integrity Analysis (A/P Invoices and Disbursements)• Gaps in Check Numbers (by checking account)• Payments to/Pos from Non-vendors/employees• Payment prior to Invoice Date• Large Payment Analysis• Recurring Payment/AP Invoice Analysis

Duplicates Analysis (A/P Invoices and Disbursements)• By amount and vendor• Confine to a fixed day-window to avoid recurring payments• Take duplicate vendor analysis results into account

Page 32: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Disbursements Tests

Freight Analysis• Duplicate billings for same shipment• Shipments to the same location in a short timeframe• Analysis of abnormal freight costs, based on other and/or

historical shipments• Reconciliation of shipments to A/P and goods receipts

records• Carrier discount optimization

Employee Expense Analysis• Wage disbursements with no or unusual withholdings• Travel and other expense reimbursement analysis• Benefits

Health care spend reduction

Page 33: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Disbursements Tests

Reconciliation Analysis• Purchase Orders to A/P Invoices

Price variancesQuantity variances

• A/P Invoices to Goods ReceiptsQuantity variances

• A/P Invoices to DisbursementsAmount variances – consider the 1 to m factor

Page 34: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Revenue Leakage

Direct Revenue Loss• Driven by poor manual and systematic controls• Is estimated to be as high as 6% of revenue for many

companies• Primary considerations

Customer Service– Contracts– Credits

Product pricing Billing inaccuracies

– Are you billing for things you should not?– Are you not billing for things that you should?

Tax/tariff allocation– Are you paying too much?

Page 35: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Fraud Detection

Fraudulent activity can occur at any time within an organization. Its effects can be widespread and often lead to significant monetary losses. Each department within an organization is susceptible to fraudulent activity. However, some departments are more vulnerable than others.

Page 36: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

A Big Problem

The Association of Certified Fraud Examiners estimates revenues lost in 2002 to occupational fraud and abuse will total approximately 6% of corporate revenues. If applied to the U.S. Gross Domestic Product, this translates into:• Losses of $600 billion• $4,500 of lost revenue per employee

Over half of the 663 cases studied caused losses of over $100,000. Approximately one of every six resulted in losses which exceeded $1 million.

Page 37: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Interesting Facts

The median length of time from inception to detection for occupational frauds was 18 months.• Expense Reimbursement and Check Tampering schemes

lasted approximately 24 months.• Billing Schemes last approximately 23 months.

A Manager or Executive was the perpetrator of fraudulent activity over 40% of the time. • The median cost of frauds perpetrated by managers or

executives was $250,000.• The median cost of frauds perpetrated by employees was

$70,000.• Employee & Manager collusion yielded a median cost of

$500,000.

Page 38: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Interesting Facts

Males are responsible for committing 53.5% of fraud at a median cost of $200,000.

The median cost of fraud perpetrated by females is $60,000.

Employees, Managers, Executives, etc. are most likely to commit their fraud between the ages 41-50.

The most costly fraud activities are performed by people over 60 years old. The median cost is $500,000.

A typical fraud perpetrator is a first-time offender. Only 7% of those studied were known to have prior convictions for fraud-related offenses.

Page 39: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Interesting Facts

Employees with a high school education or less are perpetrators of fraud over 55% of the time at a median cost of $70,000.

Those with a bachelor degree are next, accounting for over 30% (and a median cost of $243,000).

Two out of every three fraud schemes are performed by individuals acting alone at an average cost of $67,000.

Fraudulent activities performed by two or more people cost approximately $450,000.

Page 40: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Types of Fraud

“Asset Misappropriation” describes any act involving the misuse of a company asset for personal gain. Fraudulent disbursement schemes and receipts manipulation are both exposures that must be addressed.

Examples include:• Billing schemes• Fraudulent expense reimbursements• Payroll fraud

Page 41: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Billing Schemes

Billing schemes occur when an employee submits a false invoice or alters an existing one, thus causing the company to willingly (but unknowingly) issue a check for false expenses.

Billing schemes are popular because:• They do not involve the direct theft of cash or checks from

the company.• The check received is valid because it passed through the

disbursement cycle.• They are the most costly of all asset misappropriations,

which means significant rewards for fraudster.

Page 42: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Billing Schemes

Billing schemes are accomplished in three ways:• Invoicing via Shell Companies

An employee will create a fictitious company for the sole purpose of committing fraud.

Invoices are sent to the victim company, requesting payment to the shell company.

The fraud perpetrator receives the check.• Invoicing via Non-accomplice Vendors

Such vendors are used for “Pay and Return” schemes. An employee will intentionally pay a legitimate invoice twice. He/she will then contact the vendor and request one of the checks be

returned. It is then intercepted and converted.• Personal Purchases with Company Funds

After making a personal purchase, an employee will submit an unauthorized invoice to the Accounts Payable Department. By making it appear the item was purchased for the company, the fraudster is attempting to have his/her personal expense paid.

The invoice submitted by the employee is not legitimate and therefore must appear professional to avoid scrutiny.

Supporting documentation, such as purchase requisitions, are also forged to suggest the invoice is valid.

Page 43: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Billing Schemes

How can billing schemes be prevented?• Prior to authorizing payment, invoices should be checked for

validity of the vendor, validity of the goods or services invoiced, accuracy, and authenticity.

• Prior to processing payment, invoices should be checked for proper authorization, accuracy and authenticity. This will prevent overpayment, as well as payments being made to fictitious vendors.

• Strictly control access to vendor master data. How can check tampering potentially be detected through data

analysis?• Vendor-level expenditures analysis• Benford analysis• Duplicates analysis• Vendor master data analysis

Page 44: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Fraudulent Expense Reimbursements

Expense reimbursement schemes occur when an employee submits false expenses in the hope of being reimbursed by the company. They are similar to payroll schemes in that the documentation provided causes the organization to unknowingly disburse funds to the fraudster.

Page 45: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Fraudulent Expense Reimbursements

Expense reimbursement schemes can be accomplished using the following tactics:• Mischaracterized Expenses

An employee will request payment of a personal expense by claiming it was “business related”.

• Overstated Expenses An employee will overstate the cost of actual business

expenses through altered receipts.

• Fictitious Expenses Employees will manufacture receipts, often by acquiring blank

receipts from a vendor.

• Multiple Reimbursements An employee will seek reimbursement for the same expense

several times by submitting various types of support for the same expense, usually during different pay periods.

Page 46: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Fraudulent Expense Reimbursements

How can fraudulent expense reimbursements be prevented?• Expenses should be reimbursed only if an original receipt

has been submitted as support.• Receipts should be scrutinized to detect alterations or

forgeries.• Other means of proving incurred expenses, such as airline

itineraries, credit card statements, etc. should not be accepted unless approved by a supervisor.

• All expense reimbursements should be reviewed and immediately processed upon approval. This would prevent “approved” expenses from being altered prior to payment.

• Use a specific credit card for all business expenses. Receive this information electronically from credit card company and require electronic filing of expense reports by employees. This will minimize the possibility of fraud, and if fraud is occurring, will provide an easier means to identify it.

Page 47: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Fraudulent Expense Reimbursements

How can fraudulent expense reimbursements potentially be detected through data analysis?• Use a specific credit card for all business

expenses. Receive this information electronically from credit card company and require electronic filing of expense reports by employees. Reconcile the two data sets.

• Duplicates analysis.• Benford analysis.

Page 48: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Payroll Fraud

Payroll schemes occur when an employee submits false documentation (i.e. timecards) in an effort to inflate his/her wages/salary. Such documentation prompts the organization to unknowingly disburse funds to the perpetrator.

Possible ways in which Payroll Fraud can occur:• Falsified Hours and Salary• Ghost Employees

Page 49: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Payroll Fraud

How can payroll fraud be prevented? • All timecards should be reviewed for validity and accuracy.• Once submitted for approval, employees should never see

their timecard again. This will prevent them from altering their hours after the card has been “approved” for payment.

• Overtime hours must be authorized by a supervisor.• If employees use a time clock to “punch in” and “punch out”,

they must do so when they arrive for work, take breaks, go to lunch, leave for the day, etc. This will provide the most accurate portrayal of time worked, as opposed to someone forgetting to use the clock and then inflating their hours because they were forced to estimate.

• Monitor employees to assure one employee is not punching out for another.

• Strictly control access to payroll master data.

Page 50: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Payroll Fraud

How can payroll fraud be detected through data analysis? • Review personnel files for duplicate addresses,

P.O. boxes, or social security numbers. Duplicate information may suggest “ghost” employees are on the payroll.

• Perform an employee-level hours analysis, comparing employees’ hours with peers in their departments.

Page 51: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Financial Statement Assertions

Assertion Description

Validity/ Existence

The asset / liability exists and can be traced to source documentation

Completeness Transactions / assets / liabilities that SHOULD be in the financial statements ARE

Recording / Cut-off

Each asset / liability is recorded at an appropriate carrying value

Valuation The entity has rights to an asset at a given date a liability is an obligation at a given date

Presentation & Disclosure

Financial statement components are properly classified and described

Page 52: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Account Balance: Sales and Receivables

DQI Procedures

Com

ple

ten

ess

Valid

ity

Record

ing

Cu

toff

Valu

atio

n

Pre

sen

tatio

n

Fra

ud

Con

trols

Valu

e-A

dd

Summarize sales activity over the testing period and reconcile to the GL, identify unusual transactions around cut-off date √ √ √ √

Recalculate aging for 100% of A/R√ √ √

Calculate historical collection percentage and write-offs to confirm management estimates √ √ √ √

Compare open A/R by customer to the credit limit in the Customer Master √ √ √ √

Compare pricing in the invoice file to approved price list√ √ √ √

Page 53: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Account Balance: Sales and Receivables (cont’d)

DQI Procedures

Com

ple

ten

ess

Valid

ity

Record

ing

Cu

toff

Valu

atio

n

Pre

sen

tatio

n

Fra

ud

Con

trols

Valu

e-A

dd

Identify invoices without an associated shipment and shipments without an invoice √ √ √ √ √

Compare invoice dates to shipment dates √ √ √ √

Identify sales to customers not in the Customer Master file, inactive, without a credit limit, infrequent buyers √ √ √ √ √ √

Identify returns more than xx days from date of sale √ √ √

Identify sales to customers at a discount rate greater than xx% of the average product price for the period under review √ √ √

Identify gaps in invoice sequence, duplicates √ √ √ √ √

Extract all credit balances in A/R to ensure correctly classified √ √ √

Page 54: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Balance: Payables

DQI Procedures

Com

ple

ten

ess

Valid

ity

Record

ing

Cu

toff

Valu

atio

n

Pre

sen

tatio

n

Fra

ud

Con

trols

Valu

e-A

dd

Recreate A/P aging and generate customized reports (by different time buckets, customer, etc.) √ √

Match the A/P open billed & unbilled to subsequent disbursements file by period to identify open, unpaid invoices √ √ √

Compare invoice and purchase order amounts and dates√ √ √

Identify invoices posted with duplicate purchase order numbers √ √ √

Page 55: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Balance: Payables (cont’d)

DQI Procedures

Com

ple

ten

ess

Valid

ity

Record

ing

Cu

toff

Valu

atio

n

Pre

sen

tatio

n

Fra

ud

Con

trols

Valu

e-A

dd

Create a sample of debit disbursements for validity testing and summarize by period to identify unusual year-end fluctuations √ √ √

Identify vendor profiles with missing information, obsolete vendors and duplicate/similar vendors √ √ √

Identify payments recorded for goods not received and identify goods received and not recorded √ √ √ √ √

Identify payments to unapproved vendors and duplicate payments √ √ √ √

Identify payments approved by same individual who approved the purchase order √ √ √ √

Perform gap testing on check numbers in the disbursements file to identify missing checks or checks out of sequence √ √ √ √

Page 56: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Account Balance: Fixed Assets

DQI Procedures

Com

ple

ten

ess

Valid

ity

Record

ing

Cu

toff

Valu

atio

n

Pre

sen

tatio

n

Fra

ud

Con

trols

Valu

e-A

dd

Recalculate depreciation expense and accumulated depreciation for 100% of the assets in the Fixed Assets Master file and reconcile √ √ √ √ √ √

Identify over-depreciated assets (net book value less than zero)√

Identify assets without an associated useful life and without a registered location √ √ √

Identify assets being depreciated over inappropriate useful lives based on asset class √

Page 57: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Account Balance: Fixed Assets (cont’d)

DQI Procedures

Com

ple

ten

ess

Valid

ity

Record

ing

Cu

toff

Valu

atio

n

Pre

sen

tatio

n

Fra

ud

Con

trols

Valu

e-A

dd

Perform a keyword search on the asset description to identify assets that potentially should be expensed rather than capitalized √ √

Compare current year fixed asset data to prior year data, noting changes in key data elements such as acquisition cost, in-service date, residual value, and useful life.

√ √

Perform CMA sample on Fixed Assets for physical inspection√

Identify duplicate assets by tag, serial/part number or description√ √

Summarize assets by category and depreciation rate√

Page 58: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Account Balance: Payroll

DQI Procedures

Com

ple

ten

ess

Valid

ity

Record

ing

Cu

toff

Valu

atio

n

Pre

sen

tatio

n

Fra

ud

Con

trols

Valu

e-A

dd

Identify duplicate, missing and terminated employees in the payroll master file and match to any payments √ √ √ √ √

Identify employees receiving payments after termination date √ √ √ √ √

Identify salaried employees receiving pay amounts above a predetermined threshold √ √ √

Identify hourly employees with submitted hours above a predetermined weekly threshold √ √ √ √

Page 59: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Account Balance: Payroll (cont’d)

DQI Procedures

Com

ple

ten

ess

Valid

ity

Record

ing

Cu

toff

Valu

atio

n

Pre

sen

tatio

n

Fra

ud

Con

trols

Valu

e-A

dd

Identify rates of pay for hourly employees above a predetermined rate √ √ √

Reconcile and perform a CMA on payroll suspense accounts to ensure appropriately classified √ √

Identify employees who have not taken time off from work or have taken minimal time off per HR Master file √ √

Identify paychecks that have excessive, even or round numbers√ √ √

Identify paychecks not conforming to Benford’s law on gross pay or net pay, bonuses or commissions √ √

Page 60: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Account Balance: Inventory

DQI Procedures

Com

ple

ten

ess

Valid

ity

Record

ing

Cu

toff

Valu

atio

n

Pre

sen

tatio

n

Fra

ud

Con

trols

Valu

e-A

dd

Reconcile inventory and perform a CMA sample for test counts √ √ √

Identify duplicate inventory items √ √ √ √

Recalculate extended cost for 100% of inventory√ √

Summarize purchases by month and assess whether unusual fluctuations exist at year-end √ √

Page 61: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.

Account Balance: Inventory (cont’d)

DQI Procedures

Com

ple

ten

ess

Valid

ity

Record

ing

Cu

toff

Valu

atio

n

Pre

sen

tatio

n

Fra

ud

Con

trols

Valu

e-A

dd

Identify inventory items with negative or zero cost, price or quantity√ √

Identify excess and obsolete inventory items√ √ √

Identify inventory items with a cost greater than the retail/selling price√ √ √

Identify inventory items with a low profit margin based on predetermined threshold √ √

Summarize inventory by product group/class and stratify by last delivery and last cyclical count √ √

Identify inventory items without a recorded location √ √ √ √

Page 62: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.62

Overview

You work for a mid-size manufacturing company. Due to recent economic conditions, you have been charged with tightening spend and identifying potential cost recoveries within the purchase-to-pay cycle. Identify, as a group, what areas you would focus this review on, what procedures you will perform, and what results you hope to obtain.

Case Study 1

Page 63: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.63

Case Study 2

OverviewDuring a recent audit, it was determined that a terminated employee had been receiving full pay and benefits, along with his wife, 3 children, and mother. The employee had been terminated 9 months when this finding was identified. As a group and using data analysis, what could have been done to identify this and what can be done to identify all instances of these occurrences and prevent these in the future?

Page 64: Utilizing Data to Drive Competitive Advantages Devin Amato Mike Ostendorf Jeff Roy Deloitte & Touche LLP March 13, 2008 ISACA Kansas City

© Copyright 2008, Deloitte & Touche LLP. Proprietary & Confidential, All Rights Reserved.64