Forensic Data Analytics

Key to unlocking invisible information using forensic

lookback
Forensic Data Analytics as a topic and its adoption within the industry had long been overdue.
With the advent of technology and increasing incidents of fraud, there has been a significant rise
in adoption of Forensic Data Analytics. Due to this, company appointed auditors and independent
directors are now seeking to implement proactive fraud-prevention solutions and are avoiding post-
incident remediation processes.

Forensic Data Analytics is a science used to proactively seek opportunities to prevent and detect
fraud, waste and abuse by leveraging information in corporate data assets. It enables identification
of meaningful patterns and correlations in existing historic data to predict future events and assess
the reasons for various fraudulent activities. Such insightful predictive information is generally
invisible, but provides a platform on which organizations can take business decisions related to
fraud, disputes and misconduct.

The greatest value of forensic analytics is when it forces us
to notice what we did not expect to see.
Evolution of forensic Without big data analytics,

data analytics
companies are blind and deaf,
meandering aimlessly like a
deer on freeway

Big data is a reality: day, and that number is doubling every

The volume, variety and velocity of 40 months

1. Big data data coming into the organization have

reached unprecedented levels. About
2.5 exabytes of data are created each

Torture the data, and it will

confess to anything

Issues in managing big data: data warehousing techniques may

Big data requires high performance
analytics to process billions of rows
of data with hundreds of millions of
data combinations. The traditional
not be able to identify anomalies in
the existing data set thus preventing 2. Manage
proactive fraud management
data

Absence of forensic evidence

is not evidence of forensic
absence

Recent scams in the limelight: Bribery and Corruption

In the recent times, India has been hit
3. Key Risk with multi billion value scams associated
Procurement fraud and collusion in
bidding process
Events with the following:
Accounting misstatement
Anti Money Laundering

Forensic analytics is the oil of

the 21st century which protects
organizations combustion
engine from going bust

Adoption of forensic data analytics: possible if existing data assets were

4.
The associated risks could have been
mitigated if key stakeholders would
analyzed from forensic perspective to
avoid wrongful or criminal deception
Forensic
have paid attention to anomalies at intended to result in financial or Data
an earlier stage. This could have been personal gain.
Analytics

How does forensic data analytics help organizations?

Proactive fraud prevention management Effective and focused internal controls

Controlling the magnitude of fraud in a reactive Improving regulatory and compliance environment
set up

Forensic Data Analytics 3

 Capability landscape
Forensic Data Analytics can be used as a standalone Our forensic analytic models are developed to
service or in conjunction with existing practices identify variances in data sets, which may impact
such as investigations, audits, process review and an organizations profit and loss statement. This
due diligence. In the current context, data exists model also touches on various aspects, from simple
in structured (multiple form of databases) and narration captured in a transaction to complicated
unstructured forms (emails, office documents, sentiments and tone analysis. It also includes data
presentations, Excel sheets, PDF files, archive files, within applications and data recorded on social and
text and image files) in organizations. Using EYs professional networks for further analysis. This analysis
proprietary tools, raw data can be transformed helps a company to move beyond identification of low
into formats that can be analyzed, and with the value pilferage to implementing controls on existing
help of advanced analytical capabilities, anomalies and potential weak areas. Any dataset in historic, near
can be identified that may indicate potential fraud. real time and real time form can be assimilated through
Some of our key offerings include, but not limited big data solutions to help a company improve its
to, identification of fraud in vendor, customer and bottom line by checking fraudulent activities
employee registration, procurement to pay, order to
cash, sales and distribution, travel and entertainment,
payroll disbursment.

Unstructured data

Forensic data analytics

S ample Das hboard

J ournal E ntries and Amount P er User Amount per Account Name Debit/C redit
C redit
Us er_ID E Y_Account_Name
Debit
79,779 NL trading account NX 60,565,488
200M
T rade R ec'bles - R eceivables 58,874,500 E Y_C las s
As s ets
Agency Billing S ettlement Ac..
C os t of R evenue
Dis tinct count of J ournal_ID

F S MA R evenue - O ther Dis c.. E xpens e

50K
50,276 R ental R ev. - S hort T erm R e.. E xpens es
100M
Amount

-60M -40M -20M 0M 20M 40M 60M F unctional T rans fer Ac..
Amount Liabilities & S tockholde..
9,131 Local Legal Accounts (..
Amount per S ub C ategory

Structured output
1,864 2,541 333 716 291 O ther income and ded..
0M 2,393 3,705 4,869 0K E Y_A ccount_Name
91 4 34 2 E Y_S ub_C ategory
P roduct/P rogram R ela..
Accounts R eceivable: T rade 58,874,500
P urchas es not capitali..
O ther C urrent As s ets : Mis cel..
(G )/L on S ales of E quip..
Due to (from) T rade and O th.. -67,944,770 67,944,770 13th Month S alaries #1
R VBE US E KO M
C LABR AVE G A

S KAYA
BJ ANKI

C KLE IN

G G OOSEN
AKLE R K

ANVS C HAIK

P WE NNE KE S

TKO P P E NS

TS MITS
BATC HUS E R

J HAMAKE R

NWINTE R

S AME IE R

R ental R evenue: R ental Agr.. A&P - C us tomer E vents

Deferred R ental R evenue A&P - T rade s hows

Deferred R evenue Managed.. A&P C ollaterals - P rod..

-60M -40M -20M 0M 20M 40M 60M A/P - C redit out of Debi..
Amount E Y_T IME _T A G
After office hours entries
Account name per month (C alculated B ased on Document Number) W ithin O ffice hours ent..
E ffective_Date
2011 2012
E Y_E ntry_week_day
Account Name J uly Augus t S eptember O ctober November December J anuary F ebruary S unday
Agency Billing S ettlement Ac.. -393,707 -192,406 -254,811 Monday
Agency Billing S ettlement Ac.. T ues day
Billing S ettlement A (165799.. -943,525 -615,525 -274,752 -83,159 W ednes day
T hurs day
Deferred R ev. - F M (213009.. -620,377 -454,933
F riday
Deferred R ev. - F S MA (2130..
S aturday
Deferred R evenue - R ental (..
F M R ev. - Additional S ales (.. -801,576 E Y_E ntry_month_end
F M R ev. - F S MA R ev. Varia.. No
Yes
-10M 0M 10M -10M 0M 10M -10M 0M 10M -10M 0M 10M -10M 0M 10M -10M 0M 10M -10M 0M 10M -10M 0M 10M
Amount Amount Amount Amount Amount Amount Amount Amount

Figure 1: Structured output from unstructured data

4 Forensic Data Analytics

Our key differentiator in forensic
data analytics

At EY, data analytic techniques applied to internal or

external fraud follows a four pillar approach WHO- The key to identify fraud lies in the ability to
WHAT-WHEN- WHY. This approach looks at any comprehend what lies beneath.
situation from all possible angles and highlights key
issues. This does not only help in managing risks, but
also in identification of potential growth areas.

Increasing concerns about fraud and vulnerability can

be alleviated by a range of forensic techniques, some
of which are presented below.

Link Analysis
Employee group
Link Analysis is a data-analysis technique used to
evaluate relationships (connections) between nodes,
including organizations, people and transactions. Key
applications of this technique include analysis of EPBX
data, mobile bills and user logical access records that
help a company map its user footprint. Employee-
vendor nexus
In a recent incident in a manufacturing company, its
phone records were analyzed across different zones
to determine the nexus between its employees and
selected vendors on procurement and disposal of The size and width of
scrap. Using Link Analysis, we were able to establish connectors indicate
hidden relationships and information leakage from frequency of the calls
suspected employees to identified vendors for possible
kickbacks. Third party

Vendor group

Figure 2: Link Analysis

Forensic Data Analytics 5

 Social Network Analysis
Social Network Analysis views relationships in terms
India lead managing business throughout
of network theory, which consists of nodes and ties.
India through relatives as key distributors
Nodes represent individual actors within the network
and Ties represent relationships between individuals,
e.g., friendships, kinship, organizational position, etc.
Social Network Analysis, along with Link Analysis,
helps to identify related parties, conflict of interest, bid
rigging, among other fraud.

In a large consumer products company, the India lead

had appointed his relatives as distributors, and through
known vendors, managed distribution of products in
key states. Social Network Analysis, followed with a
India sales head background check, helped to reveal the nexus. This
Vendor network in east
led to a full-blown investigation and the company now
Vendor network in west
undergoes vendor due diligence before it carries out
Relatives as key distributors
any business.
Vendor network in south
Vendor network in north
Figure 3: Social Network Analysis

Concept Clustering
Concept Clustering involves grouping similar entities
or behavior into tight semantic clusters for the purpose
of identifying anomalies or red flag. It is used actively,
along with an electronic data review. In this example,
Concept Clustering was executed on more than a
million documents to identify all the information with
terms such as gifts, incentive and facilitation.
We were able to bring these down to a sizable volume
with the required criteria that was analyzed in a time-
bound manner. Concept Clustering can be effectively
used on structured and unstructured data.

Miscellaneous Fraud Cash Gift

Figure 4: Concept Clustering

Sentiment Analysis
Known as behavioral analysis, this refers to the
application of text analytics to identify and extract
subjective information including the attitudes of
writers, their affective state and the intended
emotional quotient. It determines whether expressed
opinions in a document are positive, negative or
neutral. The fraud triangle can be applied to
categorize events into rationalization, opportunity and
pressure to identify sentiments. Organizations use this
data to conduct behavioral training, stem attrition,
Angry Surprised Confused Cursing Derogatory and identify disgruntled employees and potential fraud
conversation.
Figure 5: Sentiment Analysis

6 Forensic Data Analytics

Data Visualization
identifying the hidden from not so apparent
Data Visualization techniques have proved to be effective, since humans can better absorb large pieces of
information in a visual format than that displayed in numbers or text. When the result of a fraud identification query
is combined with Data Visualization, e.g., an account payable or journal entry data, a significant amount of useful
and previously invisible information can be reviewed at one go.

Tag Cloud
One of the most widely used visual techniques is a Tag
Cloud. This is a good example of expressing complex
data that can be understood intuitively. A Tag Cloud
is the visual representation of communication relating
to transactional data entries. It is represented by a
combination of words in varied fonts, sizes or colors.
This format is useful for quickly determining the
important terms to identify key fraud issues

Figure 6: Tag Cloud

Interactive CXO dashboards
A useful feature of analytics is that an entire data set
can be converted to a meaningful dashboard for a CXO
analysis.

Such dashboards help in understanding databases and

spreadsheets of any size with their easy drag and drop
interface. They not only display information visually
in seconds, but also create interactive maps with the
click of a mouse. They can effectively analyze time
series from years to months to the actual time in a day.
Their most helpful feature is their capability to combine
different databases to a single view and publish Figure 7: Interactive CXO Dashboard
interactive dashboards on the Web.

Here, we have sliced the entire expense dump of an

organization from four key lenses including WHERE
(geography), WHAT (type of expense), HOW (expense
description) and WHO (the employee who incurred the
expense). Having multi-dimensional data on a common
platform helps a company perform an insightful analysis
to determine the tests that need to be performed on
expense data.

Forensic Data Analytics 7

Ernst & Young LLP
EY | Assurance | Tax | Transactions | Advisory Our offices
About EY
EY is a global leader in assurance, tax, transaction and Ahmedabad
advisory services. The insights and quality services we 2nd floor, Shivalik Ishaan
deliver help build trust and confidence in the capital Near. C.N Vidhyalaya
markets and in economies the world over. We develop Ambawadi
outstanding leaders who team to deliver on our promises Ahmedabad-380 015
to all of our stakeholders. In so doing, we play a critical Tel: +91 79 6608 3800
role in building a better working world for our people, for Fax: +91 79 6608 3900
our clients and for our communities.
Bengaluru
EY refers to the global organization and may refer to
12th & 13th floor
one or more of the member firms of Ernst & Young
U B City Canberra Block
Global Limited, each of which is a separate legal entity.
No.24, Vittal Mallya Road
Ernst & Young Global Limited, a UK company limited by
Bengaluru-560 001
guarantee, does not provide services to clients. For more
Tel: +91 80 4027 5000
information about our organization, please visit ey.com.
+91 80 6727 5000
About EYs Fraud Investigation & Dispute Services Fax: +91 80 2210 6000 (12th floor)
Fax: +91 80 2224 0695 (13th floor)
Dealing with complex issues of fraud, regulatory
compliance and business disputes can detract from 1st Floor, Prestige Emerald
efforts to achieve your companys potential. Better No.4, Madras Bank Road
management of fraud risk and compliance exposure Lavelle Road Junction
is a critical business priority no matter the industry Bengaluru-560 001 India
sector. With our more than 2,000 fraud investigation Tel: +91 80 6727 5000
and dispute professionals around the world, we assemble Fax: +91 80 2222 4112
the right multidisciplinary and culturally aligned team to
work with you and your legal advisors. And we work to Chandigarh
give you the benefit of our broad sector experience, our 1st Floor
deep subject matter knowledge and the latest insights SCO: 166-167
from our work worldwide. Its how EY makes a difference. Sector 9-C, Madhya Marg
Chandigarh-160 009
Tel: +91 172 671 7800
Ernst & Young LLP is one of the Indian client serving member firms of
EYGM Limited. For more information about our organization, please visit Fax: +91 172 671 7888
www.ey.com/in.
Ernst & Young LLP is a Limited Liability Partnership, registered under the Chennai
Limited Liability Partnership Act, 2008 in India, having its registered office Tidel Park
at 22 Camac Street, 3rd Floor, Block C, Kolkata - 700016
6th & 7th Floor
2013 Ernst & Young LLP. Published in India. A Block (Module 601,701-702)
All Rights Reserved. No.4, Rajiv Gandhi Salai
Taramani
EYIN1212-108
Chennai-600 113
ED None
Tel: +91 44 6654 8100
This publication contains information in summary form and is therefore Fax: +91 44 2254 0120
intended for general guidance only. It is not intended to be a substitute
for detailed research or the exercise of professional judgment. Neither
Ernst & Young LLP nor any other member of the global Ernst & Young Hyderabad
organization can accept any responsibility for loss occasioned to any Oval Office
person acting or refraining from action as a result of any material in this
publication. On any specific matter, reference should be made to the
18, iLabs Centre
appropriate advisor. Hitech City, Madhapur
Hyderabad - 500 081
Tel: +91 40 6736 2000
Fax: +91 40 6736 2200
Kochi
9th Floor ABAD Nucleus
NH-49, Maradu PO
Kochi - 682 304
Tel: +91 484 304 4000
Fax: +91 484 270 5393
Kolkata
22, Camac Street
3rd Floor, Block C
Kolkata-700 016
Tel: +91 33 6615 3400
Fax: +91 33 2281 7750
Mumbai
14th Floor, The Ruby
29 Senapati Bapat Marg
Dadar (west)
Mumbai-400 028, India
Tel: +91 22 6192 0000
Fax: +91 22 6192 1000
5th Floor Block B-2
Nirlon Knowledge Park
Off. Western Express Highway
Goregaon (E)
Mumbai-400 063, India
Tel: +91 22 6192 0000
Fax: +91 22 6192 3000
NCR
Golf View Corporate
Tower B
Near DLF Golf Course
Sector 42
Gurgaon122 002
Tel: +91 124 464 4000
Fax: +91 124 464 4050
6th floor, HT House
18-20 Kasturba Gandhi Marg
New Delhi-110 001
Tel: +91 11 4363 3000
Fax: +91 11 4363 3200
4th & 5th Floor, Plot No 2B
Tower 2, Sector 126
Noida-201 304
Gautam Budh Nagar, U.P. India
Tel: +91 120 671 7000
Fax: +91 120 671 7171
Pune
C401, 4th floor
Panchshil Tech Park
Yerwada (Near Don Bosco School)
Pune-411 006
Tel: +91 20 6603 6000
Fax: +91 20 6601 5900

EY contacts
Arpinder Singh Mukul Shrivastava Sudesh Shetty
Partner and National Leader Partner Director
Direct: +91 22 6192 0160 Direct: +91 22 61922777 Direct: +91 22 61921957
Email: arpinder.singh@in.ey.com Email: mukul.shrivastava@in.ey.com Email: sudesh.shetty@in.ey.com