Page 1

Forensic Data Analytics

Key to unlocking invisible information using forensic “lookback” Forensic Data Analytics as a topic and its adoption within the industry had long been overdue. With the advent of technology and increasing incidents of fraud, there has been a significant rise in adoption of Forensic Data Analytics. Due to this, company appointed auditors and independent directors are now seeking to implement proactive fraud-prevention solutions and are avoiding postincident remediation processes. Forensic Data Analytics is a science used to proactively seek opportunities to prevent and detect fraud, waste and abuse by leveraging information in corporate data assets. It enables identification of meaningful patterns and correlations in existing historic data to predict future events and assess the reasons for various fraudulent activities. Such insightful predictive information is generally “invisible,” but provides a platform on which organizations can take business decisions related to fraud, disputes and misconduct.

The greatest value of forensic analytics is when it forces us to notice what we did not expect to see.

Evolution of forensic data analytics Big data is a reality: The volume, variety and velocity of data coming into the organization have reached unprecedented levels. About 2.5 exabytes of data are created each

1. Big data

Without big data analytics, companies are blind and deaf, meandering aimlessly like a deer on freeway day, and that number is doubling every 40 months

Torture the data, and it will confess to anything

Issues in managing big data: Big data requires high performance analytics to process billions of rows of data with hundreds of millions of data combinations. The traditional

data warehousing techniques may not be able to identify anomalies in the existing data set thus preventing proactive fraud management

2. Manage data

Absence of forensic evidence is not evidence of forensic absence

3. Key Risk Events

Recent scams in the limelight: In the recent times, India has been hit with multi billion value scams associated with the following: •

• •

Anti Money Laundering

Bribery and Corruption Procurement fraud and collusion in bidding process Accounting misstatement

Forensic analytics is the oil of the 21st century which protects organizations combustion engine from going bust

Adoption of forensic data analytics: The associated risks could have been mitigated if key stakeholders would have paid attention to anomalies at an earlier stage. This could have been

possible if existing data assets were analyzed from forensic perspective to avoid wrongful or criminal deception intended to result in financial or personal gain.

4. Forensic Data Analytics

How does forensic data analytics help organizations? • •

Proactive fraud prevention management Controlling the magnitude of fraud in a reactive set up

Effective and focused internal controls

Improving regulatory and compliance environment

Forensic Data Analytics


Capability landscape Forensic Data Analytics can be used as a standalone service or in conjunction with existing practices such as investigations, audits, process review and due diligence. In the current context, data exists in structured (multiple form of databases) and unstructured forms (emails, office documents, presentations, Excel sheets, PDF files, archive files, text and image files) in organizations. Using EY’s proprietary tools, raw data can be transformed into formats that can be analyzed, and with the help of advanced analytical capabilities, anomalies can be identified that may indicate potential fraud. Some of our key offerings include, but not limited to, identification of fraud in vendor, customer and employee registration, procurement to pay, order to cash, sales and distribution, travel and entertainment, payroll disbursment.

Our forensic analytic models are developed to identify variances in data sets, which may impact an organization’s profit and loss statement. This model also touches on various aspects, from simple narration captured in a transaction to complicated sentiments and tone analysis. It also includes data within applications and data recorded on social and professional networks for further analysis. This analysis helps a company to move beyond identification of low value pilferage to implementing controls on existing and potential weak areas. Any dataset in historic, near real time and real time form can be assimilated through big data solutions to help a company improve its bottom line by checking fraudulent activities

Unstructured data

Forensic data analytics

S ample Das hboard J ournal E ntries and Amount P er User





9,131 716



291 34



2,393 3,705



Dis tinct count of J ournal_ID



C redit

E Y_Account_Name NL trading account NX


T rade R ec'bles - R eceivables





Debit/C redit

Amount per Account Name

Us er_ID

Debit E Y_C las s As s ets

Agency Billing S ettlement Ac..

C os t of R evenue

F S MA R evenue - O ther Dis c..

E xpens e

R ental R ev. - S hort T erm R e..

E xpens es -60M



0M Amount




Local Legal Accounts (.. O ther income and ded.. E Y_A ccount_Name P roduct/P rogram R ela..

E Y_S ub_C ategory Accounts R eceivable: T rade


P urchas es not capitali..
















O ther C urrent As s ets : Mis cel.. Due to (from) T rade and O th..

F unctional T rans fer Ac.. Liabilities & S tockholde..

Amount per S ub C ategory


(G )/L on S ales of E quip..


13th Month S alaries #1

R ental R evenue: R ental Agr..

A&P - C us tomer E vents A&P - T rade s hows

Deferred R ental R evenue

A&P C ollaterals - P rod..

Deferred R evenue Managed..




0M Amount




A/P - C redit out of Debi.. E Y_T IME _T A G After office hours entries

Account name per month (C alculated B ased on Document Number)

W ithin O ffice hours ent..

E ffective_Date 2011 Account Name

J uly

Augus t


S eptember

O ctober

Agency Billing S ettlement Ac..





J anuary

F ebruary


Monday T ues day

Agency Billing S ettlement Ac.. Billing S ettlement A (165799..


Deferred R ev. - F M (213009..




-274,752 -454,933

T hurs day S aturday

Deferred R evenue - R ental (.. -801,576

E Y_E ntry_month_end No

F M R ev. - F S MA R ev. Varia.. -10M

0M Amount



0M 10M Amount


0M Amount



0M 10M Amount


0M Amount



0M 10M Amount


0M Amount



0M 10M Amount

Figure 1: Structured output from unstructured data


W ednes day F riday

Deferred R ev. - F S MA (2130.. F M R ev. - Additional S ales (..

E Y_E ntry_week_day S unday

Forensic Data Analytics


Structured output

Our key differentiator in forensic data analytics At EY, data analytic techniques applied to internal or external fraud follows a four pillar approach — WHOWHAT-WHEN- WHY. This approach looks at any situation from all possible angles and highlights key issues. This does not only help in managing risks, but also in identification of potential growth areas. Increasing concerns about fraud and vulnerability can be alleviated by a range of forensic techniques, some of which are presented below.

Link Analysis Link Analysis is a data-analysis technique used to evaluate relationships (connections) between nodes, including organizations, people and transactions. Key applications of this technique include analysis of EPBX data, mobile bills and user logical access records that help a company map its user footprint. In a recent incident in a manufacturing company, its phone records were analyzed across different zones to determine the nexus between its employees and selected vendors on procurement and disposal of scrap. Using Link Analysis, we were able to establish “hidden” relationships and information leakage from suspected employees to identified vendors for possible “kickbacks.”

The key to identify fraud lies in the ability to comprehend what lies beneath.

Employee group

Employeevendor nexus

The size and width of connectors indicate frequency of the calls Third party

Vendor group

Figure 2: Link Analysis

Forensic Data Analytics


Social Network Analysis India lead managing business throughout India through relatives as key distributors

India sales head Vendor network in east Vendor network in west Relatives as key distributors Vendor network in south

Social Network Analysis views relationships in terms of network theory, which consists of nodes and ties. Nodes represent individual “actors” within the network and Ties represent relationships between individuals, e.g., friendships, kinship, organizational position, etc. Social Network Analysis, along with Link Analysis, helps to identify related parties, conflict of interest, bid rigging, among other fraud. In a large consumer products company, the India lead had appointed his relatives as distributors, and through known vendors, managed distribution of products in key states. Social Network Analysis, followed with a background check, helped to reveal the nexus. This led to a full-blown investigation and the company now undergoes vendor due diligence before it carries out any business.

Vendor network in north

Figure 3: Social Network Analysis

Concept Clustering Concept Clustering involves grouping similar entities or behavior into tight semantic clusters for the purpose of identifying anomalies or red flag. It is used actively, along with an electronic data review. In this example, Concept Clustering was executed on more than a million documents to identify all the information with terms such as “gifts,” “incentive” and “facilitation.” We were able to bring these down to a sizable volume with the required criteria that was analyzed in a timebound manner. Concept Clustering can be effectively used on structured and unstructured data. Miscellaneous




Figure 4: Concept Clustering

Sentiment Analysis




Figure 5: Sentiment Analysis




Known as behavioral analysis, this refers to the application of text analytics to identify and extract subjective information including the attitudes of writers, their affective state and the intended emotional quotient. It determines whether expressed opinions in a document are positive, negative or neutral. The “fraud triangle” can be applied to categorize events into rationalization, opportunity and pressure to identify sentiments. Organizations use this data to conduct behavioral training, stem attrition, and identify disgruntled employees and potential fraud conversation.

Forensic Data Analytics

Data Visualization — identifying the “hidden” from “not so apparent” Data Visualization techniques have proved to be effective, since humans can better absorb large pieces of information in a visual format than that displayed in numbers or text. When the result of a fraud identification query is combined with Data Visualization, e.g., an account payable or journal entry data, a significant amount of useful and previously invisible information can be reviewed at one go.

Tag Cloud One of the most widely used visual techniques is a Tag Cloud. This is a good example of expressing complex data that can be understood intuitively. A Tag Cloud is the visual representation of communication relating to transactional data entries. It is represented by a combination of words in varied fonts, sizes or colors. This format is useful for quickly determining the important terms to identify key fraud issues

Figure 6: Tag Cloud

Interactive CXO dashboards A useful feature of analytics is that an entire data set can be converted to a meaningful dashboard for a CXO analysis. Such dashboards help in understanding databases and spreadsheets of any size with their easy drag and drop interface. They not only display information visually in seconds, but also create interactive maps with the click of a mouse. They can effectively analyze time series from years to months to the actual time in a day. Their most helpful feature is their capability to combine different databases to a single view and publish interactive dashboards on the Web.

Figure 7: Interactive CXO Dashboard

Here, we have sliced the entire expense dump of an organization from four key lenses including WHERE (geography), WHAT (type of expense), HOW (expense description) and WHO (the employee who incurred the expense). Having multi-dimensional data on a common platform helps a company perform an insightful analysis to determine the tests that need to be performed on expense data.

Forensic Data Analytics


Ernst & Young LLP EY | Assurance | Tax | Transactions | Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization and may refer to one or more of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit About EY’s Fraud Investigation & Dispute Services Dealing with complex issues of fraud, regulatory compliance and business disputes can detract from efforts to achieve your company’s potential. Better management of fraud risk and compliance exposure is a critical business priority — no matter the industry sector. With our more than 2,000 fraud investigation and dispute professionals around the world, we assemble the right multidisciplinary and culturally aligned team to work with you and your legal advisors. And we work to give you the benefit of our broad sector experience, our deep subject matter knowledge and the latest insights from our work worldwide. It’s how EY makes a difference. Ernst & Young LLP is one of the Indian client serving member firms of EYGM Limited. For more information about our organization, please visit Ernst & Young LLP is a Limited Liability Partnership, registered under the Limited Liability Partnership Act, 2008 in India, having its registered office at 22 Camac Street, 3rd Floor, Block C, Kolkata - 700016 © 2013 Ernst & Young LLP. Published in India. All Rights Reserved. EYIN1212-108 ED None This publication contains information in summary form and is therefore intended for general guidance only. It is not intended to be a substitute for detailed research or the exercise of professional judgment. Neither Ernst & Young LLP nor any other member of the global Ernst & Young organization can accept any responsibility for loss occasioned to any person acting or refraining from action as a result of any material in this publication. On any specific matter, reference should be made to the appropriate advisor.

Our offices Kolkata 22, Camac Street 3rd Floor, Block C” Kolkata-700 016 Tel: +91 33 6615 3400 Fax: +91 33 2281 7750

Ahmedabad 2nd floor, Shivalik Ishaan Near. C.N Vidhyalaya Ambawadi Ahmedabad-380 015 Tel: +91 79 6608 3800 Fax: +91 79 6608 3900 Bengaluru 12th & 13th floor “U B City” Canberra Block No.24, Vittal Mallya Road Bengaluru-560 001 Tel: +91 80 4027 5000 +91 80 6727 5000 Fax: +91 80 2210 6000 (12th floor) Fax: +91 80 2224 0695 (13th floor) 1st Floor, Prestige Emerald No.4, Madras Bank Road Lavelle Road Junction Bengaluru-560 001 India Tel: +91 80 6727 5000 Fax: +91 80 2222 4112 Chandigarh 1st Floor SCO: 166-167 Sector 9-C, Madhya Marg Chandigarh-160 009 Tel: +91 172 671 7800 Fax: +91 172 671 7888 Chennai Tidel Park 6th & 7th Floor A Block (Module 601,701-702) No.4, Rajiv Gandhi Salai Taramani Chennai-600 113 Tel: +91 44 6654 8100 Fax: +91 44 2254 0120 Hyderabad Oval Office 18, iLabs Centre Hitech City, Madhapur Hyderabad - 500 081 Tel: +91 40 6736 2000 Fax: +91 40 6736 2200 Kochi 9th Floor “ABAD Nucleus” NH-49, Maradu PO Kochi - 682 304 Tel: +91 484 304 4000 Fax: +91 484 270 5393

Mumbai 14th Floor, The Ruby 29 Senapati Bapat Marg Dadar (west) Mumbai-400 028, India Tel: +91 22 6192 0000 Fax: +91 22 6192 1000 5th Floor Block B-2 Nirlon Knowledge Park Off. Western Express Highway Goregaon (E) Mumbai-400 063, India Tel: +91 22 6192 0000 Fax: +91 22 6192 3000 NCR Golf View Corporate Tower – B Near DLF Golf Course Sector 42 Gurgaon–122 002 Tel: +91 124 464 4000 Fax: +91 124 464 4050 6th floor, HT House 18-20 Kasturba Gandhi Marg New Delhi-110 001 Tel: +91 11 4363 3000 Fax: +91 11 4363 3200 4th & 5th Floor, Plot No 2B Tower 2, Sector 126 Noida-201 304 Gautam Budh Nagar, U.P. India Tel: +91 120 671 7000 Fax: +91 120 671 7171 Pune C—401, 4th floor Panchshil Tech Park Yerwada (Near Don Bosco School) Pune-411 006 Tel: +91 20 6603 6000 Fax: +91 20 6601 5900

EY contacts Arpinder Singh Partner and National Leader Direct: +91 22 6192 0160 Email:

Mukul Shrivastava Partner Direct: +91 22 61922777 Email:

Sudesh Shetty Director Direct: +91 22 61921957 Email:

Evolution of Forensic Data Analytics - EY India  

EY India's forensic data analytic models are developed to identify variances in data sets, which may impact an organization’s profit and los...

Evolution of Forensic Data Analytics - EY India  

EY India's forensic data analytic models are developed to identify variances in data sets, which may impact an organization’s profit and los...