Practical Use of Data Risk Mining & Machine Learning Science for Finding Anomalies and Implementing Continuous Controls in the Organization

In recent years, with the rapid development of technology, there has been a lot of discussion about Data Science, Machine Learning, and Artificial Intelligence in the context of analyzing transactions and detecting anomalies. These tools are utilized in various fields, with the primary focus on combating embezzlement, fraud, bribery, and money laundering.

The guiding principles for implementing tools for monitoring, analyzing and detecting anomalies in business transactions.

• Establish a direct and efficient connection to the production data base, enabling the retrieval and extraction of data.

This includes various systems such as SAP for financial ERP, Sales Force for sales, Success Factor for human resources, and more. It is essential to ensure both quick response and retrieval times, while avoiding any negative impact on the production system, such as slowing down response times or disrupti-ng existing users. Striking the right balance is crucial to maintain system performance and user experience.

• Set a base rule definition which refers to a comprehensive list of rules designed to identify exceptions or anomalies.

In the context of auditing, it serves as a checklist based on best practices specific to the business process being examined. For instance, in the procurement process, examples of base rules include identifying instances where a supplier is duplicated in the master data, detecting duplicate payments made to suppliers, and flagging cases where a supplier’s bank account branch is located in a different country, raising suspicion of potential money laundering. These rules play a crucial role in ensuring the accuracy and integrity of the audit process by highlighting potential irregularities or risks.

• Reduce the number of false positive cases to a minimum. This is achieved through a self-learning machine learning process and fine tuning process of the base rules.

Today, artificial intelligence tools are utilized to identify and eliminate false positives during data retrieval. The most detrimental factor to the reliability and effectiveness of these tools is the occurrence of false positives, where a large number of anomalies are flagged, but a high percentage of them are not true anomalies. It is important to acknowledge and examine true negatives as well—these are instances where suspicious movements or transactions should have been identified during retrieval but were not. Detecting true negatives presents a greater challenge.

• Ensure the tool provide efficient, effective, and prompt anomaly investigations/ root-cause-analysis.

This factor reduces significantly the time required for investigations and enhances trust in and utilization of the tool. For instance, consider investigating a suspicious invoice using a tool that enables drilling down to the granularity of the billing line level, displaying all invoices from the same supplier with identical billing information, and providing other relevant details as per the investigator’s requirements. Such capabilities significantly facilitate the investigative process.

• Provision user-friendly and intuitive interface for managing the identified anomalies.

Just like any other information system, these tools place significant importance on a user interface that caters to the user’s requirements and delivers an enjoyable experience, both in terms of functionality and visual appeal. It is essential to create an interface that not only meets the user’s needs but also encourages them to return and continue utilizing the tool.

Use of Risk Mining as part of the audit

When conducting an internal audit of a business process, understanding the process itself is a crucial part of the audit work. This involves identifying the operations and steps involved, collecting relevant data (including statistical data), and more. In traditional audits, auditors rely on interviews with the auditee to comprehend the business process, often requesting examples from system records, reports, and documents.

However, advanced Risk Mining tools offer a more comprehensive solution. These tools construct a flowchart presenting the workflow of the business process based on the actual business transactions entered and generated within the system. They provide insights into the various routes taken in the process, highlighting the differing operations and steps performed in each route. Additionally, statistical information, such as transaction volumes and their proportions within each operation or stage, is made available.

The significant advantage of this approach is that auditors gain a genuine understanding of the business process and its constituent actions and phases before questioning the auditee. Armed with this knowledge, auditors can focus on asking qualitative questions related to the data, actions, and phases within the process. They can explore the reasons behind differences among routes, particularly those less commonly taken, leading to more insightful audit discussions.

Let’s take a specific example of the Procure-to-Pay (P2P) business process derived from transactions in the SAP system. Within this example, two distinct routes can be observed:

• Route with a payment blocking operation: This route involves manually blocking the payment to the supplier, followed by a subsequent manual release to facilitate the payment.
• Route without a payment blocking operation: In this route, the payment is processed automatically without the need for a manual release.

During the audit, the auditor’s focus will be on understanding the rationale behind cases where a manual blocking operation and subsequent manual release are performed, as opposed to the instances where the release occurs automatically. By investigating these variations, the auditor aims to gain insights into the underlying factors influencing the choice between manual and automatic payment processing.

 Key advantages of using the advanced tools

One key benefit of advanced auditing tools is the reduction of reliance on the business units and IT within the organization. These tools enable auditors to have direct access to data and perform independent analysis without relying on intermediaries.

In traditional auditing, the process often involved the auditor requesting data from the business, which required assistance from IT personnel. The auditor would then need to verify the accuracy of the data received and request corrections if necessary. This process was time-consuming and prone to errors.

By utilizing advanced auditing tools, the entire process is streamlined. The auditor has immediate access to the necessary data, eliminating the need for extensive coordination and assistance. This not only saves time but also reduces the potential for errors in data retrieval and ensures data integrity.

Improved Efficiency and Streamlined Audit Processes. With the adoption of advanced auditing tools, audit teams now benefit from enhanced efficiency and shortened audit times. Unlike in the past, where auditors approached their tasks without prior knowledge, modern auditors now enter engagements equipped with comprehensive insights empowering auditors with valuable information about the business process under review. They provide a clear understanding of the various workflows within the process, including those that are less commonly followed. Additionally, auditors have access to detailed data and statistics related to the business process.

For instance, auditors can quickly access key metrics such as the total number of suppliers engaged, the number of new suppliers added in a given year, and the annual expenditure associated with procurement activities. Armed with this prior knowledge, auditors can efficiently focus their efforts on areas of high importance and potential risk, optimizing their audit approach and ultimately enhancing the effectiveness of the audit process.

By leveraging advanced auditing tools, audit teams can significantly improve their overall performance, delivering more insightful and value-added audits while minimizing the time required to complete engagements.

Enhanced Analysis and Comparison Capabilities for International Companies with multiple subsidiaries can leverage centralized tools to perform comprehensive analysis and comparison of business processes and data across their various entities. This approach offers several distinct advantages. Firstly, it enables efficient analysis and comparison of business processes, allowing organizations to identify similarities, differences, and areas for improvement across their subsidiaries. By centralizing this analysis, companies can streamline their operations, enhance consistency, and implement best practices throughout the organization.

Furthermore, these centralized tools facilitate the connection and analysis of data from diverse systems employed by different subsidiaries. This capability allows for a holistic view of the organization’s operations, enabling better insights, data-driven decision-making, and enhanced coordination among the various entities.

By leveraging a centralized tool, international companies can harness the power of unified analysis and data integration. This empowers them to identify synergies, optimize processes, and drive operational efficiency across their entire network of subsidiaries, ultimately fostering improved performance and competitiveness in the global marketplace.

Leveraging Advanced Tools for Enhanced Monitoring, Analysis, and Anomaly Detection in Business Transactions: Empowering the Second Line of Defense

As the adoption of advanced tools such as Data Science, Machine Learning, and Risk Mining continues to grow, the question arises as to which stakeholders in the company should be utilizing these tools. Should it be the internal auditors who make up the third line, the units belonging to the second line (such as compliance unit and risk management unit), the managers of the business units in the first line, or perhaps a combination of these stakeholders? There is no definitive answer to this question, as it depends on various factors, including the company’s maturity level in utilizing advanced tools, the driving force behind their implementation, and the power dynamics within the organization’s control environment. One possible approach is for the second line to be responsible for utilizing the tools while internal audit ensures their correct usage.

This testing process can encompass evaluating the adequacy of the defined base rules, examining how exceptions are handled and monitored, and assessing the presence of a structured process for learning from past experiences and driving continuous improvement.

By carefully considering the organizational context and aligning the usage of advanced tools with the appropriate stakeholders, companies can maximize their benefits and effectively navigate the complexities of their control environment.

Conclusion:

Embracing the Future: Empowering Internal Audit through Advanced Technology

As we witness the rapid transformation of our world, propelled by groundbreaking technological advancements, it is imperative for internal audit to adapt and seize the opportunity to leverage these advanced tools. It is time to embark on a journey of education and enlightenment, harnessing the power of technology to elevate the quality, efficiency, and optimization of our audit work.  It requires unwavering commitment from all relevant stakeholders, with internal auditors at the forefront, leading the charge towards embracing the potential of advanced technological solutions.

Let us not be left behind in this era of technological revolution. Instead, let us rise to the occasion, empowered by knowledge, armed with cutting-edge tools, and driven by a collective commitment to innovation and progress. By embracing this bold transformation, we can shape the future of internal audit, ensuring its relevance, effectiveness, and unwavering value in an ever-evolving world.