Financial executives, internal auditors, and compliance and risk teams are getting a whole lot savvier about how to reduce enterprise-wide risks these days, thanks in large part to forensic data analytics.
Collecting and analyzing data to reduce compliance, financial, and fraud risks is not a new concept, but historically it has been limited by archaic and time-consuming manual processes. That’s where advances in forensic data analytics—such as artificial intelligence, machine learning, and robotic process automation—is changing the face of compliance, risk, and internal audit capabilities today.
In simple terms, forensic data analytics is the collection and intelligent analysis of all the deep oceans of structured and unstructured data that companies amass in their day-to-day operations. When overlaid with human intelligence, such technologies and techniques help compliance, risk, and internal audit executives obtain meaningful insights to better prevent, detect, and monitor anomalies in business activities and transactions—and at a speed and level of accuracy once considered impossible.
Findings from a new benchmark report conducted by EY reflect that trend. Based on 745 phone interviews with financial, audit, risk, and compliance executives at multinational companies across 19 countries, respondents cited a variety of areas in which forensic data analytics has proven effective in managing risk. These areas include, among others, financial statement fraud; money laundering; data protection and data privacy compliance; cyber-breach and insider threats; and bribery and corruption.
The application of forensic data analytics within data protection and data privacy compliance is especially relevant and timely as many companies brace for the impact of the EU’s General Data Protection Regulation (GDPR) taking effect on May 25. According to the survey, 42 percent of respondents believe that data protection and data privacy regulations have a significant impact on the design and use of forensic data analytics. Yet, only 13 percent said that they’re using it to assist in GDPR compliance.
“As you’re using advanced technologies, if you incorporate these data protection considerations as you go, you’ll wind up with a better result, instead of resulting in a game of ‘gotcha’ internally or, worse, externally where you have an issue with a regulator,” Todd Marlin, a principle at EY, said during a recent Webcast discussing the survey results.
In addition to helping reduce enterprise-wide risks, other benefits of forensic data analytics, as cited by respondents, include:
Improved risk assessments (88%);
Ability to detect risk in large data sets (87%);
Faster response to investigations (81%);
More timely or relevant corrective action or training (80%);
Meeting regulatory expectations (79%);
Increased business transparency (74%); and
Reduced costs of risk management programs (55%)
At global brewing company Anheuser-Busch InBev, for example, one goal is to use forensic data analytics to “take screening activities and early detection to another level, to a point where you can stop suspicious, high-risk transactions before they happen,” said Martim Della Valle, the company’s global head of compliance. “But what I see as the main benefit is that [forensic data analytics] does a lot of the heavy lifting in getting information, leaving humans to do the value-added work.”
“What I see as the main benefit is that [forensic data analytics] does a lot of the heavy lifting in getting information, leaving humans to do the value-added work.”
Martim Della Valle, Global Head of Compliance, Anheuser-Busch InBev
Cross-functional collaboration. The survey also revealed that many risk functions are not working together effectively, hampering the full effectiveness of forensic data analytics efforts. According to the survey, 58 percent said just some of their business functions collaborate in their forensic data analytics efforts, while another 22 percent said they have siloed functions that don’t consistently share their efforts. Only 20 percent of respondents said their companies’ functions fully collaborate with each other.
To truly drive value from forensic data analytics, effective cross-function collaboration and leadership support is essential, Marlin said. Within companies that do it well, a wide range of stakeholders are responsible for a company’s forensic data analytics strategy, including internal audit, finance, enterprise risk management, compliance, information technology, and legal, the survey results showed.
“I’m seeing collaboration in pockets, and it’s in these pockets where they’re getting things done,” Marlin said. Typically, the department or business unit that is motivated to solve a problem leads the way and gets other business units around the table, he said.
In some cases, collaboration is driven by the board, depending on the question or concern that gives rise to the activity, said Maryam Hussain, a partner at EY. For example, if the board doesn’t feel comfortable in the assurances it’s getting from a certain department and wants better visibility or a different type of reporting, collaboration may be limited to just that department, she said. On the other hand, if the board expresses an interest in adopting forensic data analytics tools and techniques more broadly, that interest naturally encourages collaboration among the different departments, relevant to the board’s inquiry.
Resources and skillsets lacking. Another hurdle many companies encounter is getting the necessary resources and skillsets around executing the company’s forensic data analytics strategy—including the development of tests, technology support, or analysis of the results. Thirty-nine percent of respondents said they have no dedicated personnel at all, which could be explained by the fact that 31 percent of respondents said they outsource some or all their forensic data analytics efforts, EY stated in the survey. The second largest number of respondents (36 percent) said they have between one and five dedicated personnel involved in executing the company’s forensic data analytics strategy, whereas only 13 percent said they have 10 or more dedicated personnel.
Main benefits of FDA — broadly recognized
Respondents to the EY survey were asked to rank the main benefits of FDA (responses below out of 745):
Source: EY
In addition to resource shortages, skillsets are also lacking in this area. According to EY, successful forensic data analytics deployment requires the following three core skills:
Technical skills: Understanding of the company’s relevant systems and applicable technologies;
Domain knowledge: Familiarity with the business risks and the ability to interpret analytic results in the context of the company’s and its industry’s risk environments; and
Data analytics or data science expertise: Mathematical, computer science, and business intelligence skills in technologies such as pattern recognition, statistical analysis, query design, and data visualization
The survey showed, however, that only 13 percent of respondents indicated they have the right mix of technical skills, and only 12 percent said they have the right mix of data analytics or data science expertise. Additionally, only 28 percent said they have mature domain knowledge.
Broader investment in advanced technologies. When asked which forensic data analytics technologies they use to manage legal, compliance, and fraud risks, the most cited were spreadsheet and relational databases (90 percent); data warehousing (63 percent); internally built tools (55 percent); and visualization and reporting (54 percent).
Moreover, many financial, audit, risk, and compliance executives shared their future intentions of adopting emerging technologies over the next year, including in the areas of risk scoring and aggregation; data blending; social media analytics; user behavior analytics; robotic process automation; and artificial intelligence.
Della Valle of Anheuser-Busch InBev envisioned that, “the compliance function of the future certainly will have data scientists” and even “people who understand and know how to navigate behavioral science.”
Best practices
Despite the challenges posed by forensic data analytics, some risk, compliance, and internal audit teams across a variety of industries are playing a leading role. At online pharmaceutical company Express Scripts, for example, “the fight against prescription drug fraud and abuse involves a combination of tried-and-true detective work and state-of-the-art technology,” the company states on its Website.
To achieve this, Express Scripts has a fraud, waste, and abuse team that uses “proprietary data analytics to uncover patterns of potential fraud or abuse and scans for behavioral red flags to identify when someone is involved in wrongdoing. By combining Express Scripts’ unique platform, Health Decision Science—behavioral sciences, clinical specialization, and actionable data—the team has identified more than 290 potential indicators of pharmacy fraud.
Examples of fraud indicators Express Scripts has identified include:
The number of doctors visited;
Distance traveled to the physician or pharmacy;
The geography and patient population;
The mix of drugs dispensed; and
The frequency of those prescriptions.
Through the analysis of such data, the company is more accurately able to identify such fraudulent activity as billing for drugs that were never dispensed, billing for incorrect quantities of drugs, incidents of overbilling, and more, the company stated. “Collaborating with clients, government agencies, and law enforcement is a key component of the team’s work.”
In another example, the compliance department of a global consumer products company, together with a team of consultants and legal counsel, designed a metrics-driven methodology and platform that integrated data from multiple data sources—such as accounting systems, travel expense reports, and third-party due diligence reports—from across the enterprise for continuous monitoring of transactions and compliance risks. The platform then applies analytics to calculate risk scores. The initiative has helped the company realize cost savings through reduced investigation expenses and significant improvements in financial accounting controls, business transparency, and compliance monitoring.
And in the financial services industry, analytics has been used to weed out false positives to more accurately hone in on what risk areas to audit or monitor on a much more targeted basis. Consider the compliance task of a global financial institution, for example, that must check the names of individuals against those on a sanctions blacklist. Such a task can pose significant challenges for any multinational company with thousands of customers who may share the same name as those on the blacklist. Using data analytics, financial institutions can collect a broader variety of information—such as the individual’s nationality, the names and locations of family members, and whether they’ve traveled to, or received money from, sanctioned countries—to more easily identify those who are truly sanctioned individuals versus those who only share a name with them.
These are just a few examples of how data analytics helps companies across every industry. Through proper investment and senior-leadership support, forensic data analytics can help companies more effectively address their legal, compliance, and fraud risks. In this respect, the compliance, risk, and financial functions can collectively improve both business transparency and operational efficiency, protecting the company and fostering better business strategy.
No comments yet