Data Analytics and Mining

Controls and Audit Issues

By:- CA Anand Prakash Jangid

Agenda

Check in

Understanding Data Analytics landscape

Understanding BIG data

How is IA function Can Leverage it

Check out

Privileged and Confidential

Check in :The Bits & Bytes

1 Bit = Binary Digit

8 Bits = 1 Byte
1024 Bytes = 1 Kilobyte

1024 Kilobytes = 1 Megabyte

1024 Megabytes = 1 Gigabyte

1024 Gigabytes = 1 Terabyte

1024 Terabytes = 1 Petabyte

1024 Petabytes = 1 Exabyte

1024 Exabytes = 1 Zettabyte

1024 Zettabytes = 1 Yottabyte

1024 Yottabytes = 1 Brontobyte

1024 Brontobytes = 1 Geopbyte

Privileged and Confidential

What have put the interest in Analytics

January 2008 Socit

Gnrale announced that it
lost approximately 4.9
billion( $ 7.2 Billion) due to
unauthorized trading
The bank was founded in
1984
Operates in 82 countries and
employs 151,000 people
worldwide
Privileged and Confidential

The Man

Jrme Kerviel (born

January 11, 1977)
Started his career in
2000 in the complaince
dept of SG
2005 Promoted as
JUNIOR trader in the
Delta one Product
team
Privileged and Confidential

What so special about the fraud !!!!

Magnitude of the event - $7 billion in losses, surpassing any other example of unauthorized trading
incidents in history.
Singly perputed by a JUNIOR trader

Privileged and Confidential

How it happned
A Junior trader(Jrme) in SocGens Delta One business entered in to significant long positions in
Eurostoxx,DAX & FTSE index futures.
In the normal course of business these long positions would be hedged however the trader did not
take out genuine hedging trades
The trader offset the reported market risk by entering in to fictitious hedge transactions.
To avoid controls he Chose transactions with no cash movements or margin call & which didnt
require immediate confirmation

Privileged and Confidential

How it Happened..cont
Used other individuals passwords to cancel certain transaction

Falsified documents to justify the transactions

Ensured that the fictitious transactions were of a different instrument than the ones he cancelled

Privileged and Confidential

Cause/contributory factor
Able to Use/guess other individuals passwords to cancel/conceal certain transactions.

Trader used his experience of working in middle office roles to circumvent control processes .
Diverse application and access control across it not in sync.Old access to apps not removed for the
new role

Privileged and Confidential

What is Mr. Jerome doing now ?

Kerviel is now into a new job at information technology security consulting

firm Lemaire Consultants & Associates

Privileged and Confidential

10

The Sexiest Job of 21st Century will be..

.. DATA ANALYST
writes USA Today

It is one of the [most] sought-after positions,

tells Rob Bearden, CEO, Hortonworks

Privileged and Confidential

11

What is data analytics

[data] analytics is the process of obtaining an optimal or realistic decision based
on existing data.
- Wikipedia
Analytics leverage data in a particular functional process (or application) to enable
context-specific insight that is actionable.

- Gartner

Data analytics is the use of raw data to produce insight or

conclusions that can be acted upon
Privileged and Confidential

12

The Data analytics

Privileged and Confidential

13

And then the BigData

Privileged and Confidential

14

And then the Big Data

What is BIG DATA?

Big Data refers to datasets that grow so large that it is difficult to
capture, store, manage, share, analyze and visualize with the
typical database software tools.

It is massive (Volume) data, in different (Variety) format, from

different sources, growing at lightning(Velocity) speed!!!

Privileged and Confidential

15

The Data Types, every business, today, has

to rely upon

Privileged and Confidential

16

Business has to transform Unstructured Data into

meaningful insights
Transactional Data

World Wide Web & Social Media

Unstructured Data
Semi Structured Data
Structured Data

Flash Files
Images,
Archives
Privileged and Confidential

PDF Files
Log Files
Text Data

Transaction
Systems,
CRM, ERP,
BI, EPM,
DWH

Websites,
URLs,
Social
Medias,
Forums,
Blogs,
Messengers
News Portals
E-Commerce
17

The Data Sources, every business, today,

has to rely upon

Privileged and Confidential

18

Privileged and Confidential

19

Lets Understand this Huge,

Exponentially Growing Data

BIGDATA

Lets call it as
& How do we TAME it !!!

Privileged and Confidential

20

What makes it soo BIG?

Privileged and Confidential

21

Most Requested Uses of Big Data

Data Crawling, Collecting & Crunching
Transaction & Behaviour Analytics

Marketing & Brand Analytics

Smart Grid / Smarter Utilities
RFID Tracking & Analytics

Fraud / Risk Management & Modeling

360 View of the Customer/Products/Competition
Pattern Recognition

Log Analytics
Understanding Risk/Vulnerability patterns
Privileged and Confidential

22

Importance of analytics
Analytics help experts make decisions more accurately, objectively and economically; a rapidly developing
consensus in business, education, law, medicine and even professional sports.

Types of Analytics

Possible Applications

Retrospective Statistical Analyses

Used to gain deeper insight into critical sub-processes, financial and operational areas
of the business.

Forward-Looking Models

Can be built to predict which areas of the business are likely to evolve into risks,
exceptions, or simply require a greater level of focus.

Advanced Visualization Analytics

Can help transform the organization by providing deep analytical insight and actionable
information.

Privileged and Confidential

23

Why Business Analytics

Privileged and Confidential

24

Why business analytics?

Five big trends are driving the adoption of new approaches to business analytics. Taken together they

underscore an unforgiving demand for improved performance and a wake-up call for more disciplined risk
management.

Data Volumes & Technology Capacity

Regulations
Profitable Growth

New Signals
Hidden Sight

Privileged and Confidential

25

Opportunity for analytics within Risk management Function

Data supports fact-based decision making.

Already used extensively in many areas of business.

Automated techniques can cover up to 100% of the audit populations.

C-level and regulator expectations of IA risk management.

Desire by auditors to do more than confirm the obvious.

Data analytics has significant potential to be

Exploited in the internal audit space
Privileged and Confidential

26

Terminology Trade-up
The data jockeys

Analytics team

Continuous Control Auditing

Sustainable and repeatable analytics

Statistical Sampling

Risk Based Sampling

Site Visit

Remote auditing

Power Point

Visualization

CAATS

Analytic test

Audit observation

Hindsight, Insight, Foresight

Prescribed audit plan

Dynamic audit plan

Privileged and Confidential

27

Industry Trends
Powerful trends are driving the adoption of new approaches to Internal Audit.

IIA GAIN IT Audit Benchmarking Study 2009

Internal Auditor Magazine August 2009: Software
Trend Spotting, Neil Baker

Privileged and Confidential

Fraud Magazine May/June 2009:

Exposing the Iceberg Detecting
Fraud by Integrating E-mail Analytics
with the Fraud Triangle, Dan Torpey,
Vince Walden, and Mike Sherrod
28

What type of questions analytics can answer

Hindsight

Insight

Foresight

Where is the
problem?

What if these
trends continue?

What actions are

needed?

What will happen

next?

Why is this
happening?

Whats the best

that can happen?

What happened?

Privileged and Confidential

29

Predictive analytics complement existing fraud detection methods

Queries/Rules
Simple schemes and billing errors

Known fraud and abuse patterns

Predictive Analytics
Simple schemes and billing errors
Known fraud and abuse patterns

AND
Complex fraud and abuse patterns
Undiscovered schemes

New and emerging issues

Organized Fraud

Privileged and Confidential

30

Lessons learned why has data analysis failed

The root cause of ineffective analytics functions lies in the inability to define and measure success. There are

varying levels of maturity, independent of industry with few leading the pack.

Integration with core

audit activities

Tactical rather than

strategic technology
choices

Inability to break-down
siloed activities

Lack of IT support

Vision and the tools to

measure success

Drowning in data for

lack of information

Inability to replicate
successes

Lack of strategic
relevance to the
business

Privileged and Confidential

31

Tools and Technology

Representative analytical tools are outlined below deciding which tool is best for the situation is key.

Productivity/Database

Excel/
Access

SQL

Most organizations use a combination of traditional audit and

statistical/analytics tools.

Traditional Audit

ACL

Idea

vendors that IA can leverage.

Statistical/Analytics

SAS

Many of these tools may be available via existing ELAs with key

Engineer and deploy the necessary infrastructure and

accelerators (with appropriate IT support) such that the IA

SPSS

teams can focus on analytics vs. routine tasks.

Visualization/Self
Organizing Maps

Tableau

access to views, etc.

BI Platforms

Privileged and Confidential

Multiple ways to source the data feeds, secure ftp, read only

Viscovery

Cognos

Microstrategy

Acknowledge gaps with data but with some diligence it is

possible to work through the data quality issues
32

Sustainable Data Analytics Promotion Path

Sustainable
Repeatable
Ad-hoc

Tactical
Hindsight

Privileged and Confidential

Strategic
Insight

Foresight

33

Analytics Roadmap and Data Governance Model

Multi-year Roadmap
Building a two to three year roadmap that details the way in which your analytics program will be
implemented over time will help stakeholders understand and realize the benefits and objectives. Everyone
will share the same vision and have bought in - Internal Audit, IT, business owners and senior leadership.
The road map should be designed to evolve and will require regular updates and maintenance throughout
the multiyear delivery program.

Governance
Establishing a program governance model is critical to the success of most large, complex initiatives that
span across an organization/years.
The governance structure will determine the escalation path for projects that have significant risks and
have the authority to scope and de-scope each project.

Privileged and Confidential

34

Six guiding principles getting started with Advanced Analytics

Link your Goals and
objectives with Clear
Business Drivers

Know your data

Establish a clear understanding of expected benefits from Analytics and ensure linkage to audit planning.
This will translate into clear objectives that drive the strategy, long term vision and surface the near term
opportunities.
Data is the key ingredient. It drives the insights that fuel the benefits from any Analytics program. It
is critical to understand both the data you have and the data you dont have when determining how
and where you should begin. This knowledge also prioritizes efforts to collect whats missing for
future analyses and enhancements to your Analytics program.

Start Simple

There is no need to boil the ocean at the outset. Starting with a targeted, ad hoc analytic program
will yield greater benefits in terms of speed to insights, learning and value. Take the time to learn
first and then deploy necessary capabilities across the enterprise later.

Leverage Existing
Insights

When possible, leverage existing analytics capabilities (look within the business) to jump-start the
program and build consistency with prior initiatives. These insights should also provide clues
related to the risks and business areas to start with.

Make it Actionable
and Measurable

Develop a plan to take action and measure results accurately early in the game. The organization,
systems and process that support execution must be able to take action with the insights that are
generated recommendations.

Test and Learn

Privileged and Confidential

Be willing to test different approaches and areas of the business. Learn from results and try new
approaches based on what is learned.
35

Identifying common challenges

General
Determining and establishing consensus on objectives and success criteria.
Measuring and demonstrating success of efforts.
Limited resources (financial and human) to execute on a sustained basis.

Data availability and control

Variety of disparate information systems with different data formats
Incomplete data sets; inconsistent data quality.
Data privacy/security issues to navigate; data access may be limited.

Change management
Managing impact of data analytics and CA processes on people and other business processes and
overcoming individual auditors biases and preference regarding the use of data analytics in the audit
process.

Privileged and Confidential

36

Identifying common challenges

Data analytics
Inability to effectively leverage data analytics in order to efficiently achieve audit objectives.
Identifying, designing and building relevant analytics
Establishing a definition of exception, addressing false positives and false negatives, etc.

Privileged and Confidential

37

Expect the Unexpected

Be Prepared!!!
Privileged and Confidential

38

Questions and
Thank You
CA ANAND PRAKASH JANGID
+91 9620233516
anand@quadrisk.com
www.quadrisk.com