(continued from front fl ap) Praise for COMPUTER-AIDED CD-ROM COMPUTER-AIDED FRAUD FRAUD CODERRE INCLUDED • A look at fraud from the fraudster’s perspective Prevention and Detection: A Step-by-Step Guide Prevention & Detection • Recognizing opportunities for CAATTs “A wonderful desktop reference for anyone trying to move from traditional auditing to integrated C A Step-by-Step Guide A Step-by-Step Guide P • Approaches to assist in identifying auditing. The numerous case studies make it easy to understand and provide a how-to for rO e the highest of high fraud risk those seeking to implement automated tools including continuous assurance. Whether you are v With an increasing number of crimes eM • Techniques for the development of just starting down the path or well on your way, it is a valuable resource.” n now committed using computers and —Kate M. Head, CPA, CFE, CISA t computer networks, business professionals analyses to look for fraud hidden in iP o Associate Director, Audit and Compliance need to be well versed in the evidentiary, the data nU University of South Florida technical, and legal issues related to digital & • The steps that will assist auditors in T evidence. maximizing their ability to prevent D and detect fraud through the “I have been fortunate enough to learn from Dave’s work over the last fi fteen years, and this etE Written as a guide for every professional publication is no exception. Using his twenty-plus years of experience, Dave walks through every e responsible for accessing data and using automation of advanced digital anti- R c aspect of detecting fraud with a computer from the genesis of the act to the mining of data for data-extraction and analysis software to fraud techniques t i- its traces and its ultimate detection. A complete text that fi rst explains how one prevents and o detect and deter fraud and wasteful prac- A With new audit standards and statements n detects fraud regardless of technology and then shows how by automating such procedures, the tices, Computer-Aided Fraud Prevention and : that place even greater pressure on auditors examiners’ powers become superhuman.” AI Detection: A Step-by-Step Guide presents in- to deter and detect fraud—and to do so —Richard B. Lanza, President, Cash Recovery Partners, LLC SD depth coverage for using data analysis as frequently in an electronic environment teE part of an ongoing organizational campaign where paper trails and manual fi les may not p COMPUTER-AIDED to detect and prevent fraud. “Computer-Aided Fraud Prevention and Detection: A Step-by-Step Guide helps management and D even exist—Computer-Aided Fraud Prevention - b auditors answer T. S. Eliot’s timeless question, ‘Where is the knowledge lost in information?’ Data This essential guide includes more than and Detection: A Step-by-Step Guide is an y analysis provides a means to mine the knowledge hidden in our information. Dave Coderre has -F sixty case studies providing hard-to-fi nd absolute necessity for fraud examiners, S FR AUD internal auditors, and IT managers. long been a leader in educating auditors and others about Computer Assisted Audit Techniques. teR implementation guidance for harnessing the The book combines practical approaches with unique data analysis case examples that compel p power of the computer and data analysis the readers to try the techniques themselves.” GA to spot fraud. Thorough and resourceful, DAVID CODERRE has over twenty years —Courtenay Thompson Jr. uU this guide walks readers through a basic of experience in internal audit, management Consultant, Courtenay Thompson & Associates id understanding of all the tools necessary to consulting, policy development, manage- eD set up a system of continuous monitoring, ment information systems, system devel- with key points backed up along the way opment, and application implementation with real-world examples. areas. He is currently President of CAATS DISCOVER HOW YOUR ORGANIZATION CAN— Accompanied by educational software by (Computer-Assisted Analysis Techniques EASILY—FIGHT FRAUD IN THE DIGITAL AGE Prevention & Detection ACL, a leading data analysis and fraud and Solutions). He is the author of three highly regarded books on using data analysis Written by David Coderre, renowned expert on the use of computer-assisted audit tools and detection software provider, the book’s practical for audit and fraud detection. techniques in fraud detection, this thorough and highly readable guide is fi lled with authoritative approach clearly shows auditors how an CD-ROM tips, techniques, and advice on: INCLUDED organization already using computer-assisted audit tools and techniques (CAATTs) can • What fraud is really costing your organization progress to the next level by developing • Why use data analysis to detect fraud? approaches to prevent and detect fraud. • How to assess the risk that fraud is occurring The book contains a thorough discussion of: • Automating your corporate fraud detection process • Audit software tools • Who exactly is responsible for fraud detection? David Coderre (continued on back fl ap) ISBN: 978-0-470-39243-0 Process Black PMS 876C GLOSSY P1:OTA/XYZ P2:ABC fm JWBT037-Coderre January13,2009 1:7 PrinterName:YettoCome ii P1:OTA/XYZ P2:ABC fm JWBT037-Coderre January13,2009 1:7 PrinterName:YettoCome Computer-Aided Fraud Prevention and Detection i P1:OTA/XYZ P2:ABC fm JWBT037-Coderre January13,2009 1:7 PrinterName:YettoCome ii P1:OTA/XYZ P2:ABC fm JWBT037-Coderre January13,2009 1:7 PrinterName:YettoCome Computer-Aided Fraud Prevention and Detection A Step-by-Step Guide DAVID CODERRE JohnWiley&Sons,Inc. iii P1:OTA/XYZ P2:ABC fm JWBT037-Coderre January13,2009 1:7 PrinterName:YettoCome Copyright(cid:1)C 2009byJohnWiley&Sons,Inc.Allrightsreserved. PublishedbyJohnWiley&Sons,Inc.,Hoboken,NewJersey. PublishedsimultaneouslyinCanada. Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,or transmittedinanyformorbyanymeans,electronic,mechanical,photocopying, recording,scanning,orotherwise,exceptaspermittedunderSection107or108ofthe 1976UnitedStatesCopyrightAct,withouteitherthepriorwrittenpermissionofthe Publisher,orauthorizationthroughpaymentoftheappropriateper-copyfeetothe CopyrightClearanceCenter,Inc.,222RosewoodDrive,Danvers,MA01923, 978-750-8400,fax978-646-8600,orontheWebatwww.copyright.com.Requeststothe PublisherforpermissionshouldbeaddressedtothePermissionsDepartment,John Wiley&Sons,Inc.,111RiverStreet,Hoboken,NJ07030,201-748-6011,fax 201-748-6008,oronlineatwww.wiley.com/go/permissions. LimitofLiability/DisclaimerofWarranty:Whilethepublisherandauthorhaveusedtheir besteffortsinpreparingthisbook,theymakenorepresentationsorwarrantieswith respecttotheaccuracyorcompletenessofthecontentsofthisbookandspecifically disclaimanyimpliedwarrantiesofmerchantabilityorfitnessforaparticularpurpose.No warrantymaybecreatedorextendedbysalesrepresentativesorwrittensalesmaterials. Theadviceandstrategiescontainedhereinmaynotbesuitableforyoursituation.You shouldconsultwithaprofessionalwhereappropriate.Neitherthepublishernorauthor shallbeliableforanylossofprofitoranyothercommercialdamages,includingbutnot limitedtospecial,incidental,consequential,orotherdamages. Forgeneralinformationonourotherproductsandservices,ortechnicalsupport,please contactourCustomerCareDepartmentwithintheUnitedStatesat800-762-2974,outside theUnitedStatesat317-572-3993orfax317-572-4002. Wileyalsopublishesitsbooksinavarietyofelectronicformats.Somecontentthat appearsinprintmaynotbeavailableinelectronicbooks. FormoreinformationaboutWileyproducts,visitourWebsiteatwww.wiley.com. LibraryofCongressCataloging-in-PublicationData: Coderre,DavidG. Computer-aidedfraudpreventionanddetection:astep-by-stepguide/ DavidCoderre. p.cm. Includesindex. ISBN978-0-470-39243-0(cloth) 1.Fraud. 2.Fraudinvestigation. 3.Fraud–Prevention. 4.Auditing, Internal–Dataprocessing. I.Title. HV8079.F7C622009 364.4–dc22 2008053433 PrintedintheUnitedStatesofAmerica. 10 9 8 7 6 5 4 3 2 1 iv P1:OTA/XYZ P2:ABC fm JWBT037-Coderre January13,2009 1:7 PrinterName:YettoCome This book is dedicated to my mom and dad, who by teaching me right from wrong, contributed much to this book. Also, to my wife, Anne, who tries to keep me focused on the important things in life; and to my children, Jennifer and Lindsay, who are proof that the tone at the top helps guide ethical behavior throughout the organization. v P1:OTA/XYZ P2:ABC fm JWBT037-Coderre January13,2009 1:7 PrinterName:YettoCome vi P1:OTA/XYZ P2:ABC fm JWBT037-Coderre January13,2009 1:7 PrinterName:YettoCome Contents CaseStudies xiii Preface xv CHAPTER1 What Is Fraud? 1 Fraud: A Definition 3 Why Fraud Happens 4 Who Is Responsible for Fraud Detection? 7 What Is a Fraud Awareness Program? 11 Screening Job Applicants 12 What Is a Corporate Fraud Policy? 12 Notes 15 CHAPTER2 Fraud Prevention and Detection 17 Detecting Fraud 18 Determining the Exposure to Fraud 19 Assessing the Risk that Fraud Is Occurring (or Will Occur) 23 External Symptoms 24 Identifying Areas of High Risk for Fraud 25 Looking at the Exposures from the Fraudster’s Perspective 26 Approach 1: Control Weaknesses 27 Who Could Benefit from the Identified Control Weaknesses? 27 What Can They Influence, Control, or Affect? 28 Can They Act Alone or Is Collusion Required? 29 Approach 2: Key Fields 30 Which Data Fields Can Be Manipulated and by Whom? 30 vii P1:OTA/XYZ P2:ABC fm JWBT037-Coderre January13,2009 1:7 PrinterName:YettoCome viii Contents Additional Fraud Risk Considerations 31 Understanding the Symptoms of Fraud 31 Being Alert to the Symptoms of Fraud 34 Building Programs to Look for Symptoms 36 Investigating and Reporting Instances of Fraud 37 Implementing Controls for Fraud Prevention 38 Notes 39 CHAPTER3 Why Use Data Analysis to Detect Fraud? 41 Increased Reliance on Computers 42 Developing CAATTs Capabilities 44 Integrated Analysis and Value-Added Audit 48 Recognizing Opportunities for CAATTs 49 Developing a Fraud Investigation Plan 49 Notes 54 CHAPTER4 Solving the Data Problem 55 Setting Audit Objectives 55 Defining the Information Requirements 57 Accessing Data 58 Data Paths 59 Data File Attributes and Structures 61 Assessing Data Integrity 65 Overview of the Application System 68 Overview of the Data 69 Notes 70 CHAPTER5 Understanding the Data 71 Computer Analysis 71 Analysis Techniques 74 Filter/Display Criteria 75 Expressions/Equations 75 Gaps 75 Statistical Analysis 76 Duplicates 76 Sort/Index 76 Summarization 77 Stratification 77 Cross Tabulation/Pivot Tables 78 Aging 78