According to the International Compliance Association (ICA), global corruption, such as forms of bribery and stolen money, costs $3.6trillion each year. Like the acceleration of technology, financial crime is a rapidly evolving threat for businesses of all sizes, with the ICA claiming it accounts for 3.6% of global GDP. As criminals and the schemes they target businesses with become more sophisticated, the need for expert investigative tactics and advanced technologies to help to combat the risk becomes more important.

What role does data analytics play in forensic investigations?

According to the American Institute of Certified Public Accountants’ white paper, ‘Reimagining Auditing in a Wired World’: Audit Data Analytics (ADA) is the science and art of discovering and analysing patterns, identifying anomalies, and extracting other useful information in data underlying or related to the subject matter of an audit through analysis, modelling, and visualisation for the purpose of planning or performing the audit.

Forensic investigations can feel like finding a needle (or multiple needles) in a haystack. To simplify it, the science of data analytics is asking the correct question of the received data and having the ability to sort the hay from the needles. This data is then presented to the ‘real’ forensic investigators; the people that speak to the suspects, the witnesses, and any other people of interest, in order to solve the case. 

Data analytics play a significant role in many different functions, across many different industries, but it is the people behind the analytics that are the crucial component. The person ‘behind the computer’ still plays a critical role, in terms of guiding the analytics in the right area. That person needs to have the knowledge and capability to use the complex software required to analyse large datasets.

The typical fraud investigations that we have been involved with take place within a business process that, first and foremost, must be understood. The first, and most important, thing to understand about a business process is identifying the weaknesses that allowed a potential fraud or a manipulation to take place. Once we understand that properly, this is where data analytics, and its role in a forensic investigation, become critical.

The risk of relying upon data analytics or giving them too much credibility is missing a key insight due to the software failing to understand the bigger picture. If properly harnessed, data analytics are an incredibly powerful tool when combined with the critical human eye and perception to lift the lid on cases in the financial world and beyond. As the data scientist, Hilary Mason, put it, “Data is a tool for enhancing intuition.”

Important success factors 

Data integrity 

Data integrity is perhaps the most important factor when it comes to using data analytics in any capacity, especially in forensic investigations where the data could be manipulated. When you start accessing data, you need to be able to do so independently, so that you can more easily identify any potential manipulation of said data. 

In many cases that we have seen, there is a tech-savvy individual involved in the fraud, and their organisation has failed to properly organise what data employees should have access to. This creates an environment that is ripe for exploitation. For example, an individual with access to sensitive data such as the organisation’s financial records, is then able to perform unlawful transactions and manipulate the numbers to cover his or her tracks. So, if the data is not valid, complete and therefore not accurate; it is essentially rendered useless for analysis. The same goes for when there is not enough data to analyse.

Bridging business processes

From the investigations that we've conducted, one of the factors that can drive the success of an investigation is the ability to bridge business processes with the underlying data, and to understand how the underlying data is originated, then you know what questions to actually ask. If you know the question to ask, then you know the particular analytics test to script. 

Vendor vetting and establishing the facts

Another important factor is the software being used for the analysis. Be wary of taking the vendors’ sales pitches at face value without input from the analysts who have their own set criteria. Approach the search for any new software applications by first determining the needs of all involved in the investigation. This will allow for the data to be queried, and the right questions to be asked during the trial stage. We may need to ask, “What day did the transaction take place and in which hour that it was made?”, or “Is there a pattern to find here?”. 

Asking the right questions can narrow down the data as much as possible in order to identify any suspicious activity. By taking charge of the process and truly understanding the needs of the business, the software can be chosen in-line with the business goals.

As the famous American engineer, statistician, professor once said, “If you do not know how to ask the right questions, you discover nothing.”

The pitfalls

Missing data

From our experience, the client failing to provide the analyst with the right data sets is one of the worst mistakes that can arise from the start of the process. It is important that when the analyst requests the data, they do not ask for a specific area - the lease data, for example – but that they ask for the complete dataset.

Along this same line of thought, forensic investigators need to look at the bigger picture. In addition to failing to ask for enough data, investigators should avoid making assumptions about the situation they are working on. This was put well by the statistician, W. Edwards Dessing when he said, “Without data, you’re just another person with an opinion.”

Assuming the facts

Assumptions of the guilty parties, for example, can lead to blind spots in what you are looking for. A classic example of this could be assuming that members of management were not involved in the fraudulent activity – with these types of assumptions, you may end up missing vital pieces of information in the data that would help with the investigation. 

Skills gaps

As previously mentioned, the most important aspect of the forensic investigations process is not the data analytics themselves, but the people behind them. To be successful, the person or team developing or designing the analytics must possess a deep understanding of the business, both the specific business being investigated and processes and procedures within the industry concerned. 

Without this knowledge and context of the bigger picture, it becomes harder to ask the right questions of the software and be confident in what you are looking for. In situations like these, the analyst needs to have the capability to understand the query, as well as whether or not that query is actually achieving the desired objective.

The importance of collaboration 

A critical aspect of forensic investigations is for specialist advisers in data analytics to work alongside the business leaders, as much as it is with other projects such as internal audit services or continuous monitoring services. Ensuring effective collaboration and communication with business leaders during the investigation can lead to a better outcome. The more knowledge that is shared, the more we can assist with finding the root cause of a problem, whether it comes from the business process, the database architecture, or even an amalgamation of the two, for example.

Case study

The issue

A lot of forensic investigations begin with rumours of malpractice – speculation perhaps of wrongdoing that give rise to concern. In one particular instance, we supported the management team of a mining company after they began to hear rumours that people were working together to manipulate their quotation request procedure. 

Here in South Africa, this is one of the most pressing issues in business that we are currently facing, from a forensic investigation’s perspective. They asked us to take a look at their web interface which had a typical request-for-quote (RfQ) system. It seemed that their clients were paying far higher prices than initially quoted. Despite this complaint, nobody knew how this was happening.

The investigation

We began by bringing in our data analytics team to interrogate the RfQ system and apply their analytics programme to that database. In the RfQ system, it was quickly recognised that there was a deadline whereby the quotation process closes and suppliers can no longer submit a quote. We identified a several instances of quotes being submitted just minutes before the deadline, as well as quotes being withdrawn by the suppliers half an hour before the deadline, then those same suppliers submitting quotes again at much higher prices. We had identified these trends from the data, but what did this mean?

Our data analysts gathered enough information to pinpoint the exact number of manipulated quotes, when they were made, and over which period of time. Once the analysts had found all of the exceptions in the otherwise regular pattern on the RfQ system’s database, the investigation was out of their hands. The forensic investigators then used this information to conduct a series of interviews with people both inside and outside of the organisation. 

The findings 

From our comprehensive investigation, combing the latest in data analytics technology with the brightest minds in forensic investigating, we were able to determine that the culprits who were changing and increasing the value of the quotes most likely did not come from within the organisation. Instead, it was determined that it was a competitor of the organisation who was manipulating the quotes. 

Representatives from the competitor business were altering the quotes to a much higher price, so that the competitor could quote a slightly lower, but still high, price. Once this theory was established, the team then began investigating how this could have happened. At this point, the RSM team identified a security breach from within the RfQ system, which could only have been carried out by someone within the organisation who was working with the competitor. 

In this particular case, the organisation decided not to seek prosecution, but armed with our data-led insights and expert advice, they implemented controls that stopped the process in its tracks. It was projected that halting this process saved that organisation millions of rands.

So, what happens next?

With technological advancements increasing at a rapid rate, data analytics will become more automated and self-proficient. The software and technology behind it will only get more complex and effective in spotting financial crimes among countless datasets. Yet despite this, data analytics, as with most technologies, is a tool – and all tools need a human to wield them. You cannot remove the human factor from forensic investigations because intuition is critical. Data analytics are instead an incredibly useful and powerful extension of our capabilities in a forensic investigation. With this power, we are able to reduce corporate criminal activity, and protect the businesses that these bad actors go after.

As the British economist, Ronald Coase, once said, “If you torture the data long enough, it will confess.”