Downloaded 23 times
Uploaded byMarcos Vargas
Acl
This document provides an overview of how auditors can use audit command language (ACL) software to analyze data and detect anomalies and fraud. It discusses getting started with ACL, obtaining basic information from data, looking for anomalies, detailed transaction analysis, and provides an example case study of how ACL was used to detect procurement card fraud. The case study involved analyzing 1,840 transactions worth $209,403 over two years, compiling evidence from receipts and online orders, and identifying control issues that allowed the fraud to occur. Corrective actions were then implemented, including improving control structures and ongoing monitoring.
Acl
- 1. Use of ACLUseof ACL in Audits & Investigationsin Audits & Investigations Lon S. Heuer, CPA, CIALon S. Heuer, CPA, CIA Associate Vice President for Institutional Compliance andAssociate Vice President for Institutional Compliance and Director, Office of Internal AuditsDirector, Office of Internal Audits Dyan G. Hudson, CISADyan G. Hudson, CISA Associate Director, Office of Internal AuditsAssociate Director, Office of Internal Audits
- 2. AgendaAgenda Overview ofGeneralized Audit SoftwareOverview of Generalized Audit Software How to Get StartedHow to Get Started Getting Basic File InformationGetting Basic File Information Looking for AnomaliesLooking for Anomalies Detailed Transaction AnalysisDetailed Transaction Analysis Example – Procurement Card Case StudyExample – Procurement Card Case Study
- 3. OverviewOverview What does itdo?What does it do? Allows auditors to extract and analyze dataAllows auditors to extract and analyze data independent of programmers and auditeesindependent of programmers and auditees Summarizes large amounts of dataSummarizes large amounts of data 100% testing of large populations100% testing of large populations – Increases probability of detecting errors andIncreases probability of detecting errors and omissionsomissions – Increases probability of detecting fraudIncreases probability of detecting fraud
- 4. Getting StartedGetting Started KnowYour Data!Know Your Data! Know where to get itKnow where to get it – Platform (PC/mainframe/other) and formatPlatform (PC/mainframe/other) and format – Quantity and extract optionsQuantity and extract options – Knowledgeable staffKnowledgeable staff Know what it should look likeKnow what it should look like – Important fieldsImportant fields – Statistical expectationsStatistical expectations Check key fields for validityCheck key fields for validity – Numeric / alphanumericNumeric / alphanumeric – Blank / non-blankBlank / non-blank – Valid codesValid codes
- 5. Getting StartedGetting Started ValidityChecks Demo
- 6. Get Basic InformationGetBasic Information Generate summaries and statistics on keyGenerate summaries and statistics on key fieldsfields – Record countRecord count – Totals and key subtotalsTotals and key subtotals – Average, maximum, minimum valuesAverage, maximum, minimum values Run “overview” reports (Classify,Run “overview” reports (Classify, Summarize)Summarize)
- 7. Get Basic InformationGetBasic Information Summary statistics demo Overview reports demo
- 8. Look for AnomaliesLookfor Anomalies Exception reportsException reports Statistical deviance and digital analysisStatistical deviance and digital analysis – Benford’s LawBenford’s Law – Rounding of amountsRounding of amounts – Even dollar amountsEven dollar amounts Stuff to Read:Stuff to Read: www.utexas.edu/admin/audit/files/www.utexas.edu/admin/audit/files/ Using Audit ToolsUsing Audit Tools Case StudiesCase Studies Digital AnalysisDigital Analysis
- 9. Look for AnomaliesLookfor Anomalies
- 10. Look for AnomaliesLookfor Anomalies
- 11. Look for AnomaliesLookfor Anomalies Exception report demo Benford’s analysis demo
- 12. Detailed Transaction AnalysisDetailedTransaction Analysis Extract “suspect” records for reviewExtract “suspect” records for review Select statistically valid sample for reviewSelect statistically valid sample for review and extractand extract
- 13. Detailed Transaction AnalysisDetailedTransaction Analysis Extract Demo
- 14. ACL ExercisesACL Exercises GotoGo to www.utexas.edu/admin/audit/files/www.utexas.edu/admin/audit/files/ Download all files.Download all files. OpenOpen CARDUSE.ACLCARDUSE.ACL using ACL Workbookusing ACL Workbook and follow instructions inand follow instructions in EXERCISES.DOCEXERCISES.DOC..
- 15. ExampleExample Procurement Card FraudProcurementCard Fraud BackgroundBackground Fiscal Year 2000 Audit Plan – Spot CheckFiscal Year 2000 Audit Plan – Spot Check Procurement Card Program Fiscal Year 99Procurement Card Program Fiscal Year 99 Follow up to 1997 auditFollow up to 1997 audit StatisticsStatistics – Over 300 departments and 1,680 cardsOver 300 departments and 1,680 cards – 281,000 transactions (through 5/31/2002)281,000 transactions (through 5/31/2002) (78,463 in FY01, 63,559 in FY02 through 5/31)(78,463 in FY01, 63,559 in FY02 through 5/31) – $41.3M$41.3M ($12.0M in FY01, $9.3M in FY02 through 5/31)($12.0M in FY01, $9.3M in FY02 through 5/31)
- 16. Obtaining Data forAnalysisObtaining Data for Analysis Card DataCard Data Transaction DataTransaction Data Merchant ClassesMerchant Classes Accounting/Payment DataAccounting/Payment Data Data from Bank of AmericaData from Bank of America Data from UT Accounting SystemData from UT Accounting System Merged TransactionMerged Transaction Data File in ACLData File in ACL
- 17. Data Analysis UsingACLData Analysis Using ACL Summaries & StatisticsSummaries & Statistics High volume cardholdersHigh volume cardholders High dollar cardholdersHigh dollar cardholders High volume merchantsHigh volume merchants High dollar merchantsHigh dollar merchants Exceptions & AnomaliesExceptions & Anomalies Policy violationsPolicy violations Other unusual transactionsOther unusual transactions
- 18. Created reports basedon merchant class codeCreated reports based on merchant class code to identify unusual types of purchasesto identify unusual types of purchases International itemsInternational items Clothing storesClothing stores PetsPets GasGas FlowersFlowers Bicycle shopBicycle shop GiftsGifts CharitiesCharities SchoolsSchools Equipment RentalEquipment Rental CollegesColleges Travel-relatedTravel-related Postal ServicePostal Service Utilities (including telephone services)Utilities (including telephone services) InternetInternet Grocery storesGrocery stores TransportationTransportation AntiquesAntiques Policy ViolationsPolicy Violations Type of PurchaseType of Purchase
- 19. Other Policy ViolationsOtherPolicy Violations and Unusual Transactionsand Unusual Transactions Transactions over $999.00 limitTransactions over $999.00 limit Split Orders –Split Orders – multiple transactions to singlemultiple transactions to single vendor on single day with total amount overvendor on single day with total amount over $999.00$999.00 Even dollar amountsEven dollar amounts Sales tax paid to Texas merchantsSales tax paid to Texas merchants
- 20. Match Suspect TransactionsMatchSuspect Transactions to Accounting Recordsto Accounting Records Complicated account postings and transfersComplicated account postings and transfers between accountsbetween accounts Matched dollar amounts and dates usingMatched dollar amounts and dates using ACL’s Duplicate function to identifyACL’s Duplicate function to identify movement of funds between accountsmovement of funds between accounts Scrutinized electronic routing and approvalScrutinized electronic routing and approval of electronic payment documents to identifyof electronic payment documents to identify weaknesses in segregation of duties and/orweaknesses in segregation of duties and/or insufficient account/transaction reviewsinsufficient account/transaction reviews
- 21. Initial InvestigationInitial Investigation ReviewedExisting ReportsReviewed Existing Reports Ran Additional Reports - Single Card UseRan Additional Reports - Single Card Use Collection of ReceiptsCollection of Receipts Meeting with Principal InvestigatorsMeeting with Principal Investigators Personnel ActionsPersonnel Actions Secure Electronic Hardware/ Files/ etc.Secure Electronic Hardware/ Files/ etc. Coordination with Police and District Attorney’sCoordination with Police and District Attorney’s OfficeOffice Arrest of subjectArrest of subject
- 22. Compilation of EvidenceCompilationof Evidence ProblemsProblems Card Use (10/97 - 4/00)Card Use (10/97 - 4/00) • Transactions: 1,840Transactions: 1,840 • Volume: $209,403Volume: $209,403 Post 4/99 Receipts Destroyed (65%)Post 4/99 Receipts Destroyed (65%) Complicated Account PostingsComplicated Account Postings Number/Type of VendorsNumber/Type of Vendors
- 23. Compilation of EvidenceCompilationof Evidence ApproachApproach Document Each TransactionDocument Each Transaction Evaluate Source Documents:Evaluate Source Documents: • Original receiptOriginal receipt • Receipt copy - On request or by subpoenaReceipt copy - On request or by subpoena • Vendor web sites - order history & account infoVendor web sites - order history & account info • E-mail purchase & shipping confirmationsE-mail purchase & shipping confirmations
- 24. Compilation of EvidenceCompilationof Evidence Case ICase I ReceiptsReceipts Online order historyOnline order history Email confirmationsEmail confirmations Returns for credit onReturns for credit on personal cardspersonal cards Case IICase II Receipt with forgeryReceipt with forgery Online order historyOnline order history Email confirmationsEmail confirmations
- 25. Case I -ReceiptsCase I - Receipts
- 26. Case I -ReceiptsCase I - Receipts
- 27. Case I –Online Order HistoryCase I – Online Order History
- 28. Case I –EmailCase I – Email ConfirmationConfirmation
- 29. Case I –ReturnsCase I – Returns Order Return Credit
- 30. Case II –ReceiptCase II – Receipt With ForgeryWith Forgery Forged Receipt
- 31. Case II –ReceiptCase II – Receipt With ForgeryWith Forgery Actual Receipt Forged Receipt
- 32. Control IssuesControl Issues Separation of DutiesSeparation of Duties Sharing of PasswordsSharing of Passwords Account ReconciliationsAccount Reconciliations Minimal Account ReviewsMinimal Account Reviews
- 33. Corrective StepsCorrective Steps Lettersto Deans, Directors, PrincipalLetters to Deans, Directors, Principal Investigators, etc.Investigators, etc. Follow-up Confirmations to HierarchicalFollow-up Confirmations to Hierarchical GroupsGroups Improvement of Control StructureImprovement of Control Structure On-going Part of Compliance ProgramOn-going Part of Compliance Program
- 34. Improvement ofImprovement of ControlStructureControl Structure Website InformationWebsite Information http://www.utexas.edu/admin/purchasing/procard/pcardwelcome.htmlhttp://www.utexas.edu/admin/purchasing/procard/pcardwelcome.html Testing of new cardholdersTesting of new cardholders http://www.utexas.edu/admin/purchasing/procard/pcardmodule1.htmlhttp://www.utexas.edu/admin/purchasing/procard/pcardmodule1.html Tightened card use limitsTightened card use limits Review/acknowledge voucher approvalReview/acknowledge voucher approval
- 35. On-going Compliance ActivitiesOn-goingCompliance Activities Inclusion in Compliance VerificationInclusion in Compliance Verification SystemSystem Approvals of monthly vouchersApprovals of monthly vouchers Quarterly reviews using ACLQuarterly reviews using ACL
- 36. Quarterly ACL ReviewsQuarterlyACL Reviews Card Use ReportsCard Use Reports – Ranks by $ amountRanks by $ amount – Ranks by # transactionsRanks by # transactions
- 37. Card Use SummaryCardUse Summary
- 38. Quarterly ACL ReviewsQuarterlyACL Reviews Card Use ReportsCard Use Reports – Ranks by $ amountRanks by $ amount – Ranks by # transactionsRanks by # transactions Compliance/Miscellaneous ReportsCompliance/Miscellaneous Reports – Transactions > $999.00Transactions > $999.00 – Potential Split OrdersPotential Split Orders – Posting delays > 30 daysPosting delays > 30 days
- 39.
- 40.
- 41. Quarterly ACL ReviewsQuarterlyACL Reviews Card Use ReportsCard Use Reports – Ranks by $ amountRanks by $ amount – Ranks by # transactionsRanks by # transactions Compliance/Miscellaneous ReportsCompliance/Miscellaneous Reports – Transactions > $999.00Transactions > $999.00 – Potential Split OrdersPotential Split Orders – Posting delays > 30 daysPosting delays > 30 days College/Department Level ReportsCollege/Department Level Reports
- 42. Quarterly ACL ReviewsQuarterlyACL Reviews Merchant Summary ReportsMerchant Summary Reports – High $ MerchantsHigh $ Merchants – ““Suspect” MerchantsSuspect” Merchants – Merchant TypesMerchant Types Specific Card Investigations/WatchesSpecific Card Investigations/Watches
- 43. Procard Review ProceduresProcardReview Procedures ReportsReports Coordination with Other DepartmentsCoordination with Other Departments – Internal AuditsInternal Audits – PurchasingPurchasing – Accounts PayableAccounts Payable Follow-upFollow-up
- 44.
Editor's Notes
- #4 Audit software allows you to quickly and easily summarize huge amounts of data and generate statistics, and do testing of 100% of your population rather than having to select only a small sample. As we go through this demonstration, hopefully you will begin to see what a huge improvement this is over traditional audit sample testing.
- #16 FY2002 thru 5/31/02:63,559$9,274,807.93 FY2001:78,463 $12,026,325.67 FY2000:64,043$9,511,375.28 FY1999:50,353$7,151,204.97 FY1998:24,767$3,379,382.65 FY1997:9$1,533.96 ==================================== 281,194$41,344,630.46