The brain gain*

Advanced knowledge-based systems can be a valuable weapon in the fight against fraud By Peter Dent and Olivier L. Curet *This is an expanded version of a summary that originally appeared in the August 2003 issue. Forensic accountants and auditors no longer have to rely solely on their own experience to detect fraud or internal control weaknesses. Huge strides have been made over the past decade in advanced knowledge-based systems (KBS), which use data mining to unearth patterns and trends that might otherwise escape detection. In that way, they can contribute to an organization's overall risk management strategy. These new systems take advantage of existing knowledge drawn from the most experienced minds in the field. Data mining technologies also encompass case-based systems and neural networks. What are advanced knowledge-based systems? Advanced knowledge-based systems (KBS) are computer-based applications that do not rely on strict programming rules to perform highly skilled tasks or reach conclusions. KBS are largely trained, not programmed. Based on a limited understanding of the workings of the human brain, which is made up of many neurons that respond to outside stimuli and can detect logical but hidden patterns in data, voice and image, today's advanced neural networks are capable of processing and learning from data, then making subtle changes to their processing and output. They can also be trained to recognize simple patterns among data and model predictions from them. For example, an experienced fraud investigator might argue that hiring an employee with a gambling addiction is likely to increase an organization's risk profile. Armed with this simple fact, both a traditional rule-based expert system and a neural network, if designed appropriately, might reach the same conclusions. The only difference is that the rule-based, "if-then" application, in most cases, can answer only "yes" or "no" to the likelihood of increased risk. However, neural networks and induction-based systems such as case-based applications can define the propensity of risk, drawing on the experience of the fraud detection specialists whose knowledge was used to train them. Now, say the gambling-addicted employee also happens to be a lay minister, which would normally reduce risk. Therefore, the employee probably poses less of a risk to the organization. Although the two pieces of information would seem at odds, a neural network and an inductive-based system such as traditional case-based reasoning can weigh both to determine which should be given more importance. If, for instance, being a lay minister is considered a stronger predictor of behaviour than being a gambler, the program would alter its output to predict the organization to be at a decreased risk of fraud. But its risk prediction would be lower still if the individual were not a gambler at all. The power of neural networks and case-based reasoning can be seen when hundreds, even thousands, of competing and often contradictory bits of information—each of which can be assigned a certain weight—are entered into the system and their weightings accounted for. The output is the prediction of increased or decreased risk to an organization posed by any number of factors, whether internal or external, when benchmarked against other organizations. The applications of such systems are limited only by one's imagination. Current applications include the assessment of an entity's internal control functions and the propensity for an organization to be victimized by fraud. Background Because standard accounting procedures are frequently highly structured or at least semistructured, their inherently logical form spawned the initial rush to develop rule-based applications. But the absence during that period of well-accepted general-purpose methodologies in traditional KBS design, and the dependence on rather rudimentary technologies, led to many hastily developed and logically flawed applications that worked best in closed, static, highly specialized or narrow applications. Merely competent rather than truly expert, many of the early accounting KBS were victims of the "80/20" syndrome: 80% of their expertise was low level, and the remaining 20% impossible to encapsulate. KBS and the professional The professional's expertise, applied to the financial details of a particular company in light of his or her wider financial and general knowledge, can involve a judgment concerning the likelihood of fraud. But human judgment is subject to psychological blocks and biases, such as one's familiarity with similar events and occurrences, and one's own prejudices. The likelihood of reverting to one's biases is even greater when the environment is highly unstructured and fuzzy, as is often the case in audit or fraud engagements. Applying expertise, a professional has to judge whether financial statements give a true and fair picture of a company's affairs. The presence of fraud can obviously distort that picture, affecting a professional's judgment. Statement on Auditing Standard (SAS) 99 stipulates that audit procedures should be designed to give the professional a reasonable expectation of detecting any material misstatements, whether intentional or unintentional, in an entity's financial statements. One of the goals of KBS is to provide an additional tool to assess the risk of being victimized by fraud – whether the victim be the client and its shareholders or the professional who is unknowingly associated with a client engaging in fraudulent activities. Another application currently in use by professional service firms is the assessment of a client's fraud risk profile. The goal is to reduce the likelihood of an auditor being associated with an ethically challenged client. It is important for professionals to identify potential problem clients early, since "the costliest clients are those who don't pay their bills or who pose high litigation risks."1 (A knowledge-based system not only increases the prediction rate of potential problems but takes what is known about one client and applies it to every other client being assessed.) Such applications may become more valuable with the release of the AICPA's SAS 99 and Sarbanes-Oxley. Advantages of KBS Early rule-based systems have proven very useful in fraud detection cases where the decision-making required is relatively structured. But fraud investigations tend to be much broader in scope, covering financial, economic, accounting, social and sometimes even forensic issues. In addition, despite all the expertise available in the investigative accounting area, that expertise is recorded mainly in the form of cases rather than procedures, which do not convert easily into rules. A similar challenge exists in the assessment of internal controls. Why in one organizational environment a seemingly satisfactory internal control structure results in a catastrophic breakdown, and in another operates efficiently, is the result of a multitude of competing bits of information that defy more simplistic rule-based applications. The changing nature of the fraud or internal control risk environment—where solution strategies are constantly evolving—means a KBS's adaptability is less resource intensive than a rule-based system, which requires constant updating and maintenance. KBS are a valuable resource for supporting unstructured decision- making, which is as essential in fraud detection as it is in auditing and identifying internal control weaknesses. The advent of data mining Instead of trying to encode expertise in the form of rules, data mining has evolved to support two subtechniques.  One of these – neural network-related technologies – has been the subject of considerable research in recent years and has been shown to work quite successfully in specific environments, such as pattern recognition and financial modeling. Data mining can also be used in the service of another subtechnique, case-based reasoning. Provided with a collection of cases, along with the decisions they engendered and a case browser, users are challenged to discover and review existing experience and judgments for themselves. CBR is particularly useful in fraud detection and internal control benchmarking. A case-based application can be developed using the past experiences (i.e. concrete cases) of auditors, forensic accountants and fraud investigators—again, based on circumstances where fraud and/or internal control weaknesses may or may not have occurred. It is the experience of these experts that enables the system to be trained to work as a predictor or guide of an organization's risk profile, based on a given set of parameters. Current applications Other than the applications currently being used in professional services firms, KBS are already being employed in several industries to: • Visualize computer log files, audit trails and other time-stamped data • Display customer behavioural patterns • Segment customers into markets • Understand customer retention patterns2 • Monitor customer credit card usage patterns to minimize fraudulent transactions. An advanced KBS can also help detect a fraud as it begins to take shape—before the economic damages escalate—and within a time frame that allows for a better chance of identifying the people responsible. A data-mining application that mimics human pattern-recognition skills is able to adapt to and learn from the constantly changing behaviour patterns of fraudsters. It is important that enough historical data is included to increase the KBS's predictive accuracy. Once behavioural patterns have been identified through the use of such data, the KBS can identify similar patterns among the millions of customer accounts and produce reports indicating which ones warrant further scrutiny. While the degree of reliability and accuracy of the data-mining application can be quite high, chances are it will identify accounts that do not exhibit fraudulent activity and fail to identify others that do. But that is to be expected. Its power lies in its ability to learn from its past mistakes by incorporating data from false negatives and positives, thereby increasing its predictive capabilities. The more data and cases the application is exposed to, the more powerful and accurate it becomes. A valuable strategic weapon The application of advanced KBSs and data mining to detect internal control weakness or fraudulent activity is simply another way of using historical data to predict future behavioural patterns. Some human pattern-recognition skills cannot be matched by KBS applications—not yet, anyway—but human skills are easily overwhelmed by the sheer amounts of data that must be reviewed to detect a pattern of fraudulent activity. The problem with traditional fraud detection techniques is that the criminal activity occurs so quickly that, by the time it is detected, the fraudsters have long since disappeared and the economic damage has been done. Although an advanced KBS is never meant to replace traditional fraud detection or internal control assessment methodologies, it can help identify potential financial abuse. The professional/investigator must still gather evidence, interview witnesses and perpetrators. Organizations, for their part, must continue to ensure internal controls are in place to prevent future problems. An advanced KBS enables an organization to improve the efficiency and effectiveness of its efforts to stem potential losses from fraudulent and financially abusive activities. As such, these applications are but one more weapon in its strategic arsenal. Advanced KBS can best be thought of as watchdogs, providing leads or tips to professionals, and an organization's management about high-risk areas. These can then be investigated and controls implemented to mitigate that higher level of risk. Olivier L. Curet, PhD, is a senior manager at Deloitte & Touche. He can be reached at ocuret@deloitte.com Peter Dent, CA•IFA, CPA, CFE, is the senior forensic accountant for the World Bank Group and is based in Washington, DC. He can be reached at pdent@worldbank.org. Notes 1 Journal of Accountancy, June 1999, p. 45. 2 K. Cox, S. Eick, G. Wills, "Visual Data Mining: Recognizing Telephone Calling Fraud," Data Mining and Knowledge Discovery, Vol. 1, pp. 225-231.