5 insights into fraud risk analytics

Five insights for executives to consider in using fraud risk analytics

The latest guidance is evolving with technology

Technology has continued to become a more integrated component of virtually every business process over time, so it is not surprising that its use was a point of reference rather than a point of emphasis in this guidance. This is changing.

The Committee of Sponsoring Organizations of the Treadway Commission's (COSO) 2016 Guide (the 2016 Guide) draws from and updates guidance for establishing a fraud risk management program as first published in 2008’s “Managing the Business Risk of Fraud.” ⁴ Among its elements, the 2016 Guide provides insights and considerations for addressing Principle 8 of COSO’s 2013 Framework (the 2013 Framework), which is focused on an organization’s consideration of the risk of fraud.

Of particular note, the 2016 Guide explicitly discusses recent technology developments, specifically the role of data analytics in addressing an organization’s risk of fraud as part of a comprehensive fraud risk management program.

Back to top

Risk assessment is an essential tool in fighting fraud

A fraud risk assessment is an essential element of an organization’s fight against fraud. Leveraging guidelines in the 2013 Framework, development of the fraud risk assessment often begins by identifying business and financial processes to be included in its scope. From there, various ways that fraud and misconduct can occur by and against the organization are identified, including potential schemes to circumvent existing internal controls or for management to override controls. At this point, though, the risks identified are purely heuristic—or based on what an organization’s professionals think could occur, those fraud risks that have occurred, and schemes and risks that may be developed and included based upon industry.

From here, there is an opportunity to use one of an organization’s most important assets, its data, to build upon the initial fraud risk assessment. With fraud schemes and the sophistication of fraud perpetrators constantly evolving, analytics tools provide the ability to discern anomalies, patterns, and trends—including in real time—across available data that might otherwise go unnoticed, whether within a business unit, in a particular region, or across the enterprise.

Back to top

Three ways data analytics support the fraud risk assessment

The specific inclusion of data analytics and its benefits in the context of fraud risk assessment in the 2016 Guide recognizes the expanding role of analytics in three key stages of fraud risk assessment:

Identification. Data analytics can be used to look for anomalies or red flags that indicate potential fraud risk schemes and identify high-risk areas for inclusion in the fraud risk assessment.

Validation. Analytics can validate the identification of high-risk schemes, evaluate the accuracy of risk assessment process findings, and indicate the need for additional procedures.

Monitoring. Tests and tools can be developed to continuously monitor high-risk schemes and behaviors, aid in assessing the effectiveness of the fraud action plan, and provide proactive alerts for possible exceptions and violations on an ongoing basis.

Back to top

Simple steps can energize fraud risk analytics

Organizations that recognize the seriousness of the fraud threat often struggle with where to begin in assessing the risk. Here are some helpful initial steps:

Know where you are. Carefully examining the organization’s current fraud risk assessment approach in the context of COSO and other guidance and the potential for employing analytics can provide the foundation for expansion and improvement of current capabilities. Also, an assessment of an organization’s current use of analytics for other purposes may reveal opportunities to leverage existing capabilities to reduce the time and costs of deploying fraud risk analytics.

Know where you want to go. Organizations may reject conducting analytics across fraud and/or compliance domains as a futile, boil-the-ocean endeavor. A more realistic approach may be to set modest, short-term goals and develop a roadmap to achieve them in increments with a vision to ultimately enhance the overall fraud risk assessment program. Proofs of concept that build on incremental successes are often an effective way to integrate analytics.

While navigating the path to where you want to go, look for signs around the organization. Both major business changes and day-to-day operations can help strengthen the case for the use or enhancement of fraud risk analytics. For example, any number of directorates—such as internal audit, the office of general counsel, compliance, as well as core business operations—may take on the initiative of enhancing their discrete function with data. In fact, most companies already have an ecosystem of advanced analytic tools necessary to get started. Convening various stakeholders to discuss ongoing analytic efforts or recently completed proofs of concept—both broadly and with regard to specific fraud risk assessment opportunities—can help facilitate the production of data and the use of customized business analytics for risk assessment purposes.

The trip will ultimately be worth it. Data issues can offer organizations an easy excuse to hold off on fraud risk analytics. There’s too much data, the data’s bad, or pulling data from disparate systems is an impossible task. Organizations need not fear their data, however, because something can always be gleaned from it. And they may have no choice. With the volume of data being generated today, not employing analytics to identify and mitigate fraud and corruption early on can invite devastating problems.

Back to top

Our take: It's time to drive fraud risk management with analytics

The recent COSO guidance reinforces the important role of analytics in clearly understanding the fraud risk an organization may face and taking steps to reduce risk exposure. It is not too late for organizations to leverage analytics as part of their overall fraud risk management program and specifically related to the fraud risk assessment process. By doing so, organizations can better combat the evolving and expanding array of fraud threats.

Back to top