Adopting a Risk-based, Data Driven Approach to Travel and Expense Gordon Rule, Stanford University

The Problem Limited resources for reviewing No ability to systematically review based on award type (Federal, Grant, Univ. funds) No ability to review un-structured text (OCR) Reviewing off rules created last century No true strategies and analytics

The Solution Partnered with FICO to implement a “Risk Based” approach to reduce manual intensive processes and identify fraud, waste, and abuse. We looked at everything in a new way and light. Couldn’t create the same system and expect different results. Started with Travel and Expense and expanded to entire procure to pay for University.

Flipping the Script - A “Risk vs. Rules Based” Approach T&E Reimbursement P-Cards Procurement (Req & PO) Invoices (Ext./Int billing) Internal Audit A Modular Approach Generally limited to T&E Reimbursement Traditional T&E Reviews & Audits Risk Based Management of T&E: Monitoring across Procure to Pay cycle Focused on Policy Compliance (e.g. Travel & reimbursement guidelines) Risk-based approach focusing on High Risk Areas first High volumes of Low-risk transactions Manageable Volumes of High-risk transactions Sponsored award monies (Fed) not differentiated during review Solution highlights sponsored dollars enabling risk-based review

Risk Based Components High Risk / Dollar Areas Risk Based Focus Area Compliance Risks (e.g. HIPAA, Data security/Privacy, PCI, Minors, DEA) Contractual Language, tracking & visibility PO Leakage Consultants, biologicals, software licenses, cloud accounts Funding sources – Unallowable Costs Fed vs. Non-Fed Spend, Grant T’s & C’s Excessive Travel & Non-business related Reimbursement Flagging abusers vs. one time, modest policy exceptions Risk Mitigation / Cost Savings Manual Review Rates / Costs

Approved, Rejected, Sent Back for Additional Work How does it work? Source Systems ERP Approved, Rejected, Sent Back for Additional Work Travel/ Expense Transaction Stored Case Generated (if applicable) Database Transaction/ Case Discovery Strategies, Rules, & Analytic Model(s) Procurement Reports Data Transformation (JSON) P-Card Case Review & Disposition

P2P Summary Results – Likely Results The Results P2P Summary Results – Likely Results Example University #1 Duplicate payments - $250k PO Spend – T&E, P-card ($60M) After the Fact PO (~$100M) Low-dollar, high-risk PO (100s) Example University #2 Duplicate payments - $150k PO Spend – T&E, P-card ($7M) After the fact PO ($2.3M) Circumvent University Procurement function Lack of price/cost analysis Lack of support for federal award sourcing decisions Non-competitive contracts Collusion with suppliers University incurs unnecessary expense (e.g. overpayments, dups) Addressable P2P Risks