Data Driven Fraud Detection September 16, 2015 Keith L. Jones George Mason University

HealthSouth Trial The prosecutor noted that twice during the seven-year fraud, revenues and assets increased even though the number of HealthSouth facilities decreased. “And that’s not a red flag to you?” - Prosecutor Colleen Conry

Analytic Procedures: Analytic ProceduresSources of Information Comparison of current-year account balances to those of one or more comparable periods Financial account information for comparable periods. Comparison of the current-year account balances to anticipated results found in the company’s budgets and forecasts. Company budgets and forecasts. Evaluation of the relationships of current- year balances to other current-year balances for conformity with predicable patterns based on the company’s experience. Financial relationships among accounts in the current period (ratios). Comparison of the current-year account balances and ratios with similar industry information. Industry statistics. Study of the relationships of current-year balances with relevant nonfinancial information (e.g., production statistics). Nonfinancial information, such as production statistics.

Sustainable?????

Background  What are NFMs?  Measures of business activity:  sometimes managerial accounting data  often in 10K, not audited  produced internally and externally  SEC wants you to explain your financial results  NFMs may be less vulnerable to manipulation and/or are more easily verified than financial data (Bell et al. 2005; PCAOB 2007).  Often independent sources or sources outside accounting / finance  Not estimates  Collusion may be required

Background  Examples from our study:  Number of employees (Compustat)  Number of retail outlets  Number of patient visits  Square footage of production facilities  Number of products  Number of patents or trademarks

Brazel, Jones, Zimbelman (2009) Using Nonfinancial Measures to Assess Fraud Risk - Journal of Accounting Research RQ: If NFMs serve as a good benchmark for the financial statements, do fraud firms exhibit abnormal inconsistencies?

Example: Del Global Technologies 1997 Income: Overstated $3.7 million. Revenue: 25% from PY. Employees: 6% (440 to 412) Distribution Dealers: 38% (400 to 250) Fischer Imaging Corp: Revenue: 27% Employees: 20% Distribution Dealers: 7%

DIFF = Growth in Revenue – Growth in NFMs Variable N MeanDifference CAPACITY DIFF Fraud Firms ABNORMAL Competitors ** EMPLOYEE DIFF Fraud Firms ABNORMAL Competitors ***

Problems  F/S comparative, NFM disclosures for CY only  NFM data scattered in page 10-K  What specific NFMs should I look for? What are the benchmarks for my investment/client and industry?  So, using NFMs is too hard and too time consuming (5-6 hours to hand collect per company)  FINRA grants → Create a website/tool to solve problems based on research 10

11

12

13

14

ITT EDUCATIONAL SERVICES INC 12/31/200712/31/2008Change Revenues540,953623, Total Assets869,5081,015, NFMs Students53,00062, Full-time employees3,9604, Part-time employees2,9003, States with facilities Degree programs Institutions DIFF for Revenue DIFF for Assets Low DIFF Example

High DIFF Example GREEN MOUNTAIN COFFEE ROASTERS INC 9/27/20089/26/2009Change Revenues500,277803, Total Assets357,648813, NFMs Varieties of coffees and teas200 0 Pounds of coffees held in futures contracts1,162,5001,125, Places distributed to5,000 0 US patents International patents Pounds of coffee sold in millions Stopped disclosing pounds in 2011!! Greenlight /Einhorn DIFF for Revenue DIFF for Assets

September 28, 2010 Green Mountain 8-K: SEC inquiry On September 20, 2010, the staff of the SEC’s Division of Enforcement informed the Company that it was conducting an inquiry and made a request for a voluntary production of documents and information. Based on the request, the Company believes the focus of the inquiry concerns certain revenue recognition practices and the Company’s relationship with one of its fulfillment vendors. 17

18 Ex-post: Green Mountain restates financial statements Class-action litigation alleges illegal insider trading Founder of Green Mountain fired David Einhorn and Greenlight Capital become richer

19 DIFF = Change in Revenue - Average Change in NFMs

Future Options 1. Tag Nonfinancial Information 2. Consider requiring a footnote (FASB) or disclosure (SEC) with changes in financial measures (revenues, total assets, etc.) directly alongside changes in relevant NFMs (number of employees, retail outlets, distribution centers, products, etc).

Tenet Healthcare K (page 48) Admissions, Patient Days and Surgeries Increase (Decrease) Commercial managed care admissions 133, ,030 (4.7)% Governmental managed care admissions 118, , % Medicare admissions 156, ,493 (3.3)% Medicaid admissions 64,405 64,411 — % Uninsured admissions 23,205 24,039 (3.5)% Charity care admissions 10,435 9, % Other admissions 13,601 13,906 (2.2)% Total admissions 519, ,613 (0.6)% Paying admissions (excludes charity and uninsured) 485, ,290 (0.7)% Total government program admissions 338, , % Charity admissions and uninsured admissions 33,640 33, % Admissions through emergency department 297, , % Commercial managed care admissions as a percentage of total admissions 25.7% 26.8% (1.1)%(1) Emergency department admissions as a percentage of total admissions 57.4% 56.1% 1.3%(1) Uninsured admissions as a percentage of total admissions 4.5% 4.6% (0.1)%(1) Charity admissions as a percentage of total admissions 2.0% 1.8% 0.2%(1) Surgeries – inpatient 152, ,268 (0.9)% Surgeries – outpatient 209, , % Total surgeries 362, , % Patient days – total 2,530,528 2,586,187 (2.2)% Adjusted patient days(2) 3,748,764 3,734, % Patient days – commercial managed care 535, ,018 (4.9)% Average length of stay (days) — (1) Adjusted patient admissions(2) 774, , % Number of general hospitals (at end of period) — (1) Licensed beds (at end of period) 13,326 13, % Average licensed beds 13,309 13, % Utilization of licensed beds(3) 52.1% 53.2% (1.1)%(1)

Company is the Victim Conducting a Pro-Active Fraud Audit: A Case Study Albrecht, Albrecht, and Dunn Journal of Forensic Accounting

Vendor Fraud Overcharging Providing poor quality Billing more than once Price increases greater than 30% for four years. Work orders and cost overruns >50% $ amount, # and % of good returned to vendor Duplicate invoice numbers Vender with invoices for the same amount on same day Vendors with sequential invoices

Employee Fraud Dummy vendors Purchasing goods for personal use Two or more suppliers with same telephone and/or address Compare vendors paid to Dun and Bradstreet listing Contractors with common names – first two letters match and 90% of the name is the same Employee and vender addresses are the same Invoices without purchase orders or purchase orders with zero dollar amounts

Vendor/Employee Collusion Kickbacks or other favors Price increases greater than 30% for four years. $ amount, # and % of good returned to vendor Payments without receiving reports Increased volume of purchases by vendor and buyer Combination of increased prices and increased purchases from specific vendors

Contractor Fraud Charging more hours than worked Excessive overtime Over-billing Fake employees Rank hours worked by contract employee Rank overtime hours worked per two-week pay periods by contractor and employee Ranking contractors with rising overtime charges Contractors with significant jumps in labor rates Outliers in rates per hour Sort contractor social security numbers by ascending numbers.

Contractor Fraud Charging more hours than worked Excessive overtime Over-billing Fake employees Rank hours worked by contract employee Rank overtime hours worked per two-week pay periods by contractor and employee Ranking contractors with rising overtime charges Contractors with significant jumps in labor rates Outliers in rates per hour Sort contractor social security numbers by ascending numbers.

Findings at Refinery The refinery was rejecting over 50 % of goods received from three vendors, due to poor quality. Two were small, but one represented a purchase relationship with one of the refinery’s largest vendors. Six invoices were all found for the same amounts from the same vendor on the same day – all for $1,044,000. Three invoices from the same vendor, on the same day, for the same items, each for $900,000 One company had increased prices 581,700 percent and another that had increased prices during the four-year period by 331,879 percent. In total, there were 35 companies that had raised prices over 1,000 percent and 202 companies that had raised prices over 100 percent.

Findings at Refinery Six employees had the same addresses as vendors. There were 20 purchases over $100,000 where the quantity paid for was greater than the quantity received. From one vendor, the company paid $56,201 for items with unit prices of 19 cents and 12 cents each. The company did not need anywhere near this volume of these items.

Findings at Refinery There were four contractors whose employees were reported to have worked over 150 hours for over 20 consecutive 2-week pay periods. Employees of one company were submitting time cards from different locations for the same time periods. There was one contractor where employees had an average of 2,046 hours of overtime for the year. In examining the average rate per craft by company and employee, per-hour charges ranged from $56.11 to $15.43 per hour for the same craft.

Findings at Refinery There were seven companies whose invoices exceeded purchase order amounts by over $100,000. The largest difference was $713,791 on an original invoice of $21,621. Searching for vendors with sequential invoices revealed 19 vendors where over 50 percent of all invoices submitted were sequential. With one vendor, over 83 percent of the invoices submitted were sequential. There were three companies from which goods had been purchased with zero amount purchase orders. With all three companies, there were over 100 zero amount invoices. There were nine contractors with cost over-runs exceeding 50% and $100,000. The highest percentage cost over-run was 2431%

Thank You