1. Use of Technology (ACL) in Audits

2. Agenda Overview of Generalized Audit Software Overview of Generalized Audit Software How to Get Started How to Get Started Getting Basic File Information Getting Basic File Information Looking for Anomalies Looking for Anomalies Detailed Transaction Analysis Detailed Transaction Analysis Example – Procurement Card Case Study Example – Procurement Card Case Study

3. Overview What does it do? Allows auditors to extract and analyze data independent of programmers and auditees Allows auditors to extract and analyze data independent of programmers and auditees Summarizes large amounts of data Summarizes large amounts of data 100% testing of large populations 100% testing of large populations –Increases probability of detecting errors and omissions –Increases probability of detecting fraud

4. Getting Started Know Your Data! Know where to get it Know where to get it –Platform (PC/mainframe/other) and format –Quantity and extract options –Knowledgeable staff Know what it should look like Know what it should look like –Important fields –Statistical expectations Check key fields for validity Check key fields for validity –Numeric / alphanumeric –Blank / non-blank –Valid codes

5. Get Basic Information Generate summaries and statistics on key fields Generate summaries and statistics on key fields –Record count –Totals and key subtotals –Average, maximum, minimum values Run “overview” reports (Classify, Summarize) Run “overview” reports (Classify, Summarize)

6. Look for Anomalies Exception reports Exception reports Statistical deviance and digital analysis Statistical deviance and digital analysis –Benford’s Law –Rounding of amounts –Even dollar amounts Stuff to Read: www.utexas.edu/admin/audit/files/ Using Audit Tools Case Studies Digital Analysis

7. Look for Anomalies

9. Detailed Transaction Analysis Extract “suspect” records for review Extract “suspect” records for review Select statistically valid sample for review and extract Select statistically valid sample for review and extract

10. ACL Exercises Go to: www.utexas.edu/admin/audit/files/ Download all files. Open CARDUSE.ACL using ACL Workbook and follow instructions in EXERCISES.DOC.

11. Example Procurement Card Fraud Background Fiscal Year 2000 Audit Plan – Spot Check Fiscal Year 2000 Audit Plan – Spot Check Procurement Card Program Fiscal Year 99 Procurement Card Program Fiscal Year 99 Follow up to 1997 audit Follow up to 1997 audit Statistics Statistics –Over 300 departments and 1,680 cards –281,000 transactions (through 5/31/2002) (78,463 in FY01, 63,559 in FY02 through 5/31) –$41.3M ($12.0M in FY01, $9.3M in FY02 through 5/31)

12. Obtaining Data for Analysis Card Data Transaction Data Merchant Classes Accounting/Payment Data Data from Bank of America Data from UT Accounting System Merged Transaction Data File in ACL

13. Data Analysis Using ACL Summaries & Statistics  High volume cardholders  High dollar cardholders  High volume merchants  High dollar merchants Exceptions & Anomalies  Policy violations  Other unusual transactions

14. Created reports based on merchant class code to identify unusual types of purchases International itemsClothing storesPets GasFlowersBicycle shop GiftsCharitiesSchools Equipment RentalCollegesTravel-related Postal ServiceUtilities (including telephone services) InternetGrocery stores TransportationAntiques Policy Violations Type of Purchase

15. Other Policy Violations and Unusual Transactions Transactions over $999.00 limit Transactions over $999.00 limit Split Orders – multiple transactions to single vendor on single day with total amount over $999.00 Split Orders – multiple transactions to single vendor on single day with total amount over $999.00 Even dollar amounts Even dollar amounts Sales tax paid to Texas merchants Sales tax paid to Texas merchants

16. Match Suspect Transactions to Accounting Records Complicated account postings and transfers between accounts Complicated account postings and transfers between accounts Matched dollar amounts and dates using ACL’s Duplicate function to identify movement of funds between accounts Matched dollar amounts and dates using ACL’s Duplicate function to identify movement of funds between accounts Scrutinized electronic routing and approval of electronic payment documents to identify weaknesses in segregation of duties and/or insufficient account/transaction reviews Scrutinized electronic routing and approval of electronic payment documents to identify weaknesses in segregation of duties and/or insufficient account/transaction reviews

17. Initial Investigation n Reviewed Existing Reports n Ran Additional Reports - Single Card Use n Collection of Receipts n Meeting with Principal Investigators n Personnel Actions n Secure Electronic Hardware/ Files/ etc. n Coordination with Police and District Attorney’s Office n Arrest of subject

18. Compilation of Evidence n Problems Card Use (10/97 - 4/00) Card Use (10/97 - 4/00) Transactions: 1,840Transactions: 1,840 Volume: $209,403Volume: $209,403 Post 4/99 Receipts Destroyed (65%) Post 4/99 Receipts Destroyed (65%) Complicated Account Postings Complicated Account Postings Number/Type of Vendors Number/Type of Vendors

19. Compilation of Evidence n Approach 3Document Each Transaction 3Evaluate Source Documents: Original receiptOriginal receipt Receipt copy - On request or by subpoenaReceipt copy - On request or by subpoena Vendor web sites - order history & account infoVendor web sites - order history & account info E-mail purchase & shipping confirmationsE-mail purchase & shipping confirmations

20. Compilation of Evidence n Case I 3Receipts 3Online order history 3Email confirmations 3Returns for credit on personal cards n Case II 3Receipt with forgery 3Online order history 3Email confirmations

21. n Case I - Receipts

23. n Case I – Online Order History

24. n Case I – Email Confirmation

25. n Case I – Returns Order Return Credit

26. n Case II – Receipt With Forgery Forged Receipt

27. n Case II – Receipt With Forgery Actual Receipt Forged Receipt

28. Control Issues Separation of Duties Separation of Duties Sharing of Passwords Sharing of Passwords Account Reconciliations Account Reconciliations Minimal Account Reviews Minimal Account Reviews

29. Corrective Steps n Letters to Deans, Directors, Principal Investigators, etc. n Follow-up Confirmations to Hierarchical Groups n Improvement of Control Structure n On-going Part of Compliance Program

30. Improvement of Control Structure Website Information Website Informationhttp://www.utexas.edu/admin/purchasing/procard/pcardwelcome.html Testing of new cardholders Testing of new cardholdershttp://www.utexas.edu/admin/purchasing/procard/pcardmodule1.html Tightened card use limits Tightened card use limits Review/acknowledge voucher approval Review/acknowledge voucher approval

31. On-going Compliance Activities Inclusion in Compliance Verification System Inclusion in Compliance Verification System Approvals of monthly vouchers Approvals of monthly vouchers Quarterly reviews using ACL Quarterly reviews using ACL

32. Quarterly ACL Reviews Card Use Reports Card Use Reports –Ranks by $ amount –Ranks by # transactions

33. Card Use Summary

34. Quarterly ACL Reviews Card Use Reports Card Use Reports –Ranks by $ amount –Ranks by # transactions Compliance/Miscellaneous Reports Compliance/Miscellaneous Reports –Transactions > $999.00 –Potential Split Orders –Posting delays > 30 days

35. Compliance/Misc. Summary

37. Quarterly ACL Reviews Card Use Reports Card Use Reports –Ranks by $ amount –Ranks by # transactions Compliance/Miscellaneous Reports Compliance/Miscellaneous Reports –Transactions > $999.00 –Potential Split Orders –Posting delays > 30 days College/Department Level Reports College/Department Level Reports

38. Quarterly ACL Reviews Merchant Summary Reports Merchant Summary Reports –High $ Merchants –“Suspect” Merchants –Merchant Types Specific Card Investigations/Watches Specific Card Investigations/Watches

39. Procard Review Procedures Reports Reports Coordination with Other Departments Coordination with Other Departments –Internal Audits –Purchasing –Accounts Payable Follow-up Follow-up