1. Use of ACL in Audits & Investigations Lon S. Heuer, CPA, CIA Associate Vice President for Institutional Compliance and Director, Office of Internal Audits Dyan G. Hudson, CISA Associate Director, Office of Internal Audits

2. Agenda Overview of Generalized Audit Software Overview of Generalized Audit Software How to Get Started How to Get Started Getting Basic File Information Getting Basic File Information Looking for Anomalies Looking for Anomalies Detailed Transaction Analysis Detailed Transaction Analysis Example – Procurement Card Case Study Example – Procurement Card Case Study

3. Overview What does it do? Allows auditors to extract and analyze data independent of programmers and auditees Allows auditors to extract and analyze data independent of programmers and auditees Summarizes large amounts of data Summarizes large amounts of data 100% testing of large populations 100% testing of large populations –Increases probability of detecting errors and omissions –Increases probability of detecting fraud

4. Getting Started Know Your Data! Know where to get it Know where to get it –Platform (PC/mainframe/other) and format –Quantity and extract options –Knowledgeable staff Know what it should look like Know what it should look like –Important fields –Statistical expectations Check key fields for validity Check key fields for validity –Numeric / alphanumeric –Blank / non-blank –Valid codes

5. Getting Started Validity Checks Demo

6. Get Basic Information Generate summaries and statistics on key fields Generate summaries and statistics on key fields –Record count –Totals and key subtotals –Average, maximum, minimum values Run “overview” reports (Classify, Summarize) Run “overview” reports (Classify, Summarize)

7. Get Basic Information Summary statistics demo Overview reports demo

8. Look for Anomalies Exception reports Exception reports Statistical deviance and digital analysis Statistical deviance and digital analysis –Benford’s Law –Rounding of amounts –Even dollar amounts Stuff to Read: www.utexas.edu/admin/audit/files/ Using Audit Tools Case Studies Digital Analysis

9. Look for Anomalies

11. Exception report demo Benford’s analysis demo

12. Detailed Transaction Analysis Extract “suspect” records for review Extract “suspect” records for review Select statistically valid sample for review and extract Select statistically valid sample for review and extract

13. Detailed Transaction Analysis Extract Demo

14. ACL Exercises Go to www.utexas.edu/admin/audit/files/ Download all files. Open CARDUSE.ACL using ACL Workbook and follow instructions in EXERCISES.DOC.

15. Example Procurement Card Fraud Background Fiscal Year 2000 Audit Plan – Spot Check Fiscal Year 2000 Audit Plan – Spot Check Procurement Card Program Fiscal Year 99 Procurement Card Program Fiscal Year 99 Follow up to 1997 audit Follow up to 1997 audit Statistics Statistics –Over 300 departments and 1,680 cards –281,000 transactions (through 5/31/2002) (78,463 in FY01, 63,559 in FY02 through 5/31) –$41.3M ($12.0M in FY01, $9.3M in FY02 through 5/31)

16. Obtaining Data for Analysis Card Data Transaction Data Merchant Classes Accounting/Payment Data Data from Bank of America Data from UT Accounting System Merged Transaction Data File in ACL

17. Data Analysis Using ACL Summaries & Statistics  High volume cardholders  High dollar cardholders  High volume merchants  High dollar merchants Exceptions & Anomalies  Policy violations  Other unusual transactions

18. Created reports based on merchant class code to identify unusual types of purchases International itemsClothing storesPets GasFlowersBicycle shop GiftsCharitiesSchools Equipment RentalCollegesTravel-related Postal ServiceUtilities (including telephone services) InternetGrocery stores TransportationAntiques Policy Violations Type of Purchase

19. Other Policy Violations and Unusual Transactions Transactions over $999.00 limit Transactions over $999.00 limit Split Orders – multiple transactions to single vendor on single day with total amount over $999.00 Split Orders – multiple transactions to single vendor on single day with total amount over $999.00 Even dollar amounts Even dollar amounts Sales tax paid to Texas merchants Sales tax paid to Texas merchants

20. Match Suspect Transactions to Accounting Records Complicated account postings and transfers between accounts Complicated account postings and transfers between accounts Matched dollar amounts and dates using ACL’s Duplicate function to identify movement of funds between accounts Matched dollar amounts and dates using ACL’s Duplicate function to identify movement of funds between accounts Scrutinized electronic routing and approval of electronic payment documents to identify weaknesses in segregation of duties and/or insufficient account/transaction reviews Scrutinized electronic routing and approval of electronic payment documents to identify weaknesses in segregation of duties and/or insufficient account/transaction reviews

21. Initial Investigation n Reviewed Existing Reports n Ran Additional Reports - Single Card Use n Collection of Receipts n Meeting with Principal Investigators n Personnel Actions n Secure Electronic Hardware/ Files/ etc. n Coordination with Police and District Attorney’s Office n Arrest of subject

22. Compilation of Evidence n Problems Card Use (10/97 - 4/00) Card Use (10/97 - 4/00) Transactions: 1,840Transactions: 1,840 Volume: $209,403Volume: $209,403 Post 4/99 Receipts Destroyed (65%) Post 4/99 Receipts Destroyed (65%) Complicated Account Postings Complicated Account Postings Number/Type of Vendors Number/Type of Vendors

23. Compilation of Evidence n Approach 3Document Each Transaction 3Evaluate Source Documents: Original receiptOriginal receipt Receipt copy - On request or by subpoenaReceipt copy - On request or by subpoena Vendor web sites - order history & account infoVendor web sites - order history & account info E-mail purchase & shipping confirmationsE-mail purchase & shipping confirmations

24. Compilation of Evidence n Case I 3Receipts 3Online order history 3Email confirmations 3Returns for credit on personal cards n Case II 3Receipt with forgery 3Online order history 3Email confirmations

25. n Case I - Receipts

27. n Case I – Online Order History

28. n Case I – Email Confirmation

29. n Case I – Returns Order Return Credit

30. n Case II – Receipt With Forgery Forged Receipt

31. n Case II – Receipt With Forgery Actual Receipt Forged Receipt

32. Control Issues Separation of Duties Separation of Duties Sharing of Passwords Sharing of Passwords Account Reconciliations Account Reconciliations Minimal Account Reviews Minimal Account Reviews

33. Corrective Steps n Letters to Deans, Directors, Principal Investigators, etc. n Follow-up Confirmations to Hierarchical Groups n Improvement of Control Structure n On-going Part of Compliance Program

34. Improvement of Control Structure Website Information Website Informationhttp://www.utexas.edu/admin/purchasing/procard/pcardwelcome.html Testing of new cardholders Testing of new cardholdershttp://www.utexas.edu/admin/purchasing/procard/pcardmodule1.html Tightened card use limits Tightened card use limits Review/acknowledge voucher approval Review/acknowledge voucher approval

35. On-going Compliance Activities Inclusion in Compliance Verification System Inclusion in Compliance Verification System Approvals of monthly vouchers Approvals of monthly vouchers Quarterly reviews using ACL Quarterly reviews using ACL

36. Quarterly ACL Reviews Card Use Reports Card Use Reports –Ranks by $ amount –Ranks by # transactions

37. Card Use Summary

38. Quarterly ACL Reviews Card Use Reports Card Use Reports –Ranks by $ amount –Ranks by # transactions Compliance/Miscellaneous Reports Compliance/Miscellaneous Reports –Transactions > $999.00 –Potential Split Orders –Posting delays > 30 days

39. Compliance/Misc. Summary

41. Quarterly ACL Reviews Card Use Reports Card Use Reports –Ranks by $ amount –Ranks by # transactions Compliance/Miscellaneous Reports Compliance/Miscellaneous Reports –Transactions > $999.00 –Potential Split Orders –Posting delays > 30 days College/Department Level Reports College/Department Level Reports

42. Quarterly ACL Reviews Merchant Summary Reports Merchant Summary Reports –High $ Merchants –“Suspect” Merchants –Merchant Types Specific Card Investigations/Watches Specific Card Investigations/Watches

43. Procard Review Procedures Reports Reports Coordination with Other Departments Coordination with Other Departments –Internal Audits –Purchasing –Accounts Payable Follow-up Follow-up

44. Questions? Lon Heuer l.heuer@mail.utexas.edu Dyan Hudson d.hudson@mail.utexas.edu