1. Data Driven Fraud Detection September 16, 2015 Keith L. Jones George Mason University

2. HealthSouth Trial The prosecutor noted that twice during the seven-year fraud, revenues and assets increased even though the number of HealthSouth facilities decreased. “And that’s not a red flag to you?” - Prosecutor Colleen Conry

3. Analytic Procedures: Analytic ProceduresSources of Information Comparison of current-year account balances to those of one or more comparable periods Financial account information for comparable periods. Comparison of the current-year account balances to anticipated results found in the company’s budgets and forecasts. Company budgets and forecasts. Evaluation of the relationships of current- year balances to other current-year balances for conformity with predicable patterns based on the company’s experience. Financial relationships among accounts in the current period (ratios). Comparison of the current-year account balances and ratios with similar industry information. Industry statistics. Study of the relationships of current-year balances with relevant nonfinancial information (e.g., production statistics). Nonfinancial information, such as production statistics.

4. Sustainable?????

5. Background  What are NFMs?  Measures of business activity:  sometimes managerial accounting data  often in 10K, not audited  produced internally and externally  SEC wants you to explain your financial results  NFMs may be less vulnerable to manipulation and/or are more easily verified than financial data (Bell et al. 2005; PCAOB 2007).  Often independent sources or sources outside accounting / finance  Not estimates  Collusion may be required

6. Background  Examples from our study:  Number of employees (Compustat)  Number of retail outlets  Number of patient visits  Square footage of production facilities  Number of products  Number of patents or trademarks

7. Brazel, Jones, Zimbelman (2009) Using Nonfinancial Measures to Assess Fraud Risk - Journal of Accounting Research RQ: If NFMs serve as a good benchmark for the financial statements, do fraud firms exhibit abnormal inconsistencies?

8. Example: Del Global Technologies 1997 Income: Overstated $3.7 million. Revenue: 25% from PY. Employees: 6% (440 to 412) Distribution Dealers: 38% (400 to 250) Fischer Imaging Corp: Revenue: 27% Employees: 20% Distribution Dealers: 7%

9. DIFF = Growth in Revenue – Growth in NFMs Variable N MeanDifference CAPACITY DIFF Fraud Firms 50 0.30 ABNORMAL Competitors 50 0.110.19** EMPLOYEE DIFF Fraud Firms 110 0.20 ABNORMAL Competitors 110 0.04 0.16***

10. Problems  F/S comparative, NFM disclosures for CY only  NFM data scattered in 50-100 page 10-K  What specific NFMs should I look for? What are the benchmarks for my investment/client and industry?  So, using NFMs is too hard and too time consuming (5-6 hours to hand collect per company)  FINRA grants → Create a website/tool to solve problems based on research 10

11. 11

12. 12

13. 13

14. 14

15. ITT EDUCATIONAL SERVICES INC 12/31/200712/31/2008Change Revenues540,953623,8590.153259 Total Assets869,5081,015,3330.16771 NFMs Students53,00062,0000.169811 Full-time employees3,9604,6200.166667 Part-time employees2,9003,9600.365517 States with facilities34370.088235 Degree programs29330.137931 Institutions971050.082474 0.168439 DIFF for Revenue-0.015180142 DIFF for Assets-0.000729512 Low DIFF Example

16. High DIFF Example GREEN MOUNTAIN COFFEE ROASTERS INC 9/27/20089/26/2009Change Revenues500,277803,0450.60520 Total Assets357,648813,8390.56054 NFMs Varieties of coffees and teas200 0 Pounds of coffees held in futures contracts1,162,5001,125,000-0.03226 Places distributed to5,000 0 US patents32330.03125 International patents69730.05797 Pounds of coffee sold in millions32400.25 Stopped disclosing pounds in 2011!! Greenlight /Einhorn0.05116 DIFF for Revenue0.5540402 DIFF for Assets0.509382

17. September 28, 2010 Green Mountain 8-K: SEC inquiry On September 20, 2010, the staff of the SEC’s Division of Enforcement informed the Company that it was conducting an inquiry and made a request for a voluntary production of documents and information. Based on the request, the Company believes the focus of the inquiry concerns certain revenue recognition practices and the Company’s relationship with one of its fulfillment vendors. 17

18. 18 Ex-post: Green Mountain restates 2007-2010 financial statements Class-action litigation alleges illegal insider trading Founder of Green Mountain fired David Einhorn and Greenlight Capital become richer

19. 19 DIFF = Change in Revenue - Average Change in NFMs

20. Future Options 1. Tag Nonfinancial Information 2. Consider requiring a footnote (FASB) or disclosure (SEC) with changes in financial measures (revenues, total assets, etc.) directly alongside changes in relevant NFMs (number of employees, retail outlets, distribution centers, products, etc).

21. Tenet Healthcare -- 2009 10-K (page 48) Admissions, Patient Days and Surgeries 2009 2008 Increase (Decrease) Commercial managed care admissions 133,511 140,030 (4.7)% Governmental managed care admissions 118,129 109,450 7.9% Medicare admissions 156,104 161,493 (3.3)% Medicaid admissions 64,405 64,411 — % Uninsured admissions 23,205 24,039 (3.5)% Charity care admissions 10,435 9,284 12.4% Other admissions 13,601 13,906 (2.2)% Total admissions 519,390 522,613 (0.6)% Paying admissions (excludes charity and uninsured) 485,750 489,290 (0.7)% Total government program admissions 338,638 335,354 1.0% Charity admissions and uninsured admissions 33,640 33,323 1.0% Admissions through emergency department 297,911 293,350 1.6% Commercial managed care admissions as a percentage of total admissions 25.7% 26.8% (1.1)%(1) Emergency department admissions as a percentage of total admissions 57.4% 56.1% 1.3%(1) Uninsured admissions as a percentage of total admissions 4.5% 4.6% (0.1)%(1) Charity admissions as a percentage of total admissions 2.0% 1.8% 0.2%(1) Surgeries – inpatient 152,846 154,268 (0.9)% Surgeries – outpatient 209,294 202,195 3.5% Total surgeries 362,140 356,463 1.6% Patient days – total 2,530,528 2,586,187 (2.2)% Adjusted patient days(2) 3,748,764 3,734,085 0.4% Patient days – commercial managed care 535,345 563,018 (4.9)% Average length of stay (days) 4.9 4.9 — (1) Adjusted patient admissions(2) 774,630 759,976 1.9% Number of general hospitals (at end of period) 48 48 — (1) Licensed beds (at end of period) 13,326 13,287 0.3% Average licensed beds 13,309 13,274 0.3% Utilization of licensed beds(3) 52.1% 53.2% (1.1)%(1)

22. Company is the Victim Conducting a Pro-Active Fraud Audit: A Case Study Albrecht, Albrecht, and Dunn Journal of Forensic Accounting

23. Vendor Fraud Overcharging Providing poor quality Billing more than once Price increases greater than 30% for four years. Work orders and cost overruns >50% $ amount, # and % of good returned to vendor Duplicate invoice numbers Vender with invoices for the same amount on same day Vendors with sequential invoices

24. Employee Fraud Dummy vendors Purchasing goods for personal use Two or more suppliers with same telephone and/or address Compare vendors paid to Dun and Bradstreet listing Contractors with common names – first two letters match and 90% of the name is the same Employee and vender addresses are the same Invoices without purchase orders or purchase orders with zero dollar amounts

25. Vendor/Employee Collusion Kickbacks or other favors Price increases greater than 30% for four years. $ amount, # and % of good returned to vendor Payments without receiving reports Increased volume of purchases by vendor and buyer Combination of increased prices and increased purchases from specific vendors

26. Contractor Fraud Charging more hours than worked Excessive overtime Over-billing Fake employees Rank hours worked by contract employee Rank overtime hours worked per two-week pay periods by contractor and employee Ranking contractors with rising overtime charges Contractors with significant jumps in labor rates Outliers in rates per hour Sort contractor social security numbers by ascending numbers.

27. Contractor Fraud Charging more hours than worked Excessive overtime Over-billing Fake employees Rank hours worked by contract employee Rank overtime hours worked per two-week pay periods by contractor and employee Ranking contractors with rising overtime charges Contractors with significant jumps in labor rates Outliers in rates per hour Sort contractor social security numbers by ascending numbers.

28. Findings at Refinery The refinery was rejecting over 50 % of goods received from three vendors, due to poor quality. Two were small, but one represented a purchase relationship with one of the refinery’s largest vendors. Six invoices were all found for the same amounts from the same vendor on the same day – all for $1,044,000. Three invoices from the same vendor, on the same day, for the same items, each for $900,000 One company had increased prices 581,700 percent and another that had increased prices during the four-year period by 331,879 percent. In total, there were 35 companies that had raised prices over 1,000 percent and 202 companies that had raised prices over 100 percent.

29. Findings at Refinery Six employees had the same addresses as vendors. There were 20 purchases over $100,000 where the quantity paid for was greater than the quantity received. From one vendor, the company paid $56,201 for items with unit prices of 19 cents and 12 cents each. The company did not need anywhere near this volume of these items.

30. Findings at Refinery There were four contractors whose employees were reported to have worked over 150 hours for over 20 consecutive 2-week pay periods. Employees of one company were submitting time cards from different locations for the same time periods. There was one contractor where employees had an average of 2,046 hours of overtime for the year. In examining the average rate per craft by company and employee, per-hour charges ranged from $56.11 to $15.43 per hour for the same craft.

31. Findings at Refinery There were seven companies whose invoices exceeded purchase order amounts by over $100,000. The largest difference was $713,791 on an original invoice of $21,621. Searching for vendors with sequential invoices revealed 19 vendors where over 50 percent of all invoices submitted were sequential. With one vendor, over 83 percent of the invoices submitted were sequential. There were three companies from which goods had been purchased with zero amount purchase orders. With all three companies, there were over 100 zero amount invoices. There were nine contractors with cost over-runs exceeding 50% and $100,000. The highest percentage cost over-run was 2431%

32. Thank You