07 Data Analysis and Reporting Tools

Question 1

Understanding the data, determining whether predication exists, and building a profile of potential frauds are all steps of which phase of the data analysis process?

A. The post-analysis phase
B. The testing and interpretation phase
C. The preparation phase
D. The planning phase

Answer 1

D. The planning phase

As with most tasks, proper planning is essential in a data analysis engagement. Without sufficient time and attention devoted to planning early on, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, running into avoidable technical difficulties, and possibly overlooking key areas for exploration.
The first phase of the data analysis process is the planning phase. This phase consists of several important steps, including:
* Understanding the data
* Defining examination objectives
* Building a profile of potential frauds
* Determining whether predication exists

Question 2

During which phase of the data analysis process does the fraud examiner identify, obtain, and verify the relevant or requested data?

A. The planning phase
B. The preparation phase
C. The post-analysis phase
D. The testing and interpretation phase

Answer 2

B. The preparation phase

The second phase of the data analysis process is the preparation phase. The results of a data analysis test will only be as good as the data used for the analysis. Thus, before running tests on the data, the fraud examiner must make certain the data being analyzed are relevant and reliable for the objective of the engagement. During the preparation phase of the data analysis process, the fraud examiner must complete several important steps, including:
* Identifying the relevant data
* Obtaining the requested data
* Verifying the data
* Cleansing and normalizing the data

Question 3

Which of the following is a limitation of Benford’s Law?

A. Benford’s Law cannot be applied to data sets with non-natural numbers, such as check or invoice numbers.
B. Benford’s Law only works on data sets with assigned numbers, such as bank account or telephone numbers.
C. Benford’s Law applies best to data sets with three-digit numbers.
D. Benford’s Law can only be applied to data sets listed in currency amounts.

Answer 3

A. Benford’s Law cannot be applied to data sets with non-natural numbers, such as check or invoice numbers.

Benford’s Law distinguishes between natural and non-natural numbers, and it is important to understand the difference between the two types because Benford’s Law cannot be applied to data sets with non-natural numbers. Natural numbers are those numbers that are not ordered in a particular numbering scheme and are not human-generated or generated from a random number system. For example, most vendor invoice totals will be populated by currency values that are natural numbers. Conversely, non-natural numbers (e.g., employee identification numbers and telephone numbers) are designed systematically to convey information that restricts the natural nature of the number. Any number that is arbitrarily determined, such as the price of inventory held for sale, is considered a non-natural number.

Question 4

Which of the following functions does a Benford’s Law analysis help to achieve?
A. Measuring the relationship between items on financial statements by expressing accounts as percentages
B. Extracting usable information from unstructured text data
C. Identifying fictitious numbers
D. Identifying duplicate payments

Answer 4

C. Identifying fictitious numbers

The goal of a Benford’s Law analysis is to identify fictitious numbers. Benford’s Law provides that the distribution of the digits in multi-digit natural numbers is not random; instead, it follows a predictable pattern. That is, Benford’s Law maintains that certain digits show up more than others do when dealing with natural numbers. A “1” appears as the first non-zero digit roughly 30 percent of the time; “2” is the leading digit almost 18 percent of the time; and “9” leads off only 4.6 percent of the time. Moreover, “0” is most likely to be the second digit, appearing 12 percent of the time.
Many fraudsters fail to consider the Benford’s Law pattern when creating false documentation or transactions to cover their tracks. Consequently, testing data sets for the occurrence or non-occurrence of the predictable digit distribution can help identify included numbers that are not legitimate.

Question 5

Why do fraud examiners perform textual analytics?
A. To reveal patterns, sentiments, and relationships indicative of fraud
B. To gauge the pressures/incentives, opportunities, and rationalizations to commit fraud
C. To uncover warning signs of potentially fraudulent employee behavior
D. All of the above

Answer 5

D. All of the above

Textual analytics is a method of using software to extract usable information from unstructured text data. Through the application of linguistic technologies and statistical techniques—including weighted fraud indicators (e.g., fraud keywords) and scoring algorithms—textual analytics software can categorize data to reveal patterns, sentiments, and relationships indicative of fraud. For example, an analysis of email communications might help fraud examiners to gauge the pressures/incentives, opportunities, and rationalizations to commit fraud that exist in an organization. Textual analytics provides the ability to uncover additional warning signs of potentially fraudulent employee behavior.
Depending on the type of fraud risk present in a fraud examiner’s investigation, he will want to come up with a list of fraud keywords that are likely to point to suspicious activity. This list will depend on the industry, fraud schemes, and the data set the fraud examiner has available. In other words, if he is running a search through journal entry details, he will likely search for different fraud keywords than if he were running a search of emails. Additionally, it can be helpful to consider the three factors identified in the Fraud Triangle when coming up with a keyword list.

Question 6

Which of the following data analysis functions can be used to determine the relationship between two variables in raw data?

A. Benford’s Law analysis
B. Correlation analysis
C. Duplicate testing
D. Gap testing

Answer 6

B. Correlation analysis

Using the correlation analysis function, fraud examiners can determine the relationships among different variables in the raw data. Fraud examiners can learn a lot about data files by learning the relationship between two variables. For example, we should expect a strong correlation between the following independent and dependent variables because a direct relationship exists between the two variables. Hotel costs should increase as the number of days traveled increases. Gallons of paint used should increase as the number of houses painted increases.

Question 7

Black, a fraud examiner, is conducting textual analytics on emails sent to and from specific employees that his client has identified as fraud suspects. He is using the Fraud Triangle to come up with a list of fraud keywords to use in his search. Which of the following words found in email text might indicate a fraudster is rationalizing his actions?

A. Quota
B. Override
C. Deserve
D. Write off

Answer 7

C. Deserve

In conducting a textual analytics examination, the fraud examiner should come up with a list of fraud keywords that are likely to point to suspicious activity. This list will depend on the industry, the suspected fraud schemes or types of fraud risk present, and the data set the fraud examiner has available. In other words, if he is running a search through journal entry details, he will likely search for different fraud keywords than if he were running a search of emails.
The factors identified in the Fraud Triangle are helpful when coming up with a fraud keyword list. One of these factors is rationalization; consequently, the fraud examiner should consider how someone in the entity might be able to rationalize committing fraud. Because most fraudsters do not have a criminal background, justifying their actions is a key part of committing fraud. Some keywords that might indicate a fraudster is rationalizing his actions include reasonable, deserve, andtemporary.
Other keywords can be used to identify the other factors indicated by the Fraud Triangle. For example, write off and override would indicate opportunity to commit fraud, while quota suggests pressure to commit fraud.

Question 8

Scott, a fraud examiner, is concerned that employees are abusing their expense accounts and are spending more than the $30 per day allowed for meals. Which of the following is the most appropriate data analysis function for locating meal expenses greater than $30?

A. Compliance verification
B. Multi-file processing
C. Duplicate search
D. Gap testing

Answer 8

A. Compliance verification

Compliance verification determines whether company policies are met by employee transactions. If a company limits the amount of its reimbursements, the software can check to see that this limit is being observed. Many times, fraud examiners can find early indications of fraud by testing detail data for values above or below specified amounts. For example, when employees are out of town, do they adhere to company policy of spending no more than $30 per day for meals? To start, fraud examiners can look at all expense report data and select those with daily meal expenses exceeding $30. With the information returned from this simple query, there is a starting point for suspecting fraud.

Question 9

Which of the following is a data analysis tool that is effective in identifying indirect relationships and relationships with several degrees of separation?

A. Link analysis
B. Word maps
C. Geospatial analysis
D. Tree maps

Answer 9

A. Link analysis

Link analysis software is used by fraud examiners to create visual representations (e.g., charts with lines showing connections) of data from multiple data sources to track the movement of money; demonstrate complex networks; and discover communications, patterns, trends, and relationships.
Link analysis is very effective for identifying indirect relationships and relationships with several degrees of separation. For this reason, link analysis is particularly useful when conducting a money laundering investigation, since it can track the placement, layering, and integration of money as it moves around unexpected sources. It could also be used to detect a fictitious vendor (shell company) scheme. For instance, the investigator could map visual connections between a variety of entities that share an address and bank account number to reveal a fictitious vendor created to embezzle funds from a company.

Question 10

Which of the following data analysis functions is most useful in testing for hidden journal entries?
A. Identifying duplicates
B. Statistical sampling
C. Gap testing
D. Aging analysis

Answer 10

C. Gap testing

Gap testing is used to identify missing items in a sequence or series, such as missing checks or invoice numbers. It can also be used to find sequences where none are expected to exist (e.g., employee government identification numbers). In reviewing journal entries, gaps might signal possible hidden entries.

Question 11

A fraud examiner is conducting textual analytics on journal entry data and runs a keyword search using the terms override, write off, and reserve/provision. With which leg of the Fraud Triangle are these fraud keywords typically associated?

A. Opportunity
B. Capability
C. Pressure
D. Rationalization

Answer 11

A. Opportunity

In conducting a textual analytics examination, the fraud examiner should come up with a list of fraud keywords that are likely to point to suspicious activity. This list will depend on the industry, the suspected fraud schemes or types of fraud risk present, and the data set the fraud examiner has available. In other words, if he is running a search through journal entry details, he will likely search for different fraud keywords than if he were running a search of emails.
The factors identified in the Fraud Triangle are helpful when coming up with a fraud keyword list. One of these factors is opportunity; consequently, the fraud examiner should consider how someone in the entity might have the opportunity to commit fraud. Examples of keywords that indicate the opportunity to commit fraud includeoverride, write off, recognize revenue, adjust, discount, and reserve/provision.

Question 12

Which of the following is an example of a data analysis function that can be performed to help detect fraud through examination of payroll accounts?

A. Compare customer credit limits and current or past balances.
B. Identify paycheck amounts over a certain limit.
C. Generate depreciation to asset cost reports.
D. Compare approved vendors to the cash disbursement payee list.

Answer 12

B. Identify paycheck amounts over a certain limit.

The following are examples of data analysis queries that can be performed by data analysis software on payroll accounts to help detect fraud:
* Summarize payroll activity by specific criteria for review.
* Identify changes to payroll or employee files.
* Compare timecard and payroll rates for possible discrepancies.
* Prepare check amount reports for amounts over a certain limit.
* Check proper supervisory authorization on payroll disbursements.

Question 13

In data analysis, date fields are generally not a problem when importing and exporting data because standard formats are always used.

A. True
B. False

Answer 13

B. False

When conducting data analysis, the fraud examiner must consider the data format and structure. This consideration is important when the fraud examiner wishes to import or export data with his computer. A date can be formatted into a number of different styles, such as mm/dd/yyyy. The structure of the data will also be important, along with the extension. A text file will have a .txt extension associated with it. In what format is the current data? What format will the computer require? How does the fraud examiner get the data from here to there if the data formats and structures are different?

Question 14

Which of the following is TRUE regarding textual analytics?

A. Textual analytics is used to figure out whether someone is lying or telling the truth based on context clues.
B. Textual analytics can be used to categorize data to reveal patterns, sentiments, and relationships indicative of fraud.
C. The purpose of performing textual analytics is to search for and find an admission of fraud that can be presented in court.
D. There is a universal list of fraud keywords to use when implementing textual analytics that is applicable to any fraud examination.

Answer 14

B. Textual analytics can be used to categorize data to reveal patterns, sentiments, and relationships indicative of fraud.

Textual analytics is a method of using software to extract usable information from unstructured text data. Through the application of linguistic technologies and statistical techniques—including weighted fraud indicators (e.g., fraud keywords) and scoring algorithms—textual analytics software can categorize data to reveal patterns, sentiments, and relationships indicative of fraud. For example, an analysis of email communications might help fraud examiners to gauge the pressures/incentives, opportunities, and rationalizations to commit fraud that exist in an organization. Textual analytics provides the ability to uncover additional warning signs of potentially fraudulent employee behavior.
Depending on the type of fraud risk present in a fraud examiner’s investigation, he will want to come up with a list of fraud keywords that are likely to point to suspicious activity. This list will depend on the industry, fraud schemes, and the data set the fraud examiner has available. In other words, if he is running a search through journal entry details, he will likely search for different fraud keywords than if he were running a search of emails. It might be helpful to look at the Fraud Triangle when coming up with a keyword list. Additionally, it can be helpful to consider the three factors identified in the Fraud Triangle when coming up with a keyword list.

Question 15

Which of the following steps is included in the planning phase of the data analysis process?

A. Defining examination objectives
B. Determining whether predication exists
C. Building a profile of potential frauds
D. All of the above

Answer 15

D. All of the above

As with most tasks, proper planning is essential in a data analysis engagement. Without sufficient time and attention devoted to planning early on, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, running into avoidable technical difficulties, and possibly overlooking key areas for exploration.
The first phase of the data analysis process is the planning phase. This phase consists of several important steps, including:
* Understanding the data
* Defining examination objectives
* Building a profile of potential frauds
* Determining whether predication exists

Question 16

All of the following are advantages to using data analysis software EXCEPT:
A. Fraud examiners can use data analysis software to produce accurate results from bad data.
B. Fraud examiners can use data analysis software to search for red flags of possible fraud.
C. Fraud examiners can use data analysis software to ensure that an investigation is accurate and complete.
D. Fraud examiners can use data analysis software to centralize fraud investigations.

Answer 16

A. Fraud examiners can use data analysis software to produce accurate results from bad data.

There are five significant advantages to using data analysis software. First, data analysis software allows the fraud examiner to centralize an investigation, relying less on others to gather data. Second, data analysis software allows the fraud examiner to ensure that an investigation is accurate and complete. Third, data analysis allows the fraud examiner to base predictions about the probability of a fraudulent situation on reliable statistical information. Fourth, data analysis allows the fraud examiner to search entire data files for red flags of possible fraud. Finally, data analysis can assist the fraud examiner in developing reference files for ongoing fraud detection and investigation work.

Question 17

Which of the following is an example of a data analysis function that can be performed on cash disbursements to help detect fraud?

A. Generate vendor cash activity summary for further analysis
B. Identify disbursements by department, supervisor approval, or amount limits
C. Verify audit trail for all disbursements by purchase order, vendor, department, etc.
D. All of the above

Answer 17

D. All of the above

The following are examples of data analysis queries that can be performed by data analysis software on cash disbursements to help detect fraud:
* Summarize cash disbursements by account, bank, department, vendor, etc.
* Verify audit trail for all disbursements by purchase order, vendor, department, etc.
* Generate vendor cash activity summary for analysis.
* Identify disbursements by department, supervisor approval, or amount limits.

Question 18

Link analysis can be used to visually map connections between entities that share an address.

A. True
B. False

Answer 18

A. True

Link analysis software is used by fraud examiners to create visual representations (e.g., charts with lines showing connections) of data from multiple data sources to track the movement of money; demonstrate complex networks; and discover communications, patterns, trends, and relationships.
Link analysis is very effective for identifying indirect relationships and relationships with several degrees of separation. For this reason, link analysis is particularly useful when conducting a money laundering investigation, since it can track the placement, layering, and integration of money as it moves around unexpected sources. It could also be used to detect a fictitious vendor (shell company) scheme. For instance, the investigator could map visual connections between a variety of entities that share an address and bank account number to reveal a fictitious vendor created to embezzle funds from a company.

Question 19

Text-based data is typically considered:

A. Narrative data
B. Structured data
C. Unstructured data
D. Documentary data

Answer 19

C. Unstructured data

Data are either structured or unstructured. Structured data is the type of data found in a database, consisting of recognizable and predictable structures. Examples of structured data include sales records, payment or expense details, and financial reports. Unstructured data, by contrast, is data that would not be found in a traditional spreadsheet or database. It is typically text based.

Question 20

For the purpose of a Benford’s Law analysis, an employee identification number would be considered a “natural number.”

A. True
B. False

Answer 20

B. False

Benford’s Law distinguishes between natural and non-natural numbers, and it is important to understand the difference between the two types because Benford’s Law cannot be applied to data sets with non-natural numbers. Natural numbers are those numbers that are not ordered in a particular numbering scheme and are not human-generated or generated from a random number system. For example, most vendor invoice totals will be populated by currency values that are natural numbers. Conversely, non-natural numbers (e.g., employee identification numbers and telephone numbers) are designed systematically to convey information that restricts the natural nature of the number. Any number that is arbitrarily determined, such as the price of inventory held for sale, is considered a non-natural number.

Question 21

On which of the following data fields would a fraud examiner be most likely to run a duplicate test to search for a duplicate value?

A. Inventory counts
B. Product numbers
C. Customer account balances
D. Invoice numbers

Answer 21

D. Invoice numbers

Duplicate testing is used to identify transactions with duplicate values in specified fields. This technique can quickly review the file, or several files joined together, to highlight duplicate values of key fields. In many systems, the key fields should contain only unique values (no duplicate records).
For example, a fraud examiner would expect fields such as check numbers, invoice numbers, and government identification numbers to contain only unique values within a data set; searching for duplicates within these fields can help the fraud examiner find anomalies that merit further examination.

Question 22

Which of the following is an example of a data analysis function that can be performed to detect fraud through an examination of the general ledger?
A. Create actual-to-budget comparison reports
B. Calculate financial ratios
C. Analyze and confirm specific ledger accounts for legitimate transaction activity
D. All of the above

Answer 22

D. All of the above

The following are typical examples of data analysis queries that can be performed by data analysis software on the general ledger:
* Select specific journal entries for analysis.
* Create actual-to-budget comparison reports.
* Analyze and confirm specific ledger accounts for legitimate transaction activity.
* Speed account reconciliation through specialized account queries.
* Calculate financial ratios.
* Calculate percentage comparison ratio between accounts.
* Prepare custom reports, cash flow, profit/loss, and asset and liability total reports.
* Compare summaries by major account in any order (low-high, high-low).
* Create reports in any format by account, division, department, etc.

Question 23

Karen is undertaking a data analysis engagement to identify potential fraud at XYZ Corporation. Which of the following lists the most appropriate order in which she should conduct the steps involved in the data analysis process?
I. Cleanse and normalize the data.
II. Build a profile of potential frauds.
III. Analyze the data.
IV. Obtain the data.
V. Monitor the data.

A. II, IV, III, I, V
B. IV, II, I, V, III
C. IV, I, III, V, II
D. II, IV, I, III, V

Answer 23

D. II, IV, I, III, V

To ensure the most accurate and meaningful results, a formal data analysis process should be applied that begins several steps before the tests are run and concludes with active and ongoing review of the data. While the specific process will vary based on the realities and needs of the organization, the following approach contains steps that should be considered and implemented, to the appropriate extent, in each data analysis engagement:
1. Planning phase
* Understand the data.
* Define examination objectives.
* Build a profile of potential frauds.
* Determine whether predication exists.
2. Preparation phase
* Identify the relevant data.
* Obtain the data.
* Verify the data.
* Cleanse and normalize the data.
3. Testing and interpretation phase
* Analyze the data.
4. Post-analysis phase
* Respond to the analysis findings.
* Monitor the data.

Question 24

Which of the following is an example of a data analysis function that can be performed to help detect fraud through examination of asset accounts?

A. Compare book and tax depreciation and indicate variances
B. Select samples for asset existence verification
C. Recalculate expense and reserve amounts using replacement costs
D. All of the above

Answer 24

D. All of the above

The following are examples of data analysis queries that can be performed by data analysis software on asset accounts to help detect fraud:
* Generate depreciation to cost reports.
* Compare book and tax depreciation and indicate variances.
* Sort asset values by asset type or monetary amount.
* Select samples for asset existence verification.
* Recalculate expense and reserve/provision amounts using replacement costs.

Question 25

Why would a fraud examiner perform duplicate testing on data? A. To determine the relationship among different variables in raw data B. To identify transactions with matching values in the same field C. To determine whether company policies are met by employee transactions D. To identify missing items in a sequence or series

Answer 25

B. To identify transactions with matching values in the same field ## Footnote Duplicate testing is used to identify transactions with duplicate values in specified fields. This technique can quickly review the file, or several files joined together, to highlight duplicate values of key fields. In many systems, the key fields should contain only unique values (no duplicate records). For example, a fraud examiner would expect fields such as check numbers, invoice numbers, and government identification numbers to contain only unique values within a data set; searching for duplicates within these fields can help the fraud examiner find anomalies that merit further examination.

Question 26

Which of the following statements is TRUE regarding data mining? A. Data mining is the science of searching large volumes of data for patterns B. Data mining is an effective way for fraud examiners to develop fraud targets for further investigation C. Data mining can be used to streamline raw data into understandable patterns D. All of the above

Answer 26

D. All of the above ## Footnote Data mining is the science of searching large volumes of data for patterns. It combines several different techniques essential to detecting fraud, including the streamlining of raw data into understandable patterns. Data mining can also help prevent fraud. Additionally, it is an effective way for fraud examiners to develop fraud targets for further investigation.

Question 27

Lee manages a house painting company. He notices paint expenses have increased substantially from the prior year, which is unexpected because the company had much less business this year and painted fewer houses. Which of the following data analysis functions would be the most useful in helping Lee determine the relationship between paint expense and houses painted? A. Correlation analysis B. Benford's Law analysis C. Verifying multiples of a number D. Stratification

Answer 27

A. Correlation analysis ## Footnote Using the correlation analysis function, fraud examiners can determine the relationships among different variables in the raw data. Fraud examiners can learn a lot about data files by learning the relationship between two variables. For example, we should expect a strong correlation between the following independent and dependent variables because a direct relationship exists between the two variables. Hotel costs should increase as the number of days traveled increases. Gallons of paint used should increase as the number of houses painted increases.

Question 28

Cleansing and normalizing data during a data analysis engagement includes reviewing data to ensure that any inconsistencies are fixed, isolated, or eliminated. A. True B. False

Answer 28

A. True ## Footnote The results of a data analysis test will only be as good as the data used for the analysis. Thus, before running tests on the data, the fraud examiner must make certain the data being analyzed are relevant and reliable for the objective of the engagement. The phrase “garbage in, garbage out” is applicable in the preparation phase. Depending on how the data was collected and processed, as well as the results of the data verification process, the fraud examiner might need to cleanse and convert the data to a format suitable for analysis before executing any data analysis tests. For example, certain field formats (e.g., date, time, or currency) might need to be modified to make the information consistent and ready for testing. The data must also be normalized so that all data being imported for analysis can be analyzed consistently. Common data fields from multiple systems must be identified, and data must be standardized. In normalizing the data for analysis, table layout, fields/records, data length, data format, and table relationships are all important considerations. Additionally, the following inconsistencies in the data must be addressed: * Known errors * Special/unreadable characters in the data * Other unusable entries When possible, such situations should be addressed by fixing, isolating, or eliminating them. Any issues that cannot be cleaned up will require special consideration during the testing and interpretation phase.

Question 29

A fraud examiner is conducting textual analytics on journal entry data and runs a keyword search using the terms deadline, quota, and trouble. With which leg of the Fraud Triangle are these fraud keywords typically associated? A. Rationalization B. Pressure C. Opportunity D. Capability

Answer 29

B. Pressure ## Footnote In conducting a textual analytics examination, the fraud examiner should come up with a list of fraud keywords that are likely to point to suspicious activity. This list will depend on the industry, the suspected fraud schemes or types of fraud risk present, and the data set the fraud examiner has available. In other words, if he is running a search through journal entry details, he will likely search for different fraud keywords than if he were running a search of emails. The factors identified in the Fraud Triangle are helpful when coming up with a fraud keyword list. One of these factors is pressure; consequently, the fraud examiner should consider how someone in the entity might be under pressure to commit fraud. For example, many people commit fraud because of something that has happened in their life that motivates them to steal. Maybe they find themselves in debt, or perhaps they must meet a certain goal to qualify for a performance-based bonus. Keywords that might indicate pressure include deadline, quota, trouble, short, problem, and concern.

Question 30

A fraud examiner is planning a data analysis engagement. Which of the following should the fraud examiner understand prior to determining which tests to run on the data? A. What data is available for analysis B. Areas of data at risk for being overlooked C. The structure of the data D. All of the above

Answer 30

D. All of the above ## Footnote Although the purpose of data analysis involves running targeted tests on data to identify anomalies, the ability of such tests to help detect fraud depends greatly on what the fraud examiner does before and after actually performing the data analysis techniques. Without sufficient time and attention devoted to planning early on, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, running into avoidable technical difficulties, and possibly overlooking key areas for exploration. As a first step in the planning process—long before determining which tests to run—the fraud examiner must know what data is available to be analyzed and how that data is structured. Understanding the structure of the existing data will not only help ensure that the fraud examiner builds workable tests to be run on the data, but might also help identify additional areas for exploration that might otherwise have been overlooked.

Question 31

Which of the following is a core data analysis function that can be performed with most data analysis software applications? A. Joining files B. Duplicate searches C. Sorting D. All of the above

Answer 31

D. All of the above ## Footnote Computers can scan database information for several specific types of information, creating a red flag system. To perform this, most software packages use a combination of different functions. These functions are: * Sorting * Record selection * Joining files * Multi-file processing * Correlation analysis * Verifying multiples of a number * Compliance verification * Duplicate searches * Expressions and equations * Filter and display criteria * Fuzzy logic matching * Gap tests * Pivot tables * Regression analysis * Sort and index * Statistical analysis * Stratification * Date functions * Benford's Law analysis * Graphing

Question 32

Link analysis is particularly useful when investigating which type of fraud scheme? A. Money laundering B. Fictitious vendor C. Shell company D. All of the above

Answer 32

D. All of the above ## Footnote Link analysis software is used by fraud examiners to create visual representations (e.g., charts with lines showing connections) of data from multiple data sources to track the movement of money; demonstrate complex networks; and discover communications, patterns, trends, and relationships. Link analysis is very effective for identifying indirect relationships and relationships with several degrees of separation. For this reason, link analysis is particularly useful when conducting a money laundering investigation, since it can track the placement, layering, and integration of money as it moves around unexpected sources. It could also be used to detect a fictitious vendor (shell company) scheme. For instance, the investigator could map visual connections between a variety of entities that share an address and bank account number to reveal a fictitious vendor created to embezzle funds from a company.

Question 33

Understanding the structure and availability of existing data during a data analysis engagement helps to ensure that the fraud examiner can build workable tests to run on it. A. True B. False

Answer 33

A. True ## Footnote Although the purpose of data analysis involves running targeted tests on data to identify anomalies, the ability of such tests to help detect fraud depends greatly on what the fraud examiner does before and after actually performing the data analysis techniques. Without sufficient time and attention devoted to planning early on, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, running into avoidable technical difficulties, and possibly overlooking key areas for exploration. As a first step in the planning process—long before determining which tests to run—the fraud examiner must know what data is available to be analyzed and how that data is structured. Understanding the structure of the existing data will not only help ensure that the fraud examiner builds workable tests to be run on the data, but might also help identify additional areas for exploration that might otherwise have been overlooked.

Question 34

Suppose you suspect there is a ghost employee scheme taking place in your organization and you want to compare the payroll records to the employee master file. Which data analysis technique would you use to match these two data records? A. Compliance verification B. Correlation analysis C. Gap testing D. The join function

Answer 34

D. The join function ## Footnote The join function gathers the specified parts of different data files. Joining files combines fields from two sorted input files into a third file. Join is used to match data in a transaction file with records in a master file, such as matching invoice data in an accounts receivable file to a master cluster. For example, you might need to compare two different files to find differing records between them.

Question 35

A fraud examiner is preparing for a data analysis engagement. Why might the fraud examiner cleanse and normalize data prior to testing it? A. To ensure that the data is in a structured format B. To ensure that the data can be analyzed consistently C. To ensure that any known errors in the data are addressed D. All of the above

Answer 35

D. All of the above ## Footnote The results of a data analysis test will only be as good as the data used for the analysis. Thus, before running tests on the data, the fraud examiner must make certain the data being analyzed are relevant and reliable for the objective of the engagement. The phrase “garbage in, garbage out” is applicable in the preparation phase. Depending on how the data was collected and processed, as well as the results of the data verification process, the fraud examiner might need to cleanse and convert the data to a format suitable for analysis before executing any data analysis tests. For example, certain field formats (e.g., date, time, or currency) might need to be modified to make the information consistent and ready for testing. The data must also be normalized so that all data being imported for analysis can be analyzed consistently. Common data fields from multiple systems must be identified, and data must be standardized. In normalizing the data for analysis, table layout, fields/records, data length, data format, and table relationships are all important considerations. Additionally, the following inconsistencies in the data must be addressed: * Known errors * Special/unreadable characters in the data * Other unusable entries When possible, such situations should be addressed by fixing, isolating, or eliminating them. Any issues that cannot be cleaned up will require special consideration during the testing and interpretation phase.

Question 36

Which of the following steps takes place during the preparation phase of a data analysis engagement? A. Defining examination objectives B. Determining whether predication exists C. Cleansing and normalizing the data D. Building a profile of potential frauds

Answer 36

C. Cleansing and normalizing the data ## Footnote Defining the examination objectives, determining whether predication exists, and building a profile of potential frauds are all steps of the planning phase of the data analysis process, which is the first phase that should be undertaken. The second phase of the data analysis process is the preparation phase. The results of a data analysis test will only be as good as the data used for the analysis. Thus, before running tests on the data, the fraud examiner must make certain the data being analyzed are relevant and reliable for the objective of the engagement. During the preparation phase of the data analysis process, the fraud examiner must complete several important steps, including: * Identifying the relevant data * Obtaining the requested data * Verifying the data * Cleansing and normalizing the data

Question 37

_____________ is a method of using software to extract usable information from unstructured data. A. The Fog Index B. Benford’s Law C. Linguistic analytics D. Textual analytics

Answer 37

D. Textual analytics ## Footnote Textual analytics is a method of using software to extract usable information from unstructured text data. Through the application of linguistic technologies and statistical techniques—including weighted fraud indicators (e.g., fraud keywords) and scoring algorithms—textual analytics software can categorize data to reveal patterns, sentiments, and relationships indicative of fraud. For example, an analysis of email communications might help fraud examiners to gauge the pressures/incentives, opportunities, and rationalizations to commit fraud that exist in an organization.

Question 38

When conducting a data analysis engagement to detect fraud, it is important to build a profile of potential frauds before identifying, obtaining, and analyzing the data. A. True B. False

Answer 38

A. True ## Footnote To maximize the potential success of detecting fraud through data analysis, the analysis performed should be based on an understanding of the entity’s existing fraud risks. To do so, the fraud examiner must first build a profile of potential frauds by identifying the organization’s risk areas, the types of frauds possible in those risk areas, and the resulting exposure to those frauds. Using the profile of potential frauds as a guide, the fraud examiner must identify the target data for analysis. Specifically, for each specific fraud scenario assessed to be a high risk to the organization, the fraud examiner should determine which data fields and records would be affected by such a scheme. The fraud examiner must then identify the logistics involved with obtaining this information, including: * What specific data (i.e., fields, records) is available * Who generates and maintains the data * Where the data is stored * Timing of the data extraction (e.g., date range, cutoff dates/times) * How the fraud examiner will receive and store the data (i.e., data format and storage/transfer mechanism) * Control totals needed for verification * How to validate the sources of data

Question 39

________ is a data analysis software function that allows users to relate several files by defining relationships in collected data, without the use of the join command. A. Verifying multiples of a number B. Record selection C. Multi-file processing D. Correlation analysis

Answer 39

C. Multi-file processing ## Footnote Multi-file processing allows the user to relate several files by defining relationships between multiple files, without the use of the join command. A common data relationship would be to relate an outstanding invoice master file to an accounts receivable file based on the customer number. The relationship can be further extended to include an invoice detail file based on invoice number. This relationship will allow the user to see which customers have outstanding invoices sorted by date.

Question 40

Which of the following is NOT an example of a data analysis function that can be performed to detect fraud through examination of accounts payable? A. Summarize large invoices by amount and vendor. B. Review recurring monthly expenses and compare to posted/paid invoices. C. Identify debits to expense accounts outside of set default accounts. D. Sort asset values by asset type or monetary amount.

Answer 40

D. Sort asset values by asset type or monetary amount. ## Footnote The following are typical examples of data analysis queries that can be performed by data analysis software on accounts payable: * Audit paid invoices for manual comparison with actual invoices. * Summarize large invoices by amount, vendor, etc. * Identify debits to expense accounts outside of set default accounts. * Reconcile check registers to disbursements by vendor invoice. * Verify vendor tax forms (e.g., U.S. Form 1099 or Value Added Tax (VAT) forms). * Create vendor detail and summary analysis reports. * Review recurring monthly expenses and compare to posted/paid invoices. * Generate a report on specified vouchers for manual audit or investigation.