Preventing Fraud in

Government & Industry

Solving Complex Government Problems
Using Financial Intelligence

Dave Gilles, Deloitte Financial Advisory Services LLP

Kari Crowley, Deloitte Financial Advisory Services LLP
Brandt Heatherington, Solutions Marketing Manager, i2 Group
October 13, 2010

Agenda
Welcome and introductions
Housekeeping notes
David Giles & Kari Crowley, Deloitte
The Money Trail
Brandt Heatherington, i2 Group
Intelligence-led fraud investigations and the
i2 Fraud Solution

The Money Trail

Analyzing your financial data intelligently can help your organization identify
trends, patterns and unique anomalies. These findings may be instructive
when considering how best to maximize your organizations mission. The
findings may also be illuminating when things go wrong. In the end, following
the money is often the fastest way to your answer.
Today we will touch on:

What types of benefits can be realized by following the money?

How can the discipline of financial intelligence help identify an organizations

opportunities and vulnerabilities?

What types of tools and techniques are used to derive intelligence from financial
data?

Going forward, how does one implement an effective program and control
environment designed to prevent, detect, and deter fraud and other illicit acts?

Current events
Regulators Shut 2 Failed
Banks in Illinois
CHARLOTTE, N.C. -- Regulators on Friday shut down
two more banks, boosting the number of federally
insured bank failures this year to 36.
The latest banks seized were Strategic Capital Bank and
Citizens National bank, both in Illinois. The Federal
Deposit Insurance Corp. will continue to insure regular
deposit accounts of up to $250,000 at both banks.

Charities Look for Ways to Reduce

Overhead
WASHINGTON Some 37% of nonprofits with private contributions of
$50,000 or more in 2000 reported no
fundraising or special event costs, the
study found. Eighteen percent of nonprofits that raised $5 million or more
reported no such costs. Such a high
percentage of non-profits with zero
fundraising costs is implausible, the
study's authors said, because it usually
takes money to raise money.

The Illinois Department of Financial and Professional

Regulation's banking division took over Strategic Capital
Bank, based in Champaign, Ill., while the Office of the
Comptroller of the Currency took control of Citizens
National Bank, based in Macomb, Ill. The FDIC was
appointed receiver of both banks.

The heightened focus on fundraising

and administrative costs may
discourage organizations from spending
money on things that could make the
charity more effective, says Patrick
Rooney, director of research at the
Center on Philanthropy. Non-profits deal
with "the most intractable problems
society faces," he says. "They need
good staff and accounting systems.
They also need roofs that don't leak and
computers that don't crash."

Follow the money: Whats involved?

Financial intelligence generally uses advanced accounting skills, high-end
data analytics, tested business acumen and proven investigative
methodologies. Following the money greatly enhances an organizations
ability to identify a wide spectrum of actionable anomalies.

Financial intelligence techniques allow organizations to connect the dots through the
generation of new information and the enrichment of existing data.

Following the money is often the best tool for finding ways to maximize operational
processes and, when things go wrong, can be an effective method of uncovering
evidence of illicit activities.

Finding Efficiencies

National Budget

Full spectrum approach

Eliminate Redundancies
Identify Savings
Uncover Fraud

Healthcare Spending
Improved Claims Process
Standardized Cost Structure

During this time of constrained budgets and underperforming markets, the public and private sectors alike are
looking for ways to maximize their missions with fewer
resources.

Fraud and Waste Identified

Disaster Relief
Fraud and Waste Identified
Timely Delivery of
Medical Supplies
Quality of Relief Supplies

When Things Go Wrong

Tax Evasion
Trust Schemes
Unreported Income
Hidden Assets

Terrorist Financing
State Sponsorship
False Charities
Weapons Purchases

Whether its finding wasteful spending in a government

program, criminal manipulation of benefit systems or even
modeling the financial backing of a terrorist group,
following the money plays a part.

Finding Efficiencies

National Budget

Example: Terrorist financing

Improved Claims Process

Standardized Cost Structure
Fraud and Waste Identified

Healthcare Spending
Improved Claims Process
Standardized Cost Structure
Fraud and Waste Identified

Disaster Relief
Fraud and Waste Identified
Timely Delivery of
Medical Supplies
Quality of Relief Supplies

When Things Go Wrong

Tax Evasion
Trust Schemes
Unreported Income
Hidden Assets

Terrorist Financing
State Sponsorship
False Charities
Weapons Purchases

Rogue regimes, transnational criminals, illegal armed groups, violent

extremists and terrorist organizations all have one common element - money:
the need for, involvement in, and the importance of finances as the lifeblood
of their operations and, consequently, the livelihood of their ideology. In the
end, our Nations adversaries, both large and small, should be seen as
organized businesses focused on raising, moving, safeguarding and
expending money for the purposes of prosecuting their attacks on the USs
national security interests.

Money Trail:
Investigative Techniques

What do forensic accountants look for?

OPPORTUNITY
Absence valid business purpose

Round trip transactions

Management override

Improper asset classification

Benfords Law
Improper revenue recognition

Unusual relationships
Excessive rights of return

Misapplication of accounting principles

Types of Fraud
Reserve manipulation

Fraudulent Reporting

Discrepancies in records

Misappropriation of Assets
Channel stuffing

Side letters

Corrupt Business Practices

Conflicting records
Fictitious sales
Improper expense
capitalization
Revenue recognition

Holding the
quarter open
INCENTIVE/PRESSURE
Source: Fraud triangle was developed by Dr. Donald Cressey in 1950s

RATIONALIZATION

Data analytics and forensic technology

Analytic and forensic technologies enable the Follow the Money process
Data analytics is a key part of all financial analysis. This most frequently involves
analyzing voluminous amounts of electronic records such as: transactional data, bank
records, contracts, insurance claims, inventory logs, sales records, stock trades, etc. By
using data analytics one can:
Scenario:
Your agencys vendor payment
system has been improperly
accessed and there is a
possibility that fraudulent
payment orders have been
created. You need to analyze
thousands of payments, do due
diligence on vendor files and
trace payment flows to their
recipients to determine how
bad things are and you need
to do it fast.

Locate, scope, acquire, mine, test, and normalize data in

support of anomaly detection and fraud investigations

Filter and analyze massive transactional data sets using

business rules thus producing a focused set of anomalies

Produce predictive analytics and human network maps

Create analytic and statistical trending insights regarding

your company or, in the case of the military, your
adversary.

Background investigations
From 50,000 feet to Full Body Scan
Data Source
Level 1

Level 2

PEP/Sanction list
Adverse media

Includes Level 1 research

Identify website/media profile
D&B and other business reports
Corporate registry checks (to
identify shareholders and
directors
Bankruptcy-civil litigation
Criminal records (to the extent
available)

Level 3
Includes Level 1 and 2 research
Discreet source inquiries

Considerations
Number of subjects

Subjects business activities

Subjects contact with
government officials
Known or prior allegations

Jurisdictional risk (CPI score)/

Industry risk
Country-specific common
schemes
Project deadline
Discreet or open?

i2 - Analysts notebook: Chart A

Position on chart

DIRECTOR, VICE CHAIRMAN

MARTIN, JOSEPH R.

[s001]

ACME TRANSPORTATION GROUP [UAE]

Registered in: UAE
Reg. #: 434443

DIRECTOR [s544]

DBA
[s119]
ISLAND FUNDS

ISLAND CAPITAL FUNDING L.P.

Sanctions: OFAC (December 2008) [s433]

DBA
[s120]
I.C. PARTNERS

DBA
[s121]
I.C.F. GROUP

Focus areas

i2 - Link analysis: Chart B

i2 analysis
APEX IS FORMER OWNER (1998-2008)

CURRENT OWNER

[s505]

[s303]

APEX TRUCKING [UAE]

Sanctions: OFAC (February 2010) [s234]

Registered in: UAE

Reg. #: 434443

VIN#: 888222FFFW3434
Plate: 773 AAA, CURRENT PLATE [s303]
Plate: 992 BBF, 1998 - 2007 [s304]
Country: UNITED KINGDOM [s303]

NO. 8 CLARK HOLDINGS LIMITED

Registered in: UNITED KINGDOM
Reg. #: AFR 775141

STEEL IS
LIMITED PARTNER
[s847]

APEX IS LIMITED PARTNER OF STEEL

[s663]

THE STEEL GROUP LIMITED

Registered in: UNITED KINGDOM
Reg. #: 34344DE

CLARK ASSET MANAGEMENT IS

GENERAL PARTNER
[s223]

CLARK ASSET MANAGEMENT

Registered in: UNITED KINGDOM
Reg. #: 555899FFE

NO. 8 CLARK
ADMINISTRATORS
IS GENERAL PARTNER
[s547]

APEX IS SOLE SHAREHOLDER

[s277]

TRADING STYLE OF APEX

APEX [UAE] IS SHAREHOLDER, 100%
[s055] [s105]

APEX AUSTRALIA LTD.

Registered in: AUSTRALIA
Reg. #: 342342322

CLARK IS SOLE
SHAREHOLDER
[s564]

NO. 8 CLARK ADMINISTRATORS LIMITED

Registered in: UNITED KINGDOM
Reg. #: TRF 32433

Where does the trail lead us?

Following the Money helps us learn about new trends and new key players.
Looking at the past gives us great insight into the future:
Patterns tend to repeat
New schemes start somewhereusually as a modification or an improvement
of past behavior.
Key players groom new people to take over their fraudulent schemes.
Previously identified fringe subjects become the new epicenter of activity

Geographies that once seemed remote or anomalous can become a new

investigative focus

Prevent, Detect, Deter

Compliance: Potential risk areas

Economic
sanctions

Corruption

Money laundering

Integrity and
reputation

Fraud

Risk assessment

Identify high-risk businesses, clients , transactions and individuals

Clients, agents,
intermediaries

Assess high-risk clients, partners and agents / Evaluate related controls

Government clients

High-risk populations

High-risk populations

Principals and executives

Fraud Risk
Assessment

Agents and Consultants

Agents / Intermediaries

Customer due diligence

KYC Program

Undisclosed interests

Business partners

Intermediaries

Independent sanctions
screening

Enhanced due diligence

Litigation / Reputation

Client / Customer fraud

Transactions and
monitoring

Transaction monitoring and testing / Evaluate related controls

FCPA monitoring

Sanctions screening

AML transaction
monitoring systems

Related parties

Fraud monitoring

Gifts / Entertainment

Transaction authority
and controls

Suspicious / Cash
transaction reporting

Business partners

Financial controls

Vendors / Third Parties

Escalations and
regulatory disclosures

Escalations and
regulatory disclosures

Undisclosed relationships

Agents / Intermediaries

Compliance
culture

Evaluate compliance communications, training and awareness

Assessments and
testing

Assess internal audit and regulatory examination reports

Copyright 2009 Deloitte Development LLC. All rights reserved.

Corruption
Objective

Identify companies at risk for FCPA violations in increasingly aggressive enforcement environment due to ineffective compliance
programs and controls.
Identify strategic/equity investors exposed to potential successor liability claims for failure to perform adequate FCPA due diligence.

Key Risk Areas

Foreign government sales and touch points

Use of agents and intermediaries
Operations in high-risk countries (e.g., China, Russia)

Due
Diligence
Approach

Potential Impact

Risk assessment to identify:

Government agencies and customers
Employees, agents, consultants, vendors
Payments to government

Analysis of customers / sales processes

Marketing and sales processes, including distributors
or resellers
Use of consultants / third parties

Corrupt payments can subject a company to criminal and

civil fines and exposure (mitigated by strong compliance
program)
Corrupt payments that may require adjustment of deal
pricing/economics:
Exit of clients, business segments or intermediary
relationships
Legal and investigative costs

State-owned/-controlled customer base

Local anti-corruption laws
Sales behaviors and culture

Transaction testing and documentation

Assessment of consultant agreements
Keyword searches
Payments and expenses analysis
Interrogation of relevant general ledger accounts
FCPA Analytics Proprietary FCPA transaction testing too
Background investigations

Pre-acquisition violations required to be disclosed to DOJ

Cooperation with government investigations
Robust remedial actions and compliance programs going
forward

Copyright 2009 Deloitte Development LLC. All rights reserved.

Money laundering
Objective

Identify vulnerabilities in business operations that expose the risk that funds are being used to facilitate money laundering
Conducting enhanced due diligence on high risk clients as part of business as usual practices as well as forensic transactional and
KYC lookbacks.

Key Risk Areas

Operations in high-risk jurisdictions (e.g., countries not

applying FATF standards, offshore tax havens, etc.)
High-risk industries: gaming, financial and money services
businesses, real estate agencies, precious metals/stones
High risk individuals such as Politically Exposed Persons
(PEPs)
Vendors and joint venture partners

Cash intensive businesses

Products that can be monetized easily (e.g., consumer
electronics, vehicles)
Company formation agents and professional services providers.
Stored value cards, payments processors, money services
businesses, etc.
Trade finance and corresponding banking transactions

Due
Diligence
Approach

Identification of high-risk clients, products/services,

geographies and distribution channels

Analysis of high-risk customers (including their KYC

profile and transactional patterns), products and services
and operations:
Identify high-risk customer segments
Independent screening and assessment especially in the
context of economic and trade sanctions (e.g. OFAC)

Transaction testing and documentation

Assessment of high-risk clients, intermediaries and
transactions
Review of documentation and agreements
Assessment of controls around payments and money laundering
prevention

Potential Impact

Money laundering, sanctions compliance and terrorist

financing exposes your organization to potential criminal
and civil liability as well as reputational injury
Changes to business operations to mitigate risk of money
laundering

Identification of additional controls to be implemented for high

risk clients and products
Estimates of remedial costs to protect the business going
forward.

Copyright 2009 Deloitte Development LLC. All rights reserved.

Fraud
Objective

Incorporate fraud risk factors and schemes in corporate risk assessments to capture factors that may directly impact operations,
transactions, etc.
Link risk assessments across the organization regardless of focus (e.g.., Fraud, Operational, Anti-Corruption risk assessments)
Establish and update understanding of business relationships within and external to the company
Be prepared to address fraud events when they occur

Key Risk Areas

Various statutory and regulatory guidance

Domestic
International
Size, locations, and nature of subsidiaries and external
relationships

Industry
Quality/integrity of management and employees tone at the
top
Private vs. public company requirements

Due
Diligence
Approach

Fraud risk assessment to identify

Fraud risk factors
Specific fraud schemes/scenarios
Scenario assessment:
Likelihood of occurrence and magnitude of impact
Link schemes and scenarios to mitigating controls
Analyze identified fraud risks and evaluate mitigating
controls
Evaluate residual fraud risk
Action plan to address residual risk

Align fraud risk assessment with all other risk assessments

conducted by the enterprise
Create and evaluate fraud response management protocol
Conduct regular due diligence on business partners
Leverage human resources as a fraud risk mitigation control

More effective business operations

Avoid delays in regulatory approval
Identification of compliance and control matters before
resulting in potential losses
Expanded diligence across multiple locations for large
deals if fraud risk factors identified saves time and cost
to deal

Savings in deal cost due to issues identified early on

Perception/reputation maintained or increased
Savings in audit/compliance costs

Potential Impact

Copyright 2009 Deloitte Development LLC. All rights reserved.

Illustrative examples
Risk Area / Diligence Finding

Impact

Outcome

Suspect payments to consultants

identified and linked to acquisition
of government related business

Significant investigation and remediation

costs
Long term loss of large client
relationships
Disclosures to Department of Justice and
other regulatory bodies

Purchase price reduced by $200

million
Investigation /remedial costs in the
range of $10 million

Weaknesses in private banking

unit know your customer and
economic sanctions screening
procedures and controls
Large client population from high
risk jurisdiction for economic and
trade sanctions and corruption
(PEPs)

Recommended remediation of private

banking unit clients to acquirers KYC
standards.
Expected exit of certain private banking
client relationships
Significant efforts required to integrate
and update sanctions screening
technology

Discounted future maintainable

earnings of private banking unit by
5%
Identification of $3 million required
remedial and integration related
compliance costs.

Principal has undisclosed business

relationship with competing entities

Principals associated with target had

moved to re-direct client relationships to
competing entities.
Research identified significant integrity
and jurisdiction/sector-specific risk issues

Acquirer abandoned pursuit of

target

Corruption
Economic and trade sanctions
Integrity and reputation
Money laundering
Fraud

Copyright 2009 Deloitte Development LLC. All rights reserved.

The importance of effective compliance:

Programs and internal controls

Tone at the top

Comprehensive training
Due diligence procedures for business partners and acquisition targets
Readily available resources
Good communication channels
Methods for employees to report violations
Periodic reviews/audits
Penalties for non-compliance

Key takeaways
Following the money can be an effective way to identify both
opportunities and risks.
As evidenced by the recent legislation, the Federal government and
private sector alike recognize that identifying and eliminating improper
payments and fraud is imperative to an organizations fiscal health.
Advanced technologies and algorithms are important tools in the effort
to detect and deter illicit financial activity.
Recent investigations and enforcement actions by DOJ and the SEC
demonstrate an intensifying focus on white collar crime, including
actions against individuals
Invest in risk assessment, compliance, prevention and detection
Know your business partner!

i2 Fraud Solution
Capture, management & analysis of intelligence

Fraud landscape and challenges

$2.9 Trillion lost to fraud globally (5% of revenue)*
Large volumes of disparate data
A variety of mediums to connect to e.g. human intelligence, paper
trails, etc
Hidden in complex layers of transactional data
Lack of time to collate information
Rapidly shifting environment
Diverse perpetrators
Sophisticated tools and methods
Secure information sharing
All data searchable and accessible

Technology-enhanced investigative workflow

Analysis and Visualisation

Fraud Visual Analytic Output Examples

Fraud network mapping

Fraud risk heat maps

Cyber fraud
IP analysis

Transaction timeline
mapping

Intelligence from World-Class i2 Partners

World-Check
Portland Risk
NCFTA
Spamhaus
Maxmind

i2 Fraud Analytical Capabilities

Rapidly search multiple internal or external data sources
simultaneously including peer-to-peer networks
Pool data in common investigative platform to identify entities,
relationships, patterns and timelines
Advanced push/pull data sharing allows sharing of intelligence
across work groups in near-real-time
Detect fraud in multiple mediums: Cyber/internet, electronic
networks, telecom networks and more

i2 Fraud Solves Business Challenges

Rich extraction, analysis and visualization capabilities
Sophisticated analytical database for managing and
analyzing large volumes of multi-source data
Advanced push/pull data sharing allows analysts and
investigators to share evidence and analytic results in
near-real-time
End-users can design intelligence templates to suit their
data and workflow specialized IT skills not required
Augments existing infrastructure, does not replace it
Rapid deployment and low startup and total cost of
ownership

Save Money & Increase Productivity

i2 tools offer powerful, comprehensive and rapid
investigation
Fusion of complex data in a centralized environment
i2 data correlation and visual analysis solutions reduce
expenditure of capital and allow for faster closure of
cases, more efficient deployment of human resources
i2 analysis charts for fraud cases are the industry
standard in law enforcement, legal and prosecutorial
arenas
Over 400,000 users globally
Support, maintenance and updates are seamless

Key Commercial Clients

Sectors include:
Telecoms
Financial Institutions
Insurance
Legal firms
Pharmaceutical
Retail
And many more

Fraud Case Studies

Case Study: Fraudulent Insurance Claims

Challenge:

An increase in the number of fraudulent mobile insurance claims from new FIU

In-house single point claims system could not cross-reference data sets which required manual
analysis of data involving millions of records.

How to differentiate between legitimate and fraudulent claims?

Solution:

Create a centralised intelligence repository by importing data from legacy systems.

Integrate 3rd party data to enhance intelligence.

Search historical data to find hidden suspect patterns.

Map and cross reference all data sets to show hidden fraud by individual and organised rings.

Allow analysts to concentrate on fraud detection by providing near time results.

Result:

Instant connection of 5,000 fraud alerts to over 100,000 customers and 1500 individuals connected
to false claims and organized fraud rings

ID repeat claim submissions from known fraudsters changing minor details

Proactively terminated policies before further claims could be made

50% increase in fraud detection with 150,000 savings

Card Protection Plan

Within five months of utilising i2 software, the fraud investigation unit has seen
an approximate 50% increase in fraud detection, equating to roughly 150,000 in
savings for both CPP and its customers.

"Upon utilizing i2 products, we revealed far more useful intelligence that allowed
us to not only detect more fraud, but more importantly, we were able to stop it.

"One of my main concerns when purchasing an intelligence system was cost and
after sales support, both of which have been outstanding with i2."

Case #2: ATM Fraud

Canadian Imperial Commerce Bank
Challenge:
One of Big 5 Canadian banks experienced persistent ATM fraud from hacked
machines
Stolen data being used at banks and point-of-sale
High frequency and geographic dispersal made trending difficult without advanced
data correlation
Solution:
Imported all data for ABM/POS (automated banking machines / point of sale devices)
relating to hacked
Established parameters for frequency of fraud based on number of data stolen
events in a month period
Compared to banks and locations of devices where stolen data was used
Result:
Established trends for fraudulent use and notified law enforcement of likely times /
places to apprehend fraudsters

Case #3: Internet Credit Card Fraud

DCPJ/OCLCTIC (France)
Challenge:

GIE (French economic interest group for bank cards) alerted to 44,700 payment authorizations
over three days for test authorization amounts ($1 to $2) on a US e-commerce website involving
25,548 stolen credit card numbers

13,274 use authorizations were granted

Fraudulent use began several days later and banks were alerted when victims disputed the
charges
Solution:

IP addresses, domains and bank information involved with the suspicious transactions were
loaded into a central analysis pool. This covered several years of bank data involving 25,000,000
records

Connected domain names to registrants

One fraudulent site alone in this ring was responsible for almost $300,000 or 192,000

Small amounts at a time were low risk but high yield

Links are established using IP addresses, emails, pseudonyms, bank cards and addresses
Result:

One principal group of 1233 members is identified as well as 27 sub groups and organized
criminality established

Case #4: Auto Insurance Fraud

Top 5 US Auto Insurance Company
Challenge:

A major US insurance company was presented with a suspicious $250,000 claim for a stolen
Ferrari

Company analyst had only 30 days to investigate the claim

Solution:

Public records search on owner and link other individuals

Link uncovered to auto export company

Link uncovered to previous claims related to same company

Suspicious of fraud, analyst checks US customs to discover that the car was exported several
weeks prior to claim

Tracked car to Italy and procured service records signed for by a female lawyer who initially
connected claimant to the export company

Further analysis proves the lawyer to be the claimants wife using a different last name

Once requested to be deposed, claimant flees the country

Result:

Claim denied and law enforcement alerted

Case #5: Procurement Fraud

SRA International / US Army

During the Iraq War, manual tracking and billing processes made it easy for some
military personnel and local contractors to fraudulently bill the government
Without much of the data in electronic format, it was difficult to pinpoint relationships
between people and places
A contractor was hired to enter the data and trace the patterns
Data was complicated and transactions were global and carefully hidden
Through use of data correlation and visualization tools, intricate relationships were
discovered which illustrated who was taking bribes, what units were involved, and to
whom illegal contracts were being awarded
Visualization enabled comparison of legal and illegal operations and exposed how
illegal activities were hidden
Created solid evidence and open-and-shut cases
Out of 3 years of investigation only one case went to trial
Over $80M USD recovered thus far; $80M total expected

Fraud Resources
Need more info on fraud? Visit www.i2group.com and click on
Fraud under Solutions

Need help evaluating your fraud readiness?

Take our free no-obligation Fraud Assessment at:
www.i2group.com/fraudsurvey
Want to schedule a 1:1 meeting with an i2 Analysts Notebook
Fraud Expert? Email us at sales@i2group.com

Questions & Answers

This presentation contains general information only and is based on the experiences and
research of Deloitte practitioners. Deloitte is not, by means of this presentation, rendering
business, financial, investment, or other professional advice or services. This presentation is not a
substitute for such professional advice or services, nor should it be used as a basis for any
decision or action that may affect your business. Before making any decision or taking any action
that may affect your business, you should consult a qualified professional advisor. Deloitte, its
affiliates, and related entities shall not be responsible for any loss sustained by any person who
relies on this presentation.