Episode 66: Data Sleuth® Standard Analyses 2
As a continuation to data processing and comparative analysis, Rachel and Leah discuss more of the analyses and tools used to help clients find the needle in the data haystack. In this episode, they discuss:
Source and Use Summary Analysis
Interesting Data Findings Analysis
Risk Indicator Analysis
The information in today's podcast is just a glimpse of what's inside Leah's new book—Data Sleuth: Using Data in Forensic Accounting Engagements and Fraud Investigations—available today! Available anywhere you buy books and on Amazon!
Rachel Organist is the Data Analytics Manager at Workman Forensics. Originally trained as a geologist, Rachel uses her unique scientific reasoning expertise and analytical aptitude to undertake financial investigations. Read her full bio on the Workman Forensics team page.
PROMOTION MENTIONED IN TODAY’S EPISODE
Register at https://podcastpromo.datasleuthbook.com/ to win your free copy of Data Sleuth| Using Data in Forensic Accounting Engagements and Fraud Investigations.
RESOURCES MENTIONED IN TODAY’S EPISODE
Order Leah's new book Data Sleuth on Amazon.
CONNECT WITH WORKMAN FORENSICS
Connect with Workman Forensics
Youtube: @WorkmanForensics
Facebook: @wforensics
Twitter: @wforensics
Instagram: @wforensics
LinkedIn: @workmanforensics
Subscribe and listen to this and more episodes of The Investigation Game onApple Podcasts,Android, or anywhere you listen.
Transcript
Intro:
This episode is part four of our four part series leading up to the launch of my new book. The Data Sleuth process I lay out in the book is what I wish I had had when I started working with forensics in 2010. Whether you're new to the industry, wondering where to start, or maybe even wrestling with how to scale a service that seems unscalable, I believe the information in this book can help. The book is available now for pre-order. Pre-orders are what publishers use to determine how many books to order. So if you enjoy the content in today's episode, would you consider pre-ordering the book today? Stay tuned at the end of the show for more detail on the Data Sleuth book, or see the show notes to reserve your copy today. Well, welcome to The Investigation Game podcast, I'm your host, Leah Wietholter CEO, and founder of Workman Forensics in Tulsa, Oklahoma.
Leah Wietholter:
Today I have with me, one of the team members, again, I have Rachel Organist, she's our senior data analyst. Originally trained as a geologist, Rachel obtained a bachelor of science from the university of St. Thomas in St. Paul, Minnesota and a master of science from Penn State University. When her work in the oil and gas industry didn't provide the career satisfaction she was looking for, she researched other fields and found forensic accounting to be the perfect place to apply her analytical skills. In her work with Workman Forensics, Rachel uses her expertise in scientific reasoning, as well as her aptitude for identifying, collecting, and the sizing data to undertake financial investigations. As of 2021, Rachel is an official certified fraud examiner. Well, welcome back, Rachel, to our last episode of this wonderful series we've been doing about our data sleuth process.
Rachel Organist:
So happy to be here, it has been so much fun.
Leah Wietholter:
Yeah, it's been really fun getting some feedback from podcast listeners. One of them contacted me this week and said that he had purchased the book, but that he was actually going to listen to all of these episodes first before starting the book. So, but we had like a lot of things in common, so that was really fun to hear. So today we're going to try to squeeze three of our big analyses or tools that we use as part of data analysis into one episode. So are you ready?
Rachel Organist:
Absolutely.
Leah Wietholter:
All right. So I'm not even going to banter a lot at the beginning. Let's just dive in. Okay, so first I want to talk about our source and use analysis summary. So I'm just going to let you go, but how would you describe the Data Sleuth source and use analysis summary?
Rachel Organist:
So this one, I mean, I'm excited to talk about all of these because they're like the bread and butter core of the analysis that we do, but I feel like the source and use in particular has been around since before I started at Workman, you guys were doing this. But it's also just really cool, I think, how you've improved it, refined it, made it work for us over the last few years. But really, I think, sometimes people are taken aback by how conceptually simple it is. All it is just a way to summarize where funds in an account came from and then how they were used. Literally the source and the use of funds, I mean, that's what we put at the top of every work papers, the source and use of funds analysis.
Rachel Organist:
That's all we're doing. And we summarize by pay for expenditures and basically we're just summarizing how much came from or was paid out to different sources. We do sort things a little bit, we'll pull out withdrawals, transfers, things that appear to be corporate entities like LLCs or things like that. So there is a little bit of subgrouping that can make it more useful for us or for the client, but really it's a pretty simple work paper.
Leah Wietholter:
Yeah. It's just a reorganization and summary of everything that happened in a bank account or credit card account. We haven't really used it on any GL stuff, it's mainly account heavy transactions. Yeah, I remember the day that this hit me because as I used to scroll through bank statements, because whenever I first started, I was entering all the lines of the bank statements. So I knew what to look for, so I'd scroll and then I'm like, oh, let's filter for transfers, let's filter for wires. But it was all these steps that I then had to remember to train my staff on. And so by creating the source of new summary, this let us look at all of those things in a uniformed fashion.
Leah Wietholter:
Instead of saying, oh, did you also check for this on this big schedule of bank statement transactions? I didn't have to ask, they could just run the summary. Now, in the book, well, at least in the trainings that we do that coordinate with the book I use Excel as how we run these and everything. Internally, we have a whole process that's more automated, but the source and use summary can really just be made with subtotals or pivot tables.
Rachel Organist:
Yeah, absolutely. I was going to say if you're just using Excel, I think, pivot tables would be a pretty easy way to do it. The other thing you just describing that made me think, the other thing that I think is really simple, but really powerful about it is that you don't just have to run it on one account. A lot of times we'll combine all the personal accounts related to a case, or if there's multiple accounts related to a business entity, maybe they have an operating account and a savings account or something like that. It can really be an efficient way to do your analysis to combine all those into one schedule and then run a source and use on that.
Leah Wietholter:
So what types of cases is this analysis important?
Rachel Organist:
We run it on almost every case, but a lot of our more common use cases would be as far as the use of funds side of things, embezzlements partnership disputes, estate and trust issues. Essentially, anytime our client is concerned that someone with access to that bank account or group of accounts was using the funds inappropriately. The source side, I think, is a little less common. So that use side, I think, we use on almost every case. The source side to have it be really useful in a case we usually have to request and schedule deposit items, which we talked about those last episode or the one before, and we talked about data processing. But whether we do or don't have those deposit items, the source side can be useful if you want to identify maybe whether funds that should have been deposited were diverted in a simple, really, broad brush way, there are some more detailed ways we can look at it that we'll talk about later. But maybe you just don't see any deposits from a payee at all that you did expect to see.
Rachel Organist:
So it can be a precursor to more complex types of comparative analysis, just a quick first pass overview of what's in the account. Sometimes you see unexpected sources of funds and that tell us about connections between entities that we maybe didn't know existed. And I'm thinking of, we did a bank case, was it last year or the year before? I feel like the pandemic has completely skewed my sense of time. But we had a big bank case and we looked at a ton of accounts and there were some side threads to that investigation that we sadly didn't get to fully follow up on, it just weren't really within the scope, but I know you know a case I'm talking about.
Leah Wietholter:
Yes.
Rachel Organist:
But I feel like seeing some sources of funds in a certain accounts triggered some, oh, we didn't know that these two individuals or entities were connected. In a divorce case, the source side could reveal sources of income that we didn't previously know about. Those are just off top of my head, but I mean, super broad application we use this. Even if we don't send these to the client very often anymore, but we almost always run them just because it is, like you said, Leah, just a way to reorganize the data that we have for the case. And since we do have it so automated, it's really quick to run and it's just a good first pass look at things for us.
Leah Wietholter:
Yeah. And going back to the bank case you talked about, I have thought back to that case a lot, and I don't think we would've been as successful without the source and use. Because we had to identify a lot of parties that were connected and a lot of bank accounts that were connected, and there were a lot of entities that were connected. If you've ever done any research on entities you know that an individual doesn't have to... Like I don't have to list that Leah Wietholter owns Workman Forensics. I can use an attorney or a CPA or somebody else to be the registered agent in that state. And so just running a secretary of state search and database search would not have necessarily identified all of the entities we were looking for, or the relationships with people.
Leah Wietholter:
Because if you want to know if people are related or not, see if they're paying each other money. We can go and interview all day long, but if I can see how they're spending their money, I can make some of those relationships work. And I trust this data more than I trust interviewing those people. So, that's where I'd prefer to start, not that one necessarily works with the other, but for this case, I just really don't know how we would've, we definitely wouldn't have found everything we found without the source and use.
Rachel Organist:
And their sheer volume for that case.
Leah Wietholter:
Mm-hmm (affirmative). Yeah, that case.
Rachel Organist:
There was the number of bank accounts that we had to look at, it was great to have something like the source and use that's relatively simple and fast to run, and I feel like could give us a lot of information really quickly.
Leah Wietholter:
And it is really powerful in finding connected bank accounts, even through the transfers or wires. I've found houses purchased in the Dominican before just from a source and use and seeing a wire deposited to a bank account. Then it's like, oh, yeah, this isn't his normal paycheck. So things like that. Do you have a good case example of using a source and use, we've talked about related to a bank or maybe embezzlement, but what about in a divorce case?
Rachel Organist:
Yeah, so we actually just had a recent case where the source in use was really helpful and again, a different budget time issue instead of, we didn't have necessarily a huge volume for this case like we did for the bank case, but the client was on a smaller budget. So we wanted to really quickly be able to answer some of his questions. So we did a combined schedule all of their joint accounts, which he obviously was aware of, and ran a source and use so on that. So we quickly were able to identify several other accounts that were previously unknown to our client, a couple of credit cards that he didn't know about in addition to the ones that he did, and then some large dollar wire transfers that then that was a jumping off point for the client to request that additional documentation from the bank. That's another way that these can be really useful.
Rachel Organist:
And then it also going the other direction, the source and use did reveal that direct payments to the spouse's family, which was something our client had been really concerned about, weren't actually as material as he had thought, it was able to shift the focus for him and his attorney, those payments to her family to the wire transfers and some other issues. So I think we really got a good bang for the buck on that case with the source and use.
Leah Wietholter:
Yeah. Did you send the source and use to the client on that one?
Rachel Organist:
I think we still did not in that case because we did go ahead and do interesting data findings next, which we'll talk about in a minute, and that's often our workflow for that. We use the source and use for us to just quickly see what we want to dig into a little more, and then we do dig into specific transactions, we'll summarize those for the client on the IDF. So I think that's what we ended up sending him and going over with him.
Leah Wietholter:
So there are a few things with running a combined source and use, we don't combine personal with business and we make sure the ownership of the accounts are the same on all the accounts that we're going to combine, so we don't want to take like sun account and mix it with a husband, wife account, to keep those clean that's just better. Just keep the ownership of the account separate if you're going to combine them. And then we don't combine bank accounts with credit card accounts in the same source and use, because we actually start with the beginning balance of the account, plus all the deposits minus the expenditures. So then we end up with the ending balance.
Leah Wietholter:
So if we include, like on the bank statement, it's going to show that there's a credit card payment to Chase for $10,000 or maybe 100,000 over the period we're looking at. So if we include all of the Chase transactions as well, we're going to double count that. Because our credit card information is really like, if you're an accountant, it's like your subsidiary ledger, it's your detailed ledger of what was paid, that's how you know what that payment was for. So we keep those separate, typically.
Rachel Organist:
Yeah. And that source and use, usually, I'd say we run them on the bank account first, and then you can see if there are credit card payments out of that account. And that might tell you if you want to go further and dig into the credit card, because how a credit card was paid can be relevant to whether or not you even want to analyze those credit card statements, sometimes it doesn't really matter for a case, and then we'd rather save the client money and not look at them at all.
Leah Wietholter:
Right. Correct. Yep. Exactly. Okay, so we run a source and use first and then connected to that, we run the interesting data findings. So from a high level, what is this Data Sleuth interesting data findings analysis or some report really that we run.
Rachel Organist:
Yeah. So like you mentioned that the start of the episode, these are analysis but they're also just tools. And I think of the IDF especially as well as the risk based analysis that we're going to talk about in a little bit. But it's more of a communication tool or a way of organizing several different analyses and then presenting them usually to the client for feedback. But sometimes just getting all findings in order for the finding summary or for the report. But basically for the interesting data findings, we run a bunch of tests on a data set, usually, it's going to be banker credit card statements. And then we summarize those different items, the transactions that we have interesting data findings for. So the IDF, that's how we abbreviate it, I'd love a good three letter acronym, but ultimately, then we end up with a summary sheet of all the findings and then detail tabs.
Rachel Organist:
So, that allows the client to drill down. They can just start with a summary sheet it's less overwhelming, it's grouped into sections by the type of test or flag or analysis that we ran, but then they can always drill down to the detail tabs to see, well, what were these things that Workman has said look like loan payments? Or they can get a little more detail or even provide feedback in more detail because maybe some payments in a category were fine and they knew about them, but then other ones they do think are suspicious or are not. So that's it in a nutshell.
Leah Wietholter:
I know everybody's going to want to know, this would be the question we were asked the most if we didn't address it right now. So what are some of the common tests that we run?
Rachel Organist:
Oh, gosh. So we have a whole list, even dollar transactions, so that could be things just like $143, truly just the meaning of even dollar amounts, but also in the vast majority of cases, I'd say it's useful to narrow that down even further to just transactions that are multiples of $100or 500 or $1,000. It depends on the case or the data set, but I usually start with 100 and go from there. Expected versus actual frequency of expenditures, maybe things that you would expect to be paid or specific pays that you would expect to be paid once a month, but maybe there were multiple payments per month. Recurring transactions is a subset or a variation on that, and we'll look specifically at the same pay with the same dollar amount being paid multiple times.
Rachel Organist:
And that can be an easy way to pull out loan payments, utility payments, that kind of thing. And we can go into more detail on all of these, I just wanted to give a quick overview of what some of the tests are, frequency of deposits. So, there, I'm talking about expenditures, but also deposits. If you were expecting to see rental income or social security income, or things like that, or maybe just identify different income sources that you didn't know about, recurring payments are a way to do that. Outliers or just large individual payments, you can get a little more complex and do some joins with other data sets, like, if you wanted to join your checks by check number to the GL or to a check register and look for pays that didn't match, that's something that you can then pull back the mismatches into an IDF ATM withdrawals, anything at a specific location, which is more commonly going to be found on a credit card statement or the ATM withdrawals on the bank statement.
Rachel Organist:
Days of the week, credit card transactions, those statements I'll have transaction dates in addition to the clear posted dates. So you can look for if it's a P card that should only have been used during the week, maybe for payments made on the weekends. And then any variation or combination of the above, like really commonly we'll combine even dollar amount with a large payment and only look at large even dollar payments, or maybe you just want to look at ATM withdrawals at specific locations. So it's so wide, basically, making its own work paper by itself wouldn't be particularly useful. But when you combine it with all these other flags in terms of looking for transactions, that might be part of the loss, or might not have benefited the client or whatever it is that you're looking for in this particular case, bringing those all together on the IDF is where it's really powerful.
Leah Wietholter:
Yeah. And whenever we first started working on this, it was really just to narrow down, like giving a client a source and use was helpful. But then we started noticing like, well, the client would say things like, well, some of these payments might be okay, but not all of them. And we might look through the data set and go, "Oh, this is weird." And so then we'd pull out something. And so we just needed a place, like you said, to communicate with clients and to say, "Okay, we've gone through your data, and from a data perspective, these things seem odd or they're high risk." Even dollar payments, I just describe those as they're high risk because people who steal money typically do it in even dollar amounts.
Leah Wietholter:
So you might as well just pull those out, but we're helping the clients help us find the needles in the haystack. And so we're doing that using these different data tests. And then specifically, because you said that the tests that you can run are just so wide and, "Oh my gosh, I could do all these things with it." That's why we started most of this series with case planning, because we have to connect that back to what are the client's concerns. Usually, we find more than the client did, but it still helps us narrow down the scope of what we could look at. So that's how we reign in the scope of all these tests we're going to run to then communicate to the client, but also how do we know when we've run enough tests?
Rachel Organist:
Yeah. I was thinking about this earlier, when you mentioned when we first started doing the IDF and how the types of analysis that we were doing evolved. You might be running these different tests and eventually the same transactions are going to pop up over and over again. And that's when you feel like, "Okay, I think I have found everything that's of interest within the data set," and you can start to feel confident that you're not missing anything, at least that would stand out from a data perspective. And I just wanted to also say, I think, where IDF takes it to the next level over the source and use, or another reason we evolved to add this on top of the source and use, is that the source and use doesn't really look at timing of payments or of deposits at all, sometimes we'll split out a source and use into two different time periods, if that's relevant to the case, before or after a date of divorce or a date of death, or that thing.
Rachel Organist:
But that IDF can then bring in analyses that, like we mentioned, days of the week or frequency of payments. I just feel like a lot of times when we were sending the source and use directly to the client or even looking at it ourselves, we'd think, well, the significance of payments to this payee is different depending on whether it happened, before X, Y, Z, or after. And so being able to dig into that a little bit more in the IDF and present it along with timing information is really valuable.
Leah Wietholter:
Yeah. So then when we have this information in the IDF, we've got all these details and we group it by findings. We're not limited to just what our test results showed us, and that's why we run that source and use too, because we can use the source and use to help us cater the test well, and then organize that by data finding or whatever. I feel like we try whenever we're knowing that it's going to the client, explaining an even dollar payment is pretty simple, like if you're doing a Z score type thing outliers, I think sometimes we just call it outliers or large individual transaction or something like that, just to keep our audience in mind that they're not data analysts, but group them so that they know what we're talking about.
Rachel Organist:
Right. And we do include on our IDF summary, a column that's like data findings is usually what we'll put as the header for that. But that way on each group of payments, usually they're grouped by pay, we can tell the client, this is why we're showing you these. And maybe include some questions that we have for the client, like, was this ordinary? This is why we're asking you about this, or just a little bit more context for them of why it's included and that can help them too when they are giving us feedback.
Leah Wietholter:
And I think that's unique, by the way, to us that we would incorporate the client into this process. Talk a little bit about it in the book and story I used is that, we had been.. Man, at this point, I have talked about the book so much that I can't remember which audiences I told what. So, this is a repeat, I'm really sorry to our listeners. I don't think we've talked about this yet. But we had done some analysis and this guy was getting paid through contract labor, so there were checks made directly to him, but then there were also checks in payroll. And so we did our analysis and then wrote this really nice report. And I got into the meeting to tell, talk about the report and the clients were livid because they thought the loss amount would be much higher.
Leah Wietholter:
And I just remember sitting there like, "Oh my gosh, how did we miss this?" And that was the last time we did not include a client in the process with us because of that situation. That was just the most horrible meeting I have ever had to participate in, because they were so mad. And what had happened was he was getting paid through payroll and contract labor, but they didn't tell us that at the beginning of the case, which I don't know, now looking back, I'm like, "Did we really expected our clients to know that detail, or to tell us that detail?" I mean, that's a little presumptuous or something on our part. Come on, let's be realistic. And so when we started incorporating clients and that allows us, especially, in the IDF step, and then later, whenever we put it all together in our finding summary, it lets us catch those things and involve them before we've issued a report.
Rachel Organist:
Yeah, absolutely. And honestly, I feel like the converse is really commonly true where something looks super weird to me, not knowing the business or exactly what's going on with the trust or whatever it is. But like we always tell our clients, you know your business better than anyone, for our clients who are small business owners. And so we're here to facilitate, obviously, we bring our expertise in fraud risk and data analysis and all those kinds of things, to help them. But ultimately, they have great information on what they actually expect to be leaving their account or who should have been being paid or whether something is really unusual or not. So that's definitely a key step. And I think the IDF is that intermediary between us doing all the data analysis and then the client providing their knowledge of their business, really brings the two together, I think, really efficiently.
Leah Wietholter:
Yes, I totally agree. Can you think of a good example of the IDF before we take a break?
Rachel Organist:
Yeah. So a lot of these are pretty recent, so they're really fresh in my mind, but we had a partnership case where I think an IDF was really effective. And this was a case, I guess we'd call it pre litigation, but the audience for our analysis, the client didn't have all the information yet, their partners were being not very forthcoming with the bank statements and things that they had requested, but they were eventually able to get us some bank statements for the business. And so our client wasn't really looking for anything super specific, just general misappropriation of funds. They felt like they had been cut out of the business to some extent and the other partners were not handling things appropriately. And so the client and their attorney were just trying to gather more information before deciding what their next steps were.
Rachel Organist:
So for that IDF, we actually ended up pulling together a variety of things that I don't know that we would've seen them all in one place and connected them without doing it this way. But we were able to use recurring payments to identify what looked like loan payments that the client maybe didn't know about, and that looks like they may have benefited the partner's other businesses, that the client was not part owner of, and then some other expenditures that were related to real estate transactions that also appeared related to the partners' other businesses or assets that the partners owned without our client that we had identified through public records, database search. So it really tied together these different types of payments that all pointed to, hey, these guys are using the funds from your joint business to fund some of their other business ventures. But I feel like that IDF was really helpful in bringing all those different types of flags or payments that stood out for different reasons, but to have them all in one work paper for the client was, I think, really helpful.
Leah Wietholter:
Yeah. That is a great example. Let's take a break real quick and we'll come back to talk about our risk indicator analysis.
Leah Wietholter:
Hi, everyone, it's Leah, my new book Data Sleuth using data and forensic accounting engagements and fraud investigations, launches April 19th. And to celebrate, we are giving away 10 signed copies during each of our April 5th and April 19th episodes. With 20 chances to win, you do not want to miss out. To be sure you're in the drawing, subscribe to the podcast and turn on alerts to be the first to know when the episodes drop. Welcome back to my conversation with Rachel, we're going to talk about our risk indicator analysis. And in the book I talk about the source and use summary, the IDF, and the risk indicator analysis separately, because of how they're used, but it's not like we're performing different magic tricks with all of these. We're just revamping the old ones. So what is a common use of the risk indicator analysis or how do you decide that would be an appropriate analysis for a case?
Rachel Organist:
A lot of times if you, maybe, start with an IDF or you can even think this through an advance and see that the risk indicator analysis might be a better fit. But I'd say the risk indicator analysis is similar to the IDF and that it's a communication tool, ultimately, that pulls together the results of a variety of different tests or flags. But the big difference with the risk indicator analysis is that it's great for data sets where one transaction or record is likely to flag on multiple tests. Often, I'd say the tests that we do related to the risk indicator analysis aren't as in depth or complex as some of those IDF tests that we mentioned. So, in general, the risk indicator analysis, it can be used on bank statements, but we more commonly end up using it on data sets like payroll or purchasing orders or other, I don't know, internal company data. I just think payroll is a really good common one though.
Rachel Organist:
And the tests will just be simpler, they'll be, just so we're looking for large payments or in the case of payroll, sometimes it could be like the ratio of direct deposit to check payments. It could be weird if someone is getting a lot of checks or not only large payments, but a macro that looks for large payments can also look for payments that are large for that employee. Maybe, they're not large compared to the overall data set, but relative to other payments to that person. I'm trying to think, you just did that really good risk indicator analysis on a case that was on payroll data, what were some of your other tests?
Leah Wietholter:
Well, I think, on that one, I feel like it was a little specific to the client in the way that they did their business, but yeah, even dollar we had a bunch of people who had even dollar payments or we knew that some individuals who didn't work for the company had been paid a certain dollar amount. So then I could give a point to anyone who showed up in even dollar, give them a point, anyone who showed up in this dollar amount, I think it was $900, so then maybe give them a point. And just anything, maybe, didn't work for the company anymore, give them a point. Because it doesn't necessarily have to be on the dollar amounts, the risk indicator analysis, a common thing that people talk about is finding ghost employees.
Leah Wietholter:
I feel like that's a popular topic among fraud examiners is, let's look at the employee records and find duplicate addresses or duplicate social security numbers, they'll do it on vendor records too. But who are employees with no address, so then checks are being mailed to them, those types of things. And then award a point for each of those, like these are the data results for that flag and awarding a point to those. So anyway, I'll let you to take it from there, but those are some of the ways that I've used it.
Rachel Organist:
Yeah. Well, I was just going to say, I think, the biggest difference between risk indicator analysis and the IDF is that the risk indicator analysis is built with the assumption that a lot of transactions are going to flag on multiple tests. Whereas with the IDF, if something flags on multiple tests, you have to decide which section you're going to put it in, like where does it really stand out the most? And then you can maybe add a comment for the client, like, this payment was also really big if, maybe, it's in the wire transfer section. But you're more looking for a variety of different payments that flag on these different tests, whereas with the risk indicator analysis you were mentioning assigning points to different things, it'll be more often that we assign each test a points and then can look at transactions that have five points.
Rachel Organist:
Those might be the highest risk, and we usually put those at the top of the work paper for the client. If you can only look at one thing, here are the transactions that we think are highest risk. And another thing that, I don't know if we've done this yet, but I think you can make an argument for even weighting your tests. We typically say one point per test, but based on the facts of the case, we think is a very strong indicator of potentially fraudulent transaction, you could wieght that test higher, give it two points or something like that. But, overall, I don't know if this is a great way to put it because this isn't exactly, I'm not using these terms the same way they're used in financial statement analysis or things like that, but the risk indicator analysis is a horizontal communications of findings versus the IDF being vertical. IDF will list these different flags and these different sections consecutively, whereas with the risk indicator analysis, you're looking at all the flags at once.
Leah Wietholter:
That's true. Yeah. Another thought I just had was that I think sometimes the risk indicator analysis is helpful when the decision maker, so management or the client or owner, is further removed from the day to day. Because when we've had those cases where there's an embezzlement and the owner is very familiar with their business, they're not real far removed, they can say, oh yeah, this payment doesn't belong to us, we should have never purchased anything from this, or, oh yeah, so and so they haven't worked for us in this many years. They're familiar enough with those types of things and those are the conversations we have and then it starts building that loss. On risk indicator, I feel like it's a tool to help, maybe, the decision makers or management that are further removed, try to identify, okay, we're not going to have time to go through all of these and I don't know enough of these details to say which should go into our loss buckets, or if they should even go into a bucket.
Leah Wietholter:
And so by saying, okay, well, if we had to prioritize your time, like you said, to look at anything, we would look at these that triggered multiple flags because we think these are the highest risk. And this is how we would track this down, we'd find these supporting documents or information or ask these questions and go from there. Because sometimes they're like, we know this happened, but we don't know which people this happened with. And there are hundreds of people, I mean the case that I use this most recently on, I think, they did like 5 million in payroll a year. And this payroll was like, not very many people were over $1,000 a payroll. So we're talking about a ton of transactions and trying to narrow that down to say, okay, these categories are most likely of highest risk that we need to consider.
Rachel Organist:
Yeah. And I think that is maybe payroll data sets tend to be like that, especially with larger businesses, and maybe that's one of the reasons we tend to use this more for payroll. Because I'm even thinking one of the first cases I worked on here ended up being a really big embezzlement case, but when the client came to us they knew two of the people who were involved and they knew that at least some of the theft had happened via payroll, but they weren't really completely sure about who else was involved. And so just looking at all of their payroll data, this was before we had this risk indicator analysis really, before it had really cohered into a standard process for us. But even then I basically did the same thing and just ran a bunch of different tests.
Rachel Organist:
People who received multiple payments per pay period I put on one Excel tab and then people who were paid on pay days that not very many other people were paid, like non-standard pay dates, that's another one. But yeah, I think, payroll data sets just lend themselves to this analysis because often they are just so big that it's a good narrowing down.
Leah Wietholter:
Yeah. And the day that I was like, we need to name this was when you formalized it a little more on a purchasing case. Because if you think of purchasing and this was a manufacturing company, I mean, it was massive. How do you decide what's important? And each flag, I feel like by itself, we didn't have enough information with any of our other sources that would tell us whether it was high risk or not, we didn't know. And I think you might have added some of those too.
Rachel Organist:
That was definitely a case where the client was pretty distant and they just weren't able to give us a lot of feedback on what was potentially bad and what wasn't. Like you said, it's almost like this does a little bit more of the work for the client in assessing what's high risk and what isn't, whereas the IDF, we rely on them. We can point out things that might be high risk, but just relies on them having a little bit more information about the situation.
Leah Wietholter:
Right.
Rachel Organist:
And I think a funny side is that when I first started putting these together, it was partially inspired by idea training that I did. But then also I, and I think we probably said this in earlier episode or in the intro, but I used to be a petroleum exploration geologist, and this is big in oil and gas exploration, is what's called common risk segment mapping. And it's basically this concept except instead of a spreadsheet, you end up with a map. But you take your reservoir charge and maturity and porosity, permeability, all these different factors that make a good oil play, have your color coded maps, and then you layer them together and see like, okay, this is where all the good lines up. And that's basically what we're doing here, but just with transactions.
Leah Wietholter:
Yeah. And I just want to add to the end of this risk indicator analysis that even though it's done a little bit more with the work for the client, it's still not proof. So we still have to take that extra step. We still have to do confirmations or find invoices or connect it to something else, even if it is an interview at that point. But we've got to connect it to something else. Like on payroll, we can have all of these non monetary flags, but if the individual was never paid, then there's no loss to the company, you just need to clean up your employee records type of thing. So just one other thing that I should add that whatever your source and use looks weird on your source and use or whatever looks strange on an IDF or whatever are your highest risk items on a risk indicator analysis, that doesn't mean that there's fraud. That's not your answer.
Rachel Organist:
I think that's a great mindset for everything we've talked about, even in the series, is that nothing is a smoking gun, but you're building your case. You're adding these layers of support to which transactions are going to ultimately be part of your loss.
Leah Wietholter:
Well, thank you so much, Rachel, this was so helpful and I'm definitely going to do, just here at the end, talk about the book, just a little. Because for each of these things that we've briefly touched on, there are case stories, there are examples, there's even tables and charts to show you what this looks like in the book. And then to go along with all of these things that we're just really so passionate about and wanting to teach others about, because, I think, we all believe here, that investigations impact real people's lives. And we want to make sure that the product we're putting out is accurate of the facts, that it tells the story of what actually happened. And so we have a four hour training that's based on the book that has a workbook and all kinds of examples, and we actually practice doing the analyses that we've talked about today. So if you're interested in any of that, make sure to contact us at Workman through our website, workmanforensics.com. Yeah, this has been so much fun, Rachel, we'll have to do it again.
Rachel Organist:
Absolutely. Thanks.
Outro:
Thank you for listening to the investigation game. For more information on any of the topics brought up on this show, visit workmanforensics.com. If you enjoyed our show, be sure to subscribe and leave a review. You can also connect with us on any social media platform by searching Workman Forensics. If you have any questions or topic ideas, please email us at podcast@workmanforensics.com. Thank you.