DETECTING ANOMALIES IN YOUR DATA USING ROUNDED NUMBERS Curtis A. Smith, Defense Contract Audit Agency, La Mirada, CA

Transcription

1 DETECTING ANOMALIES IN YOUR DATA USING ROUNDED NUMBERS Curtis A. Smith, Defense Contract Audit Agency, La Mirada, CA ABSTRACT Analyzing large amounts of data looking for anomalies can be a disheartening task. You need techniques that will allow you to quickly assess the data in ways that will highlight potential anomalies while keeping you from chasing the wind. The rounded number test is one such technique. Using this test and the SAS System you can quickly identify rows in your data whose numeric variables have been rounded such that they defy statistical norms, indicating possible invention of numeric values. Within this paper, the author will present SAS code that will enable you to quickly and easily find anomalies in the data you analyze. The SAS code will include the Data Step, the MERGE statement, and the FREQ, REPORT, and GPLOT procedures. The author will also present some findings from the data he analyzes. The technique presented is powerful, yet easy to understand and use. INTRODUCTION Digital analyses are computer assisted audit techniques used to analyze large amounts of data in ways that traditional audit techniques can match. The rounded number test is one such analysis. Excessive rounding in numbers within a universe can be a sign of number invention. Frequently, rounded numbers are invented innocently for convenience. For example, when my son ran in a 5K race recently and the media reported that 5,000 people ran, we understand that that was not the official number. But, it serves its purpose of being a handy number to use. However, in some cases, rounded numbers are invented for fraudulent or other malicious reasons by persons who do not think to create numbers that would occur more naturally. For example, if someone were to create a false billing, he/she might chose a number like $125.00, rather than $ Round numbers are defined as numbers that are divisible by 10, 25, 100, or 1,000 without leaving a remainder. When analyzing dollar amounts, a common practice is to ignore cents when determining if a number is rounded. For example, $3, would be treated as $3,200. High levels of round numbers may also signal errors and irregularities, and are generally not reviewed in standard audit procedures. - Richard Lanza, CPA analyzing digits within numbers as digital analysis. It is difficult for the fraudster to avoid detection from digital analyses because the fraudster typically cannot influence an entire data file. Thus, the fraudster will invariably alter numbers in such a way that defines natural statistical occurrences of rounded numbers. But, you don t have to be looking for fraud to benefit from the rounded number test. There are many non-fraudulent reasons why a universe of numbers can violate natural statistical occurrences of rounded numbers, yet still warrant your investigation. Many respected digital analysts have written on the subject of the rounded number test. While there may be some debate on what the expected occurrence of rounded numbers are, the table below shows those that appear to be generally accepted, as stated by Dr. Mark J. Nigrini. It s not surprising that rounded by 100 occurs much more often than rounded by 1,000 because a number rounded by 1000 is also rounded by 100. Similarly, numbers rounded by 1,000 and 100 are also rounded by 10. Start Digging Here is an example from invoice transactions I have analyzed. This data set contains more than 100,000 rows. Notice the table showing the observed versus expected distribution and the delta between them. Then notice the plot showing the same. As you can see below, you ve got your work cut out for you investigating these anomalies as there are far too many transactions that are rounded to 10, 25, and 100. Mark Nigrini, Ph.D., states: The round number tests are most applicable to cases where estimation may be occurring but is inappropriate for the data being audited. Examples would include inventory counts, overtime hours (here the auditor may want to classify a whole number as a round number), numbers forming the basis of royalty payments (production levels or dollars of sales), refund amounts or credit memo amounts, or check amounts. HOW CAN YOU BENEFIT? If you are in the business of analyzing data, such as the noble profession of auditing, you might need to look for areas of fraud or areas of anomalies. Dr. Mark J. Nigrini and others have successfully used the rounded number test to detect potential fraud. Dr. Nigrini termed the use of

2 You may not get so lucky and find so many anomalies so quickly. Look at the example below from travel claim transactions I have analyzed. This data set contains more than 700,000 rows. Notice the table showing the observed versus expected distribution and the delta between them. Then notice the plot showing the same. Notice that when we subset by DIVISION and look at division Z549" we suddenly see some variation from the expected frequency of rounded numbers, especially when rounded by 10. Now take a look at our travel claims data set when we subset by the variable EMPLOYEE. Nice curves. In this case, everything looks as according to Hoyle, or whoever came up with the expected frequencies. So, a dead end, right? No, just an opportunity to dig deeper. Dig Deeper By Subsetting You can further analyze your Round number data by first subsetting your subset test: data. For example, if you measuring the extent analyze all of the transactions of rounding can help together and find nothing, you auditors detect might then look at subsets of the artificial transactions data. In this example, rather in inventory counts, than looking at all the travel o v e rt i m e h o u r s, claim transactions together, you refund amounts, or could look at subsets by check amounts. department, or by week, or by - Dr. Mark Nigrini employee. You might then see anomalies showing up. Why? Because if one department or employee is doing something funny, or if something funny was being done during one week, looking at the entire universe can obscure the funny business. But isolating subsets can be revealing. We will begin our quest by subsetting our travel claims data set by the variable DIVISION. Here is the analysis for employee AB1234". Notice that while the rounded number analysis for all transactions look normal, the analysis for this one employee does not. There are huge variations in rounded numbers 10, 25, and 100. It might be interesting to look even further and determine if employee AB1234" works in division Z549". So, the lesson is that while a whole universe may display the expected frequencies, evaluating the universe by subsets can be revealing. Inquiring minds want to know... What to Do So, what can you do with these anomalies? You can start to cross check them, looking for something in common. Considering our example, look to see if the anomalies within divisions also occur within employees. Then, you can begin extracting the actual data records that contain the anomalies and use the information on those data records to get to the root of the anomalies.

3 What have I found? Well, I analyzed travel claim transactions and found that one employee within one division had far too many transactions rounded to 10, 25, and 100. The auditors in my office are currently reviewing the transactions to determine the cause of the anomaly. SO, HOW DID I USE SAS? To produce these striking results, I used SAS to do six main tasks, which are as follows: Determine the expected frequencies of rounded numbers Determine if the numbers in the universe are rounded Determine the observed frequencies of rounded numbers in the universe Merge the observed and expected frequencies and compute the deltas Create a report of the observed versus expected distribution Create a plot of the observed versus expected distribution That does not seem too difficult. This is a SAS paper, so let s look at some code. The code I am showing is for computing the rounded number test of an entire universe. The modifications needed to do a subset analysis using a BY group analysis are not too different and will not be presented. Determine the Expected Frequencies Our fourth step will be to create a data set that contains the observed and expected rounded number frequencies. Before we can do that, we need a SAS data set that contains the expected rounded number frequencies. Here is the code I use to create the expected frequency SAS data set, using the expected frequencies we discussed earlier. For brevity, I am only showing the code for the rounded numbers 10 and 25. The complete code includes additional statements for rounded numbers 100 and 1,000. data work.expected(index=(round_by)); length round_by $4.; format Expected 8.3; expected = ; expected = ; round_by = "100"; expected = ; round_by = "1000"; expected = ; This Data Step simply creates a new data set containing four rows, one for each of the four rounded numbers we will test, and two columns. The columns will contain a label for each of the four rounded numbers (10, 25, 1000, and 1000) and the associated frequency. Determine If the Numbers in the Universe Are Rounded Before we can determine the observed rounded number frequencies we need to determine if a number is rounded. We want to determine if the numeric variable in our input SAS data set is rounded by 10, 25, 100, and/or 1,000. Therefore, we must pass each row through four sets of tests. Remember, when the numeric variable is dollars, we want to ignore the cents. Here is the code I use to determine if the numeric variable is rounded. Again, for brevity, I am only showing the code for the rounded numbers 10 and 25. The complete code includes additional statements for rounded numbers 100 and 1,000. data work.observed(index=(round_by)); length round_by $4.; set in.travel(keep=amount); round_no=int(amount); if round_no = 0 then delete; if mod(round_no,10) eq 0 then rounded = 1; else if mod(round_no,10) ne 0 then rounded = 0; if mod(round_no,25) eq 0 then rounded = 1; else if mod(round_no,25) ne 0 then rounded = 0; In the code above, we create a new SAS data set that contains three new variables ROUND_BY, ROUND_NO, and ROUNDED. For each row processed, we want to create four output rows, one for each ROUND_BY value: 10", 25", 100", and 1000". We also want to create a value associated with each of those rows containing a numeric 1 if the input number is rounded or a numeric 0 if the input number is not rounded. We want ROUND_BY to be a text formatted label, so we assign it with a LENGTH statement and set its length to $4., so that it can hold the longest value 1000". We then read an observation from our input SAS data set - in this case IN.TRAVEL. We only need the input numeric variable, so we use the KEEP= option to keep, in this case, the variable AMOUNT. We then create variable ROUND_NO and use the INT function to set it to the integer value of the AMOUNT variable. If ROUND_NO is equal to 0 (meaning the value is between.99 and -.99) we delete the row.

4 We then interrogate the ROUND_NO variable up to 2 times for each of our 4 rounded numbers. The MOD function returns the remainder when the integer quotient of the first argument is divided by the second argument. So, in the statement if mod(round_no,10) eq 0" SAS takes the value of ROUND_NO (which is the integer value of the input numeric variable), divides it by 10 and determines the remainder. If the remainder equals 0, then the next statements in our code tell SAS to set the ROUNDED variable to 1 and the ROUND_BY variable to 10". Thus, if the integer value of the input numeric variable is divisible by 10 with no remainder, the number is rounded by 10 and we set our flag variable ROUNDED to 1 (true). If the result of the MOD statement is not 0, then there is a remainder. Thus, the integer value of the input numeric variable is not divisible by 10 with no remainder, demonstrating the number is not rounded by 10. In this case, we set our flag variable ROUNDED to 0 (false). At this point, we have either set the ROUNDED variable to 1 or 0 and have set the ROUND_BY variable to 10". We then use the OUTPUT statement to write a row to our output SAS data set that will contain the input numeric variable (in this case AMOUNT), the ROUND_NO variable containing the integer value of the input numeric variable, the ROUND_BY variable, and the ROUNDED variable. We repeat this code logic for the rounded numbers 25, 100, and An example of the resulting SAS data set follows. When checking the SAS log for the number of rows written to the output SAS data set, don t be concerned if there are not 4 times as many rows in the output as there are in the input. Remember, when the integer value of the input numeric variable is 0 we deleted the row. So, it will not be unusual for the output number of rows to be something less than 4 times the number of input rows. Determine the Observed Frequencies We now want to determine the observed frequencies of the rounded numbers, which are stored in our ROUNDED variable. A simple FREQ procedure will do nicely. proc freq data=work.observed; tables rounded/out=work.rounded (rename=(percent=observed)); by round_by; There is nothing in this code that needs discussing other than to note that I rename the resulting frequency variable from the default percent to Observed so as to be unique when we merge this SAS data set with the SAS data set containing the expected frequencies. Remember I mentioned that when we want to perform the analysis by subsetting the data there is only a minor change to the code? Well the main difference is right here. To do the subsetting, you just have to modify the BY statement in the FREQ procedure to read BY byvar ROUND_BY, where byvar is the variable on which you want to subset the universe. The results of this FREQ procedure will look like the following: Merge the Frequencies and Compute the Deltas Now we have a SAS data set containing the expected rounded numbers and their associated frequencies and we have another SAS data set containing the frequencies of the observed rounded and non-rounded numbers. The next step is to merge the two and compute the difference between the expected and observed. That sounds like a simple Data Step with a MERGE statement. Here is the code: data out.rounded; merge work.expected(in=a) work.rounded(in=b where=(rounded=1)); by round_by; Delta=sum(observed,-expected); label expected="expected" observed="observed" delta="delta"; This data step simply creates a new data set by merging the observed and expected data sets by the ROUND_BY variable and creates a new variable, DELTA, containing the difference between the observed and expected frequencies. Our observed data set contains 8 rows, 4 for the occurrences of the values that are rounded by 10, 25, 100, and 1000 and 4 for the occurrences of values that are not rounded. We don t want the values that are not rounded. Remember these are identified as those where ROUNDED = 0. So, using the WHERE clause on the observed data set (ROUNDED) set to equal 1 will include only the rows that are rounded. Digital Analysis is an audit technology designed to find abnormal duplications of specific digits, digit combinations, specific numbers, and round numbers in corporate data. - Dr. Mark Nigrini

5 Create a Report of the Observed Versus Expected Now that the hard part is over, we can create our output. The comparison report is done with a simple REPORT procedure. Here is the fundamental code I use to create the tabular report with the observed versus expected distribution and delta. I accomplished the pretty version shown earlier using the Output Delivery System. proc report data=out.rounded nowindows missing; col round_by count observed expected delta; define round_by /order 'Rounded By'; define count / format=comma12. 'Observed Frequency Count'; define expected /format=8.3 'Expected Frequency Percent'; define observed /format=8.3 'Observed Frequency Percent'; define delta / format=8.3 'Observed - Expected Frequency Percent'; Create a Graph of the Observed Versus Expected Lastly, we want to create an easy to assimilate graph of our results. Here is the fundamental code I use to create the overlay plot showing the observed, expected, and delta regression lines. This code simply uses the GPLOT procedure to create an overlay plot of the OBSERVED, EXPECTED, and DELTA variables over the ROUND_BY variable accomplished the pretty version shown earlier using the Output Delivery System. REFERENCES Digital Analysis - Part 2: A Review of the Audit Tests to Detect Anomalies in Data Subsets, Mark J. Nigrini, Ph.D., id=96 Digital Analysis Real World Examples, Richard Lanza, CPA id=58 Digital Analysis Tests and Statistics - Using Digit and Number Patterns to Detect Fraud, Errors, Biases, Irregularities, and Processing Inefficiencies, and to Test New Computer Systems and Year 2000 Conversions, Mark J. Nigrini, Ph.D., CONTACT INFORMATION Your comments and questions are valued and encouraged. Contact the author at: Curtis A. Smith Defense Contract Audit Agency P.O. Box Fountain Valley, CA Work Phone: Fax: casmith@mindspring.com proc gplot data=out.rounded; plot3d (expected observed delta)*round_by/ overlay; quit If you are not familiar with creating graphs using the Output Delivery System, feel free to review my paper on the subject from WUSS My actual code is a bit more complicated, as I use macro variables to allow the user to make specifications before running the application. I also use ODS statements to make HTML files with ActiveX controls in my GPLOT procedure output. CONCLUSION Analyzing large amounts of data for anomalies or potential fraud does not have to be a disheartening task. Using digital analyses, such as the rounded number test, you can easily find anomalies in your data. It was not my intention within this paper to provide all of the SAS code I used to create the output shown within this paper. If you would like my code, send me an request. For a limited time my code is free, in exchange for your rounded number success stories.