DETECTING THE UNDETECTED FRAUD DETECTION ANALYTICS AT CARNIVAL

DETECTING THE UNDETECTED – FRAUD DETECTION ANALYTICS AT CARNIVAL Daniel Bukowski, CPA, CIA, CFE #ALTERYX 18

AGENDA • Carnival Background • Data Analytics for Internal Audit • Identifying Non-PO Vendor Risk • Alteryx Workflows • Questions #ALTERYX 18

CARNIVAL CORPORATION&PLC #ALTERYX 18

APPLICATION OF DATA ANALYTICS Compliance Fraud Detection and Investigation Operational Performance Internal Controls Stippich, W. W. , & Preber, B. J. (2016). Data Analytics: Elevating Internal Audit’s Value. Altamonte Springs, FL: IIA Research Foundation #ALTERYX 18

IIA RESEARCH #ALTERYX 18

THE AUDITOR MINDSET #ALTERYX 18

THE AUDITOR MINDSET #ALTERYX 18

THE AUDITOR MINDSET You want to take my Excel…? Alter This! #ALTERYX 18

‘ALTER’ THE AUDITOR MINDSET Auditors Alteryx Excel #ALTERYX 18

NON-PO VENDOR RISK REVIEW Project Goal • Identify the highest-risk vendors within the vendor populations of each Carnival operating company Alteryx • Convert manual, sample-based procedures into an automated, repeatable workflow that analyzes entire populations 2017 Scope • 10 k vendors, 275 k invoices, $2 bn+ spend #ALTERYX 18

NON-PO VENDOR TESTS VENDOR SETUP • • New Vendor Single-Approval Payment Terms High-Risk Country • PO Box INVOICES PAYMENTS • Vendor Total Over $250 k • Sequential Invoices • Round Dollar Amounts • Invoice Structuring • Quick Payment • Payment Date Anomalies • Payment Currency Different from Invoice Currency #ALTERYX 18

ALTERYX WORKFLOWS #ALTERYX 18

VENDOR RISK TESTS #ALTERYX 18

RISK-RANKED VENDORS USD Invoices Count Invoices Risk Score Over 250 k Paid Prior Paid 5 Days PO Box Alfa Co 9316261. 66 493 8 1 1 1 002 Beta Co 300500. 48 136 8 1 1 1 003 Charlie Co 9594836. 42 36 8 1 1 004 Delta Co 92241948. 1 1912 7 1 1 1 005 Echo Co 36927486. 61 617 7 1 1 006 Foxtrot Co 31604220. 34 333 7 1 007 Golf Co 18490591. 63 315 7 008 Hotel Co 4988327. 49 81 009 India Co 2003396. 37 010 Juliett Co 9019192. 2 Num Name 001 Round Amt Str Country New Vendor Single Approve Terms Seq Inv Diff Currency 0 0 0 1 1 0 1 0 1 0 0 1 1 1 0 0 1 0 1 1 0 0 0 1 1 1 0 0 0 1 1 0 7 1 1 1 0 0 0 1 1 0 220 7 1 1 1 0 0 0 1 1 0 34 6 1 1 1 0 0 1 1 0 #ALTERYX 18

CLUSTER ANALYSIS • Unsupervised machine learning • Identify latent relationships in the data • Principle components • Identify outliers #ALTERYX 18

Cluster 8 Centroid Cluster 8 #ALTERYX 18

CLUSTER ANALYSIS Cluster Count Max Risk Max Spend 1 82 5 26, 08, 4241 2 167 7 16, 508, 885 3 103 6 4, 608, 229 4 166 3 1, 298, 521 5 155 3 23, 240, 215 6 42 5 1, 007, 702 7 201 4 8, 978, 925 8 10 8 92, 241, 948 #ALTERYX 18

SUMMARY Data analytics with Alteryx enables internal audit to: • Do more, faster • Share processes visually • Automate manual processes • Analyze data at a greater level of detail • Focus manual procedures on the most important areas #ALTERYX 18

THANK YOU Daniel J Bukowski dbukowski@carnival. com www. linkedin. com/in/danieljbukowski Please complete a feedback survey! #ALTERYX 18

NON-PO VENDOR RISK REVIEW Prep Invoice Data Perform Risk Tests Aggregate Results Select High. Risk Vendors Manual Audit Procedures #ALTERYX 18

NON-PO VENDOR TESTS Risk Test Description SINGLE-APPROVAL VENDORS • Vendors with invoices approved by only a single HA Group executive NEW VENDORS • Vendors that have creation dates within the previous 12 months VENDOR BASED IN HIGH-RISK COUNTRY • Vendor located in a high-risk country, defined as a country in the lower 50% of the Transparency International Corruption Perceptions Index VENDOR ADDRESS IS A PO BOX • Identify vendors with a PO Box as the address on-file ROUND DOLLAR AMOUNTS • Identify vendors with multiple invoices that end in round amounts (00 or 50) INVOICE STRUCTURING • Vendors with non-PO invoices just below defined thresholds ($5 k, $10 k, $25 k, $50 k, $100 k) SEQUENTIAL INVOICES • Identify vendors that have submitted three sequential invoices PAYMENT DATE ANOMALIES • Identify invoices with date anomalies (i. e. , payment before invoice date, payment before approval date) PAYMENT TERMS • Identify vendors with system payment terms of seven days or fewer QUICK PAYMENT • Identify vendors with invoices actually paid within five days of invoice date OVER $250 K OF INVOICES • Identify vendors from which HAL, PCL, or CAU has received more than $250, 000 of invoices during the time period, for materiality • Identify instances where the invoice currency and payment currency are different INVOICE CURRENCY AND PAYMENT CURRENCY DIFF. #ALTERYX 18

NON-PO VENDOR RISK REVIEW Project Goal: Identify the highest-risk vendors within the vendor populations of each Carnival operating company Alteryx: Convert manual, sample-based procedures into an automated, repeatable workflow that analyzes entire populations 2017 Scope: 10 k vendors, 275 k invoices, over $2 bn spend #ALTERYX 18