Big Data Auditing Revisited: Context is King

It has been a few years since I wrote up on Big Data and the Audit.  It was one of the more popular posts with over a 1,000 hits to date.

The post looks at Big Data: A Revolution That Will Transform How We Live, Work, and Think by Kenneth Cukier and Viktor Mayer-Schönberger. I enjoyed the book as it really broke down the business impact of big data without getting in technical details of the underlying technology.

Why take a second look at big data auditing?

Big data and the accompanying analytical models are key a precursor to artificial intelligence. Machine learning algorithms that power the AI bots requires the users to analyse the problem and teach the underlying algorithm.

Part 1: Context is King

To make things a bit more digestible, I thought it would be good to divide the post into two parts. The first post is more palatable as I want to explore the second use case in a bit more detail and its relevance to today.  The second post will be a bit more controversial as I will take a look at the difficulty of applying fraud or cancer-fighting algorithms in the realm of (external) financial audit.

But let's look at the first issue: how can big data analytics give us better context? 

In the original post, I spoke discussed the use case used in Cukier and Mayer-Schönberger's work around Inrix. The book gives the example of how an investment firm is using traffic analysis, from Inrix, to determine the sales that a retailer will make and then buy or sell the stock of the retailer on that information. In a sense, the investment is using vehicular traffic as a proxy for sales. In an audit context, auditors can develop expectations of what sales should be based on the number of vehicles going around stores. For example, if sales are going up, but the number of vehicles are going down then the auditor would need to take a closer look.

What I realized from this example is that what big data can give auditors better context around things and assess reasonability of things. That is as more sensor data and other data are available to auditors to integrate into statistical models, the more they will be able to spot anomalies. 

One of the issues with Barry Minkow's ZZZBest accounting fraud was the lack of context. For more on the fraud, check this video:

I actually studied this case in my auditing class at the University of Waterloo. One of the lessons we were take away from this case was that the auditors didn't know how much a site restoration would cost on average (see the first bullet in this text on page 129). But how would an auditor be able to access such data? Even with the advent of the internet, it is not simply a matter of Googling for the information.

More recently, an accounting professor was found to have generated data fraudulently. The way he got caught was that a statistic he used didn't correspond to reality. Specifically:

"misrepresented the number of U.S.-based offices it had: not 150, as the paper maintained (and as a reader had noticed might be on the high side, triggering an inquiry from the journal)" [Emphasis added]

Again, the reader had the context to understand what was presented was unreasonable causing the study to unravel and exposing the academic fraud perpetrated by Hunton. 

What will it take to make this a reality? 

What's missing is a data aggregation tool that can connect to the private, third party, and public data feeds that an auditor can leverage for statistical analysis. Furthermore, for this to be useful to clients and the business community large are visualized depictions that enable the auditor to tell the story in a better way rather than handing over complex spreadsheets.

Of course for auditors to present such materials requires them to have deeper training in data wrangling, statistics and visualization tools and techniques. 

In the next post, we will revisit the first use case that I presented in the original post that explored how the New York City was better able to audit illegal conversions through the use of big data analytical techniques. Originally, I had thought this would be a good model to apply in the world of audit. However, I am revisiting this idea. 

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else

What's missing from this Top 5 uses of Blockchain list?

TechRepublic's Tom Merritt  walks us through the "Top 5" uses of blockchain in the following video. The accompanying post lists the following 5 use cases:

• Stocks
• Shipping
• Diamonds 
• Livestock 
• Law

What's missing? 

Stocks use case is actually limited to Initial Coin Offerings (ICOs). For more on an overview of ICOs, check this article. However, the post excluded Linq's blockchain that allows for the settlement of private securities.

But on a broader note, the post excluded the financial industry altogether in terms of being a forerunner for the use of blockchain. Following the hype-cycle, one of the early areas of interest for the use of the permissioned blockchain were financial institutions. It seemed like every week that a company joining the R3 Consortium.


However, since that initial fervor, a number of players, such as Goldman Sachs, Santander, Morgan Stanley and the National Australian Bank, have left the consortium.

Why?

The problem lies in understanding the actual business case for the permissioned blockchain (for the differences between public and private/permissioned, see this post). The permissioned blockchain helps parties to have a common view of transactions that they have transacted with each other via a shared ledger database. With the use of digital signatures, it incorporates authorization into this as well, so in addition to sharing information, it also enables the ability to "sign-off" on that information.

The banks could decide that they would use such a framework to make it easier to settle payments, however, how do they keep things private such as pricing and other data? This is something that needs to be sorted out but points to a bigger question as to what is the strategic advantage of blockchain for FIs. That is, this exponential technology doesn't lead to cost savings like robotic process automation or strategic insights like big data analysis.

And that's why I think something like shipping or supply chain more broadly is a much better beachhead for blockchain. With multiple partners involved in supply chain, have a shared database enables the partners to see where things are at between the wholesaler, shipper, and retailer, enabling each partner to get better insights into movement of goods and other business information. Such a system would allow for creative ways to settle payments or even enhance the ability of retailers to design consignment contracts with wholesalers. For example, BestBuy is marketplace (e.g. Brainydeal is one such retailer) within its retail front requiring such coordination. The one caveat, however, is to ensure that (cheaper) existing technology doesn't actually do this already. After all, shared databases are not a novel concept.

I would contend that legal would be a great place for the blockchain to expedite paperwork - more so than supply chain. However, such technology would be fought tooth and nail by lawyers. And they have unlimited resources to fight such technology in the courts. Also, politicians have little incentive to look into such advances as most of them are lawyers, depend on lawyers or have friends who are.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else.

What can driving algorithms tell us about robo-auditors?

On a recent trip to the US, decided to opt for a vehicle with the sat-nav as I was going to need directions and wanted to save on the roaming charges. I normally rely on Google Maps for guiding me around traffic jams but thought that the sat-nav would be a good substitute.

Unfortunately, it took me on a wild goose chase more than once – to avoid the traffic. I had blindly followed the algorithm's suggestions assuming it would save me time. I ended up being stuck at traffic lights waiting to a left-turn for what seemed like forever.

Then I realized that I was missing was that feature in Google Maps that tells you how much time you will save by taking the path less traveled. If it only saves me a few minutes, I normally stick to the highway as there are no traffic lights and things may clear-up. Effectively, what Google does is that it gives a way to supervise it’s algorithmic decision-making process.


How does this help with understanding the future of robot auditors?

Algorithms, and AI robots more broadly, need to give sufficient data to judge whether the algorithm is driving in the right direction. Professional auditing standards currently require supervision of junior staff – but the analogy can be applied to AI-powered audit-bots. For example, let’s say there is an AI auditor assessing the effectiveness of access controls and it’s suggesting to not rely on the control. The supervisory data needs to give enough context to assess what the consequences of taking such a decision and the alternative. This could include:

• Were controls relied on in previous years? This would give some context as to whether this recommendation is in-line with prior experience.
• What are the results of other security controls? This would give an understanding whether this is actually an anomaly or part of the same pattern of an overall bad control environment.
• How close is it between the reliance and non-reliance decision? Perhaps this is more relevant in the opposite situation where the system is saying to rely on controls when it has found weaknesses. However, either way the auditor should understand how close it is to make the opposite judgment.
• What is the impact on substantive test procedures? If access controls are not relied on, the impact on substantive procedures needs to be understood.
• What alternative procedures that can be relied on? Although in this scenario the algo is telling us the control is reliable, in a scenario where it would recommend not relying on such a control.

What UI does the auditor need to run algorithmic audit?

On a broader note, what is the user interface (UI) to capture this judgment and enable such supervision?

Visualization (e.g. the vehicle moving on the map), mobile technology, satellite navigation and other technologies are assembled to guide the driver. Similarly, auditors need a way to pull together the not just the data necessary to answer the questions above but also a way to understand what risks within the audit require greater attention. This will help the auditor understand where the audit resources need to be allocated from nature, extent and timing perspective.

We all feel a sense of panic when reading the latest study that predict the pending robot-apocalypse in the job market. The reality is that even driving algos need supervision and cannot wholly be trusted on their own. Consequently, when it comes to applying algorithms and AI to audits, it’s going to take some serious effort to define the map that enables such automation let alone building that automation itself.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else

Bitcoin clampdown: Towards a corporate-cryptocurrency?

WSJ reported that the Chinese government was working to shut down Bitcoin exchanges:

"China’s central bank together with other regulators has drafted instructions banning Chinese platforms from providing virtual-currency trading services, according to people familiar with the matter...regulators told at least one of the exchanges that the decision to shutter them has been made, one of the people said. Another said the order may take several months to implement."
China, however, is not the only has such issues with cryptocurrency. The US also has limited the use of Bitcoin by taxing it as a capital gain:

"Capital-gains tax rules could make using bitcoin as a currency a logistical nightmare. It meant that when U.S. citizens filed taxes, they had to account for every single bitcoin acquired, sold, or used for purchases, and the prices and dates at which those transactions happened. If you purchased 0.5 bitcoins at $360 in April 2014 and sold them for $645 on June 9, you’d have to declare that gain as a taxable event in 2015. Fair enough. But did you have to account for swings in the value if you used your bitcoin to purchase a vacation on Expedia or to order a pizza? The IRS’s move seemed to undermine bitcoin’s potential for use as a currency." Vigna, Paul. The Age of Cryptocurrency: How Bitcoin and Digital Money Are Challenging the Global Economic Order (p. 260). St. Martin's Press. Kindle Edition. 

However, the key regulatory action against Bitcoin came from the FDIC and DOJ:

"bitcoiners would report that agents from the Federal Deposit Insurance Corporation, the body charged with cleaning up failed banks so that insured depositors can be kept whole, were pressuring bank compliance officers not to work with bitcoiners. It’s hard to verify this claim. The FDIC had long communicated its concerns to bankers over supposedly high-risk categories of merchants, and bitcoin businesses were told by bank compliance officers they were included in those groups...

The U.S. Department of Justice, too, sent banks messages that contradicted FinCEN’s accommodating message. In 2013, the DOJ launched an initiative known as Operation Choke Point, in which it investigated banks dealing with merchants in businesses that weren’t necessarily illegal but were considered high fraud risks. Miami-based lawyer Andrew Ittleman, who has become something of an accidental expert on the subject, told us that Operation Choke Point now occupied most of his time and that primarily his clients were legal providers of bitcoin services and medical marijuana, along with a few pornographers and gun dealers. The law was having a chilling effect: banks might not be breaking the law by servicing such businesses, but the risk of an audit from the DOJ was enough to dissuade them from doing so. Ittleman fought hard for his clients, who were denied a vital instrument of financial access, but it was an uphill battle. The matter, he said, should be taken up to the Supreme Court by civil rights activists such as the American Civil Liberties Union." (ibid p. 258-259)

Why are governments so worried about Bitcoin?

The WSJ article cited above gives a clue:

"Beijing’s crackdown on bitcoin is part of a broader effort to root out risks to the country’s financial system. Officials earlier this year circulated a draft of anti-money-laundering rules for bitcoin exchanges, a powerful warning, even though the regulations were never formalized, according to people familiar with the matter...Virtual currencies in theory allow holders to bypass China’s traditional banking system to move money outside its capital-controlled borders. That could make it more difficult for Chinese regulators to maintain a tight grip on the yuan." [Emphasis added]

Cryptocurrency has its roots in the anarchist activists and others who saw Bitcoin as a way to challenge the power of banking sector. Given that Bitcoin had its debut during the Financial Crisis, it may have been reasonable to believe that there would be sufficient groundswell to believe that the cryptocurrency would gain popularity.

However, popularity in the realm of currency and capital is not sufficient to change institutional realities of societies. 

The reality of societies today is that financial institutions, and corporations more broadly, represent institutions that keep the society together. Since they hold the keys of the society, ultimately they will control the change that will proliferate through society. And something that undermines the ability of the society's today to control capital flows is pretty much a national security issue - and can expect a response that reflects that reality. In other words, it was reasonable to expect the Empire to Strike Back as they did. 

Can we ever expect a corporate-sponsored cryptocurrency? 

Given the way power works, the only ones that can really challenge banks' hegemony are other corporations. For example, Walmart teams up with generic drug makers (in competition with expensive brand-name alternatives) to reduce the healthcare benefits they pay to their employees.

One requirement would be to have direct access to customers so they can actually convert their cash into that digital currency. For example, online realtors are dependent on banks and their electronic payment networks to essentially get cash into the system. 

So likely a retailer alliance could be something that poses a challenge to banks and their networks. 

Amazon already has Amazon Coin, but I think that if they teamed up with Walmart you would have something that basically has wide acceptance. And that's when the games will begin.

Retailers also have an incentive to cut-out the banks and save those credit card fees. However, for this to have user acceptance the retailers would need to give their consumers a cut. 

But would this be a true cryptocurrency? 

Such a currency would likely take a permissioned or private blockchain route. Essentially, there will be a need for 'independent verifiers' (instead of miners) that will ensure that the transactions are properly accounted for. This is likely cheaper than using miners which are costly in terms of the energy costs that have to be paid. 

Although I think external auditors could play the role of the independent verifier, these systems can be highly automated and an assurance model can be developed where you have real-time assurance as the source documents would be digital. This is assuming that the cryptographic keys can be relied on for such a purpose and auditors are able to get "effortless" access to such evidence and systems. So it may lead to a renaissance in the audit but may help auditors realize their potential within the field of audit data analytics and more broadly as data scientists. 

This speaks to one of the key aspects of automated audits that I raised in this post. As promised, my plan is to delve deeper on this topic, where we can look at how blockchain can facilitate AI or automated audits. 

Ultimately, banks play a critical role in extending credit which essentially makes them gatekeepers of the consumer economy. However, other companies, largely the tech sector, are hoarding cash:

Courtesy of Business Insider

So the question is whether these non-banks could move into bank territory. For example, Rogers Wireless (cell phone provider) is also a bank. That being said, it likely won't be a revolution but could be something that evolves over time that steadily erodes bank power. However, that would mean that the banks would take this lying down and I don't think that the Empire will go out without a fight.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else

AI and the Audit: What does a robot need to audit your numbers?

In the previous post, we examined the value propositions that Appzen's AI brings to auditing expense reports.

In this post, we analyze what insights we can extract from Appzen when it comes more broadly to applying AI to the external financial audit.

The following gives a refresher on how the Appzen AI audit works:

Based on this we look at a number of factors that exist in this process to develop

Standardized process:
The expense report process that has been fairly standardized for over a decade: employees submit a digitized report of what they spent, expense codes, commentary and all the supporting documentation (e.g. receipts, invoices, etc.).  This is similar to how factories needed an assembly line before they could be automated.

Standardized capture and presentation of audit evidence:
I think this is a key piece: the actual audit evidence (i.e. receipts) must also be included in what's submitted to the auditor. As the evidence is provided in a standardized format, it enables machines to analyze these digitized source documents to run the necessary correlative models to run the risk scores and enables the automated analysis.

Audit evidence retains its chain of custody through the digitization process:
The auditor does not need to expend additional resources verifying that the evidence actually relates to the item being audited, nor do they have to expend additional resources ensuring that the independence of the evidence wasn't lost through digitization process. For example, when receiving a bank confirmation the auditor needs to ensure that this received directly from the bank and not the client.

Evidence provider identity is verified and contractually obligated to follow-up with the auditor:
The party submitting the audit evidence, the employee, has been verified in the system through the employee onboarding process. The implication of this is that the auditor doesn't have to expend audit resources confirming the identity of the evidence provider. Secondly, and perhaps more importantly, the auditor doesn't have to expend significant resources following up with the evidence provider. For example, not all customers will respond to accounts receivable confirms and then auditor will have to perform alternate procedures.

Evidence provider has incentives to produce the proper evidence: 
The previous point is closely related to the issue of incentives: if the employee fails to provide evidence then they will not be reimbursed. This puts a strong incentive on the employee to provide the evidence in a timely manner.

Provider of the evidence is trained on providing evidence:
The employee has been trained to provide complete, accurate and valid evidence. They also have access to help if they have issues with submitting expense receipts or understanding whether that evidence will be accepted.

Violations can be clearly defined and examples of violations can be taught to the system:
For fraud or errors to be flagged there needs to be rules that can be fed into the system to identify whether the item submitted needs further review or audit. For example, if the amount on the receipt doesn't match this would be flagged and has a high likelihood of error. But more importantly,  the examples of violations identified can be fed into the system to teach the system (via machine learning) what to look for.

In a future post, we will use these factors to look at how easily (or not) AI can automate financial audits.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else

AI and the Audit: Why hire a Robot as your Auditor?

On this blog, we've covered the topic of exponential change and how audit/accounting is prone to such forces.

Despite this, I am tempted to say financial auditing is different. It's not like factory work or more controversially like the pharmacist profession where AI claims to offer a safer alternative to dispensing medication.

But does that make me just one of the people who think that their profession is unique because they are in the midst of seismic change but refuse to see the writing on the wall?

At the same time, I don't want to come across as an alarmist claiming that the world is going to end when it really isn't.

It's the challenge of nuance.

While trying to figure out how to tackle this challenge, I came across AppZen; an app that uses artificial intelligence to audit expense report. It was identified in this post as being one of the game-changers in the fintech scene and was also featured in Accounting Today.

According to the company's website, the application "combines computer vision, deep learning, and natural language processing to understand the full context of expenses, not just amounts, dates, and merchant names. ReceiptIQ detects unauthorized charges in real-time from receipt images, boarding passes, travel documents, cell phone bills and any other expense documentation. Cross-checks expenses in real-time against thousands of external and social sources to determine if they are legitimate and accurate... Real-time identification of unauthorized upgrades in airlines, hotels and car rentals as well as out of policy claims for hotel laundry, alcohol purchases, cell phone charges and more."

Reviewing the company's video, I was able to extract the following value propositions:

• "100% Testing":  I put it in quotes on purpose because the idea is that the whole population is analyzed but only the high-risk ones are further analyzed. That is, this is still "examining on a test basis" but uses a risk based approach to identify what reports should be further examined. This is in contrast to the manual approach of sampling.  
• Automated exception analysis: Closely connected to the previous point, but to emphasize that there is an automated review of the population.
• Real-time analysis: Reports can be analyzed instantaneously. Although not explicitly identified in the video, this could have real world savings. Faster reviews - leading to faster reimbursement to employees - could reduce the overall amount owing on corporate credit cards thereby offering more favourable position with the credit card companies. 
• Seamless integration into existing processes: Add-on to an existing process is a much easier sell than an app that requires replacing the existing app you may have just bought.  
• Use of external data: The app uses 100s of external data sources to develop. It seems that this assists in building an expectation of whether the expense needs further analysis. 
• Limited false positives: Not explicitly stated, but it is strongly implied that the number of reports that need to be reviewed is few - meaning it's not flagging reports that are valid.   
• Reduction of audit costs and fraud: Finally, the app promises greater efficiency in the use of audit resources deployed and greater effectiveness in catching fraud. 

When looking at these benefits of AI-enabled automation, they are based on certain assumptions that may exist in the expense report realm but not in the external audit realm. For example, accounting records at a company are not normally accompanied by a digitized copy of the source document (e.g. invoice, receipt, etc.) that provides evidence of its validity, accuracy, etc. of that accounting entry. 

So which of these assumptions applies in the world of external financial audits? 

This will be the topic of the next post where I will develop a list of factors that enabled expense report to by automated by AI and see if they apply to our world. 

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else

Blockchaincanada.org: The inaugural meetup

Just finished attending a meet up sponsored by www.blockchaincanada.org. The room was filled to capacity - illustrating the excitement around the disruptive technology right here in Toronto. 

Alan Wunsche, co-founder of the organization, walked through the road map of the non- profit organization, which looks at multiple initiatives to raise the profile of blockchain in Canada and prevent the departure of luminaries in the field, such as Vitalik Buterin (Alan wasn't so specific, but I decided to read between the lines).

The organization is driven by community, and the thoughtware to be produced by the group will rely on the volunteers. For example, I volunteered for the accounting working group to explore Canadian initiatives around triple entry bookkeeping and alternative accounting models.

For those interested, in a deeper dive into blockchain checkout their blockchain hackathon this weekend.