Interested in this topic? Visit the links below for more resources:
Visit The IIA's website or YouTube channel for related topics and more.
00:00:02 Speaker 1
The Institute of Internal Auditors presents all things internal audit tech.
00:00:06 Speaker 1
In this episode, Earnest Annunciation and Tom Keaton discuss the evolving role of fraud analytics in internal auditing. They'll cover how data analytics and AI can improve fraud detection and prevention, along with the challenges and practical strategies for success.
00:00:24 Speaker 2
Hey.
00:00:25 Speaker 2
I maybe just a little bit of an intro, Tom.
00:00:28 Speaker 2
Appreciate everybody listening in to today's episode where Tom and I are going to talk about fraud analytics, but maybe it's, I think it's a good idea for us to just get acquainted with the audience.
00:00:38 Speaker 2
I'll start off and then hand it over to you, Tom.
00:00:41 Speaker 2
I'm ernison I I lead our product marketing function here at Mindbridge analytics.
00:00:47 Speaker 2
I've been in the software game for going on about 10 years now. However, prior to that I was a chief audit executive.
00:00:54 Speaker 2
So I spent a better portion of my career about 15 years doing everything.
00:00:58 Speaker 2
Maybe I'm dating myself, Tom, by saying I started my career off as an intern when Sarbanes-Oxley came into the fold in 2002.
00:01:06 Speaker 2
But yeah, have kind of seen everything.
00:01:09 Speaker 2
From, you know, socks enterprise risk management, starting internal audit groups from the ground up got into risk advisory services and public accounting at some point.
00:01:19 Speaker 2
Then got into tech so.
00:01:22 Speaker 2
That's a little about me, but I'm very happy to join you today on this episode.
00:01:27 Speaker 2
You want to give them a little bit of background on yourself.
00:01:30 Speaker 3
Yeah.
00:01:30 Speaker 3
And excited as well and looking forward to to talking a.
00:01:34 Speaker 3
Bit.
00:01:34 Speaker 3
But yeah, just a little bit about.
00:01:36 Speaker 3
I am a director of internal audit at Crown Castle.
00:01:39 Speaker 3
I've been in internal audit in some way, shape or form my entire career, going back to the early 2000s, so I'll date myself just as much as as as you did on the on the early Sox years, Ernest and my.
00:01:50 Speaker 3
Across my various experiences and stops along the way, have all included technology in some way, shape or form and risk and advisory. Currently I do.
00:02:00 Speaker 3
Lot of work in the space of automation analytics starting to thread.
00:02:06 Speaker 3
Some of the new technologies and then a good bit of my day.
00:02:07
Down here.
00:02:12 Speaker 3
Broad investigations risk and what not so really excited to dive in and and and see how we overlap in those spaces.
00:02:19 Speaker 2
Yeah, I I bet you have some phenomenal stories to.
00:02:24 Speaker 2
But before we get to those, maybe let let's just start with the basics. When you're when you're thinking about fraud and you mentioned some cutting edge technology like data analytics and automation AI.
00:02:38 Speaker 2
How have some of those?
00:02:39 Speaker 2
Kind of changed the game for internal auditors over the over the course of time.
00:02:44 Speaker 2
Have you seen it?
00:02:46 Speaker 3
Yeah, that's a great question. And and and I would say it's it's it's in two ways is the way I would answer.
00:02:52 Speaker 3
One is not nearly enough because you you hear all the technology and from probably a solid gosh I'd say maybe a decade or more, you would hear about using data analytics to do internal audits and different things.
00:03:05 Speaker 3
When you really talk to people, did anyone?
00:03:07 Speaker 3
Do it like there was very few that would would do anything other than maybe pulling population, selecting samples, but truly doing a lot of.
00:03:15 Speaker 3
Work through data analytics was kind of a Unicorn, wasn't it?
00:03:19 Speaker 3
Very often, and sometimes it felt like a mess.
00:03:22 Speaker 3
So there was a little bit of head banging on the on the desk a little bit. We were trying to figure out, you know, how to use these technologies and these theories, but then I'd say within the last couple years, we're starting to see some breakthroughs and and.
00:03:34 Speaker 3
I think that a lot of that goes to data.
00:03:36 Speaker 3
Way organizations are actually going through that digital transformation and creating a more digital organization.
00:03:44 Speaker 3
Have just again dating ourselves one more time, more, more digitally forward. People entering the workforce. They're used to having data at their fingertips and wanting certain types of data and and and then the tools are just starting to be be phenomenal.
00:04:00 Speaker 3
You no longer have to be the.
00:04:02 Speaker 3
Expert.
00:04:04 Speaker 3
Code writer to be able to build something. A lot of our drag and drop or.
00:04:08 Speaker 3
You.
00:04:09 Speaker 3
You do right, right.
00:04:11 Speaker 3
Gen.
00:04:11 Speaker 3
You're able to write it what you want to do, and it can give you some code that you can use so so really starting to see some some fascinating breakthroughs there. And I think we're just at the beginning.
00:04:21 Speaker 3
Really going to start taking off in a way that is going to seem like futuristic to to us today.
00:04:27 Speaker 3
Probably going to be just.
00:04:29 Speaker 3
A few weeks to a year or two away from now.
00:04:32 Speaker 2
Yeah, I 100%.
00:04:34 Speaker 2
And I remember a time where on an Excel spreadsheet you were limited to 65,000 rows.
00:04:44
That's right.
00:04:45
And so.
00:04:45 Speaker 2
When big data and data analytics kind of came about and you know that was such a buzz word, I want to say 15 years ago.
00:04:53 Speaker 2
As a CAEI had a mandate where I said every audit we do, whether it was an insurance audit or compliance audit, an IT audit.
00:05:01 Speaker 2
You have to have an element of data analytics.
00:05:04 Speaker 2
But we didn't know where to start, so we actually were building.
00:05:09 Speaker 2
Microsoft Access databases to test entire populations of transactions, and even then, the populations probably weren't more than you know, a couple 100,000.
00:05:20 Speaker 2
So how do you really get?
00:05:21 Speaker 2
So there's a quote out there that says that the data explosion.
00:05:26 Speaker 2
Is at this exponential.
00:05:27 Speaker 2
It's not just doubling over the course of 18 months or so. It's almost like tripling and and and it's just going to keep getting bigger.
00:05:34 Speaker 2
So from your perspective, how does?
00:05:39 Speaker 2
Let's put it to the lens of fraud.
00:05:41 Speaker 2
And how does fraud and analytics kind of fit into the bigger picture of how you see organizations managing their overall risk?
00:05:51 Speaker 3
Yeah, I I I love this topic.
00:05:53 Speaker 3
Mean with with?
00:05:54 Speaker 3
I deal with day-to-day on our our risk management side as well as you know fraud not just.
00:06:00 Speaker 3
Investigation but also detection, prevention and so forth.
00:06:04 Speaker 3
Data is is woven all through all.
00:06:06 Speaker 3
Throughout that, for me it's also it's it's it's a tough, a tough kind of Riddle to crack from a investigation perspective, if you get an allegation, you can you you you have a concrete claim to go off of or some some tip that you can look into.
00:06:23 Speaker 3
It gives you a head start and once you have a head start you know you can take a look at some vendor analytics.
00:06:28 Speaker 3
Can see who's popping out as maybe a somebody guiding most of their work to a certain vendor.
00:06:33 Speaker 3
Happens to be maybe giving them a kickback on the side.
00:06:36 Speaker 3
Or do we have a certain vendor that's coming back and doing change orders and rework to to slowly increase the the cost in which you're?
00:06:43 Speaker 3
Paying so so to me, what I call those investigative analytics, those are ones that I have some dashboards built or some queries that we run that we can do standard that's gonna give you a a profile so to speak of that that specific claim.
00:06:59 Speaker 3
Where? Where I've had some difficulty over the years and and others that I've talked to is the the predictive or the identifying analytics that you can go and you can run certain queries and using data warehouses and different.
00:07:12 Speaker 3
Different. Umm.
00:07:14 Speaker 3
Data sources to be able to say, hey, this is starting to look funny.
00:07:18 Speaker 3
Starting to to play kind of outside the lines a little.
00:07:20 Speaker 3
Maybe we should go and look into this project manager or this vendor or this construction project that's been tough.
00:07:29 Speaker 3
That's a little bit harder because the data's coming from all over the.
00:07:32 Speaker 3
It's a little bit of a a, a different way of thinking from an audit perspective to to be predictive so.
00:07:39 Speaker 3
So we're starting to try to find a way to dabble into that space, but using analytics, once we kind of have a place to look has been a huge boost to our product.
00:07:47 Speaker 3
Our success rate to being able to either substantiate or even refute the claim.
00:07:52 Speaker 3
Don't always want it to be right.
00:07:53 Speaker 3
Hope it's not.
00:07:54 Speaker 3
The claim isn't always right, but it's given us more confidence in our conclusions by being able to be data-driven to get those investigations off the ground.
00:08:04 Speaker 2
So when a claim does come in, maybe through a whistleblower or ethics hotline.
00:08:09 Speaker 2
Do you operate under the guise of innocent until proven guilty or the opposite?
00:08:15 Speaker 3
That's a great question because you know, I I never thought about until I took a more formal training probably 10 years ago and.
00:08:24 Speaker 3
I take it as almost innocent until proven guilty and so.
00:08:29 Speaker 3
For me, I think that's that's also a a, a mentally cleansing approach because when when you're an internal water, all you see typically is back.
00:08:38 Speaker 3
Right, it's it's let's go in and and and find the problem here.
00:08:41 Speaker 3
The problem?
00:08:42 Speaker 3
How do we fix this?
00:08:44 Speaker 3
Investigations the same.
00:08:45 Speaker 3
So you layer bad on bad, on bad you always you know you you you wanna feel some good somewhere, right?
00:08:50 Speaker 3
So so for me, I I like to be able to go in with that mindset of.
00:08:55 Speaker 3
We've got this claim here.
00:08:57 Speaker 3
Let's let's I'm I'm hoping it's not not legitimate.
00:09:00 Speaker 3
And take it from that standpoint now.
00:09:02 Speaker 3
That that.
00:09:03 Speaker 3
Rate on that's not terribly high. Usually claims are pretty.
00:09:08 Speaker 3
They're pretty credible for the most part.
00:09:09 Speaker 3
Usually something there, but yeah, that that's the.
00:09:12
Yeah.
00:09:12 Speaker 3
That's the method I like to follow. How about?
00:09:14 Speaker 3
What? What kind of mindset do you have in those situations?
00:09:18 Speaker 2
Oh, I'm. I'm gonna take the consulting route and say it depends.
00:09:22 Speaker 2
It depends on.
00:09:23
Yeah.
00:09:24 Speaker 2
It depends on.
00:09:25 Speaker 2
The claim is how far fetched it it could be.
00:09:32 Speaker 2
You know, I've seen some crazy things in my time at audit and we'll save some of the stories for later.
00:09:40 Speaker 2
I agree with you, Tom.
00:09:41 Speaker 2
I think innocent until proven guilty, right? It just.
00:09:44 Speaker 2
That that you gotta have some sort of compassion.
00:09:48 Speaker 2
It right.
00:09:49 Speaker 2
I don't think internal auditors are and that's the reputation that kind of precedes us.
00:09:54 Speaker 2
We're we're we're the.
00:09:56 Speaker 2
We're looking for the bag.
00:09:58 Speaker 2
We're cops, but we're like internal affairs and we're looking.
00:10:01 Speaker 2
No, that's not the case. We are.
00:10:02 Speaker 2
We are charged with.
00:10:05 Speaker 2
Helping the organization.
00:10:09 Speaker 2
With change management and protecting shareholder value and and that's what we wanna do.
00:10:14 Speaker 2
Through our risk analysis, our risk assessments.
00:10:19 Speaker 2
That's why I always love doing more advisory type work, right?
00:10:23 Speaker 2
I knew my team was being successful.
00:10:25 Speaker 3
Absolutely.
00:10:25 Speaker 2
I knew.
00:10:26 Speaker 2
Team was being successful when A/C suite.
00:10:29 Speaker 2
Executive came to me and said, Ernest, I would love for you to take a look at this process.
00:10:35 Speaker 2
Just doesn't seem to your point earlier. Something seems off.
00:10:38 Speaker 2
Doesn't seem.
00:10:39 Speaker 2
Can you come in?
00:10:40 Speaker 2
Give us an.
00:10:41 Speaker 2
Give us an independent objective.
00:10:44 Speaker 2
Opinion or recommendations on what we could do better.
00:10:47 Speaker 2
Were my favorite audits to do for sure.
00:10:50 Speaker 2
Tom, I do want to go back to what you're talking about, like some of some of the difficulty when when you look when you're trying to find trends and you're trying to.
00:10:56 Speaker 2
Patterns now.
00:10:58 Speaker 2
When you get a claim that I feel like that's a lot easier because.
00:11:01 Speaker 2
It's like.
00:11:02 Speaker 2
You know what you're looking for?
00:11:04 Speaker 2
Versus if you have vast amount of data, right?
00:11:06 Speaker 3
Certainly.
00:11:07 Speaker 2
Think about all the different systems.
00:11:10 Speaker 2
Within your organization, ERP, payroll systems, data warehouses, data lakes.
00:11:16 Speaker 2
Etcetera gls.
00:11:18 Speaker 2
What other kind of red flags would you recommend people look out?
00:11:24 Speaker 2
Maybe it's not a red flag immediately, but you know where there's smoke, there's fire.
00:11:29 Speaker 2
Like.
00:11:29 Speaker 2
What are some of those warning signs? People should be looking for?
00:11:33 Speaker 3
Yeah, that, that, that's. That's again, that's like looking through the crystal ball to find those answers, right.
00:11:37 Speaker 3
That's such a.
00:11:38 Speaker 3
And the other piece to that whole puzzle was even if you know what those those may be, I I don't know how many internal audit compliance functions are out there that have.
00:11:47 Speaker 3
Have the staffing and the budget to be able to build those complex models that potentially going to.
00:11:54 Speaker 3
Give you those answers so so I'll start off with a super big cop out of it's really hard.
00:11:59 Speaker 3
And every business is different. But but but it's all on how you look at it and something that we've been really trying to develop over the.
00:12:06 Speaker 3
Even.
00:12:07 Speaker 3
It's just from a concept to make us think a little bit differently. It is.
00:12:13 Speaker 3
I'll use a vendor.
00:12:14 Speaker 3
Let's say there's some potential corruption with the vendor that we're trying to find, right?
00:12:18 Speaker 3
Don't have a tip, but we're trying to find is there something there?
00:12:21 Speaker 3
Mentioned over usage by a single person, but we want to think more broadly and almost come up with kind of like a hit list, A hit matrix or something like that where maybe we have a suite of.
00:12:33 Speaker 3
Ten different analytics that looks like percentage of spend change orders.
00:12:37 Speaker 3
Many POS have gone in.
00:12:39 Speaker 3
Take take your.
00:12:40 Speaker 3
You know all of these different litany of things that on the surface, an individual singular.
00:12:46 Speaker 3
That you might run may not give you.
00:12:50 Speaker 3
A.
00:12:50 Speaker 3
A that red flag that you're looking for, but if you take the look at that, those those top 10 or whatever that number is, then you can kind of add some weights and measures to them. And then you look at them and.
00:13:00 Speaker 3
And you can score them.
00:13:01 Speaker 3
Their.
00:13:02 Speaker 3
Other vendors and doing the same type of work in the same areas that you might be able to eventually start pulling out some things that.
00:13:10 Speaker 3
That, that, that can give you some places to.
00:13:12 Speaker 3
Now, I'm also fortunate within my group my I I oversee the fraud piece, but it's also within internal audit. I know sometimes those are split out so so for the instance, if we if we're going through something like that and we see that we have a couple of.
00:13:26 Speaker 3
On something or.
00:13:28 Speaker 3
Some again, this is more conceptual and in practice, at this point for us, but as.
00:13:32 Speaker 3
Fours maybe pick up.
00:13:33 Speaker 3
That might allow us to say, hey, we, we should go do a construction audit of this project in this city.
00:13:39 Speaker 3
Something might be off here.
00:13:41 Speaker 3
Go take a.
00:13:41 Speaker 3
Or maybe we send a survey out to see if there's a way to to get some people to prompt.
00:13:46 Speaker 3
It's a fraud training. We go out to that, that part.
00:13:49 Speaker 3
Try to just poke our nose in there to see see if we can find.
00:13:53 Speaker 3
A little bit more within with within that group or area or vendor, but it's really challenging.
00:13:58 Speaker 3
Know my organization isn't terribly.
00:14:01 Speaker 3
So you know, we don't manufacture things we don't.
00:14:04 Speaker 3
Sell items were not really, you know, consumer driven in that.
00:14:08 Speaker 3
So so it gets to be more challenging there to be able to find some of those things we're not dealing with inventory or shrinkage or things along those lines, but it definitely gives you the mental challenge to kind of give you the the creativity to go in and.
00:14:21 Speaker 3
Different ways to slice the data to.
00:14:23 Speaker 3
To kind of turn it on its side and find some interesting details there.
00:14:27 Speaker 2
So Tom, would it be fair to say that what you're mentioning some of these dashboards is that akin to continuous monitoring or are those dashboards really just early warning signals?
00:14:39 Speaker 2
How do you think about that? And then where do you think continuous monitoring?
00:14:44 Speaker 2
Plays a role within fraud and analytics.
00:14:47 Speaker 3
That's a great jump.
00:14:49 Speaker 3
This is going to sound so the advent of dashboards like that's like a that's such a pervasive concept. Now in the last interactive dashboards I should say, right?
00:14:59 Speaker 3
Is such a pervasive concept that's really taken hold in probably the last five or six years with.
00:15:04 Speaker 3
With some of the different softwares coming out like Tableau being one now power BI is kind of all over the place as well.
00:15:10 Speaker 3
You know, I look at those as more informational and monitoring, you know, continuous monitoring in a way, sure.
00:15:18 Speaker 3
But to me, a continuous monitoring process is something that's going to be running in the background and.
00:15:24 Speaker 3
You know transaction hits AB and C attributes.
00:15:28 Speaker 3
I'm getting an e-mail or a text message or an.
00:15:31 Speaker 3
It's like, hey, we got to go look at this and it gets you out of your chair pretty quick and you go and take a look and you spin up an audit or something on those lines.
00:15:40 Speaker 3
Whereas when it comes to the dashboarding pieces, I think that's more. How's my business running.
00:15:43 Speaker 3
Am I?
00:15:44 Speaker 3
Am I in control?
00:15:45 Speaker 3
I can show you some stuff but but to me it maybe I just haven't been able to crack that code when it comes to looking at some of those dashboards, but I use those specifically for.
00:15:56 Speaker 3
Operating within an investigation, so once in an investigation I have the details on what we're looking at.
00:16:03 Speaker 3
Those are extremely valuable because now you can, you know, click and filter and sort to be able to show different highlights and then you can see some of the outliers outliers based on the criteria that you're inputting, whereas the continuous monitoring, I feel like they're actually out there.
00:16:17 Speaker 3
Bots are looking for the outliers in alerting us to those to go and take a look at.
00:16:23 Speaker 2
Yeah. And one of the best analogies I use in explaining continuous monitoring to folks is.
00:16:31 Speaker 2
Think about your credit card.
00:16:32 Speaker 2
Let's say you're traveling to Erie, PA, and you've never been there before.
00:16:38 Speaker 2
And you go to the local hardware store and you run up a a $500 charge.
00:16:43 Speaker 2
What's going to happen?
00:16:45 Speaker 2
Your cards declined because you know those financial services or credit card companies, they and the point of sale systems and everybody have so much sophisticated.
00:16:53 Speaker 2
In terms of.
00:16:55 Speaker 2
Patterns and behaviors and where you've been shopping and the minute your transactions decline, that's what continuous monitoring is, so.
00:17:04 Speaker 2
I want to dig in a little bit in in terms of the analytics that you use within your investigations. Can you talk about, you know, do I need to learn programming language to set up some of those types of queries?
00:17:18 Speaker 2
What kind of skill sets do you have, and what do those analytics look like?
00:17:23 Speaker 3
Yeah, another great question. And and for me, like I said I I got, I got lucky in my career and that that allowed me to kind of get into some of that stuff early on. And even if it was just using some basic Excel functionality that at least.
00:17:37 Speaker 3
The thought process into your head.
00:17:39 Speaker 3
On on how some querying and different things might work but but I will say.
00:17:44
We.
00:17:45 Speaker 3
Had to hire on some special help for that.
00:17:47 Speaker 3
So, so we, we we made the decision probably four or five years ago that analytics was the future for audit in every sense of the word, be it investigative support, risk assessment, audit so on.
00:18:00 Speaker 3
So forth.
00:18:01 Speaker 3
And you know, we tried to tend to do a one step, 1 foot in approach.
00:18:05 Speaker 3
So we had, I think at the time we had maybe a ten person shop.
00:18:09 Speaker 3
So we're like, hey, we'll take one person out.
00:18:11 Speaker 3
And put that person into an analytics role.
00:18:15 Speaker 3
We were able to.
00:18:16 Speaker 3
Of do a proof of concept to show that at.
00:18:18 Speaker 3
We got some some support there, but we also realized like we're all we were trying to do is obvious, kill an auditor that had some experience in there.
00:18:21
Thanks.
00:18:25 Speaker 3
So we.
00:18:26 Speaker 3
We got proof of concept and eventually when we hired somebody who had the right skill set.
00:18:31 Speaker 3
Not an auditor by trade, but but had some background of, you know, business, finance, understanding some of the inner workings of a normal organization.
00:18:41 Speaker 3
But it wasn't until we had somebody who had that sophistication, Ernest, he was able to, to truly bring that professionalism to to us.
00:18:47
Yeah.
00:18:50 Speaker 3
So while there's ways, I think you can limp through and you can you can do some things that are going through Excel or a power BI. That's not terribly.
00:18:58 Speaker 3
Sophisticated. That's that your average user could build.
00:19:03 Speaker 3
To me, I think it's really important to have have that dedicated skill set to allow you to build that, and we even went that phase.
00:19:12 Speaker 3
Of outsourcing. You know we, we we got some good good.
00:19:16 Speaker 3
Relationships with some firms that had that and we kind of went haunted and pecked through to find the right ones in the right ways with the right tools and technology and how we could transfer all of those. I'm sure you deal with with some of that in your.
00:19:28 Speaker 3
These days too, and and and and we were again really successful, but.
00:19:32
All time.
00:19:33 Speaker 2
All time.
00:19:34 Speaker 3
And that's something I tell tell people a.
00:19:35 Speaker 3
That's that that are new to trying to build out this this program with them.
00:19:40 Speaker 3
Don't afraid to call for help.
00:19:43 Speaker 3
You got to start there and that way you learn and you can see where it goes.
00:19:46 Speaker 3
You can build a foundation that way.
00:19:49 Speaker 2
Absolutely. I mean, you talk about that skill set and I joked earlier, but I was actually being real that, you know, building an access database to do my testing at at the time, you know, I took a basic sequel database course in undergrad and thought.
00:20:04 Speaker 2
I.
00:20:04 Speaker 2
Write my own queries for it but.
00:20:07 Speaker 2
It it got to a certain point where I'm like, oh, I don't know how to do this join properly.
00:20:11 Speaker 2
So I would go off into our IT department and talk to Adva and say, hey, here's what I'm.
00:20:18 Speaker 2
To do.
00:20:18 Speaker 2
And and can you help build it?
00:20:20 Speaker 2
I'm starting to see a lot more as I talk to other folks in the profession. You you mentioned earlier, you know, hiring people with different skill sets.
00:20:28 Speaker 2
I can teach somebody how to audit.
00:20:31 Speaker 2
It's not rocket.
00:20:32 Speaker 2
I mean, sometimes it can be.
00:20:34
Yes, yes.
00:20:35 Speaker 2
But you know some of the.
00:20:36 Speaker 2
Of the joys I had in my career were.
00:20:40 Speaker 2
We're doing rotational programs and getting people from the business to come join my team for a six month rotation cause. Again, I can teach an engineer how to be an auditor, but I can't teach an auditor how to be an engineer and.
00:20:56 Speaker 2
You know, getting them kind of that well-rounded experience, those were some of the.
00:21:00 Speaker 2
For the.
00:21:01 Speaker 2
Let's shift gears a little bit and.
00:21:04 Speaker 2
Artificial intelligence. AI. Are you using it as part of your fraud investigations or your analytics?
00:21:12 Speaker 2
I don't know what your company's stance is. If they're for it, if they're against it.
00:21:16 Speaker 2
Yeah.
00:21:17 Speaker 2
Mean talk to us a little bit about.
00:21:19 Speaker 2
Your usage of AI, if there is any.
00:21:22 Speaker 3
Yeah, it's low. It's.
00:21:24 Speaker 3
I mean, to me, it's still a little.
00:21:24
OK.
00:21:26 Speaker 3
We don't have any anything, you know, like a private GPT type ring or anything in there.
00:21:31 Speaker 3
So throwing data in is a big strict no no for us as I think it is for many, many organizations right now.
00:21:38 Speaker 3
But I'm really, really excited about.
00:21:40 Speaker 3
I'll be curious to hear, hear, hear some of your thoughts.
00:21:43 Speaker 3
From where you're seeing AI implementation here? Because again, my head thinking, you know, down the road, future thought is once we are able to start leveraging some of these.
00:21:52 Speaker 3
And I was doing an investigation early this morning and.
00:21:55 Speaker 3
Going through emails over and over and looking for it's like all I'm thinking is if I could just throw some sort of AI bot on this thing and have almost a Gen. AI type conversation like this is the investigation.
00:21:57
I'm.
00:22:09 Speaker 3
Is what I'm looking at.
00:22:10 Speaker 3
Is the time frame.
00:22:11 Speaker 3
And and let this thing just go wild on AO365 PST file.
00:22:16 Speaker 3
What saved me so much time that is.
00:22:18 Speaker 3
Me.
00:22:19 Speaker 3
Longest amount of time and it's it. When I first started doing investigations, you would look at emails you'd like.
00:22:24 Speaker 3
This is.
00:22:24 Speaker 3
You're getting this peek under the covers of all this stuff. Now. I've been doing it for so long, you're like.
00:22:29 Speaker 3
Hate this it takes forever.
00:22:31 Speaker 2
It's not.
00:22:31 Speaker 3
I just want to push a button.
00:22:33 Speaker 3
Let it be done.
00:22:33 Speaker 2
Yes.
00:22:34 Speaker 3
So yeah, so we we're we're in infancy on trying to use.
00:22:37 Speaker 3
We do use some of the stuff a little bit more on the audit side, but but I'd be curious to see what you're seeing with within your experience and your client base that, that, how that's gonna.
00:22:46 Speaker 3
And it's the.
00:22:47 Speaker 3
Around here.
00:22:48 Speaker 2
Yeah. So I'll preface the conversation with, you know, there are multiple flavours of of artificial intelligence. And I think in fact, no, I know generative AI. So things like ChatGPT or Llama, etcetera copilot for Microsoft.
00:23:07 Speaker 2
Generative AI, in my mind, is more of a productivity.
00:23:10 Speaker 2
Suite. It can do things that humans can do, but at a rate so much faster.
00:23:17 Speaker 2
Hey, write me an e-mail to the CEO of this.
00:23:20 Speaker 2
And I want to pitch my product to them and then you can iterate on it, right and so.
00:23:25 Speaker 2
I see a ton of value from a productivity standpoint.
00:23:29 Speaker 2
Let me give you a perfect example, Tom.
00:23:31 Speaker 2
I was helping one of our sales people with some account planning and I told them I was like, hey, go download their publicly traded go download their annual report.
00:23:40 Speaker 2
Or attach it to ChatGPT and have it summarize the key risks.
00:23:45 Speaker 2
For it and it did it in a matter of seconds.
00:23:48 Speaker 2
Right. So to your point of of your example of having to comb through emails and document tape, I I don't know whether I mean the future is so bright.
00:23:58 Speaker 2
What what AI is? However, I understand the risk that it introduces.
00:24:04 Speaker 2
And why certain organizations may have a very hard stance.
00:24:10 Speaker 2
You know, either for it or against it, or at your own leisure, at your risk. Just don't use.
00:24:15
Our, our.
00:24:16 Speaker 2
Our data in there.
00:24:18 Speaker 2
But even just from a non audit standpoint of AI and the amount of content that it can create.
00:24:26 Speaker 2
So I remember when AI was kind of getting big last year.
00:24:31 Speaker 2
And and it created a song that I think was using Kanye West voice and lyrics but had.
00:24:40 Speaker 2
Another producer's beat, and it went viral and people thought it was a real song and the record companies were scrambling. Like, how do we get this down?
00:24:49 Speaker 2
Know, I mean, you know.
00:24:51 Speaker 2
Then you hear about deep dates.
00:24:53 Speaker 2
Deep dates is a big thing right now.
00:24:56 Speaker 2
Too. And what is that gonna do for like, social engineering and?
00:25:00 Speaker 2
Every technological advance has its good and its bad so.
00:25:06 Speaker 2
I think the last thing I'll say about it is the rate of adoption of ChatGPT and and I don't know, the statistic up top my head, but it it's it's unlike anything we've ever seen before.
00:25:18 Speaker 2
So if you just go and Google like.
00:25:21 Speaker 2
Hey, how many users adopted ChatGPT like? Yeah, it.
00:25:25 Speaker 2
It's crazy, so.
00:25:27 Speaker 2
Tom, I know you and I could sit.
00:25:29 Speaker 2
And talk forever.
00:25:31 Speaker 2
But unfortunately, we're running out of time and I gotta ask you.
00:25:35 Speaker 2
One last question.
00:25:38 Speaker 2
Can you share?
00:25:40 Speaker 2
A.
00:25:41 Speaker 2
Maybe not the craziest story or investigation that you did, but something that maybe made you say wow, what were they?
00:25:49 Speaker 2
Or, Oh my goodness, I couldn't believe it, you know? Is there. Is there anything that you can share to kind of run out our conversation?
00:25:57 Speaker 3
Yeah, yeah, I I'd.
00:25:58 Speaker 3
There's always a bunch of stuff that comes to mind. We could probably talk for a couple hours on a few of these things and how how in depth some of them go, but what always ends up getting me are the ones that, that, that are the head scratchers.
00:26:09 Speaker 3
Said it's like.
00:26:10 Speaker 3
Did you get yourself there right, like?
00:26:12 Speaker 3
You know.
00:26:12 Speaker 3
No, no.
00:26:13 Speaker 3
And there's other ones that are just like the bizarre claims that come in.
00:26:17 Speaker 3
Mean there's one I I I can. I'm going to give you 2.
00:26:19 Speaker 3
This one will.
00:26:20 Speaker 3
Quick is the the most bizarre claim I ever got.
00:26:24 Speaker 3
Wasn't.
00:26:24 Speaker 3
It's just it.
00:26:25 Speaker 3
Like.
00:26:26 Speaker 3
I guess we got a call that came into the hotline and it literally all it said was I was told that I was too old.
00:26:33 Speaker 3
And then the next thing was like, you know, where does it happen?
00:26:35 Speaker 3
It goes the whole demographics and it said 4th floor.
00:26:38 Speaker 3
Well, we have offices all over the country.
00:26:41 Speaker 3
Got several.
00:26:43 Speaker 3
There's a lot of.
00:26:44 Speaker 3
So you get these calls in and you're like, OK, not much.
00:26:48 Speaker 3
I can do with that.
00:26:49 Speaker 3
I see where maybe you were headed.
00:26:51 Speaker 3
But what that usually brings me to is a whole lot of frustration when you get that. That was a call in a case.
00:26:56 Speaker 3
Couldn't do much with.
00:26:58 Speaker 3
They never responded back and we asked the question.
00:27:00 Speaker 3
But that is something that brings a ton of frustration for me is when the call comes in and there is way more fulsome.
00:27:06 Speaker 3
I was told I was too old.
00:27:07 Speaker 3
Like that but.
00:27:08 Speaker 3
That has a lot of truth to it.
00:27:10 Speaker 3
It.
00:27:10 Speaker 3
Give you enough detail and you and you struggle to get an investigation going.
00:27:13 Speaker 3
Sending messages back to the trying to go.
00:27:15 Speaker 3
We use an anonymous hotline and so you can't just call them back, but you can send them through a portal as long as they log back.
00:27:21 Speaker 3
You can.
00:27:22 Speaker 3
You can talk but.
00:27:24 Speaker 3
A lot of.
00:27:25 Speaker 3
They don't respond, and so you're stuck with things so that that breeds some frustration. But.
00:27:29 Speaker 3
You know, 1-1 in particular, I I I can throw this pretty innocuous, but it was frustrating. Kind of interesting was, you know, we had and we see these things all the time. Every company does this expense fraud, right.
00:27:40 Speaker 3
Teeny and that's the one by the.
00:27:42 Speaker 3
We can probably talk for an hour on.
00:27:43 Speaker 3
That's the simplest thing to do some analytics over but.
00:27:47 Speaker 3
We had somebody who was submitting multiple expenses.
00:27:49 Speaker 3
And.
00:27:49 Speaker 3
They were very disorganized and you went through the the the investigation with them and.
00:27:56 Speaker 3
Quite frankly, we, we say, OK, look, this seems like very a lot of mistakes.
00:27:59 Speaker 3
Lot of was intentional.
00:28:02 Speaker 3
A whole lot of waste, but nonintentional.
00:28:04 Speaker 2
Yeah, but.
00:28:04 Speaker 3
So he kind of was let off the hook a little bit.
00:28:06 Speaker 3
Pay the money back, harm the foul.
00:28:09 Speaker 3
About a week later, I see the his manager.
00:28:12 Speaker 3
How so? And so and response back was like, well, we fired him yesterday.
00:28:15 Speaker 3
I was like what you mean? I thought you were keeping him like. No, he same thing again.
00:28:19 Speaker 3
$9 for something?
00:28:20 Speaker 3
So it's not that that's not the funniest. It's not the the most.
00:28:24 Speaker 3
But to me, that's the one of those things that's always stuck out in my head.
00:28:26 Speaker 3
Some people just don't learn.
00:28:28 Speaker 3
Or they they are aren't deterred by a potential repercussion, or even put through the wringer of having to be interviewed by internal audit or legal or compliance, or whomever it is.
00:28:38 Speaker 3
Still, they still find a way to either a screw up or B think they're.
00:28:43 Speaker 3
I'm off the hook so I can do this stuff again. And you know, if you find it, just keep circling on back.
00:28:49 Speaker 3
And you know, once you've done this type of a job long enough, you, you you kind of run out of head scratches a little bit though.
00:28:57 Speaker 2
I mean, the patterns definitely start to show themselves, and I think teeny is an.
00:29:00 Speaker 2
One right like.
00:29:03 Speaker 2
Oh, you know, no receipts required for anything $25 envelope.
00:29:09 Speaker 2
Well then I start to see patterns 249924982497.
00:29:15 Speaker 2
Come on, who are you kidding, right?
00:29:17 Speaker 2
Mean.
00:29:18 Speaker 2
We got to look for that stuff.
00:29:20
Well.
00:29:20 Speaker 2
Good chat.
00:29:21 Speaker 2
It's so great having you on today's episode.
00:29:24 Speaker 2
And hopefully we can do this again.
00:29:27 Speaker 3
Absolutely enjoyed it. Very.
00:29:28 Speaker 3
It was great talking to you, but welcome the opportunity to jump back on anytime.
00:29:35 Speaker 1
If you'd like to hear more from Ernest, you can catch his session at the 2025 Fraud Virtual Conference on February 20th.
00:29:42 Speaker 1
Learn the latest in fraud prevention and detection from experts all online.
00:29:47 Speaker 1
Register at Theia .0 RG or check the show notes. You don't want to miss out.
00:29:53 Speaker 4
If you like this podcast, please subscribe and rate us. You can subscribe wherever you get your podcasts.
00:29:59 Speaker 4
You can also catch other episodes on YouTube.
00:30:01 Speaker 4
At theia.org.
00:30:03 Speaker 4
That's Theia, .0 RG.
