1. Combating Fraud :
Putting in Place an Effective Audit System to
Detect and Prevent Fraud
The 9th - Cyber Defense Initiative Conference 2009 - (CDIC 2009)
10th-11th November 2009 Queen Sirikit National Convention Center
By
Pairat Srivilairit, CIA, CISA, CBA, CCSA, CFSA, CISSP, CFE
Tuesday, 10 November 2009 15:15-16:00 hrs
1

2. About Speaker
 Mr Pairat Srivilairit received a bachelor of engineering from Chulalongkorn
University and a MBA from Thammasat University. He is a certified internal
auditor (CIA), certified information systems auditor (CISA), certified bank
auditor (CBA), holder of certification in control self-assessment (CCSA), certified financial service
auditor (CFSA), certified information systems security professional (CISSP), and a certified fraud
examiner (CFE).
 He is chairman of the Bank and Financial Institution Internal Auditors Club (BFIA) and past director
of ISACA Bangkok chapter. He is also a member of The Institute of Internal Auditors (IIA), The
Association of Certified Fraud Examiners (ACFE), The Information Systems Audit and Control
Association (ISACA), The International Information Systems Security Certification Consortium
(ISC)² and The Institute of Internal Auditors of Thailand (IIAT).
 He is a known lecturer on operational auditing and information system auditing courses at IIAT and
ISACA Bangkok Chapter. He is also a special lecturer of the IIA’s Internal Auditing Education
Partnership Program (IAEP) at Chulalongkorn University, and represented IIAT speaking to
students at several universities to disseminate the internal auditing profession.
 Mr Pairat Srivilairit is associated with finance and banking industry for over 18 years with rich
experiences in the area of management consulting, planning, research, investment,
operation and audit. He is now with TISCO Bank Public Company Limited as head of
internal audit and secretary to the audit committee.
2

3. Outline
Combating Fraud: Putting in Place an Effective Audit
System to Detect and Prevent Fraud
(45 min)
 Key Indicators of Fraud
 Types of Fraud in Activities Reviewed
 Prevention Aids by Internal Auditors
 Detection and Investigation Techniques
 Summary
3

4. ตัว อย่า งกรณีท ุจ ริต
โจรไฮเทคแฮ็กข้อมูลเชิด 200 ล้าน
– เดือนสิงหาคม 2548 ตัวแทนผู้ให้บริการเครือข่ายโทรศัพท์
เคลื่อนที่ สังเกตเห็นความผิดปกติใน traffic ของลูกค้า
ประเภทบัตรเติมเงิน
– สืบพบรหัสข้อมูลของบริษัทถูก hack แล้วนำาไป load เงิน
จำานวนเกินจริงใส่บัตรเติมเงิน เอาไปขายผ่าน Internet ใน
ราคาพิเศษ หรือตั้งโต๊ะให้บริการตามชุมชน
– บริษัทพยายามบล็อกรหัสของบัตรที่ผิดปกติ แต่ก็ยังเสียหาย
เป็นค่าเสียโอกาสรายได้ สูงถึง 200 ล้านบาท
– จับกุมผู้ต้องหาได้ 4 คน เป็นพนักงานของบริษัทเอง คดียังอยู่
ในระหว่างอุทธรณ์.
(ผู4 ัดการ 27 ส.ค.48)
้จ

5. ตัว อย่า งกรณีท ุจ ริต
ผีพนันสิงหนุ่มแบงก์แสบโกง 400 ล้าน
– เดือนพฤษภาคม 2552 ธนาคารตรวจพบสมุห์บัญชีสาขา
หนึ่งโอนเงินจากบัญชีดอกเบี้ยที่ธนาคารเตรียมไว้จ่ายลูกค้า
เข้าบัญชีตัวเองตามธนาคารต่าง ๆ
– ผู้ต้องหาจนมุมคารถขณะกำาลังหนีไปเขมร สารภาพทำามาต่อ
เนื่องนานกว่า 1 ปี เพราะทำาง่ายและไม่เคยถูกตรวจสอบ เงิน
ที่ยักยอกนำาไปซื้อบ้าน รถยนต์ เครื่องประดับ ซื้อกองทุน
เล่นพนันฟุตบอล ซื้อสลากกินแบ่ง รวมกว่า 499 ล้านบาท
– เริ่มทำางานในธนาคารเมื่อปี 2542 ได้รบรางวัลเป็นพนักงาน
ั
ดีเด่น และไม่เคยมีประวัติการทุจริต
– พบสาเหตุระบบ Core Banking System มีข้อบกพร่อง.
5
(ฐานเศรษฐกิจ 6 พ.ค.52)

6. Occupational Fraud
 “The use of one’s occupation for personal enrichment
through the deliberate misuse or misapplication of the
employing organization’s resources or assets.”
 All occupational fraud have 4 things in common
– Clandestine
– Violate the perpetrator’s fiduciary duties to the victim
organization
– Committed for direct or indirect financial benefit to the
perpetrator, and
– Cost the employer assets, revenue or reserves
6

7. How Fraud is Committed
Three categories of occupational frauds :
 Asset Misappropriations
Involve theft or misuse of organization’s assets i.e.
skimming revenues, stealing inventory and payroll fraud.
 Corruption
Wrongfully use influence to gain personal benefit contrary
to duty to employer or the rights of another i.e. accepting
kickbacks, conflicts of interest.
 Fraudulent Statements
Falsification of organization’s financial statements i.e.
overstating revenues and understating liabilities or
expenses.
7

8. How Fraud is Committed
 Asset misappropriations were most common but low
loss. Fraudulent statements were least common with
highest loss.
Breakdown of All Occupational Fraud Schemes — Median Loss
8

9. Bank Most Common Fraud
 Greatest percentage (15%) of fraud occurred in banking
and financial services sector.
9

10. How Fraud is Detected
 It takes 24 months on average to catch employee fraud
Initial Detection of Occupational Frauds 4
10

11. Key Indicators of Fraud
 Tips / Complaints
 Missing / Alteration of documents
 Duplicate / Unreasonable expenses or reimbursements
 Failure of certain employees to take vacations
 Failure to follow up on past-due receivables
 Unusual write-offs of receivables
 Employees on the payroll not sign up for benefits
 Excessive purchase of products or services
 Common phone numbers / addresses of payees or
customers
11

12. Key Indicators of Fraud
(Continued)
 Cash shortages / overages
 Stale items on bank reconciliations
 Unexplained adjustments / Journal entries
 Unusual financial statement relationships i.e.
– Increased revenue vs. decreased receivable
– Increased revenue vs. decreased inventory purchase
– Increased inventory vs. decreased purchase or A/P
 Significant increases or decreases in account balances
 Significant changes in liquidity, leverage,
profitability or turnover ratios
12

13. Limiting Fraud Losses
 Surprise audit and job rotation are still overlooked by many organizations.
13

14. Limiting Fraud Losses
 Surprise audit, job rotation, and anonymous reporting showed the greatest impact on fraud
losses.
14

15. Bank Case Symptoms
 Supervisory override, unusually large transactions or
with no apparent business purpose
 Journal voucher contain only one signature, containing
incorrect information, fund transfer between different
customers' accounts
 Deposit slip with missing information, depositor names
incomplete or not match with passbook or acct name.
 Frequent, large deposit/withdrawal in Executive account
 Deposits and withdrawals on same account on same day
or in a short period of time
 Bank checks used to transfer between accounts /
checks with altered date.
15

16. Symptoms ... More
 Purported customer signature on withdrawal voucher and
checks
 Large negative balances in slush accts or customer accts
 Deposit slip of customer funds between accts of different
customers
 Deposits of customer check where cash was received
back
 CDs closed prematurely with proceeds put into low
interest account, sometimes with penalty
 Customer not presented when account was opened,
closed or transacted
 Mailing of customer statement to Executive address
16

17. Bank Fraud Trend
 Fraud financial cost may be three or more times the
value of loss amount
 Fraud is not static. It evolves with each new measures
implemented
 New opportunities for employee fraud are emerging
 Criminals thwart rules-based systems
 “Silo” mentality weakens fraud detection
 Top management are moving toward an enterprise
focus on anti-fraud systems
 Regulatory expectations are increasing
 Solutions require commitment, investment, and talent
17

18. Insider Threat
 “Deliberate misuse by those who are authorized to use
computer and networks.”
 Insiders include employees, contractors, consultants,
temporary helper, personnel from third-party business
partner, etc.
18

19. Facts about Insider Misuses
 Most were not technically sophisticated or complex
 Most were thought out and planned in advance
 Most were motivated by financial gain
 Most perpetrators of banking and finance incidents
– Not hold technical position
– Never engage in technical attack or hacking
– Not necessarily perceived as problem employees
 Executed at workplace during normal business hours
 Detected by various channels and methods.
19

20. Misuse of Applications
Applications Legitimate Use Misuse
Client/Server  Message exchange  Unusual exchange to degrade
performance
 Connectivity to server  Exceedingly connection (DOS)
 Execution of tasks  Execute privileged procedure
Mail Clients  Send and receive e-mails  Illegal content / remote attack /
private use / overload network
Browsers /  Browse Internet / play files  View illegal content
Multimedia  View cached file and  Display other users’ viewed files
player history and accesses
Programming  Develop program  Create malware
Tools  Display memory segment  Access memory segment with
sensitive information
General-  Read / write  Access temp file for sensitive
purpose information / modify temp file to
Applications change program flow
 Input strings  Buffer overflow
20

21. Universal of
Internal Computer Fraud
Data Capture
Billing Schemes Errors
Spyware &&
Forged Corruption && Ghost Spyware Duplicate Over
Forged Corruption Ghost Key loggers Duplicate Over Payment to
Endorsement Price initiation Vendor Key loggers Payment to
Endorsement Price initiation Vendor Payments Payments Erroneous
Payments Payments Erroneous
Accomplice Quid Pro Quo && Return Early Missing or Bad Employees
Accomplice Quid Pro Quo Return Employees
Vendor
Vendor Barter Schemes && Voids
Barter Schemes Voids Fund Transfer Early
Payments
Missing or Bad & Vendors
Information & Vendors
Payments Information
Personal Passing of Payment of Invoices Unauthorized
Personal Duplicate Information
Purchase Passing of Payment of Invoices
for Non-existing Suppliers
Unauthorized
Transfer of Funds
Duplicate Information
Purchase for Non-existing Suppliers Transfer of Funds
Program Altering Schemes
Manipulation of Data Input Computer
Computer Changing Program Setting Improper
Changing Program Setting Improper
Data
Data Falsification of
Falsification of Data
Data
Fraud
Fraud
and Data Ownership
and Data Ownership Parameter
Parameter
Integrity Stock Record Suppression Use of Malware Alteration of Program
Integrity Stock Record Suppression
Attack to Cover Theft Use of Malware Alteration of Program
Attack to Cover Theft (e.g. Trojans) and Data File
of Stocks (e.g. Trojans) and Data File
of Stocks
Information Privacy Risk
Loss of Employee
Payroll Schemes Loss of Transmission of
Transmission of Employee
Intellectual Confidential Data Downloading
Check Tampering
Intellectual Confidential Data Downloading
Ghost False Property (i.e. TCP/IP) Hacker Tools
Ghost False Property (i.e. TCP/IP) Hacker Tools Forged Endorsement
Employee Communication Through For ID Theft Forged Endorsement Skimming
Employee Communication Through For ID Theft Skimming
Fraud Employee Purpose
Fraud Employee Purpose Forged Checks Write-off of
Worker’s Falsified Posting Forged Checks Write-off of
Worker’s Falsified Peer-to-peer Posting Employee
Compensation Wages Peer-to-peer Confidential Employee Money Due
Compensation Wages Filing Sharing Confidential Downloads Alter Payee Money Due
Scheme Filing Sharing Company Downloads Alter Payee to Company
Scheme Company && Nefarious
Nefarious to Company
Information
Information Applications
Applications
09/10/12 21 21

22. Types of Application Controls
Access Controls Data Origination / Input Controls
Check Integrity Check whether sources Check ifif data
Authorization
Authorization
Check Integrity
of Data entered Check whether sources Check data
Identification && of Data entered from staff direct input, is within
Identification Into Business from staff direct input, is within
Authentication Accountability Audit Into Business remote by business partner, specified
Authentication Accountability Audit Application remote by business partner, specified
Application or through web-enabled parameter
or through web-enabled parameter
application
Physical Devices (i.e. biometric application
Physical Devices (i.e. biometric
scan, metal locks, hidden path, Ensure accuracy, completeness and Ensure accuracy with optimum
scan, metal locks, hidden path, Ensure accuracy, completeness and Ensure accuracy with optimum
digital signatures, encryption, timeliness of data during conversion computerized validation
digital signatures, encryption, timeliness of data during conversion computerized validation
social barriers, human and automated from original sources into computer and editing,
social barriers, human and automated from original sources into computer and editing,
monitoring systems etc.), data or entry to computer application
monitoring systems etc.), data or entry to computer application
either manual, online input or batch. Error handling procedure
either manual, online input or batch. Error handling procedure
Permit or deny use of an object facilitate timely
Permit or deny use of an object facilitate timely
and accurate resubmission
and accurate resubmission
of all corrected data
of all corrected data
Application
Application
Controls
Controls
Data Processing
Output Control
Ensure accuracy, completeness
Ensure accuracy, completeness
and timeliness of data during Ensure data is accurately Ensure integrity of output and the correct
and timeliness of data during Ensure data is accurately Ensure integrity of output and the correct
either Batch or real-time processed through and timely distribution of output produced
either Batch or real-time processed through and timely distribution of output produced
processing by application. the application either in hardcopy, files to be used as input
processing by application. the application either in hardcopy, files to be used as input
for other system, or information
No data is added, lost or altered during processing for other system, or information
No data is added, lost or altered during processing available for online viewing
available for online viewing
09/10/12 22 22

23. Example of Detection System
General
Ledger
XBRL Business
XBRL Business
Report Engine
Report Engine
Business
Report XSLT
Branch
Branch Spreadsheet
Loan Application
Dataset
Web Application
Main Office
Main Office Web Browser
Web Browser Server Server
XML XML
document document
Branch
Branch XML
SYSLOG Key Fraud Signature
Misuse detection
Rules data & metadata
IDS Engine
Firewall and
Router Log Event Correlation
Database
09/10/12 23 23

24. Other Analytical Tools
 Use of Benford's Law as fraud detection tool
Theoretic
al Line Fraudulent
Frequencies (percent)
Transactions
09/10/12 24 24

25. Managing Insider Threat
 Strong authentication / biometric technologies
 Role-based access granted on a need-to-have basis
 Rotate job function / event log reading
 Place server and sensitive equipment in secured area
 Restrict physical access / lock / alarm test
 Wear badge / background check
 Default password / unused port / log-off on absence
 Encrypt sensitive data stored on user hard drives
 Store sensitive document in secured space
 Never issue password over unsecured channels
25

26. Aware of Warning Signs
 Rogue access point / wireless / remote
 Disgruntled employee
 A user accesses database or area of network they
have never accessed before
 Download spike
26

27. Fraud Prevention Checklist
 Good internal control
 Employee fraud awareness training / hotline
 Analytical review / surprise fraud audits
 Review company contracts
 Perception of detection / management oversight
 Proactive fraud policy and program / prosecution
 Mandatory vacations / periodic job rotation
 Screen job applicants
 Information security review / limit access / audit trail
 Management climate / employee support program
27

28. Summary
Auditor's roles in combating fraud
 Promote culture of honesty and high ethics
 Assess and mitigate the risk of fraud
 Ensure control adequacy and effectiveness
 Use data mining and statistical analysis tools
 Analyze financial statements reports
 Being alert on predication of fraud
 Ensure investigations are properly conducted
 Ensure proper follow-up actions are taken
 Develop your anti-fraud knowledge and skills
28

29. About the ACFE
 The Association of Certified Fraud Examiners
 Start 1988
 Provide anti-fraud training and education
 Over 50,000 members in 125 countries
 Administrate the Certified Fraud Examiner (CFE)
designation- a certification program for fraud practitioners
recognized by U.S. Department of Defense and FBI
 More than 20,000 CFE’s worldwide (5 Thais)
 $55 Membership Fee
 More information about ACFE
http://www.acfe.com
29

30. About CFE Exam
 Covers 4 areas
– Criminology & Ethics
– Financial Transactions
– Fraud Investigation
– Legal Elements of Fraud
 4 Exam sections of 125 questions each (75%)
 Administered via computer / must complete each
section in one sitting (2.6 hr)
 Complete all and return to ACFE in 30 days
 Must pass Qualifying Points System (40/50)
 $250 Application Fee
30

31. Q&A
Pairat Srivilairit
CIA, CCSA, CFSA, CISA, CISSP, CBA, CFE
Internal Audit Department
TISCO Bank Public Company Limited
Mobile : +668 1903 1457
Office : +66 2633 7821
Email : pairat@tisco.co.th
31