EY’s Forensic Technology & Discovery Services (FTDS) practice provides a wide range of eDiscovery, data analytics and cyber breach investigation and response management capabilities, on a global basis.

1. Forensic Data Analytics

2. Key to unlocking invisible information using forensic
“lookback”
Forensic Data Analytics as a topic and its adoption within the industry had long been overdue.
With the advent of technology and increasing incidents of fraud, there has been a significant rise
in adoption of Forensic Data Analytics. Due to this, company appointed auditors and independent
directors are now seeking to implement proactive fraud-prevention solutions and are avoiding post-
incident remediation processes.
Forensic Data Analytics is a science used to proactively seek opportunities to prevent and detect
fraud, waste and abuse by leveraging information in corporate data assets. It enables identification
of meaningful patterns and correlations in existing historic data to predict future events and assess
the reasons for various fraudulent activities. Such insightful predictive information is generally
“invisible,” but provides a platform on which organizations can take business decisions related to
fraud, disputes and misconduct.
The greatest value of forensic analytics is when it forces us
to notice what we did not expect to see.“
“

3. Forensic Data Analytics 3
Big data is a reality:
The volume, variety and velocity of
data coming into the organization have
reached unprecedented levels. About
2.5 exabytes of data are created each
day, and that number is doubling every
40 months
Recent scams in the limelight:
In the recent times, India has been hit
with multi billion value scams associated
with the following:
• Anti Money Laundering
• Bribery and Corruption
• Procurement fraud and collusion in
bidding process
• Accounting misstatement
Issues in managing big data:
Big data requires high performance
analytics to process billions of rows
of data with hundreds of millions of
data combinations. The traditional
data warehousing techniques may
not be able to identify anomalies in
the existing data set thus preventing
proactive fraud management
Adoption of forensic data analytics:
The associated risks could have been
mitigated if key stakeholders would
have paid attention to anomalies at
an earlier stage. This could have been
possible if existing data assets were
analyzed from forensic perspective to
avoid wrongful or criminal deception
intended to result in financial or
personal gain.
1. Big data
• Proactive fraud prevention management
• Controlling the magnitude of fraud in a reactive
set up
• Effective and focused internal controls
• Improving regulatory and compliance environment
How does forensic data analytics help organizations?
Evolution of forensic
data analytics
2. Manage
data
3. Key Risk
Events
4.
Forensic
Data
Analytics
Forensic analytics is the oil of
the 21st century which protects
organizations combustion
engine from going bust
Absence of forensic evidence
is not evidence of forensic
absence
Torture the data, and it will
confess to anything
Without big data analytics,
companies are blind and deaf,
meandering aimlessly like a
deer on freeway

4. Forensic Data Analytics4
Our forensic analytic models are developed to
identify variances in data sets, which may impact
an organization’s profit and loss statement. This
model also touches on various aspects, from simple
narration captured in a transaction to complicated
sentiments and tone analysis. It also includes data
within applications and data recorded on social and
professional networks for further analysis. This analysis
helps a company to move beyond identification of low
value pilferage to implementing controls on existing
and potential weak areas. Any dataset in historic, near
real time and real time form can be assimilated through
big data solutions to help a company improve its
bottom line by checking fraudulent activities
Capability landscape
Forensic Data Analytics can be used as a standalone
service or in conjunction with existing practices
such as investigations, audits, process review and
due diligence. In the current context, data exists
in structured (multiple form of databases) and
unstructured forms (emails, office documents,
presentations, Excel sheets, PDF files, archive files,
text and image files) in organizations. Using EY’s
proprietary tools, raw data can be transformed
into formats that can be analyzed, and with the
help of advanced analytical capabilities, anomalies
can be identified that may indicate potential fraud.
Some of our key offerings include, but not limited
to, identification of fraud in vendor, customer and
employee registration, procurement to pay, order to
cash, sales and distribution, travel and entertainment,
payroll disbursment.
EY_Class
Assets
Cost of R evenue
Expense
Expenses
Functional Transfer Ac..
Liabilities & Stockholde..
Local Legal Accounts (..
Other income and ded..
EY_Account_Name
Product/Program R ela..
Purchases notcapitali..
(G )/L on Sales of Equip..
13th Month Salaries #1
A&P - Customer Events
A&P - Trade s hows
A&P Collaterals - Prod..
A/P - Credit out of Debi..
EY_TIME_TAG
After office hours entries
W ithin Office hours ent..
EY_Entry_week_day
Sunday
Monday
Tuesday
W ednesday
Thursday
Friday
Saturday
EY_Entry_month_end
No
Yes
S ample Dashboard
User_ID
AKLERK
ANVSCHAIK
BATCHUSER
BJANKI
CKLEIN
CLABRAVEGA
GGOOSEN
JHAMAKER
NWINTER
PWENNEKES
RVBEUSEKOM
SAMEIER
SKAYA
TKOPPENS
TSMITS
0M
100M
200M
Amount
0K
50K
DistinctcountofJournal_ID
1,864
91
2,541 333
4
716 291
34
50,276
79,779
2 2,393 3,705
9,131
4,869
J ournal E ntries and Amount Per User Debit/Credit
Credit
Debit
EY_Account_Name
-60M -40M -20M 0M 20M 40M 60M
Amount
NL trading account NX
Trade R ec'bles - R eceivables
Agency Billing Settlement Ac..
FSMA R evenue - Other Disc..
R ental R ev. - Short Term R e..
58,874,500
60,565,488
Amount per Account Name
EY_Sub_Category
-60M -40M -20M 0M 20M 40M 60M
Amount
Accounts R eceivable: Trade
Other Current Assets: Miscel..
Due to (from) Trade and Oth..
R ental R evenue: R ental Agr..
Deferred R ental R evenue
Deferred R evenue Managed..
67,944,770
58,874,500
-67,944,770
Amount per S ub C ategory
Account Name
Effective_Date
2011
J uly August September October November December
2012
J anuary February
-10M 0M 10M
Amount
-10M 0M 10M
Amount
-10M 0M 10M
Amount
-10M 0M 10M
Amount
-10M 0M 10M
Amount
-10M 0M 10M
Amount
-10M 0M 10M
Amount
-10M 0M 10M
Amount
Agency Billing Settlement Ac..
Agency Billing Settlement Ac..
Billing Settlement A (165799..
Deferred R ev. - FM (213009..
Deferred R ev. - FSMA (2130..
Deferred R evenue - R ental (..
FM R ev. - Additional Sales (..
FM R ev. - FSMA R ev. Varia..
-801,576
-620,377
-943,525
-393,707
-615,525
-192,406
-454,933
-274,752
-254,811
-83,159
Account name per month (C alculated Based on Document Number)
Figure 1: Structured output from unstructured data
Unstructured data
Forensic data analytics
Structured output

5. Forensic Data Analytics 5
Link Analysis
Link Analysis is a data-analysis technique used to
evaluate relationships (connections) between nodes,
including organizations, people and transactions. Key
applications of this technique include analysis of EPBX
data, mobile bills and user logical access records that
help a company map its user footprint.
In a recent incident in a manufacturing company, its
phone records were analyzed across different zones
to determine the nexus between its employees and
selected vendors on procurement and disposal of
scrap. Using Link Analysis, we were able to establish
“hidden” relationships and information leakage from
suspected employees to identified vendors for possible
“kickbacks.”
Our key differentiator in forensic
data analytics
The size and width of
connectors indicate
frequency of the calls
Employee-
vendor nexus
Vendor group
Third party
Employee group
Figure 2: Link Analysis
At EY, data analytic techniques applied to internal or
external fraud follows a four pillar approach — WHO-
WHAT-WHEN- WHY. This approach looks at any
situation from all possible angles and highlights key
issues. This does not only help in managing risks, but
also in identification of potential growth areas.
Increasing concerns about fraud and vulnerability can
be alleviated by a range of forensic techniques, some
of which are presented below.
“ ”
The key to identify fraud lies in the ability to
comprehend what lies beneath.

6. Forensic Data Analytics6
Social Network Analysis
Social Network Analysis views relationships in terms
of network theory, which consists of nodes and ties.
Nodes represent individual “actors” within the network
and Ties represent relationships between individuals,
e.g., friendships, kinship, organizational position, etc.
Social Network Analysis, along with Link Analysis,
helps to identify related parties, conflict of interest, bid
rigging, among other fraud.
In a large consumer products company, the India lead
had appointed his relatives as distributors, and through
known vendors, managed distribution of products in
key states. Social Network Analysis, followed with a
background check, helped to reveal the nexus. This
led to a full-blown investigation and the company now
undergoes vendor due diligence before it carries out
any business.
Concept Clustering
Concept Clustering involves grouping similar entities
or behavior into tight semantic clusters for the purpose
of identifying anomalies or red flag. It is used actively,
along with an electronic data review. In this example,
Concept Clustering was executed on more than a
million documents to identify all the information with
terms such as “gifts,” “incentive” and “facilitation.”
We were able to bring these down to a sizable volume
with the required criteria that was analyzed in a time-
bound manner. Concept Clustering can be effectively
used on structured and unstructured data.
Sentiment Analysis
Known as behavioral analysis, this refers to the
application of text analytics to identify and extract
subjective information including the attitudes of
writers, their affective state and the intended
emotional quotient. It determines whether expressed
opinions in a document are positive, negative or
neutral. The “fraud triangle” can be applied to
categorize events into rationalization, opportunity and
pressure to identify sentiments. Organizations use this
data to conduct behavioral training, stem attrition,
and identify disgruntled employees and potential fraud
conversation.
Figure 3: Social Network Analysis
India sales head
Vendor network in east
Vendor network in west
Relatives as key distributors
Vendor network in south
Vendor network in north
India lead managing business throughout
India through relatives as key distributors
Figure 5: Sentiment Analysis
Miscellaneous
DerogatoryCursingConfusedSurprisedAngry
Fraud Cash Gift
Figure 4: Concept Clustering

7. Forensic Data Analytics 7
Tag Cloud
One of the most widely used visual techniques is a Tag
Cloud. This is a good example of expressing complex
data that can be understood intuitively. A Tag Cloud
is the visual representation of communication relating
to transactional data entries. It is represented by a
combination of words in varied fonts, sizes or colors.
This format is useful for quickly determining the
important terms to identify key fraud issues
Interactive CXO dashboards
A useful feature of analytics is that an entire data set
can be converted to a meaningful dashboard for a CXO
analysis.
Such dashboards help in understanding databases and
spreadsheets of any size with their easy drag and drop
interface. They not only display information visually
in seconds, but also create interactive maps with the
click of a mouse. They can effectively analyze time
series from years to months to the actual time in a day.
Their most helpful feature is their capability to combine
different databases to a single view and publish
interactive dashboards on the Web.
Here, we have sliced the entire expense dump of an
organization from four key lenses including WHERE
(geography), WHAT (type of expense), HOW (expense
description) and WHO (the employee who incurred the
expense). Having multi-dimensional data on a common
platform helps a company perform an insightful analysis
to determine the tests that need to be performed on
expense data.
Figure 7: Interactive CXO Dashboard
Figure 6: Tag Cloud
Data Visualization —
identifying the “hidden” from “not so apparent”
Data Visualization techniques have proved to be effective, since humans can better absorb large pieces of
information in a visual format than that displayed in numbers or text. When the result of a fraud identification query
is combined with Data Visualization, e.g., an account payable or journal entry data, a significant amount of useful
and previously invisible information can be reviewed at one go.

8. Ernst & Young LLP
EY | Assurance | Tax | Transactions | Advisory
About EY
EY is a global leader in assurance, tax, transaction and
advisory services. The insights and quality services we
deliver help build trust and confidence in the capital
markets and in economies the world over. We develop
outstanding leaders who team to deliver on our promises
to all of our stakeholders. In so doing, we play a critical
role in building a better working world for our people, for
our clients and for our communities.
EY refers to the global organization and may refer to
one or more of the member firms of Ernst & Young
Global Limited, each of which is a separate legal entity.
Ernst & Young Global Limited, a UK company limited by
guarantee, does not provide services to clients. For more
information about our organization, please visit ey.com.
About EY’s Fraud Investigation & Dispute Services
Dealing with complex issues of fraud, regulatory
compliance and business disputes can detract from
efforts to achieve your company’s potential. Better
management of fraud risk and compliance exposure
is a critical business priority — no matter the industry
sector. With our more than 2,000 fraud investigation
and dispute professionals around the world, we assemble
the right multidisciplinary and culturally aligned team to
work with you and your legal advisors. And we work to
give you the benefit of our broad sector experience, our
deep subject matter knowledge and the latest insights
from our work worldwide. It’s how EY makes a difference.
Ernst & Young LLP is one of the Indian client serving member firms of
EYGM Limited. For more information about our organization, please visit
www.ey.com/in.
Ernst & Young LLP is a Limited Liability Partnership, registered under the
Limited Liability Partnership Act, 2008 in India, having its registered office
at 22 Camac Street, 3rd Floor, Block C, Kolkata - 700016
© 2013 Ernst & Young LLP. Published in India.
All Rights Reserved.
EYIN1212-108
ED None
This publication contains information in summary form and is therefore
intended for general guidance only. It is not intended to be a substitute
for detailed research or the exercise of professional judgment. Neither
Ernst & Young LLP nor any other member of the global Ernst & Young
organization can accept any responsibility for loss occasioned to any
person acting or refraining from action as a result of any material in this
publication. On any specific matter, reference should be made to the
appropriate advisor.
Ahmedabad
2nd
floor, Shivalik Ishaan
Near. C.N Vidhyalaya
Ambawadi
Ahmedabad-380 015
Tel: +91 79 6608 3800
Fax: +91 79 6608 3900
Bengaluru
12th
& 13th
floor
“U B City” Canberra Block
No.24, Vittal Mallya Road
Bengaluru-560 001
Tel: +91 80 4027 5000
+91 80 6727 5000
Fax: +91 80 2210 6000 (12th
floor)
Fax: +91 80 2224 0695 (13th
floor)
1st Floor, Prestige Emerald
No.4, Madras Bank Road
Lavelle Road Junction
Bengaluru-560 001 India
Tel: +91 80 6727 5000
Fax: +91 80 2222 4112
Chandigarh
1st
Floor
SCO: 166-167
Sector 9-C, Madhya Marg
Chandigarh-160 009
Tel: +91 172 671 7800
Fax: +91 172 671 7888
Chennai
Tidel Park
6th
& 7th
Floor
A Block (Module 601,701-702)
No.4, Rajiv Gandhi Salai
Taramani
Chennai-600 113
Tel: +91 44 6654 8100
Fax: +91 44 2254 0120
Hyderabad
Oval Office
18, iLabs Centre
Hitech City, Madhapur
Hyderabad - 500 081
Tel: +91 40 6736 2000
Fax: +91 40 6736 2200
Kochi
9th
Floor “ABAD Nucleus”
NH-49, Maradu PO
Kochi - 682 304
Tel: +91 484 304 4000
Fax: +91 484 270 5393
Our offices
Kolkata
22, Camac Street
3rd
Floor, Block C”
Kolkata-700 016
Tel: +91 33 6615 3400
Fax: +91 33 2281 7750
Mumbai
14th
Floor, The Ruby
29 Senapati Bapat Marg
Dadar (west)
Mumbai-400 028, India
Tel: +91 22 6192 0000
Fax: +91 22 6192 1000
5th
Floor Block B-2
Nirlon Knowledge Park
Off. Western Express Highway
Goregaon (E)
Mumbai-400 063, India
Tel: +91 22 6192 0000
Fax: +91 22 6192 3000
NCR
Golf View Corporate
Tower – B
Near DLF Golf Course
Sector 42
Gurgaon–122 002
Tel: +91 124 464 4000
Fax: +91 124 464 4050
6th
floor, HT House
18-20 Kasturba Gandhi Marg
New Delhi-110 001
Tel: +91 11 4363 3000
Fax: +91 11 4363 3200
4th & 5th
Floor, Plot No 2B
Tower 2, Sector 126
Noida-201 304
Gautam Budh Nagar, U.P. India
Tel: +91 120 671 7000
Fax: +91 120 671 7171
Pune
C—401, 4th
floor
Panchshil Tech Park
Yerwada (Near Don Bosco School)
Pune-411 006
Tel: +91 20 6603 6000
Fax: +91 20 6601 5900
Arpinder Singh
Partner and National Leader
Direct: +91 22 6192 0160
Email: arpinder.singh@in.ey.com
Mukul Shrivastava
Partner
Direct: +91 22 61922777
Email: mukul.shrivastava@in.ey.com
Sudesh Shetty
Director
Direct: +91 22 61921957
Email: sudesh.shetty@in.ey.com
EY contacts