DETECTING THE UNDETECTED –

FRAUD DETECTION ANALYTICS

AT CARNIVAL
Daniel Bukowski, CPA, CIA, CFE

#ALTERYX18
AGE- • Carnival Background
• Data Analytics for Internal Audit

NDA
• Identifying Non-PO Vendor Risk
• Alteryx Workflows
• Questions

#ALTERYX18
CARNIVAL CORPORATION&PLC

Click to add logo

#ALTERYX18
APPLICATION OF DATA ANALYTICS
Fraud
Compliance Detection and
Investigation

Operational Internal
Performance Controls
Stippich, W.W., & Preber, B.J. (2016). Data Analytics: Elevating Internal
Audit’s Value. Altamonte Springs, FL: IIA Research Foundation

#ALTERYX18
IIA RESEARCH

Click to add logo

#ALTERYX18
THE
AUDITOR
MINDSET

Click to add logo

#ALTERYX18
THE
AUDITOR
MINDSET

Click to add logo

#ALTERYX18
THE You want to take my Excel…?
AUDITOR
MINDSET

Alter This!
Click to add logo
#ALTERYX18
‘ALTER’
THE
AUDITOR
MINDSET Auditors

Excel
Alteryx

Click to add logo

#ALTERYX18
NON-PO VENDOR RISK REVIEW
Project Goal
• Identify the highest-risk vendors within the vendor populations
of each Carnival operating company
Alteryx
• Convert manual, sample-based procedures into an automated,
repeatable workflow that analyzes entire populations
2017 Scope
• 10k vendors, 275k invoices, $2bn+ spend

Click to add logo

#ALTERYX18
NON-PO VENDOR TESTS

VENDOR SETUP INVOICES PAYMENTS

• New Vendor • Vendor Total Over • Quick Payment

• Single-Approval $250k • Payment Date
• Payment Terms • Sequential Anomalies
• High-Risk Invoices • Payment Currency
Country • Round Dollar Different from
• PO Box Amounts Invoice Currency
• Invoice
Structuring

#ALTERYX18
ALTERYX WORKFLOWS

Click to add logo

#ALTERYX18
VENDOR RISK TESTS

Click to add logo

#ALTERYX18
RISK-RANKED VENDORS
Risk Over Paid Paid 5 PO Round New Single Seq Diff
Num Name USD Invoices Count Invoices Score 250k Prior Days Box Amt Str Country Vendor Approve Terms Inv Currency

001 Alfa Co 9316261.66 493 8 1 1 1 1 1 1 0 0 0 1 1 0

002 Beta Co 300500.48 136 8 1 1 1 1 1 1 0 0 0 1 1 0

003 Charlie Co 9594836.42 36 8 1 1 1 1 1 0 1 0 0 1 1 0

004 Delta Co 92241948.1 1912 7 1 1 1 1 1 1 0 0 0 0 1 0

005 Echo Co 36927486.61 617 7 1 1 1 0 1 1 0 0 0 1 1 0

006 Foxtrot Co 31604220.34 333 7 1 1 1 0 1 1 0 0 0 1 1 0

007 Golf Co 18490591.63 315 7 1 1 1 0 1 1 0 0 0 1 1 0

008 Hotel Co 4988327.49 81 7 1 1 1 0 1 1 0 0 0 1 1 0

009 India Co 2003396.37 220 7 1 1 1 0 1 1 0 0 0 1 1 0

010 Juliett Co 9019192.2 34 6 1 1 1 0 0 0 0 1 1 0 1 0

#ALTERYX18
CLUSTER ANALYSIS
• Unsupervised machine learning

• Identify latent relationships in the data

• Principle components

• Identify outliers

Click to add logo

#ALTERYX18
 Cluster 8
Cluster 8 Centroid

Cluster 8

Click to add logo

#ALTERYX18
CLUSTER ANALYSIS
Cluster Count Max Risk Max Spend

1 82 5 26,08,4241

2 167 7 16,508,885

3 103 6 4,608,229

4 166 3 1,298,521

5 155 3 23,240,215

6 42 5 1,007,702

7 201 4 8,978,925

8 10 8 92,241,948

#ALTERYX18
SUMMARY
Data analytics with Alteryx enables internal audit to:

• Do more, faster

• Share processes visually

• Automate manual processes

• Analyze data at a greater level of detail

• Focus manual procedures on the most important areas

Click to add logo

#ALTERYX18
THANK
Daniel J Bukowski
dbukowski@carnival.com

YOU
www.linkedin.com/in/danieljbukowski

Please complete a
feedback survey!

Click to add logo

#ALTERYX18
NON-PO VENDOR RISK REVIEW

Manual
Prep Perform Aggregate Select High-
Audit
Invoice Data Risk Tests Results Risk Vendors
Procedures

#ALTERYX18
NON-PO VENDOR TESTS
Risk Test Description
SINGLE-APPROVAL VENDORS • Vendors with invoices approved by only a single HA Group executive

NEW VENDORS • Vendors that have creation dates within the previous 12 months

VENDOR BASED IN HIGH-RISK • Vendor located in a high-risk country, defined as a country in the lower 50% of the Transparency International
COUNTRY Corruption Perceptions Index

VENDOR ADDRESS IS
• Identify vendors with a PO Box as the address on-file
A PO BOX
ROUND DOLLAR AMOUNTS • Identify vendors with multiple invoices that end in round amounts (00 or 50)
• Vendors with non-PO invoices just below defined thresholds
INVOICE STRUCTURING ($5k, $10k, $25k, $50k, $100k)
SEQUENTIAL INVOICES • Identify vendors that have submitted three sequential invoices
• Identify invoices with date anomalies
PAYMENT DATE ANOMALIES (i.e., payment before invoice date, payment before approval date)
PAYMENT TERMS • Identify vendors with system payment terms of seven days or fewer

QUICK PAYMENT • Identify vendors with invoices actually paid within five days of invoice date
• Identify vendors from which HAL, PCL, or CAU has received more than $250,000 of invoices during the time
OVER $250K OF INVOICES period, for materiality
INVOICE CURRENCY AND
• Identify instances where the invoice currency and payment currency are different
PAYMENT CURRENCY DIFF.
Click to add logo

#ALTERYX18
NON-PO VENDOR RISK REVIEW
Project Goal: Identify the highest-risk vendors within the vendor populations of
each Carnival operating company

Alteryx: Convert manual, sample-based procedures into an automated, repeatable

workflow that analyzes entire populations

2017 Scope: 10k vendors, 275k invoices, over $2bn spend

Click to add logo

#ALTERYX18