Guidance Note for Forensic Accounting and Investigation Standard No. 410 on Applying Data Analysis focuses on the practical application of data analysis techniques to support Professionals in conducting work procedures during a FAI engagement in accordance with the Standard. The objective of this guidance note is to provide the Professional with information, approaches, and illustrations to assist in the development and implementation of data analytics techniques that support the hypothesis in the FAI engagement. It covers various aspects such as establishing a Data Analysis Plan (DAP), identifying data sources, ensuring data integrity, performing data collection and analysis, utilizing tools and techniques for data analytics and reporting, testing reproducibility, and data preservation. Additionally, the guidance note includes examples and illustrations to aid Professionals in applying similar work procedures that are relevant to the specific circumstances of the engagement.
Digital Accounting Assurance Board
The Institute of Chartered Accountants of India
1st June, 2023
GUIDANCE NOTE FOR FORENSIC ACCOUNTING AND INVESTIGATION STANDARD NO. 410 ON APPLYING DATA ANALYSIS
EXPOSURE DRAFT Approved by DAAB (On 1 June’23)
This Guidance Note provides technical clarifications and implementation guidance on how to prepare for and conduct work procedures on Forensic Accounting and Investigation Standard Number 410, on “Applying Data Analysis,” issued by the Institute of Chartered Accountants of India (ICAI) and should be read in conjunction with all the Standards relevant to the topic. The contents of this Guidance Note are recommendatory in nature and do not represent the official position of the ICAI. The reader is advised to apply his best Professional judgement in the application of this Guidance Note considering the relevant context and prevailing circumstances.
1.0 Introduction
1.1 Data Analytics (DA) being a dynamics area of practise, a lot rapid developments are underway, especially in the tools and solutions available to undertake Forensic Accounting and Investigation (FAI) engagements.
1.2 FAIS 410 on “Applying Data Analysis” expects the Professional to understand the technical aspects of DA and to deploy the evidence gathering power which it provides in an intelligent manner.
1.3 The requirements of the Standard are expected to be implemented by:
(a) Developing and applying a methodical approach, starting with a Data Analysis Plan and preparation.
(b) The detailed work procedures are expected to follow an iterative process and apply Hypotheses techniques for an effective gathering of evidence.
(c) By ensuring certain key protocols of data integrity and data preservation, the relevance and reliability of the evidence can be maintained.
2.0 Objective
2.1 This Guidance Note (GN) deals with practical application of data analysis (DA) techniques to support the Professional in carrying out work procedures when implementing the requirements of the Standard during the course of a FAI engagement.
2.2 The overall objective of this GN is to provide the Professional with information, approach and illustrations to assist in developing application of data analytics techniques in an FAI engagement in supporting the hypothesis.
2.3 FAI engagements incorporate data pre-processing steps, performing data analytics with consideration, such as data confidentiality, integrity etc., along with area such as:
(a) Establishing framework for Data Analysis Plan (DAP).
(b) Procedures which can be undertaken for Data Source Identification, Data Integrity, Data Collection, Analysis and Preservation.
(c) Introducing tools and techniques of Data Analytics to assist in Data analysis and Reporting (DAR) process \
(d) Test of reproducibility.
(e) Data preservation.
2.4 The GN also provides examples and illustrations to help the Professional apply similar work procedures which may be relevant to the circumstances of the engagement.
3.0 Procedures
3.1 Data Analysis Plan: Data Analysis Plan (DAP) act as a high-level blueprint for the Professional obtains understanding of the issues under consideration, Source, quality and type of data available, data fields, size of the data etc. Upon an adequate understanding of data, one may be able to develop a DAP for the FAI engagement At this stage, the FAI Professional may prepare DAP comprising of the different type of data analytics tests/techniques to be performed
3.2 Content of typical DAP: Depending on the engagement and availability
of the data and information to the Professional, a sample list of what may be included in the DAP is as follows (indicative list):
(a) Purpose: The expected outcome from the data analysis test.
(b) Hypothesis / Assumptions: which need to be proved/disproved through the DA tests.
(c) Data Source: Source from where data needs to be extracted.
(d) Data Integrity Checks: Procedures to check authenticity and reliability of the data set.
(e) Work procedures / DA Tests to be performed: The set of procedures which needs to be performed to achieve the purpose and will be part of the test of reproducibility.
(l) Limitations: Any expected limitations which may prevail or may be encountered while carrying out DA test. Limitations may only be captured once the data has been understood in detail.
(g) Negating false positives: Procedures to identify false positives (“false alarms”).
(h) Person performing tests: Name of the team member who will be performing the DA test.
(i) Person reviewing the outcome: Name of the team member who will be reviewing the outcome of DA test.
(j) Minimum set of fields required in the output: It may also be noted that the DAP may not be fully executable due to data quality issues, data boundaries etc.
For an indicative template of a draft DAP – See Annexure A.
3.3 Data Preparation and integrity: The data preparation for the data analytics include data acquisition and validation.
(a) In accordance with the DAP, the Professional reviews the data integrity and adherence to data boundary, with adequate precautions to ensure admissibility before Competent Authorities. Though, it is a good practise that the data is extracted from the back-end databases, however, it may not be feasible in all situations due to certain limitations.
(b) Irrespective of the process of obtaining the data, the FAI Professional may undertake certain precautions to ensure data integrity, completeness and accuracy. This may be done by matching control totals, ensuring subtotals match with the original data source, etc.
(c) For example, the completeness and accuracy of balances of General Ledger and Trial Balance obtained for previous years may be validated through reconciliation with audited financial statements; the figures of sales and purchase dump may be reconciled with the balances in the Trial Balance.
(d) Similarly, the integrity of data can be ensured by performing checks between data obtained from back-end and same data obtained from front-end. Various tests such as sequencing check, blank rows/ columns, chronological order etc. may be applied to check the integrity of data. While performing this exercise, the robustness of accounting software must be kept in mind. And if these checks fail i.e., completeness or accuracy of the data cannot be ensured then manual procedures may need to be performed as if no accounting/financial system exists.
(e) For ensuring data integrity, the Professional must ensure that the source data obtained has not been tampered with. This may be done by way of:
1. Ensuring the data is extracted in their presence and the same file is shared with the FAI Professional
2. Getting accesses to the ERPs of the clients/target and extracting the information directly by themselves.
3. Reviewing the time stamps of data extraction from the ERP or source systems.
4. In case external data is provided by third parties which are used in the course of the DA, then an appropriate confirmation may be taken from the external party like banks., vendor etc. with respect to the Integrity of the data
(f) Once the integrity of the data is validated, FAI Professional may prepare the relevant data sets on which analytical procedures needs to be carried out. The data prepared may comprise of the relevant fields which would be essential for carrying out the data analysis for the relevant assignment.
3.4 Data Analysis and Reporting (DAR): At this stage, the Professional undertakes execution of all critical data analysis identified in Data Analysis Plan (DAP). The Professional is expected to be familiar with the available DA tools, techniques, algorithms/codes/queries/models etc used for the engagement and its relevance to the hypothesis.
If feasible, a record of the details of analysis performed may be kept.in line with the requirement of test of reproducibility.
An indicative template of a draft DAR is provided in Annexure A.
3.5 Data Preservation: Data preservation is critical to the admissibility of DA finding in the court of law. The Requirement of “Test of reproducibility means that the same result can be recreated by following a specific set of steps with a consistent dataset. The Professional need to ensure that all the test of reproducibility is possible on all the data analytics done by the team. The Professional with have to provide for future access and reference to the DA.
The Professional may refer to the requirements of FAIS 420 and other legal provision to be referred on the admissibility of the evidence before a Competent Authority.
3.6 Some of the commonly known advanced tools available for data analysis includes Knime, ACL, IDEA, SQL, SAS, Python, R, among others. Such tools are based upon statistical techniques and require specific trainings to use them efficiently. Besides, there are many data visualization tools available that have graphic data representation capabilities along-with limited data analysis capabilities, such as Power BI, Tableau, etc. This is not an exhaustive list and the purpose is to bring awareness amongst the Professional on the existence of such tools. The Professional may take decision on the tools and its use in the course of the engagement.
NOTE: ICAI does not endorse any Data Analytics tool as mentioned in this Guidance Note and these tools are simply indicative in nature.
3.7 During the course of performing DA tests, the Professional may discover patterns or anomalies or trends, which could be of relevance to the overall engagement. However, upon obtaining initial results from DA tests, the Professional may examine for false positives, revise the tests where appropriate and perform iterative procedures until more reliable and satisfactory results are obtained.
For instance, while performing data analysis for potential splitting of Purchase Orders, the initial results may include some genuine business scenarios, as well, and these scenarios were not incorporated in the initial design of the DA tests.
The Professional is required to discuss the initial results with the process owner to make sure that these genuine business scenarios are filtered out. It is pertinent to note that results from DA tests by itself may not be conclusive, since the objective of DA work is to primarily assist the Professional in shortlisting areas of concern for greater forensic analysis. Therefore, it’s important that the results of the DA tests are subjected to further forensic analysis through a review of supporting documents. An iterative approach needs to be used.
3.8 Depending on the nature of assignment and expected consumer of the data analysis, output of the data analysis may be presented in a format understandable to the recipient and tailored to the needs and objectives of the respective engagement. The Professional may adequately capture the limitations pertaining to Data Analysis Report (DAR) process, which may form part of the working papers.
For example:
(a) Incomplete Data: If there are any gaps in the data set such as data missing for certain dates.
(b) Missing data fields: Instances wherein data doesn’t comprise of few relevant fields (such as vendor location) basis which certain additional analytics could have been performed.
(c) Data Source limitation: Instances wherein data could not be extracted from back-end.
(d) External Data source: Instances where the data is sourced from external parties and what are the confirmation taken on the same.
3.9 The Professional may gather certain datasets comprising of Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII), in the form of master data or unstructured data like emails, on which global laws may be applicable. Hence, FAIS 130 on “Laws and Regulations” may be referred to ensure confidentiality and storage of such data in accordance with the applicable rules and regulations.
3.10 The Professional may also gather unstructured data like emails, correspondence in word/text files, code and program files, PDFs, social media feeds, web portals, records of chats etc. With advancements in technology, Professionals can now analyse these unstructured data using natural language processing (NLP) and machine learning (ML) algorithms. This analysis can help Professionals identify potential fraud, assess risks, and improve the overall review process.
Additionally, Professional can use unstructured data to perform sentiment analysis, which can provide valuable insights into an organisation’s reputation and public perception. Overall, the use of unstructured data in data analytics can enhance the accuracy and effectiveness of the Professional, allowing him to provide more valuable insights and recommendations to their clients.
3.11 Forensic Accounting and Investigation (FAI) engagements are dynamic in nature. FAI Professional may exercise their judgement while applying the data analysis tools and techniques.
4.0 Explanations with Examples
4.1 An Illustrative DA tests which may be run by a Professional during a Forensic Accounting assignment involving allegations in the Procure to Pay function, may be as below (indicative list):
(a) Four-way match of quantity and price, i.e., Purchase Requisition (PR) vis-à-vis Purchase Order (PO) vis-à-vis Goods Receipt Note (GRN) vis-à-vis Invoice.
(b) Invoices booked at the end of Financial Year or end of the Quarter.
(c) Fund trail/Money trail in an engagement to trace the flow of the money.
(d) Significant price variation for the same material (between procurements from same vendor or procurements from different vendors).
(e) Invoice/ Payment Splitting.
(f) Purchase Order Splitting.
(g) Substantial price difference for the same material by the same or different vendors.
(h) Payment date before invoice date.
(i) Goods received before issuance of PO.
(j) Round amounts.
(k) High value invoices/ payments.
(l) Duplicate invoices/ payments.
(m) Payments over weekends/ holidays.
(n) Payments processed before the due date.
(o) Vendor details matching with employee data or customer data.
(p) Multiple vendors with same details/ coordinates.
(q) Person in charge of procurement is the same person approving the GRN.
4.2 An Illustrative DA tests which may be run by a Professional during a Forensic Accounting assignment involving allegations in the Order to Cash function, may be as below (indicative list):
(a) Two-way match of price, i.e., Delivery Order (DO) vis-à-vis Invoice.
(b) Three-way match of price, i.e., Delivery Order (DO) vis-à-vis Invoice vis-à-vis Goods dispatched.
(c) Goods invoiced but not dispatched.
(d) Goods dispatched prior to invoice date.
(e) Duplicate invoicing.
(f) Sales made through dummy employees.
(g) Sales made over weekends/ holidays.
(h) Duplicate customer codes with different credit limits.
(i) Outstanding more than the assigned credit limit.
(j) Ageing of overdue invoices or long outstanding.
(k) Sales booked at the end of the month and sales return in the next month.
(l) Payments received from one customer applied against another customer.
(m) Multiple customers with the same contact details (email, phone number etc.).
(n) Discounts more than the pre-defined limits.
(o) Utilization of fund.
(p) Round tripping of transaction.
4.3 As mentioned earlier, the DA procedures may provide various anomalies, however, there may be a possibility that the outliers noted, may neither be false positives, and neither be reportable fraudulent anomalies. For instance, there may be a genuine business transaction, wherein payments were made on holidays or payments, or receipt of goods were made before the invoice or PO dates. These instances may be carefully reviewed and must be accompanied by proper approvals and a reasonable business justification for these outliers.
4.4 The Professional must apply considered judgement to ensure that these exceptional transactions are justified and necessary documentation is in place to evidence the requisite approvals and justifications for their deviations from the norms.
4.5 In this GN, an illustrative format of Typical Data Analysis Plan (DAP) has been included to provide an overview of the nature of information to capture in such a document – See Annexure A.
5.0 Annexure A: Data Analysis Plan (DAP)
Test ID |
DA Test |
Purpose |
Hypothesis |
Data Source |
Data Integrity Check |
Limitations |
False Positives |
Executer |
Reviewer |
Every test may be given a unique ID |
Test which needs to be performed |
Expected outcome of the DA |
Hypothesis against which DA is being performed |
Reference to source from where data needs to be extracted |
How to check integrity for the data being obtained |
Any expected limitations |
Procedures to negate false positives |
<<Name>> |
<<Name>> |
DA#1 |
Duplicate vendor invoices |
To ensure that vendor invoices are not paid more than once |
Combination of (Vendor code + vendor invoice no + invoice amount) is unique |
SAP |
While downloading data from SAP, make sure:i. Full year range is considered till dateii. All vendor types are included |
In case of report runtime error, you may like to split the report into shorter duration and then merge the reports |
Do a sample check of the red flags identified for any possible false positive |
Kiran (Audit Executive) |
Rajiv (Audit Lead) |
