Matt Reeder (mtreeder@orrick.com) is an Associate with Orrick Herrington & Sutcliffe LLP in Washington, DC. John Kim (john.kim@controlrisks.com) is a Director with Control Risks in Washington, DC.
This is the second article in a two-part series.
In the first part of our series, “Developing a data analytics–enabled compliance program for the real world,”[1] we offered a three-step method for building data analytics–enabled compliance systems incrementally upon existing data sets and capabilities. Now, we turn our attention to how data analytics can enhance compliance programs that have inventoried their current capabilities, identified useful data sets, and mobilized their resources to execute an established plan.
The hallmarks of an effective data analytics–enabled compliance program are adaptability and specificity. The more adaptable a data analytics program is, the more readily it can integrate new data sources, respond to new regulatory or legal requirements, and be applied across changing business practices. Taking a multitiered approach to data analytics and implementing a continuous feedback loop will ensure an appropriate level of adaptability. Data analytics outputs must be sufficiently specific. This specificity ensures that effectiveness is measurable. Vague evaluation criteria or outputs based on loose correlations do not yield actionable information.
With these hallmarks in mind, we describe three data analytics techniques that will empower a mature, data-enabled compliance program to apply data analytics more effectively. They are rules-based tests, statistical and trend analyses, and machine learning. Understanding these techniques will allow compliance professionals to work toward incrementally adopting a multitiered approach to data analytics.
Each of these techniques has unique costs and benefits, but they can work together. Adopting all three maximizes detection rates, minimizes false positives, and marshals more useable data in service of the compliance function. Furthermore, applying all three techniques creates a virtuous feedback loop that fosters adaptability. This full-fledged application of data analytics creates momentum for the compliance function that augments, amplifies, and multiplies the effects of the more traditional components of a compliance program.
Rules-based tests
Rules-based tests are often small pieces of computer code (scripts) meant to identify behaviors, characteristics, or actions. They are typically designed to signal a specific behavior, the presence (or absence) of which may require the attention of—or correction by—a compliance professional. These behaviors can then be coded as procedural rules that are structured in an “if/then” format that targets a specific transaction set or behavior type.
Rules-based tests find information such as:
-
Expense amounts below—but within a certain range of—an approval threshold,
-
Duplicate names or addresses between vendors and employees, and
-
Duplicate or sequential invoice numbers.
Satisfying one of these rules-based tests does not by itself indicate misconduct. But misconduct is often accompanied by behaviors that do satisfy such tests. Thus, when aggregated and included in compliance monitoring or testing workflows during red-flag testing, rules-based tests can reveal patterns and trends that merit further inquiry or investigation. Each positive can be flagged, and the totality of these red flags can offer insights into risks across an employee group, within a business unit, relating to a specific transaction type, in a limited geographical area, etc.
Benefits
-
Rules-based tests are proven and effective tools for harvesting the low-hanging fruit in existing data streams.
-
The tests are often easy to implement.
-
Learning to understand and use the results of rules-based tests is fast, simple, and cheap.
-
Compliance professionals can collaborate directly with their IT departments and internal stakeholders to develop, adopt, and deploy these rules-based tests on an ongoing basis.
Drawbacks
-
The tests are often limited to known and observed behaviors, characteristics, and actions.
-
The known behavior that a subject matter expert recommends as a test criterion is likely a behavior that a would-be bad actor would know about and could use to game the test or avoid altogether.
-
Rules-based tests are rigid and therefore cannot “learn” to identify rule-avoidance behavior. Thus, relying too heavily on rules-based tests can set the stage for a game of compliance whack-a-mole that involves an endless series of time-consuming and labor-intensive refinements.
-
Since rule-based tests run on broad swaths of enterprise data, false positives can create significant noise in the compliance monitoring signal that diminishes the testing data’s usefulness.
