Wednesday, January 28, 2009

PATTERN RECOGNITION - EFFECTIVE TOOL TO FIGHT MALICIOUS INTENT

EFFECTS OF DATA PATTERN RECOGNITION


BUSINESS BACKGROUND

1. Most of the organized retailers are alive to the situation of possible fraudulent refund transactions but still they have to caters for two aspects as part of refund policy :-

(a) Customer satisfaction – ensuring that in case of defective product being sold from their shop, the customer should have a hassle free refund for this defective product.

(b) To cater of wrong Billing – in case of wrong billing to customer, there should be a process to reverse the sales and refund the amount to customer.

2. Generally the Standard Operating Processes, designed by the businesses, have the following thought process to exercise controls over the refund policy :-

(a) Refunds are time bound ie no refunds after stipulated time line.

(b) Refund being sought should be supported by original bill of sales.

(c) Refund process should be supervised by store supervisor as a check on cashier.

(d) Periodic checks on refund transactions by store managers and city heads.

DETECTION OF FRAUDULENT CASES BY DATA PATTERN RECOGNITION

4. In the event of failure of all of the above checks (quite common and frequent), pattern recognition of available data can indicate possible fraudulent refund cases.


5. During day to day activity at store levels, huge sales data gets captured by the system and is stored in data ware house. That would include data on return sales, by default. The following data can be listed out in appropriate layout to assist data interpreter :-

(a) Data on bills having negative value.
(b) Data on bills having sale reversals within a bill.
(c) Data on sale reversal for a particular store along with the last time this article was sold from store (for which sale reversal was affected).

6. Every fraudulent mind has a set pattern and no two fraudulent minds (if not planning jointly) would resort to same means to derive personal benefits through fraudulent activities. In the instant case, there could be following set of pattern emerging from the data analysis, which could be indicative of a possible fraud :-

(a) A cashier could be most comfortable in carrying out fraudulent refunds of high value SKUs only.

(b) It could be that a cashier is comfortable carrying out refund at specific times only ie at times when there is least customer presence or a time nearing the shift end or at time when store senior staff is not present at store etc.

(c) Periodicity of refund transaction is one of the major indicators of possible fraud.

(d) A cashier could be comfortable in affecting refunds for articles never sold during the permissible time line.

EFFICACY OF PATTERN RECOGNITION ( AN EXAMPLE)

7. Data in requisite format was pulled out for the period of 30 days for one particular state. It was compiled so as to have a HISTORICAL perspective. On applying required filters, it emerged that in one particular store, there was repeated negative sales of certain staples (all of them used as ingredients for preparation of SOUTH INDIAN DISH). The data was analyzed in following phases :-

(a) The analyses indicated that a particular cashier ID is being used to carry out sales reversal for these SKUs (ground verification later proved that this cashier was of South Indian Origin).

(b) The refunds were being affected between 1400 hours to 1445 hours. (shift duty of this cashier was upto 1500 hours). Reversing sales of particular SKUs nearing end of shift timings indicated that it was not customer related refund case.

(c) Further analyses of data proved that sale reversal was happening for continuous 6 days, with no sales reversal of these SKUs on 7th day. This was due to the fact that front end cashiers have a day off after 6 days of duties.

(d) For the period under review, it emerged that for 2 consecutive days, there were no sales reversal for such SKUs from this store indicating absence of this cashier during these days (it got proved later that he was on leave during those two days).

8. Armed with this analyses, the Security Team visited the store and it got verified that :-

(a) There were no customer dockets to support such refund transaction (Supervisory checks incorporated in SOP failed to detect this anomaly).
(b) This South Indian cashier was the only one involved in carrying out refunds of the articles in question (it got proved that there was no customer/ quality issue related to these SKUs. Had that been the case, other cashiers would also be forced to carry out similar transactions – but that was not the case).

(c) On being questioned, the cashier explained that he used to spare Rs 100/- everyday by this activity and also take home the SKUs for meals.

Thursday, January 22, 2009

VENDOR FRAUD

TAXI VENDOR FRAUD


BUSINESS PARAMETERS

1. Generally the companies follow the following business process / Standard Operating Procedures with regard to hiring of taxis for company executives :-

(a) Vendor development shall be a routine activity and at any given instance, the business should avoid monopoly by any single or cartel of vendors.

(b) In case of vehicles being hired (Taxi) from the vendor for company’s designated officials, the following parameters shall apply :-

(i) Administration Deptt shall obtain business approval for hiring a particular vehicle indicating the person for whom it is hired, the duration of hiring and the type of vehicle to be hired.

(ii) On receiving the approval, the Administration Department shall call for quotations from different vendors.

(iii) Lowest bidder shall be given the business keeping the quality of the services in mind.

(iv) In the case of monthly hired vehicles, specified contractual monthly rates shall not be exceeded.

(v) There shall be a log book (containing Km reading at start of duty, Place from and to, Km reading at end of duty, Total Mileage done, duration of duty etc) maintained for each vehicle and the same shall be signed by the user every day. Details mentioned in the log book shall be deemed authentic and vendor shall be paid accordingly.

2. The present issues involve all or some of the above business processes and how their violation effect the company. Such violations have a telling effect on the company bottom line. Details of the same are narrated in subsequent paragraphs.

THE DETECTION OF POSSIBLE AVENUES OF VIOLATIONS OF ABOVE PROCESS

3. During one of the routine conversations with internal administration department, the discussions revolved around vehicle hiring process. It emerged that every month the vendor is paid out for much more mileage than what is routinely contracted for. For example, the vehicles are contracted at specified rates for 3000 kms per month, vendor would claim for about 4000 Kms and was paid out accordingly. It also emerged that such vehicles are hired for officers of the rank of AVP and above (in exceptional cases for official of lower designation also). Later the topic got changed but this casual remark set the investigators thinking.

4. The following implications of above inputs were evident :-

(a) The contracted mileage translates into vehicle being hired for doing 100 Kms per day for all 30 days of month including on Sundays and Holidays.
(b) The level of officials for whom such hiring is done are generally ‘Office’ bound. Though, out station supervisory visits are also common.

(c) Just to cross check the facts, it was found that they did not attend office on the following days of the month :-

(i) On Sundays and Holidays (Four days deducted from 30 days of calendar month).

(ii) They remain on outstation tour for 3-4 days a month (another 3-4 days deducted).

(iii) It implied that on an average, the vehicle must run for 136 Kms every day, just to reach the contracted mileage of 3000 Kms per month. For being eligible to claim for 4000 Kms the vehicle should run about 180 Kms every day.

(iv) Travelling this distance in place like NCR, it would require about 4-5 hours of travelling every day.

5. Generally the vendor was regularly claiming to have exceeded the contracted mileage, the above analysis warranted a detailed inputs as to how this was being done and being claimed.

THE PROOF

6. Some leg work was involved in terms of visiting various local taxi vendors. The guise taken was that we are also the ones looking up to set up taxi services in their collaboration and wanted to learn the tricks of trade. Efforts paid off when during one such visits, one of the established taxi vendor taught us the trick. He claimed that there are gadgets which can inflate the kilometres being done by the vehicle even when the vehicle is stationary. On further insistence, he directed us to a particular local market in Delhi, where such gadgets are available. The term used for such gadget was ‘FIRKI’. Installing FIRKI would enable our taxi driver to inflate the mileage of even stationary vehicle.

7. Next logical step was to visit the local market and see for ourselves the indicated gadgets. The shopkeeper was more than eager to help us in correct selection based on the kind of speedometer our vehicle is fitted with. He explained as follows :-

(a) Vehicles With Digital Speedometers. For such vehicles the device required was digital FIRKI. In that a small gadget is fitted under vehicle dash board with a hidden switch. The switch is not visible to unsuspecting customer. The device draws current from vehicle battery and is connected to speedometer. Under normal circumstances, when the vehicle moves, the original speedometer gets electrical impulse in proportion to vehicle speed, which makes the speedometer record the inputs. However, this device (FIRKI) also does the same thing but in stationary vehicles. When the switch of the device is switched on – it provides the impulse to vehicle speedometer thereby making it record speed and Kms. The cost of such device is Rs 250 to 350 depending upon type of vehicle.

(b) Vehicles With Gear Type Speedometer. Vehicles of older version are fitted with gear type speedometers. In such vehicles a small modification is carried out to fit additional gear. This gear makes the speedometer move. The additional gear has an attached cable whose open end is conveniently accessible to driver. When the vehicle is stationary, all that driver needs is to rotate this extended cable to make the speedometer move and record additional Kms of stationary vehicle.

8. In such a way, the vendor was able to artificially inflate the kilometres of vehicles and claim on such inflated mileage. Such vendor was able to cause a very heavy loss to the company by resorting to dishonest means.

9. Lessons Learnt. Though the laid down business process / Standard Operating Procedures are apparently strong and foolproof but still they failed due to the following reasons :-

(a) Generally, a strong comfort zone gets developed between the vendor and administration department. The reasons are simple – the vendor will not like to loose client and administration persons are saved efforts to cultivate some one new. This relationship is obvious fall out of lack of supervisory controls.

(b) Vehicle users (Senior Officials of the company) generally feel that it is below their dignity to verify the Kms being recorded in log book and being signed for by them. The drivers were also smart, they never presented log book for signatures at end of day. Instead, they used to present the same on periodic basis. More diligence by users would have prevented the loss.

(c) Checks by administration department and commercial department while scrutinizing the bills, were given a ‘go by’ thinking it to be a routine affair rather than part of their serious duties. Basic common sense checks by them could have helped in detection at early stages.

Sunday, January 18, 2009

WHEN THE FENCE STARTS EATING THE CROP

FRAUDULENT MARKDOWN, SWEET HEARTING AND INTERNAL THEFT

BUSINESS PARAMETERS

1. With regards to check fraudulent mark downs, cases of sweet hearting and internal theft, a retail business modelled on SAP usage, would generally design the following parameters :-

(a) If it is a franchisee model, then losses up to certain level would be recovered from the franchisee.

(b) Mark downs shall be permitted on STAND ALONE bar coding machine as controlling it centrally on portal basis is not only prohibitive in cost in a large chain, but, also due to the amount of data handling, it cannot be handled centrally.

(c) Certain conditions would be laid down to monitor mark down process.

(d) To control sweet hearting, retailers would implement sound security policies entailing additional cost in infrastructure like CCTVs, posting of security guards etc.

(e) Effectively monitor shrink levels at front end.

2. Evidence suggest that despite stringent controls laid out in the SOPs of the business, a fraudulent mind shall try and remain a step ahead of business controls.


VIOLATIONS TO ABOVE PROCESSES

3. Case No 1 (Fraudulent Mark Downs)
Though the business process lays down adequate checks to control this activity, but, it has been noticed that the supervisory functions fail at relevant time by design or default. For example, there is a motivation for franchisee to get involved himself / herself in this act for the following reasons :-

(a) It is known fact that by resorting to dishonest practices, he lands up earning more than what he would be paying as compensation to losses.

(b) Though, the processes lays down adequate checks in system in terms of data monitoring but it has been experienced in Indian conditions that :-

(i) There are no data analyst (pattern recognizers) placed suitably to detect such cases.
(ii) There is a serious mismatch between the revisit capability of Security and Loss Prevention team at stores. Ideally, all such cases should have been detected during the period that contains original recordings and those recordings are not overwritten. For example, if the CCTV recordings are available for 10 days, then the loss prevention team should be able to analyse all transactions within this span of time to cross check their findings, otherwise, the data would get over written and would be lost forever.

(ii) Shrink figures can be dressed to look attractive as is exemplified in separate blog on the subject.

(iii) Printing bar code labels for such markdowns on stand alone machines is a serious business drawback and can only be controlled if suitable reports are generated based on data available in data warehouse.


4. Case No – 2 (Sweet Hearting) As routine matter, all major retailers have installed CCTVs to deter the cases of sweet hearting. But, that is only half job done. The efficacy of such centralized CCTVs is best demonstrated when used as “preventive tool” rather than “detection tool”. It implies that CCTVs should be continuously monitored from back end and FRONT END TEAM MUST HAVE A FEELING THAT THEY ARE BEING OBSERVED CONTINUOUSLY. That is best achieved when back end team constantly keep feeding inputs to front end team in total synergy of efforts.

5. It is a proven fact that over a period of time, if the most honest person is constantly conveyed a fact that dishonest person is getting scot-free continuously, there is hardly any incentive left for people to remain honest.

6. Case No –3 (Items being taken away from exit without bill). Such instances are not a figment of imagination, but, a fact of life in present day scenario where in the deployment of Security Guard conforms to more of fashion trend rather than a preventive tool. This can be best avoided if suitable contract is signed with service provider indicating that the agency would be suitably fined should their Security Guard be found indulging in such malpractices. HAVING A SECURITY GUARD WITH NO CONTROLS IS MORE DETRIMENTAL TO BUSINESS THAN NOT HAVING A SECURITY GUARD AT ALL.

RECOMMENDATIONS
7. The following are recommended :-
(a) Suitable reports can be generated from the available data in data warehouse, which could be used to discern a pattern and establish the prima facia case.
(b) Security and loss prevention team should have a revisit capability depending upon the time
for which recordings in CCTV storage device are available.
(c) Suitable data reports be generated to discern if shrink figures are being dressed up or not.
(d) Exemplary fines be imposed on security agency providing security guards in the event of
their guards being found guilty of acts causing loss to the company.
(e) Build a culture of honesty in business. It is best done by talent transformation team,
continuous sharing of experiences by security team and rewarding he honest employees.




Tuesday, January 13, 2009

DRESSING UP OF SHRINK FIGURES


BUSINESS PARAMETERS

1. An organized retailing business using SAP for inventory management, would design the following parameters to measure shrink (ie what inventory it is physically holding measured against what it ought to have as per books – negative variation is termed ‘Negative Shrink’)

(a) At stipulated intervals, it would carry out physical count of all its merchandise at its business site. That data would be then uploaded in SAP, which shall then generate data on ‘Overall Shrink’ (in terms of monetary values and also by individual articles).

(b) All Goods Receipt Notes (GRNs) have to be closed before a physical count document is generated.

(c) Once the physical count document is generated from SAP, it would give current book stock against each SKU. Thereafter, a physical count of all SKUs is taken separately and is posted in SAP. SAP would then calculate negative and positive shrink.

(d) Overall Shrink is the cumulative effect of ‘Negative Shrink’ and ‘Positive Shrink’.

(e) ‘Negative Shrink' will get thrown up by the figures of Physical inventory count, wherein, the articles that have physical count less than that of book stock would get posted as negative shrink. Their monetary values shall also be reflected in negative.

(f) ‘Positive Shrink’ will get reflected in the system, when the physical count of a particular SKU is more than what is given in book stocks. Its monetary value shall be reflected in positive.

(g) BOTH THESE FIGURES COMPENSATE EACH OTHER WHEN FINAL SHRINK FIGURES ARE ARRIVED AT.

EXPERIENCES ON THE PROCESS

3. Experience indicates that the Negative Shrink and Positive Shrink come up due to one or the following factors:-

(a) Negative shrink can come up due to one or combination or all of the following :-

(i) Malicious Intent (Internal and External) ie SKUs getting stolen by internal staff or customers.
(b) Non Malicious Issues – could be problems in supply chain, wrong deliveries, wrong documentation, process issues, due to wrong physical count etc. etc.

(b) Positive Shrink can come up due to one or the combination or all of the following :-

(i) Malicious Issues – when the operations team deliberately decides to dress up shrink figures (wanting to project lower shrink figures when actual shrink figures are higher).

(ii) Non Malicious Issues – ie when mental intent of operations team is not to fudge but it has happened due to some errors like – wrong deliveries of merchandise to some store whereas they were actually meant for some other store or due to procedural lapses or due to wrong PI count in previous cycle or due to errors of omissions in supply chain or due to the fact that material is in transit ie it has been physically received at the store but document has not been closed in SAP.

4. Experiences show that when there is a pressure on operations team to control negative shrink, they could devise means to post positive shrink, with an aim to effectively off set negative shrink.

PREVENTIVE MECHANISMS

5. The following business process is suggested to discern if the operations team is resorting to dressing up the shrink figures :-

(a) Carry out a test PI count. That could be done with the support of data exported to Microsoft Excel which can randomly pick up articles as per defined parameter. Such a process shall impose caution of store team and improve their efficiency.

(b) Data warehouse can be designed to carry out pattern recognition and be suitably designed to pick up abnormalities in historical perspective.

(c) There needs to be dedicated PI Count teams which should be staffed by different stake holding teams like, it should have members from store, commercial, internal audit and loss prevention team.
(d) Under no circumstances, store holder should be tasked to carry out PI count process all by himself.