Beyond finance: forensic data analysis
When Scotsman David Stewart became a CIMA member he never imagined he'd be chasing down fraudsters in Toronto. This is the first article in a series on members whose careers have expanded beyond the finance function. By Toronto-based freelance writer, Paul McLaughlin.
When a major Canadian lottery operator commissioned the largest analysis of lottery data ever, it turned to David Stewart ACMA, to head up the challenging task. ‘The Ontario Lottery and Gaming Corporation (OLG) asked us to take a look at all the transactions related to their lottery games over a period of 13 years to look for possible fraudulent behaviour, especially by retailers who redeemed winning tickets,’ said 41-year-old Stewart, the national leader of the analytic and forensic technology practice for Deloitte & Touche in Toronto. 'We ended up analysing 200 billion data.’
Stewart’s team was able to manage such an onerous undertaking thanks to the state of the art forensic lab that he and other Deloitte senior personnel created. ‘Ours is the largest private lab in Canada, as far as I know,’ said Stewart, who was born in the small town of Inverurie, near Aberdeen in Scotland.
The sprawling open space facility, which provides computer forensics, data analytics and e-discovery services, takes up more than 8,200 square feet in an office tower in downtown Toronto. ‘We have the capacity to analyse 250 terabytes of data simultaneously,’ Stewart said. ‘That’s equivalent to analysing more than 6,000 laptops.’
High security
Security is understandably paramount at the lab, which cost around £2.5 million to build. To protect it from accidents or intrusions, the lab has several key features. ‘We contracted our own outside security firm in case something goes wrong,’ said Stewart. ‘So the office tower’s building staff can’t just come in if there’s a problem. We have our own computer network that’s separate from the rest of Deloitte. We have a separate sprinkler system from the rest of the building, so we can buy some additional time prior to the sprinkler being activated and the crews arriving on the scene.’
Stewart came to Canada in the late 1990s, after his girlfriend, now wife, took a position with a film company in Edmonton, Alberta. He had recently qualified with CIMA, having started his studies in 1994 while working in the trust finance unit of the National Health Service in Edinburgh. An interview with Deloitte led him to join its small Edmonton forensic unit, where his clients ranged from Fortune 500 companies to native reserves. While in Edmonton, he was part of a group that created Deloitte’s first forensic lab in Canada, an experience that paved the way for a move to Toronto in 2007 and his present position.
As Stewart sits in a Deloitte boardroom, a large sign above his head claims: ‘If there’s evidence, we’ll find it.’ The work done at his lab, however, goes beyond that level, as evidenced in the findings presented to the OLG. ‘We used Self Organising Maps (SOM), which is a powerful artificial intelligence technique that can make sense of high dimensional and complex data,’ he said.
SOM is a sophisticated ‘data to expertise’ technique to determine seemingly unconnected relationships when considering virtually every piece of relevant data in a case. For the OLG investigation, Stewart’s team used SOM to explore 897 different attributes when considering each single transaction, such as the type of lottery game played, each wager placed, the time of day, and on which day the transaction took place.
Getting under the bonnet
For this aspect of his work, he found his CIMA training especially beneficial. ‘Management accountants are trying to determine and understand the drivers of a particular behaviour, which is exactly what I do in my job,’ he said. 'I’ve used my CIMA background so much here because it taught me how to get under the hood [bonnet] of a transaction. Effective fraud detection requires you to think like fraudsters, understand how they could beat a system before you prevent or catch them. In cost accounting you need to know what the costs affecting the overall system are. To me, those approaches are very similar.’
When Deloitte presented the OLG with its findings, it included revelations connected to the original mandate, which was to discover if suspicious winnings involving insiders had occurred. But it also presented valuable information, gleaned from the SOM approach, on how the OLG could use its data ‘to better understand its marketplace, prevent and detect potentially fraudulent behaviours, implement tighter controls and build better business processes.’ The client responded favourably, requesting suggestions on how it could realise these benefits.
When Stewart was studying to become an ACMA, he never imagined he’d be finding deleted files on a fraudster’s hard drive or analysing boxes full of documents to uncover clues of wrongdoing. Or that his CIMA training would contribute so meaningfully to his success.
September 2009
Back to Insight front page
What did you think of this article? Email tim.cooper@cimaglobal.com.