WO2006039102A2 - System, software and method for examining a database in a forensic accounting environment - Google Patents

Abstract

A system, software and method which enable the forensic examination of a database, particularly, a financial database such as a general ledger. The system, software and method leverage “n-“ or multi-dimensional data interrogation analytics, particularly, online analytical processing (“OLAP”), to enable real-time data analysis of various dimensions of multi-dimensional data in the database and identification of records that are unusual and/or significant including from patterns or relationships among the data.

Description

SYSTEM, SOFTWARE AND IMETHOD FOR EXAMINING A DATABASE IN A FORENSIC ACCOUNTING ENVIRONMENT

CROSS REFERENCE TO RELATED APPLICATIONS This application claims the benefit of U.S. Provisional Patent Application No. 60/614,769 filed on September 30, 2004, and the U.S. Patent Application of Yogesh Bahl, Bruce Gavioli and Joseph Looby titled "System, Software and Method for Examining a Database in a Forensic Accounting Environment" filed on September 13, 2005, the disclosures of which are incorporated herein by reference in their entireties.

BACKGROUND OF THE INVENTION

The present invention is directed generally to a new system, software and method that enable the examination of a database, particularly, a financial database such as, for example, a general ledger, to identify records (transactions) that are anomalous or otherwise significant (e.g., as an indicator of fraudulent activity). More particularly, the system, software and method according to the present invention employ real-time "«-" or multi-dimensional data interrogation analytics, particularly, online analytical processing ("OLAP"), to enable real-time data interrogation in a forensic accounting application.

As is known to those of ordinary skill in the art, OLAP is a category of software tools that provides analysis of data stored in a database. OLAP tools enable users to analyze different dimensions of multi-dimensional data. OLAP provides distinct advantages over known data mining tools (a class of database applications that look for hidden patterns in a group of data) ~ including the capability to identify more than just mere relationships among data, but rather the capacity to identify aspects of the data that are anomalous. As described in greater detail hereinafter, the present invention (including through its use of statistical functions) provides a new forensic tool that leverages the advantages of OLAP.

There is an ongoing effort in the accounting/auditing field, particularly, in the forensic accounting field, to design procedures to test the appropriateness of records in large financial databases. The system, software and method according to the present invention are a new response to the needs of this effort.

Forensic accounting involves the integration of accounting, statistics, technology and investigative skills. Forensic accountants are typically retained to investigate, analyze and interpret financial evidence (e.g., in investigations of criminal matters such as employee theft, securities and insurance fraud), to assist in the analysis and presentation of financial evidence, and to communicate their findings (e.g., by testifying in court as expert witnesses and preparing visual aids to support trial evidence). Forensic accountants are also called upon to assist auditors in investigating potential fraudulent activity. Forensic accountants can be engaged in public practice or by insurance companies, banks, police forces, government agencies and other organizations.

Conventionally, forensic examiners use commercial database software such as, for example, ACL, MS Access and MS SQL Server, to review general ledger transaction entries. However, these commercial tools do not perform OLAP and require the user to program a query for each question posed or test with respect to the data. Moreover, these commercial tools report voluminous amounts of data that are unwieldy and unreasonable to review and are often not useful. Accordingly, it is desired to provide a new system, software and method for use in forensic accounting investigations of financial databases that overcome the disadvantages associated with conventional software and methods and that enable, using OLAP, (i) an analysis of the same data sets, while breaking the data sets into different populations (e.g., income statement populations such as, for example, sales, cost of sales, labor, taxes, depreciation/amortization, interest and other income/expense), (ii) the identification of relationships between the populations and between the inquiries or tests with respect to the data, and (iii) the generation of results that are specific (useful) and that can translate into recommendations for the relevant users.

SUMMARY OF THE INVENTION

Generally speaking, the present invention is directed to a system, software and a method for effecting a forensic investigation of a database, especially a database containing financial information (e.g., a general ledger), using OLAP. The new system, software and method according to the present invention leverage known computer capabilities and electronic communications links to provide a new forensic accounting solution that enables the analysis of a financial database and the identification of risk areas, such as, for example, questionable transaction entries, indicative of material misstatements in an organization's financial records.

According to a preferred embodiment of the present invention, multi¬ dimensional data are stored in a database accessible to OLAP software having real-time data interrogation functionality. The software is adapted to analyze different dimensions of the data and to identify patterns and relationships among the data. The data are categorized into preselected categories. Templates defining data analysis attributes preselected to indicate significant and anomalous data are loaded into the software. Multi-dimensional data analysis is effected on the data in real-time based on the preselected template attributes and significant and anomalous data are pinpointed. Profiles comprising cubes (^-dimensional views of the database) and grids (two dimensional views of database records) are created and define maps to the database to facilitate navigation through the analyzed data. Navigation through the analyzed data is effected in "drill down" fashion (i.e., in the direction of decreasing dimensions of the data) based on the profiles. The result is an w-dimensional view of the underlying data including significant and anomalous data. A report of the significant and anomalous data is automatically generated, which can include actionable recommendations.

Accordingly, it is an object of the present invention to provide a new system, software and method that integrate accounting principles, statistics, technology and investigative techniques in a single forensic tool to enable forensic examination of a database of transactions to identify high-risk areas, such as questionable transaction entries, to detect material misstatements in an organization's financial records.

Still other objects and advantages of the present invention will in part be obvious and will in part be apparent from the specification.

The present invention accordingly comprises the various steps and the relation of one or more of such steps with respect to each of the others, and the system and software embody features which are adapted to effect such steps, all as exemplified in the following detailed disclosure, and the scope of the invention will be indicated in the claims. BRIEF DESCRIPTION OF THE DRAWINGS

For a fuller understanding of the invention, reference is had to the following description, taken in connection with the accompanying drawings, in which:

Fig. 1 is a schematic diagram of a system constructed and arranged in accordance with a preferred embodiment of the present invention;

Fig. 2a is a high-level flow diagram depicting the process steps carried out in conducting a forensic examination of a financial database using the new software which provides OLAP data interrogation functionality in accordance with a preferred embodiment of the present invention;

Fig. 2b is a flow diagram depicting process steps for effecting the step of pinpointing unusual significant records and cross-tabulating by attribute, user and/or source in accordance with the embodiment of the present invention shown in Fig. 2a;

Figs. 3a-3c depict exemplary file and field guidelines for the financial database, chart of accounts and trial balance for forensic examination in accordance with the present invention;

Figs. 4a-4i are exemplary computer screen outputs depicting various attributes analyzed using the new software which provides OLAP data interrogation functionality in accordance with a preferred embodiment of the present invention;

Fig. 5 is an exemplary computer screen output depicting an n- dimensional view of financial data generated using the new software which provides OLAP data interrogation functionality in accordance with a preferred embodiment of the present invention; and

Figs. 6a-6s depict exemplary user interface displays illustrating aspects of the process for conducting a forensic examination of a financial database using the new software which provides OLAP data interrogation functionality in accordance with a preferred embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

In assessing the reliability of the numbers underlying an organization's financial records/reports/statements, forensic accountants invariably look first to the general ledger (GL). The GL is often a very large computer database containing financial transactions for all of an organization's operations. GLs can have many millions and even billions of transaction entries (transactions entered into the GL).

Forensic examiners analyze GLs to meet objectives of the type established in, for example, the Statement on Auditing Standards (SAS) No. 99 which generally requires the examination of data (e.g., transaction entries, adjustments and estimates) for evidence of possible material misstatement due to fraud. To achieve such objectives it is helpful to (a) know who is posting to transaction accounts and when, (b) know the posting sources (computer terminals with internal controls, or spreadsheets and external databases without controls), and (c) identify significant and unusual entries that merit closer examination.

The system, software and method according to the present invention provide a new forensic accounting solution. According to the present invention as discussed in greater detail hereinafter, leveraging OLAP, the entire GL can be explored in real-time for records and relationships among the data that are both unusual and significant.

Although discussed herein in the context of a financial database, the particular example being a GL, it should be understood that the present invention is not limited to the investigation of financial databases such as GLs, but has application with respect to other types of databases as well.

Referring now to the drawing figures, Fig. 2 depicts a high-level flow diagram of a preferred method in accordance with the present invention for conducting a forensic examination of a GL using software according to the present invention which provides OLAP data interrogation functionality. The OLAP software according to the present invention is capable of analyzing, in real-time, different dimensions of multi¬ dimensional data in a GL database and identifying patterns or relationships among the data as described in greater detail hereinafter.

It should be understood that the OLAP software according to the present invention can reside on a conventional server 20 which can track how data are organized in a database and which includes functions for analyzing the data [see Fig. I]. There are suitable database servers available for nearly all the current major database systems. The server can be electronically coupled to a user interface 22 including conventional input and display devices. The user interface can be a remote interface coupled to the server via a publicly accessible global computer network such as, for example, the Internet.

In conducting a forensic examination of a financial database 24 in accordance with the present invention, the financial data (e.g., GL and chart of accounts listing account numbers used in the GL and their related information) under investigation are first obtained and loaded (in accordance with the appropriate database provider format) on a preferably separate duplicate read-only database 26 accessible to the OLAP software according to the present invention [Fig. 2, step 1; see also Fig. 1 and Fig. 6c]. Figs. 3a-3c illustrate sample file and field requirements for a GL, a chart of accounts and also atrial balance.

Desirably, the accuracy and completeness of the data load are measured/verified by the new software by automatically totaling amounts in accounts within the financial database [Fig. 2, step 2].

During the data loading process, the data can be flagged and statistical information added thereto as appropriate.

After the data loading process, summary statistics and metrics on the data can be generated to highlight any anomalous items [step 3]. Summary statistics and metrics can include (i) a sum and count of positive amounts, (ii) a sum and count of negative amounts, (iii) a sum and count of all amounts, (iv) minimum and maximum amounts, (v) a count of nulls and (vi) averages and standard deviations.

Financial data are broken out into specific categories and additional fields are added [step 4]. An initial analysis of the data is conducted and the data are broken out into income statement populations including, for example, sales, cost of sales, labor, taxes, depreciation/amortization, interest and other income/expenses, by periods, i.e., by day, month, a quarter or year. The data are also broken out into balance statement populations such as, for example, cash, accounts receivable, accounts payable and contingent liabilities.

Thereafter, the data are preferably reconciled to the associated trial balance to assess the accuracy and completeness of the data [step 5]. From steps 4 and 5, the level of activity of transaction entries within and across each income statement and balance sheet component can be ascertained and any unusual components can be identified. Accordingly, using, for example, a GL as the database under investigation, the new system, software and method according to the present invention are designed to enable the forensic accountant to efficiently conduct the following activity:

• run statistics on numeric/amount and date fields — assess whether the top (e.g., top 5) highest and lowest transaction entries are appropriate (are the highest and lowest dates reflective of the cutoffs of the file?/are the highest and lowest entries in the amount fields reasonable?) — compare to average amounts to understand what a "reasonable" entry would be;

• using the findings from the above activity, filter and extract any unusual findings ~ i.e., high/low transaction entries, entries close to cutoffs that would inflate earnings, unusual credits to revenue accounts, etc. — pull the records with the highest (e.g., 50) and lowest (e.g., 50) balances for farther review by a forensic accountant.

• obtain a listing of accounts and identify the accounts that would be at higher risk of being used to inflate earnings or perpetrate fraud — i.e., accounts that have certain restriction as to who can make entries to them, "Other" and "Misc." revenue and expense accounts;

• review transaction entries that are entered around a period end for unusual activity;

• summarize on the month of entry of the transaction entry and on the effective date of the transaction ~ identify any unusual fluctuations by month especially at the end of periods (do the same for both debits and credits); • consider how the transaction entries in each population and financial component are disbursed ~ are there several very large entries?

• look for duplicate transaction entries (desirably, excluding fields that, by their exclusion, would reduce the likelihood of finding duplicates, such as entry date, sales invoice number, or transaction number);

• reconcile the total amount of all transaction entries affecting a given account category (e.g., the sales accounts) to the total amounts recorded in the associated transaction account;

• apply Benford's Law (described in greater detail hereinafter) with respect to the amount fields;

• review debits/credits between various reserve accounts or between various liability accounts (to identify reserve increases/adjustments that are by-passing the profit/loss accounts);

• review debits to reserve accounts - inventory or accounts receivable (or other) credit or profit/loss accounts (releasing reserves to income statement — to identify potential understatement of reserves);

• review debits for assets/credits for expenses (to identify miscapitalization of expenses);

• review debits for expenses/credits for cost of^" goods sold (to identify manipulation of^" margins);

• review debits for accounts receivable/credits for revenue ( to identify revenue that is prematurely recognized);

• review debits for inventory/credits for cost of goods sold (to identify expenses that are inappropriately lowered); and • review debits for accounts payable/credits for accounts receivable (to identify if there is engagement in barter, or reciprocal transactions with customers who are also vendors where no money is changing hands).

To achieve the foregoing, pre-defined, yet customizable, templates (defining attributes to be analyzed) are loaded into the new software according to the present invention [step 6] and ^-dimensional data analysis is effected using the software to examine the data in real-time [step 7], preferably across all populations (e.g., sales, cost of sales, labor, taxes, depreciation/amortization, interest and other income/expenses). Continuing with the GL database example, the templates, or attributes to be analyzed, can include, without limitation, (i) reclassification and adjusting transaction entries, (ii) transaction type, (iii) duplicates, (iv) amounts that end in .00, (v) variance from Benford's Law (leading digit phenomenon ~ as explained in greater detail hereinafter), (vi) transaction entry description/remarks, (vii) Z-score relationships (as explained in greater detail hereinafter), (viii) transaction entry user (by Z-score) and (ix) items occurring within a preselected time period (e.g., 15 days) before and after the closing of each accounting period (including by transaction entry user).

It should be appreciated that the foregoing attributes are based on the recognition that fraudulent entries can include entries (a) made to unrelated, unusual, or seldom-used accounts, (b) made by individuals who typically do not make transaction entries, (c) recorded at the end of the period or as post-closing entries that have little or no explanation or description, (d) made either before or during the preparation of the financial statements that do not have account numbers, or (e) that contain round numbers or a consistent ending number. Data summaries labeled "profiles" are then created, read using the new software according to the present invention and automatically exported into standard, yet customizable, reports [step 8], and records that are unusual and significant are highlighted and cross-tabulated by attribute, user and/or source [step 9]. As discussed in greater detail hereinafter, the profiles comprise data cubes and grids which define 3- D topographical and interactive maps to the database created by the software according to the present invention that facilitate efficient navigation through the data stored therein. After reviewing the profiles and navigating to areas of interest, the forensic examiner can "drill down" to explore underlying transaction entries using, for example, drag and drop and point-and-click techniques, to identify significant and anomalous entries for potential selection and testing [see Fig. 2b, steps 9a-9d].

The forensic examiner is interested in, and using the new software and method according to the present invention is equipped to find, unusual activity, patterns and trends within and among categories within the financial data (e.g., increases to labor expense after layoffs; increases in sales toward the end of every quarter and decreases in sales at the beginning of every quarter).

For the reclassification attribute [Fig. 4a], the forensic examiner is interested in identifying amounts that have been reclassified from one account to other accounts and which impact the financial reporting of transactions. To this end, the examiner will look for transactions that transfer either large amounts or recurring small amounts to other accounts without sufficient explanation. This can readily be accomplished using the new software and method according to the present invention by, for example, looking for trends in reclassifications from period to period that are atypical or do not agree with trends in other transaction entry types. For the attribute of a transaction type, the forensic examiner is interested in identifying regular and closing entries that serve to increase revenues or decrease costs. To this end, the examiner will look for increases in one period that are reversed by decreases in a following period, and transactions made after year end that significantly change the amount of revenue recognized. This can readily be accomplished using the software and method according to the present invention by, for example, reviewing graphical representations generated by the inventive software for unusual characteristics [Fig. 4b] and by reviewing the net impact of increases and decreases by period.

For the attribute of duplicate entries, the forensic examiner is interested in transactions with amounts that repeat during a period without sufficient explanation. To this end, the examiner will look for volatility in the number of transactions tliat represent duplicate amounts. This can readily be accomplished using the software and method according to the present invention by, for example, reviewing graphical representations generated by the inventive software that depict the number of transactions by a particular amount [Fig. 4c].

For the ending digits attribute, the forensic examiner is interested in transactions with amounts that end in .00. To this end, the examiner will look for volatility in the increases, decreases and the net impact of transactions with amounts ending in .00. This can readily be accomplished using the new software and method according to the present invention by, for example, reviewing graphical representations generated by the inventive software that depict the number of transactions of a particular amount ending in .00 [Fig. 4d]. Benford's Law is a phenomenological law also known as the leading digit phenomenon. Benford's Law states that in listings, tables of statistics, etc., the digit "1" tends to occur with a probability of about 30%, much greater than the expected 11.1% (i.e., one digit out of nine).

For the attribute associated with variance from Benford's Law, the forensic examiner is interested in transaction entries that are at odds with the Law based on the first digits of each transaction entry amount. The forensic examiner will look: for, and using the new software and method according to the present invention is equipped to find, unusual peaks or valleys around the Benford's expectation line in graphical representations generated by the inventive software [Fig. 4e].

For the transaction entry explanation attribute, the forensic examiner is interested in transactions with unclear and/or suspect descriptions. To this end, the examiner will look for, and using the software and method according to the present invention is equipped to find, transaction descriptions that make large adjustments at the direction of a particular person, entries without explanations, and explanations that do not comport with the business of the subject organization by grouping transactions by description.

Depending on the probability distribution associated with the data in. the database under investigation, the software according to the present invention can be customized to calculate statistics related to the distribution; for example the software can be adapted to calculate the Z-score. Generally speaking, the Z-score for an item indicates how far and in what direction that item deviates from its distribution's mean, expressed in units of its distribution's standard deviation. In general, the mathematics of the Z-score are such that if every item in the distribution is converted to its Z-score, the transformed scores will necessarily have a mean of zero and a standard deviation of one.

For the Z-score attribute, the forensic examiner is interested in identifying transaction entries with amounts that deviate by more than one or two standard deviations (+/- 1 or 2) from the average amount within that financial statement component. This can readily be accomplished using the software and method according to the present invention by, using a customizable report to display all transactions of a particular type that are more than +/- 1 or 2 standard deviations from the arithmetic average, reviewing graphical representations generated by the inventive software for increases and decreases that fit the foregoing criteria [Fig. 4fJ.

For the user attribute and for the attribute of items occurring within a preselected time period before and after the closing of each accounting period, the forensic examiner is interested in, and using the new software and method according to the present invention is equipped to find, users who post only certain types of transaction entries, users who post transaction entries identified as unusual in other profiles, and users who post transactions proximate to the close of an accounting period [Figs. 4g and h]. This is accomplished by using the new software to group and drill down in real-time, within each population type, within and across transaction entry types, especially for transactions that adjust a specific financial component by a large amount.

The forensic examiner may also be interested in identifying transaction entries posted by users involving amounts that deviate by more than one or two standard deviations (+/- 1 or 2) from the average amount within that financial component (i.e., a Z-score aspect to the user attribute). This can readily be accomplished using the new software and method according to the present invention by selecting, grouping and drilling down to users who have established amounts that are more than +/- 1 or 2 standard deviation from the arithmetic mean [Fig. 4i].

As indicated above, the profiles comprise data cubes and grids which define 3-D topographical and interactive maps to the financial (e.g., GL) database that facilitate efficient navigation through the data stored therein.

A cube is an ^-dimensional view of a database, i.e., fields from the cube can be grouped in various dimensions so that relationships between the fields can be viewed. Referring to Fig. 5, the dimensions can include pages (fields that can be "dropped" into the cube, but are in reserve and not currently displayed in the cube), rows (fields on the side of the cube — e.g., "Journal Type" and "Debit/Credit"), columns (fields on the top of the cube — "Create" year and quarter) and measures (fields displayed on the face of the cube), and can be pivoted (moved to and from the column, row, measure and page areas of a cube) for analysis and filtered (in a cube or grid, using criteria to exclude data from the entire population, e.g., to show all increases and hide all decreases). The created views (cube templates) can be saved for later use. OLAP is leveraged to transfoπn the financial data into cubes that can be modified using, for example, point-and-click and drag-and-drop techniques.

A grid is a two-dimensional view of records in a database. In the grid, data can be grouped by a particular field or fields, sorted and filtered, and the created views (grid templates) can be saved for later use. Grid fields can be placed in the row and/or column of a cube while a quantitative grid field can be used as a measure to group the cube into accumulated cells.

The cubes present a summary of the database that a forensic examiner can read to identify data relationships, trends and patterns. The cubes can be navigated (e.g., using drag-and-drop and point-and-click capability) allowing the forensic examiner to select an item in a cube and navigate in the grids in the direction of decreasing dimensions of data and then into significant and unusual entries in the underlying data and/or significant and unusual data user activity for potential selection and further testing [see Fig. 2b, steps 9a-9d]. That is, this feature, which is coded in the software according to the present invention, allows the forensic examiner to drill down obtain additional information on the selected cube item in a resulting grid. The process can be iterative.

It should be appreciated that, based on user activity (i.e., dragging and dropping, pointing and clicking ~ drilling down), using OLAP, the new software will automatically rearrange data fields as appropriate.

The result is an ^-dimensional view of financial transaction entries based on the relationship of such entries to the heightened risk of material misstatement, an n- dimensional view of each attribute, or column of entry data, including tests to identify significant and unusual attributes, an ^-dimensional view of transaction creators, and posting sources, including tests to identify significant and unusual users of the financial system.

It should be appreciated that the efficient navigation of a very large financial database (e.g., a large GL) is not the only challenge. With multi-national organizations come multiple financial databases that must be consolidated into one set of financial statements. In consolidation, much of the detailed financial entries are summarized and at a summary level — the assessment of reliable data is most difficult. This means that the forensic examiner may want to look into the financial database of each significant subsidiary.

For companies with multiple disparate financial databases, the software and method according to the present invention can be applied separately to each database. Alternatively, the disparate databases can be migrated to one integrated database that globally records financial entries with an appropriate degree of granularity, and the inventive software and method applied to the integrated database.

Again, although discussed herein in the context of analyzing GLs, it should be understood that the present invention is not limited to analysis of GLs, but has application with respect to other types of databases, financial or otherwise.

Referring again to Fig. 2, based on the cross tabulation of the profile results [step 9], the high-risk areas that may require fieldwork support testing can be identified [step 10]. In the event that high-risk areas are identified, action can be taken to assist in resolving such issues (through modified sample selections, fieldwork procedures, and forensic interviews).

A report of findings and actionable recommendations (in predefined yet customizable format, including statistical and/or graphical presentation) can then be generated [step H].

It should be appreciated that the generated results of the analysis according to the present invention are specific; the results do not include voluminous data for the forensic examiner to wade through. It should be further appreciated that the results are easily translated into recommendations for next steps. Referring now to Figs. 6a-6s, in operation, with the new OLAP-based software according to the present invention installed and running, display screens can be presented to the user to enable the user to connect a cube to a database containing the financial data to be reviewed (e.g., a Microsoft Data Connection dialog box [Fig. 6a]) and to load the financial data into the cube (e.g., from a Microsoft Access database file [Fig. 6b]).

Once the data are loaded, the new OLAP-based software according to the present invention will open to the grid screen (tv^o dimensional view of a data table) [Fig. 6c]. This view shows all of the selected fields for the entire table that was loaded.

Records can be grouped (e.g., by dragging a column header to the area above the column header names) and sorted [Fig. 6d]. Multiple fields can be grouped at once; multiple columns can be sorted at once — all in real-time.

Filters can be applied [Fig. 6e]). Different filters are displayed depending on the data type of the column. For example, referring to Fig. 6e, with character based data, the "Filter Criteria" box can display for selection by the user fields that: (i) begin with a particular letter, (ii) contain particular text and (iii) are the text.

Additionally, in the filter screen, the user can initiate calculations of useful statistics for a particular field selected (e.g., by selecting the button labeled "statistics" [Fig. 6e]). The statistics can include the (i) count of records, (ii) sum of the field, (iii) average amount in the field, (iv) minimum and maximum amounts in the field, (v) standard deviation and (vi) variance between the highest and lowest amounts in the field [Fig. 6f]. When a suitable layout of a grid is found, the template can be saved to be loaded at a later time [Fig. 6g].

Cubes can also be created easily using drop-down menus presented by the new OLAP-based software of the present invention (e.g., going into the cube view by selecting "File" and "View Cube" and adding fields [Fig. 6h]). For example, Fig. 6i shows a cube created to view "Sales" "Journal Type" entries by "Debit/Credit" and then relate them to the "Create" year and quarter.

Referring to Fig. 6h, fields can be retrieved from the selected database (e.g., by selecting ^c 'Retrieve Fields") and, from the list of produced fields, desired fields can be dragged and dropped in the columns, rows, and measures of the cube [Fig. 6j].

The displayed information in the measure can be changed (e.g., by selecting "Fields" in the measure display box [Fig. 6j] and then selecting "Properties"). Fig. 6k depicts a default setting to "Sum" the field; "Count," "Average," "Max" and "Min" are some other options shown.

When the cube is in the desired layout it can be saved for later use (e.g., by selecting "Report Design" then "Load/Save" and then "Save" and naming the cube file [Fig. 61).

Once a template has been run on one of the populations (e.g., income statement populations such as, for example, sales, cost of sales, labor, depreciation/amortization, other income/expense), another population may be brought up. This involves pointing the cube file to the appropriate table in the database. Referring to Figs. 61-6n, changing cubes from one population to another can be accomplished by viewing another set of data (e.g., by selecting the "Report Design" drop-down menu and selecting "Designer" to get to the "DCube Class Properties" window), and identifying the table to be accessed (e.g., by changing, on the "General" tab, the "Record Source" coding - for example, changing "SELECT * FROM SALES" to "SELECT * FROM COST" to view cost of sales data in the cube, and then selecting "OK" and, on the menu, selecting "Edit - Refresh" to update the data in the cube).

Data analysis according to the present invention can involve "pivoting" - - that is, moving fields in the cube from one location on the cube to another (e.g.., by dragging and dropping). This automatically changes the measures displayed in the cube in real-time.

Any field that is placed as a page, column or row can be pivoted. For example, a field that has been placed in a cube as a row can be pivoted to a column or a page field, in real-time.

Referring to Fig. 6o, filtering can be accomplished by selecting or deselecting items (shown in a drop-down menu) in a particular field. If the box next to the item is marked (e.g., with an "X") the related information will be included in the view; if not marked (e.g., if the "X" is de-selected), the related information will not be included in the view and all measures/groupings will modify accordingly, in real-time.

If more understanding of a measure in a cube is sought, the forensic examiner can drill down to the supporting records and view them in the grid. Referring to Fig. 6p, this can be accomplished by selecting the cell that is of interest and selecting the criteria for the drill-down (e.g., from a "Drill Down" menu), and then selecting the table against which the criteria will be run. That is, the system, software and method according to the present invention automates and simplifies the drill-down from a cell in the cube to corresponding records in the grid by: (i) enabling a user to select a cell in the cube; (ii) displaying a drill down dialogue box; (iii) presenting drill down cbioices (see Fig. 6P); and, (iv) navigating to select grid records based on user choices. This feature gives forensic accountants a flexible and powerful "point and click" investigation tool.

Once in the cube, the forensic examiner can view aggregated information for the groupings that have been created in the cube. This may be sum of amounts ("Sum"), record counts ("Count"), or average amounts ("Avg") [Fig. 6q, "Edit" and "Total" menus].

Percentage options are provided by clicking on a "%" button on the screen. The options allow for the percentage of the total of each column or the total of each row for each respective cell to be displayed [Fig. 6r, "Edit" and "Data" menus].

Output can be produced to a printer or a spreadsheet program such as, for example, Microsoft Excel [Fig. 6s].

Accordingly, the present invention embodies a new system, software and method that uniquely integrates accounting principles, statistics, technology and investigative techniques to provide forensic accountants with the capability to explore large quantities of data in a database in real-time using online analytical processing to pinpoint records that are both unusual and significant, e.g., as an indicator of fraudulent activity.

It will thus be seen that the objects set forth above, among those made apparent from the preceding description, are efficiently attained and, since certain changes may be made in carrying out the above method and in the constructions set forth for the system without departing from the spirit and scope of the invention, it is intended that all matter contained in the above description and shown in the accompanying drawings shall be interpreted as illustrative and not in a limiting sense. It is also to be understood that the following claims are intended to cover all of the generic and specific features of the invention herein described, and all statements of the scope of the invention which, as a matter of language, might be said to fall therebetween.

Claims

CLAIMS What is claimed is:

1. A computerized method for conducting a forensic examination of multi-dimensional data stored in a database, comprising the steps of: providing multidimensional data in a database accessible to software having real-time data interrogation functionality, the software adapted to analyze different dimensions of the data and to identify at least one of patterns and relationships among the data, categorizing the data into at least one preselected category, loading at least one template defining at least one data analysis attribute preselected to indicate at least one of significant and anomalous data into the software, effecting multi-dimensional data analysis on the data in real-time based on the at least one preselected template attribute, creating at least one profiles defining at least one map to the database to facilitate navigation through the analyzed data, navigating through the analyzed data in the direction of decreasing dimensions of the data based on the at least one profile, and identifying at least one aspect of the data that is at least one of significant and anomalous.

2. The method according to claim 1, further comprising the steps of cross-tabulating the at least one significant and anomalous aspect of trie data and identifying associated fieldwork activity requirements.

3. The method according to claim 1, further comprising the step of automatically generating a report of the at least one significant and anomalous aspect of the data.

4. The method according to claim 1, further comprising the step of automatically generating a report of actionable recommendations based on the at least one significant and anomalous aspect of the data.

5. The method according to claim 1, further comprising the step of verifying at least one of accuracy and completeness of the data loaded in the database.

6. The method according to claim 1, further comprising the step of generating at least one of summary statistics and summary metrics on the data stored in the database.

7. The method according to claim 6, wherein the at least one of summary statistics and summary metrics includes at least one of (i) positive data values, (ii) negative data values, (iii) all data values, (iv) minimum data values, (v) maximum data values, (vi) nulls, (vii) averages of data values, and (viii) standard deviations of data values.

8. The method according to claim 1, wherein the data are financial data.

9. The method according to claim 8, wherein the financial data are general ledger data.

10. The method according to claim 9, wherein the step of categorizing the data into at least one preselected category includes breaking the data into at least one of income statement populations and balance sheet populations.

11. The method according to claim 10, further comprising the step of reconciling the data to an associated trial balance.

12. The method according to claim 10, wherein the step of effecting multi-dimensional data analysis on the data in real-time based on the at least one preselected template attribute is used to examine the data across the at least one of income statement populations and balance sheet populations.

13. The method according to claim 10, wherein the step of effecting multi-dimensional data analysis on the data in real-time based on the at least one preselected template attribute includes identifying at least one of patterns and relationships between the populations of the at least one of income statement populations and balance sheet populations.

14. The method according to claim 9, wherein the at least one template includes at least one of (i) reclassification and adjusting transaction entries, (ii) transaction type, (iii) duplicates, (iv) amounts that end in .00, (v) variance from Benford's Law, (vi) transaction entry description, (vii) Z-score relationships, (viii) transaction entry user, and (ix) items occurring within a preselected time period before and after the closing of an accounting period.

15. The method according to claim 1, wherein the step of effecting multi-dimensional data analysis on the data in real-time based on the at least one preselected template attribute includes identifying at least one of patterns and relationships among the data.

16. The method according to claim 1, wherein the software is online analytical processing software.

17. The method according to claim 1, further comprising the step of automatically exporting the at least one profile to at least one report.

18. The method according to claim 1 , wherein the at least one profile includes at least one data cube and at least one grid, the at least one data cube representing an ^-dimensional view of the database, the at least one grid representing a two-dimensional view of records in the database.

19. The method according to claim 18, wherein the ^-dimensional view of the database includes pages, rows, columns and measures.

20. The method according to claim 18, wherein the n-dimensional view of the database is adapted to be pivoted for analysis and filtered.

21. The method according to claim 18, wherein data in the at least one grid is at least one of grouped, sorted and filtered.

22. The method according to claim 18, wherein the step of navigating through the analyzed data in the direction of decreasing dimensions of the data based on the at least one profile includes selecting an analysis criterion in the at least one data cube and drilling down in an associated one of the at least one grid.

23. The method according to claim 1, wherein the at least one profile defines at least one three dimensional map.