181 Chapter 10 Monitoring and Managing Data and Process Quality Using Data Mining: Business Process Management for the Purchasing and Accounts Payable Processes Daniel E. O’Leary Contents 10.1 Introduction ............................................................................................ 183 10.1.1 Purpose ......................................................................................... 183 10.1.2 is Chapter ................................................................................. 183 10.2 Preventive and Detective Controls for Data Quality ................................ 184 10.2.1 Preventive versus Detective Controls ............................................ 184 10.2.2 Computer-Based Controls ............................................................ 184 AU8522_C010.indd 181 10/9/07 12:02:31 AM
Transcript
181
Chapter 10
Monitoring and Managing Data and Process Quality Using Data Mining: Business Process Management for the Purchasing and Accounts Payable Processes
Monitoring and Managing Data and Process Quality n 183
10.1 IntroductionRecently,businesseshavebecomemoreconcernedaboutusingtransactiondatatogenerateknowledgeabouttheworldinwhichtheyfunction,oftenreferredtoasso-called“business intelligence.”Thisbusiness intelligence typically isgeneratedusingtoolssuchasdataminingandknowledgediscovery.Althoughmuchofthatfocusonbusinessintelligenceinitiallywasgeneratedaboutrelationshipswithotherfirms,suchassales,increasinglythereisafocusoninternalprocesses.Thatfocusofgeneratingbusinessintelligenceaboutinternalprocesses,tofacilitatemanagementandmonitoringofthoseprocesses,isreferredtoas“businessprocessmanagement”(BPM).BPMcanbeusedonanyofanumberofprocesses,suchassalesanalysis,accountsreceivableanalysis,inventoryanalysis,andotheractivities.However,thischapter focusesonpurchasingandaccountspayableprocesses so thatparticularmetricsandapproachescanbeanalyzed.
10.1.2 This ChapterThischapterproceedsasfollows.Whilethissectionpresentsintroductiontothechapteranditspurpose,Section10.2summarizessomeof10.3brieflyreviewsthespecificdomainofpurchasingaccountspayableandsomegenericsourcesofdataqualitydisruptioninthoseareas.Section10.4reviewsthenotionofBPM,while
AU8522_C010.indd 183 10/9/07 12:02:32 AM
184 n Data Mining Methods and Applications
Section10.5investigatesmetricsforpurchasingandaccountspayablethatcanbeusedtofacilitateidentificationofdataqualityissues,suchasfraud.Section10.6analyzes some approaches todeterminehow thedataone seesmatchesupwithwhatonewouldexpect.Section10.7usesadataminingperspectivetoinvestigatetheunderlyingdataqualityandhowthatdataqualitymightbeunderminedbyfraudulentdata.Finally,Section10.8providesabriefsummaryofthechapteranditscontributions.
10.2 Preventive and Detective Controls for Data Quality
10.2.1 Preventive versus Detective ControlsPreventivecontrolsaredesignedtolimiterrorsorirregularitiesfrombeingintro-ducedintothedata.Aclassicpreventivecontrolisaspeedlimitsignthatindicatestheupperboundoncarspeed.Ontheotherhand,detectivecontrolsaredesignedtofinderrorsorirregularitiesoncetheyhavebeenintroducedtothedata.Aclassicdetectivecontrolisaradargunthatindicateshowfastthecaractuallyisgoing.
10.2.2 Computer-Based ControlsComputer-basedcontrolsusecomputercapabilitiestoprovidecontroloverthedataquality. There are a number of computer-based controls that can facilitate dataqualityandcontroloveraprocess,includingthefollowing.
10.2.2.1 Individual Accounts
Perhapsthemostimportantcontrolistheabilitytohaveindividualaccountsforeachuser.Thismakeseachindividualdirectlyresponsiblefortheactivityintheiraccount.Inthesesettings,eachindividualhashisownpasswordtocontrolaccessovertheaccountandcorrespondingpurchases.Individualaccountsallowfor“vir-tual signatures,” to indicate which user accessed the information and made thepurchases,etc.
AU8522_C010.indd 184 10/9/07 12:02:32 AM
Monitoring and Managing Data and Process Quality n 185
10.2.3 Process-Based ControlsProcess-based controls also can facilitate data quality and control. Rather thanusingtechnologycapabilities, insteadprocesscontrol isattainedbytakingafewkeyprocesssteps,buildingcontrolintotheprocessusingtheprocessoractivitieswithintheprocess.
Authorizationisacontrolthatrequiressomeindividualtotakeresponsibilityforallowingaparticularevent.Forexample,largepurchasestypicallyrequireautho-rizationby some appropriate level ofmanagement,whether it is amanager, theCFO,theCEO,ortheBoardofDirectors,typicallythroughareviewandsigna-ture,eitheractualordigital.Authorizationcanpreventsomeerrorsbecausereviewallowsonepersontheabilitytodetecterrors,whilethefactthatsomeoneneedstoauthorizeanactivitycanserveasadeterrenttopreventunauthorizedactivity.
10.3 Purchasing and Accounts PayablePurchasingandaccountspayablerequirequalitydatabecausemuchofanenterprise’sperformanceisbasedonthegoodsthatitpurchases.Thereareatleastthreescenar-iosthatprovidethebasistogeneratedetailedkeyperformanceindicators(KPIs)andapproaches.Theanalysispresentedherespansthesethreedifferentapproaches.
10.3.1 Scenario 1: Classic Purchasing and Accounts PayableIn this first scenario, information flows primarily using documents. Purchasingprocesses typically are initiated internally by a “requisition,”where aneed for apurchase is established. Requisitions also provide preventive controls because amanagergenerallymusthaveresponsibilityforauthorizingthepurchase.Aftertherequisitionisreceived,apurchasingagentestablishesapurchaseorderthattypicallylaysoutthecontractwithaparticularvendortopurchasethegoods.Purchasingagentsensurethatthevendorschosenarelegitimatevendorsandthattheproductsthat theyprovidemeetcertainstandards.Purchasingagreementsare sent to thevendor,receiving(sotheyknowwhattoexpect),accountspayable(responsibleforpayment),andpurchasingagreementsarekeptinpurchasingforreference.
Generally,after thegoodshavebeensentby thevendor,an invoice is issuedbythevendorandsenttothepurchasingfirm.Whenthegoodsarereceived,peopleinthe organization’s receiving department create a receiving memorandum. Typically,accountspayablegetsacopyofthepurchaseorder,theinvoice,andthereceivingmem-orandum;matchesthem;andpaysthebill.ThisprocessissummarizedinFigure10.1.
Information isperiodicallydigitizedasdocumentsareprocessed if there isacomputer-basedsystemsupportingtheprocess.Forexample,purchaserequisitions
AU8522_C010.indd 186 10/9/07 12:02:33 AM
Monitoring and Managing Data and Process Quality n 187
couldbecreated indigital format.Selected informationfromthose formscouldthenbeusedtocreateapurchaseorder.Itislikelythatatleastinformationaboutthevendorandthepurchaseareenteredintothesystemsothat,ultim(e.g.,usingelectronicdatainterchange).Thiswouldfacilitatesingleratherthanmultipleentriesofthesamedata.Inthislattersetting,datawouldneedtobeinputasingletimeforeachdocument.Attheotherextreme,dataineachfunctionalsilomustbeinputdigitallywitheachdocument.Inthesecondcase,asanexample,purchaseorderinformation would be entered into four different systems (purchasing, accountspayable,receiving,andatthevendor).
Figure 10.1 Classic accounts payable and purchasing.
AU8522_C010.indd 187 10/9/07 12:02:35 AM
188 n Data Mining Methods and Applications
10.3.2 Scenario 2: E-PurchasingWith the advent of E-purchasing, a number of companies developed intranet-based systems designed to facilitate and control purchasing. In these so-called“E-purchasingsystems,”purchasingtypicallyarrangeswithdifferentsupplierstoprovidedigital catalogs fromwhich systemuserscanmakepurchases.Usersaretypicallyprovideddifferent“roles”(preventivecontrols)thatindicatewhatkindsofgoodstheyareauthorizedtopurchase,(.g.,officesupplies,computers,etc.).Inaddition, users may have individual budgets for their total and individual pur-chases.Thesystemthenlimitsthekindsofpurchasesthattheycanmakeandcon-trolstheexpensesthattheycanincur.Thesystemalsoguidesthemtoapreselectedsetofproductsthatmeetorganizationalconstraints.
Monitoring and Managing Data and Process Quality n 189
BPM is the use of an integrated set of key performance indica-tors that areused tomonitor anorganizationalprocess in real time.Businessprocessmanagement(BPM)isamanagementdisciplinethatcombinesaprocess-centricandcross-functionalapproach to improv-ing how organizations achieve their business goals. A BPM solutionprovides the tools that helpmake theseprocesses explicit, aswell asthefunctionalitytohelpbusinessmanagerscontrolandchangebothmanualandautomatedworkflows.
10.4.2 BPM Data FlowsInsomecases,BPMdataflowscomefromasingledatasource,suchasanERPsystem;however,inothercasestheywillcomefromdisparatesources.Inthosesettings,acon-sistentsemanticmappingofthedatawillbenecessarytoensurethatthedataandcor-respondingmetricsarecomparable.Insomesettings,thiswillproveoneofthemostimportantsteps,andtheBPMsystemwillbringtogetherdisparatedataflowsunderonesystem,sometimesforthefirsttime.Insomesituations,aclassicXML(eXtensibleMark-upLanguage)approachcanbeusedtogatherandlabelthedata.
10.4.3 BPM Process ChangesHowever,insomesituations,BPMismorethanjustcapturingandmanagingKPIsonaparticularprocess.Insomecases,companieshavechangedthewaytheypro-cess invoices to facilitateBPM,particularly tomeet theneed for real-timedata.Hasbroapparentlydevelopedaportalthroughwhichvendorscoulddirectlysub-mitinvoices[1].Aftersubmissionthroughtheportal,invoiceswereroutedtotheappropriatevendormanagementteamsforapprovalandfromthereforfurtherpro-cessing. This approach increases the visibility of the approval and processing oftheinvoices,allowingthemtobettercontroltheflowandunderstandbottlenecks,fromtimeofsubmissiontofinalpayment.
10.4.4 Forecasts of KPIsBPMsystemsmaygobeyondmonitoringKPIstoactuallymonitoringforecastsofKPIs.Usingreal-timedata,forecastswouldbemadeandcommunicatedtoman-agers inasimilarwayas forreal-timedata.Forecast informationwouldthenbecategorizedas“incontrol,”etc.
10.4.5 BPM CapabilitiesWhat are keyBPMcapabilities?Historically,BPM takes data streams andputstheminareadableandaccessibleformsothatmanagerscanseecriticaldata.Asseen inTable10.1, the focushasbeenona rangeof importantcorporate issues.However, recently, BPM has been viewed as a potential tool for the analysis offraud.Forexample,apparentlytheLouisianaDepartmentofSocialServicesisnowusingBPMtofacilitateidentificationoffraud[6].Thisisoneoftheearlyapplica-tionsaimedatusingBPMtofocusonissuesotherthanproductivity.
10.5 BPM Metrics: Purchasing and Accounts PayableBPMmetricsandsystemscanbeusedfordifferentpurposes.Forexample,BPMforaccountspayableandpurchasingcanallowinsightintocashoutflowsandfacili-tate cashplanning.Historically, thismeans informationaboutaccountspayable
AU8522_C010.indd 190 10/9/07 12:02:37 AM
Monitoring and Managing Data and Process Quality n 191
Understanding Accounts Payable as Part of Financial and Supply Chain Analytics.
The pre-built reports and metrics of the Cognos Accounts Payable Analysis application give you a better understanding of your payment-related activity and trends. You can:
Increase managerial productivity by reducing reporting and analysis time.See how much is due and when and the value of overdue accounts.Increase working capital by optimizing cash outflow strategies.Keep better control over cash outflow while maintaining strong vendor relationships.
n
nnn
Cognos Accounts Payable Analysis gives you more than 60 key performance indicators and more than 30 reports. These metrics and reports are grouped in four key areas of analysis, answering a variety of business questions:
Accounts Payable Performancen
—What money is owed this period? What percentage is past due?—How quickly is the organization paying?— What percentage of accounts is not meeting terms? What is the value of
overdue accounts?Accounts Payable Vendor Accountn
—What is the current balance for a vendor account?—Which vendors are problematic? Why?— What is the cost to pay vendors, including errors, method of payment,
and adjustments?Accounts Payable Cash Outflown
— What is the expected cash outflow if no/all accounts take advantage of discounts?
— What is the expected cash outflow based on the expected days to pay for each account based on payment patterns to date?
Accounts Payable Organizational Effectivenessn
— How has account distribution across analysts changed as business has increased?
— What was the total cost/savings for being in variance as related to payment terms?
—What is the average/weighted average days past due?
that areoutstanding, the accountspayabledue tovendors, the extentof vendordiscountsused,andtheextentofoverdueaccounts.Table10.1providessummaryofaBPMvendor’sapproachtopurchasingandaccountspayable,includinggoalsandmetrics.
However,historically,BPMhasnotfocusedmuchonascertainingfraudandanomalous information.However,with the recent focus on theSarbanes-OxleyAct,thatfocuscouldchange.Anumberofmetricscanbedevelopedandmonitoredaspartofabusinessprocessmanagementsystemaimedattryingtofindevidenceoffraudorotherdataqualityproblemsinpurchasingandaccountspayable.Someofthosemetricsincludethefollowing.
10.5.1 Number of Invoices Received from SuppliersAnimportantongoingstatisticistocapturethenumberofinvoicesreceivedfromeachsupplieronamonthlybasis.Anomalouschangescanindicatedataqualityprob-lems.Asteepincreaseordecreaseinsomevendorinvoicesmayindicatethatvendornumbershaveerroneouslybeenattributedtosome invoices, forexample, throughdataentryerrorsorawrongvendernumber,whetherpurposefullyorbyaccident.Itmayalsoindicateafraudulentattemptbythevendortoobtainmultiplepayments.
10.5.2 Number of Transactions per System UserThesystemuservariesbasedonthetypeofsysteminplace,asdiscussedabove.Ifoneconsidersthenumberoftransactionsperaccountspayableclerk,thentheKPIprovidesameasureofproductivityforthepeopleinvolvedintheaccountspayablesystem.Ifoneconsidersthenumberoftransactionsperworkerusingthesystemtobuygoods,thenthenumberofpurchasescanrepresenttimespentawayfromtheirjob,andalsoprovideinsightintohowmuchproductivityisspentonsuchissues.
Anomalouschanges frommonth tomonthcan indicatedata inputerrorsorfraud for at least two reasons.First, itmaybe that thewronguser is attributedtothetransactions.Aninappropriateusermaybemasqueradingasanotheruser.Second,iftheuserisreplaced,thenthereplacementislikelyanewuser,andhighererrorratesareattributedtonewusers.
10.5.3 Percentage of Invoices Paid without a Purchase Order Reference
Monitoring and Managing Data and Process Quality n 193
Further, although a preventive control is to require a valid purchase ordernumber,insomesystemswithoutthepropercontrolstheremaynopurchaseorderrequiredtobeassociatedwithaninvoice.Thelackofapurchaseordercanindicatethatthetransactionisfraudulentorinerror,butinanycaseanomalous.
10.5.4 Number of Invoices for a Purchase OrderKnowingthatapurchaseordernumbermayberequired,usersintheprocessofdoinga fraudulent transactionmightusea legitimatepurchaseordernumberaspartof thedata inputprocess,butone that isnotappropriate for theparticularinvoice. In that situation, there are likely tobemultiple invoices for apurchaseordernumber.Thus,a listof thehighernumbersof invoicesperpurchaseordercouldbeaKPIofinterest.
10.5.5 Number of Users Using Each VendorInsomecases,thenumberofusersofavendorcanbeindicativeofadataqualityproblemsuchasfraud.Forexample,ifauserandavendorareworkingtodefraudthecompany,itmaybethattheuserwouldbetheonlyoneinthefirmaffiliatedwiththatvendor.
10.5.6 Relative Size of an InvoiceThereare anumberof storiesoforganizationsputting thedecimalpoint in thewrongplaceonapayment,sothata$100paymentbecomesa$10,000orlargerpayment.Accordingly,amajorconcernisthatthedollaramountofapayment,notbeexcessive.Thereareanumberoftestsforascertaininganomalies.Onesuchtestistheratioofthelargestpaymenttothesecond-largestpayment(e.g.,[8]).Thiscanbegeneralizedtotheratioofthej-thlargestpaymenttothe(j+ 1)stlargestpayment.Wheneverthatratioissubstantial,itcanindicateaproblemwithdataqualityandmaybeindicativeoffraud.Inthecasewherefraudwasbeingpurposefullycom-mittedandtherewasawarenessoftheexistenceofatestcomparisonbetweenthefirstandsecondpaymentsizes,twolargefraudulenttransactionscouldbeexecuted,thusmitigatingtheeffectivenessofthattest.Asaresult,comparisonofmorethanthefirsttwoadjacentinvoiceswouldbeappropriate.
10.6 Knowledge Discovery: Comparison to Expectations
Monitoring and Managing Data and Process Quality n 195
thenumbers thatonewouldexpect to see the leastof.Asa result,compared toBenford’slaw,theresultsareanomalous.
Not only canBenford’s lawbeused to see if there is potential fraud, but itmightalsosuggestthatpoliciesarenotbeingfollowedorthatparticularpoliciesarebeingavoided.Forexample,ifthereisapolicythatexpensesmustbesignedwhentheyexceedacertainamount,ananalysisofthedataislikelytofindanabnormalnumberofexpensesfiledjustbelowthethreshold.Forexample,ifthereisacut-offof$500.00,whereexpendituresat$500.00mustbesigned,thereislikelyanabnor-mallylargenumberofexpendituresaround$400.00.
10.6.2 Accounts Payable Data AnalysisGivenadatabaseofaccountspayabledata,anumberofcomparisonsbetweenthedatacanbemadetohelpestablishthequalityofthedata.Threekeydataelementsin accounts payable andpurchasing are the invoice number, the amount of theinvoice,andthevendornumber.
10.6.2.1 “Same, Same, Same”
Animportanttestofthequalityoftheaccountspayabledataisforduplicatepay-mentofthesameinvoicetothesamevendor(see,forexample,[8]).Inthissitua-tion,thedataisinvestigatedforthesameinvoicenumber,sameamount,andsamevendor.Suchduplicatepaymentscanoccurifthevendorprovidesmultiplecopiesatdifferenttimesofthesameinvoice,whetheraspartofnormalbusinesspracticeoraspartofafraudulentapproach.Aspartoftheanalysis,theaccountspayableclerkultimately responsible for thematchmustbedetermined so that it canbeascertainedifthereisasystematicproblem.
10.6.2.2 “Same, Same, Different”
Onetestofthequalityofaccountspayabledataisthe“same,same,different”test(sameinvoicenumber,sameamount,differentvendor)(see,forexample,[8]).Thepurposeofthetestistocomparedifferentaccountspayableentriestodetermineiftheyarethesame,andasaresult,abillhasbeenpaidmorethanonceorifthewrongvendorhasbeenpaid.Aninvoicemightbepaidtwiceinthesituationwheretheinvoice was paid to the wrong vendor and then the correct vendor. The wrongvendormayhavebeenpaid,eitherpurposelyorbyaccident,suchasanincorrectkeyingofthedata.Aspartoftheanalysis,theaccountspayableclerkultimatelyresponsibleforthematchmustbedeterminedsothatitcanbeascertainedifthereisasystematicproblem.
10.7 Data Quality-Based Data MiningPurchasingandaccountspayable systemsdependon theunderlyingdata in thesystembeing“gooddata” tobeginwith.However, that assumptionmaynotbetrue.Oneapproachtoanalyzingdataqualityistoinvestigatethedatausingdatamining,inordertodetermineifthebasicdatasetcontainsanyanomalies,indicat-ingproblemswiththeunderlyingdata.Forexample,vendorsmaybefraudulentorgoodsmaybebogus,inwhichcaseanytransactionsinvolvingthosevendorsorgoodswouldbesuspect.
10.7.3 Fraudulent Company Shipment AddressesProductsare“shippedto”particularaddressesaspartofpurchaseagreements.Gen-erally,those“shipto”addressesarefromasubsetoforganizationaddresseswheretheparticularorganizationdoesbusiness.Asaresult,ifa“shipto”addressdoesnotcomefromthatset,thenitmightindicateafraudulenttransactionanddefinitelywouldbeanomalous.This likelywouldbeevenmore indicativeofaproblem ifthe“shipto”addresscorrespondstoanemployeeaddress.Thisisnottosaythatall such shipments would be suspect; for example, there may be a home office.However, such a correspondence between addresses could indicate fraudulentlyobtainedgoods.
10.7.4 Selected Issues in Comparison of VendorsTheanalysisofshipmentandvendordatacouldbedonebypeople,butgenerally,usinganintelligentsystemwouldbefasterandpossiblymoreeffective,giventhenatureofthetask.Suchcomparisonscouldtakesomeintelligencetoexecutewell.First,nameinformationmaybeinconsistent.Forexample,“InternationalBusinessMachines”maybeinthedatabaseunderthatnameor“IBM”or“I.B.M.”oranyofanumberofotheralternatives.Second,addressconventionsmaybeinconsistent.Forexample,atsomepointinaddresses,“N.”wouldneedtobeconsideredthesameas“North”and“E.”wouldneedtobeconsideredthesameas“East.”Similarly,otherabbreviations,suchas“St.”wouldneedtobeprocessedas“Street.”Third,phonenumber information may be non-standard. For example, phone numbers couldincludedashesornotincludethatinformation.Alloftheseissueswouldlimittheabilityofasystemtocorrectlymatchvendorsindifferentsystems.
10.7.5 Bogus GoodsLeftuncontrolled,userscouldconceivablyordergoods,have theircompanypayfor them, and then resell the goods. For example, computer memory chips canbeorderedby individuals inScenario3, likely fromavendorof their choice. Itwouldbepossibletocontrivesuchpurchaseswheretheuserwasabletotransferthemoneyfromthecompanytohimself,aslongaseachindividualpurchaseandthepurchasesinaggregatedidnotexceedsomeamount.Oneapproachtodetectthiskindofbehavioristokeeptrackofdifferentkindsofgoodsandhowmanyofeachkindeachuserorders.
AU8522_C010.indd 197 10/9/07 12:02:41 AM
198 n Data Mining Methods and Applications
To better control such purchases, additional preventive control informationabout goods could be specified. Goods could be characterized as “limited con-sumptiongoods.”Whenevergoodspurchasedexceedacertainamount,thepur-chasescouldkickoutasanomalous.Forexample,computermemorychipscouldbecharacterizedasalimitedconsumptiongood,wherepurchasesforthattypeofgoodshouldnotexceedsomeparticularlimit.
10.8 Summary and ContributionThischapterinvestigatedapproachestoensureandanalyzedataqualityinapur-chasingandaccountspayableprocess,inthecontextofbusinessprocessmanage-ment.Itsummarizeddifferenttypesofcontrols,preventiveanddetective,andtheiruseincomputersystemsandprocesses.Further,threedifferentscenariosofhowthepurchasingandaccountspayableprocesseswouldbegeneratedwereanalyzed,as the particular implementation indicates what limitations are likely. Then thenotionofbusinessprocessmanagement(BPM)wasintroduced.BPMprovidesarenaissanceofmanagingprocesses,by integrating technology into thatmanage-mentprocess.
Theprimarycontributionofthischapteristhedevelopmentofanarchitecturefortheuseofbusinessprocessmanagementtoanalyzedatawithinpurchasingandaccountspayablefordataqualityandpotentialfraud.Historically,BPMhasnotbeenaimedat those activitiesbuthas focusedmoreonmanagingcashflows intheprocess.Thiswasdoneby layingout somemetrics tomonitorprocessdata,discussinghowknowledgediscoverycouldbeusedtodetermineifdataismeetingexpectations,andhowdataminingcouldbeusedtoinvestigatethedataqualityoftheunderlyingsysteminformation.
