A business process mining application for internal transaction fraud mitigation Mieke Jans a,⇑ , Jan Martijn van der Werf b , Nadine Lybaert a , Koen Vanhoof a a Faculty of Business Economics, Hasselt University, Agoralaan, Gebouw D, 3590 Diepenbeek, Belgium b Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, P.O. Box 513, 5600 MB Eindhoven, The Netherlands article info Keywords: Internal fraud Transaction fraud Process mining abstract Corporate fraud these days represents a huge cost to our economy. In the paper we address one specific type of corporate fraud, internal transaction fraud. Given the omnipresence of stored history logs, the field of process mining rises as an adequate answer to mitigating internal transaction fraud. Process min- ing diagnoses processes by mining event logs. This way we can expose opportunities to commit fraud in the followed process. In this paper we report on an application of process mining at a case company. The procurement process was selected as example for internal transaction fraud mitigation. The results con- firm the contribution process mining can provide to business practice. Ó 2011 Elsevier Ltd. All rights reserved. 1. Introduction In recent years, the problem of internal fraud has received more and more attention. Not unfounded, there the Association of Certi- fied Fraud Examiners (ACFE), an American worldwide organization that studies internal fraud, estimates a US company’s losses on internal fraud to be seven percent of its annual revenues (ACFE, 2008). In a previous report of the ACFE, in 2006, this estimation was only 5%, confirming the increasing threat internal fraud poses to companies. Internal fraud has received a great deal of attention from inter- ested parties like governments or non-profit institutions. The emer- gence of fraud into our economic world did not go unnoticed. A US fraud standard (Statement on Auditing Standard No. 99) and an international counterpart (International Standard on Auditing No. 240) were created to point auditors to their responsibility relating to fraud in an audit of financial statements. Section 404 of the Sarbanes–Oxley act of 2002 and the Public Company Accounting Oversight Board’s (PCAOB) Auditing Standard No. 2 also address this issue. Meanwhile, the CEO’s of the International Audit Net- works released a special report in November 2006. This report, is- sued by the six largest global audit networks, is released in the wake of corporate scandals. The authors of this report express their believe in fighting fraud, as they name it ‘‘one of the six vital ele- ments, necessary for capital market stability, efficiency and growth’’. 1 All these standards and reports address the issue of internal fraud (as opposed to external fraud – fraud committed by someone externally related to the company). In general, two categories within internal fraud can be distinguished: financial statement fraud and transaction fraud. Bologna and Lindquist (1995) define financial statement fraud as ‘ the intentional misstatement of certain financial values to enhance the appearance of profitability and deceive shareholders or credi- tors’. Statement fraud concerns the abuse of a managers position (hence ‘management fraud’) to alter financial statements in such a way that they do not give ‘a true and fair view’ of the company anymore. Transaction fraud however can be committed by both management and non-management. The intention with transac- tion fraud is to steal or embezzle organizational assets. Violations can range from asset misappropriation, corruption over pilferage and petty theft, false overtime, using company property for personal benefit to payroll and sick time abuses (Wells, 2005). Davia, Coggins, Wideman, and Kastantin (2000) state that the main difference between statement and transaction fraud is that there is no theft of assets involved in financial statement fraud (FSF). Turning to academic studies on this subject, some research is found concerning internal fraud. Green and Choi (1997), Lin, Hwang, and Becker (2003) and Fanning and Cogger (1998) assess the risk on FSF by means of neural networks. Deshmukh and Tall- uru (1998) use a rule-based fuzzy reasoning system for the same goal and Kirkos, Spathis, and Manolopoulos (2007) use several data mining techniques in order to identify financial factors to assess the risk on FSF. Hoogs, Kiehl, Lacomb, and Senturk (2007) use a genetic algorithm approach to detect patterns in publicly available financial data that are characteristic for FSF. This approach uses a sliding-window approach for evaluating patterns of financial data over quarters in terms of potentially fraudulent or not. 0957-4174/$ - see front matter Ó 2011 Elsevier Ltd. All rights reserved. doi:10.1016/j.eswa.2011.04.159 ⇑ Corresponding author. Tel.: +32 11268652. E-mail addresses: mieke.jans@uhasselt.be (M. Jans), j.m.e.m.v.d.werf@tue.nl (J.M. van der Werf), nadine.lybaert@uhasselt.be (N. Lybaert), koen.vanhoof@uhas- selt.be (K. Vanhoof). 1 The remaining five elements concern investor needs for information, the alignment and support of the roles of various stake holders, the auditing profession, reporting and information quality. Expert Systems with Applications 38 (2011) 13351–13359 Contents lists available at ScienceDirect Expert Systems with Applications journal homepage: www.elsevier.com/locate/eswa