Imagine having the capability to run the same types of tests that auditors use during their routine check-ups and apply it to every transaction a company makes on a daily basis.
That's the premise behind Oversight Systems, a four-year-old Atlanta-based company that serves as a "virtual auditor" with the goal of uncovering fraud and errors in financial transactions.
Oversight Systems' software -- available in Web-based or on-premise versions -- combines an audit data warehouse, advanced analytics and workflow into an integrated application extracting data from financial systems including Oracle, SAP and PeopleSoft, as well as customized applications.
"Traditionally, because it was so expensive to try to look for things to try to resolve, people just said, 'We'll live with it, it's the cost of doing business,'" said Patrick Taylor, chief executive of Oversight Systems. "What we've changed, it doesn't have to be a cost of doing business. It is now economically attractive to find and fix these problems, and that's the Oversight 'A-ha.'"
Taylor described the original genesis of Oversight as taking place around a table in a Starbucks with Chris Rossie, an employee from Taylor's previous company, Internet Security Systems, and friends Dan Kuokka and Skip Addison.
ISS, where Taylor spent four years as vice president of marketing, has since been sold to IBM. But at the time it focused on looking at network activity and trying to find hackers and prevent them from penetrating the system. The group kicked around some ideas and was looking for their next entrepreneurial opportunity.
"What we recognized was, as much money as people spend to stop hackers, if you look at their actual financial losses, they lose more money to internal fraud than they ever do to hackers," Taylor explained. "We began working on the idea of what if, instead of stopping network traffic for hackers, we looked at business transactions to try to find fraud."
The Starbucks conversation took place in the spring of 2003 and from there the group designed some PowerPoint slides to try and sell the idea. "We went out and did some primary research, got appointments with CFOs and controllers and people with auditing firms and began hammering out the market potential, the business interest," Taylor explained.
Next came fund-raising. The crew was able to raise enough capital to hire a few more people and start building the product. By the spring of 2004, the company was doing its first beta testing -- but their results were disappointing.
"We're out there, the product's working and we're finding stuff and every time we'd find something, we'd say to our users, 'Well, no, that's not fraud,' and we'd fine-tune it a little more," Taylor recalled, adding that the company would go through a year's worth of data without finding any fraud-related evidence.
"We were getting a little dejected about this and the users tell me, 'Oh, no, this is really interesting. The stuff that you found is a bunch of errors and mistakes. You're showing me where a problem happened, you know who committed the error, so it's really easy for me to fix the problem. This is great.' So while looking for fraud is absolutely important and valuable, there is a tremendous ROI in finding errors."
HOW IT WORKS
To provide continuous monitoring, Oversight offers a handful of components that make up its framework: a single data repository called an audit data warehouse; its Collaborative Reasoning Engine, or Core, which uses statistical and probabilistic analysis to identify the potential fraud or errors; an automated Workbench that identifies and studies the root cause of exceptions detected by Core; an executive dashboard including reports and graphs for management view; and a journal that keeps permanent track of the system's activity.
Aside from the platform, Oversight offers separate business process modules, including procure-to-pay accounts payable; order-to-case accounts receivable; financial accounting and reporting; travel and entertainment expenses; procurement cards; capital and fixed-asset management; human resources and payroll; and inventory.
"Most typically, customers will pick up a specific business process to monitor," Taylor said. "We'll come in and deploy against that process and they have two goals. One, they want to see how well we work, and two, they develop their own capabilities around the continuous monitoring because it is a new paradigm. They transform to a paradigm of finding problems early and fixing them early when they are easy to correct. Traditionally, people are used to chasing things down in a very retroactive and laborious manner."
According to Taylor, once the system finds an error, there are two ways to be notified. Depending on what the problem is, an e-mail alert can be sent to the user with a link to the Workbench in the Oversight user interface. Once there, a plain-language description explains why the system thought it was a problem, along with supporting data. The other model, usually used at shared service centers or in business process outsourcing, allows users to regularly log into the Oversight application to check for issues.
Mainly errors are just that -- errors, or "fat-fingered" mistakes made by humans typing in the wrong data, adding an extra zero onto a number, or typing in the right data in the wrong data field. Fraud isn't found frequently, though Taylor admitted that people have lost their jobs because of what the system has identified. "Fraud is a somewhat rare and singular event, so you might find dozens of issues a year to investigate," he said. "Of those, maybe a small handful will be real."
NEW HORIZONS
In January 2007, Oversight was approached by the Center for Audit Quality to provide feedback on their anti-fraud efforts and its common data model for the general ledger to drive a consistent approach for all registrants, according to Taylor.
As a result, Oversight created its Extractor Mapper, a system that retrieves detailed general ledger transactions from a client's financial application and transforms it into the common data model specified by the center.
"Under existing practices, the procedure for gathering detailed GL data is fraught with miscues and often requires multiple attempts in order to achieve a successful extraction," Taylor said. "As audit firms strive to apply forensic analysis in a greater percentage of their clients, it became necessary to automate the process. Oversight Extractor Mapper was configured to meet the requirements for a CDM and it will be deployed by the Big Four as part of the CAQ initiative."
Aside from that project, Taylor's goal remains simple: "selling lots more software and selling lots more services."
Though he would not disclose the company's earnings, he said that Oversight is experiencing upwards of 50 percent quarter-over-quarter growth. "We're tripling year over year or better," he said, adding that the company has approximately 70 employees, two of which include Rossie and Kuokka, as vice president of business development and vice president of research, respectively.
Pricing for his software varies for each company, Taylor said, but, "For your average $1 billion company, you could be starting at the $150,000-a-year range." Those who want to use the system once -- what Oversight calls a one-time audit "check-up" -- can expect to pay $4,750.
With almost 100 customers, including McDonald's, Quaker Chemical Corp. and American Electric Power, Taylor said that Oversight could also be used for small and midsized companies. "Probably the most important characteristic for us is that the company has a focus on improving the quality, efficiency and compliance of business processes," he said. "In organizations that have implemented a shared service center or have centralized accounting, there's inherently a focus on the business process with an executive who can see the benefits."
'HOW CAN WE BUY THIS?'
Jim Kirkpatrick, director of internal audit at Shaw Industries Group Inc., a subsidiary of Berkshire Hathaway, saw the benefits of using the Oversight system after an introductory meeting.
Kirkpatrick had been frustrated with his previous software system, which forced him to wait on data from his information technology organization during every audit routine. "We started scratching our heads, saying there has to be a better way," he said. "It just kept taking us longer and longer."
Around that time, Kirkpatrick received a telephone call from Sam Kaye, Oversight's new vice president of sales, whom Kirkpatrick knew previously. "He said, 'I've been here two weeks, I'm looking at this software and I think this is something. I want to get your honest opinion,'" Kirkpatrick recalled. "So we jumped in a car a week later, looked at the demo [and] we came out of there saying, 'How in the world can we buy this software?'"
In September, the system was installed over the course of a weekend, and Kirkpatrick said that he has been extremely satisfied with the results.
"For us, it provides a continuous monitoring technique to identify outliers and unusual items in our data," he said, adding that his company chose the procure-to-pay module. "It provides instant notification upon potential duplicate vendors, duplicate payments, duplicate vouchers, and transactions that are outside the normal standard deviation."
With more than 55,000 vendors to track, Kirkpatrick said that the software has helped to cleanse the company's data. For example, the system will draw out "exceptions" when a vendor is added and it has similarities to others already in the system. Those entries will be flagged and the company has people on staff to facilitate investigating integrity checks or potential errors. Ninety-five percent of the time, the integrity checks don't turn out to be an error, he claimed.
"I'm not going to say there were not some things that surprised management," Kirkpatrick said, who declined to disclose how many errors were found. "But the big thing is, it is preventing anything that is a potential error or duplicate item."
