CONCLUSIONS PAPER. The Impact of the Underground Economy, Title and How Analytics Can Fight It

Transcription

1 CONCLUSIONS PAPER The Impact of the Underground Economy, Title and How Analytics Can Fight It

2 ii Contents What s the harm in an underground economy?... 1 How big is the problem?... 1 Digging up the underground economy... 2 Focus investigative efforts where they ll pay off... 4 An analytics lifecycle approach... 4 One state s journey: Washington... 5 Big payback...6 Closing thoughts... 7 Learn more... 7 Featuring: Carl Hammersburg, Manager for Government and Health Care Fraud, SAS John Stultz, Principal Fraud Specialist, SAS

3 1 What s the harm in an underground economy? A handyman builds a deck for a client, gets paid in cash and doesn t report the income. A chainsaw operator makes a little money on the side trimming trees after storms. A stay-at-home mom uses her skills to run a small day care and sell baked goods and hand-painted furniture. A business owner gets cash at a check-cashing service and distributes it to workers who are off the books. A retailer uses creative sourcing and bookkeeping to cut costs and keep prices low. This is free rein of entrepreneurial spirit, right? If both vendor and customer benefit, what s the harm? Plenty, when you consider the bigger picture: For one, unreported or underreported income starves governments of needed tax revenue. Business owners who are not protected by insurance, occupational safety rules, background checks and workers comp put themselves, their clients and co-workers at risk if something goes wrong. Those who skirt standard business requirements such as licensing, inspections, and contributions to Medicare and unemployment can drive down their cost structures by percent and undercut legitimate businesses through unfair competition. Somebody pays the price. For example, when people use their personal homes and cars to provide services to the public, they incur exposures not reflected in their insurance premiums. That means more risk for the insurance company and higher premiums for the rest of us. Workers who get injured on the job and are not covered by workers compensation end up at public hospitals and on disability benefits. In most cases, government picks up the tab, which translates into higher taxes or lower services for everybody. These kinds of activities are easy to underreport or not report at all to escape taxation, licensing and regulation. How big is the problem? Hidden business is big business, thanks in part to new technologies and business models. For example, we re seeing dramatic growth in businesses based on sharing, such as renting out your personal home. Or a surge in freelance gigs, such as providing taxi services using your personal vehicle. And there are popular online marketplaces that match resources with local demand, such as for cleaning, moving, delivery and handyman work. These kinds of activities are easy to underreport or not report at all to escape taxation, licensing and regulation.

4 2 In its latest tax gap study, the US Internal Revenue Service estimated that $376 billion of income is underreported, while non-filers account for another $28 billion. And we re not talking about unlawful activities, such as counterfeiting or illegal drug deals just about legitimate business activities that fly under the radar of tax authorities. IRS estimates may be conservative. Economist Edgar Feige, author of Underground Economies in Transition: Unrecorded Activity, Tax Evasion, Corruption and Organized Crime, estimated that $2 trillion in activity never makes it to federal tax forms in the US. In Canada, that figure is about $45 billion. In the US, 17 percent of income tax goes unreported. For sales tax, the gap comes in at 27 percent in Italy, 39 percent in Greece and 48 percent in Romania. We all know these studies are inaccurate and only hint to the magnitude of the problem, because so many activities are so far off the radar that it s impossible to know, said Carl Hammersburg, Manager of Government and Health Care Fraud programs at SAS. Digging up the underground economy Underground activities are not always premeditated. Some are, but others are simply caused by lack of knowledge Why can t all my full-time workers be independent contractors? Other strategies are deliberate, such as offering clients a better rate if they ll pay in cash that won t be reported. Other activities are well choreographed, such as collusion and fake identities to hide sales volume to avoid sales taxes. Analytic techniques detect all three flavors of fraud, but you have to start with the right data and match the analytics to the need. Moving up the spectrum from opportunistic to deliberate to organized activities, you need progressively more sophisticated analytic techniques. Figure 1. Different analytic techniques apply across the spectrum of risk.

5 3 We can catch potential risks at the lower level with simple business rules, said John Stultz, a Principal Fraud Specialist at SAS. For example, flag all cash withdrawals over $1,000 or all checks totaling more than $10,000 in a business day. Business rules provide a simple way to spot data points that are out of range, but they also deliver a lot of false positives that derail investigators into low-value cases. Business rules are a good place to start, but a rigorous analytic decision engine requires multiple analytic techniques, often complementing each other. Database searching and matching identifies discrepancies in behavior or information for an entity across multiple systems. For instance, it could identify a person who has a fleet of heavy construction vehicles but shows only minor construction or grading income. Anomaly detection is very good at helping us know what we don t know. It finds indicators of risk where we don t know where to set thresholds, said Stultz. The system can compute variables and find the outliers that are potentially suspicious. Historical anomaly detection looks at changes in behavior over time. If the system sees a sudden, drastic shift from a historical pattern with nothing else in the data to explain that shift this would be flagged as an anomaly and factored into the overall risk score for that entity. Peer grouping or clustering compares trends to the norm for a demographically similar entity or peer group, and identifies cases that are quite different from what would be expected for that group. For example, what volume of cigarette sales would be typical for a mini mart that sells x gallons of gas a month? Text mining identifies patterns in unstructured data, such as reports, comment fields and social media. Text mining can be useful for unearthing factual discrepancies, scripted words or phrases, or phrases indicative of lying. With advanced analytics such as predictive modeling, you can build models that identify attributes or patterns that are highly correlated with past risks, even newly emerging patterns. The models are then used to score incoming transactions to determine if they look more like known fraud or known valid transactions. Those scores factor into the overall risk score associated with the entity. Business rules are a good place to start, but a rigorous analytic decision engine requires multiple analytic techniques, often complementing each other. Database searching and matching Anomaly detection Text mining Advanced analytics Social network analysis For activities conducted by organized rings, social network analysis identifies relationships among entities, based on static attributes in the data (phone numbers or addresses, for example) or transactional attributes, such as referral relationships. For example, social network analysis could find where a store owner had multiple memberships in a big box discount/wholesale store, purchased 440,000 cartons of cigarettes across those different accounts but didn t report equivalent sales.

6 4 Focus investigative efforts where they ll pay off Using multiple analytic techniques in combination, you can effectively triage cases for investigation. Perhaps business rules and database matching didn t catch anything suspicious, but anomaly detection found a high likelihood of risk, and so did one of the predictive models. The suspicion was confirmed by social network analysis. A constellation of pointers gives you confidence that investigators time will be well spent on this case. Each analytic technique contributes to a cumulative risk score weighted to give more influence to the strongest proven indicators of risk, said Stultz. Now we have a way to triage to focus on things with a very high probability of being a true positive with a high associated higher dollar amount. Figure 2. A hybrid analytic approach effectively triages cases for investigation. An analytics lifecycle approach Now that analytic models are essential assets, they must be managed with rigor throughout their life cycle. In a cyclical and iterative process, models go through the following stages: Problem identification. Stakeholders come together to articulate the business questions to solve, which leads to the selection of the best analytic techniques to use. Data prep. Source, cleanse and prepare the data for better results, as appropriate for the business question and analyses in mind. Data exploration. Interactively explore the data to quickly spot relevant variables, trends and relationships that were not evident before then transform and select the needed data.

7 5 Model development. Skilled analysts or modelers build the models, usually multiple models that will be compared to choose the best-performing champion model. Model validation. Once built, the model is registered, tested or validated, approved and ready to be used with production data. Model deployment. Once approved for production, the model is applied to new data to uncover past underreported activities or to generate predictive insights. Model monitoring and evaluation. We want to catch models that are getting outdated because patterns of fraud are evolving, said Stultz. Model performance is monitored to ensure it is still up to date and delivering valid results. Over time, models are recalibrated by changing the weights of characteristics or are rebuilt with existing and new characteristics. Now that analytical models are high-value organizational assets to detect and prevent fraud, the models and their data must be managed for optimal performance across the analytical life cycle. This is a highly iterative and interactive process that should be tightly managed. It s not set it and forget it. Figure 3. The analytical life cycle One state s journey: Washington Speaking at an Association of Certified Fraud Examiners (ACFE) event, Hammersburg shared his experience as head of compliance for Washington state s workers compensation program, the fourth-largest workers comp insurer in the nation. In seven years there, Hammersburg oversaw fraud detection, claim investigations, premium audits, provider fraud and collections programs and served as the agency lead for broad underground economy issues that cut across many regulatory programs. The first step was to pull together a joint task force made up of elected individuals from the House and Senate, from both parties, together with other people who might

8 6 be affected, such as from the employment sector, administration, enforcement and tax authorities, said Hammersburg. This task force addressed issues of legislation and budget, enforcement and analytics. For example, what restrictions apply to data sharing? What legislative changes are needed to make the project work? When data from multiple agencies leads to a discovery, who handles enforcement? The task force defined a framework for the changes to be made and took that back to their various departments to implement. The first phase used simple tools, such as Excel spreadsheets, and rudimentary data sharing and analysis, Hammersburg recalled. I ll admit it, we were doing rules-based analysis at the beginning. We weren t using a statistically rigorous analytical methodology. If rules-based methods identified things that were 20 or 30 percent off, then we d analyze it. There was a points system in scoring according to which business rules were breached, but otherwise the system was not very effective for triaging risk. At the same time, just this piece with that rudimentary analysis was enough to bring in millions of dollars to Washington state and receive an award from the governor. The second phase expanded data and analytics capabilities. We acquired tools to do analytics and to help visualize networks, said Hammersburg. We added unemployment tax data and began to pull in all sales and business taxes for our state, so we had a more comprehensive look at what was going on. These enhancements led to finding more dollars, but they also triggered a lot more false positives and prompted a request for funding for a comprehensive analytics system. The third phase pulled in 15 data sets from the state level, spanning five different departments/agencies plus external audit and control functions (to ensure compliance with data-sharing regulations and best practices). When additional access controls were set in place (a server in a locked cage with cameras on it, coupled with stringent access restrictions) the analytics system also incorporated IRS data for business taxes and individual taxes. We were looking at a more than $1.4 billion tax gap every two years. That s enough to run major programs. This is a huge issue, and we needed to be able to do something about it. Carl Hammersburg, Manager for Government and Health Care Fraud, SAS Big payback Each step of this analytic evolution added value, said Hammersburg, but the third phase produced the most dramatic results. All the taxing agencies in Washington state participated in the Unregistered Business Study. Following the same methodology the IRS uses, we measured $718 million in taxes either underreported or nonreported not registered with one or more of our agencies for every year of the study. We were looking at a more than $1.4 billion tax gap every two years. That s enough to run major programs. This is a huge issue, and we needed to be able to do something about it. Productivity gains were notable as well. Having a comprehensive analytics system dropped the time it took us to triage a case by 80 percent. Having all the data in one place dropped the time it took to audit a business by 15 percent, said Hammersburg. The false positive rate, which had been around 50 percent, dropped to 12 percent. We were getting 80 percent more productivity while getting 50 percent more dollars per case.

9 7 The return on investment turned heads and changed perceptions. By improving our risk ranking and triaging, our comprehensive analytic system delivered a 30:1 ROI. When we factored in all costs from facilities to office supplies to IT systems and staff the program delivered a 10:1 ROI overall. The Washington State Legislature gave us funding to double the size of our construction specialist team without us even asking, and that just doesn t happen in government. Closing thoughts If we had done anything differently in Washington state, we would have done it faster, said Hammersburg. The key message is that fraud prevention dealing with risk and program integrity is not a cost issue, it s a saving. When you can truly quantify the positive impact to the bottom line of a company or government agency, you shift the recognition that this is not an expense but that it s a saving. Some government organizations may be concerned that a rigorous program to shine a light on the underground economy will shine a brighter light on how much they didn t know until now. Don t let that stop you, said Hammersburg. You have the opportunity to really get ahead of it now. Turn a risk into an opportunity going forward. Learn more Learn about SAS solutions for security intelligence: sas.com/en_us/industry/fraud-si Watch the ACFE webinar, The Impact of the Underground Economy, and How Analytics Can Fight It sas.com/underground

10 To contact your local SAS office, please visit: sas.com/offices SAS and all other SAS Institute Inc. product or service names are registered trademarks or trademarks of SAS Institute Inc. in the USA and other countries. indicates USA registration. Other brand and product names are trademarks of their respective companies. Copyright 2016, SAS Institute Inc. All rights reserved _G