Credit: Khakimullin Aleksandr/Shutterstock.com

This article is the second part in a two-part series on data analytics in corporate compliance.

The Use of Data Analytics to Detect Compliance Risks

As detailed in Part 1 of this series, the DOJ, SEC and other government agencies are increasingly using sophisticated data analytics technology as they focus their resources. Taking a cue from government agencies, many companies around the world are already using data analytics to detect control weaknesses, potential misconduct, and high risk behavior. In Part 2 of this series, this article briefly describes how companies are already using data analytics in compliance, and discusses factors that should be considered as companies adopt this as part of their compliance solution.

How Data Analytics Is Being Used

For years, financial services firms have analyzed transactions and flow of funds to identify individuals and activities that raise the risk of money laundering, corruption, and other financial frauds. Many banks use algorithms to detect suspicious transactions, like round-tripping, flow of funds between accounts, and transactions structured to avoid triggering a suspicious activity report. But the use of data analytics as a compliance tool is not limited to the financial services industry, and is increasingly used to identify bribery and corruption risk. Anheuser-Busch InBev, one of the world's largest consumer goods companies, has used machine-learning technology to develop a compliance tool called Project BrewRIGHT, which identifies high risk business partnerships and potentially illegal third-party payments. The program analyzes data from over 50 countries for possible red flags and has saved AB InBev hundreds of thousands of dollars on investigating payments.

Data analytics tools like Project BrewRIGHT allow companies to be proactive rather than reactive in their compliance efforts. Companies are also increasingly examining employee expense reports, travel bookings, accounts payable records, and vendor charts of accounts to identify transactions, trends, or patterns that suggest compliance problems. These internal data sources can be incredibly valuable in detecting corruption risk.

Considerations for Using Data Analytics in Compliance

The extent to which a company uses data analytics to identify compliance weaknesses necessarily depends upon its risk profile. In its most recent guidance on effective corporate compliance programs, DOJ reiterated the bedrock compliance principle that well-designed compliance programs should be tailored to the particular risks a company faces. Those risks include the industry, geographic scope, and regulatory landscape in which a company operates.

In thinking about how to incorporate data analytics into a compliance program, a company can start with the basics:

• What data sources already exist in the company, and can they be analyzed to detect compliance risks, such as third-party payments, internal expense reports, chart of accounts, "know your customer" data, or other financial transaction reports?
• What data does the company already analyze in order to generate management reports and track financial performance, and can that data be analyzed from a different perspective to identify control weaknesses or high risk behavior?
• How do existing data sources align with the company's compliance risk areas? For example, if the company faces significant corruption risk through a global distributor network, does the company record margin payments, discounts, and marketing support payments to distributors that could be analyzed to identify potentially corrupt transactions?

Data analytics rarely works well in isolation and should be one component of a holistic approach to compliance. A well-devised algorithm can flag a transaction for additional review.  But it is that additional review—which requires human judgment and analysis—that makes the crucial determination of whether the transaction is a problem. In the securities or commodities industry, a trade placed just before a market moving announcement may be evidence of the trader's skill or luck, or it may be evidence of possible insider trading. Once a trade is flagged for additional review, it will likely take additional investigative legwork to determine whether the trade was benign.

As with any other part of a compliance program, a company needs to have a well-thought-out plan for implementing data analytics into its compliance efforts including resource considerations. A data analytics tool needs to be appropriately calibrated to flag items that are true anomalies given the nature of a company's business. Too many false positives can distract from legitimate compliance problems and drain precious compliance resources. To be sure, the process of calibrating a data analytics tool requires some up front trial-and-error and investment in time, but it is worth the effort to get more reliable data on potential compliance gaps. Once the data analytics tool is up and running, the company needs to ensure it has the right team with the right skill set to analyze the transactions the tool flags for review. That may require augmented training for compliance personnel and enlisting the support of other control functions like finance and accounting. Ultimately, a well-designed data analytics tool will become part of the fabric of the compliance program and help a company detect and remediate compliance problems in their nascent state rather than waiting for them to hit the hotline.

Charles D. Riely, a former assistant regional director for the Division of Enforcement for the SEC, and Erin R. Schrantz are partners, and Matthew J. Phillips is an associate, in Jenner & Block's Investigations, Compliance and Defense Practice.