Broader FDA capabilities to help mitigate insider threat, cyber and fraud risks His t Backdate Hoax C t Descriptive tests t Diplomat expense yber at Honorarium oric Graph Sort Friend fee Pressure Expedite Hack Government official al datQuery = Subtract Pie char ymen Special t ÷ a s Fraud Access ack Divide ∑Group t + a t running Special payment Analytical� Average Aler onFrustrated Entertain Risk r Management override F Insider threat Add * Bogus Multiply Reporting Special pWorried Secretive Facilitation Rules-based descriptive tests and reporting — By using historical Keyword search — The process scans free text fields and data with simple and complex analytical weighted tests, significant unstructured data sources to identify suspicious or high-risk value can be achieved to identify areas of risk. Alerts will be language used. Companies can develop their own library of high- produced when a specific condition is met. For example, if an risk terms that incorporates industry and company-specific jargons, employee submits an expense for reimbursement with an expense acro nyms and cultural slangs that might be used within the specific amount in excess of a predefined reimbursement policy, then an group being analyzed. The process can be developed to take into alert would be triggered. These types of analytics are often easy account industry-specific terms, multiple languages and historical to implement as they rely on predefined conditions and policies. events so that suspicious language can be tagged and escalated for For this reason, this is the most common FDA technique used further review. by businesses. Topic modeling and linguistic analysis — These tools use text Statistical analysis and machine learning — This technique analytics to identify suspicious phrases, high-risk topics or leverages historical facts in the data and machine learning to unusual patterns of behavior in the free text components of the make predictions about future or otherwise unknown events. data. Beyond keyword searching, topic modeling seeks to cluster, The incorporation of statistical models into this approach further quantify and group the key noun or noun phrases in the data, increases the confidence that items identified as outliers warrant enabling the investigative team to quickly gain an understanding additional review, thus limiting the amount of false positives and of what information may have been compromised or the corrupt increasing the efficiency of the review process. intent of certain business activities. Linguistic analysis techniques use the results of text analytics to identify the emotive tone of the communication — identifying angry, frustrated, secretive, harassing or confused communications, among other sentiments. 26 | Global Forensic Data Analytics Survey 2016