Forensic analytics using cluster analysis: Detecting anomalies in data

• Published date: 01 April 2021
• Author: Clarence Goh,Benjamin Lee,Gary Pan,Poh Sun Seow
• Date: 01 April 2021
• DOI: http://doi.org/10.1002/jcaf.22486

Received: 8 Octobe r 2020Accepted: 28 December 2020

DOI: 10.1002/jcaf.22486

EDITORIAL REVIEW

Forensic analytics using cluster analysis: Detecting

anomalies in data

1 INTRODUCTION

Forensic accounting refers to the branch of accounting

that deals with the application of accounting facts gath-

ered through auditing methods and procedures to resolve

legal problems (Bhasin 2007). It involves the integrationof

investigative, accounting, and auditing skills. In perform-

ing forensic investigations, forensic accountants need to

calculate values, identify irregular patterns or suspicious

transactions, and draw conclusions by critically analyzing

financial data. Forensic accounting often also provides an

accounting analysis and explanation for frauds that have

been committed (Koh et al. 2009). Given the growth in

financial crime rates, there has been an increasing focus

on the role and skillsets that forensic accountants should

possess (Owojori & Asaolu 2009). Consistent with this, a

recent survey conducted by Rezaee et al. (2004) found that

93.3% of academics and 88.2% of practitioners expect the

demand and interest for services in fraud examination to

increase in the near future.

Given the rapid advancement in technology and the

growth in both the quantity and variety of data available in

the corporate setting, the use of data analytics techniques

have become widespread in accounting, including in

the area of forensic accounting (Pan et al. 2017;Nigrini

2020). One important data analytics technique in foren-

sic accounting is the use of cluster analysis to detect

anomalies in financial data (Chandola et al. 2009). In this

article, we introduce the cluster analysis technique and

highlight how it can be applied in anomaly detection in

forensic accounting. Using a worked example, we also

demonstrate how cluster analysis can be implemented

using the Tableau software.

Tableau is a software application that queries data and

generates graph-like visualizations. It is capable of han-

dling large datasets and can also perform various data ana-

lytics procedures, including clustering analysis. Although

Tableau is a useful tool that is effective in performing

forensic analytics tasks (Nigrini 2020), a recent survey con-

ducted by Ernst & Young(2014) highlights that only 12% of

respondents regularly use it in forensic data analytics, with

the majority of respondents (65%) preferring to rely on less

sophisticated tools such as Microsoft Excel. Our focus on

Tableauin this article contributes to the practice of forensic

accounting by highlighting how an effective but less com-

monly used tool can be applied in forensic analytics.

2BASICS OF CLUSTER ANALYSIS

Anomalies in data refer to outlier observations that devi-

ate so much from other observations that they may have

been generated by a different mechanism (Hawkins 1980).

Anomaly detection techniques are effective in forensic

accounting because they can effectively identify unusual

corporate financial behavior (Sharma and Panigrahi 2012).

Cluster analysis can be applied to detect anomalies in com-

plex datasets. Cluster analysis involves classifying data in

such a way that data assigned to the same cluster are more

similar to one another (along dimensions being examined)

than to data assigned to another cluster (Everitt et al. 2011).

Prior studies suggest that that in performing cluster analy-

sis, normal data is assigned to clusters which are large and

dense while anomalies are assigned to clusters which are

small and/or sparse (eg, Chandola et al. 2009; Sun et al.

2004).

Tableau performs cluster analysis using the K-means

clustering algorithm (Everitt et al. 2011). K-means clus-

tering has been examined in the accounting literature as

a technique in forensic accounting (Amani and Fadlalla

2017). Tang et al. (2006) suggest that using the K-means

algorithm is suitable when the dataset under analysis is

large, as often is the case with financial data, because it

requires less computing power than other methods. Sev-

eral steps are involved in the K-means clustering algo-

rithm. In step one, a value for K, which represents the

number of clusters to be used in the analysis, is assigned

(by the forensic accountant). The value assigned to K

should be selected such that adding an additional cluster

(ie, K+1) does not significantly improve the cluster model.

In step two, the algorithm randomly selects K data points.

These data points represent initial cluster centers, which

serve as a prototype of cluster members. In step three,

the algorithm computes Euclidean distances and uses it

154 © 2021 Wiley Periodicals LLCJ Corp Account Finance. 2021;32:154–161.wileyonlinelibrary.com/journal/jcaf