Phases of the Data Analysis Process

1. Why This Topic Matters

Data analysis is one of the most powerful tools available to a fraud examiner. Modern organisations generate enormous volumes of transactional data, and fraud frequently leaves a footprint in that data: duplicate payments, vendors with employee addresses, journal entries posted at odd hours, round-dollar amounts just below approval thresholds, and so on. However, simply dumping data into a software tool and "looking for fraud" is ineffective and wasteful. The ACFE Fraud Examiners Manual stresses that effective data analysis is a structured, objective-driven process. The CFE exam tests whether you understand that structure, the order of the phases, and what activities belong in each phase. Questions in this area are common in the Investigation (Fraud Examination) section, and they are very answerable if you learn the framework rather than memorising isolated facts.

2. What It Is

The data analysis process is a disciplined approach for using software and analytical techniques to detect fraud indicators in an organisation's data. The Fraud Examiners Manual divides the process into four phases:

1. Planning Phase
2. Preparation Phase
3. Testing and Interpretation Phase
4. Post-Analysis Phase

The phases are sequential but also iterative: results from testing may send the examiner back to refine tests, obtain more data, or re-cleanse data. A helpful memory aid is P-P-T-P: Plan, Prepare, Test, Post-analyse.

3. How It Works – Phase by Phase

Phase 1: Planning
The ACFE regards planning as the most important phase. Without a plan, analysis becomes an undirected "fishing expedition" that produces mountains of meaningless exceptions. Key planning activities include:

• Understand the business and the data. Learn how the entity operates, which systems hold the relevant data, how data flows between systems, which fields exist, and what each field means. Interview IT personnel and data owners. Obtain data dictionaries and record layouts.
• Articulate the examination objectives. What is the purpose of the analysis? Is it a reactive investigation into a specific allegation, or a proactive fraud-detection exercise? Clear objectives drive every later decision.
• Build a profile of potential frauds (fraud risk assessment). Identify the schemes that could occur in the area under review (e.g., billing schemes, ghost employees, expense reimbursement fraud) and the red flags or symptoms each scheme would leave in the data.
• Determine whether predication exists and whether data analysis is the appropriate tool.
• Identify the specific tests that will detect each identified scheme (e.g., for a shell company scheme: match vendor addresses to employee addresses, search for vendors with no tax ID, identify sequential invoice numbers from a single vendor).
• Determine the data needed for those tests – which systems, which tables, which fields, and which time period.

Phase 2: Preparation
This phase gets the data into a usable, reliable form. It is often the most time-consuming phase. Activities include:

• Identifying the relevant data and its location (e.g., accounts payable master file, vendor master file, payroll register, general ledger detail).
• Obtaining the data. Submit a formal data request specifying tables, fields, date ranges, and format. Where possible, obtain data directly from the source system rather than through intermediaries who could filter or alter it. Preserve the original data and work on copies.
• Verifying the data. Confirm the data is complete and accurate before testing. Techniques include reconciling record counts and control totals (e.g., total disbursements per the file versus the general ledger), checking date ranges, and confirming the file matches what was requested.
• Cleansing and normalising the data. Cleansing removes or corrects errors: duplicates, blanks, invalid characters, inconsistent formats. Normalising (or standardising) converts data into a consistent structure so it can be compared and joined – for example, formatting all dates the same way, standardising address abbreviations ("St." vs "Street"), or converting all text to one case so that "ACME Inc" and "Acme, Inc." match.

Phase 3: Testing and Interpretation
Here the planned tests are actually run and the output is analysed. Important points:

• Run the tests designed during planning using the chosen tool (e.g., IDEA, ACL/Galvanize, Excel, SQL). Common tests include duplicate detection, gap detection, Benford's Law analysis, stratification, summarisation, joins/relations between files, date/time analysis, and keyword searches.
• Interpret the results. Exceptions are indicators, not proof. Every anomaly must be evaluated in context. Expect many false positives – legitimate transactions that trip a test (e.g., duplicate amounts that are genuinely recurring rent payments).
• Refine the tests. If a test generates too many false positives, tighten the criteria; if it generates nothing useful, broaden it or try a different approach. This is where the iterative nature of the process is most visible.
• Follow up. Genuine red flags are investigated through traditional means – document examination, interviews, and tracing transactions – to determine whether fraud actually occurred.

Phase 4: Post-Analysis
The final phase ensures the work has lasting value:

• Document the process. Record what data was obtained, how it was verified and cleansed, which tests were run, what parameters were used, and what results were found. Documentation supports the credibility and repeatability of the work and may be needed if the matter proceeds to litigation.
• Report the results to management, the audit committee, legal counsel, or other stakeholders in a clear format suited to the audience (see the related topic on reporting tools and data visualisation).
• Monitor and improve. Evaluate which tests were effective and which were not. Successful tests can be converted into continuous monitoring routines that run automatically on an ongoing basis, strengthening the organisation's anti-fraud controls.

4. Key Principles the Exam Expects You to Know

• Data analysis should be objective-driven – tests are chosen to detect specific, identified fraud risks.
• Planning comes first and is the foundation; failing to plan leads to irrelevant output.
• You must understand the data before analysing it.
• Data must be verified (completeness and accuracy) before conclusions are drawn.
• Cleansing and normalising belong to the Preparation phase, not the Testing phase.
• Analysis output identifies anomalies or red flags, not conclusive evidence of fraud; follow-up is always required.
• False positives are normal and expected; refining tests is part of the process.
• Documentation and continuous monitoring are hallmarks of the Post-Analysis phase.

5. Exam Tips: Answering Questions on Phases of the Data Analysis Process

Tip 1 – Memorise the four phases in order. Plan, Prepare, Test and Interpret, Post-analyse. Questions frequently ask which phase comes first, which activity happens in a particular phase, or which phase a described activity belongs to.

Tip 2 – Match activities to phases. Build a mental table:
• Understanding the business, setting objectives, building a fraud profile, selecting tests, deciding what data is needed → Planning.
• Requesting data, obtaining data, verifying completeness, reconciling control totals, cleansing, normalising → Preparation.
• Running tests, reviewing exceptions, eliminating false positives, refining tests → Testing and Interpretation.
• Documenting, reporting, evaluating test effectiveness, establishing continuous monitoring → Post-Analysis.

Tip 3 – Watch for the "most important" or "first step" question. The ACFE position is that planning is the critical foundation, and that the examiner must understand the data and the entity's business before analysis. If an answer choice jumps straight to "run tests" or "obtain all available data" as the first step, it is almost certainly wrong.

Tip 4 – Distinguish verification from cleansing. Verification asks "Is this the complete and accurate data I requested?" (record counts, control totals). Cleansing/normalising asks "Is the data in a consistent, usable format?" (duplicates, formats, standard abbreviations). Both are Preparation, but the exam may test the difference.

Tip 5 – Remember that results are indicators, not proof. Any answer stating that a data analysis exception "proves" fraud, or that follow-up is unnecessary, is incorrect. The correct view is that anomalies require investigation through conventional fraud examination techniques.

Tip 6 – Expect questions on false positives. The exam expects you to know that false positives are common, that they do not mean the analysis failed, and that the proper response is to refine the test criteria during the Testing and Interpretation phase.

Tip 7 – Recognise the iterative nature. If a question describes an examiner going back to obtain additional data or adjust a test after reviewing results, that is normal and correct – the process is not strictly linear.

Tip 8 – Read scenario questions carefully. Many questions present a short narrative ("Maria is a CFE who has been asked to analyse disbursement data...") and ask what she should do next or which phase she is in. Identify the last completed activity in the scenario, locate it in your phase table, and choose the next logical step.

Tip 9 – Eliminate answers that describe a "fishing expedition." The ACFE consistently teaches that analysis should be targeted at specific fraud risks. Choices suggesting the examiner should "analyse all data for anything unusual" without defined objectives are distractors.

Tip 10 – Link to adjacent topics. Questions may blend this topic with data analysis techniques (Benford's Law, duplicate testing, gap testing) or with reporting and visualisation. Knowing where each technique fits in the four-phase framework will help you answer integrated questions confidently.

6. Quick Review Summary

• Planning: understand business and data, set objectives, identify fraud risks and red flags, choose tests, define data needs.
• Preparation: identify, obtain, verify, cleanse, normalise.
• Testing and Interpretation: run tests, review exceptions, manage false positives, refine, follow up.
• Post-Analysis: document, report, evaluate, implement continuous monitoring.

Master this structure, practise placing activities in the correct phase, and remember the guiding philosophy – targeted, objective-driven analysis that produces indicators requiring follow-up – and you will handle any exam question on the phases of the data analysis process.