Gift cards are unclaimed property and must be forfeited to the state of purchase when they go unused.  Retailers typically make a voluntary disclosure of their balance of unused cards and transfer the cash to each state.  These voluntary disclosures are subject to audit which, in the case of this retailer, was likely given the nature of its business and the volume of transactions it processed.

The wrinkle that arose on this project was that the client’s point of sale (POS) system which managed the issuance and redemption of gift cards generated unreliable data.  The system had been managed by multiple vendors over the years and upgraded piecemeal.  Though the POS provided gift card ID numbers, customer names and addresses, store locations, transaction dates and balances, the data were inconsistent: gift card ID numbers were reused at different stores, customers who bought the gifts cards gave them to other people to redeem them who subsequently registered as new customers, store locations changed, etc.  It was impossible for the auditor to rely upon a list of transactions for any individual gift card – a gift card purchased for $10,000 might go unused while four other gift cards with redemptions of $2,500 would appear in the system as each having a negative (-) $2,500 balance.

So, the audit question was – how could I match up the gift card purchase transactions (debits) with their redemptions (credits) using the data that I had.  I used a genetic algorithm.  A genetic algorithm is a search technique that finds solutions to “optimization” problems – i.e. the process of choosing the best fit given a set of alternatives.  For each debit transaction, I was tasked with finding the most likely credit transactions that corresponded to it. 

I wrote a program in C# to iterate through each debit transaction and find dangling credit transactions that, if netted together, would result in a $0.00 balance.  The criteria I used to find these dangling credits were based on the information I had in the dataset.  For instance, if I had a $10,000 gift card issued to a Mr. Smith in Morristown, NJ, I searched for any transaction involving customers who lived near Morristown, NJ and tried to find dangling credits that equaled $-10,000.  If I found these, I would net them together, and remove them from the data set so that they couldn’t be “found” in subsequent iterations. 

In doing this, I observed that the data set evolved as subsequent iterations occurred, and it became easier to find the dangling credits because the dataset shrank.  The result of this activity was a substantial ($1.2m) reduction in the amount of unclaimed gift cards which saved the client from having to hand this money over to the states.  The results subsequently survived at least two state audits because the matches of gift card issuances and redemptions were both plausible and supported by a logical algorithm.

This heuristics in the genetic algorithm was supplemented with address validation.  Because the customers’ addresses were validated against the US Postal Service database of valid addresses and were geo-coded (assigned their latitude and longitudinal coordinates) they were known to exist and the relationships between two addresses in the same town or county could be used as part of the genetic algorithm.

Therefore, this case is yet another reason why auditors need to make a genuine effort to understand information architecture, search algorithms and analytics.  The savings gained by creative use of a genetic algorithm and USPS address validation far surpassed the fee for consulting services this client paid.

A recent study published in the journal Auditing seems to provide yet another example of how auditors are more effective when they use visual information – e.g. flowcharts – when identifying relevant internal controls in business processes.  Read the authors’ abstract below:

“The purpose of this study is to examine the extent to which client-prepared internal control documentation and business process flowcharts affect auditors’ ability to detect missing internal controls. A total of 395 experienced auditors participated in a two (internal control matrix: blank or client-prepared) by two (business process flowchart: absent or present) between-participants experiment. The research findings indicate that auditors who were supplied with a blank internal control matrix and a business process flowchart identified significantly more missing controls relative to the three other treatment conditions, among which there were no differences in the number of identified missing controls. The results indicate that when auditors are evaluating the effectiveness of a client’s internal control system for a significant business process, they should be provided with a flowchart of the business process under examination and complete their internal control design evaluation before reading client-prepared internal control documentation.”

 You hear that audit clients – provide a BLANK internal control matrix, a good flowchart, and forget the internal control documentation.  Think about all of the paper you could save yourself!

 Bierstaker, James Lloyd, James E. Hunton, and Jay C. Thibodeau. “Do Client-Prepared Internal Control Documentation and Business Process Flowcharts Help or Hinder an Auditor’s Ability to Identify Missing Controls?.” Auditing 28.1 (2009): 79-94. Business Source Complete. EBSCO. Web. 13 Jan. 2010.

To say that tacit knowledge is “non-linguistic” means that you cannot transfer this knowledge by writing it down.  If you are trying to teach someone to ride a bicycle, you cannot give him a “Bicycle Riding Handbook” and expect him to get very far.  To say it is “non-numeric” suggests that tacit knowledge is not empirical – you cannot give someone a formula or spreadsheet and expect him deduce what the knowledge should represent with the formula alone.  Tacit knowledge comes from the gut.

Auditors face difficulties when they encounter instances of tacit knowledge in their attempts to learn about a business process.  An example in my past deals with a client who had several thousand spreadsheets in its financial reporting process.  The client started a project to simplify these spreadsheets and implement automated controls the process.  To do this — and make its results auditable — the spreadsheet owner (an accountant) was asked to express how he created the spreadsheet and used its values in linguistic terms – he had to “document it”.  Although the client could easily support the financials it reported and had many manual controls in place to detect errors that did occur occasionally, the accountants could not explain how they calculated their numbers in several cases.  The common answer “that’s the way it’s done” would resurface.  When I would ask a particular spreadsheet owner to write down the steps he used to prepare a spreadsheet, my attempts to reproduce the steps would rarely return a consistent result.

It is clear to me now that there was a considerable amount of tacit knowledge in this reporting process that could not be explained in words.  Nonaka and Takeuchi would argue that one would have to experience the process before understanding whether it was well-controlled, but acquiring such “experience” would take more time than any auditor would be able to commit.  Perhaps auditors should consider the prevalence of tacit knowledge in business processes as a risk and expect audit clients to use Nonaka and Takeuchi’s tool – the SECI model – as a means of addressing it.

Tacit knowledge creates a considerable benefit to an organization because of its intangible nature – competitors cannot access this knowledge if it is not written without capturing the people who possess the knowledge.  Yet, this same benefit works as a disadvantage to auditors and should not be understated.