A medical insurance provider uses an electronic claims-submission process and suspects that a number of physicians have submitted claims for treatments that were not performed. Which of the following control procedures would be most effective to detect this type of fraud?

The most effective detective control in this scenario is the use of data analytics. Computer software can analyze vast amounts of claims data to identify anomalies, outliers, and red flags that indicate potential fraud. By comparing claims against the insured's demographic data (e.g., age, gender) and medical history, the system can flag logically inconsistent or improbable treatments (e.g., a maternity claim for a 70-year-old). This proactive, data-driven approach is highly effective for sifting through numerous transactions to pinpoint suspicious claims that warrant further investigation, directly addressing the risk of billing for services not rendered.

A. This is a weak deterrent, not a detective control. A physician intending to commit fraud would not hesitate to sign a false attestation.
B. This procedure is ineffective because it asks the suspected perpetrators (the physicians) to verify their own potentially fraudulent claims. They would simply confirm them.
C. An Integrated Test Facility (ITF) tests the system's processing logic, not the factual validity of a claim. It cannot determine if a service was actually performed.

1. The Institute of Internal Auditors (IIA), GTAG 16: Data Analysis Technologies, 2011.

Page 10, Section "Fraud Detection": This guide explicitly states that data analysis can be used for "Identifying unusual or duplicate payments..." and "Analyzing expense account reimbursement for non-business-related travel...". The principle of using analytics to find unusual patterns is directly applicable to detecting fraudulent medical claims. The guide emphasizes that data analysis helps auditors identify anomalies that may be indicative of fraud.

2. The Institute of Internal Auditors (IIA), "Managing the Business Risk of Fraud: A Practical Guide," 2008.

Page 61, Chapter 5 "Fraud Detection": This guide highlights "Analytical procedures" as a key fraud detection technique. It states, "These procedures are effective in detecting fraud and can be performed on a variety of data... The specific types of analytical procedures that can be performed are limited only by the imagination of the fraud examiner and the availability of reliable data." This supports using software to analyze claims data for abnormalities.

3. COSO, "Fraud Risk Management Guide," Second Edition, 2016.

Page 55, Principle 4 "Selects, Develops, and Deploys Fraud Control Activities": The guide discusses the use of data analytics to identify potential fraud events. It notes that organizations can "analyze activities and transactions to compare with established profiles and thresholds to identify anomalies for follow-up." This aligns perfectly with using software to identify abnormal claims based on patient history.