[Paper Review] Open ERP System Data For Occupational Fraud Detection

Julian Tritscher, Fabian Gwinner+3 more|arXiv (Cornell University)|Jun 9, 2022

Imbalanced Data Classification Techniques4 citations

TL;DR

This paper proposes a novel method for generating publicly available synthetic ERP system data that includes both normal business operations and realistic occupational fraud scenarios. By leveraging a serious game to simulate user interactions in a real ERP system, the authors generate multi-year datasets with fine-grained fraud annotations, enabling reproducible benchmarking of fraud detection techniques in enterprise resource planning environments.

ABSTRACT

Recent estimates report that companies lose 5% of their revenue to occupational fraud. Since most medium-sized and large companies employ Enterprise Resource Planning (ERP) systems to track vast amounts of information regarding their business process, researchers have in the past shown interest in automatically detecting fraud through ERP system data. Current research in this area, however, is hindered by the fact that ERP system data is not publicly available for the development and comparison of fraud detection methods. We therefore endeavour to generate public ERP system data that includes both normal business operation and fraud. We propose a strategy for generating ERP system data through a serious game, model a variety of fraud scenarios in cooperation with auditing experts, and generate data from a simulated make-to-stock production company with multiple research participants. We aggregate the generated data into ready to used datasets for fraud detection in ERP systems, and supply both the raw and aggregated data to the general public to allow for open development and comparison of fraud detection approaches on ERP system data.

Motivation & Objective

• To address the lack of publicly available ERP system data for occupational fraud detection research.
• To generate realistic synthetic ERP data that includes both normal operations and diverse fraud scenarios.
• To ensure reproducibility and comparability of fraud detection methods by releasing raw and aggregated datasets.
• To extend data generation beyond P2P processes to include the O2C process for broader applicability.
• To provide fine-grained, expert-annotated fraud labels at the feature level for in-depth evaluation of detection models.

Proposed method

• Using a serious game to simulate real user interactions in a live ERP system, capturing both normal and fraudulent business processes.
• Modeling multiple occupational fraud scenarios in collaboration with auditing experts to ensure realism and diversity.
• Conducting multiple simulation runs over several fiscal years to generate longitudinal ERP data.
• Extracting raw transaction data from the ERP system and aggregating it into ready-to-use datasets.
• Creating joint datasets by joining financial accounting tables, excluding non-discriminative fraud cases to preserve data integrity.
• Performing expert-level feature annotation to highlight anomalous column entries that signal underlying fraud cases.

Experimental results

Research questions

• RQ1 Can a serious game be effectively used to generate realistic, publicly available ERP data that includes both normal operations and occupational fraud?
• RQ2 How can synthetic ERP data be structured to support reproducible benchmarking of fraud detection algorithms?
• RQ3 What level of granularity in fraud labeling is necessary to enable meaningful evaluation of detection performance?
• RQ4 To what extent do fraud cases in ERP data remain distinguishable from normal transactions when aggregated at the financial accounting level?
• RQ5 How can data generation strategies be extended to cover multiple business processes such as O2C and P2P in a unified, open dataset?

Key findings

• The authors successfully generated multi-year ERP system data with both normal and fraudulent transactions through a serious game-based simulation.
• The dataset includes 86 fraud cases across multiple fiscal years, with 50 frauds labeled in the final joint dataset.
• Fraud cases were found to be detectable primarily through a small number of anomalous entries in otherwise regular data, supporting the use of statistical anomaly detection methods.
• The inclusion of expert-annotated feature-level labels enables fine-grained analysis of fraud detection performance at the transaction level.
• The final datasets are publicly released, including both raw and aggregated data, to support open, reproducible research in ERP fraud detection.
• The approach enables benchmarking of fraud detection methods across different business processes, including O2C and P2P, with realistic fraud scenarios.