A company's internal control system is a crucial factor for operational effectiveness and efficiency. A properly designed internal control system adds reliability to a company's financial information by preventing, detecting, and correcting erroneous or fraudulent transactions on timely basis. A series of financial scandals in the late ‘90s and the early 2000s resulted in the passage of the Sarbanes-Oxley Act (hereinafter SOX) in 2002, mandating public companies to implement, evaluate, and report on the quality of their internal control systems. Although various internal control requirements are mandated by SOX, there is a lack of clear and detailed guidelines about what and how companies should implement internal control mechanisms into their systems. This study intends to shed some light on these issues by proposing and testing two anomaly detection models utilizing transactional data from a bank and an insurance company.

This study makes several contributions to research on anomaly detection. First, this study provides a detailed guideline for the development of an anomaly detection model that is implementable and understandable by internal auditors. Second, it proposes anomaly detection models at a transactional level with unlabeled (i.e. unclassified) data that is more realistic and useful in practice. Finally, it shows that the process of developing an anomaly detection model helps to identify weakly-controlled or risky areas.

The first chapter introduces general concepts about internal control systems and the research purpose of this study. The next chapter summarizes and discusses literature related to internal control systems and anomaly detection. The third chapter consists of two essays that investigate the implementation of anomaly detection models with transactional level data. In these studies, transactions from transitory accounts of a bank and from wire transfer payment systems of an insurance company are investigated to show feasible implementation processes of anomaly detection models. The fourth chapter concludes this study by discussing limitations and directions for future research.