Liquidity, Operational and Fraud Risk Analytics

Introduction

Financial risk analytics is not limited to measuring losses after they occur. It also helps an organisation anticipate cash shortages, identify weaknesses in processes and systems, detect unusual transactions, and allocate control resources. Liquidity risk, operational risk and fraud risk are closely connected. A failed payment process can create a liquidity shock; a cyberattack can interrupt funding access; and fraudulent payments can reduce cash while damaging reputation and regulatory standing.

This chapter develops a practical analytics framework for three questions:

1. Can the organisation meet its obligations when they fall due?
2. Where could people, processes, systems or external providers fail?
3. Which transactions, behaviours or events may indicate fraud?

The emphasis is on diploma-level professional application: defining risk, selecting useful indicators, analysing data, interpreting results and designing proportionate controls.

Learning Objectives

By the end of this chapter, the learner should be able to:

• analyse cash-flow gaps, liquidity ratios and funding concentration;
• distinguish liquidity risk from solvency and profitability risk;
• classify operational risks involving processes, people, systems, cyber threats and third parties;
• use loss-event data, scenarios, key risk indicators and control assessments;
• apply basic anomaly-detection methods to identify potentially fraudulent activity;
• evaluate controls, governance, ethics and limitations of risk analytics;
• communicate risk findings to managers and recommend practical responses.

1. Liquidity Risk and Cash-Flow Analysis

1.1 Meaning and importance

Liquidity is the ability to obtain cash or cash-equivalent resources quickly enough to meet obligations as they become due, without unacceptable loss. Liquidity risk is the risk that an organisation cannot meet those obligations, or can meet them only by selling assets at a substantial discount or obtaining very expensive funding.

Liquidity differs from:

• Profitability risk: the possibility that revenue will not cover expenses.
• Solvency risk: the possibility that total liabilities exceed the value of assets or that an entity cannot survive over the longer term.
• Market risk: the possibility that prices, interest rates or exchange rates will move adversely.

A profitable firm may still fail if customers pay late while wages, suppliers and lenders require immediate payment. Consequently, liquidity analysis must use timing, not merely accounting profit.

1.2 Cash-flow gap analysis

A cash-flow forecast estimates expected cash inflows and outflows by time bucket. The net cash flow for period t is:

where NCFₜ is net cash flow in period t, Iₜ is cash inflow and Oₜ is cash outflow. The projected closing cash balance is:

where Cₜ is closing cash and Cₜ₋₁ is opening cash. These identities assume that inflows and outflows are measured on the same cash basis and time interval.

A liquidity gap can be expressed as:

where Aₜ is available cash and reliably accessible liquidity during period t, and Lₜ is required cash outflow during that period. A negative Gₜ indicates a shortfall before planned mitigating actions.

The term “available liquidity” must be defined carefully. It may include cash, highly liquid securities and committed undrawn facilities, but should exclude resources that are legally restricted, operationally inaccessible or likely to disappear during stress.

#### Worked example: weekly cash forecast

An organisation begins with cash of $120,000. During the next three weeks, expected inflows are $80,000, $55,000 and $90,000, while outflows are $100,000, $130,000 and $70,000.

The lowest projected balance is $25,000 at the end of week 2. If the organisation requires a minimum operating buffer of $40,000, the week-2 liquidity gap is $15,000. Management could accelerate collections, delay discretionary expenditure, draw a facility or sell liquid assets. Each action should be assessed for cost, reliability and possible reputational consequences.

Forecasts should normally be prepared using at least three views:

• Base case: most likely timing and amounts.
• Adverse case: delayed receipts, higher withdrawals or reduced sales.
• Severe but plausible stress case: simultaneous deterioration in several drivers.

Forecast confidence should be reflected in assumptions. A receivable that is historically collected in 30 days but is currently disputed should not be treated as certain cash.

1.3 Liquidity ratios

Ratios provide comparable indicators, but they do not replace cash-flow timing analysis.

The current ratio is:

It measures broad short-term coverage. Its weakness is that inventories and receivables may not be quickly convertible into cash.

The quick ratio is:

It excludes inventory and other less liquid current assets. The exact definition should follow the organisation’s accounting policy.

The cash ratio is:

It is conservative because it includes only the most immediately available resources.

For a lending or financial-services context, a liquidity coverage concept compares a stock of high-quality liquid assets with stressed net cash outflows:

The ratio is meaningful only when the definitions, stress horizon and eligibility rules are specified. It should not be confused with a universal ratio applicable to every industry.

#### Worked example: ratio interpretation

Suppose current assets are $600,000, including inventory of $180,000; cash and equivalents are $150,000; trade receivables are $210,000; and current liabilities are $400,000.

• Current ratio = $600,000 ÷ $400,000 = 1.50.
• Quick ratio = ($150,000 + $210,000) ÷ $400,000 = 0.90.
• Cash ratio = $150,000 ÷ $400,000 = 0.375.

The current ratio appears comfortable, but the quick ratio is below 1. This indicates dependence on inventory conversion or additional financing. A ratio alone cannot establish failure risk; the maturity dates, quality of receivables and access to facilities must also be examined.

1.4 Funding concentration

Funding concentration exists when a large proportion of funding depends on one lender, instrument, market, customer group or maturity date. Concentration creates refinancing risk: if a major source is withdrawn, the organisation may not replace it quickly.

A simple concentration measure is:

If an organisation has total funding of $10 million and $6 million is provided by one lender, concentration is 60%. A more general concentration measure is the Herfindahl–Hirschman Index:

where sᵢ is source i’s share of total funding expressed as a decimal and n is the number of sources. The index rises as funding becomes concentrated. For example, four equal lenders produce an HHI of 0.25, while one lender providing 100% produces 1.00. HHI is a comparative indicator, not a universal regulatory threshold.

Liquidity dashboards should also show maturity concentration, secured versus unsecured funding, currency exposure, covenant headroom and the proportion of facilities that are committed rather than merely anticipated.

2. Operational Risk Analytics

2.1 Definition and taxonomy

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal and compliance consequences in many organisational frameworks, although strategic and reputational risk may be treated separately.

A practical taxonomy is:

The taxonomy supports consistent data collection. An event may have multiple causes: for example, a fraudulent payment may involve social engineering, weak segregation of duties and inadequate transaction monitoring.

2.2 Risk and control assessment

A risk and control self-assessment normally identifies a process, its objectives, inherent risks, controls, residual risks and owners. Inherent risk is exposure before controls; residual risk is exposure after considering control effectiveness.

A simple prioritisation score is:

This ordinal calculation is useful for ranking, provided the scales are defined consistently. It should not be interpreted as a precise probability of loss unless likelihood and impact are quantitatively estimated.

A more analytical expected-loss estimate is:

If a control failure has an estimated annual probability of 0.08 and impact of $250,000, expected annual loss is $20,000, assuming the probability and impact estimates are appropriate and the event definition is clear. Extreme events may require scenario analysis because historical frequencies are too limited.

2.3 Loss-event data

A loss database should record at least:

• event date and discovery date;
• business unit and process;
• event type and root cause;
• gross loss, recoveries and net loss;
• direct financial loss and indirect costs;
• control failures and corrective actions;
• whether the event was internal, external, accidental or deliberate.

Important analytical measures include event frequency, average loss, total loss, maximum loss, near misses and time to closure. Analysts must avoid survivorship bias: recording only events that produced financial loss will hide near misses and successfully blocked attacks.

Data quality issues are common. Different units may classify similar events differently; old events may be underreported; and losses may be discovered long after occurrence. A data dictionary, reporting thresholds and independent validation improve comparability.

2.4 Key risk indicators and key performance indicators

A key risk indicator (KRI) is a measurable signal associated with increasing exposure. Examples include failed reconciliations, overdue access reviews, payment exceptions, system downtime, staff turnover in control-sensitive roles and vendor service-level breaches. A key performance indicator (KPI) measures operational achievement, such as processing speed or sales volume. A KPI can become a risk driver when pressure to meet it encourages unsafe behaviour.

Effective KRIs have:

• a clear owner and business definition;
• a reliable data source;
• an appropriate frequency;
• thresholds based on evidence or risk appetite;
• escalation rules and documented management action.

A traffic-light threshold is useful for communication but can oversimplify a continuous risk trend. Analysts should examine direction, volatility, seasonality and relationships between indicators rather than focusing only on whether a single threshold was crossed.

2.5 Scenario analysis and stress testing

Scenario analysis considers plausible events that may be absent or rare in historical data. A scenario should specify the event, affected processes, duration, dependencies, financial consequences, liquidity effects and recovery assumptions.

For example, a two-day payment-system outage may produce lost sales, manual processing costs, customer compensation and delayed collections. A cyber scenario may also create legal, forensic and notification costs. Scenarios should include second-order effects: a supplier failure may interrupt production, reduce sales and weaken cash inflows at the same time.

Stress testing is not a prediction. It is a disciplined examination of vulnerability. Results should identify trigger points, minimum resources, alternative processes and decisions required during the event.

3. Fraud Risk Analytics

3.1 Nature of fraud risk

Fraud is intentional deception or abuse of position for unlawful or improper gain. The fraud triangle identifies three commonly associated conditions:

• Pressure or incentive: financial difficulty, targets or personal debt.
• Opportunity: weak access controls, poor supervision or excessive authority.
• Rationalisation: the belief that the behaviour is justified or temporary.

Analytics cannot directly observe rationalisation, but it can identify opportunities and unusual outcomes. Fraud controls should therefore combine data analysis with governance, culture, whistleblowing channels, investigation and disciplinary processes.

3.2 Data preparation and analytical signals

Fraud analytics begins with a reliable transaction population. Relevant fields may include transaction ID, date and time, amount, employee, customer, supplier, payment method, location, approval path and changes to master data.

Useful tests include:

• duplicate invoice numbers or identical amounts;
• payments just below approval limits;
• unusual weekend or overnight transactions;
• rapid changes to supplier bank accounts followed by payment;
• one bank account linked to multiple unrelated suppliers;
• dormant accounts becoming active;
• transactions outside normal geographic or behavioural patterns;
• excessive reversals, refunds or manual journal entries.

These are indicators, not proof. A large transaction may be legitimate, and a sophisticated fraud may resemble ordinary activity. Every alert requires contextual review.

3.3 Anomaly detection methods

A basic standardised score is:

where xᵢ is an observation, μ is the mean, and σ is the standard deviation of a relevant peer group. A high absolute zᵢ indicates unusual distance from the group average. The method assumes that the mean and standard deviation are meaningful and that extreme values are not so influential that they distort the baseline.

For skewed transaction amounts, the median and median absolute deviation (MAD) are often more robust. A robust score can be expressed as:

where MAD = median(|x_i − median(x)|). The score should be interpreted using a chosen threshold and a clearly defined peer group; it is not automatically a probability of fraud.

Other approaches include:

• Rule-based testing: transparent and easy to explain, but vulnerable to evasion.
• Clustering: groups similar observations and highlights isolated cases.
• Classification models: estimate the likelihood of a known class when labelled cases exist.
• Network analysis: examines relationships among employees, suppliers, accounts and devices.
• Sequence analysis: detects unusual order or timing of events.

Supervised machine learning requires labelled, representative data. Fraud labels are usually incomplete and highly imbalanced, so accuracy alone is misleading. Precision, recall, false-positive cost and investigation capacity should be monitored.

Precision is:

Recall is:

A system with high recall finds more suspicious cases but may generate too many false alerts. The appropriate balance depends on loss severity, legal requirements and investigation resources.

4. Control Design and Governance

Analytics strengthens, but does not replace, internal control. Important controls include segregation of duties, maker-checker approval, least-privilege access, reconciliations, independent review, exception management, supplier verification, secure authentication and tested business continuity arrangements.

A sound control lifecycle is:

1. identify the objective and risk;
2. design a preventive or detective control;
3. assign ownership and evidence requirements;
4. monitor operation and exceptions;
5. test effectiveness independently;
6. remediate weaknesses and verify closure.

Governance should define risk appetite, escalation thresholds, model ownership, data access, retention and accountability. Audit trails must record who changed data, approved transactions, altered rules or overrode alerts.

Ethical and regulatory issues are especially important in fraud analytics. Personal data should be collected for legitimate purposes, accessed only by authorised personnel and retained no longer than necessary. Automated alerts should not become automatic accusations. Investigations should be fair, confidential and based on corroborating evidence. Models should be tested for discriminatory effects, unstable performance and explainability. Human review is essential for consequential decisions such as account suspension or employee discipline.

5. Integrated Application: Illustrative Case

Background

Harbour Office Supplies, a fictional medium-sized distributor, has grown rapidly. It relies on three major suppliers, offers customers 60-day credit and uses an online payment platform. Management notices that cash balances fluctuate sharply despite reported profits.

Problem

The finance team discovers delayed customer collections, a high concentration of supplier payments and a rise in manual payment overrides. At the same time, the information-security team reports repeated phishing attempts.

Analysis

A four-week base forecast shows a minimum cash balance of $90,000. An adverse case delays 20% of customer receipts by two weeks and increases supplier outflows by 10%; the minimum balance becomes negative $65,000. The organisation therefore has a projected liquidity gap of $65,000 under the adverse assumptions.

Current assets are $1.2 million, including $400,000 inventory and $300,000 cash and receivables combined; current liabilities are $900,000. The current ratio is 1.33, while the quick ratio is only 0.89 if quick assets are $800,000. The ratios reinforce the forecast finding that inventory conversion and customer timing are important.

Funding analysis shows that one bank provides 70% of total committed funding. Although the facility is currently available, the concentration creates refinancing vulnerability.

Operational data shows that payment exceptions increased from 1.5% to 4.8%, two supplier bank accounts were changed shortly before large payments, and access reviews are three months overdue. A rule-based test identifies six payments just below the second-level approval threshold. A network review finds that two supposedly independent suppliers share a bank account and contact telephone number.

Approach and solution

Management takes the following actions:

• creates daily cash monitoring during the stress period;
• accelerates collection of overdue receivables and negotiates supplier timing;
• seeks a second committed funding source;
• freezes supplier bank-detail changes pending independent verification;
• requires dual approval for manual overrides;
• completes privileged-access reviews;
• investigates the linked suppliers and threshold-splitting payments;
• conducts staff phishing training and simulated testing;
• adds KRIs for exception rates, bank-detail changes, funding concentration and overdue access reviews.

Outcome

The investigation finds that one employee colluded with an external supplier to redirect payments. The anomaly rules did not prove fraud, but they prioritised the case for investigation. The organisation recovers part of the loss, reduces payment exceptions and establishes a more resilient liquidity buffer.

Learning points

Liquidity and fraud analytics should not operate in separate organisational silos. Fraud can create immediate cash outflows, while weak liquidity may increase pressure and misconduct incentives. Combining forecasts, control indicators, transaction analytics and human investigation provides a stronger defence than any single model.

6. Limitations and Best Practices

Risk analytics has important limitations. Historical data may not represent future conditions; rare events are difficult to estimate; thresholds can create false confidence; and model outputs may reflect biased or incomplete data. Fraudsters adapt when controls become predictable. An apparently low incident rate may indicate underreporting rather than low risk.

Best practice is to:

• reconcile analytical data to authoritative financial records;
• document definitions, assumptions and data lineage;
• use peer groups appropriate to product, customer and process;
• combine quantitative indicators with expert judgement;
• test scenarios beyond historical experience;
• monitor false positives, false negatives and alert backlogs;
• validate models periodically and after major business changes;
• maintain independent challenge by risk, compliance or internal audit;
• link every material alert to an owner, action and closure date.

Contemporary developments include real-time payment monitoring, graph-based fraud detection, cloud operational resilience, continuous control monitoring and generative-AI-assisted investigation. These technologies can improve speed and pattern recognition, but they also introduce data-security, explainability, hallucination and third-party dependency risks. AI-generated recommendations should be treated as decision support, not unquestioned evidence.

Chapter Summary

Liquidity analytics examines whether cash and reliable funding are available when obligations fall due. Cash-flow gap analysis is more time-sensitive than profitability measures, while current, quick and cash ratios provide complementary but incomplete views. Funding concentration and maturity concentration expose an organisation to refinancing risk.

Operational risk analytics classifies exposure arising from processes, people, systems, cyber threats, third parties and external events. Loss data, near misses, KRIs, control assessments and scenario analysis help managers prioritise weaknesses. Fraud analytics uses transaction tests, anomaly scores, network relationships and supervised or unsupervised models to identify cases requiring investigation.

Analytics must be supported by sound controls, governance, privacy protection, model validation and human judgement. The strongest approach integrates liquidity forecasting, operational indicators and fraud monitoring so that financial, process and behavioural signals are considered together.

Key Terms

Liquidity risk: Risk of being unable to meet obligations when due.

Cash-flow gap: Difference between available liquidity and required cash outflows over a specified period.

Current ratio: Current assets divided by current liabilities.

Quick ratio: Liquid current assets divided by current liabilities.

Cash ratio: Cash and cash equivalents divided by current liabilities.

Funding concentration: Dependence on a limited number of funding sources.

HHI: A concentration index calculated by summing squared funding shares.

Operational risk: Risk of loss from failed processes, people, systems or external events.

Loss event: An occurrence that produces, or could produce, operational loss.

Near miss: An event that could have caused loss but did not.

KRI: Key risk indicator used to monitor changing exposure.

Scenario analysis: Evaluation of consequences under a defined plausible event.

Fraud triangle: Pressure, opportunity and rationalisation conditions associated with fraud.

Anomaly detection: Identification of observations that differ from expected patterns.

Precision: Proportion of flagged cases that are true positives.

Recall: Proportion of true cases that are successfully detected.

Segregation of duties: Division of responsibilities to reduce error or abuse.

Residual risk: Risk remaining after controls are applied.

Review Questions

Short Answer Questions

1. Why can a profitable organisation still experience liquidity failure?
2. Distinguish the current ratio from the quick ratio.
3. Identify five categories of operational risk.
4. What is a key risk indicator, and how does it differ from a KPI?
5. Why should an anomaly alert not be treated as proof of fraud?

Long Answer Questions

1. Explain how an organisation should construct and interpret a base, adverse and severe cash-flow forecast.
2. Discuss the strengths and limitations of liquidity ratios in risk analysis.
3. Describe how loss-event data and scenario analysis can be combined to assess operational risk.
4. Compare rule-based, statistical and machine-learning approaches to fraud detection.
5. Explain the governance and ethical requirements for using personal and transaction data in fraud analytics.

Analytical / Application Questions

1. A firm has cash of $90,000, receivables of $210,000, inventory of $300,000 and current liabilities of $400,000. Calculate its current ratio, quick ratio and cash ratio, then interpret the results.
2. A company has four funding sources with shares of 50%, 25%, 15% and 10%. Calculate the HHI and explain what it indicates about funding concentration.
3. Design a fraud-monitoring dashboard for an online distributor. Specify at least six indicators, their data sources, possible thresholds and the management action required when an indicator deteriorates.

Multiple Choice Questions with Answers

Question 1

Which measure focuses most directly on the timing of expected cash receipts and payments?

A. Cash-flow forecast

B. Gross profit margin

C. Inventory turnover

D. Return on equity

Correct Answer: A. Cash-flow forecast

Question 2

An organisation has current assets of $600,000 and current liabilities of $400,000. What is its current ratio?

A. 0.67

B. 1.20

C. 1.50

D. 2.00

Correct Answer: C. 1.50

Question 3

Which item is normally excluded from the quick ratio calculation?

A. Cash

B. Trade receivables

C. Short-term investments

D. Inventory

Correct Answer: D. Inventory

Question 4

If one lender supplies 70% of an organisation’s funding, the primary risk is:

A. Funding concentration

B. Inventory obsolescence

C. Foreign-exchange translation

D. Depreciation risk

Correct Answer: A. Funding concentration

Question 5

Which is an example of a key risk indicator?

A. Number of overdue access reviews

B. Annual advertising revenue

C. Total office floor area

D. Employee birthday count

Correct Answer: A. Number of overdue access reviews

Question 6

In the fraud triangle, opportunity may be increased by:

A. Strong independent approval controls

B. Weak segregation of duties

C. Regular reconciliations

D. Mandatory leave policies

Correct Answer: B. Weak segregation of duties

Question 7

A transaction has xᵢ = 150, peer-group mean μ = 100 and standard deviation σ = 25. What is its z-score?

A. 1

B. 2

C. 3

D. 4

Correct Answer: B. 2

Question 8

Precision measures:

A. The proportion of true cases that were detected

B. The proportion of alerts that are true positives

C. The total number of transactions reviewed

D. The average size of a suspicious transaction

Correct Answer: B. The proportion of alerts that are true positives

Question 9

Which control most directly reduces the risk that one person creates and approves a fraudulent payment?

A. Segregation of duties

B. Increasing advertising expenditure

C. Reducing inventory counts

D. Extending customer credit terms

Correct Answer: A. Segregation of duties

Question 10

Why is scenario analysis valuable for operational risk?

A. It guarantees the exact future loss amount

B. It removes the need for controls

C. It examines plausible events that may be absent from historical data

D. It converts all risks into accounting profit

Correct Answer: C. It examines plausible events that may be absent from historical data