Using benford's law for fraud detection and auditing

Using Benford’s Law for Fraud Detection & Auditing

Rohit Kundu, CAATs Expert

July 2014

• AuditNet® features:

• Over 2,000 Reusable Templates, Audit Programs, Questionnaires and Control Matrices

• Networking Groups & Online Forums through LinkedIn, Google and Yahoo

• Audit Guides, Manuals, and Books on Audit Basics

CaseWare Analytics (IDEA) users receive full access to AuditNet templates

• Founded in 1988 • An industry leader in providing technology solutions for

finance, accounting, governance, risk and audit professionals • Over 400,000 users of our technologies across 130 countries

and 16 languages • Customers include Fortune 500 and Global 500 companies • Microsoft Gold Certified Partner

CaseWare International

International Acceptance

• What is Benford’s Law? • Conforming/Non-Conforming Data Types • Practical Applications of Benford’s Law • Major Digit Tests • Demo • Q&A

Agenda

Timeline 1881- Simon Newcomb 1938 – Frank Benford 1961 - Roger Pinkham 1992 - Mark Nigrini

From Theory to Application

Simon Newcomb’s Theory: Frequency of Use of the Different Digits in Natural Numbers “A multi-digit number is more likely to begin with ‘1’ than any other number.”

Pg. 40. American Journal of Mathematics, The Johns Hopkins University Press

Timeline 1881- Simon Newcomb 1938 – Frank Benford 1961 - Roger Pinkham 1992 - Mark Nigrini

From Theory to Application

Frank Benford: • Analyzed 20,229 sets of numbers, including, areas of rivers, baseball

averages, atomic weights of atoms, electricity bills, etc. Conclusion Multi digit numbers beginning with 1, 2 or 3 appear more frequently than multi digit numbers beginning with 4, 5, 6, etc.

Timeline 1881- Simon Newcomb 1938 – Frank Benford 1961 - Roger Pinkham 1992 - Mark Nigrini

From Theory to Application

Data First Digit 1 First Digit 2 First Digit 3

Populations 33.9 20.4 14.2

Batting Averages 32.7 17.6 12.6

Atomic Weight 47.2 18.7 10.4

X-Ray Volts 27.917 15.7

Average 30.6% 18.5% 12.4%

Timeline 1881- Simon Newcomb 1938 – Frank Benford 1961 - Roger Pinkham 1992 - Mark Nigrini

From Theory to Application

Roger Pinkham: Research conducted revealed that Benford’s probabilities are scale invariant.

Dr. Mark Nigrini: Published a thesis noting that Benford’s Law could be used to detect fraud because human choices are not random; invented numbers are unlikely to follow Benford’s Law.

The number 1 occurs as the leading digit 30.1% of the time, while larger numbers occur in the first digit less frequently. For example, the number 3879

3 - first digit 8 - second digit 7 - third digit 9 – fourth digit

Benford’s Law

Benford’s Law Key Facts For naturally occurring numbers, the leading digit(s) is (are)

distributed in a specific, non-uniform way. While one might think that the number 1 would appear as

the first digit 11 percent of the time, it actually appears about 30 percent of the time.

Therefore the number 1 predominates most progressions. Scale invariant – works with numbers denominated as

dollars, yen, euros, pesos, rubles, etc. Not all data sets are suitable for analysis.

Benford’s Law Defined

Conforming Data Types • Data set should describe similar data (e.g. town populations) • Large Data Sets • Data that has a wide variety in the number of figures e.g.

plenty of values in the hundreds, thousands, tens of thousands, etc.

• No built-in maximum or minimum values

Some common characteristics of accounting data…

Conforming Data Types - Examples • Accounts payable transactions • Credit card transactions • Customer balances and refunds • Disbursements • Inventory prices • Journal entries • Loan data • Purchase orders • Stock prices, T&E expenses, etc.

Non-Conforming Data Types • Data where pre-arranged, artificial limits or nos. influenced

by human thought exist i.e. built-in maximum or minimum values – Zip codes, telephone nos., YYMM#### as insurance policy no. – Prices sets at thresholds ($1.99, ATM withdrawals, etc.) – Airline passenger counts per plane

• Aggregated data • Data sets with 500 or few transactions • No transaction recorded

– Theft, kickback, skimming, contract rigging, etc.

Usage of Benford’s Law • Within a comprehensive Anti-Fraud Program COSO Framework

Risk Assessment

Control Environment

Control Activities

Information and Communication

Specify organizational objectives

Monitoring

High- Level Usage of Benford’s Law • Risk-Based Audits

– Planning Phase Early warning sign that past data patterns have changed

or abnormal activity

Data Set X represents the first digit frequency of 10,000 vendor invoices.

High- Level Usage of Benford’s Law • Forensic Audits

– Check fraud, bypassing permission limits, improper payments

• Audit of Financial Statements

– Manipulation of checks, cash on hand, etc.

• Corporate Finance/Company Evaluation – Examine cash-flow-forecasts for profit centers

Major Digit Tests (using IDEA) • 1st Digit Test • 2nd Digit Test • First two digits • First three digits • Last two digits • Second Order Test

1st & 2nd Digit Tests 1st Digit Test • High Level Test • Will only identify the blinding glimpse of the obvious • Should not be used to select audit samples, as the sample

size will be too large 2nd Digit Test • Also a high level test • Used to identify conformity • Should not be used to select audit samples

First Two Digits Test • More focused and examines the frequency of the numerical

combinations 10 through 99 on the first two digits of a series of numbers

• Can be used to select audit targets for preliminary review Example: 10,000 invoices -- > 2600 invoices -- > (1.78% + 1.69%) x 10,000 -- > (178 + 169) = 347 invoices Only examine invoices beginning with the first two digits 31 and 33.

Source: Using Benford’s Law to Detect Fraud , ACFE

First Three Digits Test • Highly Focused • Used to select audit samples • Tends to identify number duplication

Last Two Digits Test • Used to identify invented (overused) and rounded numbers • It is expected that the right-side two digits be distributed

evenly. With 100 possible last two digits numbers (00, 01, 02...., 98, 99), each should occur approximately 1% of the time.

Source: Fraud and Fraud Detection: A Data Analytics Approach, John Wiley & Sons, Inc., Hoboken, New Jersey

Second Order Test • Based on the 1st two digits in the data. • A numeric field is sorted from the smallest to largest

(ordered) and the value differences between each pair of consecutive records should follow the digit frequencies of Benford’s Law.

Source: Fraud and Fraud Detection: A Data Analytics Approach, John Wiley & Sons, Inc., Hoboken, New Jersey

Continuous Monitoring Framework • Automated & Repeatable Analysis • Input New Analytics with Ease • Remediation Workflow & Resolution Guidelines • KPIs (Root Cause Analysis)

Continuous Monitoring Framework Turn-key Solutions • P2P • Purchasing Cards and T&E Monitoring

– Identify transaction policy violations – Spend, Expense & Vendor profiling – Identify card issuance processing errors – Evaluate trends for operational/process improvements

Conclusion Benford’s Law • One person invents all the numbers • Lots of different people have an incentive to manipulate

numbers in the same way • Useful first step to give us a better understanding of our data • Need to use Benford’s Law together with other drill down

tests • Technology enables this faster and easier to produce results

Rohit Kundu

[email protected]

Sunder Gee [email protected]

IDEA Inquiries

[email protected]

Q & A