Using Benford’s Law for Fraud Detection & Auditing
Rohit Kundu, CAATs Expert
July 2014
• AuditNet® features:
• Over 2,000 Reusable Templates, Audit Programs, Questionnaires and Control Matrices
• Networking Groups & Online Forums through LinkedIn, Google and Yahoo
• Audit Guides, Manuals, and Books on Audit Basics
CaseWare Analytics (IDEA) users receive full access to AuditNet templates
• Founded in 1988 • An industry leader in providing technology solutions for
finance, accounting, governance, risk and audit professionals • Over 400,000 users of our technologies across 130 countries
and 16 languages • Customers include Fortune 500 and Global 500 companies • Microsoft Gold Certified Partner
CaseWare International
International Acceptance
• What is Benford’s Law? • Conforming/Non-Conforming Data Types • Practical Applications of Benford’s Law • Major Digit Tests • Demo • Q&A
Agenda
Timeline 1881- Simon Newcomb 1938 – Frank Benford 1961 - Roger Pinkham 1992 - Mark Nigrini
From Theory to Application
Simon Newcomb’s Theory: Frequency of Use of the Different Digits in Natural Numbers “A multi-digit number is more likely to begin with ‘1’ than any other number.”
Pg. 40. American Journal of Mathematics, The Johns Hopkins University Press
Timeline 1881- Simon Newcomb 1938 – Frank Benford 1961 - Roger Pinkham 1992 - Mark Nigrini
From Theory to Application
Frank Benford: • Analyzed 20,229 sets of numbers, including, areas of rivers, baseball
averages, atomic weights of atoms, electricity bills, etc. Conclusion Multi digit numbers beginning with 1, 2 or 3 appear more frequently than multi digit numbers beginning with 4, 5, 6, etc.
Timeline 1881- Simon Newcomb 1938 – Frank Benford 1961 - Roger Pinkham 1992 - Mark Nigrini
From Theory to Application
Data First Digit 1 First Digit 2 First Digit 3
Populations 33.9 20.4 14.2
Batting Averages 32.7 17.6 12.6
Atomic Weight 47.2 18.7 10.4
X-Ray Volts 27.917 15.7
Average 30.6% 18.5% 12.4%
Timeline 1881- Simon Newcomb 1938 – Frank Benford 1961 - Roger Pinkham 1992 - Mark Nigrini
From Theory to Application
Roger Pinkham: Research conducted revealed that Benford’s probabilities are scale invariant.
Dr. Mark Nigrini: Published a thesis noting that Benford’s Law could be used to detect fraud because human choices are not random; invented numbers are unlikely to follow Benford’s Law.
The number 1 occurs as the leading digit 30.1% of the time, while larger numbers occur in the first digit less frequently. For example, the number 3879
3 - first digit 8 - second digit 7 - third digit 9 – fourth digit
Benford’s Law
Benford’s Law Key Facts For naturally occurring numbers, the leading digit(s) is (are)
distributed in a specific, non-uniform way. While one might think that the number 1 would appear as
the first digit 11 percent of the time, it actually appears about 30 percent of the time.
Therefore the number 1 predominates most progressions. Scale invariant – works with numbers denominated as
dollars, yen, euros, pesos, rubles, etc. Not all data sets are suitable for analysis.
Benford’s Law Defined
Conforming Data Types • Data set should describe similar data (e.g. town populations) • Large Data Sets • Data that has a wide variety in the number of figures e.g.
plenty of values in the hundreds, thousands, tens of thousands, etc.
• No built-in maximum or minimum values
Some common characteristics of accounting data…
Conforming Data Types - Examples • Accounts payable transactions • Credit card transactions • Customer balances and refunds • Disbursements • Inventory prices • Journal entries • Loan data • Purchase orders • Stock prices, T&E expenses, etc.
Non-Conforming Data Types • Data where pre-arranged, artificial limits or nos. influenced
by human thought exist i.e. built-in maximum or minimum values – Zip codes, telephone nos., YYMM#### as insurance policy no. – Prices sets at thresholds ($1.99, ATM withdrawals, etc.) – Airline passenger counts per plane
• Aggregated data • Data sets with 500 or few transactions • No transaction recorded
– Theft, kickback, skimming, contract rigging, etc.
Usage of Benford’s Law • Within a comprehensive Anti-Fraud Program COSO Framework
Risk Assessment
Control Environment
Control Activities
Information and Communication
Specify organizational objectives
Monitoring
High- Level Usage of Benford’s Law • Risk-Based Audits
– Planning Phase Early warning sign that past data patterns have changed
or abnormal activity
Data Set X represents the first digit frequency of 10,000 vendor invoices.
High- Level Usage of Benford’s Law • Forensic Audits
– Check fraud, bypassing permission limits, improper payments
• Audit of Financial Statements
– Manipulation of checks, cash on hand, etc.
• Corporate Finance/Company Evaluation – Examine cash-flow-forecasts for profit centers
Major Digit Tests (using IDEA) • 1st Digit Test • 2nd Digit Test • First two digits • First three digits • Last two digits • Second Order Test
1st & 2nd Digit Tests 1st Digit Test • High Level Test • Will only identify the blinding glimpse of the obvious • Should not be used to select audit samples, as the sample
size will be too large 2nd Digit Test • Also a high level test • Used to identify conformity • Should not be used to select audit samples
First Two Digits Test • More focused and examines the frequency of the numerical
combinations 10 through 99 on the first two digits of a series of numbers
• Can be used to select audit targets for preliminary review Example: 10,000 invoices -- > 2600 invoices -- > (1.78% + 1.69%) x 10,000 -- > (178 + 169) = 347 invoices Only examine invoices beginning with the first two digits 31 and 33.
Source: Using Benford’s Law to Detect Fraud , ACFE
First Three Digits Test • Highly Focused • Used to select audit samples • Tends to identify number duplication
Last Two Digits Test • Used to identify invented (overused) and rounded numbers • It is expected that the right-side two digits be distributed
evenly. With 100 possible last two digits numbers (00, 01, 02...., 98, 99), each should occur approximately 1% of the time.
Source: Fraud and Fraud Detection: A Data Analytics Approach, John Wiley & Sons, Inc., Hoboken, New Jersey
Second Order Test • Based on the 1st two digits in the data. • A numeric field is sorted from the smallest to largest
(ordered) and the value differences between each pair of consecutive records should follow the digit frequencies of Benford’s Law.
Source: Fraud and Fraud Detection: A Data Analytics Approach, John Wiley & Sons, Inc., Hoboken, New Jersey
Continuous Monitoring Framework • Automated & Repeatable Analysis • Input New Analytics with Ease • Remediation Workflow & Resolution Guidelines • KPIs (Root Cause Analysis)
Continuous Monitoring Framework Turn-key Solutions • P2P • Purchasing Cards and T&E Monitoring
– Identify transaction policy violations – Spend, Expense & Vendor profiling – Identify card issuance processing errors – Evaluate trends for operational/process improvements
Conclusion Benford’s Law • One person invents all the numbers • Lots of different people have an incentive to manipulate
numbers in the same way • Useful first step to give us a better understanding of our data • Need to use Benford’s Law together with other drill down
tests • Technology enables this faster and easier to produce results
