Benford's Law:

How to Use it to Detect

Fraud in Financial Data
August 7, 2013
Special Guest Presenter:

Don Sparks
CIA, CISA, CRMA
Vice President
Audimation Services Inc
Partner with CaseWare IDEA

Copyright 2013 FraudResourceNet LLC

About Peter Goldmann, MSc., CFE

President and Founder of White Collar

Crime 101
Publisher of White-Collar Crime Fighter
Developer of FraudAware Anti-Fraud
Training Monthly Columnist, The Fraud
Examiner,
ACFE Newsletter
Member of Editorial Advisory Board,
ACFE
Author of Fraud in the Markets
Explains how fraud fueled the financial
crisis.

Copyright 2013 FraudResourceNet LLC

 About Jim Kaplan, MSc, CIA, CFE

President and Founder of AuditNet,

the global resource for auditors
Auditor, Web Site Guru,
Internet for Auditors Pioneer
Recipient of the IIAs 2007 Bradford
Cadmus Memorial Award.
Author of The Auditors Guide to
Internet Resources 2nd Edition

Copyright 2013 FraudResourceNet LLC

Don Sparks, CIA, CISA, ARM

Vice President Industry Relations -

Audimation Services, Inc.
24-years property/casualty insurance
internal auditing experience (12 as
the CAE)
ISACA International Education &
Dissemination Committee
Former senior staff member of the IIA
GAIN, Flash Surveys, Role of Audit
in SOX 2002 video conferences
Co-Author of GTAG 13 & GTAG 16
Creator/Programmer Auditchannel.tv

Copyright 2013 FraudResourceNet LLC

 Webinar Housekeeping
This webinar and its material are the property of FraudResourceNet
LLC. Unauthorized usage or recording of this webinar or any of its
material is strictly forbidden. We will be recording the webinar and you will
be provided access to that recording within five-seven business days.
Downloading or otherwise duplicating the webinar recording is expressly
prohibited.

You must answer the polling questions to qualify for CPE per NASBA.

Please complete the evaluation to help us continuously improve our

Webinars.

Submit questions via the chat box on your screen and we will answer them
either during or at the conclusion.

If GTW stops working you may need to close and restart. You can always
dial in and listen and follow along with the handout.

Copyright 2013 FraudResourceNet LLC

Disclaimers
The views expressed by the presenters do not necessarily represent
the views, positions, or opinions of FraudResourceNet LLC (FRN) or
the presenters respective organizations. These materials, and the oral
presentation accompanying them, are for educational purposes only
and do not constitute accounting or legal advice or create an
accountant-client relationship.
While FRN makes every effort to ensure information is accurate and
complete, FRN makes no representations, guarantees, or warranties as
to the accuracy or completeness of the information provided via this
presentation. FRN specifically disclaims all liability for any claims or
damages that may result from the information contained in this
presentation, including any websites maintained by third parties and
linked to the FRN website
Any mention of commercial products is for information only; it does not
imply recommendation or endorsement by FraudResourceNet LLC

Copyright 2013 FraudResourceNet LLC 5

 Todays Agenda

AuditingforFraud:Standards&Essentials
Assistinlearningthelogicandhelpexplainitto
othersassometimesitisattackedasHocusPocus.
Auserfriendlyintroduction
Helpdetecttheredflagsoffraud
Bestdatatouse
Stepbystepdemonstrationtofraudaudits
Commonsoftwareprogramstofacilitatinguse
Demonstrationon492,000PCardFile

Copyright 2013 FraudResourceNet LLC

The Auditors Role

IPPF Standard 1210.A3

Internal auditors must have
sufficient knowledge ofavailable
technology based audit techniques
to perform their assigned work

Copyright 2013 FraudResourceNet LLC

 IIA Guidance GTAG 13

Internal auditors require appropriate

skills and should use available
technological tools to help them
maintain a successful fraud
management program that covers
prevention, detection, and
investigation. As such, all audit
professionals not just IT audit
specialists are expected to be
increasingly proficient in areas such as
data analysis and the use of
technology to help them meet the
demands of the job.

Copyright 2013 FraudResourceNet LLC

Professional Guidance

Copyright 2013 FraudResourceNet LLC

 Using Statistics To Seek Out
Criminals

Feb.26,2013 Thediscoveryofbankseffortsto
manipulatetheLondonInterbankOfferedRate
(LIBOR)owesalottostatisticaltechniquesthat
providefirstindicationsofwrongdoing.
Ifregulators(andauditors)wanttouncovermore
misdeedsinthemarkets,theyll havetouse
statisticalscreeningtoolsmoreactivelythanthey
dotoday.
Extendingtheanalysisovera30yearperiod
revealedLiborsubmissionsfollowedBenfords
closelyforabout20years,butbegantodiverge
sharplyinthemid2000s.

Copyright 2013 FraudResourceNet LLC

Bernie Madoff Fraud

If you took the annual returns of all

possible investments, you would
find that the population matches
Benfords Law very closely.
However, the returns that Madoff
was reporting dont. They nearly all
have a 1 as a leading digit, as he
consistently reported returns
between 10%-20%. This would
have been a clear indication that
his returns were being made up.

Copyright 2013 FraudResourceNet LLC

 Do Patterns in Data Mean Anything

Statisticsstudentsareaskedto
performasimpletask.Createa
matrixofheadsandtailsby
recordingtheresultsof200
coinflips.Theprofessor
reviewstheresultsandeasily
identifiesthestudentsthatjust
madeuptheresultswithout
flippingacoin.Howdidhe
know?

Copyright 2013 FraudResourceNet LLC

InventorsandInnovators

SimonNewcomb 1881
FrankBenford 1938
RogerPinkham 1961
MarkNigrini 1992

Copyright 2013 FraudResourceNet LLC

 BenfordsLawDefined
Oftencalledthefirstdigitlaw,refersto
thefrequencydistributionofdigitsin
many(notall)reallifedatasources.On
theright,youcanseethenumber1
occursastheleadingdigit30.1%ofthe
time,whilelargernumbersoccurinthe
firstdigitlessfrequently.Forexample,
thenumber3879
3 firstdigit
8 seconddigit
7 thirddigit
9 fourthdigit

Copyright 2013 FraudResourceNet LLC

ExpectedFrequenciesBased
onBenfordsLaw
st nd rd th
Digit 1 Place 2 Place 3 Place 4 Place

0 0.11968 0.10178 0.10018

1 0.30103 0.11389 0.10138 0.10014
2 0.17609 0.19882 0.10097 0.1001
3 0.12494 0.10433 0.10057 0.10006
4 0.09691 0.10031 0.10018 0.10002
5 0.07918 0.09668 0.09979 0.09998
6 0.06695 0.09337 0.0994 0.09994
7 0.05799 0.0935 0.09902 0.0999
8 0.05115 0.08757 0.09864 0.09986
9 0.04576 0.085 0.09827 0.09982

Copyright 2013 FraudResourceNet LLC

 Polling Question 1

Benfords Law is sometimes also called:

A. First-Digit Law
B. First-two Digits Law
C. Third-Digit Law
D. Nigrinis Law

Copyright 2013 FraudResourceNet LLC

SimpleFacts
Thenumber1predominatesmost
progressions.
Probabilitiesarescaleinvariant workswith
numbersdenominatedasdollars,yen,euros,
pesos,rubels,etc.
Notalldatasetsaresuitableforanalysis.
Notgoodforsampling resultsinlarge
selectionsizes.
Goodlowcostentryintousingcontinuous
auditing/monitoring.

Copyright 2013 FraudResourceNet LLC

 CanYouUseitToWinthe
Lottery?
No.Theoutcomeofthelottery
istrulyrandom.Thismeans
everylotterynumberhasan
equalchanceofoccurring.The
leadingdigitfrequencies
should,inthelongrun,bein
exactproportiontothenumber
oflotterynumbersstartingwith
thatdigit.

Copyright 2013 FraudResourceNet LLC

WhereDoesBenfordsFitinto
YourAntiFraudProgram?

Copyright 2013 FraudResourceNet LLC

 TheRedFlagsofFraud
As technology matures, finding fraud will increase.
Best use today is to prioritize audit planning.
Early warning sign past data patterns have changed.
Fraud Deterrence Potential Fraudsters may not
understand the theory of Benfords but know audit is
regularly running data analysis.
Identify Duplicates, Whole Numbers, Recurring
Expenses, other data pattern Anomalies
Coupled with high dollar and stratified random sample
techniques (use with other analytical tools)

Copyright 2013 FraudResourceNet LLC

Polling Question 2

Benfords Law is a good tool for finding fraud when just a

few fraudulent transactions are entered into the system.

A. True
B. False

Copyright 2013 FraudResourceNet LLC

 DemoRealFraud
CFEfounda6year$860,000APfraud.Ioftengeta
questioncouldBenfordshavefoundthissooner?
CFEaskedthreequestions:
HowmanyemployeesworkinAP
Longesttenureemployee
Canyoupull6yearsofAPfromAS400
ImportedAPintoIDEA
RanSummarization
Bankreimagedsuspiciousduplicatechecksselected
bytheCFO

Copyright 2013 FraudResourceNet LLC

TypesofDataThatConform

Accounts Payable Estimations in General Test of approval

(number sold * price)
Accounts Receivable
(number bought*price)
Disbursements
Sales
T&E Expenses
Most sets of Accounting
Numbers with
Full year of transactions
Ledger violations say under
$2,500
Inventories at many Purchase orders
locations
Computer System data Loan data
file conversions
Processing inefficiencies Customer balances
due to high quantity
New Combinations of Stock prices
selling prices
Customer refunds Journal entries
Credit card transactions

Copyright 2013 FraudResourceNet LLC

 NonConformingDataTypes

Situation Examples
Data set comprised of assigned Checks, invoices, zip codes, telephone,
numbers insurance policy YYMM####
Numbers influenced by human thought Prices set at psychological thresholds
($1.99, ATM withdrawals
Accounts with a large number of firm- An account specifically set up to record
specific numbers $100 refunds
Accounts with a built in minimum or Assets must meet a threshold before
maximum recorded
Airline passenger counts per plane Data sets with 500 or fewer
transactions
Where no transaction is recorded Theft, kickback, skimming, contract
rigging

Copyright 2013 FraudResourceNet LLC

UsesinFraudInvestigations

FirstandSecondDigitAnalysis
FirstTwoDigitsAnalysis
FirstThreeDigitsAnalysis
LastTwoDigitsAnalysis
SummationTest
AdvancedSettings FuzzyLogicSetting
RoundedByAnalysis
DuplicationAnalysis

Copyright 2013 FraudResourceNet LLC

 Polling Question 3

Types of financial data that conform to use in Benfords

Law testing (choose the best answer(s)

A. Accounts Payable (number sold * price)

B. Accounts Receivable (number bought * price)
C. Disbursements
D. Sales
E. All of the above

Copyright 2013 FraudResourceNet LLC

FirstandSecondDigitAnalysis

Thedesignatedfirstorsecond
digitsinanumberserieswillbe
analyzed.Theexpectedoutput
servesasaroughcheckofthe
actualnumericaldistributionin
thepopulationandisusedto
determinelevelofcompliance
withtheBenfordsLaw.

Copyright 2013 FraudResourceNet LLC

 FirstTwoDigitsAnalysis

Thistestexaminesthefrequencyofthe
numericalcombinations10through99onthe
firsttwodigitsofaseriesofnumbers.
Inparticulartheoutputservesforthe
analysisofavoidedthresholdvalues.Thus,
thesetestshelptoclearlyvisualizewhen
orderorpermissionlimitshavebeen
systematicallyavoided.

Copyright 2013 FraudResourceNet LLC

FirstThreeDigitsAnalysis

Thistestexaminesthefrequencyofthe
numericalcombinations100through999in
thefirsttwodigitsofaseriesofnumbers.
Theoutputservesforanalysisafter
conspicuousroundingoffoperations.
Requiresalargeamountofdeviationswitha
populationgreaterthan10,000.

Copyright 2013 FraudResourceNet LLC

 LastTwoDigitsTest:

TheLastTwoDigitstestanalyzesthe
frequencyofthelasttwodigitsandisuseful
inauditingelectionresults,inventory
countsanysituationinwhichpaddingor
numberinventionissuspected.

Copyright 2013 FraudResourceNet LLC

RoundedByAnalysis

Thistestisusedtoanalyzetherelative
increasingfrequencyofroundednumbers.
Thedeterminationcomprisesthefrequencies
ofthenumbersthataredivisibleby10,25,
100and1,000(andanyuserdefinedvalues
ofwholenumbers)withoutremainders.

Copyright 2013 FraudResourceNet LLC

 DuplicatesAnalysis
Theanalysisofmultipleduplicatesincludesall
numbervaluesintheentiredatabasethatoccur
morethanonce.Thistesthelpstheuserto
recognizeallexistingduplicatesinthedatasupply
whereastheresulttablepresentstheduplicates
sortedaccordingtothedescendingfrequency.The
aimofthetestistoidentifycertainnumbersthat
occurmorethanonce(forexample,possible
duplicatepayments).
Differencefromtheothertests: Doesnotanalyze
anynumericalcombinations,butthepurevalueof
anumber.

Copyright 2013 FraudResourceNet LLC

SummationTest

TheSummationtestissimilartothetraditional
BenfordsLawtest,butinsteadofcalculating
thenumberofoccurrencesforeachfirsttwo
digits,itsumseachamount.
Advantage:Allowsyoutoidentifyclearly
significantamountsthatdonotfollowthe
expectedresultsofBenfordsLaw.

Copyright 2013 FraudResourceNet LLC

 SecondOrderTest

TheSecondOrdertestisbasedonthedigits
ofthedifferencesbetweenamountsthat
havebeensortedfromsmallesttolargest
(ordered).Thefirsttwodigitsofthe
differencesshouldfollowthedigit
frequenciesofBenfordsLaw.Thistestis
particularlyusefulinindicatingdataintegrity
issues.

Copyright 2013 FraudResourceNet LLC

AdvancedSettings

WithmostBenfordsLawtestsinIDEA
VersionNine,youhavetheoptionof
extractingsuspicious datawhosedigit
frequenciesdonotfollowthedigit
frequenciesofBenfordsLaw.WithAdvanced
Settings,youcanalsorefinethisoutputto
limitthesizeoftheoutputdatabase.

Copyright 2013 FraudResourceNet LLC

 CheckforBenfords
Conformity

Copyright 2013 FraudResourceNet LLC

Polling Question 4

Area(s) where Benfords Law is not a good tool (choose all

that apply):
A. All the numbers in a series are at or below $9.99 or frauds
involving situations where nothing is recorded.
B. All of the numbers are positive.
C. All of the numbers are negative.
D. Very large data sets over 1 billion records.

Copyright 2013 FraudResourceNet LLC

 Benfords Law Software

Integrated Tools Add-In

Component

CaseWare IDEA Excel

Arbutus Access
Active Data SAS
ACL
ESKORT Computer Audit (SESAM)
Tableau
TopCAATs

Copyright 2013 FraudResourceNet LLC

CreatingaContinuous
AuditingApplication

Source: July 2011 ISACA

Copyright 2013 FraudResourceNet LLC

 Demo P-Card File - Steps
in Presentation
StratifythePopulation
AnalyzethePopulationUsingBenford
OrganizePopulationintogroupsbythenumberof
leadingdigits.
AnalyzeGroupsUsingBenford
StoreBenfordAnalysisintoaTableandthenextract
highfrequencydigitcombinations(usethez
statisticandthevariancebetweenactualand
expectedoccurrence).
Maketheanalysisrepeatableandcontinuous.

Copyright 2013 FraudResourceNet LLC

BENFORD
Slide Number 40

Polling Question 5

Mark Nigrini:
A. Invented Benfords Law
B. Is a close relative of Benford
C. Is the only one to find fraud using Benfords Law
D. Believes auditors should use it to detect fraud

Copyright 2013 FraudResourceNet LLC

 Conclusion
DigitalanalysistoolslikeBenfordsLawenableauditors
andotherdataanalyststofocusonpossibleanomaliesin
largedatasets.Theydonotprovethaterrororfraud
exist,butidentifyitemsthatdeservefurtherstudyon
statisticalgrounds.Digitalanalysiscomplementsexisting
analyticaltoolsandtechniques,andshouldnotbeused
inisolationfromthem.
Notnecessarilyfraud manyFalsepositives
Certaintypesoffraudwillnotbedetected
Usefultool,settingfutureauditingplans
LowCostEntryintoDigitalcontinuousanalysis

Copyright 2013 FraudResourceNet LLC

Questions?

Any Questions?
Dont be Shy!

Copyright 2013 FraudResourceNet LLC

 Coming Up This Month

1. When Law Enforcement Comes

Knocking on August 14, 2013 1:00 PM
2. Best Practices in Detecting
Accounts Payable Fraud Using Data
Analysis on August 21, 2013 11:00 AM

Copyright 2013 FraudResourceNet LLC

Thank You!
Website: http://www.fraudresourcenet.com

Jim Kaplan
FraudResourceNet
800-385-1625
jkaplan@fraudresourcenet.com

Peter Goldmann
FraudResourceNet
800-440-2261
pgoldmann@fraudresourcenet.com
Don Sparks
dons@audimation.com
832-327-1877

Copyright 2013 FraudResourceNet LLC