Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​Benford's Law in a Big Data World

Applying the mathematical digital analysis tool to large data sets can help auditors detect fraud and other problems.

Comments Views

​The power of Benford's Law has never been as critical given the rise of big data and computing power. The digital analysis tool has been used in numerous high-profile forensic investigations, including investigations of voter fraud in the 2009 Iranian election and Greece's efforts to hide its debt in 2015.

A Benford's Law review of 5,400 contracts at a Canadian nonprofit organization found the numeral "4" as the first digit 16% of the time, compared to the expected 9.7%. That finding enabled the internal auditor to uncover questionable contracts in amounts between $40,000 and $49,999 that totaled $15 million. Those contracts were approved by an employee who directed them to vendors who were his associates.

In addition to detecting fraud, internal auditors can use Benford's Law to identify inefficient processes and computer bugs. It does this by determining the expected frequency for any digit in a set of discrete numbers such as journal entries, disbursements, and revenues. This means that a digit in a number in a given data set is mathematically predictable. Because the expected frequency for each digit is known, every item in excess of that frequency is deemed unusual.

With large amounts of data to analyze, Benford's Law can detect anomalies better than traditional audit techniques. For example, research shows that companies whose financial statements are significantly out of compliance with Benford's Law are likely to get caught for accounting irregularities. A before-and-after comparison of restated earnings showed that the new, real numbers aligned with Benford analysis.

Internal auditors can leverage audit software with Benford's Law functionality. Additionally, some audit departments can work with the organization's IT function to adopt a step-by-step Benford analysis using established formulas to analyze company data for unusual patterns.

Revealing Fraud

Benford's Basics

Benford's Law made its debut in the audit profession in the 1990s through the efforts of Mark Nigrini, an expert on the theory. First discovered in 1881 by mathematician Simon Newcomb, the theory lay dormant for almost half a century until the 1930s when it was again discovered by physicist Frank Benford.

Benford determined that leading digits are distributed in a specific, nonuniform way. This discovery led to the mathematical theory that in large sets of data, the initial digits of amounts will tend to follow a predictable pattern. The initial digit "1" is most common as the first digit in data sets, appearing 30% of the time, followed by "2" (17.6%), "3" (12.5%), "4" (9.6%), "5" (7.9%), "6" (6.6%), "7" (5.8%), and "8" (5.1%). The initial digit "9" appears the least often (less than 5%).

Benford's Law works because the distance from "1" to "2" is far greater than the distance from "9" to "10." For example, if a data set begins with the digit "1," it has to increase by 100% before it begins with the digit "2." To get from "2" to "3" requires a 50% increase; from "3" to "4," 33%; "4" to "5," 25%; "5" to "6," 20%; "6" to "7," 16%; "7" to "8," 14%; "8" to "9," 12%; and "9" to "10," 11%.

Because few fraudsters know about Benford's Law, the numbers they cook up stand out. As a result, the position of each digit in their transactions will not follow Benford's analysis, revealing their crime (see "Benford's Basics" at right).

For example, during a purchasing audit at a retail company, internal auditors discovered there were 550 purchase orders issued with the first two digits "96," compared with the expected count of 289 purchase orders. Benford's Law analysis showed 145 purchase orders of between $9,600 and $9,690 were approved by a director whose approval authority was limited to $10,000. Further investigation revealed that over a two-year period, the director made $3.5 million in purchases for personal items such as electronics, jewelry, and appliances.

Five Types of Analysis

Basic tests in Benford's Law cover first-digit analysis, second-digit analysis, first two-digit analysis, first three-digit analysis, and last two-digit analysis.

  • First-digit Analysis Auditors can chart the expected and actual occurrence for each digit from "1" to "9." They can drill down further on unusual differences for analysis and action.
  • Second-digit Analysis Like the first-digit analysis, the second-digit analysis is a test of reasonableness. At a health-care company, an analysis of the second digits in more than 21,000 payroll records revealed that the numeral "0" turned up as the second digit twice as often as it should have. The numeral "5" showed up 60% more often than expected. Based on those findings, the records were deemed fraudulent.
  • First Two-digit Analysis (F2D) There are 90 possible combinations (10 through 99) for the first two digits in a number. For example, the first two digits of 110,364 are "11." In an F2D test, Benford's Law would note there is a 3.8% likelihood that "11" would be the first two digits. This is a much more focused test as the purchase order example showed.
  • First Three-digit Analysis (F3D) In F3D tests, there are 900 possible combinations (100 through 999), allowing for an in-depth analysis of large data sets. It provides greater precision for picking up abnormal duplications in sets with 10,000 or more transactions.
  • Last Two-digit Analysis There are 100 possible combinations (00 through 99) in the last two digits of a number. The expected proportion for each of these combinations is 1%. Any excess is rounded off or are invented numbers.

When to Use It

Benford's analysis is best used on data sets with 1,000 or more records that include numbers with at least four digits. As the data set increases in size, closer conformity to the expected frequencies increases.

However, not all financial data lend themselves to such tests. Benford's analysis cannot be used in scenarios such as:

  • A data set made up of assigned numbers such as Social Security, contract, invoice, phone, customer, and check numbers.
  • Psychological thresholds such as $199.99.
  • Minimum and maximum numbers such as a petty-cash fund disbursing between a $10 minimum and a $40 maximum.
  • Where no transaction is recorded such as thefts, kickbacks, and contract rigging.
  • Limiting a sample of transactions to only between a narrow range, such as between $100 and $999.

Extract Needles From Digital Haystacks

Benford's Law can be a powerful way to combat the costly scourge of fraud. It is like placing a magnet over a haystack and extracting the needles, enabling internal auditors to analyze an entire population of data. All it takes is an interest and a willingness to learn new approaches.  

Lal Balkaran
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



Lal BalkaranLal Balkaran<p>Lal Balkaran, CIA, FCPA, FCGA, FCMA, is an internal auditor and independent consultant with more than 30 years' experience based in Scarborough, Ontario.</p>


Comment on this article

comments powered by Disqus
  • AuditBoard_Pandemic_May 2020_Premium 1_
  • Galvanize_May 2020_Premium 2
  • IIA CERT-Online Proctering_May 2020_Premium 3