Benford’s Law Application
I recently obtained and reviewed accounting data from a client to perform a Benford’s analysis. I obtained billing history data and general ledger data covering multiple periods and accounts. Benford’s is a very quick and easy technique to assist an auditor in determining where there may be areas of greater risk. While not the end all be all by any means, it can quickly provide additional insight into areas that may warrant additional investigation. Used with other tools, it can corroborate other findings or, perhaps, provide a risk indicator not provided by other means.
Once a Benford’s analysis is complete, the results could be used as the nexus to request client internal audit reports. We’re not fishing, we’re confirming analytical findings.
What follows is client data from their billing system. The universe consisted of 439,741 records covering 167 separate accounts. When Benford’s is applied to this total universe we get the following results.
In the previous example, it appears that Benford’s did not work as promised. Not so.
As previously noted, we have 167 different accounts in this universe. The calculation was made across all these non-homogenous accounts. Homogeneity is necessary for Benford’s to work. Many of these accounts may have attributes that prevents Benford’s from working properly. For example, there might be accounts containing recurring purchases of the same amount and or restricted by a minimum or maximum amount, like an hourly wage rate. This would defeat the Benford’s requirement that the amounts be “naturally occurring”. In the same vein, serial numbers, invoice numbers or any other instance where numbers are assigned in a document will not respond as anticipated in accordance with Benford’s Law. Further, Benford’s doesn’t work well in very small samples. You should have at least 500 transactions in the data set you’re testing.
You may recall that there were a total of 439,741 records. If so, you may have noticed that I only have data for 414,355. The missing 25,386 records were those that had a value of zero or less than one. These records were removed from the sample.
Client Account – Post Differential No Fringe – POOR Benford’s Match
The preceding calculations were made from more than enough records to provide Benford’s with an opportunity to work, but, as you can see, there are substantial differences between the Calculated Benford’s and what was anticipated in Standard Benford’s. As this is Post Differential, the sample does not conform to Benford’s “naturally occurring” requirement. Post is based upon a standard percentage of salary which does not permit the numbers to be random. For an account like this, Benford’s is of little value.
Client Account – Expensed Equipment – GOOD Benford’s Match
Conversely, the preceding Expensed Equipment account’s results closely track the Benford’s standard. The auditor would not rely solely on these results to conclude that risk was minimal; nevertheless, this quick analysis would be used to corroborate other data.
Client Account – Tools – POOR Benford’s Match
This tools account is a poor Benford’s match. Aside from actual fraud, there are a couple of reasons why this analysis didn’t match Benford’s norms. First is the number of records selected. There are only 388 records. In readings, various authors have suggested a variety of minimum sample sizes for Benford’s to work. One author suggested that the lowest number of records permitting a Benford’s analysis was 500. Other’s suggested the lowest as anywhere from 1,000 to 2,500 to achieve useable results. In addition to the very small sample size, the nature of the account might lend itself to repeated purchases of selected tools that are quickly broken or stolen. This may suggest that other analytical techniques are needed as Benford’s doesn’t perform well under these circumstances.
Client Account – Materials 1 – FAIR Benford’s Match
Client Account – Materials 2 – GOOD Benford’s Match
My final two examples are the preceding Materials Accounts. Account Materials 1 with 1203 records provides us with a Fair Benford’s match while Account Materials 2 with 2137 records provides us with a Good Benford’s match. As with other analytical techniques, sample size matters. The larger the sample, the more reliable the results.
Benford’s is useful, but it isn’t perfect. It’s designed to detect deviations from expected norms. It will do so under two conditions. For a Benford’s analysis to detect an anomaly, a person that is attempting to perpetrate a fraud has either added records or removed records in a manner that does not conform to a Benford distribution. So, if a transaction was never recorded, like an off the books fraud, a kickback, a bribe or asset theft, it would not be detected by Benford’s.
There are other instances that Benford’s is of little service. If the data set does not comply with the requirement that it be “naturally occurring” then Benford’s won’t work. For example, duplicate addresses or bank accounts cannot be detected, yet, two employees with similar addresses might indicate ghost employees or, an employee’s address that is also a vendor’s address might indicate a shell company. Other examples where Benford’s is lacking include duplicate purchase orders or invoice numbers that could signal duplicate payments, fraud or shell companies. Additionally, Benford’s will not detect frauds like contract rigging, defective deliveries, or defective shipments.
I like Benford’s and the opportunities it presents. Nevertheless, It’s best used as a corroborating, rather than as a conclusive tool.
Closing Comments –
This analysis was derived using Excel. The files used were very large. The data was obtained in 68 separate Excel files. These then had to be consolidated. Nothing was set up to perform the analysis. Everything was created from scratch. It was laborious and time consuming. A work-a-day auditor couldn’t spend this much time to get to these results. A colleague provided the information I used for the analysis. He spent a great deal of time obtaining the information from client systems for another purpose. Had he not shared his data, this presentation would not have happened. Just getting the data would have taken too much time.
There are much better ways to do this. Many clients possess and use various forms of ACL (Auditing Control Language) that provides a mechanism to directly query and perform a Benford’s analysis on the resulting data. With such capability, Benford’s becomes a capable tool providing a significant resource in identifying and localizing areas of risk.
The software firm ACL has introduced a module called “Find Money Fast” that incorporates Benford’s analysis as well as other supporting auditing analytics. From readings, it seems that the coordinated application of Benford’s, in addition to other complimentary procedures, is an effective approach to identifying and localizing auditing risk.
