Using Benford'sLaw for Fraud Detection and Auditing...Using Benford'sLaw for Fraud Detection and Auditing Don Sparks, CIA, CISA, CRMA, ARM Audimation Services Inc. Using Benford's

Using Benford's Law for Fraud Detection and AuditingDon Sparks, CIA, CISA, CRMA, ARMAudimation Services Inc.

Using Benford's Law for Fraud Detection and Auditing Presented by Don Sparks, Audimation Services 02/09/2016

1

Presenter

Presentation Notes

Benford’s Law For more than three decades, Benford’s Law has been used by financial professionals to find inconsistent data. The Law states that digits and digit sequences in a dataset follow a predictable pattern. Applying Benford’s Law to digital analysis can identify possible errors, potential fraud and other irregularities. The Benford’s Law function in data analysis tools counts digit occurrences of values in the database and compares the totals to the predicted result according to Benford’s Law to help identify outliers that might indicate fictitious invoices. It may also help expose circumvention of approval policies such as large number of transaction just below approval thresholds, which may indicate invoice splitting.

Session Objectives

• How to apply Benford’s law analysis to find outliers in processes suchas payroll, cash disbursement and p-cards, county records, quarterlyfinancials, Insurance claims, etc.

• The types of data that do and do not conform to Benford’s Law• A practical guide to apply Benford’s tests using IDEA software (1st

digit, 2nd digit testing, advanced analytics – fuzzy logic, etc.)

In this session, you will learn the theory behind the law and how it can be used to find potential fraud and errors to help turn your internal audit or fraud investigation into a revenue generating center. Also, there will be a discussion on:


2

Presenter

Presentation Notes

More commonly today, auditors think of running Benford’s Law after the fraud has been detected. By then, most of the money taken has been spent and is not recoverable. It is very difficult to find instances where Benford’s has been successful in finding the fraud early. However there are a few that say running the BL on a regular basis has played a big role in tipping management off of things that just are not right.

About Don Sparks, CIA, CISA, CRMA, ARM • Vice President Industry Relations - Audimation

Services, Inc.• CAE Property/casualty insurance internal audit• Risk Services firms: PwC & RSM• The IIA – eLearning: GAIN, Flash Surveys, &

Monthly web tv broadcasts on Audit & SOX• NAIC IT Working Papers Committee• Co-Author of GTAG 13 & GTAG 16• Creator & Programmer Auditchannel.tv


3

Exhibit Benford’s Law with Population Data


4

Auditors Share the Same Life CycleTasks must be Standardizedto move forward and buildKnowledge


5

Data Miners Share the Same CRISP-DM Cycle

CRoss-Industry Standard Process for Data Mining


6

Fraud Auditors Share The Same Anti-Fraud Process


7

Auditors Share the Same Standards (The IIA IPPF)

• Achievement of the organization’s strategic objectives; • Reliability and integrity of financial and operational information; • Effectiveness and efficiency of operations and programs; • Safeguarding of assets; and • Compliance with laws, regulations, policies, procedures, and contracts.

2120.A1 – The IA activity must evaluate risk exposures relating to the organization’s governance, operations, and information systems regarding the following:

2120.A2 – The IA activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk.


8

Auditors Share the Same Risk FactorsAccording to the IIA practice advisory: Linking the Audit Plan to Risk and Exposures, suggests the following risk factors, among others, should be considered:

• Dollar materiality• Asset liquidity• Quality of internal controls• Degree of change or stability• Complexity• Managements competence


9

Do Patterns in Data Mean Anything?

Statistics students are asked to perform a simple task. Create a matrix of heads and tails by recording the results of 200 coin flips. The professor reviews the results and easily identifies the students that just made up the results without flipping a coin. How did he know?


10

Inventors and Innovators• Simon Newcomb – 1881• Frank Benford – 1938• Roger Pinkham – 1961• Mark Nigrini – 1992


11

Presenter

Presentation Notes

In the 1880’s an astronomer noticed that pages in the front of his logarithm tables were more worn than the pages in the back of the book. The tables were used to multiple and divide large numbers. Simon published a paper on his observations in 1881 but did not offer proof nor a use. The article was promptly forgotten. In 1938, Beneford noticed the same thing, but was unaware of Simon’s article. Benford actually conducted some tests on relatively larger populations and some with smaller numbers. While he did not come up with any practical uses, Frank did publish a paper that had a better reception than Simon’s and so it became known as Benford’s Law. In 1961 Roger Pinkham proved that Benford’s Law held true no matter the unit of measurement. That means it does not matter what unit of measurement is used – yens, dollars, feet, miles, or meters. The result of Roger’s studies and that of other interested parties found that invented numbers do not conform to Benford’s Law. Benford’s Law was used on companies financial reports in 1988 and found that the companies were not completely honest in their financial reports. The real breakthrough for auditors came in 1992 when Mark Nigrini, a South African chartered accountant codified a practical use for Benford’s Law. His 1992 thesis showed that accounting data conforms to Benford’s Law. In 1994 he assisted tax agencies in finding suspect tax returns. From there he worked with companies to find fraud and further his research to expand applications of Benford’s Law.

Why Benford’s Law?Most naturally occurring data sets follow a strange rule called Benford'sLaw. This rule allows you to predict how often each number 1 through 9 will appear as the first non-zero digit in the data set.

Benford's Law can be used to analyze large financial data sets and identify red flags. If the data doesn't look anything like the distribution predicted by Benford's Law, it may mean the numbers have been manipulated.

Places to use Benford’s Law are plentiful in organizations such as currency amounts, time durations, scientific and survey results, PIN numbers, surface areas, and numerical quantities.


12

Benford’s Law DefinedOn the right, you can see the number 1 occurs as the leading digit 30.1% of the time, while larger numbers occur in the first digit less frequently.

For example, the number 3879• 3 - first digit• 8 - second digit• 7 - third digit• 9 – fourth digit


13

Presenter

Presentation Notes

Often called the first-digit law, refers to the frequency distribution of digits in many (not all) real-life data sources Most people assume the probability is 1/9 that the first digit will be 1 - 9 This would mean digits are equally likely to occur, but this is not the case According to Benford’s Law the probability of obtaining a 1 in the first digit position is 30.1% This result has been found to apply to a wide variety of data sets, including electricity bills, street addresses, stock prices, population numbers, death rates, lengths of riversand and tends to be most accurate when values are distributed across multiple order of magnitude. Make sure you understand the logic of Benford and can explain it to Management. Benford sometimes is attacked as “Hocus Pocus”. The focus is not just on finding fraud, but to identify unusual trends in the transactions that might represent control weaknesses or savings opportunities.

Expected Frequencies Based on Benford’s Law Digit 1

stPlace 2

ndPlace 3

rdPlace 4

thPlace

0 0.11968 0.10178 0.10018

1 0.30103 0.11389 0.10138 0.10014

2 0.17609 0.19882 0.10097 0.1001

3 0.12494 0.10433 0.10057 0.10006

4 0.09691 0.10031 0.10018 0.10002

5 0.07918 0.09668 0.09979 0.09998

6 0.06695 0.09337 0.0994 0.09994

7 0.05799 0.0935 0.09902 0.0999

8 0.05115 0.08757 0.09864 0.09986

9 0.04576 0.085 0.09827 0.09982


14

Presenter

Presentation Notes

Many people believe that the best results come from numbers with at least 4 digits. Numbers below say $9.99 to .01 will not register on the Benford analysis – do a demo.

Scientific Methods vs. Data AnalyticsScientific Testing•Benford’s Law •Trend Analysis •Time Series Analysis •Correlation •Z-Score •Relative Size Factor •Same-Same-Same •Same-Same-Different •GEL

Operational Analytics•Extract•Statistics•Sort•Gaps•Duplicates•Aging Samples•Summarize•Stratify• Join (Match)• Compare


15

Presenter

Presentation Notes

So we all know that tips is the most common method of detecting fraud. But have you ever considered that your own corporate data may be a good source of tips to fraud and areas where control suggestions could reduce cost/increase revenue? In this session we will look at two real demonstrations of using Benford’s law while increasing our knowledge about the technique. Assist in learning the logic and help explain it to others as sometimes it is attacked as “Hocus Pocus”. A user-friendly introduction Help detect the red flags of fraud Best data to use Step-by-step demonstration to fraud audits Common software programs to facilitating use Demonstration on 492,000 P Card File

Good Places to Use Benford’s Law

• When used correctly, it can be a powerful tool for identifying suspect accounts or amounts for further analysis.

• Easy to use and best of all not well known by fraudsters!• A tool to complement additional tests/tools. • Users have to gain expertise in interpreting results.


16

Presenter

Presentation Notes

I would like to thank Peter and Jim for inviting me to present to you today – and let me just add some experiences from my past more closely related to today’s topic. Some times got paid twice, quickly fixed Pink slips placed in wrong envelopes Top five hundred wage earners list in the wrong hands

Types of Data That ConformAccounts Payable (number sold * price)

Estimations in General Ledger Test of approval violations under $2,500

Accounts Receivable (number bought*price)

Inventories at many locations Purchase orders

Disbursements Computer System data file conversions

Loan data

Sales Processing inefficiencies due to high quantity

Customer balances

T&E Expenses New Combinations of selling prices

Stock prices

Most sets of Accounting Numbers with

Customer refunds Journal entries

Full year of transactions Credit card transactions


17

Presenter

Presentation Notes

Another example might be a cutoff of US $2,500 for purchases in which a purchase order is required for any purchase at or above this price point. Thus, a Benford’s Law test of the two leading digits (specifically, 24) could reveal any anomalies, manipulation or fraud involving this cutoff. It is also useful as a test of controls to see if existing controls for purchase orders are working effectively. It is important to note that since the cutoff amount has two key digits, a two-digit test is needed rather than a single leading digit.

Non-Conforming Data TypesSituation Examples

Data set comprised of assigned numbers Checks, invoices, zip codes, telephone, insurance policy YYMM####

Numbers influenced by human thought Prices set at psychological thresholds ($1.99, ATM withdrawals

Accounts with a large number of firm-specific numbers

An account specifically set up to record $100 refunds

Accounts with a built in minimum or maximum Assets must meet a threshold before recorded

Airline passenger counts per plane Data sets with 500 or fewer transactions

Where no transaction is recorded Theft, kickback, skimming, contract rigging


18

Simple Facts

• The number 1 predominates most progressions. • Probabilities are scale invariant – works with numbers denominated as

dollars, yen, euros, pesos, rubels, etc.• Not all data sets are suitable for analysis.• Not good for sampling – results in large selection sizes.• Good low cost entry into using continuous auditing/monitoring.• You need to run Benford’s Law on the same data set at regular

intervals.


19

Presenter

Presentation Notes

If you do not like Benford, blame Mark Nigrini!

Areas of Concern About Using Benford’s LawAnalysis tools like Benford’s Law enable auditors and other data analysts to focus on possible anomalies in large data sets. They do not prove that error or fraud exist, but identify items that deserve further study on statistical grounds. The analysis complements existing analytical tools and techniques, and should not be used in isolation from them.•Not necessarily fraud – many False positives•Certain types of fraud will not be detected•Useful tool, setting future auditing plans•Low Cost Entry into Digital continuous analysis


20

Presenter

Presentation Notes

We conclude that Benford’s analysis, when used correctly, is a useful tool for identifying suspect accounts for further analysis. Because of its usefulness, digital analysis tools based on Benford’s law are now being included in many popular software packages (e.g.,ACL and CaseWare 2002) and are being touted in the popular press. CaseWare 2002 says of this new application it “...can identify possible errors, potential fraud or other irregularities.” The goal of this paper has been to help auditors more appropriately apply Benford’s law-based analysis to increase their ability to detect fraud. SAS No. 99 instructs auditors to use analytical tests in the planning stages of their audit. Benford analysis is a particularly useful analytical tool because it does not use aggregated data, rather it is conducted on specific accounts using all the data available. It can be very useful in identifying specific accounts for further analysis and investigation. Because the potential cost of undetected fraud is high, an auditor using this technique must take care not to overstate the reliability of such tests. While such tests have many advantages, certain limitations must also be considered. Specifically, (1) care must be exercised in interpreting the statistical results of the test, (2) Benford analysis should only be applied to accounts which conform to the Benford distribution, and (3) the auditor must be cognizant of the fact that certain types of frauds will not be found with this analysis. While Benford analysis by itself might not be a “surefire” way to catch fraud, it can be a useful tool to help identify some accounts for further testing and therefore should assist auditors in their quest to detect fraud in financial statements.

What’s in Your Audit Toolbox?


21

Exhibit Benford’s Law Used in Financial Areas

• A video from the internet of Benford’s law applied to 10 Years of Apple Inc Financials

• Video with Equity Funding Fraud• Demo of data with Equity Funding Fraud• Demo of 500,000 records in a P- Card data set• $860,000 Accounts Payable Fraud


22

Uses in Fraud Investigations• First and Second Digit Analysis *• First Two Digits Analysis*• First Three Digits Analysis**• Last Two Digits Analysis**• Summation Test**• Advanced Settings – Fuzzy Logic Setting #• Rounded By Analysis #• Duplication Analysis #* =Primary **=Advanced #=Associated


23

Presenter

Presentation Notes

So what are the typical tests and what do they mean. We will run through the typical tests in the next few pages. What may be apparent is the Types of data and what your audit objectives are.

See Red Flags – Less Costly, Better and Faster

• Technology is getting better all the time• The need to find fraud faster to improve recovery• Risk based audit planning• Early warning sign past data patterns have changed• Fraud Deterrence – fraudsters may not understand the theory but

know audit is always looking • Identify Duplicates, Whole Numbers, Recurring Expenses, other

data pattern anomalies• Great analytic when coupled with high dollar and stratified random

sample techniques


24

Presenter

Presentation Notes

As technology matures, finding fraud will increase. Best use today is to prioritize audit planning. Early warning sign past data patterns have changed. Fraud Deterrence – Potential fraudsters may not understand the theory of Benford’s but know audit is regularly running data analysis. Identify Duplicates, Whole Numbers, Recurring Expenses, other data pattern Anomalies Coupled with high dollar and stratified random sample techniques (use with other analytical tools)

Where Can Benford’s Be Used –LIBOR Case?Feb. 26, 2013 – Discovery of banks’ efforts to manipulate the London Interbank Offered Rate (LIBOR) owes a lot to statistical techniques that provide first indications of wrongdoing.

If regulators (and auditors) want to uncover more misdeeds in the markets, they’ll have to use statistical screening tools more actively than they do today.

Extending the analysis over a 30 year period revealed Libor submissions followed Benford’s closely for about 20 years, but began to diverge sharply in the mid-2000’s.


25

Presenter

Presentation Notes

The Libor studies were classic screens, in that they tested for divergence from normal statistical behavior or from markets thought to be functioning properly. To understand how screens work, consider one popular statistical tool: Benford’s law. The law states that the digits in certain types of data from naturally occurring events follow a consistent pattern. The number 1 is by far the most frequent first digit, followed by 2, 3 and so on all the way to 9. The second significant digit is more evenly distributed, and so is the third digit. Such patterns have been observed in financial data such as stock prices, corporate revenue and interest rates. Libor submissions followed Benford’s law closely for about 20 years, but began to diverge sharply in the mid-2000s.

Where Can Benford’s Be Used - Lottery?

No. The outcome of the lottery is truly random. This means every lottery number has an equal chance of occurring.


26

Presenter

Presentation Notes

At this point, you might be tempted to revise the way you choose your lottery numbers: out go birthdays and in comes Benford. Will that make a difference? In other words, Benford's Law needs data that are neither totally random nor overly constrained, but rather lie somewhere in between. These data can be wide ranging, and are typically the result of several processes, with many influences. For example, the populations in towns and cities can range from tens or hundreds to thousands or millions, and are affected by a huge range of factors. Similarly, think about the 50 highest mountains in the world, measured in metres: not many of these will begin with 1 either (Mount Everest has a height of 8850 metres)! Unlike the lottery, these data are not random: instead, they are highly constrained. The range of possibilities is too narrow to allow a law of digit frequencies to hold.

Tips for Successful Data Analytics Integration

•Start with a high-priority, high-return project•Focus on efficiency and effectiveness

•Communicate•Be brief; be thorough; be gone

•Exercise patience•Call the Integration Help Desk


27

Presenter

Presentation Notes

Start with a high-priority, high-return project. The first project will require significant set-up costs, so it is important to begin with a project that will lead to tangible visible returns. Do not try to sneak analytics in the back door! Focus on efficiency and effectiveness. Do the right things the right way will provide the opportunities to look around the corners for errors and fraud. Communicate. Sharing information while protecting inside knowledge across multiple departments about early successes will build momentum. Be brief; be thorough; be gone! Analysts should avoid cramming too much information into one project while building the skills to develop and sustain successful data analytics efforts. Broaden your horizon. Exercise patience. Although quick-hit projects may be completed in a few hours or days, full integration can take a year or more and your plan may be refined as business activities and risks change. Call the Integration Help Desk. A quick call or email can save a lot of mistakes/rework!

Questions? Don Sparks832-327-1877


28

Presenter

Presentation Notes

Add questions asked by registrants How do you detect fraud through an audit programs? How do I audit my banking organization against fraud in the system/ i t environment? I am interested in acquiring data mining software and look forward to hearing everyone's experiences.

Documents

Using Benford'sLaw for Fraud Detection and Auditing...Using Benford'sLaw for Fraud Detection and Auditing Don Sparks, CIA, CISA, CRMA, ARM Audimation Services Inc. Using Benford's