Benford's Law: How to Use it to Detect Fraud in Financial Data

Copyright © 2013 FraudResourceNet™ LLC

Benford's Law: How to Use it to Detect Fraud in Financial DataAugust 7, 2013

Special Guest Presenter:

Don SparksCIA, CISA, CRMAVice PresidentAudimation Services IncPartner with CaseWare IDEA


About Peter Goldmann, MSc., CFE

President and Founder of White Collar Crime 101Publisher of White-Collar Crime FighterDeveloper of FraudAware® Anti-Fraud

Training Monthly Columnist, The Fraud Examiner, ACFE Newsletter

Member of Editorial Advisory Board, ACFE

Author of “Fraud in the Markets”Explains how fraud fueled the financial crisis.


About Jim Kaplan, MSc, CIA, CFE

President and Founder of AuditNet®, the global resource for auditors

Auditor, Web Site Guru,

Internet for Auditors Pioneer

Recipient of the IIA’s 2007 Bradford Cadmus Memorial Award.

Author of “The Auditor’s Guide to Internet Resources” 2nd Edition


Don Sparks, CIA, CISA, ARM

Vice President Industry Relations -Audimation Services, Inc.

24-years property/casualty insurance internal auditing experience (12 as the CAE)

ISACA International Education & Dissemination Committee

Former senior staff member of the IIA – GAIN, Flash Surveys, Role of Audit in SOX 2002 video conferences

Co-Author of GTAG 13 & GTAG 16 Creator/Programmer Auditchannel.tv


Webinar Housekeeping

This webinar and its material are the property of FraudResourceNet™ LLC. Unauthorized usage or recording of this webinar or any of its material is strictly forbidden. We will be recording the webinar and you will be provided access to that recording within five-seven business days. Downloading or otherwise duplicating the webinar recording is expressly prohibited.

You must answer the polling questions to qualify for CPE per NASBA.

Please complete the evaluation to help us continuously improve our Webinars.

Submit questions via the chat box on your screen and we will answer them either during or at the conclusion.

If GTW stops working you may need to close and restart. You can always dial in and listen and follow along with the handout.


Disclaimers

The views expressed by the presenters do not necessarily represent the views, positions, or opinions of FraudResourceNet™ LLC (FRN) or the presenters’ respective organizations. These materials, and the oral presentation accompanying them, are for educational purposes only and do not constitute accounting or legal advice or create an accountant-client relationship.

While FRN makes every effort to ensure information is accurate and complete, FRN makes no representations, guarantees, or warranties as to the accuracy or completeness of the information provided via this presentation. FRN specifically disclaims all liability for any claims or damages that may result from the information contained in this presentation, including any websites maintained by third parties and linked to the FRN website

Any mention of commercial products is for information only; it does not imply recommendation or endorsement by FraudResourceNet LLC

5


Today’s Agenda

Auditing for Fraud: Standards & Essentials

Assist in learning the logic and help explain it to others as sometimes it is attacked as “Hocus Pocus”.

A user‐friendly introduction

Help detect the red flags of fraud

Best data to use

Step‐by‐step demonstration to fraud audits

Common software programs to facilitating use

Demonstration on 492,000 P Card File


The Auditor’s Role

IPPF Standard 1210.A3 Internal auditors must have sufficient knowledge of…available technology based audit techniques to perform their assigned work


IIA Guidance – GTAG 13

Internal auditors require appropriate skills and should use available technological tools to help them maintain a successful fraud management program that covers prevention, detection, and investigation. As such, all audit professionals — not just IT audit specialists — are expected to be increasingly proficient in areas such as data analysis and the use of technology to help them meet the demands of the job.


Professional Guidance


Using Statistics To Seek Out Criminals

Feb. 26, 2013 – The discovery of banks’ efforts to manipulate the London Interbank Offered Rate (LIBOR) owes a lot to statistical techniques that provide first indications of wrongdoing. If regulators (and auditors) want to uncover more misdeeds in the markets, they’ll have to use statistical screening tools more actively than they do today. Extending the analysis over a 30 year period revealed Libor submissions followed Benford’s closely for about 20 years, but began to diverge sharply in the mid‐2000’s.


Bernie Madoff’ Fraud

If you took the annual returns of all possible investments, you would find that the population matches Benford’s Law very closely. However, the returns that Madoffwas reporting don’t. They nearly all have a 1 as a leading digit, as he consistently reported returns between 10%-20%. This would have been a clear indication that his returns were being made up.


Do Patterns in Data Mean Anything

Statistics students are asked to perform a simple task. Create a matrix of heads and tails by recording the results of 200 coin flips. The professor reviews the results and easily identifies the students that just made up the results without flipping a coin. How did he know?


Inventors and Innovators

Simon Newcomb – 1881

Frank Benford – 1938

Roger Pinkham – 1961

Mark Nigrini – 1992


Benford’s Law Defined

Often called the first‐digit law, refers to the frequency distribution of digits in many (not all) real‐life data sources. On the right, you can see the number 1 occurs as the leading digit 30.1% of the time, while larger numbers occur in the first digit less frequently. For example, the number 3879

3 ‐ first digit

8 ‐ second digit

7 ‐ third digit

9 – fourth digit


Expected Frequencies Based on Benford’s Law

Digit 1st

Place 2nd

Place 3rd

Place 4th

Place

0 0.11968 0.10178 0.10018

1 0.30103 0.11389 0.10138 0.10014

2 0.17609 0.19882 0.10097 0.1001

3 0.12494 0.10433 0.10057 0.10006

4 0.09691 0.10031 0.10018 0.10002

5 0.07918 0.09668 0.09979 0.09998

6 0.06695 0.09337 0.0994 0.09994

7 0.05799 0.0935 0.09902 0.0999

8 0.05115 0.08757 0.09864 0.09986

9 0.04576 0.085 0.09827 0.09982


Polling Question 1

Benford’s Law is sometimes also called:

A. First-Digit LawB. First-two Digits LawC. Third-Digit LawD. Nigrini’s Law


Simple Facts

The number 1 predominates most progressions.

Probabilities are scale invariant – works with numbers denominated as dollars, yen, euros, pesos, rubels, etc.

Not all data sets are suitable for analysis.

Not good for sampling – results in large selection sizes.

Good low cost entry into using continuous auditing/monitoring.


Can You Use it To Win the Lottery?

No. The outcome of the lottery is truly random. This means every lottery number has an equal chance of occurring. The leading‐digit frequencies should, in the long run, be in exact proportion to the number of lottery numbers starting with that digit.


Where Does Benford’s Fit into Your Anti‐Fraud Program?


The Red Flags of Fraud

As technology matures, finding fraud will increase. Best use today is to prioritize audit planning. Early warning sign past data patterns have changed. Fraud Deterrence – Potential Fraudsters may not

understand the theory of Benford’s but know audit is regularly running data analysis.

Identify Duplicates, Whole Numbers, Recurring Expenses, other data pattern Anomalies

Coupled with high dollar and stratified random sample techniques (use with other analytical tools)


Polling Question 2

Benford’s Law is a good tool for finding fraud when just afew fraudulent transactions are entered into the system.

A. TrueB. False


Demo Real Fraud

CFE found a 6 year $860,000 AP fraud. I often get a question could Benford’s have found this sooner?

CFE asked three questions:

How many employees work in AP

Longest tenure employee

Can you pull 6 years of AP from AS400

Imported AP into IDEA

Ran Summarization

Bank re‐imaged suspicious duplicate checks selected by the CFO


Types of Data That Conform

Accounts Payable (number sold * price)

Estimations in General Ledger

Test of approval violations say under $2,500

Accounts Receivable (number bought*price)

Inventories at many locations

Purchase orders

Disbursements Computer System data file conversions

Loan data

Sales Processing inefficienciesdue to high quantity

Customer balances

T&E Expenses New Combinations of selling prices

Stock prices

Most sets of Accounting Numbers with

Customer refunds Journal entries

Full year of transactions Credit card transactions


Non‐Conforming Data Types

Situation Examples

Data set comprised of assigned numbers

Checks, invoices, zip codes, telephone, insurance policy YYMM####

Numbers influenced by human thought Prices set at psychological thresholds ($1.99, ATM withdrawals

Accounts with a large number of firm-specific numbers

An account specifically set up to record $100 refunds

Accounts with a built in minimum or maximum

Assets must meet a threshold before recorded

Airline passenger counts per plane Data sets with 500 or fewer transactions

Where no transaction is recorded Theft, kickback, skimming, contract rigging


Uses in Fraud Investigations

First and Second Digit Analysis

First Two Digits Analysis

First Three Digits Analysis

Last Two Digits Analysis

Summation Test

Advanced Settings – Fuzzy Logic SettingRounded By AnalysisDuplication Analysis


Polling Question 3

Types of financial data that conform to use in Benford’sLaw testing (choose the best answer(s)

A. Accounts Payable (number sold * price)B. Accounts Receivable (number bought * price)C. DisbursementsD. SalesE. All of the above


First and Second Digit Analysis

The designated first or second digits in a number series will be analyzed. The expected output serves as a rough check of the actual numerical distribution in the population and is used to determine level of compliance with the Benford’s Law.


First Two Digits Analysis

This test examines the frequency of the numerical combinations 10 through 99 on the first two digits of a series of numbers.

In particular the output serves for the analysis of avoided threshold values. Thus, these tests help to clearly visualize when order or permission limits have been systematically avoided.


First Three Digits Analysis

This test examines the frequency of the numerical combinations 100 through 999 in the first two digits of a series of numbers.

The output serves for analysis after conspicuous rounding off operations. Requires a large amount of deviations with a population greater than 10,000.


Last Two Digits Test:

The Last Two Digits test analyzes the frequency of the last two digits and is useful in auditing election results, inventory counts—any situation in which padding or number invention is suspected.


Rounded By Analysis

This test is used to analyze the relative increasing frequency of rounded numbers.

The determination comprises the frequencies of the numbers that are divisible by 10, 25, 100 and 1,000 (and any user‐defined values of whole numbers) without remainders.


Duplicates Analysis

The analysis of multiple duplicates includes all number values in the entire database that occur more than once. This test helps the user to recognize all existing duplicates in the data supply whereas the result table presents the duplicates sorted according to the descending frequency. The aim of the test is to identify certain numbers that occur more than once (for example, possible duplicate payments). Difference from the other tests: Does not analyze any numerical combinations, but the pure value of a number.


Summation Test

The Summation test is similar to the traditional Benford’s Law test, but instead of calculating the number of occurrences for each first two digits, it sums each amount.

Advantage: Allows you to identify clearly significant amounts that do not follow the expected results of Benford’s Law.


Second Order Test

The Second Order test is based on the digits of the differences between amounts that have been sorted from smallest to largest (ordered). The first two digits of the differences should follow the digit frequencies of Benford’s Law. This test is particularly useful in indicating data integrity issues.


Advanced Settings

With most Benford’s Law tests in IDEA Version Nine, you have the option of extracting “suspicious” data whose digit frequencies do not follow the digit frequencies of Benford’s Law. With Advanced Settings, you can also refine this output to limit the size of the output database.


Check for Benford’s Conformity


Polling Question 4

Area(s) where Benford’s Law is not a good tool (choose all that apply):A. All the numbers in a series are at or below $9.99 or frauds involving situations where nothing is recorded.B. All of the numbers are positive.C. All of the numbers are negative.D. Very large data sets over 1 billion records.


Benford’s Law Software

Integrated Tools Add-In Component

CaseWare IDEA Excel

Arbutus Access

Active Data SAS

ACL

ESKORT Computer Audit (SESAM)

Tableau

TopCAATs


Source: July 2011 ISACA

Creating a Continuous Auditing Application


Demo P-Card File - Steps in Presentation

Stratify the Population

Analyze the Population Using Benford

Organize Population into groups by the number of leading digits.

Analyze Groups Using Benford

Store Benford Analysis into a Table and then extract high frequency digit combinations (use the z statistic and the variance between actual and expected occurrence).

Make the analysis “repeatable and continuous”.

BENFORDSlide Number 40


Polling Question 5

Mark Nigrini:A. Invented Benford’s LawB. Is a close relative of BenfordC. Is the only one to find fraud using Benford’s LawD. Believes auditors should use it to detect fraud


Conclusion

Digital analysis tools like Benford’s Law enable auditors and other data analysts to focus on possible anomalies in large data sets. They do not prove that error or fraud exist, but identify items that deserve further study on statistical grounds. Digital analysis complements existing analytical tools and techniques, and should not be used in isolation from them.

Not necessarily fraud – many False positives

Certain types of fraud will not be detectedUseful tool, setting future auditing plansLow Cost Entry into Digital continuous analysis


Questions?

Any Questions?Don’t be Shy!


Coming Up This Month

1. When Law Enforcement Comes Knocking on August 14, 2013 1:00 PM

2. Best Practices in Detecting Accounts Payable Fraud Using Data Analysis on August 21, 2013 11:00 AM


Thank You!

Website: http://www.fraudresourcenet.com

Jim KaplanFraudResourceNet™

800-385-1625 [email protected]

Peter GoldmannFraudResourceNet™

[email protected]

Don [email protected]

832-327-1877

Economy & Finance

Benford's Law: How to Use it to Detect Fraud in Financial Data