5/15/2016

I'veGotYourNumber

JournalofAccountancy

I'veGotYourNumber
HowamathematicalphenomenoncanhelpCPAsuncoverfraudandotherirregulaities.

BYMARKJ.NIGRINI
May1,1999

EXECUTIVESUMMARY
BENFORD'SLAWPROVIDESADATA
analysismethodthatcanhelpalertCPAsto
possibleerrors,potentialfraud,manipulative
biases,costlyprocessinginefficienciesorother
irregularities.

CPAsCANUSEBENFORD'SDISCOVERYin
businessapplicationsrangingfromaccounts
payabletoY2Kproblems.Inaddition,subsettests
identifysmalllistsofseriousanomaliesinlarge
datasets,makingananalysismoremanageable.

APHYSICISTATGERESEARCH
LABORATORIESinthe1920s,FrankBenford DIGITALANALYSISISWELLSUITEDtofinding
foundthatnumberswithlowfirstdigitsoccurred errorsandirregularitiesinlargedatasetswhen
morefrequentlyintheworldandcalculatedthe auditorsneedcomputerassistedtechnologiesto
expectedfrequenciesofthedigitsintabulated directtheirattentiontoanomalies.
data.
MARKJ.NIGRINI,CA(SA),PhD,MBA,isanassistantprofessorattheEdwinL.CoxSchoolof
Business,SouthernMethodistUniversity,Dallas,andaResearchFellowattheErnst&Young
CenterforAuditingResearchandAdvancedTechnology,UniversityofKansas,Lawrence.
WhenphysicistFrankBenfordtestedthefirstdigitsin
listsofnumbersduringthe1920sand1930s,hefound
thatabout31%ofthenumbershad1asthefirstdigit,
19%had2,andonly5%had9.
(ILLUSTRATIONCOURTESYOFARTOVERNITE.COM)

Isitpossibletotellthatanumberiswrongjustbylookingatit?Insomecases,youbet.Using
Benford'slawamathematicalphenomenonthatprovidesauniquemethodofdataanalysis
CPAscanspotirregularitiesindicatingpossibleerror,fraud,manipulativebiasorprocessing
inefficiency.Benford'slawisusedtodeterminethenormallevelofnumberduplicationindatasets,
whichinturnmakesitpossibletoidentifyabnormaldigitandnumberoccurrence.Accountantsand

http://www.journalofaccountancy.com/Issues/1999/May/nigrini

1/8

5/15/2016

I'veGotYourNumber

auditorshavebeguntoapplyBenford'slawtocorporatedatatodiscovernumberpattern
anomalies.Forlargedatasets,CPAsusehighlyfocusedteststhatconcentrateonfinding
deviationsinsubsets.
EUREKA!
FrankBenfordmadeasimpleobservationwhileworkingasaphysicistattheGEResearch
LaboratoriesinSchenectady,NewYork,inthe1920s.Henoticedthatthefirstfewpagesofhis
logarithmtablesbooksweremorewornthanthelastfewandfromthishesurmisedthathewas
consultingthefirstpageswhichgavethelogsofnumberswithlowdigitsmoreoften.Thefirst
digitofanumberisleftmostforexample,thefirstdigitof45,002is4.(Zerocannotbeafirst
digit.)Benfordextrapolatedthathewaslookingupthelogsofnumberswithlowfirstdigitsmore
frequentlybecausethereweremorenumberswithlowfirstdigitsintheworld.
Exhibit1:Benford'sLawExpectedDigitalFrequencies
Benfordthentestedthisideabylookingatthefirstdigitsof20
listsofnumberswithatotalof20,229observations.Hislists
camefromvariedsources,suchasgeographic,scientificand
demographicdata.Onelistcontainedallthenumbersinan
issueofReader'sDigest.Hefoundthatabout31%ofthe
numbershad1asthefirstdigit,19%had2,andonly5%had
9asafirstdigit.Benfordthenmadesomephysicsrelated
assumptionsaboutthedistributionofnaturallyoccurringdata
and,usingintegralcalculus,hecomputedtheexpected
frequenciesofthedigitsanddigitcombinations.
Theexpectedfrequenciesofthedigitsinthefirstfour
positionscanbeseeninexhibit1,whichshowsalargebias
infavoroflowdigitsinthefirstposition.Theprobabilitythat
thefirstdigitiseithera1,2or3is60.2%.
NotalldatasetsfollowBenford'slaw.Thosedatasetsmost
likelytowillhavethefollowingcharacteristics:
Thenumbersdescribethesizesofsimilarphenomena(forexample,marketvaluesof
corporations).

Thenumbersdonotcontainabuiltinmaximumorminimumvalue(suchasdeductibleIRA
contributionsorhourlywagerates).

Assignednumbers,suchasSocialSecuritynumbers,zipcodesorbankaccountnumberswillnot
conformtoBenford'slaw.

http://www.journalofaccountancy.com/Issues/1999/May/nigrini

2/8

5/15/2016

I'veGotYourNumber

Mutualfundmath.AnintuitiveexplanationofBenford'slawistoconsiderthetotalassetsofa
mutualfundthatisgrowingat10%peryear.Whenthetotalassetsare$100million,thefirstdigit
oftotalassetsis1.Thefirstdigitwillcontinuetobe1untiltotalassetsreach$200million.This
willrequirea100%increase(from100to200),which,atagrowthrateof10%peryear,willtake
about7.3years(withcompounding).At$500millionthefirstdigitwillbe5.
Growingat10%peryear,thetotalassetswillrisefrom$500millionto$600millioninabout1.9
years,significantlylesstimethanassetstooktogrowfrom$100millionto$200million.At$900
million,thefirstdigitwillbe9untiltotalassetsreach$1billion,orabout1.1yearsat10%.Once
totalassetsare$1billionthefirstdigitwillagainbe1,untiltotalassetsagaingrowbyanother
100%.Thepersistenceofa1asafirstdigitwilloccurwithanyphenomenonthathasaconstant
(orevenanerratic)growthrate.
Benford'slawhasbeenfoundtoapplytomanysetsoffinancialdata,includingincometaxor
stockexchangedata,corporatedisbursementsandsalesfigures,demographicsandscientific
data.Sincethe1940s,morethan150academicpapersonBenford'slawhavebeenpublishedby
mathematicians,statisticians,engineers,physicistsandrecentlybyaccountants.None
disputesitoroffersacompetinglawrelatedtodigits.PerhapsRogerPinkhamwrotethemost
convincingsupportin1961,whenheshowedthatBenford'slawwasscaleinvariant.Inother
words,ifasetofnumbersfollowedBenford'slawclosely,andifallthenumbersinthesetwere
multipliedbyanonzeroconstant(suchas22.04or0.323),thenthenewsetofnumberswould
alsofollowBenford'slawclosely.OnlytheprobabilitiesofBenford'slawhadthisproperty.This
scaleinvariancehelpsustounderstandwhyBenford'slawworksonfinancialdatathroughoutthe
world,eventhoughthedataareexpressedindifferentcurrencies.Arecentreviewofthetheory
underlyingBenford'slawisbythemathematicianTedHillinAmericanScientist(JulyAugust1998).
Exhibit2:FirstDigitsofCensusData
Exhibit2,showstheresultsofananalysisofthepopulation
countsofthe3,141U.S.counties,accordingtothe1990
census.Benford'slawproportionsareshownasthediamond
studsontheline.Thebarsshowtheactualproportions.There
areninebars,oneforeachofthepossiblefirstdigits.Fromthe
graphit'sclearthattheactualproportionsfollowBenford'slaw
quiteclosely,whichiswhatwouldbeexpectedfromauthentic,
unmanipulateddata.Themeanabsolutedeviationofthefirst
digitsofthecensusdatais0.7%,whichmeansthaton
average,theactualproportiondifferedfromtheexpected
proportionbysevententhsofonepercent.Auditorsusually
consideradifferenceofthismagnitudetobeimmaterial.Theunderlyingthesisofdigitalanalysisis
thatBenford'slawmakesitpossibletospotdataanomalies.
TELLTALETHRESHOLD
In1993,inStateofArizonav.WayneJamesNelson(CV9218841),theaccusedwasfoundguilty
oftryingtodefraudthestateofnearly$2million.Nelson,amanagerintheofficeoftheArizona
StateTreasurer,arguedthathehaddivertedfundstoabogusvendortodemonstratetheabsence
http://www.journalofaccountancy.com/Issues/1999/May/nigrini

3/8

5/15/2016

I'veGotYourNumber

ofsafeguardsinanewcomputersystem.Theamountsofthe23checksissuedareshownin
exhibit3.
Exhibit3:CheckFraudinArizona
Becausehumanchoicesarenotrandom,inventednumbers
areunlikelytofollowBenford'slaw.Herearesomedivergent
signsthatBenford'slawwouldhavedrawnattentionto:
Asisoftenthecaseinfraud,theembezzlerstartedsmall
andthenincreaseddollaramounts.

Mostoftheamountswerejustbelow$100,000.It'spossible
thathigherdollaramountsreceivedadditionalscrutinyorthat
checksabovethatamountrequiredhumansignaturesinstead
ofautomatedcheckwriting.Bykeepingtheamountsjust
belowanadditionalcontrolthreshold,themanagertriedto
concealthefraud.

Thedigitpatternsofthecheckamountsarealmostopposite
tothoseofBenford'slaw.Over90%have7,8or9asafirstdigit.Hadeachvendorbeentested
againstBenford'slaw,thissetofnumbersalsowouldhavehadalowconformity,signalingan
irregularity.

Thenumbersappeartohavebeenchosentogivetheappearanceofrandomness.Benford's
lawisquitecounterintuitivepeopledonotnaturallyassumethatsomedigitsoccurmore
frequently.Noneofthecheckamountswasduplicatedtherewerenoroundnumbersandall
theamountsincludedcents.However,subconsciously,themanagerrepeatedsomedigitsand
digitcombinations.Amongthefirsttwodigitsoftheinventedamounts,87,88,93and96were
allusedtwice.Forthelasttwodigits,16,67and83wereduplicated.Therewasatendency
towardthehigherdigitsnotethat7through9werethemostfrequentlyuseddigits,incontrast
toBenford'slaw.Atotalof160digitswereusedinthe23numbers.Thecountsforthetendigits
from0to9were7,19,16,14,12,5,17,22,22,and26,respectively.ACPAfamiliarwith
Benford'slawcouldhaveeasilyspottedthefactthatthesenumbersinventedtoseemrandom
bysomeoneignorantofBenford'slawfalloutsideexpectedpatternsandthusmeritcloser
examination.
Exhibit4:FirstTwoDigitsofAccountsPayableData
ONTHEJOBAPPLICATIONS
Corporateaccountspayabledataareafavoritetargetofthedigitalanalysistechnology.Thefirst
andseconddigittestsareusedashighlevelexaminationsofreasonableness(dataauthenticity).
ThegraphofthefirsttwodigitsofanaccountspayablefileofaNASDAQlistedsoftwarecompany
isshowninexhibit4.
http://www.journalofaccountancy.com/Issues/1999/May/nigrini

4/8

5/15/2016

I'veGotYourNumber

ThelineplotsBenford'slawandthebarsshowthe
actualproportions.Whenthebarsextendabovethe
Benford'slawline,theactualproportionexceedsthe
Benford'slawpredictedproportion,creatingan
abnormallevelofduplicationforthatfirsttwodigit
combination.
Ananalysisoftheactualdollaramountsshowedthat
thenumbers$25,$30and$10occurredmost
frequently.Thefollowupauditshowedthatinvoices
withtheseamountsweremainlyforcouriercharges.
Repeatedlowdollaramountshighlightinefficienciesif
theyarebeingprocessedforthesametypeof
purchase.Atonecompany,thefollowupauditshowedthataccountspayablewasprocessing
about12,000invoicesannuallyforemployeebusinesscardpurchasesfromthesamevendor.
Monthlybillingcouldmakesteepreductionsinprocessingcosts.Otherproblemsthathavebeen
foundinclude:
Biasesincorporatedata.Inonecompany'saccountspayabledata,therewasalargefirst
twodigitspike(excessofactualoverexpected)at24.Ananalysisshowedthattheamount
$24.50occurredabnormallyoften.Theauditrevealedthatthesewereclaimsfortravel
expensesandthatthecompanyhada$25voucherrequirement.Employeeswereapparently
biasedtowardclaiming$24.50.

Duckingauthorizationlevels.Sometimesmanagersconcentratetheirpurchasesjustbelow
theirauthorizationlevelssotheirchoiceswon'tbescrutinized.Managerswith$3,000
purchasinglevelsmighthavealotofinvoicesfor$2,800to$2,999,whichwouldshowupin
dataanalysisbyspikesat28and29.
Benford'sLawFormula
P(D1=d1)=log10(1+1/d1)ford1{1,2,...,9}
Duringonebankaudit,theauditorsanalyzedthefirsttwodigitsofcreditcardbalanceswrittenoff
asuncollectible.Thegraphshowedalargespikeat49.Ananalysisoftherelateddollaramounts
(thatis,from$480to$499andfrom$4,800to$4,999)showedthatthespikewascausedmainly
byamountsbetween$4,800and$4,999,andthatoneofficerwasresponsibleforthebulkofthese
writeoffs.Thewriteofflimitforinternalpersonnelwas$5,000.Itturnedoutthattheofficerwas
operatingwithacircleoffriendswhowouldapplyforcreditcards.Aftertheyranupbalancesof
justunder$5,000,hewouldwritethedebtsoff.
It'salsopossibletotestforexcessiveroundnumberswhenanaccountantwantstocheckfor
excessiveestimating(perhapsroyaltyreceivableschedules)andtotestthelasttwodigitstofind
numberinvention(perhapsininventorycounts).
DoItYourself

http://www.journalofaccountancy.com/Issues/1999/May/nigrini

5/8

5/15/2016

I'veGotYourNumber

ForahandsonintroductiontoBenford'slaw,openTheWallStreetJournalandpickarandom
startingpointinthestocktablesforthetwomajorexchanges.Tabulatethefirstdigitsofthedaily
volume(inhundreds)for100stocks.About50ofthenumbersonthelistshouldstartwitha1ora
2.Onlyabout5numbersshouldstartwitha9justasBenford'slawwouldpredict.

REFININGTHETESTS
Corporatedatasetsarebecominglargerandlarger.Thefirsttwodigitstestcouldbefinetunedto
afirstthreedigitstesttokeepsamplesizesmanageable,butthereisstillthepotentialforlarge
samples.Forexample,thefirsttwodigits30mighthaveanactualproportionof0.02,whichis
higherthanthe0.0142expected,butanauditof2%ofthepopulationwouldbeexcessiveand
expensive.
Subsettestsidentifysmalllistsofseriousanomaliesinlargedatasets,makingananalysismuch
moremanageable.Theyfocusonerrorsasopposedtobiases,fraudorprocessinginefficiencies.
Datasubsetsarenaturalgroupingsofthedata.Inaccountspayable,thesubsetsareusually
vendornumbers.Inbankingdata,thesubsetsareusuallyaccountnumbers.Othersubset
variablescouldbedataforsalesassociatesinretailing,transactiondates,travelagentsinairline
data,costcentersandemployeesinpayrolldata.
Relativesizefactor.TheRSFtestfindssubsetswherethelargestnumberisoutoflinewiththe
remainingnumbersandispossiblyanerror.Ithasdetectederrorsinaccountspayablewhenstaff
miscodedthedecimalpointintheinvoiceamount.Therelativesizefactor(RSF)forasubsetis:
RSF=Largestnumberinsubset/Secondlargestnumberinsubset.Anamountof$452.47was
codedas$45,247.Thaterroneous$45,247greatlyexceededalltheotherpaymentstothat
vendorandtheerrorwasdetectedduetothehighRSF.
PutIttoWork
HerearesomepossiblepracticalapplicationsforBenford'slawanddigitalanalysis.
Accountspayabledata.
Estimationsinthegeneralledger.
Therelativesizeofinventoryunitpricesamonglocations.
Duplicatepayments.
Computersystemconversion(forexample,oldtonewsystemaccountsreceivablefiles).
Processinginefficienciesduetohighquantity/lowdollartransactions.
Newcombinationsofsellingprices.
Customerrefunds.

http://www.journalofaccountancy.com/Issues/1999/May/nigrini

6/8

5/15/2016

I'veGotYourNumber

AcompanyintheMidwestwired$600,000towhatitthoughtwasavendorbutactuallywasa
charity.The$600,000wassignificantlyinexcessoftheamountusuallydonatedtothecharity.
HadthecompanyruntheRSFtestusingtherecipient'scheckingaccountnumbersasthesubset
variable,thetestwouldhavedetectedthatanamountofthismagnitudehadneverbeforebeen
wiredtothataccountnumber.Thetestisdesignedtodetectdataerrors.Forexample,ahighRSF
inpayrolldatacouldsignalanovertimeerrorandahighRSFforinventoriescouldsignala
calculationorcounterror.
Same,same,different.Thistestalsodetectserrorsbyidentifyingnearidenticalentries.In
accountspayabledatathetestisoftenusedtoidentifycasesinwhichtheinvoicenumberisthe
same,thedollaramountisthesameandthevendornumbersaredifferent.Thesenearidentical
entriescouldoccurifthewrongvendorispaid(perhapsthevendornumberismiskeyed)andata
laterstagethecorrectvendorispaid(becausethesystemdoesnotregisterpaymentofthe
invoicetothatvendor).Companiesthathaveusedthistesthavereapedlargepaybacksof
misdirectedfunds.
Thesame,same,differentcriteriacanfindmanydifferenttypesofnearidenticalentries.Inairline
ticketrefunddata,itcanfindcaseswheretheticketnumberisthesame,thedollaramountisthe
sameandthecreditcardnumberisdifferent.Inpayrolldataitcanfindinstanceswherethe
employeenumberisthesame,thedateisthesameandthecheckingaccountnumberisdifferent.
Thistestworksverywellinlargedatasetswherethematchessignalaseriouserror.The"hit"list
isusuallyshortenoughtoallowanauditofallthematches.
ReadAllaboutIt
FormoreonBenford'slawanddigitalanalysis:
TheFirstDigitProblem,byR.Raimi,AmericanMathematicalMonthly83(Aug.Sept.):521538,
1976.
TheUseofBenford'sLawasanAidinAnalyticalProcedures,byM.J.NigriniandL.I.
Mittermaier,Auditing:AJournalofPracticeandTheory16(Fall):5267,1997.
UsingDigitalFrequenciestoDetectFraud,byM.J.Nigrini,TheWhitePaper(April/May):36,
1996.

Same,same,same.Thistestfindsidenticalentries,suchasduplicatepaymentsinaccounts
payable.WhilemanyAPsystemscanmakethisidentification,duplicatesmaystilloccurifsomeof
thepurchasedetailsaremiskeyedorwhenthereareanumberofpaymentcentersormultiple
paymentsystems.Duplicatesaredetectedwhenallthepaymentdataareanalyzedtogether.This
testcanalsobeusedininventory,payroll,accountsreceivableandsales.
ADDRESSINGANOMALIES
Usingdigitalanalysisoncorporatedatarequirestheuseofacomputer.Therearedigitalanalysis
programsthatoperateinSAS,IDEA,ACLandExcel.Auditorscanalsowritetheirownprograms
tocalculatethedigitandnumberfrequencies.
http://www.journalofaccountancy.com/Issues/1999/May/nigrini

7/8

5/15/2016

I'veGotYourNumber

DigitalanalysisrequiresknowledgeofBenford'slawandsomeprofessionaljudgmenttoidentify
anomaliesworthyofinvestigation.Itcanbeusedinongoingapplications,suchasaccounts
payable,andforonetimeneeds,suchasY2Kproblems.Itisasurprisinganswertotheproblem
ofdatairregularitiesandapowerfultoolforCPAs.

2016AmericanInstituteofCPAsAllRightsReserved

http://www.journalofaccountancy.com/Issues/1999/May/nigrini

8/8