Benford's Law for Auditors: First-Digit Testing, Thresholds and Limits

Benford's Law says that in many naturally occurring sets of numbers, the leading digit is not uniformly distributed. The digit 1 leads about 30 percent of the time and 9 about 5 percent. Auditors use the pattern as a screen: if a population of invoices, payments or journal entries departs from the expected distribution, the departure points to where to look. It is a way to select items for testing, not a conclusion about fraud.

This guide gives the expected frequencies, the statistical tests, a worked example with the arithmetic, when the method does not apply, and how it fits the journal entry and fraud procedures in AU-C 240.

The law

The expected proportion of numbers with first digit d is log10(1 + 1/d). The astronomer Simon Newcomb noticed the pattern in 1881, and the physicist Frank Benford documented it across many datasets in 1938.

The nine values sum to 100 percent. The same logic gives expected frequencies for the second digit and for the first two digits together, and the first-two-digits test is more sensitive for spotting invented amounts or thresholds.

Where it works and where it does not

Benford's Law fits data that:

• spans several orders of magnitude, such as invoices from $50 to $90,000;
• is produced by a mix of processes rather than one source;
• has no built-in minimum, maximum or assigned pattern.

It does not fit:

• assigned numbers such as check numbers, invoice numbers and account numbers;
• amounts held in a narrow range, such as monthly rent or employee reimbursements capped at $100;
• prices set by design, such as $9.99 retail prices;
• very small populations. A few dozen items give unstable proportions.

If the test is run on a population that should not conform, the result says nothing about misstatement. State in the workpaper why the population is suitable.

The tests

Z-statistic for one digit

For digit d with expected proportion e and observed proportion p, in a population of n items:

z = (|p - e| - 1/(2n)) / sqrt(e(1 - e)/n)

A value above 1.96 flags a digit at the 5 percent significance level. With large populations, even trivial differences become significant, which is why a second measure helps.

Mean absolute deviation (MAD)

MAD is the average of the absolute differences between observed and expected proportions across the digits. It does not depend on population size. Mark Nigrini's guidance, widely cited in forensic accounting, gives first-digit bands: below 0.006 is close conformity, 0.006 to 0.012 acceptable, 0.012 to 0.015 marginally acceptable and above 0.015 nonconformity. The bands are empirical rules of thumb, not statistical critical values, so treat them as a screening aid.

Worked example

All numbers are illustrative. A company has 1,000 vendor invoices for the year. The approval policy requires a second approver for invoices of $10,000 or more.

Observed counts sum to 1,000. For digit 9: p = 0.110, e = 0.04576, so |p - e| = 0.06424. The continuity correction is 1/2,000 = 0.0005. The standard error is sqrt(0.04576 x 0.95424 / 1,000) = 0.006608. z = (0.06424 - 0.0005) / 0.006608 = 9.65.

Summing the nine gaps gives 0.1285, and MAD = 0.1285 / 9 = 0.0143, in the marginal band. The overall MAD alone would not alarm anyone. The digit-level view does: a spike at 9 (11.0 percent against 4.6 percent expected) and a shortfall at 1.

The pattern fits invoices written just under the $10,000 approval limit, with the missing items from digit 1 being amounts that would otherwise have been $10,000 and above. This is a hypothesis, not a finding.

Follow-up

1. Extract the 110 invoices beginning with 9 and sort by amount. How many are between $9,000 and $9,999?
2. Group by vendor, approver and date. Concentration in one vendor or one approver sharpens the lead.
3. Look for splitting: several invoices to one vendor on the same or adjacent days that together exceed $10,000.
4. Test a sample for support, receiving evidence and approval.
5. Document what was found, including a clean explanation if there is one. A vendor may legitimately bill in a fixed band.

Using it in the audit

• Journal entries. Screening the amounts of manual entries can identify entries to examine within journal entry testing.
• Risk assessment. Run it on expense reports, vendor payments and credit memos as part of the fraud risk assessment under AU-C 240. See fraud risk assessment.
• Sample selection. Use the digit or amount band that deviates as a targeted selection, a form of key item testing.
• Documentation. Record the population, completeness check, fields used, the test, the results and the follow-up. See audit data analytics.

Run the test yourself with the Benford's Law analyzer.

Common mistakes

• Running the test on a population that cannot conform and reading the result as evidence.
• Treating a nonconforming result as proof of fraud rather than a pointer.
• Using the digit test only and missing round numbers and threshold clustering.
• Ignoring population completeness: a partial extract can distort the digits.
• Testing too few items.
• Not documenting why exceptions have innocent explanations.

FAQ

Does Benford's Law prove fraud?

No. A departure is a reason to look, not a finding. Many legitimate datasets do not conform.

How many records do I need?

Enough for the proportions to be stable. Hundreds is workable for the first digit; the first-two-digits test needs more.

What is a good MAD value?

Under common guidance for the first digit, below 0.006 is close conformity and above 0.015 is nonconformity. These are rules of thumb.

Which fields should I test?

Fields that arise from many independent transactions: invoice amounts, payments, journal entry amounts and expense claims.

Is Benford's Law audit evidence?

By itself it identifies items to examine. The evidence comes from the follow-up procedures on the selected items.

Sources

• Benford, F., The Law of Anomalous Numbers, Proceedings of the American Philosophical Society (1938); Newcomb, S., Note on the Frequency of Use of the Different Digits in Natural Numbers, American Journal of Mathematics (1881)
• Nigrini, M., Benford's Law: Applications for Forensic Accounting, Auditing, and Fraud Detection (Wiley, 2012), conformity bands for mean absolute deviation (as described in Severe Testing of Benford's Law and the R benford.analysis documentation)
• AICPA, AU-C section 240, Consideration of Fraud in a Financial Statement Audit

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error