Benford's Law: Finding Anomalies in the Ledger

Take any large set of naturally occurring amounts, such as invoices, expense claims, payments or sales, and count how many begin with each digit. Intuition says each of the nine digits should lead about 11% of the time. In reality, about 30% begin with a 1, 18% with a 2, and fewer than 5% with a 9. The pattern is so regular that its absence is a signal.

A strange law with a simple reason

The astronomer Simon Newcomb noticed it in 1881, when the first pages of logarithm tables were far more worn than the last. The physicist Frank Benford tested it in 1938 on more than 20,000 numbers, from river areas to street addresses, and it now carries his name. The expected share of numbers starting with digit d is log₁₀(1 + 1/d).

The reason is scale. Amounts that grow by percentages, and that span several orders of magnitude, spend more time starting with 1 than with 9: a balance growing at 10% a year takes seven years to go from 1,000 to 2,000, but just over one year to go from 9,000 to 10,000. Most financial data have exactly this property, which is why auditors can use the law as a baseline.

From curiosity to audit tool

In the 1990s the accountant Mark Nigrini showed how to apply it systematically to accounting data, and digital analysis is now part of the toolkit of external auditors, internal audit departments and forensic accountants. Researchers have applied it to public data too: a 2011 study by Bernhard Rauch and colleagues found that Greece's macroeconomic statistics deviated from Benford's law more than those of any other euro area country, in the years before its revised deficit figures shook the markets.

In this simulated ledger of 12,000 supplier invoices, every digit follows the law closely except one: 13.4% of invoices start with a 4, against 9.7% expected. The overall measure of fit, the mean absolute deviation, is 0.0085, which Nigrini's thresholds would still classify as acceptable conformity. A single summary statistic can pass while a specific digit is shouting. The analysis has to look at the digits, not just the score.

Following the anomaly

The next step is to zoom in. The first-two-digits test, or simply a histogram of the amounts around the suspicious range, usually tells the story.

Invoices crowd into the band just below 5,000, the limit above which a second approval is required. That is the signature of split purchases: a 15,000 order entered as four invoices of 4,800 to avoid the approval. It is not proof of fraud. It may be a buyer avoiding paperwork, a supplier invoicing by delivery, or a policy limit set too low. But it is a precise question to ask, about a precise set of transactions, which is what audit resources need.

Using it well

• Choose data that should conform: many transactions, spanning several orders of magnitude, not assigned numbers. Invoice numbers, prices set by policy, or amounts with a fixed minimum and maximum will not follow the law.
• Test by population: by supplier, approver, business unit or month. An anomaly diluted in the whole ledger can be obvious in one cost centre.
• Combine it with other tests: duplicate amounts, round numbers, amounts just below thresholds, weekend postings.
• Treat results as leads, not conclusions. The value of the method is that it tells auditors where to look in a population too large to read.