Fraud detection techniques in forensic accounting fall into a few families: digit tests such as Benford's law, duplicate and gap tests, ratio and trend analysis, and human work such as interviews and document review. Each finds one kind of problem in one kind of data, and each can mislead when applied to the wrong data.
Which fraud detection techniques do forensic accountants rely on?
Forensic accountants rely on four families of technique: statistical tests on digits and amounts, rule-based tests for duplicates and gaps, comparisons across time and peers, and non-data work such as interviews. A good engagement combines them, because the techniques cover different blind spots.
The families in one line each
- Digit and distribution tests ask whether the pattern of numbers looks like real activity. Benford's law is the best known.
- Duplicate and gap tests look for repeated payments and missing numbers in a sequence.
- Ratio and trend techniques compare a figure with its past or with similar businesses.
- Interviews and document review supply the context that numbers cannot.
A table of techniques
The table summarizes each technique with the data it needs, what it can detect and where it breaks. It is a planning aid, and every row has exceptions.
| Technique | Data needed | What it can detect | Where it fails |
|---|---|---|---|
| Benford's law, first digit | Hundreds of amounts that span several orders of magnitude | Invented or manipulated amounts; unusual clusters | Small sets, assigned numbers, capped or narrow-range amounts |
| Duplicate tests | Payee, amount, date, reference | Double payments, repeated invoices | Legitimate repeats such as rent and subscriptions |
| Gap tests | A numbered sequence such as checks | Missing, voided or hidden items | Items outstanding or issued out of order |
| Ratio analysis | Two or more related totals | Expense or margin that moves out of line | Businesses that change legitimately |
| Trend analysis | Several periods of the same measure | Steady growth in one payee or cost | Seasonality, one-off events |
| Peer comparison | Reliable data from similar entities | Outliers against the group | Few or poor comparators |
| Interviews and document review | People and source documents | Intent, approval, existence of goods | Witnesses who are unavailable or unreliable |
Techniques find leads
Every technique produces a list of items to examine. None of them proves fraud. The step from a flagged item to a conclusion needs documents and often a person's explanation. Statements are one data source for all of this, and the first step is confirming that a statement is real, which the tests for fake or altered bank statements cover.
Benford's law in forensic accounting: first-digit tests
Benford's law says that in many naturally occurring sets of numbers, the first digit is 1 about 30 percent of the time and 9 under 5 percent of the time. A first-digit test compares the digit frequencies in a data set with those expected values and flags a set that departs from them.
The expected frequencies
The expected share of leading digit d is the base-10 logarithm of 1 plus 1/d. This gives the following values.
| First digit | Expected frequency |
|---|---|
| 1 | 30.1% |
| 2 | 17.6% |
| 3 | 12.5% |
| 4 | 9.7% |
| 5 | 7.9% |
| 6 | 6.7% |
| 7 | 5.8% |
| 8 | 5.1% |
| 9 | 4.6% |
The reason is that quantities which grow by percentages spend longer in ranges starting with 1 than in ranges starting with 9. Moving from 1,000 to 2,000 takes a 100 percent rise, while moving from 9,000 to 10,000 takes about 11 percent.
How to run the test
- Choose a field, such as the amounts of payments to all vendors in a year.
- Take the first non-zero digit of each amount, ignoring signs and decimals.
- Count how often each digit appears and convert the counts to percentages.
- Compare with the table above and measure the gap for each digit.
- Investigate the digits with the largest gaps by pulling the transactions that start with them.
What a flag looks like
Here is an example. A set of 2,400 payments shows a 5 as the leading digit in 14 percent of cases, against an expected 7.9 percent. An analyst pulls every payment starting with 5 and finds a cluster between 5,000.00 and 5,200.00 sent to a few payees, just under a 5,250.00 approval limit. The test did not prove anything; it pointed to a band of amounts, and the band led to a control weakness worth questioning.
Reading the size of the gap
With small samples, digit frequencies move around by chance, so a gap that looks large may mean nothing. Statistical tests such as chi-square or the mean absolute deviation put a number on the gap, and the larger the data set, the more weight a gap deserves. State the sample size in your workpaper, and do not report a flag as significant without it.
What do duplicate and gap tests add to forensic techniques?
Duplicate and gap tests add exact, rule-based checks that need no statistics. A duplicate test finds repeated payments, and a gap test finds numbers missing from a sequence. They suit bank data because every statement line has a date, an amount and often a check or reference number.
Duplicate tests
A basic duplicate rule flags lines with the same payee and amount within a short window. Variants relax one field: same amount and date with different payee text, or same payee and a near amount. Duplicates can signal an invoice paid twice, a payment re-sent after a failure, or an employee paying the same fake invoice twice. The details of choosing rules are in duplicate transaction rules by payee, amount and date.
Gap tests
Sort the check numbers that cleared and list the numbers that did not. Missing numbers fall into three groups: checks still outstanding, voided checks, and checks that were issued but never recorded. The third group is the one that matters, and you can only separate it from the others by comparing with the register and the voided-check file. Gaps in invoice or purchase-order numbers work the same way.
Where bank data helps
Most statements print check numbers and amounts, so both tests can run on extracted statement lines. PreciseBankFlow lists lines that share a payee, amount and close dates, along with gaps in check sequences, and gives each exception its supporting lines for you to confirm. The conclusion on each exception stays with you.
What these tests do not do
A duplicate test misses a double payment with different amounts. A gap test misses fraud that uses the existing numbers. The more clever the scheme, the less it looks like a repeat or a hole.
Ratio and trend techniques for forensic fraud detection
Ratio and trend techniques compare a figure with another figure or with its own history, and flag movements that the business cannot explain. They work on summarized data, so they suit a first pass before you look at individual lines.
Ratios that tell a story
Useful ratios include cost of sales as a share of revenue, a given expense as a share of revenue, and receivables to sales. If revenue rises 5 percent and one expense line rises 40 percent, that line gets a closer look. In bank data, compare total payments to a payee with the total of the related invoices or purchase orders.
Trend analysis
Total a measure by month and plot it. Look for a payee whose payments rise every month, cash withdrawals that start in one month and continue, or deposits that fall while sales are flat. Trend tests find slow schemes that look ordinary on any single day.
Peer comparison
If you have reliable figures for similar businesses, compare margins and expense shares. Do this with care. A business with different pricing, a different customer mix or a one-off event will look like an outlier for honest reasons.
Worked example
Take a small company where monthly payments to one supplier were 8,000, 8,200, 8,100, then 9,600, 11,800 and 14,500, while its purchases in units stayed flat. The ratio of payments to units is up by almost 80 percent over three months. That is the question to put to the buyer and the supplier, not an accusation.
When Benford's law testing does not apply
Benford's law testing does not apply when the numbers are not the kind that follow the pattern. A test on the wrong data produces a flag that means nothing and can send a review down a wrong path. Check the data against the conditions before you run the test.
Data sets it fails on
- Assigned numbers. Check numbers, invoice numbers, account numbers and phone numbers are labels, not quantities.
- Narrow ranges. Prices set between 50 and 99, or fees fixed by a schedule, do not span several orders of magnitude.
- Small samples. A few dozen amounts cannot show a stable pattern.
- Capped or thresholded amounts. Payments limited by an approval rule, a minimum or a maximum bunch up artificially.
- Heavily rounded data. Amounts that are mostly round numbers, as in a business billing flat fees, depart from the law with no fraud involved.
- Data from a single source with one price. A subscription business with a few price points will fail.
A practical rule
Ask whether the amounts arise from multiplying and growing, such as sales, expenses and balances, and whether there are hundreds or thousands of them. If the answer to either is no, choose another technique. A departure from Benford's law is only an unusual distribution. Honest data can show it, and fraud can leave a perfect fit when the forger knows the law.
Interviews and document review alongside forensic data techniques
Data techniques tell you where to look. Interviews and document review tell you what happened, because they supply approvals, intent and the existence of goods and services. A flagged payment that the buyer explains and the contract supports is closed. One that nobody can explain is the start of the real work.
Document review
For each flagged item, trace the paper trail: the purchase order, the delivery record, the invoice, the approval and the payment. Check that each document is dated in order and signed by the right person. If you need to rely on a statement that anyone supplied, verify it with the bank first.
Interviews
Interview in a sensible order, starting with people far from the suspected person and finishing with those closest. Ask open questions about how a process works before you ask about the item. Record who said what. Interviews should be done by someone qualified, and the choices about timing and tone belong to the engagement partner and counsel.
Why data alone is not enough
A pattern in the data can have an ordinary cause that only a person knows, and a real fraud can sit outside the patterns your tests were built for. Combining the families is more reliable than any one, which is also why tooling should support the analyst. What to ask of such tooling is covered in what forensic accounting software should prove, and the matching engine behind some of the tests is explained in transaction matching software and what it does.