Unusual Patterns via Benford's Law
Written by Michelle Henley
Updated at October 24th, 2024
Table of Contents
Use Case:
Employee expense reports are a critical area for monitoring company spending and ensuring compliance with financial policies. The Unusual Patterns via Benford's Law risk analytic applies Benford's Law, a widely accepted statistical principle frequently used in forensic accounting and fraud detection. Benford's Law predicts that in naturally occurring datasets, lower digits (such as "1") are more likely to appear as the first digit than higher digits (such as "9"). This pattern holds true across various financial datasets, making it a powerful tool for identifying anomalies.
If an employee’s expense reports consistently deviate from this expected distribution—such as showing an unusually high frequency of amounts starting with "9"—it could indicate manipulation, like inflating or deflating expense values. The Unusual Patterns via Benford's Law Analytic flags this deviation from the expected distribution of first digits. Upon review, the compliance team investigates and discovers the employee has been inflating expense amounts to avoid scrutiny, helping prevent further misuse of company funds.
Benford's Law is a trusted method in financial analysis and is commonly used by auditors, regulators, and forensic analysts to detect fraud, errors, or manipulation in datasets, including expense reports, financial statements, and transaction logs. This analytic allows users to choose between analyzing the first or the first two significant digits of transaction values, offering flexibility and greater precision in detecting deviations from the expected distribution. By leveraging Benford’s Law, organizations can uncover potential fraud or manipulation early, ensuring the integrity of financial transactions and compliance with policies.
| Description | Identifies transactions linked to an entity that has a history of transactions with a measure that does not conform to Benford’s Law (also known as the law of anomalous numbers), which is a probability distribution for the first significant digits found valid for many real-life sets of numerical data, including financial transactions. |
| Domain(s) | Employee |
| Analysis Type | Indicator |
| Focus Area | Statistical |
| Score Methodology | Number of match occurrences, within the configured historical period of data, for the configured entity with non-conforming leading digits. |
Default Scoring Criteria
Importance: 3 (default)
Enabled: True (default)
No rules are configured by default. Rules must be set by user.
Rule Configuration
To configure a rule for this risk analysis, open the settings page from Risk Analysis Settings → Unusual Patterns via Benford's Law (Employee Domain) and click Add A Rule.
The following rule fields are required:
| Rule Field | Description |
|---|---|
| Name | Name for the specifc rule |
| Description | Description of the rule |
| Measure | Transaction Amount, USD Transaction Amount, Transaction Amount (Currency Cohort), Transaction Amount USD (Company Cohort), Transaction Amount (Company Country Cohort) |
| First Significant Digits | First digit, or First Two Digits |
| Context Period in Days | 1-365 Days |
| Entity | Subject |
| Minimum Transactions to Preform | 5,000 - 500,000 |
Next, click Add A Rule Component.
To set a component, select from the Field and Search Type drop-down lists.
The Value field will appear once a Field and Search Type are selected.
Below is a description of each Field & Search Type and Value available:
| Field | Search Type | Value Type |
|---|---|---|
| Approved Amount USD |
Greater Than or Equal To OR Less Than or Equal To |
Dollar Amount |
| Company | Includes OR Excludes | List is populated from customer data* |
| Employee | Includes OR Excludes | List is populated from customer data* |
| Employee Work Country | Includes OR Excludes | Preset List of Countries |
| Expense Customer Field 1 | Includes OR Excludes | List is populated from customer data* |
| Expense Customer Field 2 | Includes OR Excludes | List is populated from customer data* |
| Expense Type | Includes OR Excludes | Preset list. |
| Expense Type (Detailed) | Includes OR Excludes | List is populated from customer data* |
| HCP Purpose | Contains OR Does Not Contain | Free text |
| Itemization Custom Field 1 | Includes OR Excludes | List is populated from customer data* |
| Itemization Custom Field 1 | Includes OR Excludes | List is populated from customer data* |
| Merchant Category Code | Includes OR Excludes | Preset List |
| Merchant Category Group | Includes OR Excludes | Preset List |
| Merchant Country | Includes OR Excludes | Preset List of Countries |
| Original Transaction Amount USD |
Greater Than or Equal To OR Less Than or Equal To |
Dollar Amount |
| Payment Method | Includes OR Excludes | Preset List |
| Personal Expense | Includes OR Excludes | Yes/No |
| Report Custom Field 1 | Includes OR Excludes | List is populated from customer data* |
| Report Custom Field 2 | Includes OR Excludes | List is populated from customer data* |
| Subject Classification | Includes OR Excludes | List is populated from customer data* |
| Vendor Name | Contains OR Does Not Contain | Free Text |
*For values populated from customer data, value lists will not populate if data is not available.
Note: Where multiple rule components are set, they operate only in an “and” manner.
Unique Configuration
This analysis utilizes rules configured by the user, for which they can configure the following:
|
Measure - the measure used to identify/parse the first significant digits from (after rule components are applied. Options are:
|
|
First Significant Digits - the number of first significant digits to extract and compare to the expected probability according to Benford’s Law. Options:
|
| Context Period in Days - the period of time, from the impact date, for which transactions are considered by the rule. Can choose 180 to 1440 months (default is 365 days). |
| Context Period in Months - the period of time, from the impact date, for which transactions are considered by the rule. Can choose 6 to 48 months (default is 48 months). |
|
Entity - the entity for which to sum up the occurrences (of non-conforming transactions) over the context_period within the rules population. Options:
|
|
Confidence Interval - used to calculate a range around the expected frequency for the first significant digits. The higher the confidence interval, the tighter the range around the expected frequency. Options:
|
|
Minimum Transactions to Perform - a value that serves as the minimum number of transactions returned by the rule components to perform the Benford’s Law check (rules that are too narrow and return fewer transactions are ignored). Options:
|
|
Rule Components - specific restrictions, by field, to limit the transactions that are considered by the rule.
|
| Scoring Criteria based on the number of occurrences found for non-conforming first significant digits (per entity configured) within the historical period of time for the rule components (Strong, Moderate, and Weak values can be set). |
| Automatic Criteria - transactions that meet this criteria will appear in Monitoring Review results regardless of Risk Engine Score. |
Exclusions
Items noted as “no longer valid” are excluded from the historical data.
The customer is welcome to share exclusions, excluded only after determining a risk result, for the following fields:
- Materiality (Customer Configured): Amount USD is less than [$X,XXX].
-
Vendor Classification 1 - A source system classification that typically provides deeper insight into the subject, such as a line of business or possibly a special designation useful to a variety of operations within a company (e.g., risk level designation). Note, this value may be equivalent to the subject type or 'Not Specified' when a value is not available.
- Values to Exclude: [XXX, XXX, XXX]
-
Transaction Type - The high-level classification of the transaction, enabling a basic understanding of the impact to the company. This is a harmonized value created by Lextegrity using logic in coordination with the customer.
- Values to Exclude: [XXX, XXX, XXX]
-
Transaction Type (Detailed) - A more detailed understanding of the transaction, specifically the original expense type used in the source system.
-
Values to Exclude: [XXX, XXX, XXX]
-
Values to Exclude: [XXX, XXX, XXX]