Benford’s Law Used in Auditing: Methods, Tests, and Limits

Benford’s Law in auditing is a screening technique that compares the leading digits of numbers in a financial data set against a predicted logarithmic distribution, where 1 appears first about 30% of the time and 9 only about 5%. When the actual frequencies drift too far from that pattern, something has distorted the data — fraud, systemic error, or sloppy entry — and the auditor knows which slice of transactions to pull for closer review. The test doesn’t prove misconduct. It narrows the field.

What Benford’s Law Predicts

The probability that any digit d appears as the leading digit in naturally occurring numerical data equals log₁₀(1 + 1/d).¹ That formula produces these expected frequencies for the first digit:

1: 30.1%
2: 17.6%
3: 12.5%
4: 9.7%
5: 7.9%
6: 6.7%
7: 5.8%
8: 5.1%
9: 4.6%

If digits were evenly distributed, each would appear about 11.1% of the time. They aren’t, because a number starting with 1 has to double before its leading digit turns to 2, while a number starting with 9 needs only a small percentage increase to roll over to 1. Across any data set spanning multiple orders of magnitude, that asymmetry gives lower digits a longer run at the front of the number.²

The law also predicts distributions for second digits, third digits, and digit combinations, each of which can be tested separately.

Which Data Sets the Test Actually Works On

Misapplying Benford’s Law is a fast way to chase ghosts. For the test to be meaningful, the data has to meet several conditions.³

The numbers should come from real transactions or mathematical combinations of them (price times quantity, for example), not be assigned arbitrarily.
The data should span multiple orders of magnitude. A range of $12 to $985,000 works. A range of $48 to $52 does not.
There should be no artificial caps or floors. Per diem limits, policy spending thresholds, and minimum transaction amounts all constrain the natural distribution and will produce false positives.
Sample size matters. At least 1,000 records for a first-digit test, and ideally 5,000 or more for a first-two-digit test. Data sets below about 500 records are unreliable even when the numbers are legitimate.

Good candidates: general ledger balances, vendor payment files, accounts payable and receivable entries, revenue line items, inventory counts.⁴ Poor candidates: check numbers, invoice numbers, zip codes, phone numbers, or anything else generated sequentially or by formula.³ An auditor who runs the test on 200 expense reports and gets excited about a spike at digit 7 is probably just looking at noise.

Running the Test

The workflow is straightforward. Pull the data set, strip out non-numerical fields, isolate the leading digit of every amount, and tally how often each digit from 1 through 9 appears. Compare the observed frequencies against the expected Benford frequencies. Most audit analytics packages do this automatically and produce a histogram overlaying the actual bars on the ideal Benford curve.

The visual is the fastest read. Where the bars track the curve, the data looks normal. Where they diverge, spikes and valleys point to specific digits that are over- or underrepresented. If digit 5 is dramatically overrepresented, the auditor filters the population down to transactions starting with 5 and pulls documentation. Instead of sampling randomly across tens of thousands of transactions, you’re triaging the population into “probably fine” and “worth a closer look” before any substantive testing begins.

First-Digit vs. First-Two-Digit

Experienced auditors often skip straight to the first-two-digit test. A first-digit test divides the population into nine buckets, which is blunt. Testing the first two digits creates 90 buckets (10 through 99), giving a much sharper picture of where the data deviates.

The precision matters when someone is inflating legitimate entries. A $1,510 payment padded by 28% becomes $1,933; the first digit is still 1, but the first two digits jumped from 15 to 19, and a first-two-digit test picks up the shift.⁵

The follow-up sample also shrinks. In one journal-entry example, a first-digit spike at 5 would have required testing 8.9% of the population. Drilling into the first two digits showed the excess was concentrated at “50” (round-number entries), which represented only 2% of the population.⁵ That kind of reduction matters when you’re working through hundreds of thousands of records.

One quirk of accounting data: round numbers are common because humans estimate, negotiate, and price in multiples of ten. First-two-digit combinations like 10, 20, and 30 will often spike slightly even in clean data. Auditors learn to distinguish the background hum of rounding from the signal of manipulation.

Measuring Whether a Deviation Is Real

Eyeballing a histogram helps, but auditors also need objective measures to separate real deviation from random variation. Three tests are standard.⁶

Z-Statistic

The Z-test examines one digit at a time, asking whether the observed frequency of that digit differs significantly from what Benford predicts. A Z-statistic above 1.96 is significant at the 5% level. It’s useful for confirming a single suspicious spike, but it doesn’t evaluate the distribution as a whole.

Chi-Square Test

Chi-square evaluates the whole distribution at once. For a first-digit test, a chi-square value above 15.507 (at the 5% level, 8 degrees of freedom) indicates the overall distribution doesn’t conform.⁶ Its weakness is sensitivity to sample size: very large data sets can throw statistically significant chi-square values even when the practical deviation is trivial.

Mean Absolute Deviation

The Mean Absolute Deviation, or MAD, is generally treated as the most practical measure because it produces a single number to compare against established thresholds. Mark Nigrini, the forensic accountant who brought Benford’s Law into audit practice, proposed the following ranges for first-digit tests:⁶

0.000 to 0.006: close conformity
0.006 to 0.012: acceptable conformity
0.012 to 0.015: marginally acceptable conformity
Above 0.015: nonconformity

A MAD score in the nonconformity range signals a real problem worth investigating. The MAD is less sensitive to sample size than chi-square, which suits the large populations auditors typically work with. In practice, most auditors run the MAD and chi-square together and treat them as complementary.

Reading a Non-Conforming Result

A Benford deviation is a red flag, not a verdict. The next job is figuring out why the numbers don’t follow the expected pattern, and the answer isn’t always fraud.

The most common innocent explanation is rounding. If a company routinely prices services at $500, $1,000, or $5,000, the first-two-digit test will show spikes at 10, 50, and similar multiples without any wrongdoing. Duplicate payments, data entry errors, and bulk transactions at standardized amounts also distort the distribution. Flagging every deviation as suspicious without considering the underlying business process wastes time.

Some patterns are genuinely suspicious. Overrepresentation of 8s and 9s often points to transactions engineered to sit just below a review threshold; if purchases above $10,000 need a second signature, a fraudster writes invoices for $8,500 or $9,200.⁷ Underrepresentation of 1 can signal that smaller transactions are being deleted or diverted. Clusters at first-two-digit combinations that don’t correspond to any natural business pattern deserve particular scrutiny.

What follows is standard substantive audit work. Pull supporting documentation for the flagged transactions, trace them to source documents, verify approvals, and look for patterns in timing, vendor, or employee. Benford’s Law gets you to the right haystack. Finding the needle still takes traditional procedures.

Where It’s Used

Nigrini brought the method into mainstream practice with a Journal of Accountancy article in 1999, and it has since been adopted across government auditing, corporate internal audit, and regulatory enforcement.

Tax authorities use it to screen returns for anomalies. A taxpayer fabricating deductions or income is unlikely to unconsciously replicate the logarithmic pattern that genuine financial data produces, so returns whose digits don’t fit can be flagged for examination.

Government auditors have applied it at scale. In one documented study, auditors analyzed more than 13 million monthly payment records from a national welfare program to identify regions where withdrawal amounts deviated from the expected distribution and prioritize investigations accordingly.⁶

Internal auditors commonly run the analysis on vendor payment files as part of routine general ledger analytics. It’s particularly effective against fictitious vendor schemes, where an employee sets up a fake supplier and submits invoices. Amounts chosen by a person tend to cluster in ways that violate the Benford distribution.

Holding Up in Court

When Benford’s Law analysis moves from the audit file to the courtroom, the question is whether a judge will admit it as expert testimony. In federal courts, that’s governed by Daubert v. Merrell Dow Pharmaceuticals, which requires that scientific evidence be relevant and reliable. Judges look at whether the method can be tested, has been peer-reviewed, has a known error rate, and enjoys general acceptance in its field.

Benford’s Law fares well on those factors. The mathematics has been extensively tested, published in peer-reviewed journals across statistics, accounting, and forensic science, and is widely accepted among forensic accountants. In at least one federal criminal case, the court found that “Benford’s Law and the software used [by the expert] are generally accepted in the relevant community, have been tested, and have been subjected to peer review,” and admitted the testimony.⁸

The caveat is the same one that governs audit work. The analysis identifies anomalies, not guilt. A forensic accountant testifying about Benford’s Law results needs to present them as indicators warranting investigation, not standalone proof of fraud. Courts are more receptive when the Benford analysis is one layer of evidence supported by substantive findings from the follow-up work.

What Benford’s Law Won’t Catch

The test is a powerful first pass, but it has blind spots. A data set can conform perfectly and still contain fraud if the fraudulent transactions happen to mirror the natural pattern. A handful of fabricated entries scattered across digit ranges won’t move the distribution enough to trigger a deviation. Benford catches patterns of manipulation, not individual bad transactions.

It also can’t tell fraud apart from legitimate anomalies without follow-up work. A recent acquisition, a change in pricing structure, or a one-time event like a natural disaster can produce genuinely unusual digit distributions. Treating the analysis as a black box will lead to wrong conclusions.

And the technique only works on the data it’s given. If fraudulent transactions were booked to accounts the auditor didn’t select, or if the manipulation involves off-book activity, Benford’s Law won’t see it. It tests the integrity of recorded data, not the existence of data that was never recorded in the first place.

1
Wikipedia. Benford’s Law
2
ScienceDirect. Revisiting the Benford Law: When the Benford-Like Distribution of Leading Digits in Sets of Numerical Data Is Expectable?
3
ISACA. Understanding and Applying Benford’s Law
4
Carnegie Mellon University. Benford’s Law: Potential Applications for Insider Threat Detection
5
Journal of Accountancy. Using Benford’s Law to Reveal Journal Entry Irregularities
6
National Library of Medicine. A Benford’s Law Based Method for Fraud Detection Using R Library
7
Association of Certified Fraud Examiners. What Is Benford’s Law and Why Do Fraud Examiners Use It?
8
GovInfo. Case 1:13-cr-00966-JCH-SMV