Fighting fraud by the numbers: Digital analysis primer

Many new fraud examiners know that they need to use digital analysis in their cases but they also need some guidance through the maze. Here's some practical advice from your experienced colleagues.  

Unique Fashions Inc. owns and operates retail clothing stores for women nationwide. The company builds and maintains all its retail stores. Each store manager is authorized to spend up to $5,000 per quarter on store maintenance. These expenditures include things such as repairing broken store windows, and fixing air conditioning and heating problems, roofing problems, plumbing problems, etc. The maintenance expenditures are captured store by store.1 

Two years ago, to establish baseline data, the internal auditors of Unique Fashions decided to analyze the maintenance expenditures using digital analysis. During their analysis they had determined the pattern of the typical distribution for maintenance expenditures per quarter per store: 30 percent of the expenditures range from $1 to $1,250; 50 percent from $1,251 to $2,500; 15 percent from $2,501 to $3,750; and 5 percent from $3,751 to $5,000. This year's analysis of maintenance expenditures revealed that store No. 156 had 47 percent of its maintenance expenditures in the $1 to $1,250 range. This store was scheduled for an internal audit visit.

Suspecting fraud, the internal auditors included a CFE on their audit team. The CFE's investigation revealed that Miss Jones, the store manager, was participating in a kickback scheme with her brother-in-law who owns a heating and air conditioning company. Without the digital analysis of the maintenance expenditures account, this fraud possibly would have never come to light.

Interviewing the experts
As many of us know, the ACFE's Report to the Nation on Occupational Fraud and Abuse estimates that U.S. organizations alone lose $660 billion annually to fraud. These are sobering statistics. How can Certified Fraud Examiners, forensic accountants, internal auditors, and loss prevention professionals help in the fight against fraud? One way is to use digital analysis. Digital analysis has the potential to detect and deter fraudulent activities; it also can be used for testing internal controls, can help identify operational inefficiencies and efficiencies, and can also provide a tool for continuous monitoring of selected data.

To learn how digital analysis can help detect and deter fraud, we interviewed these experienced digital analysis practitioners: Mark Burr, staff claim auditor at State Farm Insurance Companies in Bloomington, Ill.; Scott Curtis, CFE, fraud examiner and manager of forensic technology and discovery services at Huron Consulting Group in Chicago, Ill.; Michael Eraci, director of internal audit at McDonald's Corporation in Oak Brook, Ill.; John Krueger, senior manager of business risk services at Ernst & Young in Cleveland, Ohio; and John Langione, CFE, senior manager of business risk services, at Ernst & Young, in New York City, N.Y. (The opinions expressed here are those of the interviewees and don't necessarily reflect the opinions of their employers.) These practitioners defined digital analysis, discussed its strengths and weaknesses, and offered advice about getting started with digital analysis.

What is digital analysis?
"Digital analysis is a process for analyzing data sets to identify non-conforming patterns and deviations within the data, with the intent of finding the cause of the deviations," said Curtis. According to Langione, "digital analysis is based on the premise that operational inefficiencies, noncompliance with internal controls, and fraudulent activity will usually show up as irregular patterns in the data." Burr said, "people who commit fraud tend to fall into patterns. Digital analysis provides a means to detect those patterns." Digital analysis, therefore, has many potential applications for CFEs, forensic accountants, internal auditors, and loss prevention specialists. To better understand the subject, let's look at a few examples of digital analysis techniques.

Benford's Law
Benford's Law, one of the most popular and widely publicized digital analysis techniques, was developed in the 1920s by General Electric physicist Frank Benford. He noticed that he was using the first pages of his book of logarithm tables much more frequently than the last pages. Benford hypothesized that in a large data set there should be more numbers that start with a low first digit than a high first digit. The term "first digit" refers to the far-left digit of a number. For example, in the number 476, four is the first digit, seven is the second digit, and six is the third digit.
Benford empirically demonstrated that in a large data set the distribution of the first digit frequencies, from 1 to 9 respectively, is as follows:

This means that the number 1 as the first digit of a number will appear 30 percent of the time in a large data set while the number 9 as a first digit will appear only 4.6 percent of the time. Benford also developed a distribution of frequencies for second, third, and fourth digits. For a table of digit frequencies, see the table below.

Benford's Law: Expected Digital Frequencies 

Position in Number

Not all data sets will conform to Benford's Law. For Benford's Law to apply, the data set must be a large one and consist of random numbers. On the other hand, Benford's Law wouldn't apply in the following situations:

• when numbers are assigned (for example, phone numbers or social security numbers); and
• when there are built-in maximums or minimums in the data (for example, a group of purchase orders in which a purchasing agent can only approve a purchase up to a maximum of $5,000).

For additional discussion of non-conforming data sets, see Mark J. Nigrini's book, "Digital Analysis Using Benford's Law," published in 2000 by Global Audit Publications, and available through the Institute of Internal Auditor's Web site, www.theiia.org. Another good resource is "Using Benford's Law to Detect Fraud," a workbook with a CD-ROM in the ACFE Bookstore at www.ACFE.com.

Benford's Law has many practical applications. For example, you're analyzing a data set of cash disbursements. As long as Benford's Law applies to the data set, the list of first digit frequencies presented previously should apply. After running a Benford's Law analysis of the cash disbursements data set, if the number 6 as a first digit appears 10 percent of the time, this would raise a red flag because Benford's Law predicts it should appear only 6.7 percent of the time. Upon investigation, you may discover that a fraudster has been writing unauthorized checks that start with the number 6. The fraudster may have believed that no one would investigate checks written in the $6,000 range because they would be immaterial. On the other hand, you may discover a legitimate reason for the high occurrence of the number 6 as a first digit. The company may have numerous rental properties and the rent is always in the $6,000 range.

Relative size factors
In the relative-size factor test, a ratio is computed. The largest number in the data set is divided by the second largest number. This test is often used in the accounts payable area. Suppose the highest accounts payable amount paid to vendor RRT for the month of November is $1,200. The second-highest payment to this vendor during the month is $1,000. This would result in a relative-size-factor ratio of 1.2 for vendor RRT for November. In December, however, this same relative-size-factor test yields a ratio of 12 ($12,000 high payment divided by $1,000 second highest payment). Obviously, this large change in the ratio needs to be investigated. You may discover that a decimal point was inadvertently moved one place to the right, resulting in a $12,000 rather than a $1,200 payment. This type of analysis can be done vendor by vendor on a month-by-month basis.

Other tests
The last-two digits test is another example of how digital analysis can be used. According to Benford's Law, as one investigates the far-right digits of a number (that is, the third and fourth digits) there's an approximate equal probability of each far-right digit occurring. (Again, see the chart above.) For instance, the last-two digit combinations of 00, 01, 02 through 99 have approximately a 1 percent chance of occurring. If the data set shows a last-two digit distribution different from this expected 1 percent pattern, then you may need to do follow-up analysis. For example, assume the last two digits, 00, occur 4 percent of the time in the data set. This could indicate that there's excessive rounding taking place. For example, employees who count inventory may not be performing precise counts but are instead estimating the count to the nearest round number. If the last two digits, 99, appear more than expected in the data set, employees may be trying to avoid a pre-set dollar limit. If purchasing contracts of $10,000 and above require another level of approval, purchasing agents may be writing contracts for $9,999 to avoid management scrutiny. Any other last-two digits combination that shows up more than anticipated could indicate fraudulent numbers and would probably trigger an investigation.

Limitations of digital analysis
Accessing the data
To use digital analysis effectively, you must know its limitations. "Getting the data into a format to run the digital analysis can take a significant amount of time and energy," said Eraci. Therefore, you need to be aware that accessing the data for the first time may be an arduous and lengthy process.

False positives
All the interviewees emphasized that the biggest drawback to digital analysis is the number of false positives it might produce. To illustrate a false positive, assume that you analyze a data set using Benford's Law, but the digit distribution predicted by the law isn't met. Therefore, you decide to investigate the anomaly in the data. The follow-up investigation indicates that there's a legitimate reason for the spike in the data. For example, the first digit "2" may have appeared in the data set 26 percent of the time when Benford's Law says it should appear only 17.6 percent of the time. (Again, see the chart above.) Your investigation reveals that the company regularly pays a $2,500 expense each month. This $2,500 expense explains the anomaly in the data and, thus, is an example of a false positive.

CFEs, fraud examiners, internal auditors, and loss prevention specialists all have an important role to play in the fight against fraud. However, all the interviewees agreed that internal auditors are in the best position to avoid the problem of numerous false positives. This is because they know the company, know the business risks, know the control risks, and know the data sets within the company. "Internal auditors know how data is accumulated within a company's information system. An established internal auditor can utilize a detailed operating knowledge of the organization to more efficiently identify high fraud-risk transactions," said Langione. According to Curtis, "as a forensic accountant, data is just data. But, a knowledgeable internal auditor can help a forensic accountant really understand how the company's operations are reflected in the data. As little as a half hour with an internal auditor is extremely valuable."

You need to narrow the data set before performing digital analysis. "The temptation is to take an entire population of data and run digital analysis," said Langione. This will usually generate too many false positives. You may want to consult with an internal auditor before you select the data you want to analyze. This is because internal auditors, due to their knowledge of the business, have the ability to pull out an appropriate subset of the data for analysis. Analyzing subsets will generally greatly reduce the number of false positives. For example, when analyzing homeowner casualty insurance claims data, you might look at only the claims data for similar-size Midwestern cities. This is because claims data in the more rural Midwest follow a different pattern than claims data on the East and West Coasts.

Follow-up time
A second limitation to digital analysis is the follow-up time required to investigate anomalies in the data set. Curtis said, "with digital analysis, you can analyze millions of data points in a matter of minutes. Unfortunately, you can get a lot of false positives and it can be extremely time-consuming investigating all of the data anomalies." Krueger provided a second example, from an external audit perspective, of the onerous follow-up time that can result due to the use of digital analysis. "External auditors may not use digital analysis for a financial statement audit because it presents them with too many data anomalies," Krueger said. "External auditors need to get comfortable that there is no material misstatement of the financial statements, and then they move on. Therefore, digital analysis is more effectively used by internal audit departments that have the time to dig through the data anomalies and investigate them."

To summarize the limitations of digital analysis, all the practitioners emphasized two points. First, you must narrow your data sets before running Benford's Law to limit the number of anomalies in the results. Second, you must understand that following up on the data anomalies can take a significant amount of time. However, according to Curtis, "The follow-up work is where the real value comes in."

Advantages of Digital Analysis
All data analyzed
Even though looking at 100 percent of a data population may generate numerous false positives, there may be instances when you may wish to do just that. Therefore, an important advantage of digital analysis is that it can allow you to look at 100 percent of the data. With appropriate software, millions of data points can be analyzed in a short period of time. "Digital analysis lets you look at the whole population, rather than a sample. Therefore, it is easier to justify your findings and make recommendations to management when you've looked at 100 percent of the population," said Eraci.

Unbiased look at data
"Digital analysis gives you an unbiased look at the data," Burr said. This is important if you're proactively looking for fraud at your organization. You may have a preconceived notion as to what types of frauds might be taking place and what the digital analysis might reveal. However, the digital analysis software has no built-in biases and therefore takes a totally unbiased look at the data. It may reveal a data pattern that you didn't anticipate at all. As a result, you may discover new and unusual frauds.

Helps plan internal audit scope
"A good application of digital analysis could be in the initial determination of your audit scope," said Burr. Digital analysis can identify potential problem areas. When planning an audit, the internal auditor can focus on these identified areas. "Digital analysis, if done properly, can be a very effective way to audit efficiently," said Eraci. In a similar fashion, fraud examiners can use digital analysis to sharpen the focus of their investigations.

Continuous monitoring
Digital analysis provides organizations with an excellent tool for continuous monitoring. Assume that you've identified a subset of data, you've run digital analysis on it, and you've spent the necessary time to follow up on all the data anomalies. At this point, this subset can serve as a base line for continuous monitoring. Another way to establish a base line is to regularly analyze a particular data set. For example, you could compare the current six months of data to the prior six months. The prior time period can establish the expected distribution against which to measure. This approach is particularly valuable if the data set isn't compliant with Benford's Law. In this way, the company's own unique data distribution becomes the base line. Using this approach, you can easily identify any spikes in the data from one time period to the next. If the data spikes can't be explained by shifting business conditions, then perhaps the data anomaly is an indicator of fraud. This means you can periodically replicate the digital analysis and compare the new results with the base-line results.

If there are no new data anomalies, generally you won't need to follow-up. This notion of continuous monitoring is extremely valuable in organizations that have numerous sub-units and far-flung global operations. If the organization has a computer system that will allow you to run the data analysis from your home office, digital analysis can be an extremely valuable continuous monitoring tool. On the other hand, if the computer system won't support this type of centralized analysis, you can teach the digital analysis techniques to the operating unit personnel so they can run the digital analysis themselves. Since internal controls are the responsibility of management, this distributive approach to continuous monitoring gives management ownership of the internal control process.

Deterrent value
The benefits of digital analysis usually outweigh the costs. Digital analysis can have a significant value as a fraud deterrent because "even if you don't find any fraud using digital analysis, people understand that you are looking for it," Burr said.

How do I get started?
Is it difficult to get started with digital analysis? All interviewees answered, "No." In fact, four of our digital analysis practitioners taught themselves the technique. Mark Nigrini's book, "Digital Analysis Using Benford's Law," provides an excellent overview of digital analysis. ACFE resources include the "Using Benford's Law to Detect Fraud" workbook and CD-ROM and "Digital Evidence and Computer Crime," by Eoghan Casey.

The interviewees suggested attending a continuing education course on digital analysis. They also emphasized it's critical to be familiar with the software package you'll be using to perform digital analysis. All interviewees thought ACL is a good package because it has a built-in Benford's Law feature. Burr mentioned that ACL has both a PC version and a server version. Other software packages that can be used for digital analysis include MS Access, Idea, and DATAS (digital analysis tests and statistics). Curtis said that when getting started with digital analysis, it's important to know how the data is stored and how to access it. However, he emphasized that, "the real skill is in designing the test and breaking the data into an appropriate subset for testing."

Tool for all
Summarizing, all interviewees agreed that digital analysis is an effective tool in the fight against fraud because it can help to both detect and deter fraudulent activities. However, all emphasized that digital analysis does have drawbacks. Probably the most significant drawback is the number of false positives that digital analysis can produce. Other drawbacks include difficulty in accessing data and the follow-up time needed to investigate data anomalies. On the other hand, digital analysis has several significant positive aspects. These aspects include the ability to:

• look at 100 percent of a data set;
• take an unbiased look at the data set;
• better plan internal audit scope;
• continuously monitor operations; and
• potentially deter fraudulent behavior.

Digital analysis is a tool that every anti-fraud professional can use in the fight against fraud.

Linda M. Leinicke, Ph.D., CPA, is professor of accounting at Illinois State University in Normal, Ill.

Joyce A. Ostrosky, Ph.D., CPA, CMA, is professor of accounting at Illinois State University in Normal, Ill.

W. Max Rexroad, Ph.D., CPA, is emeritus professor of accounting at Illinois State University in Normal, Ill. 

The authors acknowledge Lauren Setterlund, a master's student at Illinois State University in Normal, Ill., for her contributions to this article.

1 This is a fictitious example drawn from real cases.