Data Analysis Functions and Benford's Law
5 minutes
5 Questions
Within the CFE body of knowledge, data analysis functions are the core techniques fraud examiners apply with tools such as ACL, IDEA, Excel, SQL, or Python to detect anomalies in large transactional datasets. Key functions include: (1) Sorting and indexing, which arrange records to reveal outliers such as unusually high payments; (2) Filtering and extraction, which isolate records meeting suspicious criteria like weekend postings or round-dollar amounts; (3) Summarization and stratification, which group data by vendor, employee, or amount band to spot concentration or activity just under approval thresholds; (4) Duplicate testing, which identifies repeated invoice numbers, amounts, or addresses indicative of double payments or shell vendors; (5) Gap detection, which finds missing check or invoice numbers suggesting destroyed or diverted documents; (6) Joining and matching, which compare files—such as the vendor master against employee records—to expose conflicts of interest; (7) Aging and trend analysis, which highlight timing irregularities; and (8) Statistical sampling and regression, which support quantification of losses. Benford's Law is a specialized digital-analysis function. It states that in many naturally occurring numerical datasets, the leading digit is not uniformly distributed: 1 appears first about 30.1% of the time, 2 about 17.6%, declining to roughly 4.6% for 9. The expected frequency is log10(1 + 1/d). Fraud examiners compare the actual first-digit, second-digit, or first-two-digit distributions of amounts to these expectations. Significant deviations—for example, a spike in amounts beginning with 9 or 4—may indicate fabricated numbers, since people inventing figures tend to distribute digits evenly or favor certain digits. Benford's Law works best on large, unconstrained datasets spanning several orders of magnitude, such as disbursements or expense claims, and is unsuitable for assigned numbers like check numbers, phone numbers, or data with built-in minimums and maximums. Deviations are red flags prompting further investigation, not proof of fraud, so CFEs combine Benford analysis with the other functions above and with document examination and interviews to reach supportable conclusions.
Data Analysis Functions and Benford's Law: A Complete CFE Exam Guide
Why This Topic Matters for the CFE Exam
Modern fraud examinations almost never involve a single smoking-gun document. Instead, evidence is buried inside millions of transactions stored in accounting systems, payroll files, vendor master files, and expense reports. The Investigation section of the CFE Exam (and the ACFE Fraud Examiners Manual chapter on Data Analysis and Reporting Tools) tests whether you understand how to turn raw data into leads. Two things are tested heavily: (1) the standard data analysis functions available in tools such as ACL, IDEA, Excel, and SQL-based platforms, and (2) Benford's Law, a statistical technique used to spot numbers that may have been fabricated. Examiners love this material because it is concrete, definitional, and has a memorizable set of percentages. If you know the functions, know when each is appropriate, and know the Benford digit frequencies and their limitations, these questions become easy points.
Part One: What Is Data Analysis in a Fraud Examination?
Data analysis is the process of obtaining, cleansing, and examining electronic data to identify anomalies, trends, patterns, and exceptions that may indicate fraud. The ACFE describes a general process:
1. Understand the data - learn what systems exist, what fields mean, and how transactions flow.
2. Build a profile of potential frauds - decide which schemes could occur (ghost employees, fictitious vendors, duplicate payments, kickbacks) and what red flags would appear in the data.
3. Obtain the data - request complete, unaltered files; document the source, date, and record counts (control totals).
4. Cleanse and normalize - fix formatting, remove duplicates created by extraction errors, standardize dates and names, and verify completeness against control totals.
5. Analyze - run the functions described below.
6. Investigate exceptions - data analysis produces leads, not proof. Every anomaly must be followed up with document review, interviews, or other evidence.
7. Report and document - maintain an audit trail so results can be reproduced.
Remember the central principle: data analysis identifies anomalies, not fraud. An anomaly might be a data entry error, a legitimate unusual transaction, or a scheme. The CFE must investigate before drawing conclusions.
Part Two: The Core Data Analysis Functions
The exam expects you to recognize each function, know what it does, and match it to the fraud scheme it best detects.
1. Sorting and Indexing
Arranging records in ascending or descending order on one or more fields. Useful for spotting the largest payments, oldest items, or records falling just below approval thresholds. Indexing creates a logical order without physically rearranging the file.
2. Filtering and Record Selection (Extraction)
Selecting only records that meet specified criteria, for example payments over $10,000 made on weekends, or vendors with no tax ID. This is often the first step in isolating suspicious transactions.
3. Joining and Relating Files
Combining two or more files based on a common key field. Classic fraud tests include matching the employee master file to the vendor master file on address, bank account, or phone number (to find employee-owned shell vendors), or matching payroll to HR termination records (to find ghost employees paid after termination).
4. Statistical Analysis and Summarization
Computing counts, totals, averages, minimums, maximums, and standard deviations. Summarization accumulates numeric values by a key field, such as total payments per vendor or total overtime per employee, highlighting outliers.
5. Stratification
Grouping numeric data into layers or ranges (for example, $0 to $999, $1,000 to $4,999, $5,000 to $9,999) and counting the records and totals in each band. Stratification quickly reveals clustering just below authorization limits, a red flag for split purchases or approval avoidance.
6. Duplicate Testing
Identifying records that share identical values in selected fields, such as the same invoice number and vendor, the same amount and date, or the same bank account across different vendors. Detects duplicate payments, duplicate expense claims, and multiple employees sharing one direct deposit account.
7. Gap Testing
Finding missing items in a sequence that should be continuous, such as check numbers, invoice numbers, purchase orders, or receipt numbers. Gaps can indicate destroyed or diverted documents used to conceal theft.
8. Aging
Classifying records by elapsed time since a date, commonly used for accounts receivable and accounts payable. Unusual aging patterns can reveal lapping, fictitious receivables, or held payments.
9. Trend Analysis and Time-Series Analysis
Comparing values over periods to spot unexpected spikes, dips, or seasonality breaks. Examples include a sudden rise in credit memos in one month, or expense reimbursements that climb steadily for one employee.
10. Compliance Verification
Testing whether transactions conform to policy, such as purchases without a purchase order, payments approved by someone outside their authority limit, or vendors added without the required documentation.
11. Fuzzy Matching and Soundex
Identifying near-duplicates or similar-sounding names where exact matching fails. Soundex converts names to a phonetic code so that Smith and Smyth match. Fuzzy logic catches ABC Supply Inc. versus A.B.C. Supply, a common technique in shell vendor schemes.
12. Date and Day-of-Week Analysis
Flagging transactions posted on weekends, holidays, or outside business hours, or journal entries made at unusual times, which may indicate management override.
13. Calculated Fields and Recalculation
Creating new fields by formula, for example recomputing invoice totals from quantity times price or verifying payroll gross-to-net calculations, to detect manipulated amounts.
14. Verifying Multiples of a Number (Round Number Testing)
Identifying amounts that are exact multiples of 100, 500, or 1,000. Legitimate invoices rarely land on round numbers; fabricated ones often do.
15. Correlation and Regression Analysis
Measuring the statistical relationship between variables, such as sales and commissions or units produced and raw materials consumed. Regression can predict expected values so that actuals deviating sharply from predictions are flagged.
16. Sampling
Selecting a subset of records for detailed review when the full population cannot be examined. Statistical sampling (random, stratified) allows conclusions about the population; judgmental sampling targets high-risk items. In fraud work, examining 100 percent of a population electronically is usually preferred because fraud is often a small number of items.
17. Text Analytics and Keyword Searching
Searching unstructured data such as email, memos, or free-text description fields for terms like override, adjust, fix, cover, or nobody will notice. The ACFE Fraud Triangle keyword lists are commonly referenced.
Part Three: Benford's Law - What It Is
Benford's Law (also called the First-Digit Law) is a mathematical observation that in many naturally occurring sets of numbers, the leading digit is not uniformly distributed. Instead, smaller digits appear as the first digit far more often than larger digits. The number 1 appears as the first digit about 30 percent of the time, while 9 appears as the first digit less than 5 percent of the time.
History: The phenomenon was first noted in 1881 by astronomer Simon Newcomb, who observed that the early pages of logarithm tables (containing numbers starting with 1) were more worn than later pages. Physicist Frank Benford independently rediscovered and documented it in 1938, testing more than 20,000 numbers from diverse sources such as river areas, populations, and newspaper figures. In the 1990s, Dr. Mark Nigrini popularized its use in auditing and fraud detection.
The Formula: The expected probability that a number has first digit d is:
P(d) = log10 (1 + 1/d)
Expected First-Digit Frequencies (memorize these):
Digit 1: 30.1%
Digit 2: 17.6%
Digit 3: 12.5%
Digit 4: 9.7%
Digit 5: 7.9%
Digit 6: 6.7%
Digit 7: 5.8%
Digit 8: 5.1%
Digit 9: 4.6%
Notice that digits 1 through 3 together account for roughly 60 percent of all first digits, while 7, 8 and 9 combined are only about 15 percent.
Expected Second-Digit Frequencies: The second digit (which can be 0 through 9) is much flatter but still declines: 0 is about 12.0%, 1 about 11.4%, 2 about 10.9%, 3 about 10.4%, 4 about 10.0%, 5 about 9.7%, 6 about 9.3%, 7 about 9.0%, 8 about 8.8%, and 9 about 8.5%. By the third digit and beyond, the distribution is nearly uniform.
Why It Works: Intuitively, think of a quantity growing by a constant percentage. Moving from 1 to 2 requires 100 percent growth, so a number spends a long time with a leading 1. Moving from 8 to 9 requires only 12.5 percent growth, so numbers pass through a leading 8 quickly. Any data set spanning several orders of magnitude and generated by multiplicative or compounding processes tends to follow the pattern. Benford's Law is scale invariant, meaning converting dollars to euros does not change the digit distribution.
Part Four: How Benford's Law Is Applied in Fraud Detection
The logic is simple: people who invent numbers do not invent them in Benford proportions. Fraudsters tend to spread digits evenly, favor digits in the middle, repeat favorite numbers, or cluster just under control thresholds. When the actual digit distribution of a data set deviates significantly from Benford's expected distribution, the deviation points to a subset of transactions worth examining.
Typical Benford tests:
- First-digit test: a high-level reasonableness check of the whole population.
- Second-digit test: another broad test, useful for spotting rounding.
- First-two-digits test: the most practical fraud test; produces 90 possible combinations (10 through 99) so spikes are more specific. A spike at 49 in a company with a $5,000 approval limit is a classic finding.
- First-three-digits test: highly specific, used on very large data sets.
- Last-two-digits test: identifies excessive round numbers (00, 50) suggesting estimated or fabricated amounts.
- Number duplication test: lists the most frequently occurring exact amounts; often paired with Benford results.
Measuring deviation: Analysts compare actual to expected proportions and may use statistical measures such as the Z-statistic for individual digits, the chi-square test, or the mean absolute deviation (MAD) across all digits to judge conformity. The exam is unlikely to require calculation, but you should recognize that significant deviation is the trigger for further review, and that larger data sets allow smaller deviations to be meaningful.
Part Five: When Benford's Law Does and Does Not Apply
This is the most heavily tested aspect. Benford's Law is only valid for data with certain characteristics.
Data sets that SHOULD conform to Benford's Law:
- Numbers describing the sizes of similar phenomena (invoice amounts, expense reimbursements, inventory counts, accounts payable, sales transactions, stock prices, population figures).
- Large data sets (generally at least several hundred, ideally thousands of records).
- Data spanning several orders of magnitude (tens, hundreds, thousands, tens of thousands).
- Data with no built-in minimum or maximum (other than zero).
- Data that result from combinations of numbers, such as quantity multiplied by price.
- Positively skewed data where the mean is greater than the median.
Data sets that should NOT be tested with Benford's Law:
- Assigned or sequential numbers: invoice numbers, check numbers, purchase order numbers, employee IDs, Social Security numbers, phone numbers, ZIP codes, account numbers.
- Numbers influenced by human thought or psychology: prices set at $9.99 or $19.95, ATM withdrawals in fixed multiples, fixed fees.
- Data with built-in minimums or maximums: a field where every value must fall between $500 and $1,000; hourly wages capped by policy.
- Small data sets: a few dozen records will not stabilize into the expected distribution.
- Data with many firm-specific recurring amounts: a utility that charges a flat $25 fee to thousands of customers, or a company whose refunds are always $10.
- Random numbers: lottery numbers or random number generator output are uniform, not Benford.
- Data covering only one order of magnitude, such as adult heights or test scores from 0 to 100.
Limitations to remember:
- Benford's Law identifies anomalies, not fraud. Deviations can result from legitimate business practices, data entry conventions, or system defaults.
- It is a population-level test; it points to groups of transactions (for example, all amounts beginning with 48 or 49), not to individual fraudulent items.
- A data set can conform to Benford's Law and still contain fraud, especially if the fraudulent transactions are few relative to the whole or if the fraudster deliberately mimicked natural numbers.
- Results should be combined with other analytics, document review, and interviews.
Part Six: Software and Implementation
The ACFE discusses several tool categories. Spreadsheets (Excel) can perform Benford analysis with LEFT, COUNTIF, and LOG10 functions but struggle with very large files and lack audit trails. Generalized audit software such as ACL (now Diligent/Galvanize), IDEA, and Arbutus include built-in Benford commands, maintain logs of every step, protect source data from alteration (read-only), and handle millions of records. Database query tools (SQL) and programming languages (Python, R) are increasingly common. Specialized Benford tools and add-ins such as ActiveData also exist. Whatever the tool, the examiner should document the data source, record counts, and procedures so results can be replicated and defended in court.
Part Seven: Worked Mini-Examples
Example A: A CFE analyzes 40,000 accounts payable disbursements. The first-two-digit test shows the combination 49 appears at nearly three times its expected frequency. The company has a $5,000 single-signature approval limit. Interpretation: Payments of $4,900 to $4,999 are unusually frequent, suggesting purchases are being split or structured to avoid dual approval. Next step: extract all payments between $4,900 and $4,999, summarize by vendor and approver, and review supporting documents.
Example B: An examiner wants to test a listing of 300 employee badge numbers using Benford's Law. Interpretation: Inappropriate. Badge numbers are assigned sequentially and are not measurements of a natural phenomenon. Gap testing or duplicate testing would be the correct functions.
Example C: A fraud examiner suspects that a bookkeeper is issuing checks to a shell vendor. Which function is most direct? Answer: Join the vendor master file to the employee master file on address, bank account number, and phone number; then summarize payments to any matched vendors.
Example D: Several receipt numbers are missing from a cash register sequence. Function: Gap testing; the missing receipts may have been voided or destroyed to conceal skimming.
Exam Tips: Answering Questions on Data Analysis Functions and Benford's Law
Tip 1 - Memorize the first-digit table cold. You may be asked the expected frequency of the digit 1 (about 30 percent), the digit 9 (about 4.6 percent), or which digit appears most often. Also remember that the probability decreases as the digit increases, and that digits 1, 2, and 3 together exceed 60 percent.
Tip 2 - Know the eligibility rules better than the math. The most common Benford questions ask whether a given data set is appropriate. Instantly reject: assigned numbers (invoice numbers, SSNs, phone numbers, ZIP codes), numbers with built-in minimums or maximums, prices set by psychology, and small data sets. Instantly accept: large sets of transaction amounts, expense claims, invoice dollar values, and populations.
Tip 3 - Benford indicates anomalies, not proof of fraud. If an answer choice says Benford's Law proves fraud occurred, confirms the perpetrator, or eliminates the need for further investigation, it is wrong. The correct framing is always that deviations identify areas requiring additional examination.
Tip 4 - Match the function to the scheme. Practice these pairings: ghost employees and shell vendors go with join/relate; duplicate payments go with duplicate testing; missing checks or receipts go with gap testing; purchases clustered under approval limits go with stratification or first-two-digit Benford; lapping and fictitious receivables go with aging; misspelled vendor variants go with fuzzy matching or Soundex; weekend or after-hours journal entries go with date analysis; recomputing invoice totals goes with calculated fields.
Tip 5 - Distinguish similar-sounding functions. Summarization totals values by a key (payments per vendor); stratification groups values into numeric ranges (how many payments between $1,000 and $4,999). Sorting rearranges; filtering extracts. Duplicate testing finds repeats; gap testing finds what is missing.
Tip 6 - Remember the history and names. Newcomb observed it first (1881), Benford formalized it (1938), Nigrini applied it to fraud and auditing. Benford's Law is also called the First-Digit Law.
Tip 7 - Watch for the best answer, not just a correct one. The CFE Exam often offers several plausible choices. Ask which option is the most direct, most efficient, or most specific to the scheme described. Analyzing 100 percent of the population electronically is generally preferred over sampling when detecting fraud.
Tip 8 - Expect questions on process and documentation. Data should be obtained in a way that preserves the original, verified with control totals (record counts, sums), and every analytical step should be logged so results are reproducible and admissible.
Tip 9 - Understand why the second-digit and first-two-digit tests exist. The first-digit test is a coarse screen; the first-two-digit test is the workhorse for finding thresholds and favorite numbers; the last-two-digit test exposes round-number fabrication.
Tip 10 - Read the numbers in the question carefully. If a question says a set contains 50 records, that alone can make Benford inappropriate. If a question says all values must be between $100 and $500, the built-in range makes it inappropriate. If the question describes dollar amounts of thousands of invoices with no caps, Benford applies.
Quick Review Summary
- Data analysis turns large electronic populations into targeted leads; anomalies require follow-up, never automatic conclusions.
- Core functions: sorting, filtering, joining, summarization, stratification, duplicate testing, gap testing, aging, trend analysis, compliance verification, fuzzy matching, date analysis, calculated fields, round-number testing, correlation and regression, sampling, text analytics.
- Benford's Law: P(d) = log10(1 + 1/d); first digit 1 appears about 30.1 percent, digit 9 about 4.6 percent; discovered by Newcomb, named for Benford, applied to fraud by Nigrini.
- Apply Benford only to large, naturally occurring, multi-magnitude numeric data without assigned values, psychological pricing, or built-in limits.
- Deviations point to groups of transactions for investigation; they do not prove fraud.
Master these points and you will handle every Data Analysis Functions and Benford's Law question on the CFE Exam with confidence.
Modern fraud examinations almost never involve a single smoking-gun document. Instead, evidence is buried inside millions of transactions stored in accounting systems, payroll files, vendor master files, and expense reports. The Investigation section of the CFE Exam (and the ACFE Fraud Examiners Manual chapter on Data Analysis and Reporting Tools) tests whether you understand how to turn raw data into leads. Two things are tested heavily: (1) the standard data analysis functions available in tools such as ACL, IDEA, Excel, and SQL-based platforms, and (2) Benford's Law, a statistical technique used to spot numbers that may have been fabricated. Examiners love this material because it is concrete, definitional, and has a memorizable set of percentages. If you know the functions, know when each is appropriate, and know the Benford digit frequencies and their limitations, these questions become easy points.
Part One: What Is Data Analysis in a Fraud Examination?
Data analysis is the process of obtaining, cleansing, and examining electronic data to identify anomalies, trends, patterns, and exceptions that may indicate fraud. The ACFE describes a general process:
1. Understand the data - learn what systems exist, what fields mean, and how transactions flow.
2. Build a profile of potential frauds - decide which schemes could occur (ghost employees, fictitious vendors, duplicate payments, kickbacks) and what red flags would appear in the data.
3. Obtain the data - request complete, unaltered files; document the source, date, and record counts (control totals).
4. Cleanse and normalize - fix formatting, remove duplicates created by extraction errors, standardize dates and names, and verify completeness against control totals.
5. Analyze - run the functions described below.
6. Investigate exceptions - data analysis produces leads, not proof. Every anomaly must be followed up with document review, interviews, or other evidence.
7. Report and document - maintain an audit trail so results can be reproduced.
Remember the central principle: data analysis identifies anomalies, not fraud. An anomaly might be a data entry error, a legitimate unusual transaction, or a scheme. The CFE must investigate before drawing conclusions.
Part Two: The Core Data Analysis Functions
The exam expects you to recognize each function, know what it does, and match it to the fraud scheme it best detects.
1. Sorting and Indexing
Arranging records in ascending or descending order on one or more fields. Useful for spotting the largest payments, oldest items, or records falling just below approval thresholds. Indexing creates a logical order without physically rearranging the file.
2. Filtering and Record Selection (Extraction)
Selecting only records that meet specified criteria, for example payments over $10,000 made on weekends, or vendors with no tax ID. This is often the first step in isolating suspicious transactions.
3. Joining and Relating Files
Combining two or more files based on a common key field. Classic fraud tests include matching the employee master file to the vendor master file on address, bank account, or phone number (to find employee-owned shell vendors), or matching payroll to HR termination records (to find ghost employees paid after termination).
4. Statistical Analysis and Summarization
Computing counts, totals, averages, minimums, maximums, and standard deviations. Summarization accumulates numeric values by a key field, such as total payments per vendor or total overtime per employee, highlighting outliers.
5. Stratification
Grouping numeric data into layers or ranges (for example, $0 to $999, $1,000 to $4,999, $5,000 to $9,999) and counting the records and totals in each band. Stratification quickly reveals clustering just below authorization limits, a red flag for split purchases or approval avoidance.
6. Duplicate Testing
Identifying records that share identical values in selected fields, such as the same invoice number and vendor, the same amount and date, or the same bank account across different vendors. Detects duplicate payments, duplicate expense claims, and multiple employees sharing one direct deposit account.
7. Gap Testing
Finding missing items in a sequence that should be continuous, such as check numbers, invoice numbers, purchase orders, or receipt numbers. Gaps can indicate destroyed or diverted documents used to conceal theft.
8. Aging
Classifying records by elapsed time since a date, commonly used for accounts receivable and accounts payable. Unusual aging patterns can reveal lapping, fictitious receivables, or held payments.
9. Trend Analysis and Time-Series Analysis
Comparing values over periods to spot unexpected spikes, dips, or seasonality breaks. Examples include a sudden rise in credit memos in one month, or expense reimbursements that climb steadily for one employee.
10. Compliance Verification
Testing whether transactions conform to policy, such as purchases without a purchase order, payments approved by someone outside their authority limit, or vendors added without the required documentation.
11. Fuzzy Matching and Soundex
Identifying near-duplicates or similar-sounding names where exact matching fails. Soundex converts names to a phonetic code so that Smith and Smyth match. Fuzzy logic catches ABC Supply Inc. versus A.B.C. Supply, a common technique in shell vendor schemes.
12. Date and Day-of-Week Analysis
Flagging transactions posted on weekends, holidays, or outside business hours, or journal entries made at unusual times, which may indicate management override.
13. Calculated Fields and Recalculation
Creating new fields by formula, for example recomputing invoice totals from quantity times price or verifying payroll gross-to-net calculations, to detect manipulated amounts.
14. Verifying Multiples of a Number (Round Number Testing)
Identifying amounts that are exact multiples of 100, 500, or 1,000. Legitimate invoices rarely land on round numbers; fabricated ones often do.
15. Correlation and Regression Analysis
Measuring the statistical relationship between variables, such as sales and commissions or units produced and raw materials consumed. Regression can predict expected values so that actuals deviating sharply from predictions are flagged.
16. Sampling
Selecting a subset of records for detailed review when the full population cannot be examined. Statistical sampling (random, stratified) allows conclusions about the population; judgmental sampling targets high-risk items. In fraud work, examining 100 percent of a population electronically is usually preferred because fraud is often a small number of items.
17. Text Analytics and Keyword Searching
Searching unstructured data such as email, memos, or free-text description fields for terms like override, adjust, fix, cover, or nobody will notice. The ACFE Fraud Triangle keyword lists are commonly referenced.
Part Three: Benford's Law - What It Is
Benford's Law (also called the First-Digit Law) is a mathematical observation that in many naturally occurring sets of numbers, the leading digit is not uniformly distributed. Instead, smaller digits appear as the first digit far more often than larger digits. The number 1 appears as the first digit about 30 percent of the time, while 9 appears as the first digit less than 5 percent of the time.
History: The phenomenon was first noted in 1881 by astronomer Simon Newcomb, who observed that the early pages of logarithm tables (containing numbers starting with 1) were more worn than later pages. Physicist Frank Benford independently rediscovered and documented it in 1938, testing more than 20,000 numbers from diverse sources such as river areas, populations, and newspaper figures. In the 1990s, Dr. Mark Nigrini popularized its use in auditing and fraud detection.
The Formula: The expected probability that a number has first digit d is:
P(d) = log10 (1 + 1/d)
Expected First-Digit Frequencies (memorize these):
Digit 1: 30.1%
Digit 2: 17.6%
Digit 3: 12.5%
Digit 4: 9.7%
Digit 5: 7.9%
Digit 6: 6.7%
Digit 7: 5.8%
Digit 8: 5.1%
Digit 9: 4.6%
Notice that digits 1 through 3 together account for roughly 60 percent of all first digits, while 7, 8 and 9 combined are only about 15 percent.
Expected Second-Digit Frequencies: The second digit (which can be 0 through 9) is much flatter but still declines: 0 is about 12.0%, 1 about 11.4%, 2 about 10.9%, 3 about 10.4%, 4 about 10.0%, 5 about 9.7%, 6 about 9.3%, 7 about 9.0%, 8 about 8.8%, and 9 about 8.5%. By the third digit and beyond, the distribution is nearly uniform.
Why It Works: Intuitively, think of a quantity growing by a constant percentage. Moving from 1 to 2 requires 100 percent growth, so a number spends a long time with a leading 1. Moving from 8 to 9 requires only 12.5 percent growth, so numbers pass through a leading 8 quickly. Any data set spanning several orders of magnitude and generated by multiplicative or compounding processes tends to follow the pattern. Benford's Law is scale invariant, meaning converting dollars to euros does not change the digit distribution.
Part Four: How Benford's Law Is Applied in Fraud Detection
The logic is simple: people who invent numbers do not invent them in Benford proportions. Fraudsters tend to spread digits evenly, favor digits in the middle, repeat favorite numbers, or cluster just under control thresholds. When the actual digit distribution of a data set deviates significantly from Benford's expected distribution, the deviation points to a subset of transactions worth examining.
Typical Benford tests:
- First-digit test: a high-level reasonableness check of the whole population.
- Second-digit test: another broad test, useful for spotting rounding.
- First-two-digits test: the most practical fraud test; produces 90 possible combinations (10 through 99) so spikes are more specific. A spike at 49 in a company with a $5,000 approval limit is a classic finding.
- First-three-digits test: highly specific, used on very large data sets.
- Last-two-digits test: identifies excessive round numbers (00, 50) suggesting estimated or fabricated amounts.
- Number duplication test: lists the most frequently occurring exact amounts; often paired with Benford results.
Measuring deviation: Analysts compare actual to expected proportions and may use statistical measures such as the Z-statistic for individual digits, the chi-square test, or the mean absolute deviation (MAD) across all digits to judge conformity. The exam is unlikely to require calculation, but you should recognize that significant deviation is the trigger for further review, and that larger data sets allow smaller deviations to be meaningful.
Part Five: When Benford's Law Does and Does Not Apply
This is the most heavily tested aspect. Benford's Law is only valid for data with certain characteristics.
Data sets that SHOULD conform to Benford's Law:
- Numbers describing the sizes of similar phenomena (invoice amounts, expense reimbursements, inventory counts, accounts payable, sales transactions, stock prices, population figures).
- Large data sets (generally at least several hundred, ideally thousands of records).
- Data spanning several orders of magnitude (tens, hundreds, thousands, tens of thousands).
- Data with no built-in minimum or maximum (other than zero).
- Data that result from combinations of numbers, such as quantity multiplied by price.
- Positively skewed data where the mean is greater than the median.
Data sets that should NOT be tested with Benford's Law:
- Assigned or sequential numbers: invoice numbers, check numbers, purchase order numbers, employee IDs, Social Security numbers, phone numbers, ZIP codes, account numbers.
- Numbers influenced by human thought or psychology: prices set at $9.99 or $19.95, ATM withdrawals in fixed multiples, fixed fees.
- Data with built-in minimums or maximums: a field where every value must fall between $500 and $1,000; hourly wages capped by policy.
- Small data sets: a few dozen records will not stabilize into the expected distribution.
- Data with many firm-specific recurring amounts: a utility that charges a flat $25 fee to thousands of customers, or a company whose refunds are always $10.
- Random numbers: lottery numbers or random number generator output are uniform, not Benford.
- Data covering only one order of magnitude, such as adult heights or test scores from 0 to 100.
Limitations to remember:
- Benford's Law identifies anomalies, not fraud. Deviations can result from legitimate business practices, data entry conventions, or system defaults.
- It is a population-level test; it points to groups of transactions (for example, all amounts beginning with 48 or 49), not to individual fraudulent items.
- A data set can conform to Benford's Law and still contain fraud, especially if the fraudulent transactions are few relative to the whole or if the fraudster deliberately mimicked natural numbers.
- Results should be combined with other analytics, document review, and interviews.
Part Six: Software and Implementation
The ACFE discusses several tool categories. Spreadsheets (Excel) can perform Benford analysis with LEFT, COUNTIF, and LOG10 functions but struggle with very large files and lack audit trails. Generalized audit software such as ACL (now Diligent/Galvanize), IDEA, and Arbutus include built-in Benford commands, maintain logs of every step, protect source data from alteration (read-only), and handle millions of records. Database query tools (SQL) and programming languages (Python, R) are increasingly common. Specialized Benford tools and add-ins such as ActiveData also exist. Whatever the tool, the examiner should document the data source, record counts, and procedures so results can be replicated and defended in court.
Part Seven: Worked Mini-Examples
Example A: A CFE analyzes 40,000 accounts payable disbursements. The first-two-digit test shows the combination 49 appears at nearly three times its expected frequency. The company has a $5,000 single-signature approval limit. Interpretation: Payments of $4,900 to $4,999 are unusually frequent, suggesting purchases are being split or structured to avoid dual approval. Next step: extract all payments between $4,900 and $4,999, summarize by vendor and approver, and review supporting documents.
Example B: An examiner wants to test a listing of 300 employee badge numbers using Benford's Law. Interpretation: Inappropriate. Badge numbers are assigned sequentially and are not measurements of a natural phenomenon. Gap testing or duplicate testing would be the correct functions.
Example C: A fraud examiner suspects that a bookkeeper is issuing checks to a shell vendor. Which function is most direct? Answer: Join the vendor master file to the employee master file on address, bank account number, and phone number; then summarize payments to any matched vendors.
Example D: Several receipt numbers are missing from a cash register sequence. Function: Gap testing; the missing receipts may have been voided or destroyed to conceal skimming.
Exam Tips: Answering Questions on Data Analysis Functions and Benford's Law
Tip 1 - Memorize the first-digit table cold. You may be asked the expected frequency of the digit 1 (about 30 percent), the digit 9 (about 4.6 percent), or which digit appears most often. Also remember that the probability decreases as the digit increases, and that digits 1, 2, and 3 together exceed 60 percent.
Tip 2 - Know the eligibility rules better than the math. The most common Benford questions ask whether a given data set is appropriate. Instantly reject: assigned numbers (invoice numbers, SSNs, phone numbers, ZIP codes), numbers with built-in minimums or maximums, prices set by psychology, and small data sets. Instantly accept: large sets of transaction amounts, expense claims, invoice dollar values, and populations.
Tip 3 - Benford indicates anomalies, not proof of fraud. If an answer choice says Benford's Law proves fraud occurred, confirms the perpetrator, or eliminates the need for further investigation, it is wrong. The correct framing is always that deviations identify areas requiring additional examination.
Tip 4 - Match the function to the scheme. Practice these pairings: ghost employees and shell vendors go with join/relate; duplicate payments go with duplicate testing; missing checks or receipts go with gap testing; purchases clustered under approval limits go with stratification or first-two-digit Benford; lapping and fictitious receivables go with aging; misspelled vendor variants go with fuzzy matching or Soundex; weekend or after-hours journal entries go with date analysis; recomputing invoice totals goes with calculated fields.
Tip 5 - Distinguish similar-sounding functions. Summarization totals values by a key (payments per vendor); stratification groups values into numeric ranges (how many payments between $1,000 and $4,999). Sorting rearranges; filtering extracts. Duplicate testing finds repeats; gap testing finds what is missing.
Tip 6 - Remember the history and names. Newcomb observed it first (1881), Benford formalized it (1938), Nigrini applied it to fraud and auditing. Benford's Law is also called the First-Digit Law.
Tip 7 - Watch for the best answer, not just a correct one. The CFE Exam often offers several plausible choices. Ask which option is the most direct, most efficient, or most specific to the scheme described. Analyzing 100 percent of the population electronically is generally preferred over sampling when detecting fraud.
Tip 8 - Expect questions on process and documentation. Data should be obtained in a way that preserves the original, verified with control totals (record counts, sums), and every analytical step should be logged so results are reproducible and admissible.
Tip 9 - Understand why the second-digit and first-two-digit tests exist. The first-digit test is a coarse screen; the first-two-digit test is the workhorse for finding thresholds and favorite numbers; the last-two-digit test exposes round-number fabrication.
Tip 10 - Read the numbers in the question carefully. If a question says a set contains 50 records, that alone can make Benford inappropriate. If a question says all values must be between $100 and $500, the built-in range makes it inappropriate. If the question describes dollar amounts of thousands of invoices with no caps, Benford applies.
Quick Review Summary
- Data analysis turns large electronic populations into targeted leads; anomalies require follow-up, never automatic conclusions.
- Core functions: sorting, filtering, joining, summarization, stratification, duplicate testing, gap testing, aging, trend analysis, compliance verification, fuzzy matching, date analysis, calculated fields, round-number testing, correlation and regression, sampling, text analytics.
- Benford's Law: P(d) = log10(1 + 1/d); first digit 1 appears about 30.1 percent, digit 9 about 4.6 percent; discovered by Newcomb, named for Benford, applied to fraud by Nigrini.
- Apply Benford only to large, naturally occurring, multi-magnitude numeric data without assigned values, psychological pricing, or built-in limits.
- Deviations point to groups of transactions for investigation; they do not prove fraud.
Master these points and you will handle every Data Analysis Functions and Benford's Law question on the CFE Exam with confidence.
Test mode:
CFE - Data Analysis Functions and Benford's Law Example Questions
Test your knowledge of Data Analysis Functions and Benford's Law
Question 1
A fraud examiner wants to test a company's disbursement records for invented or manipulated figures. The examiner plans to compare how often each leading digit appears against the frequencies expected in naturally occurring numbers. Which of the following data fields is the MOST suitable population for this test?
Question 2
A fraud examiner runs a first-two-digits Benford's Law test on a year of vendor invoices. Most digit combinations closely match the expected frequencies. However, there is a sharp spike at the combinations just below the amount above which invoices need a second manager's approval. Which of the following is the MOST likely explanation for this pattern?
Question 3
A fraud examiner runs a first-two-digits Benford's Law test on a year of accounts payable invoices. The test shows a spike in amounts that begin just below the limit at which a second approval is required. Before pulling source documents, the examiner wants to find out which parties account for the excess. Which data analysis step should the examiner take NEXT?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Data Analysis Functions and Benford's Law questions
16 questions (total)