Benford's Law and Four Other Tests That Surface Cooked Books
You can't read every transaction in a set of books. What you can do is run a handful of analytical tests that make the odd ones stand out — the entries that don't behave the way honest data behaves. None of these tests proves fraud. What they do is tell you where to look. This guide covers Benford's Law and four other tests that earn their place in any financial investigator's kit.
The mindset for all five: they are screening tests. They narrow thousands of transactions down to a handful worth examining by hand. A hit is a lead, not a finding.
1. Benford's Law (first-digit analysis)
Here is the counter-intuitive fact Benford's Law rests on: in many naturally occurring sets of numbers — invoice amounts, expense claims, transaction values — the first digit is not evenly distributed. The digit 1 appears as the leading digit about 30% of the time; 2 about 18%; and so on down to 9, which leads under 5% of the time. This holds across a startling range of real financial data.
Why it matters: when people invent numbers — fake invoices, made-up expenses — they tend to distribute the digits far more evenly than nature does, or to cluster them (for example, lots of amounts starting with 4 because they're keeping claims under a 500 threshold). So you take a large set of transactions, count how often each digit leads, and compare the actual distribution to Benford's expected curve. Where the real data bulges away from the expected shape, you have a population worth examining.
The limits, stated honestly: Benford's Law needs a large dataset (hundreds of values at least) and only works on numbers that are free to range naturally. It fails on assigned numbers (invoice sequence numbers, account codes), on data with hard floors or ceilings, and on small samples. A deviation is not fraud — it can be a perfectly legitimate feature of the business. It tells you where to dig, nothing more.
2. Duplicate testing
Simple and powerful: look for records that shouldn't be identical but are. The same invoice number paid twice. Two payments of the exact same odd amount to the same vendor on the same day. The same expense receipt submitted in two different months. Duplicates are a classic fingerprint of double-billing, resubmitted claims and lazy fraud.
The innocent explanation: genuine duplicates happen — legitimate recurring payments, split invoices, data-entry that legitimately repeats. So a duplicate is a candidate to examine, not a caught thief. Pull the supporting documents before you conclude anything.
3. Gap and sequence testing
Many business documents are numbered in sequence — cheques, invoices, receipts, purchase orders. Sequence testing looks for the gaps: missing numbers in a run that should be unbroken. A missing cheque number can mean a cheque was removed and used off the books. A gap in a receipt book can mean receipts were destroyed to hide a transaction.
The innocent explanation: spoiled documents, cancelled transactions and stationery genuinely goes missing. Gaps are common and mostly innocent. But an unexplained gap in a controlled sequence, especially around the period you're investigating, is worth accounting for.
4. Relative size factor (RSF)
This test finds the entry that's wildly out of scale with its neighbours. For each account or vendor, you compare the largest transaction to the next largest — that ratio is the relative size factor. Where one payment dwarfs every other payment to the same vendor, the RSF spikes, and that outlier is worth a look. It's how you catch the single inflated invoice hidden among dozens of normal ones, or the one giant "expense" in an otherwise modest account.
The innocent explanation: big legitimate transactions exist — an annual payment, a one-off capital purchase, a genuine large order. A high RSF flags the transaction for review; the review decides whether it's real.
5. Ratio and trend analysis
Step back from individual transactions and look at relationships over time. Does the ratio of expenses to revenue drift in a way that doesn't match the business? Do payroll costs jump without new hires? Does a cost category creep up quarter after quarter with no operational reason? Trend and ratio analysis catches the slow, structural manipulations that no single transaction reveals — the frog-in-boiling-water frauds that hide inside a plausible-looking total.
The innocent explanation: businesses change. Prices rise, product mixes shift, one-off events distort a quarter. A moving ratio is a question about why, not an answer.
The thread running through all five
Notice the pattern: every test produces candidates, and every candidate has an innocent explanation you have to rule out. That's not a weakness of the tests — it's the correct way to use them. The tests do the one thing humans are bad at, which is spotting the statistically odd needle in a haystack of thousands of transactions. Your job starts where the test ends: pulling the supporting documents, asking the questions, and deciding whether the anomaly is fraud or just business.
Used this way, analytical tests make you both faster and fairer. Faster, because you examine ten flagged transactions instead of ten thousand. Fairer, because you're not fishing — you're following the data to the entries that objectively stand out, and you're testing the innocent explanation for each.
Keeping it defensible
If a finding rests on one of these tests, be ready to explain the test in plain language, state its assumptions and limits, show the data you ran it on, and — for every anomaly you relied on — show the document review that turned a statistical flag into a substantiated concern. "Benford's Law says it's fraud" is not a defensible sentence. "The first-digit distribution deviated here, which directed us to these transactions, which on examination could not be substantiated because…" is.
Running these tests without a data-science degree
These tests are standard in forensic accounting, but running them by hand — building the Benford distribution, sorting for duplicates, computing relative size factors — takes tools and know-how most small teams don't have. Conectir's financial analysis can run these analytical tests across a dataset, show the results and the flagged transactions with the arithmetic in plain sight, and let you record the document review that follows. It surfaces the anomalies; it never declares the books cooked. If you work through business accounts, see how the financial tools run the analytical tests.
See how Conectir’s financial analysis tools handles this on a real case — leads to verify, never a verdict.
Frequently asked questions
What is Benford's Law and how does it detect fraud?
Benford's Law describes the natural frequency of leading digits in many financial datasets — 1 leads about 30% of the time, down to under 5% for 9. Invented numbers often break this pattern, so comparing a dataset's actual first-digit distribution to the expected curve highlights populations worth examining. It indicates where to look, not that fraud occurred.
Does a Benford's Law deviation prove fraud?
No. It requires a large dataset of naturally ranging numbers and can deviate for entirely legitimate reasons. A deviation is a screening result that directs further examination, not evidence of fraud.
What other tests detect irregularities in accounts?
Common ones include duplicate testing (identical records that shouldn't be), gap/sequence testing (missing numbers in controlled sequences), relative size factor (outlier transactions far larger than their peers), and ratio/trend analysis (relationships that drift without a business reason).
Are these tests proof of wrongdoing?
No. Every test produces candidates with innocent explanations that must be ruled out through document review and questions. They are screening tools that narrow where to look, not findings in themselves.
How much data do I need for these tests?
Benford's Law and trend analysis need reasonably large datasets to be meaningful (hundreds of values at least). Duplicate, gap and relative-size tests can work on smaller sets but still only produce leads to be examined by hand.