Benford's Law for Auditors: A Practical Guide
How Benford's Law works, which ledgers it suits, how to read MAD and chi-square, and what to do when the first-digit test flags something.
Editorial disclosure: Pyalm publishes and maintains the products and free tools discussed on this site. Regulatory statements are linked to primary sources where applicable. No independent professional review is claimed unless a reviewer is explicitly named.
Benford's Law is one of the cheapest analytical procedures an accountant can run. In many real-world sets of financial amounts, the leading digit is 1 about 30% of the time and 9 less than 5% of the time. Numbers people invent, round, or engineer to dodge a limit rarely follow that curve — which is why auditors and forensic accountants use the test to decide where to look.
The expected pattern
| First digit | Expected frequency |
|---|---|
| 1 | 30.1% |
| 2 | 17.6% |
| 3 | 12.5% |
| 4 | 9.7% |
| 5 | 7.9% |
| 6 | 6.7% |
| 7 | 5.8% |
| 8 | 5.1% |
| 9 | 4.6% |
The formula is simply log10(1 + 1/d). The pattern appears when amounts come from many independent events and spread across several orders of magnitude — for example invoices from AED 50 to AED 50,000.
When the test is worth running
- Good fits: accounts payable invoices, expense claims, payments, journal lines, sales transactions, inventory values.
- Poor fits: assigned numbers (cheque or invoice numbers), data with a tight range (salaries in a single grade), prices set by a list, and anything capped by an approval limit.
- Sample size: a few hundred items at minimum. Small samples drift from the curve by chance alone.
Reading the results
Three statistics are commonly reported:
- MAD (mean absolute deviation) — the average gap between observed and expected frequencies. Nigrini's bands for first-digit tests are: below 0.006 close conformity, 0.006–0.012 acceptable, 0.012–0.015 marginal, above 0.015 non-conformity.
- Chi-square — compares counts with expected counts. With 8 degrees of freedom, a value above 15.51 is significant at 5% and above 20.09 at 1%. It becomes over-sensitive with very large populations, so don't rely on it alone.
- Z-score per digit — shows which digits are unusual. An absolute value above 1.96 is significant at 5%.
What a flag usually means
A flagged digit is a lead, not a finding. Typical innocent causes are a fixed-price service billed many times, a bulk contract, or a legitimate cluster of purchases. Typical concerning causes:
- An excess of digit 4 or 9 near an approval limit (invoices split to stay under AED 5,000, say).
- Too many 5s or round numbers suggesting estimates entered as facts.
- A spike at one digit from a single vendor or user.
Follow up by listing the transactions behind the flagged digit, sorting by vendor and user, and testing a sample against source documents.
Run it in your browser
The free Benford's Law Analyzer takes a CSV or pasted column, shows observed versus expected frequencies, highlights unusual digits and lets you export the transactions for any digit. Nothing is uploaded — the data stays on your device.
Pair it with other tests
Benford works best alongside other analytics: a duplicate payment test, a check for missing invoice numbers and a review of fraud red flags in accounting data. If your books live in one system with a clean ledger export, all of these take minutes — Pyalm Books keeps sales, purchases and journals in one double-entry ledger and is free during beta.
Standards, rates and deadlines change. Confirm the current position with the relevant authority or a qualified adviser before you rely on it.