Benford's law: why do almost a third of amounts start with the digit 1, and how does this help find a fake document?

If amounts were random, it is natural to think that their first digit would be spread evenly from 1 to 9, with about 11 percent for each. But in much real-life data, including payment amounts, this is not so: small digits occur far more often.

Key rules

• The formula of the law. The probability that the first digit is d = log10(1 + 1/d). Result: 1 – 30.1%; 2 – 17.6%; 3 – 12.5%; 4 – 9.7%; 5 – 7.9%; 6 – 6.7%; 7 – 5.8%; 8 – 5.1%; 9 – 4.6%
• Why is this so? To grow from 1 000 to 2 000, an amount has to double, but from 9 000 to 10 000 only by 11 percent. Growing quantities "spend more time" in the range that starts with 1
• History. In 1881 the astronomer Simon Newcomb noticed that the first pages of books of logarithm tables were more worn. In 1938 the physicist Frank Benford tested this on a large amount of data and wrote it up in detail, and the law became known by his name
• When it works. When the data span several orders of magnitude (from tens of soum to billions), there are enough of them and the amounts are not assigned by a person but arise from events
• When it does not work. Assigned numbers (invoice serial numbers, telephone numbers), values in a narrow range (goods at the same price, salaries in a pay scale), data with an upper or lower limit and small samples
• A deviation is a signal, not proof. If the distribution differs from the law, this is not proof of error or fraud: it shows which group should be examined more deeply against the documents
• Its place in audit. Benford analysis is used as one of the analytical procedures to pick out a suspicious part from a large volume of records; the final conclusion is still based on examining the documents

Example: the "Charxpalak" retail chain

The internal auditor Bekzod counted the first digit of the amounts of 1 000 payments made to suppliers during one year. In the company, payments over 5 million soum must be approved by the deputy director (a hypothetical internal rule).

Payments starting with 4 are 65 more than expected, and those starting with 5 are 27 fewer. Bekzod separated out the payments starting with 4: most of them turned out to be in the range of 4.5–4.99 million soum. He found cases where two or three such payments were made to the same supplier on the same day.

This may be a sign of splitting one large payment into several parts to stay below the approval threshold. But no conclusion is drawn yet: Bekzod will now check the contracts, waybills and goods receipts for these payments. If the documents prove correct, a change to the internal rule (a limit on the total amount per day) will be proposed.