IFIP International Conference on Digital Forensics

DigitalForensics 2011: Advances in Digital Forensics VII pp 129-141

Detecting Fraud Using Modified Benford Analysis

  • Christian Winter
  • Markus Schneider
  • York Yannikos
Conference paper

DOI: 10.1007/978-3-642-24212-0_10

Volume 361 of the book series IFIP Advances in Information and Communication Technology (IFIPAICT)
Cite this paper as:
Winter C., Schneider M., Yannikos Y. (2011) Detecting Fraud Using Modified Benford Analysis. In: Peterson G., Shenoi S. (eds) Advances in Digital Forensics VII. DigitalForensics 2011. IFIP Advances in Information and Communication Technology, vol 361. Springer, Berlin, Heidelberg

Abstract

Large enterprises frequently enforce accounting limits to reduce the impact of fraud. As a complement to accounting limits, auditors use Benford analysis to detect traces of undesirable or illegal activities in accounting data. Unfortunately, the two fraud fighting measures often do not work well together. Accounting limits may significantly disturb the digit distribution examined by Benford analysis, leading to high false alarm rates, additional investigations and, ultimately, higher costs. To better handle accounting limits, this paper describes a modified Benford analysis technique where a cut-off log-normal distribution derived from the accounting limits and other properties of the data replaces the distribution used in Benford analysis. Experiments with simulated and real-world data demonstrate that the modified Benford analysis technique significantly reduces false positive errors.

Keywords

Auditingfraud detectionBenford analysis
Download to read the full conference paper text

Copyright information

© IFIP International Federation for Information Processing 2011

Authors and Affiliations

  • Christian Winter
    • 1
  • Markus Schneider
    • 1
  • York Yannikos
    • 1
  1. 1.Fraunhofer Institute for Secure Information TechnologyDarmstadtGermany