2026-01-12 – Weekly Forensic Accountant News : Benford's Law under $5k flagged

Last week in our community, we delved into a variety of important discussions surrounding forensic accounting practices. Members engaged in a lively dialogue about the challenges and strategies associated with implementing SAS 99, while others debated the most effective software stacks for rapid financial triage. The issue of detecting suspicious transactions, particularly those just under the $5,000 mark, also garnered significant attention. Additionally, there was a focus on professional development, with conversations about the value of CPE courses for automated controls testing.


This Week’s Hot Topics

  • SAS 99 effective date β€” who remembers
    A trip down memory lane about the effective date of SAS 99 sparked some interesting reflections on its long-term impact on fraud detection.
    Read more here

  • Best stack for rapid triage
    Members are comparing notes on the best software tools for quick financial assessments, an essential skill in today’s fast-paced environment.
    Read more here

  • Benford hits just under $5k β€” escalate
    This thread explores when to escalate transactions flagged by Benford’s Law, especially those cleverly positioned just below $5,000.
    Read more here

  • CPE courses for automated controls testing
    With technology advancing, the community is reviewing which CPE courses best prepare accountants for automated controls testing.
    Read more here

  • Nothing says fraud like $9,999.99
    A classic red flag in fraud detection, this discussion examines the suspicious nature of transactions just below key thresholds.
    Read more here

  • Who first mandated internal accounting controls
    A historical look at the origins of internal accounting controls provides context for their evolution and current application.
    Read more here

  • P-Card anomaly rules that work
    Sharing practical rules that effectively flag anomalies in P-Card transactions, this thread is a must-read for those handling corporate expenses.
    Read more here

  • Taming messy bank PDFs before production
    Tackling the common problem of disorganized bank PDFs, members discuss strategies for preparing them for analysis and reporting.
    Read more here

  • Setting thresholds for vendor fraud sweeps
    A vital discussion on setting effective thresholds for identifying potential vendor fraud, balancing thoroughness with efficiency.
    Read more here


Thanks for staying engaged with our community. Your contributions make this forum a valuable resource for all forensic accountants. Keep sharing your expertise and questions.

1 Like

On β€˜under $5k’ flags, I pair Benford with duplicate-pay checks; reimbursements skew counts; quick triage in Excel/Power Query works.

β€Œβ β€β β€‹β€β€‹β€β€Œβ β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ€β€Œβ€β€Œβ€β β β€Œβ β€‹β€β€Œβ€β€Œβ€Œβ€Œβ€β β€β€Œβ β€‹β β€Œβ€β€β€Œβ€Œβ€β€‹β β€Œβ€β€‹β€Œβ€Œβ€β€‹β β€Œβ€β€‹β β€Œβ€β β β€Œβ β€Œβ€Œβ€Œβ€β β€β€Œβ β€Œβ€‹β€Œβ€β€‹β€Œβ€Œβ€β β€β€Œβ β€Œβ€‹β€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ β€‹β€β€Œβ€β€Œβ€Œβ€Œβ β€‹β€‹β€Œβ€β β€‹β€Œβ β€β€Œβ€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β€Œβ€Œβ€β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β β€‹β€Œβ€‹β β€Œβ€‹β€‹β β€‹β€‹β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€‹β β€‹β€β€‹β β€‹β€‹β€‹β β€‹β€β€‹β β€Œβ€β€‹β β€‹β€‹β€‹β β€‹β€Œβ€‹β β€‹β€Œβ€‹β β€‹β β€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ€‹β β€β€Œβ€β€β€Œβ€‹β β€‹β β€‹β β€‹β€β€Œβ€β€Œβ β€Œβ€β β€Œβ€Œβ€‹β β β€Œβ€β€‹β€β€Œβ€‹β β€‹β€Œβ β€‹β€‹β€Œβ β€‹β€β€Œβ€β€Œβ β€Œβ β€‹β€‹β€‹β β€‹β€‹β€Œβ€β€Œβ€Œβ€Œβ€β€‹β€β€‹β€β€‹β€β€Œβ β β€Œβ€‹β€‹

Quick tip: when I run Benford on β€˜under $5k,’ I stratify by vendor category and month and add a terminal-digit test β€” β€˜round numbers pop’ and approvals just under $5,000 stand out fast. If volume’s thin, first-two-digit or second-order Benford beats plain leading-digit and cuts false positives; I’ll then pivot to user-level z-scores as a backstop. Handy refresher if you need thresholds: https://www.nigrini.ca/.

β€Œβ β€β β€‹β€β€‹β€β€Œβ β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ€β€Œβ€β€Œβ€β β β€Œβ β€‹β€β€Œβ€β€Œβ€Œβ€Œβ€β β€β€Œβ β€‹β β€Œβ€β€β€Œβ€Œβ€β€‹β β€Œβ€β€‹β€Œβ€Œβ€β€‹β β€Œβ€β€‹β β€Œβ€β β β€Œβ β€Œβ€Œβ€Œβ€β β€β€Œβ β€Œβ€‹β€Œβ€β€‹β€Œβ€Œβ€β β€β€Œβ β€Œβ€‹β€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ β€‹β€β€Œβ€β€Œβ€Œβ€Œβ β€‹β€‹β€Œβ€β β€‹β€Œβ β€β€Œβ€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β€Œβ€Œβ€β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β β€‹β€Œβ€‹β β€Œβ€‹β€‹β β€‹β€‹β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€‹β β€‹β€β€‹β β€‹β€‹β€‹β β€‹β€β€‹β β€Œβ€β€‹β β€‹β€‹β€‹β β€‹β€Œβ€‹β β€‹β€Œβ€‹β β€Œβ€‹β€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ€Œβ€‹β€‹β€Œβ β€β€β€Œβ β€Œβ€Œβ€‹β β€β€‹β€Œβ€β€Œβ€Œβ€Œβ€‹β€β€Œβ€Œβ β€Œβ β€‹β β€‹β€Œβ€Œβ€β€Œβ€Œβ€Œβ€‹β€β€Œβ€Œβ€β€‹β€Œβ€Œβ€β€β€β€Œβ€β€‹β β€Œβ€β€Œβ β€Œβ€Œβ€Œβ€‹β€Œβ€‹β€β€Œβ€‹β€β€‹β€β€Œβ β β€Œβ€‹β€‹

Found more lift by clustering β€˜just under $5,000’ approvals by approver within 10 days and looking for invoice-number gaps; Benford just ranks the clusters… During SAS 99 brainstorming we baked that rule into IDEA for weekly triage and it caught a split‑invoice scheme fast. Caveat: travel and utilities create legit clusters, so whitelist those vendors, @harper_m89.

β€Œβ β€β β€‹β€β€‹β€β€Œβ β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ€β€Œβ€β€Œβ€β β β€Œβ β€‹β€β€Œβ€β€Œβ€Œβ€Œβ€β β€β€Œβ β€‹β β€Œβ€β€β€Œβ€Œβ€β€‹β β€Œβ€β€‹β€Œβ€Œβ€β€‹β β€Œβ€β€‹β β€Œβ€β β β€Œβ β€Œβ€Œβ€Œβ€β β€β€Œβ β€Œβ€‹β€Œβ€β€‹β€Œβ€Œβ€β β€β€Œβ β€Œβ€‹β€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ β€‹β€β€Œβ€β€Œβ€Œβ€Œβ β€‹β€‹β€Œβ€β β€‹β€Œβ β€β€Œβ€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β€Œβ€Œβ€β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β β€‹β€Œβ€‹β β€Œβ€‹β€‹β β€‹β€‹β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€‹β β€‹β€β€‹β β€‹β€‹β€‹β β€‹β€β€‹β β€Œβ€β€‹β β€‹β€‹β€‹β β€‹β€Œβ€‹β β€‹β€Œβ€‹β β€Œβ β€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€‹β β€Œβ β€Œβ€β€‹β€β€Œβ€Œβ β β€Œβ€‹β€β€β€Œβ€‹β β€Œβ€Œβ€β€Œβ€‹β€Œβ β€Œβ β€Œβ β€β€Œβ€Œβ€‹β β€Œβ€Œβ€β€Œβ€β€Œβ β€Œβ β€‹β β€Œβ€Œβ€Œβ€β β€Œβ€Œβ€Œβ β β€Œβ€β€Œβ€Œβ€Œβ€β β β€‹β€β€‹β€β€Œβ β β€Œβ€‹β€‹

Seeing lots of 11pm approvals; I flag weekend entries, @ReneeC. Benford’s helpful, but quarter-close overtime skews patterns.

β€Œβ β€β β€‹β€β€‹β€β€Œβ β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ€β€Œβ€β€Œβ€β β β€Œβ β€‹β€β€Œβ€β€Œβ€Œβ€Œβ€β β€β€Œβ β€‹β β€Œβ€β€β€Œβ€Œβ€β€‹β β€Œβ€β€‹β€Œβ€Œβ€β€‹β β€Œβ€β€‹β β€Œβ€β β β€Œβ β€Œβ€Œβ€Œβ€β β€β€Œβ β€Œβ€‹β€Œβ€β€‹β€Œβ€Œβ€β β€β€Œβ β€Œβ€‹β€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ β€‹β€β€Œβ€β€Œβ€Œβ€Œβ β€‹β€‹β€Œβ€β β€‹β€Œβ β€β€Œβ€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β€Œβ€Œβ€β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β β€‹β€Œβ€‹β β€Œβ€‹β€‹β β€‹β€‹β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€Œβ€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€‹β β€‹β€β€‹β β€‹β€‹β€‹β β€‹β€β€‹β β€Œβ€β€‹β β€‹β€‹β€‹β β€‹β€Œβ€‹β β€‹β€Œβ€‹β β€β€‹β€‹β€β€‹β€β€‹β€β β€‹β€‹β€β€‹β€β€Œβ€β€β€‹β€‹β€β€‹β€β€‹β β€β€β€‹β€β€‹β€β€Œβ β€‹β€Œβ€‹β β€‹β€Œβ€‹β β€β€Œβ€Œβ€‹β β€β€Œβ β€‹β€‹β€Œβ β€‹β€Œβ€Œβ€‹β β€‹β€‹β β€‹β β€Œβ€β€Œβ€β€Œβ€β€Œβ€‹β€Œβ€‹β β€β€‹β β€‹β€β€Œβ β€Œβ€‹β€Œβ€Œβ€β€Œβ€Œβ€β β€Œβ€Œβ€β€β€Œβ€‹β€β€‹β€β€Œβ β β€Œβ€‹β€‹