2. Jamie Ralls, CFE, ACDA Ian Green, M.Econ, CGAP Wendy Kam, MBA Oregon Audits Division NASACT March 24, 2016

3. Opening Remarks Moderator R. Kinney Poynter Executive Director NASACT Speaker Ian Green Senior Auditor Audits Division (OR) 2 Speaker Jamie Ralls Principal Auditor Audits Division (OR) Speaker Wendy Kam Staff Auditor Audits Division (OR)

4. Agenda 1. History 2. What is Benford’s Law (a.k.a Benfords) 3. Types of data that conform 4. Uses in fraud investigations 5. ACL and Excel examples 6. Fraud analysis in the real world & other tests 7. Lessons learned 3

5. Polling Question #1 of 5 For individuals: Please be sure to answer the polling questions as they are also your attendance checks for today’s webinar. For groups: Please answer in a way that reflects the consensus of the group. Attendance for groups is still monitored via the sign-in sheet. Don’t forget to send in your questions! 4

6. History Simon Newcomb – 1881 Frank Benford – 1938 Roger Pinkham – 1961 Mark Nigrini - 1989 5 Frank Benford - 1912 Logarithm Book

7. What is Benford’s Law It gives the probability of obtaining digits 1 through 9 in each position of a number For example 3879 3 – first digit 8 – second digit 7 – third digit 9 – fourth digit Most people assume that the probability is 1/9 that the first digit will be a given number According to the law, the probability of obtaining a “1” in the first digit position is 30.1% and run down to 4.6% for “9”. 5

8. Benford’s Distribution Mathematical Formula: P(d) = Log 10 (1+ 1/d) 7

9. Normal Distribution 8

10. Another Way to Think About Benford’s Law 9 2,000 is a 100% increase over 1,000 9,000 is only a 12.5% increase over 8,000 1,000 2,000 9,000 8,000 (2,000-1,000)/1,000 = 100% change (9,000-8,000)/8,000 = 12.5% change

11. 10 Small change needed Note how this pattern follows Benford’s Distribution 100%50% 33.3%25%20%16.7%14.3% 12.5% 11.1% 123456789

12. Key Assumptions The set of numbers is not limited All leading digits are possible (1,2,3,4,5,6,7,8,9) Numbers span multiple orders of magnitude For example, 1 to 10, 10 to 100, 100 to 1,000 Numbers with at least 4 possible digits work best Sample size is very large Use the entire population, if available Sample sizes under 100 won’t work Sample sizes under 1,000 are not very reliable in most situations 11

13. What Works, What Doesn’t Follows Benfords Most accounting related data, such as Accounts Receivable Transaction level data Addresses Bank account balances Census data River drainage Doesn’t follow Benfords Ages Heights Zip codes Payroll Invoice numbers Check numbers Product price ATM withdrawals 12 Note: Remember to check your dataset to see that it meets the required assumptions from slide 9, The above list does not work in all cases

14. Why… Bank account balances Numbers have no limit and span multiple orders of magnitude From $1 to $1 billion+ Available sample size of data is very large Nearly everyone has one ATM Withdrawals Upper and lower limit Minimum generally $20 Maximum generally $800 Numbers span only 2 orders of magnitude Generally limited to multiples of $20 13

15. Polling Question #2 of 5 For individuals: Please be sure to answer the polling questions as they are also your attendance checks for today’s webinar. For groups: Please answer in a way that reflects the consensus of the group. Attendance for groups is still monitored via the sign-in sheet. Don’t forget to send in your questions! 14

16. Benford’s Law Uses Payment Information – vendor payments, travel payments, and credit card payments. Example: State travel payments, excess leading digits of ’24’. Bad Debt Write offs Example: An internal auditor ran Benfords and found a spike in leading digits of ‘49’. Upon further investigation they found a huge fraud where the bank rep was opening up credit cards for his friends who were charging the card to just under $5,000, and then not paying on the debt. The bank rep was writing them off with no one knowing because the approval was $5,000 and over. 15

17. 16 Enron Fraud

18. Tax Fraud Reportedly used by the IRS and several states to detect tax return fraud. Al Capone tax returns – The first digit 1 shows up about 15% of the time (as opposed to the expected 30%) Small Public sector company – family share holders. Used tax returns from 7 years and aggregated it. Ran Benfords and found the pattern was not naturally occurring. 17

19. Check Fraud/Embezzlement in Arizona State of Arizona vs Wayne James Nelson (1993) Wrote 23 checks (approx. $2 million) Check amounts < 100K (tried to circumvent a control that required human signatures) 18

20. Embezzlement Continued 19 Embezzler started small, then increased amounts. Over 90% have a first digit of 7, 8, or 9

21. Can Benford’s Law be used in Court? Yes! But don’t just take our word for it: 20 Clip of Darrell Dorrell graciously provided by WNYC Studios and Radiolab! To listen to the full episode or to learn more about this program please visit: http://www.radiolab.org/story/91699-from-benford-to-erdos/http://www.radiolab.org/story/91699-from-benford-to-erdos/ All rights reserved by WNYC Studios and Radiolab.

22. 21 Applying Fraud Analysis in the Real World

23. Other Useful Fraud Detection Tests Average transaction amount Percent of even dollar transactions Analyzing records of clients with a high number of “lost” cards High number of multiple same day/same time transactions This could indicate someone splitting fraudulent transactions to avoid detection Large distances traveled Owner using personal SNAP card at their store 22

24. Top 30 Placeholder 23

25. Real World Example Food Stamp (SNAP) Fraud in Oregon 24 Store TypeAverage TransactionAverage % Even Convenience stores Mini markets 7-11 $6~5% Walmarts$33~5% Safeway/Albertsons$24~5% “Dollar” stores$847% Meat markets$3712% Carniceria Mi Pueblo$5451%

26. ACL Demo The following slides are screenshots of the ACL demo for your records. 25

27. Carniceria Mi Pueblo 26

28. Comparison Stores 27

29. 28

30. Benford’s on Second Digit 29

31. Second Digit Table 30

32. 31

33. 32 Note how Carniceria’s percent of even dollar transactions steadily rose over the years, while comparison stores did not

34. 33 Note how Carniceria’s average transaction amount rose dramatically over the years, while comparison stores did not

35. Excel Demo The following slides are screenshots of the Excel demo for your records. 34

36. Excel 35

37. Excel First Digit 36

38. Excel First Two Digit 37

39. Geographic Information System (GIS) Overview What is it? How is it used? Where can I learn more? ArcGIS (www.esri.com)www.esri.com Free and open source - QGIS (http://www.qgis.org/en/site/) or Grass GIS (http://grass.osgeo.org/)http://www.qgis.org/en/site/http://grass.osgeo.org/ 38

40. Distance Traveled Using ArcGIS To protect client privacy this map does not use actual client addresses 39

41. Polling Question #3 of 5 For individuals: Please be sure to answer the polling questions as they are also your attendance checks for today’s webinar. For groups: Please answer in a way that reflects the consensus of the group. Attendance for groups is still monitored via the sign-in sheet. Don’t forget to send in your questions! 40

42. 41 Office Addresses Bank Balances – Follows Benfords Ages Heights Pre-Webinar Survey Results – Sample Size 367

43. 42 Pre-Webinar Survey Results – Sample Size 367 Home Addresses – Follows Benfords SSNs – 8 & 9 should not be possible unless issued after 2011 Drivers Licenses Favorite/Random Numbers Look at that bias!

44. Last 2 Digits Overview 43 The test identifies abnormal duplications on the right side (i.e. Cents), these duplications could indicate errors, invented numbers, or excessive rounding. It is expected that the right side two digits be distributed evenly. With 100 possible last two digit numbers (00, 01, 02…..98,99), each should occur approximately 1% of the time.

45. Human Service Forecast Audit Last Digit Test 44

46. Other Tests Using Benford’s Law What we’ve covered so far: First Digits First-Two-Digits Last Two Digits Other Tests: First-Three-Digits Second Digits Number Duplication Rounded Numbers Second order Summation Mean Absolute Deviation(MAD) Distortion Factor 45

47. Polling Question #4 of 5 For individuals: Please be sure to answer the polling questions as they are also your attendance checks for today’s webinar. For groups: Please answer in a way that reflects the consensus of the group. Attendance for groups is still monitored via the sign-in sheet. Don’t forget to send in your questions! 46

48. Lessons Learned Benford’s law will lead to false positives Business processes can change the distribution of leading digits to appear to violate Benford’s, when in fact, there is no fraud occurring Unusual patterns only indicate fraud Additional investigative work is required to prove fraud Benfords will not detect all types of frauds For example, bribes and kickbacks are off the books and undetectable through data analysis Proportional manipulations 47

49. Putting It All Together Work with law enforcement partners to deliver the information they need for their investigation and the trial Be ready for last minute rush requests Document your work as you go Prepare to testify before a jury 48

50. 49

51. Helpful Resources Books by Mark J. Nigrini, Ph.D. http://www.nigrini.com/benfords law.htm https://www.facebook.com/Benf ordsLaw/ www.acl.com www.acfe.com 50

52. Polling Question #5 of 5 For individuals: Please be sure to answer the polling questions as they are also your attendance checks for today’s webinar. For groups: Please answer in a way that reflects the consensus of the group. Attendance for groups is still monitored via the sign-in sheet. Don’t forget to send in your questions! 51

53. Question and Answer Session Moderator R. Kinney Poynter Executive Director NASACT Speaker Ian Green Senior Auditor Audits Division (OR) 52 Speaker Jamie Ralls Principal Auditor Audits Division (OR) Speaker Wendy Kam Staff Auditor Audits Division (OR)

54. Thank You! Oregon Audits Division 255 Capitol Street NE STE 500 Salem, OR 97310 (503) 986-2255 Jamie.N.Ralls@state.or.us Ian.M.Green@state.or.us Wendy.Kam@state.or.us 53 Additional Questions?

55. Attendance Check – FOR INDIVIDUALS ONLY  Please type “I have completed the webinar.” in your Question toolbar.  Be sure to hit the send button after typing your response. 54