Benford’s law in practice: a simple test that points to unusual numbers
In many real-world sets of numbers, the first digit is far more often 1 than 9. When a ledger breaks that pattern, it is worth a look. How the test works, where it helps and where it misleads.
Look at the first digit of every invoice amount in a year of payments. You might expect each digit from 1 to 9 to appear about equally often. In many real-world data sets it doesn't. Numbers starting with 1 appear in roughly 30% of cases, and numbers starting with 9 in under 5%.
This pattern is known as Benford’s law. Auditors and investigators use it as a quick way to find parts of a data set that behave differently from the rest.
The expected pattern
| First digit | Expected share |
|---|---|
| 1 | 30.1% |
| 2 | 17.6% |
| 3 | 12.5% |
| 4 | 9.7% |
| 5 | 7.9% |
| 6 | 6.7% |
| 7 | 5.8% |
| 8 | 5.1% |
| 9 | 4.6% |
The pattern tends to appear in data that spans several orders of magnitude and grows naturally, such as sales, expenses and payments.
Why it is useful
People who invent numbers rarely reproduce this pattern. Amounts kept just below an approval limit, figures rounded by hand or values repeated many times all show up as spikes in the distribution. The test doesn't prove anything on its own; it tells you where to look.
Where it misleads
Benford’s law does not fit every data set. Be careful with:
- Assigned numbers such as invoice numbers, phone numbers or employee IDs
- Data with limits, such as amounts capped at a policy maximum or with a fixed minimum
- Narrow ranges, for example values that all fall between 100 and 999
- Small populations, where random variation swamps the pattern
- Prices set by policy, like a standard fee charged thousands of times
A deviation in these cases may simply reflect how the business works.
Using it well
- Choose the right population: one type of transaction, over a long enough period.
- Test the first two digits as well as the first. It is more sensitive to amounts kept below limits.
- Measure the deviation, don’t just eyeball the chart. A conformity statistic helps compare periods and units.
- Drill into the spikes. Which users, vendors or accounts create the excess?
- Combine with other tests, such as duplicates, round amounts and weekend postings.
Where it fits
Benford analysis is one test among many in a forensic review. It is fast, cheap and good at pointing. The finding comes from what you do next. Our investigations and forensics team uses it alongside ForenCity and the Audit Suite.