Analytical Fraud-Detection Techniques: Benford's Law and Journal Entry Testing

Analytical fraud-detection techniques
Core methods	Digit-frequency analysis (Benford's Law); risk-based journal entry testing
Key standard	SAS No. 99 (2002; now AU-C 240)
Benford's Law source	Gorenc (2019)
Journal entry source	Lanza & Gilbert (2007)
Highest-risk entry type	"Top-side" entries bypassing subledgers
Internal controls rank	4th among detection methods (ACFE)
Leading detection method	Tips

Analytical fraud-detection techniques are quantitative screening methods that examine the numbers themselves, rather than physical documents or witness testimony, to identify transactions or financial statements warranting closer scrutiny. Two techniques dominate the practitioner literature: digit-frequency analysis under Benford's Law, and risk-based journal entry testing, a structured search of the general ledger developed in response to auditing standards that followed the Enron-era accounting scandals. Both techniques share a common epistemic limitation that runs through this article: neither one proves fraud on its own. Each generates a lead — a stratum of numbers or a cluster of journal entries statistically or structurally unusual enough to merit investigation — that must then be corroborated against source documents, interviews, and the broader constellation of red flags before any conclusion is drawn. This article expands on the mechanics of Benford's Law covered in its own dedicated article by situating the technique within the academic literature on its evidentiary limits, and introduces the parallel discipline of journal entry testing, including its "5 Ws" methodology and its central finding about where financial statement fraud is most likely to hide.

1 Benford's Law as a screening tool, not proof

The full mechanics of digit-frequency analysis — the expected first-digit distribution, its history, and the data conditions required for a valid test — are covered in the dedicated article on Benford's Law. This section focuses narrowly on how the technique is framed as legal evidence, drawing on Gorenc's 2019 study "Benford's Law As a Useful Tool to Determine Fraud in Financial Statements," published in Management: Journal of Contemporary Management Issues.^[1]

Gorenc's central and most consequential claim is a limiting one: a departure from the expected Benford distribution in a set of reported financial figures is insufficient, standing alone, to prove fraud in a court of law.^[1] The statistical test can establish that a dataset's leading-digit profile deviates from what an unconstrained, naturally occurring set of numbers should look like, but it cannot by itself identify who altered the numbers, why, or even whether the deviation reflects intentional manipulation as opposed to a benign structural feature of the data (assigned identifiers, price points, an imposed threshold, or a genuinely unusual but honest business event). This is precisely the same caution developed at length in the Benford's Law article's discussion of requirements and limitations, but Gorenc's framing sharpens it into an explicit evidentiary boundary: the test is a screening and prioritization tool that tells an examiner where to look, not a finding of fact that tells a court what happened.

This distinction matters practically because it defines the correct role of digit analysis inside an investigation. A Benford deviation in, say, a population of vendor disbursements does not itself constitute an allegation; it identifies a stratum of transactions for the examiner to pull and trace to source documents — purchase orders, contracts, receiving reports, and correspondence — using the fuller toolkit of forensic accounting. Only that corroborating evidence, not the statistical anomaly itself, can support a legal conclusion that fraud occurred.

2 Linking digit analysis to fraud theory

Gorenc situates Benford's Law within the same theoretical scaffolding used throughout fraud examination: Cressey's fraud triangle (pressure, opportunity, rationalization) and the Association of Certified Fraud Examiners' three-branch fraud tree taxonomy of corruption, asset misappropriation, and financial statement fraud.^[1] The connection to the fraud triangle is direct: digit-frequency analysis is aimed at surfacing the physical trace left by the opportunity leg once it has been exploited. A manager under pressure to hit an earnings target, and rationalizing the act as temporary or victimless, still has to produce a set of numbers that will pass casual review. Because fabricated figures tend to distribute leading digits more evenly than genuine ones, or cluster suspiciously around round numbers and psychological thresholds, the digit pattern is one of the few artifacts of the underlying human decision that survives into the dataset itself and can be tested independently of the perpetrator's own account.

Within the ACFE's fraud tree, Benford's Law is most useful against financial statement fraud specifically, because that branch produces large populations of unconstrained financial figures — account balances, journal-entry amounts, revenue line items — of exactly the kind the test requires. It is markedly less useful against classic asset misappropriation schemes involving a small number of large, individually fabricated transactions, since a handful of fictitious entries buried in an otherwise honest population will rarely shift the aggregate digit distribution enough to register statistically. This is one reason digit analysis functions best as a complement to, rather than a substitute for, targeted testing of specific transaction populations such as journal entries.

3 Risk-based journal entry testing

Where Benford's Law screens an entire population of figures for statistical anomalies, journal entry testing is a more targeted discipline aimed directly at the general ledger. Lanza and Gilbert's 2007 Journal of Accountancy article "A Risk-Based Approach to Journal Entry Testing" lays out the methodology that has become the standard practitioner reference.^[2] The article's premise is that journal entry testing is not optional or merely good practice: it is a requirement directly responsive to SAS No. 99, Consideration of Fraud in a Financial Statement Audit (2002, now codified as AU-C 240), the same post-Enron standard discussed in the Red Flags and Fraud Triangle articles.^[3] SAS 99 obligates auditors to test the appropriateness of journal entries recorded in the general ledger and other adjustments made in preparing financial statements, specifically because management override of controls, executed through journal entries, is recognized as one of the primary mechanisms of financial statement fraud.

Lanza and Gilbert's methodology departs from traditional sampling in favor of examining the full population of journal entries rather than a statistical subset, using data-analysis software such as Excel, ACL, or IDEA to filter, stratify, and rank entries by risk characteristics.^[2] This full-population approach is possible precisely because journal entry data is structured and extractable in a way that, for example, informal conversations or physical documents are not, making it well suited to the same category of analytical methods that includes digit-frequency testing. The goal is not to review every entry with equal scrutiny but to use risk criteria to triage the population down to a manageable, high-yield subset for manual examination.

4 The "5 Ws" methodology

Lanza and Gilbert organize their risk criteria around a journalistic mnemonic borrowed from investigative reporting: the "5 Ws" — Who, What, When, Where, and Why.^[2] Each question targets a different dimension of a journal entry that can reveal risk:

Question	What it tests	Example risk indicator
Who	The identity and authorization of the preparer and approver	Entries prepared or posted by individuals outside their normal role or authority; entries lacking a second, independent approver
What	The nature, size, and account classification of the entry	Unusually large manual entries; entries affecting sensitive accounts such as revenue, reserves, or related-party balances; entries stratified and ranked by dollar size
When	The timing of the posting	Entries posted on weekends, holidays, or outside normal business hours; entries concentrated at period-end or year-end close, when management has the strongest incentive and the least time for review
Where	The account or ledger location of the entry	Postings to dormant, suspense, or rarely used accounts; entries routed through unusual account combinations
Why	The business rationale and threshold behavior of the entry	Round-dollar amounts (a common signature of an estimated or fabricated figure rather than a computed one); amounts falling just under an approval or reporting threshold; entries lacking adequate supporting documentation or a clear business purpose

These five questions function as a structured extension of the same reasoning found in the Red Flags article's accounting-record category, translated into extractable, filterable data criteria that can be run programmatically across a full general-ledger population rather than relied upon as a manual checklist. In practice, an examiner applying this framework filters the ledger by each of the 5 Ws in combination — for example, isolating round-dollar entries (Why) posted by a small number of senior preparers (Who) at or near period-end (When) — to produce a short list of the highest-risk entries for individual tracing to supporting documentation.

5 Top-side entries and the subledger bypass problem

The single most important finding in Lanza and Gilbert's methodology concerns where fraudulent journal entries are most likely to originate. Most day-to-day accounting entries flow up from subledgers — accounts receivable, accounts payable, payroll, fixed assets — each governed by its own set of controls, reconciliations, and often multiple people involved in processing, which makes subledger-level manipulation comparatively difficult to execute and conceal without collusion.

"Top-side" journal entries, by contrast, are adjustments made directly at the corporate or consolidation level, entered straight into the general ledger or the consolidation software without passing through any subledger and without triggering the subledger's normal control checks.^[2] Lanza and Gilbert identify top-side entries as the highest-risk vehicle for management override of internal controls, precisely because they bypass the layered, cross-departmental controls that would otherwise require multiple people to notice or participate in a manipulation. A single senior manager or a small executive-level team with consolidation access can post a top-side entry that overstates revenue, reduces expenses, or reclassifies a liability, without any subledger clerk, accounts-payable processor, or departmental reconciliation ever seeing or questioning the transaction. This is the general ledger's version of the same override risk discussed in the Financial Statement Fraud article: financial statement fraud is fundamentally a management crime, committed by the people positioned to override the very controls designed to catch ordinary employees, and top-side entries are the specific mechanical instrument through which that override is most often executed.

Testing routines built on this methodology accordingly weight the Who, Where, and When criteria of the 5 Ws toward isolating consolidation-level posting access, entries with no subledger source system, and postings clustered at the close calendar's most sensitive dates — the intersection where a top-side override is most likely to surface.

6 Why internal controls rank only fourth

Lanza and Gilbert ground the urgency of journal entry testing in a finding drawn from ACFE research: internal controls rank only fourth among the methods by which occupational frauds are actually detected.^[2] This finding has been substantially reaffirmed in subsequent ACFE Report to the Nations editions, which consistently find that tips from employees, customers, vendors, or anonymous sources detect a larger share of frauds than any other single method, well ahead of internal audit, management review, or the control environment itself, and that over half of all frauds are attributable to a lack of internal controls or the override of controls that do exist.^[4]

The implication is not that controls are worthless, but that a sophisticated employee, and especially a member of senior management with the authority to make top-side entries, can and routinely does circumvent standard control structures.^[2] A control environment built to catch clerical errors or lower-level misappropriation is not designed to catch a person authorized to bypass it entirely. This is the rationale for a separate, proactive testing routine that does not rely on the control environment functioning correctly in the first place, but independently interrogates the very population of entries that environment was supposed to govern.

7 Red-flag perception research

A separate but related line of research asks not which techniques detect fraud most effectively, but which red flags practitioners themselves believe are most diagnostic. Moyes (2008), "CPAs' Perceptions of Red Flags Used in Detecting Fraud," published in The ICFAI Journal of Audit Practice, surveyed certified public accountants on the perceived effectiveness of fraud indicators, organizing the results along the same three categories as the fraud triangle: pressure, opportunity, and rationalization.^[5] The full text of this specific study was not independently verified for this article; the finding below is reported as consistent with a broader Moyes research program on auditor red-flag perception and should be treated with appropriate caution rather than as a confirmed, independently checked result.

The pattern reported across this literature is that CPAs tend to rate red flags tied to management's attitude or rationalization — such as a known history of securities-law violations, or management's attempts to limit the scope of an audit — as more effective indicators of fraud than red flags tied to opportunity or to incentive and pressure alone.^[5] If accurate, this has a direct practical implication for how an investigator or OSINT researcher triages limited time and resources: a documented pattern of management resistance to scrutiny, or a track record of prior misconduct, may be a more efficient early filter than combing for opportunity-side control weaknesses or pressure-side financial strain, both of which are common in the ordinary course of business and carry a much higher false-positive rate on their own. This finding should be read alongside the fuller discussion of red-flag categories, the SAS lineage, and the general caution that red flags raise questions rather than answer them, in the dedicated Red Flags article.

8 Combining the techniques in practice

Digit-frequency analysis and journal entry testing are complementary rather than competing techniques, and the strongest practical fraud-detection programs run both together as part of the broader suite of analytical methods. Benford's Law is best deployed as a wide, cheap, first-pass screen across an entire population of financial figures — disbursements, account balances, reported line items — to flag strata of numbers whose digit distribution warrants a closer look. Journal entry testing, by contrast, is a narrower, deeper, and more structurally targeted search of the general ledger specifically, built around the 5 Ws and weighted heavily toward the top-side entries identified as the highest-risk vehicle for management override. A well-designed program might use a Benford deviation in a class of accounts to help decide which subledgers or time periods deserve the most intensive journal entry testing, or use the "Why" criterion of round-dollar and threshold-adjacent amounts as a shared filter across both techniques.

Neither technique substitutes for the corroborating work of a full forensic accounting investigation: tracing flagged entries to source documentation, interviewing preparers and approvers, and testing the business rationale offered for each anomaly. Both are, in Gorenc's phrase, tools that determine where to look, not tools that determine what happened. No purely quantitative or purely control-based method has displaced the tip as the single most effective fraud-detection mechanism; the analytical techniques described here sharpen the search once suspicion has already opened the door to a deeper investigation.

See also: Benford's Law, Red Flags, Fraud Triangle, Financial Statement Fraud, Analytical Methods, Forensic Accounting.

References

1. Gorenc, M. "Benford's Law As a Useful Tool to Determine Fraud in Financial Statements." 2019. Management: Journal of Contemporary Management Issues, 14(1), 19-31. doi:10.26493/1854-4231.14.19-31
2. Lanza, R. B., & Gilbert, S. "A Risk-Based Approach to Journal Entry Testing." 2007. Journal of Accountancy, 204(1). journalofaccountancy.com
3. AICPA. Statement on Auditing Standards No. 99, Consideration of Fraud in a Financial Statement Audit. 2002 (now codified as AU-C 240).
4. Association of Certified Fraud Examiners (ACFE). Occupational Fraud 2024: A Report to the Nations. 2024. acfe.com
5. Moyes, G. D. "CPAs' Perceptions of Red Flags Used in Detecting Fraud." 2008. The ICFAI Journal of Audit Practice, 5(1), 47-60. (Full text not independently verified; reported as consistent with the broader Moyes research program — treat with appropriate caution.)