# Benford's Law in Audit 2026: 12,000 Accounts Payable Transactions, Flag or Clear?

Hunter Gibson · October 17, 2026

> Clear a 12,000-transaction AP ledger only when first-digit chi-square is ≤15.507 and MAD is ≤0.006; investigate deviations before escalating.

| Takeaway | Detail |
| --- | --- |
| Clear the 12,000-transaction ledger only when first-digit chi-square is ≤15.507 and MAD is | Chi-square uses 8 degrees of freedom at α=0.05; the MAD cutoff is 0.006. |
| The guide states separate clearing and flagging rules for the same two tests. | Thesis: clear if chi-square ≤15.507 and MAD |
| Investigate a deviating digit without calling it fraud unless escalation criteria are met. | Escalate only if the deviation survives a material review. |
| AML reporting thresholds include U.S. cash deposits over $10,000 and occasional EU transactions above €10,000. | These thresholds standardize detection of suspicious transactions across transaction types. |

This guide sets decision rules for 12,000 accounts payable transactions using first-digit chi-square and MAD.

It explains when to clear, drill down, or escalate without treating a deviating digit as fraud.

![Benford's Law in Audit 2026](https://static.mm-ais.com/article-images-ai/benford-s-law-in-audit-2026-12-000-accou-ai-c9087f20.jpg)

## How Benford flagging actually works

Benford's Law works because first-digit frequencies are constants, not estimates from your sample. In any naturally generated numeric dataset, the digit 1 leads about 30.1% of the time, followed by 2 at 17.6%, 3 at 12.5%, 4 at 9.7%, 5 at 7.9%, 6 at 6.7%, 7 at 5.8%, 8 at 5.1%, and 9 at 4.6%. Those probabilities come from the logarithmic distribution and sum to exactly 100%, which means you can state your expected counts before you ever open the ledger.

For the 12,000 AP transactions, the expected count for leading digit 1 is 3,612 (12,000 × 0.301). The same multiplication gives you expected counts for every other digit: 2,112 for digit 2, 1,500 for digit 3, and so on down to 552 for digit 9. The chi-square statistic then compares what you actually observed against these expectations by summing (observed − expected)² / expected across all nine digits. Because there are nine digit categories, the test has 8 degrees of freedom.

| Test statistic | What it measures | Clear threshold |
| --- | --- | --- |
| Chi-square (df = 8) | Aggregate deviation across digits 1–9 | ≤ 15.507 |
| MAD | Average absolute gap between observed and expected digit proportions | < 0.006 |

Now for the myth worth killing: any deviation means fraud. The number that kills it is 15.507, the chi-square critical value for 8 degrees of freedom at the α = 0.05 significance level. If your computed chi-square is at or below 15.507, the deviation is within ordinary random variation — the kind you would see in perfectly legitimate ledgers. A statistically significant result is not a verdict; it is a signal that the distribution differs from Benford's expectation enough to merit a look, nothing more. Fraudsters fabricating invoices do tend to violate Benford (humans over-use mid-range digits and round numbers), but so do datasets with built-in constraints like fixed recurring amounts or price ceilings.

That is why the MAD test matters alongside the chi-square. The mean absolute deviation averages the difference between observed and expected proportions across all nine digits, and a value below 0.006 confirms conformity at a more granular level than a single aggregate statistic. Run both tests on all 12,000 rows: clear the ledger when chi-square is at or below 15.507 and MAD is below 0.006; flag for a drill-down only when both breach their thresholds. If just one statistic exceeds its threshold, investigate the specific deviating digit — pull the transactions behind it, check for legitimate clustering like recurring vendor payments — without labeling it as fraud. Escalation is reserved for deviations that survive a materiality review, not for a first-pass statistic alone.

![How Benford flagging actually works — Benford's Law in Audit 2026](https://static.mm-ais.com/article-images-ai/benford-s-law-in-audit-2026-12-000-accou-ai-86188e0f.jpg)

## Evidence: thresholds and false positives

ComplyAdvantage estimates that false-positive AML alerts cost financial institutions about $3.5 billion every year, and that overly sensitive thresholds add time and cost burdens to an AML program. That figure is the warning for a Benford review: a low threshold for flagging can turn a statistical screen into an expensive investigation queue before anyone has tested whether the deviation is material.

amlnetwork.org identifies U.S. cash deposits over $10,000 and EU occasional transactions above 10,000 as AML reporting thresholds. Those are jurisdiction-specific compliance triggers, not a universal fraud line, so a first-digit deviation in accounts-payable data should not be treated as proof of misconduct simply because it crosses an arbitrary round number.

| Input | Figure | Use in a Benford review |
| --- | --- | --- |
| amlnetwork.org reporting threshold | $10,000 U.S. cash deposit; €10,000 EU occasional transaction | Shows that alert thresholds are jurisdiction-specific, not one global fraud test |
| ComplyAdvantage false-positive cost | $3.5 billion per year | Shows the cost of over-sensitive alerting |
| Risk-based convergence | Set sensitivity to the cost of failure and the cost of review | Use the Benford flag as triage, then investigate the deviating digit without calling it fraud |

The convergence is that reporting thresholds and false-positive costs point in the same direction: threshold design should reflect what failure would cost, not just what the system can technically execute. A Benford screen therefore needs a second step after the flag, because the first step only says the observed first-digit pattern differs from the expected pattern.

In practice, the $10,000 or 10,000 line can inform where a jurisdiction expects heightened scrutiny, while the $3.5 billion estimate reminds the team that every unnecessary alert has a price. The review should isolate the deviating digit, test whether it is material to the ledger, and document the result before anyone labels the transaction set fraudulent.

![Evidence: thresholds and false positives — Benford's Law in Audit 2026](https://static.mm-ais.com/article-images-pixabay/benford-s-law-in-audit-2026-12-000-accou-ebc99efe.jpg)

## Options compared: flag rules

The choice among flagging rules is really a choice among error profiles: false positives, blind spots, or a controlled escalation path.

Option A, raw chi-square only, flags any statistically significant deviation. Because chi-square scales with sample size, a large population can make a small deviation look significant; at N=12,000, a trivial 0.8 percentage-point deficit in digit 9 can exceed 15.507. The rule therefore over-flags routine noise and raises false positives.

Option B, MAD only, measures overall distance from expected first-digit shares but ignores which digit deviates. A large spike in one digit can be diluted by small offsets elsewhere, so the rule can miss concentrated anomalies in digits 4 through 7 that matter for AP fraud, such as clusters of $4,999 approvals.

| Rule | Strength | Failure mode |
| --- | --- | --- |
| Option A: chi-square only | Detects any significant deviation | False positives from trivial deviations at large N |
| Option B: MAD only | Measures overall deviation size | Misses concentrated anomalies in digits 4-7 |
| Option C: combined + materiality | Requires significance and size | Needs both statistics and a materiality filter |

Option C, combined chi-square plus MAD plus a materiality floor, is the winner. It flags only when chi-square exceeds 15.507 and MAD is at least 0.006, then filters to transactions above audit material. If only one statistic breaches, investigate the specific digit and its transactions, but do not treat the result as a fraud flag.

Practical check: run both statistics on the full population, record which digit drives any breach, and escalate only when the combined test and materiality filter agree. That preserves detection while avoiding Option A's false positives and Option B's blind spots.

![Options compared: flag rules — Benford's Law in Audit 2026](https://static.mm-ais.com/article-images-pixabay/benford-s-law-in-audit-2026-12-000-accou-0cee9168.jpg)

## Costs, limits, and edge cases

Benford's Law is a screen for naturally generated amounts, not a universal test. It breaks when the population is dominated by assigned identifiers or constrained values: invoice numbers, check numbers, account codes, fixed approval caps, and repeated vendor templates can all force first digits into patterns that have nothing to do with fraud. It still wins when the population is unconstrained AP amounts that span several orders of magnitude, because those amounts are generated by many independent decisions rather than by a numbering scheme. The edge cases are population-quality failures, not fraud indicators by themselves.

| Population condition | Benford result |
| --- | --- |
| More than 20% assigned or capped numbers | Unreliable; do not use as a screen |
| Clean AP amounts, N at least 10,000 | Useful screen, never proof of fraud |

The practical limit is population composition. If more than 20% of the population consists of assigned or capped numbers, Benford is unreliable for that population; if the population is clean AP amounts with at least 10,000 observations, it is a useful screen but never proof of fraud.

The cost check is asymmetric. A false clear can let a material misstatement pass because the screen looked clean; a false flag wastes review time and can train reviewers to ignore the next alert. The rule therefore treats Benford as a triage signal: investigate the deviating digit, document why it deviates, and escalate only when the deviation survives materiality and population-quality checks.

When the population is mixed, segment it before testing. Separate assigned identifiers, capped payments, and template-driven vendors from unconstrained amounts, then run the screen only on the segment that behaves like a natural distribution. That preserves the screen's value where it works and prevents a bad population from discrediting a good control. A clean result in a mixed population is not evidence of no fraud; it is evidence that the screen was applied to the wrong population.

![Benford's Law in Audit 2026, photo 2](https://static.mm-ais.com/article-images-pixabay/benford-s-law-in-audit-2026-12-000-accou-b9ddaf18.jpg)

## 12,000 AP transactions

This 12,000-row AP example uses observed first-digit counts of 1=3,700, 2=2,100, 3=1,500, 4=1,200, 5=950, 6=800, 7=700, 8=600, and 9=450. It is a worked example for applying the rule, not evidence about any actual ledger.

The checkpoint expected counts are 3,612; 2,112; 1,500; 1,164; 948; 804; 696; 612; and 552. The first-digit chi-square is about 22.46 against a critical value of 15.507 with 8 degrees of freedom, so the ledger is statistically flagged. The MAD is about 0.0024, below 0.006, indicating close conformity; on these two results together, do not call the ledger fraudulent. The breach is driven mainly by digit 9, whose observed count of 450 is 102 below its expected 552, so the follow-up is a digit-9 drill-down.

Apply the rule mechanically: clear only when chi-square is at or below 15.507 and MAD is below 0.006; flag for drill-down when either exceeds its threshold; escalate only if the deviation survives a materiality review. Here, chi-square exceeds 15.507 while MAD stays below 0.006, so the status is "flag for drill-down," not "clear" and not a fraud call.

| Digit | Observed count | Expected count | (O−E)²/E |
| --- | --- | --- | --- |
| 1 | 3,700 | 3,612 | 2.14 |
| 2 | 2,100 | 2,112 | 0.07 |
| 3 | 1,500 | 1,500 | 0.00 |
| 4 | 1,200 | 1,164 | 1.11 |
| 5 | 950 | 948 | 0.00 |
| 6 | 800 | 804 | 0.02 |
| 7 | 700 | 696 | 0.02 |
| 8 | 600 | 612 | 0.24 |
| 9 | 450 | 552 | 18.85 |
| Total | 12,000 | 12,000 | 22.46 |

The table records each digit, observed count, expected count, and chi-square component, with totals of 12,000 transactions and 22.46. Retain it with the run so a reviewer can see which digit caused the flag.

To apply the rule to another ledger, replace the observed counts with that ledger's first-digit counts, keep the expected counts and formulas fixed, and recompute chi-square and MAD before changing any status. If chi-square is at or below 15.507 and MAD is below 0.006, clear the ledger; if either exceeds, flag the deviating digit for review without calling it fraud.

![12,000 AP transactions — Benford's Law in Audit 2026](https://static.mm-ais.com/article-images-pixabay/benford-s-law-in-audit-2026-12-000-accou-c3a7b9bf.jpg)

## Decision rules for flag or clear

If the first-digit chi-square is at or below 15.507 and MAD is below 0.006, clear the full 12,000-transaction population. No Benford escalation is opened, no digit-level review is required, and the result is recorded as a pass for the period. This is the only clear outcome under the rule, and it should be documented with both test results and retained in the audit file.

If chi-square exceeds 15.507 and MAD is at least 0.006, flag the population for drill-down. Review every first digit whose observed count deviates more than 10% from its expected count, list the digit, observed count, expected count, and variance, and require a second reviewer before any escalation. The drill-down is limited to digits above the 10% gap, and the flag is not treated as a fraud finding.

If chi-square exceeds 15.507 while MAD stays below 0.006, investigate the specific deviating digit, such as digit 9, but leave the fraud conclusion unstated. With 12,000 transactions, a small deviation can be statistically significant without being materially important, so the review should focus on cause, population mix, and control evidence rather than accusation. The digit is named in the review note.

If chi-square is at or below 15.507 while MAD is at least 0.006, treat MAD as an effect-size warning rather than an escalation trigger. Review the largest digit gap, compare it with the control environment and transaction population, and escalate only if a separate issue supports that action. Document why the chi-square result did not drive the decision, and make no escalation on MAD alone.

If a drill-down digit's deviation survives materiality review, escalate the item to fraud investigation with the digit-level evidence attached. If it does not survive, record the review, the digit, the observed and expected counts, and the rationale, then close the Benford item without escalation. The materiality review is documented before escalation, and either outcome must be traceable to the rule used.

## What to do next

| Step | Action | Why it matters |
| --- | --- | --- |
| 1 | Run first-digit chi-square and MAD on all 12,000 accounts payable transactions. | Creates the Benford baseline for the ledger. |
| 2 | Clear the ledger only if chi-square is ≤15.507 (8 degrees of freedom, α=0.05) and MAD is | Both tests must pass under the clearing rule. |
| 3 | If either test exceeds its cutoff, flag the deviating first digit for drill-down rather than treating it as fraud. | A statistical deviation alone is not an accusation. |
| 4 | Screen flagged deviations through the materiality floor and duplicate/round-number checks before escalation. | Filters benign or structured anomalies. |
| 5 | Escalate only deviations that survive material review, using AML thresholds (U.S. cash deposits over $10,000; occasional EU transactions above €10,000) as standardized context. | Keeps escalation consistent across transaction types. |
| 6 | Record the test results and the clear, flag, or escalate decision in the audit workpaper. | Preserves reproducibility and reviewability. |

## Frequently Asked Questions

**What significance level and degrees of freedom apply to the chi-square test?**

Chi-square uses 8 degrees of freedom at α=0.05.

**What is the MAD cutoff?**

The MAD cutoff is 0.006.

**When does a deviation get escalated rather than merely investigated?**

Escalate only if the deviation survives a material review.

**What AML reporting thresholds are listed?**

AML reporting thresholds include U.S. cash deposits over $10,000 and occasional EU transactions above 10,000.

**Why can expected first-digit counts be set before reviewing the ledger?**

Those probabilities come from the logarithmic distribution and sum to exactly 100%, which means you can state your expected counts before you ever open the ledger.

**Are clearing and flagging governed by the same rule set?**

The guide states separate clearing and flagging rules for the same two tests.

## Quick answers

| What does the guide use to set decision rules for the 12,000 accounts payable transactions? | The guide sets decision rules for 12,000 accounts payable transactions using first-digit chi-square and MAD. |
| --- | --- |
| What chi-square cutoff is paired with 8 degrees of freedom at α=0.05? | The chi-square cutoff is ≤15.507. |
| What is the MAD cutoff? | The MAD cutoff is 0.006. |
| Which digit leads about 30.1% of the time under Benford's Law? | Digit 1 leads about 30.1% of the time. |
| What AML reporting thresholds are mentioned? | AML reporting thresholds include U.S. cash deposits over $10,000 and occasional EU transactions above €10,000. |

Also worth reading: **Continuous audit monitoring vs sampling: 3x detection rate—switch in 2026?**: [Continuous audit monitoring vs sampling:](https://financialauditexpert.com/blog/continuous-audit-monitoring-vs-sampling-3x-detection-rateswitch-in-2026.php) · **Benford's Law 2026: MAD Zero and Sequential Tests from 2025 Filings**: [Benford's Law 2026: MAD Zero](https://financialauditexpert.com/blog/benfords-law-2026-mad-zero-and-sequential-tests-from-2025-filings.php) · **Benford's Law: 8% False-Positive Rate in Q1 2026 10-Q Revenue**: [Benford's Law: 8% False-Positive Rate](https://financialauditexpert.com/blog/benfords-law-8-false-positive-rate-in-q1-2026-10-q-revenue.php)

### Related reading

- [Spotting Invalid Transactions Before the Audit Team Arrives](https://financialauditexpert.com/blog/spotting-invalid-transactions-before-the-audit-team-arrives.php)
- [Legal Requirements and Consumer Protections Understanding Autopay Authorization Standards in Business Transactions](https://financialauditexpert.com/blog/legal_requirements_and_consumer_protections_understanding_au.php)
- [Understanding Fair Value Measurement in Non-Monetary Exchange Transactions A 2024 Analysis](https://financialauditexpert.com/blog/understanding_fair_value_measurement_in_non_monetary_exchang.php)
- [Decoding Multiple 401k Accounts and the Reality of Retirement Loans](https://financialauditexpert.com/blog/decoding_multiple_401k_accounts_and_the_reality_of_retiremen.php)
- [2026 Ledger Physics: Benford Screen, Forest Flags, Queue Cost](https://financialauditexpert.com/blog/2026-ledger-physics-benford-screen-forest-flags-queue-cost.php)
- [Benford's Law Flags 11% of ERP Spend: Monitor or Triage?](https://financialauditexpert.com/blog/benfords-law-flags-11-of-erp-spend-monitor-or-triage.php)

### Latest

- [Internal Controls Review: Testing 5 Bonsai Workflows for Duty Gaps](https://financialauditexpert.com/blog/internal-controls-review-testing-5-bonsai-workflows-for-duty-gaps.php)
- [What Are Internal Controls? 3-Layer Framework for Anomaly Detection in 2026...](https://financialauditexpert.com/blog/what-are-internal-controls-3-layer-framework-for-anomaly-detection-in-2026-audits.php)
- [Continuous audit monitoring vs sampling: 3x detection rate—switch in 2026?](https://financialauditexpert.com/blog/continuous-audit-monitoring-vs-sampling-3x-detection-rateswitch-in-2026.php)

Canonical: https://financialauditexpert.com/blog/benfords-law-in-audit-2026-12000-accounts-payable-transactions-flag-or-clear.php
Markdown: https://financialauditexpert.com/blog/benfords-law-in-audit-2026-12000-accounts-payable-transactions-flag-or-clear.php/index.md