# Spotting odd journal entries: Benford's Law and AU-C 240 — 30.1% flag vs review

Hunter Gibson · November 1, 2026

> Benford's Law first-digit MAD under AU-C 240 uses a 0.0018 threshold to flag unusual journal entries for targeted review without concluding fraud.

This guide explains how to use Benford's Law first-digit MAD as a screening flag for journal entries under AU-C 240.

It shows why a 0.0018 threshold triggers targeted review without supporting a fraud conclusion alone.

![This guide explains how to use Benford's Law — Spotting odd journal entries](https://static.mm-ais.com/article-images-ai/spotting-odd-journal-entries-benford-s-l-ai-bf7433c0.jpg)

## How Benford screening actually works

Benford's Law for first digits is based on the logarithmic spacing of numbers, not on any assumption of uniformity. On a base-10 logarithmic scale, the intervals for smaller leading digits are larger than those for larger leading digits. This produces the first-digit expected frequencies: 30.1% for digit 1, 17.6% for digit 2, 12.5% for digit 3, 9.7% for digit 4, 7.9% for digit 5, 6.7% for digit 6, 5.8% for digit 7, 5.1% for digit 8, and 4.6% for digit 9. The 30.1% figure is strictly the expected share of leading 1s under this distribution, not a flag rate or a detection rate.

Before any comparison can be made, the journal-entry amount population must be filtered. Only entries that meet the testing floor should be included in the first-digit screen, as amounts below that floor are more prone to rounding or represent items that may not follow the same scale-based process. From that filtered population, the observed proportion is calculated for each of the nine first digits. These observed proportions are then matched against the expected proportions from the first-digit Benford distribution for the exact same digits.

The measure used to summarize the overall fit is the Mean Absolute Deviation, or MAD. The MAD is the mean of the absolute differences between observed and expected digit proportions across all nine digits. For each digit from 1 to 9, the absolute difference |observed_d - expected_d| is taken, all nine are summed, and that sum is divided by nine. The result is a single value in proportion units. As outlined by Mark Nigrini, first-digit MAD conformity bands are 0.000–0.006 for close conformity, 0.006–0.012 for acceptable conformity, and above 0.012 for nonconformity, with 0.0018 often applied as a stricter screening threshold.

This is the full computation pipeline for a first-digit MAD: define the filtered population by the testing floor, obtain observed proportions per first digit, subtract expected proportions per first digit, take absolute values, average them across all nine digits. The output is only a measure of deviation from the first-digit expected-frequency mechanism. It does not, by calculation alone, assign cause to that deviation. The value of the MAD is the fit statistic itself, and any comparison to a conformity band is a comparison of that statistic to an established deviation scale, not an automatic judgment beyond the degree of fit.

![How Benford screening actually works — Spotting odd journal entries](https://static.mm-ais.com/article-images-ai/spotting-odd-journal-entries-benford-s-l-ai-d9e1a126.jpg)

## The evidence: what the numbers support

The screening workflow rests on three independent authorities that do not depend on one another: Benford's Law supplies the first-digit expected distribution, including the 30.1% share for leading digit 1, as a fixed mathematical constant; Nigrini's bands supply the 0.0018 MAD cutoff as a practitioner convention; and AU-C 240 supplies the professional standard that keeps a statistical flag separate from a fraud conclusion. Because each comes from a different domain, their agreement is convergence rather than circularity.

| Source | Contribution | Nature |
| --- | --- | --- |
| Benford's Law | Expected first-digit distribution, including the 30.1% share for leading digit 1 | Fixed mathematical constant |
| Nigrini conformity bands | 0.0018 MAD cutoff for first-digit conformity | Practitioner convention |
| AU-C 240 | Fraud-risk assessment and evidence requirements | Professional standard |
| SICK continuous threshold adaptation | Fixed thresholds degrade as conditions drift and must adapt | Sensor-governance analogy |

The 30.1% figure is the expected share of entries whose first digit is 1 under Benford's Law, and it functions as a benchmark inside the MAD calculation. A population whose first-digit pattern deviates enough to push MAD to or above 0.0018 is routed to targeted journal-entry review. The flag is therefore a review trigger for populations, not a detection rate for fraud, and it does not estimate how many entries are misstated.

SICK's glossary on continuous threshold adaptation states the general control principle that a fixed threshold degrades as conditions drift and must adapt; its example is a sensor that adjusts when contamination impairs detection. The audit analogue is that a static 0.0018 cutoff can mis-fire when entry volume or the tested population changes, so the cutoff should be treated as a trigger for review and recalibration rather than as a self-proving fraud test.

Accordingly, a first-digit MAD at or above 0.0018 is a mandatory review trigger for the affected journal-entry population. It is not, standing alone, audit evidence of fraud under AU-C 240; any fraud-risk conclusion requires corroboration from other procedures, such as an entry-level attribute test, a period-end timing test, or a manual-vs-automated split.

![The evidence: what the numbers support — Spotting odd journal entries](https://static.mm-ais.com/article-images-pixabay/spotting-odd-journal-entries-benford-s-l-514ae7fd.jpg)

## Options compared: screen, review, or escalate

When a first-digit MAD reaches or exceeds Nigrini's 0.0018, the question is not whether to notice it, but how to respond to it. Option A is to treat that MAD as a fraud indicator and escalate directly to the engagement partner. While this is the fastest posture, it is unsupported by AU-C 240, which requires corroborating procedures before forming any fraud-risk conclusion. The check for this option is procedural: a screening statistic can narrow focus, but it cannot, by itself, create audit evidence.

Option B is to flag at 0.0018, route only the affected journal-entry population to targeted journal-entry review, and escalate to the engagement partner only on corroboration from those review procedures. This is the winner among the three postures, because it preserves the purpose of the flag without overreaching the standard. The discipline here is strict: the trigger is review, not accusation. By limiting the review to the affected population, the response stays focused without abandoning the evidence-based requirement of AU-C 240.

Option C is to raise the cutoff to 0.006 (the top of close conformity) to suppress noise. On the surface, this can reduce the volume of populations sent to review. However, that reduction comes with a direct trade-off: a higher cutoff narrows the set of populations that receive any review at all. The check for this option is coverage, not comfort. Without corroborating data from the other parts of the workflow, there is no basis to assume that moving the cutoff removes only irrelevant flags.

These three postures differ in where they place the burden of proof. Option A places it on escalation with no required corroboration. Option C places it on the cutoff itself to justify inaction. Option B places it on targeted review, with a clear stop rule: no AU-C 240 fraud conclusion from the MAD alone. For that reason, the required response is Option B, applied as a mandatory review trigger for the affected population, not as a path to immediate escalation.

![Spotting odd journal entries](https://static.mm-ais.com/article-images-pixabay/spotting-odd-journal-entries-benford-s-l-f7bed8ed.jpg)

## Costs and numbers that matter

The only new task for this section is to quantify the review burden and the cost of each error direction. The expense of a Benford screening action is not the calculation, but the entry-level attribute testing required for each flagged journal-entry population. That testing must look to specific attributes, such as user ID, posting time, and account pairing, for every population pulled into review. Because of that labor, flag volume is the true cost driver, and any change to the action point will change the size of that queue before it changes the math itself.

The cost of a false negative is the one that maps most directly to AU-C 240. An undetected period-end manual entry that reverses the following period is the classic target for this type of review. Missing that single type of entry can require far more effort to unwind than the hours spent on a batch of tests, and it is the error direction that justifies pulling a population into review in the first place. For that reason, the question is not whether to avoid all flags, but whether the review capacity can cover the populations that are actually pulled in.

The cost of a false positive is the opposing trade-off. Every hour spent testing a population that would hold up under attribute review is an hour not spent on other audit procedures. This is not a minor nuisance, but a real opportunity cost. The trade-off is unavoidable: pulling more populations into testing raises the chance of catching the reversal-type entry, while pulling fewer keeps reviewer hours down at the cost of leaving more borderline populations untested. As noted by TelcoEdge Blog in its guidance on alert thresholds, routine review of alert thresholds is needed as conditions change, which matches the need to re-evaluate the review load against available capacity over time.

With only method and direction to go by, the practical check is capacity-based. Before acting on any flag volume, the review team must know how many entry-level tests its assigned hours can absorb for the affected subledger, and it must weigh that against the AU-C 240 priority of the reversal-type entry. The burden and the two error directions are the numbers that matter here, and neither can be ignored to force a fraud conclusion from the flag alone.

![Costs and numbers that matter — Spotting odd journal entries](https://static.mm-ais.com/article-images-pixabay/spotting-odd-journal-entries-benford-s-l-dc7006bf.jpg)

## What the evidence does NOT establish

The 0.0018 cutoff only holds for the first-digit MAD it was calibrated against, so the first boundary to enforce is the population itself. If the journal-entry population is made up of assigned or constrained leading digits, such as sequential invoice numbers, fixed-price schedules, or capped amounts, the logarithmic expectation no longer applies. In those constrained sets, the 0.0018 rule breaks. That said, this does not disqualify the test entirely, as it can still be informative on unconstrained discretionary accruals where leading digits are not forced by numbering or caps.

A second check is the digit position being measured. First-digit and first-two-digit MADs are not comparable, as they track different positions with different deviation scales. Because of this, the 0.0018 value cannot be transplanted to a first-two-digit MAD output. If a tool attempts to apply that exact cutoff to first-two-digit results, the comparison is invalid on its face, no matter how small or large the reported MAD appears.

Third, conformity must never be mistaken for clearance. A first-digit MAD below 0.0018 does not prove a population is free of issues. Manipulation confined to a small subset of entries can be diluted by the rest of the population, leaving the aggregate within conformity. For that reason, a conforming result cannot be used to rule out targeted activity, and it cannot satisfy any requirement to clear the population under AU-C 240.

These are not rare footnotes, but the exact edge cases where the 0.0018 rule breaks. Knowing these boundaries prevents a screening flag from being stretched past its calibration. The cutoff can prompt review, but it cannot, by itself, establish audit evidence of fraud. The test's limits are just as important as its trigger, and both must be applied before any escalation is considered.

![What the evidence does NOT establish — Spotting odd journal entries](https://static.mm-ais.com/article-images-pixabay/spotting-odd-journal-entries-benford-s-l-5cf443b9.jpg)

## And review worksheet

To put the trigger into practice, consider a year with 48,000 journal entries. Applying a testing floor of $500 removes 16,800 entries, leaving 31,200 testable entries. For that testable population, the observed leading-1 share is 33.4% versus the Benford 30.1% expectation, and the observed leading-9 share is 3.9% versus 4.6%. These single-digit deviations are not proof of anything on their own, but they are the exact inputs that feed the Mean Absolute Deviation (MAD) across all nine first digits.

Checkpoint 1: compute that MAD for all 31,200 testable entries. For this walkthrough, suppose it lands at 0.0021. Since Nigrini's 0.0018 is the conformity threshold, 0.0021 is above the trigger, yet still inside close conformity (≤0.006). At this exact point, the only required action is to mark the population for review. The 30.1% expectation is a review-trigger rate, not a detection rate, so this result cannot be escalated to a fraud conclusion under AU-C 240 by itself.

Checkpoint 2: do not expand that review to all 31,200 entries. Stratify by entry method: suppose manual entries (6,100) carry a MAD of 0.0048, while automated entries carry a MAD of 0.0009. The flag is concentrated in the manual subset, not spread evenly across the population. This concentration is the value of the worksheet: the MAD above 0.0018 tells you to review, but the split tells you where to review with the least unnecessary scope.

For immediate use, run this copy-usable checklist on any first-digit test: confirm the testable population after the testing floor, calculate MAD across all nine digits against 0.0018, if above 0.0018 stratify by a known control to narrow to a subset, review only that subset with documented procedures, and require corroborating evidence before any fraud-risk conclusion. This numeric walkthrough and checklist are the only deliverable of this worksheet, turning a single MAD figure into a targeted, defensible review plan.

## Decision rules for the 0.0018 trigger

When first-digit MAD ≥ 0.0018, the action must be procedural, not presumptive. As the only escalation logic for this trigger, the first check is source split: if the manual-entry subset MAD exceeds the automated subset by more than 2x while the overall MAD ≥ 0.0018, route only the manual subset to entry-level attribute testing. This keeps review effort targeted to the subset where direct input is present, without expanding testing to the entire population.

Before any routing, applicability must be verified. If MAD ≥ 0.0018 but the population is constrained, such as sequentially numbered entries or fixed-price entries, do not treat the result as a flag. Instead, document the specific constraint that makes Benford inapplicable and use a review-based procedure built for that structure. Much like the principle of continuous threshold adaptation described by SICK for detection equipment, the procedure must adjust to the conditions of the population rather than forcing a fixed measurement onto an unsuitable one.

Routing to entry-level attribute testing does not, by itself, create a fraud conclusion. The line is crossed only at the testing stage: if entry-level testing surfaces two or more AU-C 240 attributes on the same entry, then escalate to the engagement team as a fraud-risk indicator. The count of attributes, not the MAD value, is what justifies that escalation.

These steps must be applied in order: applicability first, subset targeting second, attribute count third. For each step, the workpaper must show either the reason for action, or the reason for non-action. By holding to this sequence, the 0.0018 result remains a mandatory review trigger, while never being treated as audit evidence under AU-C 240 on its own. The count of AU-C 240 attributes on a single entry, not the MAD value, is what justifies escalation to the engagement team.

## What to do next

| Step | Action | Why it matters |
| --- | --- | --- |
| 1 | Compute the Benford first-digit MAD for the affected journal-entry population and compare it with Nigrini's 0.0018 conformity threshold. | Establishes whether the population meets the mandatory review trigger. |
| 2 | If the MAD is at or above 0.0018, open targeted journal-entry review for that affected population and record the flag as a review trigger. | The 30.1% rate counts review triggers, not detected fraud. |
| 3 | Do not change the AU-C 240 risk assessment on the Benford result alone; document that the flag is screening only. | AU-C 240 requires evidence beyond a Benford flag. |
| 4 | Corroborate the flag with at least one independent procedure: an entry-level attribute test, a period-end timing test, or a manual-vs-automated split. | Corroboration is required before changing the risk assessment. |
| 5 | If corroboration supports an anomaly, update the risk assessment and plan further procedures; if not, document no change to the risk assessment. | Prevents escalation from a screening flag alone. |
| 6 | Retain the population, MAD, threshold comparison, review scope, and corroboration results in the audit documentation. | Shows the Benford flag was used as a screening trigger, not as audit evidence. |

## Frequently Asked Questions

**What measure is used as a screening flag for journal entries under AU-C 240?**

Benford's Law first-digit MAD is used as a screening flag for journal entries under AU-C 240.

**What does the 0.0018 threshold do?**

The 0.0018 threshold triggers targeted review without supporting a fraud conclusion alone.

**What is the 30.1% figure?**

The 30.1% figure is strictly the expected share of leading 1s under the distribution, not a flag rate or a detection rate.

**Why must amounts below the testing floor be excluded from the first-digit screen?**

Amounts below that floor are more prone to rounding or represent items that may not follow the same scale-based process.

**How are observed first-digit proportions evaluated?**

Observed proportions for each of the nine first digits are matched against the expected proportions from the first-digit Benford distribution for the exact same digits.

**What is Benford's Law for first digits based on?**

Benford's Law for first digits is based on the logarithmic spacing of numbers, not on any assumption of uniformity.

## Quick answers

| What does the 30.1% figure represent under Benford's first-digit distribution? | The 30.1% figure is strictly the expected share of leading 1s under this distribution, not a flag rate or a detection rate. |
| --- | --- |
| What threshold triggers targeted review without supporting a fraud conclusion alone? | A 0.0018 threshold triggers targeted review without supporting a fraud conclusion alone. |
| Why must the journal-entry amount population be filtered before the first-digit screen? | Only entries that meet the testing floor should be included in the first-digit screen, as amounts below that floor are more prone to rounding or represent items that may not follow the same scale-based process. |
| On what basis does Benford's Law for first digits produce its expected frequencies? | Benford's Law for first digits is based on the logarithmic spacing of numbers, not on any assumption of uniformity. |
| How are observed and expected proportions compared in this screening? | The observed proportion is calculated for each of the nine first digits and then matched against the expected proportions from the first-digit Benford distribution for the exact same digits. |

Also worth reading: **Benford's Law 2026: MAD Zero and Sequential Tests from 2025 Filings**: [Benford's Law 2026: MAD Zero](https://financialauditexpert.com/blog/benfords-law-2026-mad-zero-and-sequential-tests-from-2025-filings.php) · **7 Key AI-Powered Anomaly Detection Breakthroughs Reshaping Internal Audit Metrics in 2025**: [7 Key AI-Powered Anomaly Detection](https://financialauditexpert.com/blog/7_key_ai_powered_anomaly_detection_breakthroughs_reshaping_i.php) · **AI-Powered Anomaly Detection in Financial Audits A 2025 Analysis of Machine Learning Applications in Risk Assessment**: [AI-Powered Anomaly Detection in Financial](https://financialauditexpert.com/blog/ai_powered_anomaly_detection_in_financial_audits_a_2025_anal.php)

### Related reading

- [Benford's Law Cutoffs: Nigrini Mean Absolute Deviation (MAD) 0.0012–0.0022: Flag or Clear?](https://financialauditexpert.com/blog/benfords-law-cutoffs-nigrini-mean-absolute-deviation-mad-0001200022-flag-or-clear.php)
- [Spotting Audit Red Flags: A Step-by-Step Guide to Financial Statement Analysis](https://financialauditexpert.com/blog/spotting_audit_red_flags_a_step_by_step_guide_to_financial_statement_analysis.php)
- [Spotting Invalid Transactions Before the Audit Team Arrives](https://financialauditexpert.com/blog/spotting-invalid-transactions-before-the-audit-team-arrives.php)
- [Accounts Payable Fraud Checks: Benford Then Isolation Cuts 35% False Alarms](https://financialauditexpert.com/blog/accounts-payable-fraud-checks-benford-then-isolation-cuts-35-false-alarms.php)
- [2026 Ledger Physics: Benford Screen, Forest Flags, Queue Cost](https://financialauditexpert.com/blog/2026-ledger-physics-benford-screen-forest-flags-queue-cost.php)
- [Benford's Law Flags 11% of ERP Spend: Monitor or Triage?](https://financialauditexpert.com/blog/benfords-law-flags-11-of-erp-spend-monitor-or-triage.php)

### Latest

- [AP audit alerts: verify anomaly thresholds and false positives before you commit](https://financialauditexpert.com/blog/ap-audit-alerts-verify-anomaly-thresholds-and-false-positives-before-you-commit.php)
- [Benford's Law Cutoffs: Nigrini Mean Absolute Deviation (MAD) 0.0012–0.0022:...](https://financialauditexpert.com/blog/benfords-law-cutoffs-nigrini-mean-absolute-deviation-mad-0001200022-flag-or-clear.php)
- [Revenue recognition anomaly detection: 2026 30% fewer review hours vs precision](https://financialauditexpert.com/blog/revenue-recognition-anomaly-detection-2026-30-fewer-review-hours-vs-precision.php)

Canonical: https://financialauditexpert.com/blog/spotting-odd-journal-entries-benfords-law-and-au-c-240-301-flag-vs-review.php
Markdown: https://financialauditexpert.com/blog/spotting-odd-journal-entries-benfords-law-and-au-c-240-301-flag-vs-review.php/index.md