Fraud-indicator review

A fraud-indicator review runs four core tests against the transaction population for the period under review. A Benford's Law distribution test compares the actual first-digit frequency of payment amounts to the expected natural distribution and flags where the deviation is statistically significant. A duplicate-payment scan checks for the same vendor, amount, and near-matching date or invoice number appearing more than once. A round-dollar scan flags entries clustered at suspiciously even amounts relative to the business's normal transaction pattern. A vendor-master screen cross-references vendor names, addresses, and bank account details against employee records for any overlap.

Each test produces its own output, and we deliver a single ranked list combining all four, with the specific test and reasoning attached to every flagged item so a reviewer is never handed an opaque score with no explanation behind it.

We start by pulling a full transaction-level export from the accounting system for the review period, using forensic data extraction methods that preserve the audit trail and do not alter the live file. That export becomes the working dataset for every test that follows.

The Benford's Law test runs against the full population of payment amounts; it works best with a larger dataset, so for a smaller business we still run it but weight the result accordingly and lean more heavily on the duplicate-payment and vendor tests, which hold up regardless of volume. Duplicate-payment and round-dollar scans run through CaseWare IDEA or ACL Analytics, which can compare tens of thousands of line items for near-matches far faster than manual review.

Vendor-master screening is largely a manual cross-reference exercise: we pull the vendor list and the employee list and check for overlapping addresses, phone numbers, or bank details, since this kind of match rarely shows up in a purely statistical test. Every flag from every test goes into one ranked list, reviewed by a senior reviewer for false positives and for language before it reaches the board or counsel.

Boards and audit committees responding to a whistleblower tip, owners of a business with a bookkeeper or controller who has broad, unsupervised access to payments, insurers scoping a fidelity or crime-policy claim before committing to a full investigation, and attorneys doing financial due diligence ahead of an acquisition or a dispute all engage this review for the same reason: they need a defensible, prioritized starting point rather than a full manual audit of every transaction.

It is a poor fit if you already know specifically what happened and need the loss quantified rather than found; that work is better scoped as embezzlement investigation support. It is also not the right tool if what you actually need is an opinion on financial statements, since that requires a licensed audit, which is outside our scope entirely.

The most common problem is a board that wants a yes-or-no answer on whether fraud occurred, when what a screening review can actually deliver is a ranked list of items worth investigating further. We set that expectation at intake, because a review presented as a verdict when it is really a starting point creates more risk than it resolves.

A second problem is a small business with a modest transaction count expecting Benford's Law to carry the whole review. We explain upfront that the test is more reliable with volume, and for a smaller dataset we shift the weight toward duplicate-payment and vendor-overlap testing, which do not depend on a large sample to be meaningful.

A third problem is a vendor list that has never been cleaned, full of stale entries, inconsistent formatting, and duplicate vendors under slightly different names, which makes the vendor-overlap test noisier than it needs to be. We normalize the vendor master as part of the review itself rather than treating a messy list as a reason to skip the test.

CaseWare IDEA and ACL Analytics run the bulk of the pattern-detection work: Benford's Law distribution testing, duplicate and near-duplicate payment matching, and round-dollar frequency analysis across the full transaction population exported from the client's accounting system. Both tools are built for exactly this kind of forensic data-analysis work rather than general bookkeeping.

The transaction export itself comes from QuickBooks Online or Xero, pulled at the transaction level rather than from summary reports, so voided and deleted entries the platform retained are included in the population being tested. Microsoft Excel organizes the final ranked output and the reasoning behind each flag into a document a non-technical board member or attorney can follow without needing to open the underlying analytics software.

A fraud-indicator review is quoted per engagement based on transaction volume, the number of accounting systems and entities involved, and whether vendor and employee master data needs to be gathered from more than one source. A single-entity business on one accounting platform with a clean vendor list is a materially smaller engagement than a multi-entity group with several disconnected systems.

We provide a written estimate after a short scoping call covering the accounting system, the approximate transaction volume, and the period under review, and we flag early if the vendor or employee data needed for the overlap test is not readily available, since gathering it can add meaningfully to the timeline.

Every flagged item on the ranked list carries the specific test that surfaced it and the specific reason, never a bare score with no explanation. Before delivery, a senior reviewer reviews the full list for obvious false positives, such as a supplier who legitimately prices in round numbers, and removes or annotates them rather than letting noise dilute the list a board or attorney has to work through.

The senior reviewer then reviews the finished list specifically for language: every flag is phrased as a pattern worth investigating, never as a conclusion about fraud having occurred, since a review that overstates its own findings creates real legal exposure for the client who acts on it.