FIN 470 Week 2 Data-Driven Fraud Detection Example

186,000 Invoices, Seven Tests: How Vendor Matching, Threshold Clustering, Benford's Law and Sequence Checks Found the Midstate Payments and Two Other Problems at Buckeye Comfort Supply

[Student Name]

University of Phoenix

FIN/470: Fraud Examination and Forensic Accounting

Week 2 Assignment

[Instructor Name]

[Date]

Buckeye Comfort Supply, its data and all results are composites written for a model paper; analytic methods and research findings come from the sources listed.

After the accounts payable clerk at Buckeye Comfort Supply, the composite Ohio distributor, spotted a shared post office box between a vendor and a branch manager, the company's outside counsel engaged a forensic accountant. Her first question was whether Midstate Coil Services was the only problem. Traditional audits test samples of transactions; a shell company that billed small amounts at one branch could easily escape a sample. Testing every transaction does not prove fraud, but it shows where to look, which is what an investigation needs first. This paper describes how she tested five years of payments.

Preparing the Data

She obtained the accounts payable transaction file for five years, 186,000 invoice lines, the vendor master file with about 2,100 vendors and the human resources file with employee addresses, phone numbers and direct deposit accounts. Cleaning took longer than testing, about three weeks against one: addresses were standardized, so that Street and St. matched, duplicate vendor records were merged and post office boxes were flagged. Albrecht et al. (2019) stress that most data analysis time goes to understanding and preparing data, and that poorly prepared data produce misleading results.

Test One: Vendor and Employee Matching

Comparing addresses, phone numbers and bank accounts between the vendor master and employee files produced 11 matches. Nine were employees reimbursed through the payables system for travel, which was expected. One was Midstate, sharing Dale's post office box. One was a refrigerant recovery company owned by a warehouse supervisor's wife, which had done real work at market prices, but the relationship had never been disclosed. That case was referred for a conflict of interest review.

Test Two: Clustering Below Approval Limits

Branch managers could approve invoices up to $10,000. A histogram of all invoices showed a modest rise just under $10,000 across the company, but at Dale's branch, 49 of the 212 maintenance invoices in the period fell between $9,000 and $9,999, about 23 percent, compared with about 3 percent at other branches. Forty of Midstate's 44 invoices were among them; the other four were for smaller amounts.

Test Three: Benford's Law

Nigrini (2012) explains that in many naturally occurring data sets, leading 1s turn up in close to a third of the values while leading 9s turn up in fewer than one in twenty, a pattern known as Benford's law. Company-wide, invoice amounts followed the expected pattern closely. At Dale's branch, 31 percent of maintenance invoices began with 9, a deviation far beyond what chance would produce for 212 items. Benford analysis works only on data that should follow it, such as payments of varied size; amounts fixed by price lists or limited to a narrow range will not, so she applied it only to maintenance and repair categories.

Test Four: Sequential Invoice Numbers

A real vendor issues invoices to many customers, so the invoice numbers Buckeye receives skip widely. Midstate's 44 invoices were numbered 1001 through 1044 with no gaps, meaning Buckeye was its only customer. A gap and sequence test across all vendors found three others with nearly consecutive numbers; all were small local firms with few customers, and their work was confirmed.

Test Five: Round Amounts

Invented amounts tend to be round. Midstate's invoices included many amounts ending in 00, such as $9,400 and $8,900, far above the share of round amounts from other maintenance vendors, whose invoices reflected parts and labor at varied prices.

Test Six: Duplicates

A duplicate test, matching vendor, amount and date within a short window, found $38,000 of duplicate payments across the company over five years, mostly from a single supplier that had resubmitted invoices after a system change. Those were errors rather than fraud, and the supplier refunded them within a month of being asked.

Test Seven: Post Office Box Vendors

Of 74 vendors with only a post office box as their address, 70 were established suppliers. Four were small service vendors approved by branch managers; one was Midstate, and the other three were confirmed as legitimate after site visits.

Bringing the Results Together

Midstate appeared in five of the seven tests: the employee match, the threshold cluster, the Benford deviation, the invoice sequence and the round amounts. No other vendor appeared in more than two. Bolton and Hand (2002) note that combining several signals usually identifies fraud far better than any single one, because each test alone produces many false alarms. Scoring vendors by the number of tests they failed gave the investigation a clear priority list.

Why the Company's Own Controls Missed It

Buckeye's external auditors had tested accounts payable each year, selecting a sample of large payments and confirming that each had an approved invoice. Every Midstate invoice was approved and under $10,000, so none was likely to be selected, and any that was would have passed: it had an invoice and an authorized signature. Sampling for approval tests whether controls were followed, not whether the underlying transaction was real. A scheme designed to satisfy the controls passes them. Full-population analytics look instead for patterns across transactions that no single document reveals, such as a vendor whose invoices are always just under a limit.

What the Analysis Did Not Do

The analysis did not prove that Midstate's services were never performed or that Dale controlled Midstate. It showed where to look. Proof required documents and interviews, the subject of Week 3.

Continuous Monitoring

Buckeye will run the vendor match, threshold, sequence and duplicate tests monthly through its accounting software, with results reviewed by the controller and a summary sent to the audit committee of the board. New vendors will be screened against employee records before their first payment.

Conclusion

Seven tests on 186,000 invoices pointed to Midstate from five directions, uncovered an undisclosed conflict of interest and recovered duplicate payments. None proved fraud alone, but together they focused the investigation. Running them monthly turns a one-time analysis into a lasting control.

References

Albrecht, W. S., Albrecht, C. O., Albrecht, C. C., & Zimbelman, M. F. (2019). Fraud examination (6th ed.). Cengage Learning.

Bolton, R. J., & Hand, D. J. (2002). Statistical fraud detection: A review. Statistical Science, 17(3), 235-255. https://doi.org/10.1214/ss/1042727940

Nigrini, M. J. (2012). Benford's law: Applications for forensic accounting, auditing, and fraud detection. John Wiley & Sons.