7-Data mining journal entries for fraud detection-- An exploratory study

ContentslistsavailableatScienceDirect

InternationalJournalofAccounting

InformationSystems

Dataminingjournalentriesforfrauddetection:Anexploratorystudy

RogerS.Debrecenya,⁎,GlenL.GraybabShidlerCollegeofBusiness,UniversityofHawai'iatMānoa,UnitedStates

CollegeofBusinessandEconomics,CaliforniaStateUniversityatNorthridge,UnitedStates

articleinfoabstract

Frauddetectionhasbecomeacriticalcomponentoffinancialauditsandauditstandardshaveheightenedemphasisonjournalentriesaspartoffrauddetection.Thispapercanvassesperspectivesonapplyingdataminingtechniquestojournalentries.Inthepast,theimpedimenttoresearchingjournalentrydataminingisgettingaccesstojournalentrydatasets,whichmayexplainwhythepublishedresearchinthisareaisanullset.Forthisproject,wehadaccesstojournalentrydatasetsfor29differentorganizations.Ourinitialexploratorytestofthedatasetshadinterestingpreliminaryfindings.(1)Forall29entities,thedistributionoffirstdigitsofjournaldollaramountsdifferedfromthatexpectedbyBenford'sLaw.(2)Regardinglastdigits,unlikefirstdigits,whichareexpectedtohavealogarithmicdistribution,thelastdigitswouldbeexpectedtohaveauniformdistribution.Ourtestfoundthatthedistributionwasnotuniformformanyoftheentities.Infact,eightentitieshadonenumberwhosefrequencywasthreetimesmorethanexpected.(3)Wecomparedthenumberofaccountsrelatedtothetopfivemostfrequentlyoccurringthreelastdigitcombinations.Fourentitieshadaveryhighoccurrencesofthemostfrequentthreedigitcombinationsthatinvolvedonlyasmallsetofaccounts,oneentityhadalowoccurrencesofthemostfrequentthreedigitcombinationthatinvolvedalargesetofaccountsand24hadalowoccurrencesofthemostfrequentthreedigitcombinationsthatinvolvedasmallsetofaccounts.Ingeneral,thefirstfourentitieswouldprobablyposethehighestriskoffraudbecauseitcouldindicatethatthefraudsteriscoveringuporfalsifyingaparticularclassoftransactions.Inthefuture,wewillapplymoredataminingtechniquestodiscoverotherpatternsandrelationshipsinthedatasets.Wealsowanttoseedthedatasetwithfraudindicators(e.g.,pairsofaccountsthatwouldnotbeexpectedinajournalentry)andcomparethe

Keywords:Fraud

JournalentriesDataminingAuditing

AccountinginformationsystemsXBRLGL

⁎Correspondingauthor.

E-mailaddresses:roger@debreceny.com(R.S.Debreceny),glen.gray@csun.edu(G.L.Gray).1467-0895/$–seefrontmatter©2010ElsevierInc.Allrightsreserved.doi:10.1016/j.accinf.2010.08.001

158R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

sensitivityofthedifferentdataminingtechniquestofindtheseseededindicators.

©2010ElsevierInc.Allrightsreserved.

1.Introduction

Thispaperexploresemergingresearchissuesrelatedtotheapplicationofstatisticaldataminingtechnologytofrauddetectioninjournalentries.Thedetectionoffraudandparticularlyoffinancialstatementfraud1hasbecomeanincreasinglyimportantcomponentofthefinancialstatementauditoverthelastdecade.Anumberofimportantfinancialstatementfraudshaveinvolvedfraudulentjournalentriesormanagerialoverrideofcontrolsthathaveutilizedjournalentrieswithincomputerizedaccountinginformationsystems.Thesejournalentrieshaveofteninvolvedwell-knownexamplesoffinancialstatementfraudincludinginappropriaterevenuerecognition,inappropriatecapitalizationofexpensesandawidevarietyofinappropriateaccruals.Givenlikelyfraudsterresponsetoknownpatternsoffraudulentjournalentriessuchasnon-standardjournalentries2andtheenormousvolumeofjournalentriesintypicalcomputerizedaccountinginformationsystems,itisquestionablethatdirectauditorassessmentofsmallsamplesofjournalentrieswilleffectivelyandefficientlydetectlikelypatternsoffraudulentactivity.AutomatedauditoranalysisofjournalentrieshasbeenincreasinglymandatedbyauditingstandardsintheU.S.andinternationally.Somedegreeofdirectcomputerizedanalysisofjournalentriesisnowpartofthetoolkitofauditteamsonmajorauditengagements.Thereis,however,verylittleknowledgeoftheefficacyofthisimportantclassofauditprocedures.

Althoughtherearelargebodiesofliteratureregardingdatamininginotherdomains,abroadsearchofauditliteraturedidnotlocateanyresearchliteratureonthedataminingofjournalentries.3Yet,auditingstandardsrequirethatauditorsconsiderfraudintheirfinancialauditsandthosestandardsspecificallyrequirethatauditorsexaminejournalentries.Basedonthesuccessfulapplicationsofdataminingtootherdomains,itwouldappearthatdataminingholdsthepotentialtoimproveboththeeffectivenessandefficiencyoftheauditorsintheiranalysisofjournalentriesandfrauddetection.Thisisinlinewithrecentcallsforresearchontheroleofjournalentriesintheauditprocess(Curtisetal.2009).

Inthispaper,wesetouttheunderlyingissuesthatwillguideeffectiveandefficientdataminingofjournalentries.Wereviewthestandardsfromauditingregulatorsandguidancefromtheprofessionalauditcommunityandexplorethepotentialforstatisticaldataminingoflargesetsofjournalentries.Wethentestthestatisticalpropertiesofjournalentries,inanexploratorystudy.Wemakefirststepstodataminingofsuchjournalentries.Thesefirststepsaretestedwithasetofjournalentriesfor29entities.Weconsidertheessentialelementsofthejournalentries.Weexploretheirstatisticalproperties,concentratingontheirdispersionfromknowndistributions.Weidentifysomepreliminarypatternswithinthejournalentries.Thepapermakesanimportantcontributiontotheliteratureondataanalysis,dataminingandfrauddetectionwithinjournalentries.

Theremainderofthispaperproceedsasfollows:thenextsectionprovidesgeneralbackgroundmaterialandthenspecificallyaddressestheroleofjournalentriesincommittingfraudanddrawslessonsfromrecentfraudsthatusedjournalentries.Thesectionalsosummarizestheresponsesofstandardsetterstotheheightenedfraudriskenvironmentsincethelate1990s.Inthethirdsection,weexploretheissues

TheAuditingStandardsBoardoftheAICPAdefinedfinancialstatementfraudinSAS99as:“Misstatementsarisingfromfraudulentfinancialreportingareintentionalmisstatementsoromissionsofamountsordisclosuresinfinancialstatementsdesignedtodeceivefinancialstatementuserswheretheeffectcausesthefinancialstatementsnottobepresented,inallmaterialrespects,inconformitywithgenerallyacceptedaccountingprinciples(GAAP)”(PCAOB2002).Thereisafinelinebetweenearningsmanagementandfinancialstatementfraud,butalinethatisbeyondthescopeofthispaper.Weconfinethediscussiontodeliberateandintentionalmaterialmisstatements,typicallyundertakenbyoneormoremembersofseniormanagement.2AccordingtothereportofthePanelonAuditEffectiveness,“Non-standardentriesisatermthatisnotpreciselydefined,althoughitisincommonuseamongaccountantsandauditors.Suchentriessometimesarereferredtoas“top-sideentries,”“post-closingentries,”“manualadjustments,”“managemententries”or“unusualadjustments.”Ingeneral,theyarefinancialstatementchangesorentriesmadeinthebooksandrecords(includingcomputerrecords)ofanentitythatusuallyareinitiatedbymanagement-levelpersonnelandarenotroutineorassociatedwiththenormalprocessingoftransactions.”(POB2000,83).3Thislackofpublishedliteraturedoesnotmeanthattheauditfirmsarenotdoinganyjournalentrydatamining.Quitethecontrary,thefirmsaredeployingdataminingtechnology,butwhattheyaredoingisproprietaryand,assuch,rarelygetspublishedforpublicconsumption.

1R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181159

involvedindataminingjournalentries.Wediscussboththetechnicalandthestatisticalpropertiesofjournalentriesandhowdataminingcanleveragetheeconomicrelationshipsembeddedintheaccountcombinationsrepresentedinthejournalentry.Inthefourthsection,weintroduceourdataset.Wethendiscussourinitialexplorationofthestatisticalpropertiesofthejournalentriesinourdatasetinthenextsection.Inthefinalsection,wedrawconclusionsandpointtoaresearchagenda.2.Background

Overthelastseveralyears,therehasbeenanincreasedemphasisonthedetectionoffraudasakeyelementofthefinancialstatementaudit.In2000,theAICPA'sPublicOversightBoard'sPanelonAuditEffectivenesspointedtoavarietyofnecessaryreformstoensurethelong-termviabilityoftheaudit(POB2000).Thesignificantfraudsthatinvolvedmanipulationoffinancialstatementsanddisclosuresinthelate1990sandearlypartofthiscenturygaveaddedimpetustoafundamentalshiftintheconductofaudits.Anumberoffraudschemesinvolvednon-standardjournalentriesthatweredesignedtomakerelativelysimpleadjustmentsbetweenclassesofaccountssuchthatthefinancialstatementresultswouldshowanimprovedpositionatthemargin.

Asaresponsetosignificantfinancialstatementfraudsoverthelastdecadeorso,therehavebeenanumberofchangestoauditingstandardsandtheregulatoryenvironmentgoverningtheprofessionofauditing.ThepromulgationbytheAuditingStandardsBoard(ASB)ofSAS99(ConsiderationofFraudinaFinancialStatementAudit)(ASB2003)andtheenactmentofSarbanes–OxleyAct(SOX)bytheU.S.governmentwerecentralevents.SAS99significantlyincreasedtheresponsibilityofauditorstoaddresspotentialfraudasanintegralpartoffinancialaudits(ASB2003;CAQ2008).Forexample,SAS99requiresthedirectassessmentofjournalentriesforfraudrisk.TheInternationalAuditingandAssuranceStandardsBoard(IAASB)followedSAS99withsimilarlanguageintheirIAS240(IAASB2009a).Whileindividualfraudshavebeensubstantialandtherangeoffraudtechniquesemployedbroad,theproportionoffraudswithinthebroaderpopulationofauditclientsisminuscule.Insupportofthepreparationoffinancialstatementsandaccompanyingnotesandotherdisclosures,auditclientsemploysophisticatedinformationsystemsthatgeneratevastquantitiesofelectronicevidence.Findingevidenceoffrauddetectionwithinthisinformationmilieuischallenging.Employingdatamininghasthepotentialtoimprovetheefficiencyandeffectivenessofauditteamsintheconductoffraud-relatedaudittasks.

Modernaccountinginformationsystemsincreasinglyrecordtransactionsinthegeneralledgerattheatomiclevel.Itiscommonforentitiestohaveseveralhundredthousandjournalentriesinagivenaccountingperiod.Managersintentoncommittingfraudmayalsochoosetoconcealfraudulenttransactionswithinothertransactionsin“mega-combined”entries.Thesefactorsmakedataminingofjournalentriestodetectfraudachallengingexercise.

Theremainderofthissectiontakesacloserlookatfinancialstatementfraudinvolvingjournalentriesandtheresponseofstandardsetterstoheightenedriskfromfraud.2.1.Financialstatementfraudsinvolvingjournalentries

Asintroducedintheprevioussection,thefocusofthispaperisdataminingofjournalentrieswithincomputerizedaccountinginformationsystems.Thispotentialclassofsubstantivetestsisdesignedtosupporttheauditors'assessmentofmaterialmisstatementsinthefinancialstatementsarisingfromfraud.Whilemisappropriationofassetsisimportant,detectionoffinancialstatementfraudisofgreaterconcerntoinvestorsandotherstakeholders.Thislattertypeoffraudusuallyhasgreaterprobabilityofgivingrisetoamaterialmisstatementandtobecommittedbyuppermanagement.Thefocusofthisstudyiswiththeuseofjournalentriestofacilitatefraudandtechniquestodiscoverpotentiallyfraudulententries.

Amongstthepanoplyoffinancialstatementfrauds,thefraudatWorldComInc.isperhapsthemostegregious.WorldComprovidesausefulmodelofhowfinancialstatementfraudstypicallyinvolvemanyadjustingjournalentries.TheWorldComfraudwasrelativelystraightforward,primarilyinvolvingadjustmentsfromexpenseaccountstocapitalexpenditureaccounts.AsthespecialreporttotheBoardofDirectorsonthefraudshows,therewasnojustificationinaccountingprinciplesorpracticeforthesematerialadjustments(Beresfordetal.2003).Theamountswerelargeandwellknownwithinthecorporation.Someoftheseadjustmentswereeventhetopicofconversationbetweenaccountantsin

160R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

internationaloperationsandlocalauditors(Woods2002).TheWorldComjournalentriesprovideausefulexampleofthewayinwhichfraudsinvolvemultiplesignalsthatmustbeidentifiedintheaggregate.

ThespecialreportdescribedsevenimportantcharacteristicsoftheadjustmentsandoftheuseofjournalentriesatWorldCom.First,thefraudinvolvedstraightforwardandinappropriateaccountingreallocations.Theseincludedtransfersfromflowstostocks.Forexample,significanttransfersweremadefromwhatwaseffectivelyasuspenseexpenditureaccount,“PrepaidCapacityCosts,”tothe“ConstructioninProgress”account,whichwastreatedascapitalexpenditure(Beresfordetal.2003).Second,journalentriesalsoinvolvedaccountingtreatmentsdesignedtoinfluencedisclosureratherthanrecognition.Forexample,linecostsweretransferredtoaccountsthatrolledupinto“Selling,GeneralandAdministrativeExpenses(SG&A).”Theseadjustmentsdidnotchangethereportedprofits,butdidchangetheallocationbetweengrossandnetprofitdisclosures(Beresfordetal.2003).ThischangeindisclosurewastoinfluencetheconclusionsofanalystsonWorldComfinancialperformance.Third,manyofthesuspiciousjournalentrieswereillconcealed,withlargeadjustmentsinroundedamountsthatwouldbeobvioustothemostcasualofinspections(Beresfordetal.2003,126).Fourth,therewerealargenumberofinappropriateoratbestquestionablejournalentries.Thespecialreportnotedthat“[w]efoundhundredsofhuge,round-dollarjournalentriesmadebythestaffoftheGeneralAccountinggroupwithoutpropersupport…”(Beresfordetal.2003,244.Emphasisadded.),Fifth,inappropriatejournalentrieswereoftenaccompaniedbyinadequateornodocumentationandwhichcircumventednormalinternalcontrols.Sixth,theadjustmentswerealmostuniversallyatthecorporatelevel.Inmanycases,however,thesenon-standardadjustmentsmadeatthecorporatelevelrequiredadjustmentsatoperatingdivisionsandinternationaloperations.Seventh,manyindividualsandgroupswithinthecorporationquicklybecameaware—orshouldhavebeenaware—oftheimplicationsoffraudulententriespassedatheadquarters,nottheleastofwhichwasastheresultofsweepingupaftertheaforementionednon-standardadjustments(Beresfordetal.2003).

PerhapsthemostinterestingaspectoftheWorldComcasefromtheperspectiveofthispaperisthestatementthat“WorldCompersonnelalsorepeatedlyrejectedAndersen'srequestsforaccesstothecomputerizedGeneralLedgerthroughwhichInternalAuditandothersdiscoveredthecapitalizationoflinecosts”(Beresfordetal.2003).TheremighthavebeenaverydifferentoutcometorecentUScorporatehistoryifAndersenhadmorevigorouslypursuedelectronicaccesstotheGeneralLedger.

TheWorldComcasewasparticularlyegregiousand,asthespecialreporttotheBoardofDirectorsclearlydescribes,thepotentialredflagsfortheauditorsweremanyandvaried.Nonetheless,manyofthesameredflagsexistinotherfinancialstatementfrauds.TheCendantCorporationfraudthatpre-datedtheWorldComfraudwasalmostaword-for-wordtranscription.A1998reporttotheAuditCommitteeofthethenCendantCorporationnotedthatinwhat“showstohavebeenacarefullyplannedexercise,”alargenumberof“unsupportedjournalentriestoreducereservesandincreaseincomeweremadeafteryear-endandbackdatedtopriormonths;mergerreservesweretransferredviainter-companyaccountsfromcorporateheadquarterstovarioussubsidiariesandthenreversedintoincome;andreservesweretransferredfromonesubsidiarytoanotherbeforebeingtakenintoincome”(Willkieetal.,1998).

PerhapswhatdistinguishestheCendantcasefromWorldComwasthewiderangeofaccountsandaccountingtreatmentsthatwereinvolvedinthefraudatCendant.Hundredsofjournalentrieswererequiredtoachievethedesiredimpactonnetincome.Thefraudulententriesimpactedrevenue,cash,accountsreceivableanddeferredrevenue.Wallace(2000)notedthatcontrolviolationswithinCendantwerehighlydisaggregated.Auditorsandotherschargedwithdiscoveringtheseviolationsmayneedtoaggregatethesedisaggregatedtransactionsinordertoseethebroaderpictureandbeinabetterpositiontoidentifythecontrolviolations.Asimilarpictureofjournalentriesattheheartoffinancialstatementfraudscanbedrawninmanyotherexemplarsofthelastdecade,includingHealthSouth(Weldetal.2004)andXerox,EnronandAdelphia(BFA)(DeVriesandKiger2004).2.2.Responseofstandardsetterstoheightenedrisksfromfraud

Theheightenedrecognitionoftheimportanceoffinancialstatementfraudinthe1990sleadstoanincreasedemphasisonfraudamongstauditingstandardsetters.ThethenPublicOversightBoard(POB)oftheAICPAprovidedsomeofthemostinfluentialguidanceonhowauditingshouldrespondtothisheightenedriskenvironmentinthereportoftheir“PanelonAuditEffectiveness”(POB2000).ThePanelconductedreviewsofworkingpapers,whichthePaneltermed“QuasiPeerReviews,”forasignificant

R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181161

numberofaudits.Inaddition,theyreviewedtheSEC'sAccountingandAuditingEnforcementReleases(AAERs)overtheprevioustwo-yearperiod,whichwasaparticularlyactiveperiodinSECenforcement.Whenreviewingtheresponseofauditorstohighlevelsoffraudrisk,thePanelmadeparticularnoteofthefailureofauditteamstoassess“non-standard”journalentries.Insome15%ofcases,auditorsdidnothaveasufficientunderstandingoftheclientsystemsforpreparingsuchentries.Innearlyonethirdofothercases,theauditteamsdidnotundertakesubstantivetestsofnon-standardjournalentries(POB2000).ThePanelrecommendedtotheASB“developstrongerandmoredefinitiveauditingstandardstoeffectasubstantialchangeinauditors'performanceandtherebyimprovethelikelihoodthatauditorswilldetectfraudulentfinancialreporting”(POB2000).ThePanelmadeaseriesofdetailedandintegratedproposals;themostimportantofwhichforthepurposesofthispaperwasthattheauditcontainsa“forensic-typefieldworkphase.”Thiswasnottoturntheauditintoaforensicinvestigation,whichwoulddramaticallychangethecharacteroftheaudit.Rather,theproposalsweretobringselectedforensictechniquestothefinancialstatementaudit.Unsurprisingly,giventheirfindings,thePanelmadespecificrecommendationsondirectexaminationof“nonstandard”journalentries.ThePanelnotedthat“[a]llorvirtuallyallentitiesrecordnon-standardentries.Theseentriescanprovideanavenueformanagementtooverridecontrolsthatcouldleadtofraudulentfinancialreporting.Consequently,auditorsneedtodesigntestsintheforensic-typephasetodetectnon-standardentriesandexaminetheirpropriety.Thisaspectoftheforensic-typephaseaffectsnotonlytheextentoftesting,butalsoitstiming,becausesuchentriescanberecordedatvarioustimesduringtheyear”(POB2000).

TheresponseoftheASBwasSAS99,“ConsiderationofFraudinaFinancialStatementAudit”(ASB2003).4Thisstandardnotesthatamaterialmisstatementinfinancialstatementscanarisefromfraudulentfinancialreporting,definedas“intentionalmisstatementsoromissionsofamountsordisclosuresinfinancialstatementsdesignedtodeceivefinancialstatementusers”andfrommisappropriationofassets(ASB2003).SAS99requiresthattheauditorundertakeavarietyofanalyticalandplanningtasksandsubstantiveauditprocedurestosupportthedetectionoferrorsarisingfromfraudulentfinancialreporting.Thestandardmakesparticularnoteoftheroleofjournalentriesandotheradjustmentsintheconductoffinancialstatementfraud.SAS99imposedaconsiderablyenhancedsetofrequirementsontheauditor.Thestandardrequiredauditorsto“designprocedurestotesttheappropriatenessofjournalentriesrecordedinthegeneralledgerandotheradjustments(forexample,entriesposteddirectlytofinancialstatementdrafts)madeinthepreparationofthefinancialstatements”(ASB2003).

SAS99providesdetailedguidanceonselectionofentriesandadjustments,requiringtheauditortoassesstheriskofmisstatementfromfraud,effectivenessofcontrolsoverjournalentriesandthenatureandcomplexityofentriesandaccounts.Thestandardidentifiesmarkersoffraudulententriesincluding:“entries(a)madetounrelated,unusual,orseldom-usedaccounts,(b)madebyindividualswhotypicallydonotmakejournalentries,(c)recordedattheendoftheperiodoraspost-closingentriesthathavelittleornoexplanationordescription,(d)madeeitherbeforeorduringthepreparationofthefinancialstatementsthatdonothaveaccountnumbers,or(e)containingroundnumbersoraconsistentendingnumber”(ASB2003).Auditorsarecautionedthattheyshouldpayparticularattentiontonon-standardentriesandtootheradjustmentssuchasconsolidationentries.

Finally,SAS99makesanumberofexplicitrequirementsfortheauditortoundertakesubstantivetestsofthedetailofcontrolsandtransactions.Thestandardnotesthatfraudulentjournalentriesarelikelytooccuraroundtheclosingprocessandthat,consequently,testingshouldconcentrateonentriespostedintheperiodleadinguptothefiscalyearendorduringthepreparationofthefinancialstatements.Indicativetestsofthejournalentriesdatasetinclude:

•Non-standardjournalentries

•Entriespostedbyunauthorizedindividualsorindividualswhowhileauthorizeddonotnormallypostjournalentries

•Unusualaccountcombinations•Roundnumber

•Entriespostedaftertheperiod-end

4SAS99isnowaninterimauditstandardofthePublicCompanyAccountingOversightBoard.

162R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

•Differencesfrompreviousactivity

•Randomsamplingofjournalentriesforfurthertesting

ThedetailedrequirementsofSAS99wereaconsiderableaugmentationtothoseofitspredecessor,SAS82.BecauseofthedetailedrequirementsofSAS99,amajorthrustofauditfirmshasbeentodeveloptechnologies,policiesandproceduresdesignedtoenablethemtofulfilltheserequirements.Morerecently,theASBhasalsoaddressedthequestionofjournalentriesintheirso-called“riskstandards.”TheseincludeSAS109onunderstandingtheentityanditsenvironment(ASB2006a)andSAS110onauditprocedures(ASB2006b).SAS109requiresthattheauditorassessthemannerinwhichinformationismovedtothegeneralledgerfromothersystems,howsystemandnon-standardjournalentriesarecreatedandcontrolledandtheroleofconsolidationandcloseprocesses(ASB2006a).TheserequirementsareincrementaltothoseinSAS99,arguablyensuringthattheauditordevelopsasophisticatedunderstandingofthecloseprocessandtherolesplayedbygeneralledgerjournalentries.TheCenterforAuditQualityhasalsoprovidedguidanceontheprocessesinvolvedinselecting,acquiring,testingandanalyzingjournalentriesforfrauddetection(CAQ2008).

TheInternationalAuditingandAssuranceStandardsBoard(IAASB)havetakenasomewhatmorenuancedapproachtotheauditofjournalentries.In2003,theIAASBrevisedtheirfraudstandard,ISA240,atleastinpartasaresponsetotheincreasedrequirementsofSAS99.Afterrecentredrafting,ISA240requiresthat“irrespectiveoftheauditor'sassessmentoftherisksofmanagementoverrideofcontrols,”theauditorshould“testtheappropriatenessofjournalentriesrecordedinthegeneralledgerandotheradjustmentsmadeinthepreparationofthefinancialstatements”(IAASB2009a).5Giventhatfraudulentmanagerialactionsoftentakeplaceattheendofaccountingperiodandintheclosingprocess,thestandardrequiresthattheauditor“selectjournalentriesandotheradjustmentsmadeattheendofareportingperiod.”Thestandardalsorequiresthattheauditor“considertheneedtotestjournalentriesandotheradjustmentsthroughouttheperiod”(IAASB2009a,para32).FactorstotakeintoconsiderationintheselectionprocessidentifiedbytheBoardaresomewhatsimilartoSAS99,includingassessmentofriskofmisstatementfromfraud,controlsoverjournalentriesandadjustmentsandthenatureandcomplexityoftheevidenceenvironment.TheBoardalsoprovidesachecklistofmarkersofpotentiallyfraudulentjournalentries,again,similartoSAS99.Similarly,theauditevidencestandard,ISA330,notesthattheauditorshouldexamine“materialjournalentriesandotheradjustmentsmadeduringthecourseofpreparingthefinancialstatements”(IAASB2009b,para20).

Takentogether,SAS99,thetwonewriskstandards(SAS109and110)andISA240considerablyincreasedtherequirementsontheauditortoassessthecontrolsoverjournalentriesandconsiderthefraudriskenvironmentasitimpactsthecreationofdifferentclassesofjournalentries.Thesestandardsradicallychangedconductofsubstantivetestsonjournalentries.WhilepriortoSAS99auditorsmighthaveinspectedsuspiciousjournalentriesinexceptionalcircumstances,directtestsofjournalentriesandadjustmentsisnowastandardelementoftheauditatleastforlargerandhigherriskclients.Theproportionofauditsthataresubjecttofullanalysisofjournalentriesissignificantandgrowing.Inarecentsurveyofauditorsatnational,regionalandlocalfirms,Janvrinetal.(2009,106)showthatComputerAidedAuditTools(CAATs)arenowusedinnearlyhalfofauditstoidentifyjournalentriesandotheradjustmentstobetested.Thischangeinthenatureandextentofsubstantivetestshascomeatthesametimeasconsiderablechangesintheinformationtechnologyenvironmentinwhichjournalentriesareprocessed.Thefollowingsectionaddressesthisnewtechnologyenvironment.3.Understandingthepropertiesofjournalentries

Inthissection,weaddresshowtobuildasystematicunderstandingofasetofjournalentriesthatmaycontaindeliberatedeceptionorothersignalsoffinancialstatementfraudormisappropriationofassets.Aswewilldiscussinmoredetaillaterinthesection,thereissparseresearchontheinterrogationordataminingofjournalentries.Giventheparlousstateofresearch,itisperhapsnecessarytoturntofirst

Atthetimeofwriting,therehasbeenrecentrulemakingattheASBandPCAOB.TheASBhasanexposuredraftthatmorecloselyalignstheirstandardswiththoseoftheIAASB,includingthefraudstandard(ASB2009).ThePCAOBisalsointheprocessofpromulgationofnewstandardsonauditrisk.ThenewstandardsthatwillarisefromthisprocesswillresultinconsequentialamendmentstoSAS99(PCAOB2008).Ineachcase,therearechangesinthelanguagebutnotinthesubstanceoftheirtreatmentofjournalentriesintheauditprocess.

5R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181163

Fig.1.Datastructureofjournalentry.(BasedinpartontheXBRLGLtaxonomyandSAPR/3generaljournalledgerentry).

principlesandbuildanewresearchagendaandanewprogramforextractingknowledgefromjournalentries.Animportantelementofanyprogramofdataminingisdevelopingknowledgeofthepropertiesofthesubjectoftheinvestigation.

Aswithmanysubjectsofdatamining,journalentrieshaveanumberofattributesthatmustbeassessedbothindividuallyandtakentogether.Fig.1showsasimplifieddatamodelofatypicaljournalentry.Thereisjournalentryheaderinformationthatuniquelyidentifiesthejournalentry(JE).Someofthatheaderinformationisenteredbytheuser,butmostoftheinformationisautomaticallyassignedbythesoftware.TheentrydetailhasonedatabaserecordforeachlineinthebodyoftheJE.Indatabaseterminology,thereisaone-to-manyrelationshipbetweentheentryheaderinformationandtheentrydetailinformation.SinceanyJE,atminimum,wouldbeexpectedtohaveatleastonedebitandonecredit,wewouldexpectatleasttwoentrydetailrecordsforeachentryrecord.InadditiontotheJEitself,sometimesabatch(orgroup)of

164R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

JEsaresubmittedandprocessestogether.InthatcasetherewouldbebatchdataelementssimilartothoselistedatthetopofFig.1.

3.1.Thetechnologyenvironment

Theeffectiveandefficientdataminingofjournalentriesrequirescomprehensiveunderstandingoflikelymarkers(redflags)offraudulententriesoradjustments,statisticalpropertiesofjournalentriesandthetechnologicalenvironmentinwhichtheclienttransactsthejournalentries.Inthefollowingparagraphs,weaddressthelastoftheseconsiderations.Thereareanumberofimportanttechnologicalandpolicyissuestoconsiderbeforedeliberatingonthemosteffectiveandefficientformofdataminingofjournalentries.First,towhatextentarejournalentriespassedinsubsidiaryledgersandonlysummarizedintheGeneralLedger?Second,whatautomatedcontrolsexistoverthepassingofjournalentries?Third,howdoestheclientprocessaccountingestimates,consolidations,adjustmentsandotherfine-tuningintojournalentries?Fourth,whataretheimplicationsofbespokeandthirdpartyanalyticalandconsolidationsoftwareapplicationsingenerating“mega-combined”journalentries?Weaddresseachoftheseissuesinturninthefollowingdiscussions.

3.2.Granularityinprocessingofjournalentries

TheGeneralLedger(GL)withintheaccountinginformationsystemisthefinalrepositoryfortheeconomicimpactofalleconomiceventsthataffectanorganizationand,byextension,thefinancialstatements.ThecouplingoftheGeneralLedgertotheoriginalprocessingoftheeconomiceventthattriggerstheeventisanimportantfactorinthedesignofdataminingsolutions.GeneralLedgersystemstypicallyprocessdatathatmayhavearisenfromavarietyoftransactionprocessingsystems,including:sales,purchases,logistics,maintenanceandmanufacturingsub-systems.TheGeneralLedgercouldreceivetransactionsfromthosesystemsatdifferentlevelsofaggregation.Inmanyolderandlegacyaccountinginformationsystems,dataarecominginatahighlevelofaggregation.Theremaybeasinglejournalentryeachmonththatcapturesallthemultitudeoftransactionsthatwereprocessedbytheparticularsub-system.Forexample,salessystemswilltransmitasingleentryeachmonththatwillhaveaggregatedpostingstorevenue,costofgoodssold,accountsreceivable,etc.AutomateddrilldownfromtheGeneralLedgertotheoriginaltransactionisusuallydifficultorinfeasibleinsuchsystems.Theminingofvalue-addingprocessesattheGeneralLedgerlevelisthennotnecessarilyparticularlyproductive.

Conversely,non-standardjournalentries,suchasclosingadjustmentsthatmaybemarkersoffinancialstatementfraud,arelikelytoberelativelyobvioustotheauditorofthesemoretraditionalorlegacyaccountinginformationsystems.Inthesesystems,non-standardjournalentriescanbeobservedamongarelativelysmallnumberofjournalentries.Theyarelikelytohaveclearlyidentifiedmarkersthatcanbeobservedbythedataminingapplication.

Ontheotherhand,inmanyclientinstantiationsofERP6systems,theGeneralLedgerrecordsthetransactionsattheatomiclevel.Itisnotuncommonforclientstohaveseveralhundredthousandjournalentries.Certaintransactionclassesmaybeaggregated,butareexceptionstothisrule.Theseincludelowtransactionvalueretailsalesandindividualmonthlybillingsfortelecommunicationsclients.Nonetheless,theGListypicallyaveryrichinformationenvironment.Further,manyclientsmaintaincloselycoupledtransactionprocessingsystems.AdrilldownisincreasinglyfeasiblefromtheGLto,forexample,salesprocessingandcustomerrelationshipsystems.

Whetherdataminingtechniquescanidentifypotentiallyfraudulentjournalentriesinapopulationofhundredsofthousandsofjournalentriesisstillanunansweredempiricalquestion.Identifyingnon-standardjournalentrieswithinalargepopulationofjournalentriesisalsoparticularlychallenging.

EnterpriseResourcePlanningisaclassofenterprisewideapplicationsoftwarefortrackingfinancialtransactions,logistics,sales,purchases,inventoryetc.

6R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181165

3.3.Adjustingjournalentries

Adjustingjournalentriesforestimatestoaccounts(e.g.,estimateforbaddebtallowance)areafocalpointforfinancialstatementfraudandrequireahighlydevelopedapproachtodatamining.Thereisanenormousvariationinhowclientscalculatethesemanyestimatesthatareusedinfinancialreporting.Manyadjustingjournalentrieswillbeastheresultofspreadsheetanalysisofaccruals,reserves,impairments,etc.Thesespreadsheetanalysesareanimportantsourceofcontrolrisk(JanvrinandMorrison2000;Panko2006;PricewaterhouseCoopers.2004).Inothercases,adjustingentriesmightresultfromstoredproceduresthataretriggeredinbusinessintelligencedatawarehousesorfromprogramswritteninSAP'sABAPlanguage.Thelogicofthejournalentrywillrestinthesupportingapplicationandrequirefurtherinquiryorassessment.Whenassessingwhatmayseentobequestionablejournalentriestheauditormustconsidertherisksassociatedwiththeparticularmethodforgenerationofthejournalentry.

3.4.Classesofjournalentriesandadjustments

ThereareseveralclassesofGeneralLedgerjournalentries.ThebulkofjournalentrieswithinGeneralLedgersystemsareso-called“system”entries.Theseentrieswillnormallybepostedasresultoftheconclusionofsomephaseinabusinessprocesssuchastheacquisitionofinventoryoratthedeliveryandbillingofgoodsorservices.Suchjournalentriesarepostedunderthecontroloftheapplicationsoftware.Inmostcases,thesesystementriesresultinanappropriatereflectionofthenatureofthebusinessprocessintheaccountingsystemanddonotrepresentfraud.However,someoftheseentriesmaybebecauseofsystematicfraud.Forexample,infinancialstatementfraudsthatentailinappropriaterevenuerecognitionmaywellinvolvesystemtransactionsthathavebeenfraudulentlyenteredintotheaccountinginformationsystematthedirection,interventionorinsistenceofsomelevelofmanagementwithintheenterprise.

Asecondclassofjournalentriesarethe“top-line”journalentriestotheGeneralLedger(CAQ2008,12).Aswithsystementries,thevastmajorityofthesetransactionsareentirelyappropriate.Forexample,anumberoftheseentriesresultsfromanalysesconductedbyenterprisestaff.Entriestoadjustallowancesfordoubtfuldebtstoreflectdebtorpaymenthistoriesattheendoftheperiod;rollbackofinventorytoadjuststandardcoststolowerofcostormarketandadjustmentstoaccountforimpairmenttothevaluationofacquiredgoodwillareallexamplesof“top-line”journalentriesthatarenormallyvalidandappropriate.Equally,anyoftheseentriescouldbeinappropriateandbeevidenceoffraud.

Athirdclassofjournalentriesiscomprisedof“mega-combined”journalentries.TheseareentriesarepushedtotheGeneralLedgerfromanalyticalandconsolidationssystems.Thesesystemsincludecustomapplicationsformanagingentity-specificaccountingaccrualsandestimates.Examplesareapplicationsformanagingexposures,suchasthevaluationoffinancialinstruments,warrantyprovisionsandcapitalleases.Consolidationandrapid-closeapplication,suchasthosefromHyperion,7areasecondexampleofsystemsthatgiveriseto“mega”journalentries.Thesemegaentrieswilltypicallybefewinnumberandimpactuponmanyaccounts—atworst,asinglejournalentrytransferredfromHyperionmightposttoseveralhundredaccountsintheGeneralLedgersystem.

Journalentriesarisingfromthesesystemsarelikelytobehighvaluefromafraudperspectivegiventhattheyarebydefinitionarisingnotfromaparticularinternalorexternalatomictransaction,butfromareviewofanaccrualoradjustment.Employingknownmarkersoffraudulententriesmaybehighlydebatablewhentheauditorviewssomanyeconomicassumptionsforaccrualsoradjustmentthroughthelensofsuchahighlyaggregatedsinglejournalentry.

AchallengealsoarisesfromthedisparatelocusofcontrolbetweentheGeneralLedgerandtheanalyticalandconsolidationssystems.Thesesystemsmayormaynothavetheirownsystemsofcontrolsandtransactionlogs.TheOracleHyperionFinancialManagementsoftwarepackage,forexample,hassophisticatedbuilt-incontrolsandlogs.Thecontrolsovercustom,in-housedevelopedsystemsarelikelytovarywidely.Nonetheless,controlsovertheseaccrualsandadjustmentsaresplitbetweenthegeneralledgerandtheanalyticalsystem,makingdataminingpotentiallydifficult.

7HyperionisnowpartofOracleInc.

166R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

3.5.Understandingthestatisticalpropertiesofjournalentries

Atthemostelementarylevel,wecanseeasetofjournalentriesasindependentmembersofapopulationofevents,correspondingtoaknownorexpecteddistribution.Unfortunately,researchintothestatisticalpropertiesofjournalentriesappearstobeanullset.Anextensiveliteraturereviewdidnotidentifyasinglepaper,otherthanthediscussionofapplyingdigitalanalysis(significantdigitlaw)thatwediscussinthenextparagraphs.Thereisnoliteraturethatmodelsthestatisticalpropertiesofpopulationsofjournalentries.Noristherealiteraturethattakesexemplardatabasesofjournalentriesandteststhestatisticalpropertiesofthosedatabases.Thisisindeedsurprising,giventhepublicpolicyimportanceoffinancialstatementfraudorthecentralityoftheseassessmentstothevalueaddingcharacteristicsofauditfirms.Theliteratureonauditsamplingisofonlylimitedvaluetothediscussionofdataminingjournalentries.Whenassessingjournalentries,theproblemisnotgeneratingarepresentativesamplesincetheauditorhasthecompletepopulationavailableinelectronicform.Rather,thetaskistoidentifythosejournalentriesthatareanomalousandpotentiallyindicativeoffraud.Whatdistributionwillrepresentsuchapopulation?

Digitalanalysisisagenerictermemployedintheforensicaccountingandauditingprofessionforinvestigationsofleadingdigitswithinpopulationsofinterest.TheSignificantDigitLaw,8whichisattheheartofdigitalanalysis,showsthatleadingdigitsinavarietyofpopulationsarenotnormallydistributed(Hill1995).Tothecontrary,theyfollowalogarithmicdistribution.AsHill(1995)notes,empiricalevidenceforthislawhasbeenfoundinawiderangeofnatural,asdistinctfromartificiallyconstructed,populations.AnalternativeapproachusingaBayesianapproachhasbeenproposedbyLey(1996)andsupportedbyevidencefromextensivesimulationsbyGeyerandWilliamson(2004).

Digitalanalysishasbeenemployedtodeterminefraudulentpatternsofdatainoperationsmanagement(Halesetal.2008),scientificpublishing(Diekmann2007)andearningsmanagement(Guanetal.2006;Skousenetal.2004).DigitalanalysishasbeenstronglyrecommendedbyNigriniandothersasavital,evenessential,toolinfrauddetection(Nigrini2000;NigriniandMittermaier1997).Whilethereareclearchallengeswiththepracticalapplicationofdigitalanalysis(ClearyandThibodeau2005),itremainsaveryusefultoolfordetectionofpossiblefraudwithinalargedataset.

Whilethefirstdigitsofjournalentriesareofconsiderableinterestinthedetectionoffraud,thefinaldigitsarealsoofconsiderableinterest.Aretherejournalentrieswithsignificantnumbersofzeroesorotherindicationsoffraud,assuggestedinSAS99?Weareparticularlyinterestedinthethreetosixdigitsfromtheright,asindicativeofthousandstomillionsofdollars.Afterthreedigitsfromtheleft,weexpectthatdigitswillappearwithequalprobability.Detectionofunusualpatternsintheright-mostdigitscanemploytraditionalparametricmeasuressuchasgoodnessoffit,skewnessandkurtosis.ChengandHall(1998)notethatthesetestsmayinfluencedalmostasmuchbythevalidityoftheparticularparametricmodele.g.bytheweightofthetailsofthefitteddistributionasbythehypothesisofhomogeneity.”AninterestingsolutiontothisproblemissuggestedbyHartiganandHartigan(1985).Their“dip”statisticmeasuresthemaximumdifferencebetweentheunimodaldistributionfunction(worstcase)andequaldistribution,asthemostextrememodality.Thediptestallowsustoseepatternsintherighthandsidedigitthatmightindicatefraud.

3.6.UnderstandingtheGeneralLedgerstructure

Eachjournalentrymustbeinterpretedinlightofthechartofaccounts.ThestructureofthechartofaccountsfortheGeneralLedgerisspecifictotheparticularentity.Theconceptofjournalentrywith“unusualaccountcombinations”requiresmatchingtheconceptualunderstandingofsuchcombinationstotheclient'schartofaccounts.Typically,theauditordevelopsaninternaltaxonomytorepresentagenericchartofaccounts.Thegenericchartofaccountsallowsanalysisofthejournalentriesintermsofunusualpatternsofactivity.Thesepatternsincludeabnormalvolumesoftransactionstoparticularclassesofaccounts;transactionstoclassesofaccountsatatypicaltimesintheclosingcycle;andjournalentriesmadetounusualcombinationsofaccounts.

ThisiscommonlyknownasBenford'sLaw(Benford1938)whoindependentlydeterminedrelationshipsfounddecadespreviouslybyNewcomb.

8R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181167

Theauditorand,particularly,thosefromauditfirmsthathavecentralizeddatacollectionandanalyticalfunctionsmustmapthesestandardtemplatesortaxonomiestotheclient'schartofaccounts.Thereisclearlyasignificanttimecostinmatchingthehierarchyoftheclient'schartofaccountstothestandardtaxonomy.Whenevertheclientmodifiesitschartofaccounts,thedatacollectionteammustadjustthemappingoftheclient'smodifiedchartofaccountstotheauditfirm'sgenericchartofaccountstaxonomy.ThereisapotentialroleforXBRLGLinprovidingmoresophisticatedmappingoftheclient'sgeneralledgertothegenerictaxonomy.Themappingmayincludenotjustthedate,accountandtransactionamountbutinformationoncontrolsanddatasources.

Thesignificanceofthedoubleentryaccountingsystemasthefoundationforann-dimensionalmatrixrepresentationofthevalueaddingactivitiesofthecompaniesiswell-known(Ijiri1975;IjiriandKelly1980;Leech1986;Mattessich1964,2003;SampsonandOlan1992).Ataminimum,eachjournalentryinvolvesatleasttwoaccountsaswellasatimedimension.Inthecaseofsystemsjournalentries,anyonetransactionmaysimultaneousposttoseveralhundredaccounts.Theaccountsinvolvedwithinajournalentryformpartofanaccountingtaxonomy.Thejournalentrylineamountsmustbeinterpretedinrelationtothistaxonomyaswellastheamount,statisticalpropertiesandtemporalcharacteristicsofthetransaction.Inaddition,eachtransactionisnotanentityuntoitself.Eachtransactionhastobeinterpretedinlightofalltheothertransactionsthatimpactuponanindividualaccountorgroupofaccounts.Takeninthetotality,thissetofattributesprovidesaveryrichpopulationtodataminingsoftware.Yet,howauditorscanapplymatrixtechniquestotheanalysisofjournalentriesisstillhighlytentativeandspeculative(Aryaetal.2000;SampsonandOlan1992).Muchadditionalresearchisrequiredtobetterexplorehowmatrixrepresentationscouldbebetterintegratedintojournalentryanalysis.

3.7.Puttingitalltogether

Insummary,thequestionsthataffecttheapplicationofdataminingtojournalentriesintheauditare:•Whatarethesourcesofthejournalentries?Howdothosesourcesinfluencedataminingforallenterprises?Fortheparticularenterprise?

•Arethereunusualpatternsinthejournalentriesbetweenclassesofaccounts?•Aretherepotentialoverridesincontrolsoverprocessingofjournalentries?

•Doestheclassofjournalentryinfluencethenatureofthejournalentry?Forexample,doadjustingjournalentriescarryagreaterprobabilityoffraud?

•Isthereevidenceofunusualpatternsintheamountofthejournalentrieseitherfromtheleftmostdigits(Benford'sLaw)orfromtherightmostdigits(HartiganandHartigan'sdiptest)?

•Howcanwetriangulateandcombinethesevariouspossibledriversoffraudinthejournalentriestoallowdirecteddatamining?

4.Investigatingpopulationsofjournalentries

Wenowmovetothefirststagesofassessingthequestionswesetoutintheprevioussection.Oneofthemajordifficultiesforresearchersinthefinancialfrauddomainisobtainingaccesstoreal-worldinternalaccountingdatatotestvarioushypothesesandmodels.Forthispaper,wewerefortunatetohaveaccesstoalargedatabasethatincludeddatasetsofjournalentriesforawidevarietyoforganizations.Specifically,ananonymoussoftwarevendorprovidedjournalentriesfor36organizations.Therearejournalentriesfortwoyearsfortwoorganizations.Thesoftwarevendorremovedanyidentifyinginformationfromthefilespriortotheirtransfer.Unfortunately,therewasnoaccesstotheopeningtrialbalancefortheseorganizations.Norweretheredetailsonthesourceofthejournalentriesortheemployeesinvolvedinpassingtheentries.Theseorganizationswerefromboththefor-andnot-for-profitsectors.Asevidencedfromthestyleofthejournalentriesandchartsofaccounts,theunderlyingaccountinginformationsystemswerealldifferent.Eightofthedatasetswereforperiodslessthantwelvemonthsandwereexcludedfromtheanalysisbelow.Oneorganization'sjournalentrydatasetwasincompleteandwasalsoeliminatedfromtheanalysis.

168R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

4.1.Mappingindividualchartsofaccounts

Oneofthechallengesinanalyzingthisjournalentrydatawasthateachorganizationhaditsownchartofaccounts.Usingthedisparatechartsofaccountswouldhavemadecross-sectionalanalysisverydifficult.Assuch,thefirststepinpreparingthisdataforanalysiswastocreateacomprehensivestandardchartofaccounts.Theneachorganization'schartofaccountswasmappedtothestandardchartofaccounts.Table1showsthedescriptivestatisticsofthe29setsofchartsofaccountsoftheorganizationswestudied.Therearearelativelysmallnumberofaccountsinuseinmostoftheorganizations,withasmallnumberoforganizationshavingcomplexchartsofaccounts.

Weconstructedamasterchartofaccountswitha“five–four”structure.Thefirstfivedigitsdesignatetheprimaryaccountandthesecondfourdigitsforthesub-account.Inmostcases,thefourdigitscorrespondtoaparticularsub-accountforoneoftheentitiesinthesample.Conversely,themasteraccounts(fivedigits)arepartofthelogicalstructureofthemasterchartofaccounts.Thereare1672accounts(five–four)inthemasterChartofAccounts,with343primary(fivedigits)accounts.Theresultingdatabasethatweusedforoursubsequentanalysishadatotalof496,182lineitemsacrossthe29organizations.Thereisconsiderablevariationinpostingtothevariousaccounts.Table2showsthenumberoftransactionsperprimaryaccount:

Therearetenaccountswithmorethan10,000transactionseach,includingtheusualsuspectsofAccountsReceivable(38,714transactions),AccountsPayable(44,916transactions)andSalariesandWages(44,158transactions).4.2.Descriptivestatistics

Table3showssomebasicdescriptivestatisticsforthe29organizations.Thefirstobservationthatarisesfromthesedescriptivestatisticsisthedifferencebetweentheorganizations.Thefirstcolumnliststhetotalnumberofjournalentrylineitemswithinthefiscalyear.Thehighestnumberwasnearly154thousandandthelowestwaslessthanonethousand.Thedollarvaluesofthejournalentrylinesalsovariedwidely.ThemaximumjournalentrylineitemfortheChiEtaentitywas$362,478,016.Thesmallestmaximumwas$34,929forPi.

Therelativelylargermaximumentriesprobablyindicatethatsummaryjournalentriestransferredinformationbetweenaccountingmodules.Forexample,perhapsonlyonejournalentrywasusedtotransfersummaryinformationonceamonthfromtheaccountspayablemoduletothegeneralledger.Summaryversusdetailedjournalentrieswillbepartoftheauditor'sriskanalysisandtheirsubsequentdevelopoftheauditprogram.Forexample,ifonlymonthlysummaryjournalentriesareused,thentheauditorisgoingtofocusonthesourcemodules(e.g.,accountspayable).Fromadataminingperspective,itisprobablybetterifdetailsaretransferredtothegeneralledgerbecausethegeneralledgerwillthenbeessentiallyalarge,comprehensivedatabase.If,ontheotherhand,thedetailsarekeptineachmodule,theneachmoduleisitsownisolateddatabase.Beingabletodatamineacrossmodulescanbeimportantinanaudit.Forexample,acommonsearchistofindanyvendoraddresses(storedinthevendormasterfile)thatarethesameasemployeeaddresses(storedintheemployeemasterfile)(CAQ2008).Matchescouldmeanthatanemployeehassetupafakevendorthatissubsequentlyreceivingchecksfromthecompany.

Thenumberofjournalentriesandlineitemsperjournalentryvarieswidely.Table4showsthenumberofindividuallineitemsthatmakeupthevariousjournalentriesforeachentity.Thefirstcolumnshowsthenumberofdistinctjournalentriesintheyear(N).Thenweshowthemean,standarddeviationandminimumandmaximumnumberoflineitemsperjournalentry.Therewereorganizationsthathavejournalentrieswithverylargenumbersoflineitems(e.g.Beta,ChiandZeta).Theseareexamplesofso-

Table1

Activeaccountsinorganizationalchartofaccounts.Minimum

MaximumactiveaccountsMedianactiveaccountsAverageactiveaccounts

431036107164

R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

Table2

Transactionsperfivedigitaccountsinmasterchartofaccounts.MinimumMaximumMedianMean

Standarddeviation

169

144,916

8614014784

called“megaentries,”wheretransactionsarecomingeitherfromstoredautomaticjournalentriesthatreverseprior-periodadjustingjournalentriesortransferdatafromsubsidiarysystems.5.Statisticalanalysisofjournalentries

Inthissection,weinvestigatethestatisticalanalysisofoursetofjournalentries.5.1.Digitallaw

Digitalanalysis(alsofirst-digitlaworBenford'sLaw)isastatisticaltechniqueregularlydiscussedintheprofessionalguidanceonfrauddetectioningeneral(Benford1938;Nigrini2000;NigriniandMittermaier1997;Tackett2007)andjournalentriesinparticular(CAQ2008).DigitalanalysispredictsthatthefirstdigitofasetofnumberswillhavethedistributionshowninTable5.

Table3

Descriptivestatisticsfororganizations.(1)EntityBetaChiChiEtaChiNuChiPiDeltaEtaEtaNuEtaPiGammaKappaKappaXiMuXiNu

OmicronPhiPhiPsiPiPiNuPsiRhoSigmaTauThetaUpsilonXiXiNuXiRoZeta

(2)Numberlineitems40,617153,80018,5722421487129,8666892318144544337244721011,53131825303841038,3291426699832584579137813771739452430,174278132,55462,638

(3)Totallineitems$(000)$240,221$60,889,933$13,396,011

$27,374$2712$78,716$215,237$43,517$23,463$38,823$97,421$41,261$1,730,387

$6533$195,516$19,229,705

$41,455$2140$13,940$2569$4529$840$863$1516$9337$674,415$154,551$5,381,983$11,094,568

(4)Maximumlineitem$$2,927,854$250,650,816$362,478,016

$653,316$495,667$393,500$12,000,000$489,822$685,613$618,214$576,281$464,904$24,223,476$425,000$12,893,261$549,332,992

$663,000$34,929$324,012$46,710$80,000$19,367$15,353$41,785$129,566$9,016,084$1,637,364$38,741,784$38,232,288

170R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

Table4

Lineitemsperjournalentry.(1)EntityBetaChiChiEtaChiNuChiPiDeltaEtaEtaNuEtaPiGammaKappaKappaXiMuXiNu

OmicronPhiPhiPsiPiPiNuPsiRhoSigmaTauThetaUpsilonXiXiNuXiRoZeta

(2)N109752752915502242235761444004845419912325279053657814339215360108685982649141248486455298626374682

(3)Mean3729652856387346964464633455531213

(4)StdDev481328711675213844102063496832567333642

(5)Min22222222222222222222222222222

(6)Max6421375663432318463214118664536653873585446776584523346345021525736

Table6showsthenumberofjournallineitemsforeachorganizationwithaparticularfirstdigitofthedollaramounts,theactualdistribution(Act%)ofthosedigits,andthevariancefromtheexpecteddistribution(Diff=Act%−Expected%).WeshowtheChi-squareandp-valueforeachentity.Foreveryoneofthe29entitiesinthestudy,theChi-squaredistributionindicatesthattheobservedpatternoffirstdigitsdiffersfromthatexpectedbyBenford'sLaw.IfweassumethatBenford'sLawshouldapplytoapopulationofjournalentries,thenthevariationsinthetableindicatemanyredflagsthatneedfurtherinvestigationbytheauditor.Forexample,whyisthenumberof5sconsiderablygreaterthanexpectedatBeta?Probablytheinterestingquestionbecomes:howistheauditorgoingtoinvestigatethatquestion?Betahas40,614journalentrylines.Istheauditorgoingtopulleveryjournalentrywheretherewasajournalentrylinewherethedollaramountstartedwith5?Thatwouldbe5,902journalentrylines.Instead,theauditorwouldwanttodeterminewaystoefficientlyanalyzepatternsinthoselines.Forexample,do5sshowupmorefrequentlyforspecificaccountnumbers,forspecificcombinationsofaccountnumbers,forspecificemployeeID'spostingthejournalentries,forspecifictimeperiods(e.g.,nearendofquarters,endofyears,orjustafterthestartofthenextquarterornextyear),orforotherpatternsthatthedataminingsoftwarediscovers.Benford'sLawbuildsoncertainassumptionsaboutunderlyingdata,includingthatthereareno

Table5

ExpecteddigitdistributionunderBenford'sLaw.Digit12345

Probability30.1%17.6%12.5%9.7%7.9%

Digit6789

Probability6.7%5.8%5.1%4.6%

R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

Table6

Observeddigitdistributionsinjournalentrydatabase.EntityBeta

Χ2=2911.7P=0.000Chi

Χ2=272.0p=0.000ChiEtaΧ2=49.9p=0.000ChiNuΧ2=44.5p=0.000ChiPi

Χ2=618.3p=0.000Delta

Χ2=180.5p=0.000Eta

Χ2=46.0p=0.000EtaNuΧ2=37.0p=0.000EtaPiΧ2=24.4p=0.001GammaΧ2=38.9p=0.000KappaΧ2=81.2p=0.000KappaXiΧ2=42.7p=0.000MuXi

Χ2=134.2p=0.000Nu

Χ2=523.3p=0.000OmicronΧ2=18.9p=0.015Phi

Χ2=21.8p=0.005PhiPsi

Χ2=275.6p=0.000Pi

Χ2=20.3p=0.009PiNu

Χ2=86.2p=0.000Psi

Χ2−50.9p−0.000

DataCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%Diff

110,36626%−5%48,72632%2%575231%1%79533%3%81017%−13%941032%1%21932%2%66229%−2%42830%0%130029%−1%236233%3%224931%1%329729%−1%65120%−10%160230%0%247530%−1%11,70531%0%45032%1%204129%−1%102331%1%

2634816%−2%26,66017%0%341018%1%46019%1%120025%7%477216%−2%10315%−3%41518%0%25818%0%79518%0%118816%−1%129818%0%194717%−1%88928%10%92517%0%151218%0%705718%1%25118%0%132219%1%56717%0%

3518213%0%18,84412%0%220812%−1%24910%−2%92119%6%359212%0%11917%5%25311%−2%19213%1%56413%0%103714%2%81311%−1%131111%−1%36511%−1%69913%1%113113%1%464312%0%16712%−1%104715%2%37712%−1%

4476712%2%14,4259%0%16949%−1%24410%0%53111%1%27239%−1%467%−3%2189%0%1329%−1%42510%0%6669%0%6279%−1%10509%−1%52917%7%4468%−1%7909%0%393710%1%1168%−2%68410%0%36611%2%

5590215%7%12,2528%0%14538%0%2259%1%3818%0%27559%1%507%−1%22110%2%1259%1%3418%0%5137%−1%6559%1%112210%2%2478%0%4188%0%6538%0%34229%1%1299%1%5247%0%3099%2%

622906%−1%96566%0%12036%0%1476%−1%3207%0%19527%0%467%0%1245%−1%715%−2%3428%1%4506%0%4897%0%9698%2%1926%−1%3416%0%6047%1%20645%−1%1229%2%3325%−2%1715%−1%

721285%−1%81185%−1%9765%−1%964%−2%2285%−1%15595%−1%183%−3%1778%2%997%1%2055%−1%4586%1%3595%−1%6245%0%1113%−2%2986%0%4726%0%20725%0%655%−1%3996%0%1454%−1%

819845%0%80085%0%8985%0%1165%0%2205%−1%15945%0%558%3%1265%0%534%−1%2005%−1%3194%−1%3986%0%6155%0%973%−2%3016%1%3674%−1%20495%0%715%0%3545%0%1344%−1%

9

171

16504%−1%71115%0%9585%1%894%−1%2605%1%15095%0%325%0%1225%1%876%1%2616%1%2513%−1%3224%0%5735%0%1013%−1%2735%1%3855%0%13804%−1%554%−1%2954%0%1665%1%

(continuedonnextpage)

172R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

Table6(continued)EntityRho

Χ2=28.0p=0.000SigmaΧ2=84.6p=0.000Tau

Χ2=24.4p=0.001ThetaΧ2=47.7p=0.000UpsilonΧ2=72.1p=0.000Xi

Χ2=394.2p=0.000XiNuΧ2=20.6p=0.008XiRo

Χ2=326.0p=0.000Zeta

Χ2=222.5p=0.000

DataCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%Diff

1128628%−2%39028%−2%41730%0%56032%2%124127%−3%886429%−1%85431%1%911828%−2%17,80928%−2%

285619%1%17413%−5%23217%−1%32319%1%91520%3%522117%0%49918%0%625419%2%10,84117%0%

362814%1%18513%1%19214%1%18110%−2%49111%−2%310210%−2%31911%−1%433313%1%881514%2%

446410%0%15111%1%14611%1%22113%3%43210%0%307910%1%2549%−1%319910%0%619310%0%

53909%1%1279%1%1269%1%1549%1%3448%0%26119%1%2489%1%311110%2%52678%0%

62546%−1%16012%5%886%0%865%−2%2856%0%17416%−1%1475%−1%21307%0%42337%0%

72505%0%645%−1%574%−2%744%−2%3047%1%21967%1%1806%1%18006%0%36926%0%

82445%0%554%−1%453%−2%744%−1%2325%0%16445%0%1616%1%14274%−1%30715%0%

92075%0%725%1%745%1%664%−1%2806%2%17166%1%1194%0%11824%−1%27174%0%

systematicassignmentofthenumbers.So,asanalternativeexplanation,itmaybethatjournalentriesviolateoneormoreofthoseassumptions.Thiscriticalquestionneedsfurtherresearch.5.2.Lastdigits

Professionalguidancealsodiscussesjournalentriesthatcontain“roundnumbersoraconsistentendingnumber”(CAQ2008).Journalentrieswiththesecharacteristicshaveabnormaldistributionsoflastdigits.Unlikethefirstdigit,whichisexpectedtohavealogarithmicdistribution,thelastdigitswouldbeexpectedtohaveauniformdistribution.Asatestofuniformity,Table7showsthedistributionofthefourthdigitforeachorganizationforalldollaramountsgreaterthan$999.Bythispositionweexpectauniformdistributionoftheintegers(thesamenumberof0s,1s,etc.).Table7showsthedistributionwasdefinitelynotuniformformanyoftheentities.Forexample,forBeta,some19%ofthefourthdigitofjournalentrylineitemsendedinzero(10%wasexpected).Manyoftheentitieshadjournallineitemswithfourthdigitsignificantlygreaterthanexpected,rangingupto58%forXiNu.Someeightofthe29entitieshadoneofthefourthdigitsbeingthreetimesmorethanexpected.However,therecouldbesituationsinorganizationsthatmakesomenumbersappearmoreoften.Forexample,anappliancecompanymightpriceplasmaTVsat$1,598etc.Inthatsituation,8swouldbeexpectedtoappearmorefrequentlyinthepopulation.

TheHartiganandHartigan(1985)diptestofunimodalityprovidesatestofthemodaldistributionagainstthebasecaseofequaldistribution.Table8showsthediptestforeachoftheorganizationsinthestudy.9Thetableshowsthediptestvalue(3)andprobability(4).Columns(5)and(6)showthelowandhighends,respectively,ofthemodalintervalforthebest-fittingunimodaldistribution.Some21oftheorganizationshadstatisticallysignificantdiptestvalues,wherepb0.01.Giventhatthesevaluesrangefromzeroto999,10someof

ThereportedtestemploystherevisedalgorithmofChengandHall(1998).Thereportedstatisticeliminatesthe5398lineitemsoflessthan$1.10Giventhatthesearethelastthreedigits,avalueof$10,$100,$1000and$10,000wouldallhavethesamevalueofzero.Thetestsshowninthissectionwererepeatedwithadjustmentsforlineitemsgreaterthan$1000.Essentiallyidenticalresultswereobserved.

9R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

Table7

Observedfourthdigitdistributionsinjournalentriesdatabase.EntityBeta

Χ2=881.8p=0.000Chi

Χ2=606.8p=0.000ChiEtaΧ2=613.3p=0.000ChiNuΧ2=756.7p=0.000ChiPi

Χ2=44.65p=0.000Delta

Χ2=334.1p=0.000Eta

Χ2=449.4p=0.000EtaNu

Χ2=3483..9p=0.000EtaPiΧ2=39.8p=0.000GammaΧ2=1651.4p=0.000KappaΧ2=956.6p=0.000KappaXiΧ2=926.7p=0.000MuXi

Χ2=2986.2p=0.000Nu

Χ2=28.3p=0.000OmicronΧ2=49.3p=0.000Phi

Χ2=468.2p=0.000PhiPsi

Χ2=4901.3p=0.000Pi

Χ2=32.5p=0.000PiNu

Χ2=71.1p=0.000Psi

Χ2=377.3p=0.000

DigitCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%Diff

0168519%9%992312%2%187517%7%40034%24%1618%8%150015%5%19836%26%87054%44%6313%3%69638%28%82325%15%68826%16%156634%24%3518%8%27814%4%117918%8%199638%28%4311%1%20616%6%19533%23%

17419%−1%772810%0%10119%−1%736%−4%1821%11%8158%−2%6011%1%624%−6%337%−3%1247%−3%1916%−4%1204%−6%3167%−3%1910%0%1598%−2%6109%−1%2815%−5%318%−2%1109%−1%437%−3%

27699%−1%823410%0%105810%0%1008%−2%1821%11%110511%1%377%−3%946%−4%7315%5%1357%−3%2959%−1%2238%−2%3518%−2%2714%4%22111%1%5839%−1%4018%−2%318%−2%947%−3%397%−3%

37909%−1%786110%0%9449%−1%988%−2%78%−2%8709%−1%377%−3%755%−5%5411%1%855%−5%2829%−1%1807%−3%3528%−2%126%−4%19710%0%6079%−1%3697%−3%6517%7%14111%1%366%−4%

47789%−1%75399%−1%10059%−1%1008%−2%67%−3%103110%0%407%−3%654%−6%347%−3%1146%−4%2147%−3%1747%−3%3037%−3%147%−3%1909%−1%5889%−1%3006%−4%298%−2%13010%0%549%−1%

58199%−1%836610%0%111010%0%756%−4%11%−9%8638%−2%5710%0%795%−5%439%−1%1699%−1%39812%2%39515%5%45110%0%2413%3%19910%0%69611%1%73514%4%287%−3%1199%−1%305%−5%

67449%−1%770010%0%10339%−1%12110%0%89%−1%108111%1%183%−7%1147%−3%367%−3%1016%−4%32910%0%1917%−3%3267%−3%105%−5%21811%1%5799%−1%3416%−4%4011%1%1018%−2%397%−3%

76798%−2%786210%0%9418%−2%575%−5%910%0%100510%0%5610%0%1378%−2%4910%0%1548%−2%2728%−2%28911%1%3297%−3%179%−1%1789%−1%64010%0%2906%−4%4412%2%1109%−1%376%−4%

885710%0%73279%−1%10169%−1%827%−3%11%−9%101710%0%214%−6%574%−6%7014%4%1056%−4%2598%−2%2299%−1%3247%−3%137%−3%1759%−1%5528%−2%3226%−4%277%−3%1169%−1%7313%3%

9

173

8099%−1%765910%0%109310%0%887%−3%33%−7%9199%−1%265%−5%644%−6%449%−1%1327%−3%1926%−4%1857%−3%2886%−4%2111%1%20810%0%5919%−1%2254%−6%4211%1%12910%0%387%−3%

(continuedonnextpage)

174R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

Table7(continued)EntityRho

Χ2=168.7p=0.000SigmaΧ2=53.1p=0.000Tau

Χ2=98.1p=0.000ThetaΧ2=47.3p=0.000UpsilonΧ2=68.1p=0.000Xi

Χ2=221.4p=0.000XiNu

Χ2=4774.4p=0.000XiRo

Χ2=705.6p=0.000Zeta

Χ2=1802.9p=0.000

DigitCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%DiffCountAct%Diff

017923%13%137%−3%3013%3%5213%3%14213%3%180913%3%107658%48%346115%5%671716%6%

1638%−2%169%−1%83%−7%379%−1%10210%0%12439%−1%774%−6%238110%0%39129%−1%

29112%2%63%−7%94%−6%308%−2%868%−2%139310%0%814%−6%22129%−1%39429%−1%

38911%1%2213%3%6326%16%256%−4%686%−4%142310%0%875%−5%21719%−1%39089%−1%

4577%−3%116%−4%2611%1%5614%4%989%−1%12239%−1%764%−6%224610%0%38529%−1%

5496%−4%148%−2%188%−2%349%−1%737%−3%135010%0%1015%−5%255211%1%430810%0%

6729%−1%4023%13%3314%4%6717%7%15415%5%156111%1%1106%−4%22129%−1%399610%0%

7658%−2%159%−1%177%−3%349%−1%10210%0%135210%0%704%−6%19028%−2%37029%−1%

8456%−4%106%−4%135%−5%349%−1%999%−1%11668%−2%845%−5%21799%−1%38599%−1%

97710%0%2916%6%219%−1%236%−4%12812%2%142310%0%885%−5%20949%−1%35549%−1%

Table8

Lastthreedigits—diptest.(1)EntityBetaChiChiEtaChiNuChiPiDeltaEtaEtaNuEtaPiGammaKappaKappaXiMuXiNu

OmicronPhiPhiPsiPiPiNuPsiRhoSigmaTauThetaUpsilonXiXiNuXiRoZeta

(2)N40,193152,65418,5012413471729,4006862300143744127231720511,49731055077834537,6391413692332504558137213681701445630,122272932,06361,502

(3)Dip0.0170.0030.0080.0120.0690.0060.0320.0190.0240.0120.0070.0160.0090.0210.0080.0110.0160.0180.0190.0110.0070.0210.0170.0170.0160.0080.0280.0060.004

(4)P0.0000.0000.0000.1180.0000.0020.0040.0020.0020.0100.1010.0000.0000.0000.1640.0010.0000.0410.0000.0910.3280.0110.0610.0260.0000.0000.0000.0000.000

(5)Low515002100000001000100813112000

(6)High51500212008200510250015312501269321028000

R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181175

thesedistributionsareparticularlyinteresting.Forexample,Chihasaneffectivelyunimodaldistributionofthelastthreedigits,withthevalue15.Thereare,however,only97lineitemsofgreaterthan$1000andwiththelastthreedigitvalueof15.Thereareseveralsimilartransactionsinvolvingthe“Severance,Bonuses&FringeBenefitsAccount,”whichmaywarrantfurtherinvestigation.Similarresultsareobservedforotherorganizationsofinterest,includingGamma,MuXiandTheta.

Auditorinvestigationofjournalentrieswithparticularlyhighlevelsofroundedorotherunusualpatternscannotrely,however,purelyonthosepatternsasascreenasthenumberofentriesmaybetoolargetoinvestigate.Thesepatternshavetobeconsideredinconjunctionwiththenumberofaccountsinvolved.Fig.2illustratestheserelationships.Theextentofabnormalpatterns,suchasroundedjournalentries,istheverticalaxis.Thenumberofdifferentaccountsinvolvedintheseunusualpatternsisthehorizontalaxis.IfanentityisinQuadrantA(high-small),thereisahighproportionofunusualjournalentrieswitharelativelysmallnumberofaccountsinvolvedinthesejournalentries.QuadrantB(high-large)alsohasalargenumberofjournalentrieswithabnormalpatternsbutwithalargenumberofaccountstowhichtheseentriespost.QuadrantC(low-small)hasbothlowabnormalityandasmallnumberofaccounts.QuadrantD(low-large)hasrelativelylowlevelsofabnormaljournalsbutwithalargenumberofaccounts.

IfanentityisinQuadrantA,thereisthesignificantpotentialforfraudbutonlyasmallnumberofaccounts.Webelievetheinvestigationcostisrelativelylow,asitislikelythattherearefewpatternsoftransactionstoidentify.Conversely,QuadrantBismoredifficulttoinvestigateastherearemoreaccountsinvolvedand,webelieve,alargersetofpatternsinthetransactions.

TounderstandthelargedifferencesinthelevelofabnormalpatternsinthejournalentrieswedisplayinTable7aboveandtoseeifthesejournalentriescouldbeseenasfollowingthepatternsweshowinFig.2,weundertookadditionalanalysis.Weselectedthelastthreedigits(totheleftofthedecimalplace)ofeachlineitemineachjournalentry.Inlinewiththepreviousdiscussion,weexpectedthattheselastthreedigitswouldbeuniformlydistributed.Weviewedthelineitemsineachjournalfromthreeperspectives:1)alllineitems,2)onlylineitemsgreaterthan$1000toeliminatereviewofminorjournalentriesand3)journalentriestotalingatleast$1000.Wecountedthetotalnumberoflineitemswithinjournalentriesundereachoftheoptions.Wethenidentifiedthenumberoflineitemswiththefivemostcommonsetsoflastthreedigitsandtookthisasaproportionofthetotallineitems.Wealsoconsideredthenumberofaccounts

Fig.2.Patternsofjournalentryvaluesvs.numberofaccountsinvolved.

176R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

Fig.3.Proportionofjournalentriestonumberofaccountsallitems.

postedwithinthejournalentriesmakingupthelineitemswiththefivemostcommonsetsoflastthreedigits.Figs.3–5showthethreevariantsofjournalentriesascomparedwiththenumberofaccounts.

Thereareinterestingpatternsinthesethreefigures.Thereareseveralentitiesthathaveveryhighlevelsofabnormallyfrequent“lastthreedigits.”Therearefourofour29entitiesthathave30to60%oftheirtransactionsmadeupofjustthetopfiveofthelastthreedigitpatterns.Withuniformdistribution,wewouldexpectanyfivethree-digitnumberstorepresentonly0.5%oftransactions.Interestingly,eachoftheseentitiesemploysonlyamaximumof40accountswithinthese“topfive”transactions.Effectively,inoursample,allthoseentitiesthathadstronglyabnormaltransactionpatternshadonlyarelativelysmallnumberofaccounts.ThesefourentitiescouldbeplacedinQuadrantA(high-small).NoentitieswereinQuadrantB,onewasinQuadrantD(low-large)andbyfarthemost,24,inQuadrantC(low-small).Ingeneral,allelsebeingequal,thefourfirmsinQuadrantAprobablyposethehighestriskoffraudfortheauditors.Thesefirmshaveaveryhighnumberofroundnumberorconsistentnumbertransactionsand

Fig.4.Proportionofjournalentriestonumberofaccountslineitemsgreaterthan$1000.

R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181177

Fig.5.Proportionofjournalentriestonumberofaccountsjournalentriesgreaterthan$1000.

theyarepostedtojustafewaccountswhichcouldindicatethatthefraudsteriscoveringuporfalsifyingaparticularclassoftransactionssuchpostingfictitioussales.

5.3.Unusualtemporalpatterns

Theprimaryobjectiveofdataminingisfindingunusualpatterns(oroutliersthatdonotfitapattern)inthedata.Theseunusualpatternswouldconstitutetheredflagsthattheauditorwouldsubsequentlyinvestigate.Oneredflagthatanauditormayinvestigateisunusualpatternsinthejournalentryactivities.End-of-quarterandend-of-yearjournalactivitiesareusuallyofparticularinterest.Theauditor'sconcernisthatmanagementwillmakeinappropriatejournalentriestoimproveormanagetheirperformancenumbers(e.g.,netincome)priortoclosingtheirbooksfortheirquarterlyfilings(form10-Qforpubliccompanies)andthemorecloselyfollowedannualreport(form10-Kforpubliccompanies),whichundergoesaformalcertifiedfinancialaudit.

Byfarthemostcommonformoffinancialfraudcentersonrevenuerecognition.Forexample,acompanymaybookasaleinoneyearthatactuallyoccurredinthefollowingyear.Inthemostegregiousformofrevenuerecognitionfraud,managementbookscompletelyfictitioussales.Theseexamplesofrevenuerecognitionfraudcouldresultinavarietyofjournalentriestobookthosesalesoverandabovethenormaljournalentries,whichwouldthereforeincreasetheoverallnumberofjournalentriespostedduringtheperiodoffraud(e.g.,thelastmonthoftheyear).

AsFig.6illustrates,diagnosingunusualpatternscanbechallengingbecausedefiningnormalisinitselfachallenge.Forexample,increasesinjournalentryactivitieswouldbeexpectedinthelastmonthofthefiscalyearasavarietyofone-timenormalclosingjournalentriesandaccrualswouldbeposted.GraphsontheleftsideofFig.6showjournalentrylineitemvolumeforeachmonthandgraphsontherightsideshowtheaveragedollarvalueofeachjournalentrylineforeachmonth.Visuallycomparingtheorganizationsinthefigure,itwouldbehardtodefinewhatisnormal.TheparticularthreeorganizationsinFig.6wereselectedtoillustratethewidedifferencesinthe29organizationsinourdatabase.Forthe29organizationsforwhichwehave12completemonthsofjournalentries(includingtheonesshowninFig.6),onlytwoorganizationshadthehighestvolumeinthelastmonthandonlyoneofthe29otherorganizationshadthehighestaveragedollarvaluesinthelastmonth.Doesthismeanthattherewaspotentialrevenuerecognitionfraudforthoseoneortwoorganizationsandnopotentialforrevenuerecognitionfraudattheotherorganizations?Ofcoursenot,onbothcounts.Itdoesillustrate,however,thattheauditorcannotvisuallycherrypickpotentialproblemareas.Itwilltakedeeperdataminingtoisolateunusualpatternsandtransactions.

178R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

Fig.6.Monthlydistributionsofmonthlyjournalentrylinevolumeanddollarvolumeforasampleoforganizations.

6.Conclusion

Frauddetectionhasbecomeanincreasinglyimportantelementofthefinancialstatementaudit.Thereisclearevidenceoftheimportanceofjournalentriesintheconductoffinancialstatementfraudsoverthelastdecade,withoneofthemostegregiousbeingWorldCom.Itishardlysurprising,then,thatakeyelementinrecentprofessionaldevelopmentsinincreasingthefrauddetectionrequirementsinthefinancialstatementaudithasbeensignificantlyheightenedrequirementstoassessthecontrolsonjournalentriesandtoconductsubstantiveteststhereon.Unfortunately,researchondataminingjournalentriesfromafrauddetectionperspectiveisessentiallyanullset.Inthispaper,wecanvassanumberofperspectivesonsuchdatamining.

R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181179

Thenatureandformofthepopulationofjournalentriespostedtothegeneralledgerincomputerizedaccountinginformationsystemsisafunctionofseveraltechnologicalandentity-levelcharacteristics.InamodernERPsystem,journalentrieswillbehighlygranular—evenatomic.Inmoretraditionalaccountinginformationsystems,generalledgerjournalentriesmaybehighlyaggregatedwherethegeneralledgerwillreceivesummarizedjournalsfromsubsidiarysystems.ThesesummarizedjournalentrieswillcaptureinformationwithaverydifferentprofilethaninanERPsystem.Journalentrieswillflowfromavarietyofothersystemsandbusinessprocesses.Journalentriesmayflowfromconsolidationsystems,fromautomatedorsemi-automatedgeneralledgerandfrommanualentries.Dataminingapproachesmustbesufficientlyflexibletoaccommodatethesedifferentdatastructuresandflows.

Thereisaclearandpressingneedforresearchonavarietyofinterrelatedareasindataminingjournalentries.Dataminingjournalentriesmustbringtogetherfivecharacteristics,viz(a)amount,(b)chartofaccountscodetoestablishimpactonthegeneralledger,(c)sourceofthejournalentry,(d)controlcharacteristicssurroundingtheindividualjournalentryand(e)openingand,byextension,closinggeneralledgerbalances.

Thebiggestimpedimenttodoingresearchindataminingofjournalentriesisgettingaccesstooneormorereal-worldjournalentrydatasets.Forthisproject,wehadaccessto36differentdatasets,ofwhich29wereappropriateforourinitialanalysis.Thesevenexcludeddatasetshadlessthan12monthsofdata.Therearepotentiallymanymoredataminingtechniquesthatcouldbeappliedtothisdataset.However,ourdigitalanalysistechniquesdidbringupsomeinterestingpreliminaryfindings,including:

•Forall29entitieswetested,theChi-squaredistributionindicatesthatthefirstdigitsofjournaldollaramountsdiffersfromthatexpectedbyBenford'sLaw.If,ononehand,weassumethatBenford'slawshouldapplytojournalentries,thesevariationsmeanstheauditorswouldhaveatremendousnumberofredflagstoinvestigate.Ontheotherhand,Benford'sLawbuildsoncertainassumptionsaboutunderlyingdata,so,furtherresearchisneededtoexplorewhetherorhowjournalentriesviolateoneormoreofthoseassumptions.•Professionalguidancerecommendsidentifyingjournalentriesthatcontainroundnumbersoraconsistentendingnumber.Unlikefirstdigits,whichareexpectedtohavealogarithmicdistribution,thelastdigitswouldbeexpectedtohaveauniformdistribution.Ourtestfoundthatthedistributionwasdefinitelynotuniformformanyoftheentities.Eightofthe29entitieshadoneofthefourthdigitsbeingthreetimesmorethanexpected.However,therecouldbesituationsinorganizationsthatmakesomenumbersappearmoreoften,whichwouldhavetobeidentifiedbytheauditors.

•Sinceinvestigatingfalsepositivescouldbeexpensivefortheauditors,auditorswillhavetodevelopandselectauditmethodologiesappropriatetothecharacteristicsofthejournalentries.Wecomparedthenumberofaccountsrelatedtothetop-fivemost-frequentlyoccurringthreelastdigitcombinations.Ofthe29entities,fourentitieshadaveryhighoccurrencesofthetop-fivethree-digitcombinationthatinvolvedonlyasmallsetofaccounts,onehadalowoccurrencesofthetop-fivethree-digitcombinationthatinvolvedalargesetofaccountsand24hadalowoccurrencesofthetop-fivethree-digitcombinationthatinvolvedasmallsetofaccounts.Ingeneral,allelsebeingequal,thefirstfourfirmsprobablyposethehighestriskoffraudfortheauditorssincetheyhadaveryhighnumberofroundednumberorconsistentnumbertransactionsandtheyarepostedtojustafewaccountswhichcouldindicatethatthefraudsteriscoveringuporfalsifyingaparticularclassoftransactions.

•Intermofgeneralpatternsoftransactionvolumes,theredidnotappeartobeany.Weexpectedtoseeincreasesatquarterendoryear,butwedidnotfindconsistentexamplesofthisinour29entities.Ourinitialanalysisofthe29journalentrydatasetsjustbeginsthepotentialanalysisofthesedatasets.Inthefuture,weexpecttoapplymanymoredataminingtechniquestodiscoverotherpatternsandrelationshipsinthedatasets.Wealsowanttostartseedingthedatasetwithfraudindicators(e.g.,pairsofaccountsthatwouldnotbeexpectedinajournalentry)andcomparethesensitivityofthedifferentdataminingtechniquestofindtheseseededindicators.Acknowledgements

Ourthanksfortheimportantsupportofasoftwarevendorinprovidingdata,NeilHermanfordataextractionandcodingandtheShidlerCollegeofBusinessattheUniversityofHawai'iatMānoaforfinancialsupport.

180R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181

References

AryaA,FellinghamJ,SchroederDA.Accountinginformation,aggregation,anddiscriminantanalysis.ManageSci2000;46(6):

790–806.

ASB.StatementonAuditingStandardsno.99considerationoffraudinafinancialstatementaudit,26.NewYork:AuditingStandards

Board,AmericanInstituteofCPAs;2003.

ASB.StatementonAuditingStandardsno.109understandingtheentityanditsenvironmentandassessingtherisksofmaterial

misstatement,46.NewYork:AuditingStandardsBoard,AmericanInstituteofCPAs;2006a.

ASB.StatementonAuditingStandardsno.110performingauditproceduresinresponsetoassessedrisksandevaiuatingtheaudit

evidenceobtained,26.NewYork:AuditingStandardsBoard,AmericanInstituteofCPAs;2006b.

ASB.Exposuredraft—proposedstatementonauditingstandardsconsiderationoffraudinafinancialstatementaudit(redrafted).

NewYork:AuditingStandardsBoard,AmericanInstituteofCPAs;2009.

BenfordF.Thelawofanomalousnumbers.ProcAmPhilosSoc1938;78:551–72.

Beresford,D.R.,N.d.Katzenbach,andC.B.Rogers.2003.ReportofinvestigationbytheSpecialInvestigativeCommitteeoftheBoard

ofDirectorsofWorldCom,Inc.Clinton,Miss.:WorldCom,Inc.,345.

CAQ.PracticeaidfortestingjournalentriesandotheradjustmentspursuanttoAUsection316.Washington,DC:CenterforAudit

Quality;2008.

ChengM-Y,HallP.Calibratingtheexcessmassanddiptestsofmodality.JRStatSocSerB1998;60(3):579–89.

ClearyR,ThibodeauJC.ApplyingdigitalanalysisusingBenford'sLawtodetectfraud:thedangersoftypeIerrors.Auditing2005;24

(1):77–81.

CurtisMB,JenkinsJG,BedardJC,DeisDR.Auditors'trainingandproficiencyininformationsystems:aresearchsynthesis.JInfSyst

2009;23(1):79–96.

DeVriesDD,KigerJE.Journalentriesandadjustments—yourbiggestfrauddanger.JCorporateAccountingFinance2004;15(4):

57–62.

DiekmannA.Notthefirstdigit!UsingBenford'sLawtodetectfraudulentscientificdata.JApplStat2007;34(3):321–9.

GeyerCL,WilliamsonPP.DetectingfraudindatasetsusingBenford'sLaw.CommunStatSimulComput2004;33(1):229–46.

GuanL,HeD,YangD.Auditing,integralapproachtoquarterlyreporting,andcosmeticearningsmanagement.ManageAuditingJ

2006;21(6):569–81.

HalesDN,SridharanV,RadhakrishnanA,ChakravortySS,SihaSM.Testingtheaccuracyofemployee-reporteddata:aninexpensive

alternativeapproachtotraditionalmethods.EurJOperRes2008;189(3):583–93.HartiganJA,HartiganPM.Thediptestofunimodality.AnnStat1985;13(1):70–84.HillT.Astatisticalderivationofthesignificant-digitlaw.StatSci1995;10(4):354–63.

IAASB.Internationalstandardonauditing240—theauditor'sresponsibilityrelatingtofraudinanauditoffinancialstatements.

Handbookofinternationalstandardsonauditingandqualitycontrol.NewYork:InternationalAuditingandAssuranceStandardsBoard,InternationalFederationofAccountants;2009a.p.163–206.

IAASB.Internationalstandardonauditing330—theauditor'sresponsestoassessedrisks.Handbookofinternationalstandardson

auditingandqualitycontrol.NewYork:InternationalAuditingandAssuranceStandardsBoard,InternationalFederationofAccountants;2009b.p.331–54.

IjiriY.Theoryofaccountingmeasurement.Sarasota,Fla:AmericanAccountingAssociation;1975.

IjiriY,KellyE.Multidimensionalaccountinganddistributeddatabases:theirimplicationsfororganizationsandsociety.AccOrganSoc

1980;5(1):115–23.

JanvrinD,BierstakerJ,LoweDJ.Aninvestigationoffactorsinfluencingtheuseofcomputer-relatedauditprocedures.JInfSyst

2009;23(1):97-118.

JanvrinD,MorrisonJ.Usingastructureddesignapproachtoreducerisksinenduserspreadsheetdevelopment.InfManage2000;37

(1):1.

LeechSA.Thetheoryanddevelopmentofamatrix-basedaccountingsystem.AccountingBusRes1986;16(64):327–41.LeyE.OnthepeculiardistributionoftheU.S.stockindexes'digits.AmStat1996;50:311–3.MattessichR.Accountingandanalyticalmethods.Homewood,Ill:RichardDIrwin;1964.

MattessichR.Accountingresearchandresearchersofthenineteenthcenturyandthebeginningofthetwentiethcentury:an

internationalsurveyofauthors,ideasandpublications.AccountingBusFinancialHist2003;13(2):125–70.

NigriniMJ.DigitalanalysisusingBenford'sLaw:testsstatisticsforauditors.Seconded.Vancouver:GlobalAuditPublications;

2000.

NigriniMJ,MittermaierLJ.TheuseofBenford'sLawasanaidinanalyticalprocedures.AuditingAJPractTheory1997;16(2):

52–67.

PankoRR.SpreadsheetsandSarbanes–Oxley:regulations,risks,andcontrolframeworks.CommunAIS2006;2006(17):2-50.

PCAOB.AUsection316—considerationoffraudinafinancialstatementaudit[URL].PublicCompanyAccountingOversightBoard

[cited20October2006].Availablefrom.http://pcaob.org/standards/interim_standards/auditing_standards/index_au.asp?series=300§ion=300.2002.

PCAOB.Proposedauditingstandardsrelatedtotheauditor'sassessmentofandresponsetoriskandconformingamendmentsto

PCAOBstandards.PublicCompanyAccountingOversightBoard,21October[cited10June2009].Availablefrom.http://www.pcaobus.org/Rules/Docket_026/2008-10-21_Release_No_2008-006.pdf2008.

POB.Reportandrecommendationsofthepanelonauditeffectiveness.NewYork:AmericanInstituteofCertifiedPublicAccountants,

PublicOversightBoard;2000.

PricewaterhouseCoopers.Theuseofspreadsheets:considerationsforsection404oftheSarbanes–OxleyAct.NewYork,NY:

PricewaterhouseCoopersLLP;2004.9.

SampsonWC,OlanMJ.Aninnovationinauditing:matrixsummariesofjournalentries.Abacus1992;28(2):133–41.

SkousenCJ,GuanL,WetzelTS.Anomaliesandunusualpatternsinreportedearnings:Japanesemanagersroundearnings.JInt

FinancialManageAccounting2004;15(3):212–34.

TackettJA.Digitalanalysis:abetterwaytodetectfraud.JCorporateAccountingFinance2007;18(4):27–36.WallaceW.Reportingpractices:potentiallessonsfromCendantCorporation.EurManageJ2000;18(3):328–33.

R.S.Debreceny,G.L.Gray/InternationalJournalofAccountingInformationSystems11(2010)157–181181

WeldLG,BergevinPM,MagrathL.Anatomyofafinancialfraud:aforensicexaminationofHealthSouth.CPAJ2004:44–9

(October).

WillkieFarrGallagher,ArthurAndersenLLP.ReporttotheAuditCommitteeoftheBoardofDirectorsofCendantCorporation,August

24[cited1September2007].Availablefrom.http://www.secinfo.com/dsvrn.71H3.htm.1998.

WoodsL.Inconfidence[Email],26April[cited10May2007].Availablefrom.http://news.findlaw.com/hdocs/docs/worldcom/

worldcom062602cstemail.pdf.2002.