Benford's law for integrity tests of high-volume databases: a case study of internal audit in a state-owned enterprise

Hector Ruben Morales,Nicolas Epelbaum,Marcela Porporato

doi:10.1108/jefas-07-2021-0113

Abstract

PurposeThe technical feasibility of using Benford's law to assist internal auditors in reviewing the integrity of high-volume data sets is analysed. This study explores whether Benford's distribution applies to the set of numbers represented by the quantity of records (size) that comprise the different tables that make up a state-owned enterprise's (SOE) enterprise resource planning (ERP) relational database. The use of Benford's law streamlines the search for possible abnormalities within the ERP system's data set, increasing the ability of the internal audit functions (IAFs) to detect anomalies within the database. In the SOEs of emerging economies, where groups compete for power and resources, internal auditors are better off employing analytical tests to discharge their duties without getting involved in power struggles.Design/methodology/approachRecords of eight databases of an SOE in Argentina are used to analyse the number of records of each table in periods of three to 12 years. The case develops step-by-step Benford's law application to test each ERP module records using Chi-squared (χ²) and mean absolute deviation (MAD) goodness-of-fit tests.FindingsBenford's law is an adequate tool for performing integrity tests of high-volume databases. A minimum of 350 tables within each database are required for the MAD test to be effective; this threshold is higher than the 67 reported by earlier researches. Robust results are obtained for the complete ERP system and for large modules; modules with less than 350 tables show low conformity with Benford's law.Research limitations/implicationsThis study is not about detecting fraud; it aims to help internal auditors red flag databases that will need further attention, making the most out of available limited resources in SOEs. The contribution is a simple, cheap and useful quantitative tool that can be employed by internal auditors in emerging economies to perform the first scan of the data contained in relational databases.Practical implicationsThis paper provides a tool to test whether large amounts of data behave as expected, and if not, they can be pinpointed for future investigation. It offers tests and explanations on the tool's application so that internal auditors of SOEs in emerging economies can use it, particularly those that face divergent expectations from antagonist powerful interest groups.Originality/valueThis study demonstrates that even in the context of limited information technology tools available for internal auditors, there are simple and inexpensive tests to review the integrity of high-volume databases. It also extends the literature on high-volume database integrity tests and our knowledge of the IAF in Civil law countries, particularly emerging economies in Latin America.

Highlights

International Standards on Auditing (ISA) encourages auditors to use analytical procedures during the planning, execution and completion phases of the audit to identify, among others, the existence of unusual trends (ISA 300, 2009; ISA 315, 2016; ISA 330, 2006)
Motivating this study is the fact that internal auditors operating in state-owned enterprises (SOEs) in emerging economies need to employ analytical techniques that allow them to discharge their duties without interfering with the political process that might ask to ignore rules, procedures and best practices in corporate governance
This study focuses on mitigating uncertainty by providing a test interpreted as an indicator of the confidence or alert of the possible inherent or pre-existing risk of the computerized data that are made available to the internal auditors in their routine tasks

Summary

Introduction

International Standards on Auditing (ISA) encourages auditors to use analytical procedures during the planning, execution and completion phases of the audit to identify, among others, the existence of unusual trends (ISA 300, 2009; ISA 315, 2016; ISA 330, 2006). This study focuses on mitigating uncertainty by providing a test interpreted as an indicator of the confidence or alert of the possible inherent or pre-existing risk of the computerized data that are made available to the internal auditors in their routine tasks. To properly measure the inherent risk level before evaluating the existence and effectiveness of internal controls, the auditor needs to find and investigate possible errors or material differences. International regulations urge internal auditors to act in computerized environments to evaluate the reliability of the data used by testing controls and applying substantive data tests at the transaction level (ISA 315, 2016; ISA 330, 2006). The literature documents the advantage of leaving proper audit trails (Okundaye et al, 2019) and propitiates the testing of large data sets to generate evidence of consistency in the data (Cleary and Thibodeau, 2005), one of which is Benford’s law (Nigrini, 2019)

Objectives

Results

Discussion

Conclusion