End of Chapter Questions, Exercises, and Problems
for
by
Mark J. Nigrini, Ph.D.
Version 1.00 dated March 21, 2012.
Copyright © 2012 by Mark J. Nigrini. All rights reserved.
This document is a supplement to Forensic Analytics and has been prepared for purchasers of the book.
Table of Contents
Notes for the student ................................................................................................................................... 2
Chapter 1: Using Access in Forensic Investigations..................................................................................... 3
Chapter 2: Using Excel in Forensic Investigations ....................................................................................... 7
Chapter 3: Using PowerPoint in Forensic Presentations .......................................................................... 10
Chapter 4: High-Level Data Overview Tests .............................................................................................. 12
Chapter 5: Benford's Law: the Basics ........................................................................................................ 14
Chapter 6: Benford's Law: Assessing Conformity...................................................................................... 17
Chapter 7: Benford's Law: The Second-Order and Summation Tests ...................................................... 20
Chapter 8: Benford's Law: Number Duplication and Last-Two Digits Tests ............................................. 23
Chapter 9: Testing the Internal Diagnostics of Current Period and Prior Period Data ............................ 25
Chapter 10: Identifying Fraud Using the Largest Subsets and Largest Growth Tests .............................. 27
Chapter 11: Identifying Anomalies Using the Relative Size Factor Test ................................................... 29
Chapter 12: Identifying Fraud Using Abnormal Duplications within Subsets .......................................... 31
Chapter 13: Identifying Fraud Using Correlation ...................................................................................... 33
Chapter 14: Identifying Fraud Using Time-Series Analysis ....................................................................... 35
Chapter 15: Fraud Risk Assessments of Forensic Units............................................................................. 41
Chapter 16: Examples of Risk Scoring with Access Queries ...................................................................... 44
Chapter 17: The Detection of Financial Statement Fraud......................................................................... 47
Chapter 18: Using Analytics on Purchasing Card Transactions ................................................................. 50
1
NOTES FOR THE STUDENT
Forensic accounting is an interesting, challenging, and rewarding profession with many diverse
facets to all parts of the investigation. The U.S. Department of Labor states that accountants and auditors
are expected to experience faster than average employment growth from 2008 to 2018. Job opportunities
should be favorable for accountants and auditors who have a professional certification and CPAs should
have the best prospects. Also, management accountants and internal auditors increasingly will be needed
to discover and to eliminate fraud, and forensic accountants will be needed to detect illegal activity by
individuals, companies, and organized crime rings. This all means that the skills that you develop from
forensic analytics are skills that is needed and valued in the marketplace, and which contributes positively
to the well-being of society. The less fraud and corruption in society, the less the prices of goods and
services have to be inflated to cover these losses.
These analytic skills are not easy to acquire. No specialized vocation is easy. Fraud investigation
requires some special skills because we are trying to detect activities that the fraudster purposely sought
to conceal. On top of this, we operate in an adversarial system of justice. This means that errors and
omissions on the part of the investigator will be used defendants and their attorneys. A quick skim
through the chapters isn't going to develop much of a useful skill. This would be like reading a small
English-Spanish translation dictionary and then expecting to be able to talk Spanish in your travels
abroad. What is needed here is a careful reading of the book and lots of practice. For each chapter the
end-of-chapter materials include:
 At least five discussion questions, five short answer questions, five multiple choice questions, and
 At least two cases
The discussion questions are meant to be a bit thought provoking. Some of these questions will
require you to think "outside the box" or "outside the chapter." You won't find the exact answer to the
question in the chapter. This was done on purpose. The short answer and the multiple choice questions
call for the best answer to each question. The cases will be hard work. You will be asked to use four
different data sets for the cases together with an Excel template and a real-world forensic report. The
cases will assume a reasonable level of competence with Excel and Access. If you get stuck please look
at your course syllabus for the procedures and rules related to asking your instructor or a class friend for
help. Lots of help is available on the Microsoft website. You don't have to guess what VLOOKUP is
(Case 18-16). The Microsoft site has an explanation together with an example.
There are also PowerPoint slides that outline the main points in the chapter. The PowerPoint
slides are not a substitute for reading the chapter.
Please thank your instructor for making your course a highly relevant course from a personal and
a social perspective. I welcome feedback from users.
Mark J. Nigrini, Ph.D.
Pennington, New Jersey, USA
March 20, 2012
2
CHAPTER 1
USING ACCESS IN FORENSIC INVESTIGATIONS
Discussion Questions
1. Forensic analytics is the procurement and analysis of electronic data to reconstruct, detect, or
otherwise support a claim of financial fraud. List the four main steps in forensic analytics.
2. List the four Access objects of most use in forensic analytics with a brief description of each.
3. Is importing data into Access a challenging task?
4. List four features that show that Access was made to, amongst other things, perform calculations
and to manipulate and query data.
5. Why do Excel tables usually need some work before they can be used in Access?
Short Answer Questions
6. If you make a serious error in Access you can always "exit without saving" to undo the error
(true/false).
7. In Access it is quite easy to export tables or the results of queries to Excel (true/false).
8. Numeric amounts made up of dollars and cents or numeric amounts, or where the user does not
want any rounding errors should be formatted as text (true/false).
9. It is good practice to include a primary key in Access tables (true/false).
10. Access does not have a password encryption feature (true/false).
Multiple Choice Questions
1.
An Access database (.accdb) file size is limited to,
a. 1,048,576 rows
b. 10 gigabytes
c. 2 megabytes
d. 2 gigabytes
2.
a.
b.
c.
d.
To get Access to start working you need to,
Open an existing file or create a new blank database
Run the Query Wizard "start new database"
Have a table that takes up more than 2 GB
Click "Run" from the VBA module
3
3.
a.
b.
c.
d.
The order of the records in an Access table,
Make the execution of a query faster when the results are sorted from smallest to largest
Should have no effect on the results of any query
Can help to keep a file size below the Access file size limit
Can cause innocent people to be found guilty of fraud
a.
b.
c.
d.
The form most often used in forensic analytics is called a
Dashboard
Billboard
Signboard
Switchboard
4.
5.
A query that requires Access to use the data in two or more tables needs to include a,
a.
b.
c.
d.
Coin
Filter
Join
Parameter
Cases
16.
Elaine Ashby had come to enjoy the family holiday celebrations. While year-end was normally a
busy time with Elaine preparing for her upcoming audits, the holiday events provided a welcome break
from her clients. Being promoted to partner this past year at Alexander, Mitchell & Co. meant new audit
responsibilities and several new clients. Elaine needed, and looked forward to, a relaxing evening with
her extended family.
Cole Forester is Elaine’s nephew and a senior majoring in statistics. Both Elaine and Cole shared
a common interest – solving brain-teasers. Elaine anticipated that Cole would try to stump her with
challenging problems that he had come across since the family’s last get-together.
Sure enough, Cole had a lot of interesting mind-twisting puzzles. They tested each other for a
while. To introduce the next problem, Cole took an Almanac from the book shelf.
Cole said, “Aunt Elaine, this is a question about the length of rivers. What do you think is the
most common first digit of a river’s length? Do most river lengths start with a 5 as in 50 miles or 500
miles, or do river lengths mostly start with some other digit?”
“Wow, this is a good one!” said Elaine. Thinking aloud, she wondered, “It is more likely that the
first digit of a river’s length is a 5, or a 6, or a 2?” “Wait, this is a trick question. Is the river’s length in
miles or kilometers,” asked Elaine.
“The answer is the same whether length is measured in miles or kilometers,” answered Cole. “In
fact, the answer is the same no matter how you measure it. You could measure it in beer can lengths if
you wanted,” Cole stated.
After a few moments, Elaine said, “I’m stumped. I would think that each digit would be equally
likely, especially if the measurement doesn’t matter.”
4
“The most common first digit for river lengths is 1,” replied Cole. “Look here in the almanac.”
Cole opened the book to show Elaine a list of rivers and their lengths. Indeed, 1 was the most common
first digit, followed by 2, then 3, and so on.
Cole continued, “And it’s not just river lengths, it could be the stream flow numbers, the
populations of cities, the market capitalizations of listed companies, or almost anything in which numbers
occur naturally.”
“Pretty interesting stuff, where did you find this one?” asked Elaine.
“We were talking about Benford’s Law in one of my statistics classes. Frank Benford, back in
the 1930’s, saw that the first pages of his logarithm tables were more worn than the last pages. The first
pages show the logs of numbers with low first digits. He did some analysis of real-world numbers and a
little integral calculus and voila – Benford’s Law. Benford found that the probability of digits occurring
is mathematically determinable and that large differences between the expected probabilities of the low
and high digits exist. For example, the likelihood of a 1 being the first digit is more than 30% and the
likelihood of a 9 being the first digit is less than 5%,” said Cole.
“Okay, you got me on that one. Now, I have one for you,” replied Elaine. For the next half-hour,
Elaine and Cole challenged each other.
On her way home Elaine mulled over what Cole had said about Benford’s Law. Maybe she could
use Benford’s Law to help identify which client accounts to audit. Her thought was that authentic
numbers would follow Benford’s Law, while fictitious numbers would not follow Benford’s Law. If a
fraud has been, or is being, perpetrated, the principles of Benford’s Law might help her identify the
fraudulent (invented) numbers. She decided to call Cole in the morning to ask for some more information
on Benford's Law.
Cole wrote a report that described the fundamental elements of Benford’s Law. Cole’s professor
gave him somel references to recent academic and professional articles. After reading the report, Elaine
felt that forensic analytics was appropriate as part of the analytical procedure process and as a fraud
detection tool.
Elaine felt that Benford’s Law provided a valid benchmark against which to test the actual digit
frequencies against the expected digit frequencies. Excesses of any specific digit, digit combination, or
specific number, might point to a fraud (where the scheme causes the same numbers to be used over and
over again), or a bias in the numbers (where employees duplicate transactions just below internal control
limits). Another possibility was that the abnormal duplications were something innocently inherent in the
way that the client did their business.
Elaine’s believed that a tool that could help detect fictitious numbers might assist in the audit of
management’s existence or occurrence assertion. Detection of processing inefficiencies or biases might
be offered to clients as a consulting service linked to the audit. She considered Benford's Law to be a new
analytical procedure. The auditing standards require auditors to use analytical procedures in planning the
nature, timing, and extent of other auditing procedures. Forensic analytics is a series of high-level data
overview tests together with tests that drill down to look for small sets of data anomalies.
Elaine also knew that auditors were required to specifically assess the risk of material
misstatement due to fraud. Benford's Law, because of its detective abilities, is one useful tool for
5
assessing fraud risk. By identifying data that does not conform to the expected digit frequencies, the
auditor could direct additional audit effort to these high-risk areas. For example, if an accounts receivable
list showed significant deviations from Benford’s Law, the auditor could increase the level of
confirmations, do additional scanning of transactions, and perform a more thorough examination of
supporting documents.
Elaine decided that her newest client, Page Software, would be a good candidate for some
Benford's Law and forensic analytics tests. Page Software was a NASDAQ listed company with their
head office in Cincinnati, Ohio. In her discussions with CFO Roland Highman he noted a concern about
the efficiency of the accounts payable system. With thousands of invoices totaling around $100 million,
Roland did not have the resources to investigate the issue. Elaine wanted to make a good impression with
the firm’s management. She believed that forensic analytics would be a good starting point and would
also help with writing the formal audit program. Roland provided Elaine with an Excel file with last
year’s accounts payable invoice data.
Required:
a. Create an Access database with a file name PageSoftware.accdb.
b. Import the PageSoftware_Invoices.xlsx file into your Access database. Name the table Invoices.
Format the Amount field as Currency. Show a screenshot of your Access database with the
Invoices table opened.
c. Give the number of records do you have in your Access Invoices table?
17.
Refer to your Access database PageSoftware.accdb.
Required:
a. Use the Table Properties dialog box and enter a description for your Invoices table as is done in
Figure 1.24. Show a screenshot similar to Figure 1.24 in your answer.
b. Use the Access Documenter feature to document your database. Select only the Invoices table to
be documented (you don't really have anything else at this stage). Show a screenshot of the first
page of the documentation as your answer. Using a right click will magnify the page so that the
top half of the first page is readable in a screenshot.
6
CHAPTER 2
USING EXCEL IN FORENSIC INVESTIGATIONS
Discussion Questions
1. Why is it important to do data cleansing before the data is analyzed?
2. What sorts of things can one put into a cell in an Excel worksheet?
3. What is the difference between using the Copy and Paste sequence in Excel, or using the
Data→Get External Data commands?
4. How can we use Excel's conditional formatting options in forensic analytics?
5. Would a forensic report include a recommendations section?
Short Answer Questions
6. Data cleansing involves the detection and correction (or removal) of corrupt or inaccurate records
from data tables (true/false).
7. The column references in Excel start with Roman i, and increase by 1 as we move to the right (that
is, ii, iii, iv, v, and so on) (true/false).
8. An Excel file can be password protected (true/false).
9. Excel results can be sent to Word documents reasonably easily (true/false).
10. Excel's error indicator is a little red triangle in the bottom right corner of a cell (true/false).
Multiple Choice Questions
11.
Excel's row limit is,
a. 16,384 rows
b. 2 GB
c. 1,048,576 rows
d. There is no limit
12.
a.
b.
c.
d.
The procedure to convert an Excel table to a normal range consists of a right click in the table
followed by,
Clear Contents
Sort→Custom Sort
Insert Comment
Table→Convert to Range
7
13.
a.
b.
c.
d.
Which phase in a forensic investigation is likely to be most relevant to Excel?
Data collection
Data preparation
Data analysis
Data entry
a.
b.
c.
d.
The risk of faulty decisions being made on the basis of errors that have crept into spreadsheets is
known as,
Risk management
Market risk
Systematic risk
Spreadsheet risk
a.
b.
c.
d.
To make it so that some rows or columns are not viewable we use the ______ command.
Paste Special
Hide
Format Cells
Hyperlink
14.
15.
Cases
16.
Open Excel 2007. For this case we will import the data from our PageSoftware.accdb Access
database.
Required:
a. Import the data in the Invoices table of PageSoftware.accdb. into Excel using the Data→Get
External Data series of steps. Show a screenshot of the first 10 records of your Excel worksheet.
b. Remove the connection to the Access database and convert the data to a normal range. Format the
Amount field as currency with two decimal places. Show a screenshot of the first 10 records of
your Excel worksheet.
c. Add some conditional formatting to the Amount field using purple data bars. Follow the method
used for Figure 2.7. Show a screenshot of the first 10 records of your Excel worksheet.
d. Remove the formatting in (c) above. Save the Excel file as PageSoftware.xlsx when you are done.
17.
Open Excel 2007. For this case we will use the PageSoftware.xlsx Excel file created in Case 2-16
above.
Required:
a. Password protect the file using the password Forensic to both open and to modify the file. Close
the file. Open the file and show the opening dialog box for your password protected file. See
Figure 2.10.
8
b. Open Word 2007. Copy and paste the first ten rows of the Excel worksheet into your Word
document. Use the method of pasting that does not keep the updating link with the Excel file.
Show a screenshot of the Word page.
c. Put your cursor in cell H2. Calculate the sum of the amounts in column E. Your answer should be
$93,136,553.14. Now put your cursor in cell H4. Calculate the average invoice amount using the
formula =H2/Count(E:E). Format cell H4 as currency with two decimals. Keep your cursor in cell
H4. Click Formulas→Formula Auditing→Trace Precedents. Show a screenshot of the first 10
records of your Excel worksheet which should include column H. Clear the formula auditing
arrows using Remove Arrows. Do not save the file after parts (b) or (c).
9
CHAPTER 3
USING POWERPOINT IN FORENSIC PRESENTATIONS
Discussion Questions
1. In what forms are the PowerPoint support available on the Microsoft website?
2. Give the five main sections of a PowerPoint presentation dealing with a forensic-related matter.
3. A PowerPoint presentation on a forensic matter should only be made at the end of the investigation.
There should be no interim report. Discuss.
4. Who would be the audience for a presentation concerning a fraud investigation that dealt with
members of senior management?
5. Would it be a good idea to password protect a sensitive forensic-related PowerPoint presentation?
Short Answer Questions
6. The "divided attention" issue is made more acute the ______ (greater/closer) the distance between
the presenter and the screen.
7. Avoid using white as a background color in forensic presentations (true/false).
8. A forensic report should be _____ (biased/unbiased).
9. In addition to _____ (actual fallacy/factual accuracy) a good report should be well-written with no
grammatical, typing, or spelling errors.
10. It is best to read from PowerPoint slides so as not to make any mistakes (true/false).
Multiple Choice Questions
11. PowerPoint slides can include,
a. Text
b. Diagrams
c. Images
d. All of the above
12. The largest section of the PowerPoint window is the,
a. Slides tab
b. Outline tab
c. Slide pane
d. Notes pane
13. When planning the length of a presentation,
a. Don't leave any time for audience questions
10
b. Take into account audience questions
c. It's better to have too much to say that to have open time at the end
d. Include plenty of jokes, especially ones that poke fun at political views and moral beliefs.
14. To copy a table from Word to PowerPoint,
a. The user needs to retype the table from scratch in PowerPoint
b. The table can be selected in Word followed by Copy and Paste
c. The table needs to be copied to Excel and then from Excel to Word
d. Is only possible for tables with eight or fewer rows
15. To copy a screenshot from your computer screen to PowerPoint one can use,
a. Alt+F4
b. Alt+Enter
c. Alt+PrintScreen
d. Alt+Shift
Cases
16.
Review the Fraud Vulnerability Assessment prepared by Summerford Accountancy, PC for the
Wake County Board of Education in Raleigh, NC. The link can be found at,
http://www.wcpss.net/audit/strengths.html Click on (The full audit) to open the pdf file.
Required:
a. Prepare a PowerPoint presentation on the background, engagement team, the approach and the
general findings in the report. These sections refer to pages 4 to 16 in the report.
b. Prepare a PowerPoint presentation on the areas of noted weakness in the report. This section is in
pages 16 to 26 in the report.
c. Prepare a PowerPoint presentation on the fraud prevention and detection section in the report. This
section is in pages 27 to 34 in the report.
2.
Review the forensic accounting report for the SEC vs. C. Wesley Rhodes, Jr. et. al. case. The
report is posted on the supplementary website for this book. The report was prepared by Gregory A.
Gadawski and Darrell D. Dorrell of Financial Forensics. Their website is http://financialforensics.com
and more information can be found at http://www.financialforensicsacademy.com/.
Required:
a. Prepare a PowerPoint presentation on the facts and circumstances, investor funds, and the
consolidated financial statements in the report. These sections refer to pages 7 to 35 in the report.
b. Prepare a PowerPoint presentation on the forensic accounting analysis, and the findings and
conclusions in the report. These sections are in pages 36 to 54 in the report.
11
CHAPTER 4
HIGH-LEVEL DATA OVERVIEW TESTS
Discussion Questions
1. Can you change the strata boundaries in the data profile, or do you have to use the strata shown in
Figure 4.1 in every data analysis project?
2. Why is it inefficient to have a high proportion of low-value invoices?
3. Can Excel 2007 be used to calculate the inputs for a histogram?
4. Should the periodic graph always have monthly totals and also always have just 12 monthly totals?
5. What is an Access union query?
Short Answer Questions
6. Descriptive _____ are graphical and numerical measures that are used to summarize and interpret
some of the properties of a data table.
7. The periodic graph becomes more useful after a three or four year history has been built up with
the data (true/false).
8. In Access all formatting of the output must be done in design view before the query is run
(true/false).
9. A union query is prepared in Access in QSL view (true/false).
10. The two main Excel functions that are used for the data profile are ____ and _____ .
Multiple Choice Questions
11. For each stratum the data profile shows the _____________.
a. Count and the average and the percentage of the maximum
b. Count and the sum and the percentage of the totals
c. Count and the percentage of the total
d. Sum and the percentage of the total
12. The data profile helps the investigator or auditor assess whether the file is ______ .
a. Complex
b. Open
c. Obsolete
d. Complete
12
13. The data profile is also useful for finding _____ amounts in data sets that should not have _____
numbers.
a. Negative
b. Rational
c. Natural
d. Positive
14. On the periodic graph the _____ is/are on the _____ .
a. Histogram, first page
b. Access query, data profile
c. Time period, x-axis
d. Dollars, x-axis
15. The data profile calculations can be done more efficiently in Access using a _____ query.
a. Abbreviation
b. Communion
c. Reunion
d. Union
Cases
16.
Open Excel 2007. For this case we will use the PageSoftware.xlsx Excel file created in Case 216.
Required:
a. Open the PageSoftware.xlsx file using the password Forensic. Remove the password protection.
Save the file as PageSoftware.xlsx (no name change).
b. Create a periodic graph of the monthly totals for the invoices. Use the PeriodicGraph.xlsx
template.
c. Save the PeriodicGraph.xlsx template as Case_4_16.xlsx. Delete the extra tab created for the
periodic graph totals and the extra field (Month) created in the PageSoftware.xlsx file. Save the
file which will now appear unchanged.
17.
Open Excel 2007. For this case we will use the PageSoftware.xlsx Excel file created in Case 2-16
with the password removed as required above.
Required:
a. Create the data profile for the data using the NigriniCycle.xlsx template. Use the default strata
boundaries.
b. What insights do you get from the data profile in (a) above?
c. Delete all the tabs in the Excel file related to the digit graphs and save the file as Case_4_17.xlsx.
13
CHAPTER 5
BENFORD'S LAW: THE BASICS
Discussion Questions
1. What are the three guidelines for determining whether a data set should conform to Benford's Law?
2. How large should a data set be before we would consider running Benford's Law tests?
3. Why do we analyze positive and negative numbers separately?
4. Why is the first-two digit test preferred to the first digit test?
5. What are the main steps in running the first-two digits test in Access?
Short Answer Questions
6. Frank Benford was a _____ (physicist/numismatist) who published the seminal paper on the topic
of digit frequencies.
7. The expected proportion for the first digit 9 is less than the expected proportion for the second digit
9 (true/false).
8. Benford's Law is scale invariant under multiplication. This means that if all the numbers in a
Benford Set are multiplied by a nonzero constant then the new data set will also be a Benford Set
(true/false).
9. Evidence supporting rounding-up behavior by management in financial statement numbers is an
excess of second digit 0s and a shortage of second digit 9s (true/false).
10. An overall consideration for conformity to Benford's Law is that the data has more large numbers
than small numbers (true/false)
11. There are problems with graphing a large data set in Excel (true/false).
Multiple Choice Questions
12.
Benford begins his paper by noting that the first few pages of a book of ____ ____ show more
wear than the last few pages,
a. Auto parts
b. Differential calculus
c. Telephone numbers
d. Common logarithms
13.
There are ____ possible first digits.
a. Nine
b. Ten
14
c. Ninety
d. One hundred
14.
a.
b.
c.
d.
Benford's paper was published in ____ .
1638
1738
1838
1938
a.
b.
c.
d.
The early 1970s started a stream of articles that showed that the familiar ______ sequence (1, 1,
2, 3, 5, 8,…) follows Benford's Law.
Versace
Fibonacci
Hitachi
Prime number
15.
16.
The formulas for the expected Benford's Law proportions use which mathematical function?
a.
b.
c.
d.
17.
Square roots
Absolute values
Quadratics
Logarithms
Benford's Law gives the _____ frequencies of the digits in tabulated data.
a.
b.
c.
d.
18.
Abnormal
Expected
Excessive
Atypical
___, ___, and _____ show(s) that there are practical uses of Benford's Law.
a.
b.
c.
d.
Auditing, forensic analytics research, legal requirements
Forensic analytics research, legal requirements, corporate governance
Tax evasion, auditing, forensic analytics research
Statistics, mathematics, econometrics
Cases
19.
Open the PageSoftware.accdb Access database.
Required:
a. Run the first-two digits test in Access.
b. Graph the results in Excel 2007 using the NigriniCycle.xlsx template.
c. Identify the three largest spikes on the graph.
15
d. Delete columns P to AJ in the Tables tab and all the tabs except for the Tables and First-Two
tabs. Your spreadsheet will therefore only have two worksheets.
e. Save your Excel file as Case_5_19.xlsx.
20.
Go to the Website http://www.kaggle.com. Click Competitions. Scroll down to the dunnhumby's
Shopper Challenge.
Click on the name to open the page.
Click the data tab.
Download the training data as shown below.
Required:
a. Import the data into Access. Excel cannot be used because the .csv file has 12,146,637 rows.
b. Run the first-two digits test on all the positive values (i.e., >0).
c. Graph the results in Excel 2007 using the NigriniCycle.xlsx template.
d. Identify the three largest spikes on the graph.
e. Did you expect shopping data to conform to Benford's Law?
f. Save your Excel file as Case_5_20.xlsx. Save your Access file as ShopperData.accdb.
16
CHAPTER 6
BENFORD'S LAW: ASSESSING CONFORMITY
Discussion Questions
1. Explain how changes in the number of records, N, affects the calculated Z-score?
2. Does Excel have a function that performs the chi-square test? If so, what is the function and what
is the critical value that we'd be looking for in a conformity test?
3. Why does the cumulative density function in Figure 6.1 have the steepest slope for the lower digits
(10-19) and the smallest slope for the higher digits (90-99)?
4. Will a graph of the ordered (sorted) logs have a positive slope on every segment of the line as
shown in Figure 6.5?
5. Why does the difference between the logs in equation 6.12 need to be an integer value?
Short Answer Questions
6. The result of the Z-statistic test for the first-two digits would be 90 calculated Z-statistics, one for
each digit combination (10, 11, …,90) (true/false).
7. The critical value for the Kolmogorov-Smirnoff test does not include N, the number of records
(true/false).
8. All things being equal, a low Mean Absolute Deviation indicates a closer fit to Benford's Law
(true/false).
9. The log of a negative number is ____ (zero/undefined/negative/rare).
10. The mantissa arc test is based on plotting the mantissas on the unit _____ (radius/number
line/circle).
Multiple Choice Questions
11.
The fractional part of the log of a number is called the _____ .
a. Characteristic
b. Suffix
c. Mantissa
d. Z-statistic
12.
The Z-statistic is used to test whether the actual proportion for a specific first-two digit
combination differs ______ from the expectation of Benford's Law.
a. Materially
17
b. Convincingly
c. Noticeably
d. Significantly
13.
a.
b.
c.
d.
The chi-square test ________ .
Has to date only been used in medical research
Is a well-known statistical test
Requires specialized statistical software
Was invented by Hill in 1995
a.
b.
c.
d.
The Kolmogorov-Smirnoff test is based on the ________ .
Cumulative intensity junction
Cumulative propensity function
Cumulative intensity function
Cumulative density function
14.
15.
The formula for the Mean Absolute Deviation (MAD) _____ .
a.
b.
c.
d.
Uses, N, the number of records.
Has a square root sign in the denominator
Uses the absolute values of the differences between the actual and expected proportions
Plots the mantissas on the unit circle
Cases
16.
Open the Case_5_19.xlsx file that contains your Page Software results. Also open your
PageSoftware.accdb Access database.
Required:
a. Run the first digits test in Access.
b. Copy the actual counts from Access to cells B3:B11. Create a first digit graph that has the same
format as the first-two digits graph.
c. What is the MAD for the first digits? What is the MAD for the first-two digits? What is your
conformity conclusion using the first-two digits MAD and Table 6.1?
d. Does the data conform to Benford's Law using the chi-square test for the first digits, and a 0.05
significance level?
e. Does the data conform to Benford's Law using the chi-square test for the first-two digits, and a
0.05 significance level?
f. Does the data conform to Benford's Law using the Kolmogorov-Smirnoff test for the first-two
digits, and a 0.05 significance level?
g. Save the file as Case_6_16.xlsx.
18
17.
Open your dunnhumby's Shopper Challenge Excel file Case_5_20.xlsx.
Required:
a. What is the MAD for the first-two digits? What is your conformity conclusion using the first-two
digits MAD and Table 6.1?
b. Does the data conform to Benford's Law using the chi-square test for the first-two digits, and a
0.05 significance level?
c. Does the data conform to Benford's Law using the Kolmogorov-Smirnoff test for the first-two
digits, and a 0.05 significance level?
d. Save the file as Case_6_17.xlsx.
19
CHAPTER 7
BENFORD'S LAW: SECOND-ORDER & SUMMATION TESTS
Discussion Questions
1. What is a continuous distribution?
2. Why would the mean of a uniform distribution have no effect on the differences between the
ordered records?
3. Assume that in the Page Software data set all 79 correct amounts of $50 were changed to 79
amounts of $50 million. Would the first-two digits graph be unaffected? Explain. Would the
periodic graph be affected? Explain.
4. Explain the ʃ, ||, and ln symbols in equation 7.3
5. What is the difference between fraud prevention and fraud detection? Are the tests in this chapter
more closely related to prevention or detection?
Short Answer Questions
6. When the values of a data set are placed in ascending order the result is called the ____
(align/order/position) statistics of the data.
7. It would be difficult to run the second-order test in Access (true/false).
8. In a data set of journal entries where the debits are shown as positive values and the credits are
shown as negative values, the expected sum is ______ ($zero, equal to the number of records,
equal to the range of the data).
9. The first-two digits are grouped into the ____ (Major and minor, Prime and minor, upper and lower
bounds) first-two digits.
10. All negative numbers (including $zero) should be deleted from the data set before the second-order
test is run (true/false).
Multiple Choice Questions
11.
The second-order test is based on the ______ the elements (amounts or values) of ordered data.
a. Sums of
b. Absolute values of
c. Logarithms of
d. Differences between
12.
The expected result of the second-order test is a data set that is ______ .
20
a.
b.
c.
d.
13.
Continuous
Normally distributed
Almost Benford
Significantly Benford
a.
b.
c.
d.
A data set with 1,000 records will have ____ differences between the ordered records.
Zero
999
1,000
1,001
a.
b.
c.
d.
In contrast to the first-order test, the summation test is based on ____ rather than ______ .
Sums, counts
Counts, sums
Sums, mean absolute deviations
Mean absolute deviations, sums
14.
15.
The summation test looks for excessively ________ in the data.
a.
b.
c.
d.
Large gaps
Large numbers
Small mean absolute deviations
Small round numbers
Cases
16. Open the NigriniCycle.xlsx file that is the main Excel template. Open your
PageSoftware_Invoices.xlsx Excel file that contains your data.
Required:
a. Copy the numeric dollar amounts from D1:D38177 in PageSoftware_Invoices.xlsx to D1:D38177
in the Data tab in the NigriniCycle.xlsx template. Close the PageSoftware_Invoices.xlsx file.
Save the NigriniCycle.xlsx file as Case_7_16.xlsx. Use the Case_7_16.xlsx file for all the case
requirements that follow (including Case 7-17).
b. Delete the following tabs: DataProfile, First Digits, Second Digits, First-Two, and Last-Two. In
the Data tab clear the contents of the range A2:C26. Copy the formula in E26 to the range
E26:E38177. Copy the formula in F26 to the range F26:F38177. Copy the formula in G26 to the
range G26:G38177. The formulas in columns E, F, and G will not actually be used for this case.
Do not make any changes to columns I, J, K, or L for now.
c. Run the second-order test on the PageSoftware data using the template. Show your completed
graph and the first ten lines of the supporting table (Q1 to V12 in the Tables tab).
d. Does the second-order test show any data anomalies? Explain. Save your file.
21
17. Use the invoices data in Case_7_16.xlsx.
Required:
a. Run the summation test on the Page Software data using the template. Show your completed
graph and the first ten lines of the supporting table (X1 to AC12 in the Tables tab).
b. Does the summation test show any data anomalies? Explain. Save your file as Case_7_17.xlsx.
22
CHAPTER 8
BENFORD: NUMBER DUPLICATION & LAST-TWO DIGITS
Discussion Questions
1. The result of the number duplication test is usually a report sorted by Count descending such as is
shown in Figure 8.2. How else might the table be sorted and what would the goal be of a different
sort?
2. What do we mean by a psychological threshold?
3. Do we always run the number duplication test on dollar (or currency) amounts?
4. Why is the expected proportion for each possible last-two digit combination equal, when the firsttwo digits are heavily skewed towards the low digits?
5. Do we always run the last-two digit test on dollar (or currency) amounts?
Short Answer Questions
6. A separate number duplication test is run on each of the five main strata in the data profile
(true/false).
7. For accounts payable data the number duplication test should include a comparison of the large
positive numbers with the large negative numbers (true/false).
8. The last-two digit test is not all that useful for accounts payable data (true/false).
9. The last-two digits test is a powerful test for _______ (presented/indented/invented) numbers.
10. There are ____ (9, 10, 90, 99, 100, 101) possible last-two digit combinations.
Multiple Choice Questions
11.
A candidate for review on the number duplication report would include numbers linked to,
a. Small positive spikes on the first-order graph
b. Large negative spikes on the first-order graph
c. Large positive spikes on the first-order graph
d. Large positive spikes on the periodic graph
12.
a.
b.
c.
d.
13.
The main commands in the query to run the number duplication test in Access are,
Group By, and Count
Group By, and Sum
Group By, and Duplicates
Pivot Table, and Amount
The details in the number duplication report usually include,
23
a.
b.
c.
d.
14.
a.
b.
c.
d.
15.
Blank, Amount, First-two
Rank, Count, First-Two
Date, Count, Amount, First-two
Rank, Count, Amount, First-Two
_____ numbers do not have a set of last-two digits.
Negative
Even
Whole
Irrational
The expected last-two digit proportion is ________ for each last-two digit combination.
a.
b.
c.
d.
0.01
0.10
1.00
It differs depending on whether the digits are low or high digits
Cases
16. Open your PageSoftware_Invoices.xlsx Excel file that contains your data.
Required:
a. Run the number duplication test in Excel using Excel's pivot table capabilities.
b. Prepare a report with headings and data that follow the format in Figure 8.5.
c. Use Excel's filtering capability to limit your results to amounts greater than or equal to $10.00.
d. Delete all the unneeded worksheets and data from your file.
e. Save the result as Case_8_16.xlsx.
17. Open your NigriniCycle.xlsx Excel template. Open your ShopperData.accdb Access file.
Required:
a. Run the last-two digits test on the shopper data on the Amount field in the Training table using the
cents (the two digits to the right of the decimal point) as the last-two digits. Use two queries as is
set out in figures 8.19 and 8.20. Calculate the last-two digits for all the positive numbers (i.e.,
greater than zero).
b. Open the Nigrinicycle.xlsx template and delete all the tabs except for Tables and Last-Two. In the
Tables tab delete columns A to AC. Save the file as Case_8_17.xlsx.
c. Paste your Access results into Column C in the Excel file. Amend the formula for the actual
proportions (Column D). Click on Last-Two to see your graph. Save the file again.
d. What anomalies do you see on the last-two digits graph?
24
CHAPTER 9
INTERNAL DIAGNOSTICS OF CURRENT AND PRIOR DATA
Discussion Questions
1. What are descriptive statistics?
2. What is the objective of using descriptive statistics in a forensic environment?
3. With respect to external audits, do the auditors of public companies have to follow the fraud
statement SAS No. 99 issued by the AICPA?
4. Why might external auditors be reluctant to use and deploy computer assisted audit techniques
(CAATS) in their audits?
5. Is it absolutely essential that all of the tests listed in Table 9.1 be run on each and every data set for
which there is data for multiple time periods?
Short Answer Questions
6. Bolton and Hand state that we can seldom be certain by statistical analysis alone that a fraud has
been perpetrated (true/false).
7. Missing records might indicate fraud, or processing or internal control issues (true/false).
8. The set of descriptive statistics that measures the variability or the spread of the numbers includes
the mean and the median (true/false).
9. Data that is _____ (positively/negatively) skewed consists of many small amounts and fewer large
amounts.
10. When using the My Law concept we still use the Mean Absolute Deviation (MAD) to measure
conformity (true/false).
Multiple Choice Questions
11.
Bolton and Hand suggest the concept of _______ scores where higher scores are associated with
records that are unusual or more like previous fraudulent values.
a. Benford
b. Diagnostic
c. Statistical
d. Suspicion
12.
a.
b.
c.
d.
________ are numerical measures that describe a specific characteristic of a population.
Diameters
Parameters
Mantissas
Significance levels
25
13.
a.
b.
c.
d.
The test used to test for a significant difference between the means is the ______ .
Z-statistic
Mean Absolute Deviation
Two-sample t-test
Two-sample d-test
a.
b.
c.
d.
The _____ measure tells us whether the numbers are evenly distributed around the mean.
Skewness
Interquartile range
Standard deviation
Median
14.
15.
A ______ is a graph consisting of vertical bars constructed on a horizontal line that is marked off
a.
b.
c.
d.
with intervals.
Upper bound
Pie chart
Final exam
Histogram
Cases
16. Open the Excel file Census_2000_2010.xlsx which contains the county population numbers from the
2000 census and the 2010 census.
Required:
a. Run the Nigrini parallel scan on the 2000 and 2010 population numbers using Table 9.1 as your
guide. Start with the sum and include all the statistics in the list down to the standard deviation.
All these calculations can be done using Excel's functions and the Data→Analysis→Data Analysis
tools. For the purposes of the analysis change all the blank cells in column D to zeros (0). Prepare
the table in Excel. Save your file as Case_9_16.xlsx.
b. Based on the results does it appear that there are errors of fraud?
17. Open the Excel file Census_2000_2010.xlsx with the 2010 and 2011 county population numbers.
Required:
a. Prepare a histogram of the 2010 population numbers using a histogram with 10 intervals. Save the
file as Case_9_17a.xlsx.
b. Run the My Law test by comparing the 2010 first-two digits graph to the 2000 first-two digits
graph. Use the Nigrini Cycle template and change the second-order graph to be another first-two
digits graph. Delete all unneeded tabs and tables. Is there a significant difference between the two
periods? Use the MAD criterion and Table 9.2. Save the file as Case_9_17b.xlsx.
26
CHAPTER 10
THE LARGEST SUBSETS AND LARGEST GROWTH TESTS
Discussion Questions
1. With respect to Case 9-17 data (county populations), what subset variable could be used to run the
largest subsets test? What would the results be telling us?
2. Why is it inefficient for an airline company headquartered in Chicago to receive 12,000 invoices
from the printer down the road for business cards?
3. How could a credit card refund issued by a company be fraudulent?
4. Are we always only interested in the largest subsets? Are there cases when we might be interested
in the smallest subsets?
5. When looking at subset growth, is the dollar amount or the dollar percentage amount the only way
that we can measure an increase? How else can we measure an increase from period to period?
Short Answer Questions
6. The goal of the largest subsets test is to find subsets that are highly _____
(deflated/inflated/upflated) due to error or fraud.
7. The largest subset test sometimes also requires a review of the medium-sized totals when looking
for suspicious items (true/false).
8. The audit recommendation in the case of the erroneous $620,000 employee reimbursement was
that the system flag potential high dollar errors ______ (before/immediately after/at the same time
as) the employee reimbursement checks are printed.
9. Running the largest subsets test in Access uses the ____ (IIF/Sort/Group By), Count, and Sum
functions to identify the largest subsets.
10. We have a problem in calculating a percentage change when the _____ (prior period/current
period) has a sum of zero dollars.
Multiple Choice Questions
11.
The largest subsets test is useful because experience has shown that fraudsters (at least the ones
that were caught) generally ________ .
a. Do not know how to use Excel
b. Do not know how to print an authentic looking invoice
c. Do not know when to stop
d. Prefer to commit a fraud on a Friday
12.
Running the largest subsets test is quite straightforward using Excel's ________ capabilities.
a. Pivot table
27
b. Line chart
c. Formula function
d. Pivot label
13.
a.
b.
c.
d.
To change a null (blank or missing) value for either period 1 or period 2 in Access we would use
the following two Access functions,
If, Is Null
IIf, Is Null
If, Is Blank
IIf, Is Blank
a.
b.
c.
d.
When running the largest subsets test in Access, the usual last step is to,
Graph the results in Excel
Use the Top Values property to display only the top values
Choose your subset field
Select the table that contains the transaction data
14.
15.
To run the largest subsets test we need a data set with at least ______ field(s).
a.
b.
c.
d.
One
Two
Three
N/A, we need at least two rows of data.
Cases
16. Open your PageSoftware_Invoices.xlsx Excel file. Open your Access database PageSoftware.accdb.
Required:
a. Run the largest subsets test in Excel using vendors as the subset variable and Excel's pivot table
capabilities. Your result should look like Figure 10.13. The results should be formatted as a table
using table style medium 2. Save your result as Case_10_16.xlsx.
b. Run the largest subsets test in Access and calculate the total sums and counts for 2010. Sort by the
sum descending. Use the Top Values property to limit the results to the top 100 vendors measured
by total dollars. Your result should look like Figure 10.4. Save your query as qryLargestVendors.
17. Open the Excel file Census_2000_2010.xlsx with the 2010 and 2011 county population numbers.
Required:
a. Run the largest growth test in Excel by calculating the percentage change for each state from 2000
to 2010. Your final result should look like Figure 10.17. Save the Excel file as Case_10_17.xlsx.
b. Do the results for any of the states seem anomalous?
28
CHAPTER 11
THE RELATIVE SIZE FACTOR TEST
Discussion Questions
1. What types of anomalies does the RSF test aim to identify?
2. Does the RSF formula always have to use the second largest record in the denominator? If not,
what other options are there?
3. What is the decimal point error?
4. Why do we delete negative numbers before calculating the RSF?
5. Is it always more work to run the RSF test in Access, as opposed to Excel?
Short Answer Questions
6. The RSF test was developed as a result of a company wiring $600,000 in _____
(earnest/terror/error) to the bank account of a charity.
7. Large RSFs are more indicative of error when the subset has _____ (few/zero/many) records.
8. The second largest record for a subset is identified in Access by using the 2NDLARGEST function
(true/false).
9. In both Access and Excel the RSF is calculated to ____ (zero, one, two, four) decimal places.
10. The two largest invoices listed for a vendor could actually be the same invoice (true/false).
Multiple Choice Questions
11.
The numerator of the RSF formula is ________ .
a. The number of records in the subset
b. The smallest record in the subset
c. The second largest record in the subset
d. The largest record in the subset
12.
a.
b.
c.
d.
When running the RSF test, subsets with only ______ are deleted.
Small records
Large records
One record
Two records
a.
b.
c.
d.
When the largest and second largest items are equal, the RSF is equal to _____ .
Zero
-1.00
1.00
Infinity
13.
29
14.
a.
b.
c.
d.
15.
The second largest amount in the subset acts as a(n) ______ or norm.
Benchmark
Equation
Subset
Join property
The query to select the transactions for a specified vendor is called a _____ query. This query prompts the
user for the vendor number.
a.
b.
c.
d.
Join
Make Table
Union
Parameter.
Cases
16. Open your Access database PageSoftware.accdb.
Required:
a. Run the RSF test in Access. Sort by the RSF descending. Your results should match those of
qryRSF11 in the book (however, only the results of qryRSF10 are shown in the book).
b. Show the transactions for vendor 3653.
17. Open the Excel file Census_2000_2010.xlsx with the 2010 and 2011 county population numbers.
Required:
a. Run the RSF test in Excel using the states as the subset variable and the 2010 population numbers
as the numeric amounts. Use the usual RSF formula as shown in equation 11.1. Do not delete any
records since the minimum population number for any county is 82 people. Your final result
should look like Figure 11.27. Save the Excel file as Case_11_17.xlsx.
b. Do the results for any of the states seem anomalous?
c. Is it possible to get a RSF result that is less than 1.00?
30
CHAPTER 12
ABNORMAL DUPLICATIONS WITHIN SUBSETS
Discussion Questions
1. Companies usually have checks built in to their systems to prevent duplicate payments. Is it not
then a waste of the auditor's time to test for duplicate payments when the system has a check built
in to prevent duplicate payments?
2. How does a company end up paying the same amount, on the same date, against the same invoice
number, to different vendors?
3. Does the same-same-different test work best with data for a short period of time, or with data from
a long period of time?
4. Is a regular payment to a vendor (say $6,000 per month) always an indicator of fraud or error?
5. Can the subset number duplication test be run on the 2010 census data?
Short Answer Questions
6. Excel's pivot table capabilities are well-suited to running the SSS test (true/false).
7. The "D" in the SSD test stands for _____ (divergent/distant/different).
8. The number duplication factor is calculated using a _______ (graph/formula/trend).
9. If an investigation shows many duplicate payments, the forensic report should suggest system
improvements to _____ (increase/reduce) the chances of this happening again.
10. Running the SSD test in Access uses a series of five ____ (tables, reports, forms, queries).
Multiple Choice Questions
11.
The SSS, SSD, and NFF tests are all aimed at finding ______ .
a. Duplications
b. Outliers
c. Correlations
d. Trends
12.
a.
b.
c.
d.
13.
If all the numeric amounts in a subset were equal, the calculated NFF would be ______ .
0
1.00
100
Infinity
The SSD test is well-suited to identifying cases where the wrong vendor is paid ______ and the
correct vendor is paid _______ .
31
a.
b.
c.
d.
14.
a.
b.
c.
d.
15.
In cash, by check
By check, in cash
First, second
Second, first
Access has ______ that can perform an adequate, but not perfect, job for the SSS and SSD tests.
Experts
Modules
Gurus
Wizards
To keep the SSS and SSD results to a manageable size we could _________ .
a.
b.
c.
d.
Delete all subsets with just one or two records
Delete all records below a dollar threshold
Run the tests twice, once on the first six months and once on the last six months
Combine the SSS and SSD results into one table
Cases
16. Open your Access database PageSoftware.accdb.
Required:
a. Run the SSS test in Access to identify cases of the same vendor, the same date, and the same
amount. Limit your results to amounts that are greater than or equal to $50. Sort the results by
Count descending and then by Amount descending.
b. Does any particular vendor seem to warrant a closer look?
c. Run the SSD test in Access to identify cases of the same date, the same amount, and different
vendors. Limit your results to amounts that are greater than or equal to $50. Sort the results by
Count descending and then by Amount descending.
d. Do any transactions warrant a closer look?
e. Run the subset number duplication test. Limit your results to amounts that are greater than or equal
to $50. Sort the results by NFF descending and then by Sum descending.
f. Does any particular vendor seem to warrant a closer look?
17. Open the Excel file Census_2000_2010.xlsx with the 2010 and 2011 county population numbers.
Required:
a. Run the appropriate test in Excel to identify cases where a state has two or more counties with the
same 2010 populations. For example, Texas might have ABC county and DEF county that each
have 1,146 people. Save the Excel file as Case_12_17.xlsx.
b. Do the results for any of the states seem anomalous?
32
CHAPTER 13
IDENTIFYING FRAUD USING CORRELATION
Discussion Questions
1. Describe what is meant by preventive controls, detective controls, and corrective controls?
2. Describe the concept of correlation.
3. Explain what is meant by the statement that correlation does not imply causation.
4. Do we encounter more positive correlations or negative correlations in real world data? That is,
which of the two occurs most often in the real world?
5. Is it ever useful to calculate the correlation between one variable and another variable where the
first variable is subject to measurement error?
Short Answer Questions
6. Correlation measures how well two sets of data are _____ (geometrically/linearly/proportionally)
related.
7. A calculated correlation of zero is ____ (possible/impossible/the norm).
8. It is reasonably easy to estimate the calculated correlation by looking at the data on a graph
(true/false).
9. A correlation of 0.80 says that the association is ____ (weak/negative/strong).
10. If the world total for carbon dioxide emissions shows a strong increase from 1989 to 2008, then a
country with a correlation of 0.98 _____ (also showed a strong increase/showed no change/showed
a decrease) in its emissions for the period.
Multiple Choice Questions
11.
Correlation is used on a proactive basis as a(n) ________ .
a. Preventive control
b. Detective control
c. Internal control
d. Corrective control
12.
a.
b.
c.
d.
The most efficient route is to design systems so as to _____ errors or fraud from occurring
through tight preventive controls.
Augment
Invent
Repent
Prevent
33
13.
a.
b.
c.
d.
The lowest possible value for a calculated correlation is,
-100.00
-1.00
0
Minus infinity
a.
b.
c.
d.
The use of correlation is well suited to situations where there are a large number of _______
units.
Measurement
Forensic
Inventory
Cohesive
14.
15.
Correlation can be calculated in Excel by using its _____ function.
a.
b.
c.
d.
FORENSIC
CALC
CORR
CORREL
Cases
16. Open your Access database PageSoftware.accdb.
Required:
a. Create a new table tblInvoicesPos (for invoices that are positive) that includes only positive
(greater than zero) amounts and only the transactions for those vendors that have more than one
positive invoice amount. This table only needs the Amount and the Vendor fields. Use a series of
queries that ends with a Make Table query to create your table with 35,855 records. Use this table
for the questions that follow.
b. Calculate the average invoice amount for each vendor. Round the result to the nearest cent. Your
query should include the vendor number, the average invoice amount for each vendor, and the
count of the invoices for each vendor. Your result should have 2,309 records.
c. Calculate the correlation between the count and the average amount. What does the result tell you?
17. Open the Excel file Census_2000_2010.xlsx with the 2010 and 2011 county population numbers.
Required:
a. Calculate the correlation between the 2000 and the 2010 population numbers for each state. For
the analysis change the blank (null) values in 2010 to zeroes. Use the correlation function in Excel.
Your final result should be a table of 51 correlations similar to Figure 13.18 except that the names
will be the names of states and not countries. Save the Excel file as Case_13_17.xlsx.
b. What conclusions do you draw from your results?
34
CHAPTER 14
IDENTIFYING FRAUD USING TIME-SERIES ANALYSIS
Discussion Questions
1. What are the two main goals of time-series analysis in a forensic context?
2. Can time-series analysis take into account a change in conditions in the current period?
3. What is the equivalent of the MAPE measure in linear regression?
4. Since linear regression is easily done in Excel, and since linear regression would also extrapolate
the past, why don't we just use linear regression for the revenue or expense forecasts?
5. If we were using forecasts for 2013 as a continuous monitoring technique, would we have to wait
until the end of 2013 before we could compare the actual numbers to the forecast numbers?
Short Answer Questions
6. A time-series is a sequence of the successive values of an expense or revenue stream in units or
dollars over unequally spaced time intervals (true/false).
7. On a time-series graph the dates or time units are plotted on the y-axis (the vertical axis)
(true/false).
8. When running time-series in Excel the seasonal factors need to be calculated before the forecasts
can be calculated (true/false).
9. A ____ (high/low) MAPE indicates a close fir between the actual past values and the fitted timeseries values.
10. The heating oil sales data shows that the demand is highly ________ (reasonable/seasonal/elastic)
with a low demand in the warm summer months and a high demand in the cold winter months.
Multiple Choice Questions
11.
The suggested metric for assessing the goodness-of-fit for time-series data is the _____.
a. MAD
b. R2
c. MAPE
d. Chi-square statistic
12.
a.
b.
c.
d.
The term used to describe the subunit used to perpetrate the fraud is the _______ unit.
Measurement
Inventory
Seasonal
Forensic
35
13.
a.
b.
c.
d.
Time-series analysis is used to _____ the revenues or expenses for future periods.
Audit
Predict
Plan
Control
a.
b.
c.
d.
A ______ pattern is one that cycles up and down over long unequal time periods.
Regression
Linear
Geometric
Cyclical
14.
15.
Time-series can be calculated in Excel by using its _____ function.
a.
b.
c.
d.
TIME
FORECAST
EXTRAPOLATE
There is no time-series function in Excel
Cases
16. Download the 2008 to 2011 heating oil data from the EIA (U.S. Energy Information Administration)
Website at http://www.eia.gov/. Use the following path,
Click Tools, click Data Tools & Models,
Click Time-Series Data:
36
Click Petroleum & Other Liquids
Click Consumption/Sales
37
Click Prime Supplier Sales Volumes
Click 1993-2011 in View History for No. 2 Fuel Oil:
This gives the data. Click Download Data (XLS File)
38
To give:
Eight of the numbers have been blurred to prevent students from simply copying the numbers as
displayed above. The numbers may be updated and corrected by the EIA. The latest available numbers
should always be used for the requirements below:
Required:
a. Create an Excel data file with the 2008 to 2011 heating oil data that follows the same format as the
table in Figure 1.20. The table should have three fields, namely Year (2008 to 2011), Month (1 to
12) and GallonsPD (with the numbers shown above). The table will have 48 rows. It will be easier
to use Excel to create the table. Save the Excel file as Case_14_16.xlsx.
b. Graph the data in Excel.
c. Import the data into Minitab. Run time series analysis on the data using Stat→Time
Series→Decomposition. The variable is GallonsPD and the seasonal length is 12. Choose the
generate forecasts option to generate 12 forecasts (i.e., for 2012). Show the forecasts in a graphical
form as produced by Minitab and also in an Excel worksheet.
39
17. Use the heating oil data set created in Case 14-16.
Required:
a. Calculate the seasonal factors for the data as is shown in Column K of the worksheet in Figure
14.18. Include the labels in Column L. Use columns B, C, and D for your data just as is done in
Figures 14.17 and 14.18. Your columns should therefore match the columns in Figures 14.17 and
14.18.
b. Are the high seasonal factors associated with the high volume months, or are the low seasonal
factors associated with the low volume months?
40
CHAPTER 15
FRAUD RISK ASSESSMENTS OF FORENSIC UNITS
Discussion Questions
1. What is meant by a predictor variable and what is the equivalent concept called in linear
regression?
2. What is meant by continuous controls monitoring?
3. Briefly describe the risk-score approach or the risk-scoring methodology.
4. What problems would arise from having or using predictors that were not valid? For example,
where a sales reporting application included a predictor (such as whether the zip code was an odd
or an even number) that really had nothing to do with the behavior of interest.
5. In what circumstances does the risk scoring methodology work best?
Short Answer Questions
6. In the steps used to develop a continuous monitoring application, the system design step occurs
before the system documentation step (true/false).
7. A final forensic unit of 0 is associated with a low risk of errors, and a final forensic unit of 1 is
associated with a high risk of errors (true/false).
8. Slovic (1966) notes that little is known about the manner in which human subjects combine
information from multiple ______ (views/news/cues).
9. Sales reporting errors can be either intentional or unintentional (true/false).
10. If a risk scoring system was developed in which the predictors had no predictive ability, then the
system would be no worse or better than a random selection of forensic units (true/false).
Multiple Choice Questions
11.
The PWC study concluded that continuous auditing is still considered to be a(n) ________
phenomenon.
a. Dormant
b. Emerging
c. Successful
d. Mature
12.
a.
b.
c.
d.
The first step in a CM application is to determine the _____ of the monitoring.
Length
Cause
Scope
Risk
41
13.
a.
b.
c.
d.
A risk score is calculated for each _______ unit.
Measurement
Inventory
Seasonal
Forensic
a.
b.
c.
d.
The risk score method uses multiple ______ to assess the risk of fraud or error.
Predictors
Queries
Reports
Correlations
14.
15.
The risk scoring system is a fraud _______ activity.
a.
b.
c.
d.
Correction
Perfection
Prevention
Detection
Cases
16. Import the 2000/2010 census data into Access. Before importing the data change the blank (null)
values for the 2000 census to zeroes. Name the file Census.accdb. This case will calculate a risk score
for each state based on the census numbers. Each state (and the District of Columbia) will therefore be a
forensic unit. No fraud or error is actually suspected in this case. The activity is done simply to develop
some practice with scoring forensic units.
Required:
a. Create a predictor P1 that scores each forensic unit with a 1.00 if the state has a newly formed
county, and zero otherwise (similar to the P8 variable in the chapter, although P8 had three
possible values, not just 0 or 1). A newly formed county would occur when there is a 0 value for
the 2000 census and a positive count for the 2010 census.
b. Create a predictor P2 that gives each state a score of .1 (with a maximum of 1.00) for each
number in either 2000 or 2010 that is an exact multiple of a 100 (e.g., 400, 900, 2,000, or 3600).
A state with 4 "round numbers" should score 0.40 for P2 and a state with no round numbers
should score 0.00.
c. Create a predictor P3 that first calculates the proportion of counties in a state that had population
increases of 10 percent or more. The P3 score is equal to the proportion times 3 (with a
maximum score of 1.00). Counties with zero populations in 2000 should be scored as if their
percentage increase is greater than 10 percent.
d. Calculate the final risk scores for each state by giving P1 a weight of 0.10, P2 a weight of 0.30,
and P3 a weight of 0.60. Round and display the scores to three decimal places. Sort the results
by risk scores decreasing. Export the results to Excel. Save the Census.accdb file.
42
17. Open the Census.accdb database created in Case 15-16.
Required:
a. Create a neat Access report that shows only the P3 results. The report should show the state name,
the two letter state abbreviation, and the P3 score. The result should be sorted by P3 score
descending. The data sets for this book include a table of state names and the two letter
abbreviations.
b. Create an Access report that shows the final risk scores for each state sorted by risk scores
descending. The report should show the final scores, the scores for P1 to P3, the state name, and
the two letter abbreviation.
c. Create a switchboard so that the reports created in (a) and (b) can be displayed with a single click.
A switchboard is shown in Figure 15.8.
43
CHAPTER 16
EXAMPLES OF RISK SCORING WITH ACCESS QUERIES
Discussion Questions
1. Why has the IRS stopped performing the TCMP audits?
2. Once the TCMP data table has been completed, the IRS uses discriminant analysis to select returns
for audit. What is discriminant analysis?
3. Does the DIF system include a message of some sort telling IRS auditors which areas were
problematic areas on the taxpayer's tax return?
4. What is check kiting? Is it still a problem today?
5. Why is Access preferred to Excel in the risk scoring applications?
Short Answer Questions
6. The TCMP provided the IRS with an estimate of the level on noncompliance and the
noncompliance trend (true/false).
7. The two main groups of tax returns are _____ (filed on paper and filed electronically, U.S. resident
and resident abroad, business and nonbusiness).
8. The IRS audit selection method is conducive to the auditor conducting a simple correspondence
audit, office audits, or field audits (true/false).
9. The objective of the risk-scoring method is to identify the high-risk cases and to end up with ____
(many/only a few/many or few, it doesn't matter) forensic units with high scores.
10. In the risk scoring queries we need to avoid a ______ (division/multiplication/addition) by zero
error.
Multiple Choice Questions
11.
The first step in the TCMP audit process was,
a. Selection of returns for audit
b. Preliminary planning
c. Getting suggestions from IRS auditors
d. Purchasing statistical software
12.
Every financial institution has a unique _________.
a. Routing submit code
b. Routing transit code
c. Routing transit digit
44
d. Routing transit number
13.
a.
b.
c.
d.
If a single check kiting predictor was given a weighting of zero, then ________.
Final scores could not be calculated because we cannot divide by zero
All the final scores would equal zero because any number times zero is zero
This predictor would have no influence on the final scores
This predictor would be the only predictor influencing the final scores
a.
b.
c.
d.
The function in Access that allows for multiple "If" criteria is the ______ function.
Switch
Criteria
Which
ManyIf
14.
15.
With respect to the risk-scoring method and the DIF scoring procedure, ______ require(s) a manual
screening by a skilled investigator to decipher why the forensic unit was given a high score.
a.
b.
c.
d.
Neither
Both
Only the DIF scoring procedure
Only the risk scoring procedure
Cases
16. Open your Access database PageSoftware.accdb. This case will require you to program a risk
scoring system to detect vendor fraud in Access. We will use the same predictors P1 to P4 shown in the
chapter. The weightings will be different to take into account the fact that we are not using P5. Limit the
results to vendors that have a total amount for the year that is greater than $50.00.
Required:
a. Create a predictor P1 that scores each vendor with a 0 if there are six or less invoices each month,
and 1 otherwise. See equation 16.18.
b. Create a predictor P2 that scores each vendor with a 0 if there are one or more credits or
adjustments for the year, and 1 otherwise. See equation 16.19.
c. Create a predictor P3 that scores the vendor according to the increase in dollars for H2 as
compared to H1 as a proportion. Use the formula in equation 16.20.
d. Create a predictor P4 that scores the vendor with a 0 if the total dollars are too small or too large
to be a high risk fraud. Use the formula in equation 16.21
e. Calculate the final risk scores for each vendor by giving P1 to P4 weightings of 0.15, 0.15, 0.50,
and 0.20 respectively.
f. Program the required queries in Access following the guidance in the book. Your final result
should be list of the sorted 3,363 vendor risk scores in Access as is shown in Figure 16.11. Use
the same naming conventions that are used in the book.
45
17. Open your Access database PageSoftware.accdb with the risk scoring queries as required in Case 1616. This case is a continuation of the case above.
a. Create a parameter query (qryVendorDetails) that extracts the records for a selected vendor. For
example, if you type in "4343" (without the quotes) then you'll see the transactions for that vendor
in a format similar to Figure 16.13. Show the Vendor, Date, Amount, ExpenseType, and ID fields.
Show the result for vendor #4343.
b. Create a new query (qryWeighted3) that shows only the 50 vendors with the highest risk scores.
c. Create a neat Access report based on (b) above that shows only the 50 vendors with the highest
risk scores. The report should show the details shown in Figure 16.11 and it should be sorted by
the risk score descending.
d. Create an Access report that shows the vendor details from part (a).
e. Create a switchboard so that the reports created in (c) and (d) can be displayed with a single click.
A switchboard is shown in Figure 15.8.
46
CHAPTER 17
THE DETECTION OF FINANCIAL STATEMENT FRAUD
Discussion Questions
1. Why is it problematic to use Benford's Law to detect fraud in a single set of financial statements?
2. Why should totals and subtotals be ignored when analyzing data for compliance to Benford's Law?
3. Figure 17.1 shows the reported numbers of InterOil Corporation (IOC). These numbers were
reported in exact dollars. Why is it meaningless to analyze the last-two digits of financial
statement numbers that are rounded to the nearest thousand or the nearest million?
4. Why should we be at all concerned when accountants and managers round up sales numbers by a
small percentage to get a number that just makes a psychological threshold? After all, we're just
talking about a manipulation of just (say) 1 percent of revenues.
5. Why did the study to detect biased income statement numbers (pp. 395-398) omit foreign
companies listed on the NYSE?
Short Answer Questions
6. The analysis of the financial statements of the Oceania company showed that the digits of the
revenue numbers and the digits of the expense numbers did not conform to Benford's Law using
the MAD criterion. However, because there were very few records _____ (all/none) of the
differences were statistically significant using the z-statistic.
7. Excessive duplication of the digits in the financial statements of a company would not necessarily
prove fraud (true/false).
8. Fraudulent financial reporting is a phenomena limited to companies. Fraudulent financial reporting
does not apply to government agencies or nonprofit organizations (true/false).
9. In the analysis of the reported Enron numbers, the _____ (biserial/binomial/nominal) probability
distribution was used to calculate the chances of seven second digit 0s in 12 reported numbers.
10. Most cases of financial statement fraud involve misstated ______ (revenue/expense/inventory)
numbers.
Multiple Choice Questions
11.
Fraudulent financial reporting is the intentional misstatement of, or a(n) _________ the financial
statements, made with the intent to deceive financial statement users.
a. Addition to
b. Suspicion on
c. Condition in
d. Omission from
47
12.
a.
b.
c.
d.
13.
Income and expense (or income and deduction) items need to be analyzed _________ because
they are manipulated in opposite ways.
Together
Separately
Quickly
Graphically
The Enron bankruptcy set off a chain of events that resulted in the ________ and brought the topic of
corporate fraud and accounting to the attention of the financial press and television.
a.
b.
c.
d.
14.
Sarbanes-Presley Act
Sarbanes-Oxley Act
Bankruptcy of Lehman Brothers
John Grisham novel "The Firm"
a.
b.
c.
d.
The Enron financial statements for 1997 to 2000 showed an excess of _______.
Round numbers
Last-two digit 00s
Second digit 9s
Second digit 0s
a.
b.
c.
d.
For the divisional reports the risk scoring system sought to evaluate the risk of intentional and
unintentional ______ and biases in the reported numbers of the divisions.
Estimates
Rounding
Corrections
Errors
15.
Cases
16. Open your Census.accdb database created in Case 15-16. Use Access for all the requirements except
where you are asked to use Excel for the graphs.
Required:
a. Run the second digit test on the 2010 county populations using Access to calculate the second digit
frequencies. Your queries will need to be an adaptation of the queries in Figure 5.3 and Figure 5.4.
Use the MID function in Access to calculate the second digits of the 2010 population numbers.
Use the Excel template NigriniCycle.xlsx to graph the second digits. The second digit counts (from
Access) need to be pasted into the range B15:B24 in the Tables tab. Show the graph that is
automatically prepared in the Second Digits tab. Delete all the unneeded tabs. Save the file as
Case_17_16.xlsx.
b. Do the second digit frequencies show signs of rounding-up behavior?
c. Calculate the sum of the 2010 population numbers.
48
d. Do the following for each 2010 population number that has a second digit 9: Increase the number
by 1.5 percent (by multiplying by 1.015) and then round the number to the nearest integer. Now
rerun part (a) and graph the second results again in Excel using the NigriniCycle.xlsx template.
Show the graph that is automatically prepared in the Second Digits tab. Delete all the unneeded
tabs. Save the file as Case_17_16b.xlsx.
e. Do the second digit frequencies show signs of rounding-up behavior?
f. Calculate the inflated sum of the 2010 population numbers as a result of the manipulation in (d).
17.
Review the forensic accounting report for the SEC vs. C. Wesley Rhodes, Jr. et. al. case. The
report is posted on the supplementary website for this book. The report was prepared by Gregory A.
Gadawski and Darrell D. Dorrell of Financial Forensics. Their website is http://financialforensics.com
and more information can be found at http://www.financialforensicsacademy.com/.
Required:
a. What were the overall observations of the forensic accountants as a result of applying the Benford's
Law tests (see page 38)?
b. What were the conclusions of the forensic accountants as a result of applying the second digit test
to the ledger accounts (see page 40)?
c. What were the conclusions of the forensic accountants as a result of applying the first-two digits
test to the ledger accounts (see page 41)?
d. What were the conclusions of the forensic accountants as a result of applying the number
duplication test to the ledger accounts (see page 46)? Give a one or two sentence summary for
each of the six points in the report
18.
Perform an internet search to locate the quarterly report filed by Enron on April 17, 2001 for the
first quarter of the 2001 fiscal year.
Required:
a. List the revenues and the net income in dollars for the first quarter of 2001.
b. What digit pattern do you notice for these numbers?
c. Comment on the magnitude of the revenues.
49
CHAPTER 18
USING ANALYTICS - PURCHASING CARD TRANSACTIONS
Discussion Questions
1. What are the three parts of the fraud triangle? Which of these three parts is especially relevant to
employee purchasing cards?
2. Briefly describe the Locard Exchange Principle. You will need to do an internet search on the
term. How could this concept be related to purchasing card fraud and abuse?
3. What is a purchasing card?
4. What is meant by "waste and abuse" in a purchasing card program?
5. What are the types of purchasing card fraud that could be perpetrated by an employee?
Short Answer Questions
6. The high-level overview tests for the purchasing card transactions included the _______ (samesame-same test/data profile/inspection test).
7. For purchasing card data it is normal that there are no negative numbers from credits, refunds, or
other miscellaneous adjustments (true/false).
8. For purchasing card data it is normal to run the first-order test on amounts that are ____
($10/$30/$50/$100) and higher.
9. The summation test sums all the amounts with ________ (first/second/first-two/last-two) digits of
10, 11, 12,…,99.
10. It is best to collect and analyze the data at the _______ (start/midpoint/end) of the investigation.
Multiple Choice Questions
11.
The GAO is now known as the,
a. Government Accountability Office
b. General Accountability Office
c. General Administration Office
d. Government Accounting Online
12.
The use of cards is an efficient way of simplifying and speeding up the purchases of ______ transactions.
a.
b.
c.
d.
13.
Foreign
High-value
Low-value
Cash
The National Association of Purchasing Card Professionals administers the _____ program.
50
a.
b.
c.
d.
14.
a.
b.
c.
d.
15.
Certified Fraud Examiner (CFE)
Computer Forensics Education (CFE)
Certified Purchasing Card Professional (CPCP)
Computer Program Certification Panel (CPCP)
The first graph of the purchasing card dashboard in the chapter example was _______.
The data profile
Purchase amount by card type and by month
First-two digits of purchase amounts
Cardholders showing the largest month-on-month growth
The forensic analytic tests run on the purchasing card data would fit in well with a(n) ________ program.
a.
b.
c.
d.
Accounting
Rounding
Continuous monitoring
Mentoring
Cases
16. Open the Excel file Census_2000_2010.xlsx with the 2010 and 2011 county population numbers.
The objective of this case is to create a pie chart similar to the two pie charts shown in the purchasing
card dashboard in Figure 18.1.
Required:
a. Use Excel's pivot table capabilities to create a table of the population totals for the 50 states and the
District of Columbia.
b. Create a second smaller table showing just the total populations of CA, TX, NY, FL, IL, and Other.
Use Excel's VLOOKUP function to get the populations of the five states, and use the fact that the
Other total is the grand total (308,745,538) minus the totals for CA, TX, NY, FL, and IL. The
example below has the numbers purposely blurred.
c. Create an "Exploded pie in 3-D" pie chart from the data Columns D and E in (b) above. Make sure
that the segments are labeled with the state abbreviations and "Other" as the case may be.
d. Save your result as Case_18_16.xlsx.
51
17. Open your PageSoftware.xlsx Excel file. This file has the accounts payable transactions for 2010 for
a software company. For the purposes of this case we'll assume that these are purchasing card
transactions.
Required:
a. Create a table with the same headings as the first table in the Excel dashboard (Figure 18.1). This
is the "total purchase trend across all cards for a given period." The table has the sum in dollars,
the counts, and the average value for six months, together with YTD figures in the last row.
Create a table with the same format but use the PageSoftware invoice data. Use Excel's functions
to calculate the dashboard amounts. Use functions that can be easily updated for the next month's
dashboard. Your answer will have dollar amounts or transaction counts where the xs are shown
below.
b. Save your file as Case_18_17.xlsx.
The end.
52