Gains:
- Understand the concepts of the fraud triangle (pressure, opportunity, justification) and red flags and use artificial intelligence to scan for suspicious patterns
- Ability to scan Benford's law, duplicate payment and unusual supplier patterns with artificial intelligence support and produce a review list
- Ability to understand that suspicion of fraud is a serious allegation, that the artificial intelligence sign alone is not evidence, and that the final evaluation belongs to the independent auditor.
There is a profound difference between mistake and cheating. An error is an unintentional mistake; getting a total wrong, forgetting a record. Cheating is intentional deception; It is when someone knowingly distorts records for personal gain. The auditor's job is not to "find" fraud—fraud is a legal qualification and is for the courts—but ISA 240 asks the auditor to exercise professional skepticism about the risk of material misstatement due to fraud and to evaluate signs of fraud risk (red flags). The auditor assesses the risk of fraud and investigates suspicious patterns; The final legal decision belongs to others.
In this unit we will cover how to use AI to screen for fraud risk: the fraud triangle, red flags, Benford's law, duplicate payment and unusual supplier patterns, and text analysis in description areas. The basic principle is sternly underlined: no pattern flagged by AI is, by itself, evidence of fraud. A red flag is a “stop and investigate” sign; not an accusation.
Cheating triangle and red flags
The classic framework for fraud investigation is the fraud triangle; He says that fraud usually occurs when three conditions occur together: Pressure (financial/personal necessity that pushes the person to cheat), Opportunity (weak internal control, unchecked authority), and Justification (a way of justifying one's action to oneself—"I'll put it back anyway"). The auditor is more careful in areas where these three conditions are strong.
A red flag is a warning signal that may indicate the possibility of fraud. Typical examples: official exhibiting unusual lifestyle, contracts constantly going to the same supplier, supplier whose address is the same as that of an employee, staff who do not take holidays and do not delegate their work to anyone, frequent correction records, split payments just below the threshold, duplicate invoice numbers. AI can scan for many of these flags on data. But remember: every flag can have an innocent explanation. The auditor's job is to see the flag and investigate, not to blame him for seeing the flag.
Benford's law: a counterintuitive but powerful screening
Benford's law (law of the first digit) says that in large sets of naturally occurring numbers, the distribution of the first significant digit is not uniform: numbers tend to start with "1" (about 30%), with a very low probability of starting with "9" (about 4.6%). Natural data with wide ranges, such as bill amounts, expenses, account balances, generally follow this distribution. When someone fits numbers by hand (e.g. writes amounts just below the approval threshold), this natural distribution is disrupted. Benford analysis compares the distribution of the first (and, if necessary, the first two) digits with what is expected and flags deviations.
AI can calculate the Benford distribution on thousands of amounts in seconds and show digits that deviate from what is expected. But Benford has two limits and the auditor should know them:
- It does not fit all data. Limited numbers within a certain range (e.g. product prices always between 45-55 TL), sequential numbers (invoice number), assigned codes do not comply with Benford; "deviation" is meaningless here.
- Deviation is not evidence. When a step goes up more than expected, the most it says is "look here". The reason may be legitimate (e.g. company pricing). The auditor cannot draw conclusions from the investigation.
Caution: Presenting the Benford deviation as "evidence of cheating" is a serious mistake. Benford is just a red flag; It directs which records should be examined and does not prove fraud.
Text analysis and repetition patterns
The AI's language ability also comes in handy in detecting non-numeric fraud. Unusual concentrations, ambiguous expressions or certain keywords can be scanned in the description fields ("miscellaneous expenses", "consultancy", "representation hosting"). Also structural patterns: duplicate invoice numbers, supplier accounts matching employee bank account, supplier records created over the weekend, frequent round-the-clock payments. The AI produces all of this as a “review list”; The auditor searches the list.
Scan type
What does AI do?
What does an auditor do?
Benford analysis
The first digit indicates the distribution deviation
Investigates the cause of the deviation
duplicate payment
Same amount+date+supplier finds repetition
Is the truth confirmed by duplicate documents?
Supplier-employee matching
Flags same address/account overlap
Investigates if there is a conflict of interest
Subthreshold division
Indicates clustering below approval threshold
Evaluates whether there is intent
Text/description analysis
Scans for vague/repetitive comments
Queries content by document
three mini cases
Case 1 — Benford gave direction, inspector found. An auditor had a Benford analysis performed on expense statements. Amounts starting with "4" were much higher than expected. The auditor examined this set and found that one employee had consistently entered expenses amounting to "$4.8xx", just below the $5,000 approval threshold. The documents turned out to be fake. Benford deviation gave direction; The auditor's investigation and documents revealed the fraud.
Case 2 — False positive Benford. A team member had a Benford analysis done on the product price list and wrote "there is manipulation" when he saw a large deviation. The responsible person examined: the data consisted of prices in a narrow band between 90-110 TL; Benford wouldn't fit into such a limited set anyway. The "bias" was entirely due to applying the method to the wrong data. Lesson: Benford does not apply to all data; The auditor evaluates its suitability.
Case 3 — Raising the flag to blame. An auditor wanted to directly write the "supplier whose address is the same as an employee" marked by AI in the report as "fictitious supplier, fraud". The responsible person stopped it: upon investigation, it was seen that the supplier was a real business, belonged to the employee's relative, and that this was a conflict of interest relationship, but not fictitious. This was reported as a relationship that needed to be disclosed, not cheating. Lesson: red flag initiates investigation; The evidence determines the outcome.
Weak prompt / Strong prompt
Weak prompt:
Find out if there is fraud in these payments.
Problem: AI cannot "find" cheating; Cheating is a legal consequence. This prompt produces either a fabricated “cheat list” or unfounded accusations.
Powerful prompt:
Your role: you are an independent auditor's fraud risk screening assistant. You SIGN the red flag; The cheating evaluation and the result belong to me. Do not label any records as "cheat".Data (anonymous): Supplier payments (columns: payment_id, date, supplier_id, supplier_address, amount, confirmation_threshold=50,000, description).Task - perform the following scans, export each as a SEPARATE list:1) Subthreshold split: Clustered just below the 50,000 TL threshold (45,000-49,999) payments; count by supplier.2) Duplicate: same amount + same supplier + recurring payments within 3 days.3) Benford (first digit): compare the first digit distribution of amounts with the expected Benford; Show deviating steps. IMPORTANT: Also evaluate whether this data complies with Benford (range, constraint) and warn if not. 4) Disclosure analysis: mark suppliers where vague descriptions such as "miscellaneous/miscellaneous/consulting" are concentrated. For each list: write that these are "red flags to be investigated" and are not RESULTS of fraud. Adding a fitting record/pattern.
This prompt is powerful because it parses the scans, calls into question Benford compliance, positions the output as a “red flag,” and prohibits the attribution of “cheating.”
Common mistakes
- It means "find the trick". AI does not detect cheating; red flag signs. Cheating is a legal consequence.
- Applying Benford to inappropriate data. Mistaking "deviation" in narrow band, sequential numbers or codes as meaningful.
- Considering deviation as evidence. Declaring a cheat without investigating the Benford or pattern sign.
- Turning the red flag into accusation. Writing off a relationship/pattern as cheating without verifying it with documentation.
- Ignoring the cheating triangle. Just looking at the data and not evaluating the context of pressure/opportunity/justification.
Tip: When you find a red flag, ask yourself two questions: “What could be a completely innocent explanation for this?” and “If it really is cheating, what other traces should I see?” The first question protects you from unfair accusation, the second from superficiality.
In summary
In a fraud audit, the auditor's role is not to "find" fraud, but to evaluate the risk of fraud with skepticism and look for red flags (BDS 240). AI is a powerful scanning engine: It performs Benford analysis, duplicate payment, subthreshold split, supplier-employee overlap, and text analysis in seconds. But every sign is a red flag, not evidence; Benford does not fit all data; Deviation does not mean cheating. It's the AI's job to see the flag, it's the auditor's job to investigate and evaluate and avoid legal attribution. The red flag says "stop and investigate"; He doesn't say "guilty".
Application task
Consider a hypothetical vendor payment dataset and set an approval threshold. Have the AI run four scans (subthreshold split, duplicate, Benford, annotation analysis) with the powerful prompt pattern above; Have Benford question his suitability. Then, for each red flag that comes up, write an “innocent explanation” and a “cheating scenario” and indicate what evidence would differentiate the two.
checklist
- [ ] I didn't tell the AI to "find tricks"; I said "flag red" and banned the characterization of cheating.
- [ ] I applied Benford only to suitable (widely spaced, natural) data; I evaluated the suitability.
- [ ] I treated each red flag as a beginning of research, not a conclusion.
- [ ] For each sign, I considered both the innocent explanation and the cheating scenario.
- [ ] I did not characterize the patterns as fraudulent/imaginary without verifying them with documentation.
- [ ] I evaluated the context of the fraud triangle (pressure, opportunity, justification).
- [ ] I have documented that the final legal qualification is not the auditor's job and that I have assessed the risk.