Chapter 27 — Key Takeaways

A scannable one-page card. For the full argument and the worked examples, see index.md.

The core claims

• Forensic accounting is investigation, not assurance. A routine audit asks whether the statements are fairly presented and presumes good faith; a fraud examination begins from an allegation and asks was money taken, how, how much, and by whom? The forensic accountant starts where the auditor's assumption of good faith ends.
• The fraud triangle tells you where to look — not who did it. Financial crime by otherwise law-abiding people tends to require pressure (a non-shareable financial problem), opportunity (access plus a way to conceal), and rationalization (a story that protects self-image), all at once. Convergence on one person is a reason to investigate, never a verdict.
• Following the money works because money has to go somewhere — and somewhere keeps a record. Money laundering (placement → layering → integration) tries to break the trail, but every stage records the money in institutions the criminal does not control. Laundering relocates evidence; it rarely destroys it.
• The audit trail — especially digital — is unusually durable. A single transaction generates redundant copies (your books, both banks, the clearing network, the processor, the supplier, a tax document). To erase it you would have to alter records across institutions and a government agency consistently — effectively impossible. Metadata (who/when) often betrays a manipulation the visible numbers hide. Destroying records tends to strengthen a case (spoliation).
• Benford's law is a screen, not a verdict. In many natural datasets the first digit follows a decreasing distribution — 1 leads ~30% of the time, 9 only ~5% — not a flat ~11%. A dataset that should obey it but does not is a flag that directs a hands-on examination. It does not apply to bounded or assigned numbers, a savvy fraudster can fake conformity, and a deviation is never by itself proof of fraud.
• Financial evidence is, at its strongest, evidence of MOTIVE — and motive answers why, never who. Many innocent people have debts, heirs, and inconvenient relatives. "Strongest motive, therefore guilty" is the prosecutor's fallacy in a new suit. Motive earns its weight only in convergence with independent evidence of opportunity and means.

The method-validity verdict (NAS 2009 / PCAST 2016)

Where they sit: Benford's law has a sound mathematical foundation (unlike the discredited pattern-comparison "sciences"), but its forensic use is purely screening — a positive result is a reason to look, never a confirmation. Forensic-accounting reconstruction is document-based and defensible, but its strength is capped by the completeness of the records and the honesty of its stated assumptions. None of these individualizes a culprit the way a quantified DNA match can; the strongest financial finding is a motive, which is one converging line, not a conclusion.

What you can honestly say on the stand

• The reconstruction: "Based on the records I obtained, the defendant's documented liabilities exceeded his liquid assets, he had missed payments in the relevant period, and he was the named beneficiary of a large policy on the decedent's life — facts establishing a strong financial motive. My analysis depends on the completeness of those records and the assumptions I have stated."
• The Benford screen: "A Benford's-law analysis flagged a subset of the renovation cost entries as statistically anomalous, which directed a hands-on examination of those entries; that examination found figures consistent with inflated or fabricated costs. The statistical test located the entries; the document review is what I rely on for the finding."
• What you must NOT say: that a Benford deviation proves fabrication; that a financial motive proves the defendant committed the crime (the ultimate issue — Chapter 30); that the numbers individualize a culprit; or that the absence of a motive proves innocence.

The cold-case line

The death-contingent insurance policy on Diallo, Keller's crushing debts, and the Benford-flagged renovation books together establish that Roy Keller had a strong financial motive. That is the precise finding — and it answers why a crime might have been committed, not who committed it. Keller is a named person of interest; motive is not guilt. The conclusion is reserved for the assembly (Chapter 39), where this motive must converge with opportunity (Ch. 25–26) and means (Ch. 10–12, 22–24).

The themes this chapter advanced

• Exclusion over proof — financial evidence yields motive (a why), not guilt (a who); a Benford screen flags, never finds; the records can exclude a falsely-suspected person as readily as build a motive (Chapter 1, §1.6).
• The validity spectrum — Benford's law has a sound basis but is strictly a screening tool (like a presumptive test, Chapter 21); financial reconstruction is document-grounded but capped by record completeness; neither individualizes a culprit the way DNA does.
• (Also touched: cognitive bias — the Cognitive-Bias Watch on letting a chosen suspect anchor the reconstruction, §27.2, previewing Chapter 31; and the CSI effect — the fantasy of the analyst who spots a fraud in a glance and treats the money as proof, corrected in §27.1 and §27.6.)