The Models Used to Detect Balance-Sheet Discrepancies and Fraud

A practitioner's guide to the quantitative models auditors, forensic accountants and credit-risk teams use to flag manipulated financial statements — what each one measures, how it's calculated, and where it breaks.

Every set of financial statements tells a story. The job of fraud detection is to check whether the story is internally consistent — whether the balance sheet, income statement and cash-flow statement corroborate each other, or whether one has been quietly bent to flatter the others. No single model “proves” fraud. What these models do is narrow attention: they turn thousands of line items into a handful of red flags a human then investigates. Used together, they're one of the most cost-effective screening layers in finance.

Here are the models that matter, roughly in the order a seasoned analyst reaches for them.

Start with analytical review: ratios and trends

Before any named model, the first screen is analytical. Vertical analysis (each line as a percentage of sales or total assets) and horizontal analysis (period-over-period change) expose items moving in ways the business shouldn't support. The classic tells: revenue growing while operating cash flow stalls, receivables growing faster than sales, gross margins expanding against an industry that's compressing, inventory building without a demand story, and a widening gap between net income and cash from operations.

The single most useful discrepancy signal is the accruals gap — the divergence between reported earnings and cash generated. Earnings are an opinion; cash is a fact. When the two separate persistently, something in the accrual estimates is doing the heavy lifting. Most of the formal models below are really structured ways of measuring that gap.

The Beneish M-Score

The Beneish M-Score, developed by Messod Beneish in 1999, is the best-known earnings-manipulation model. It combines eight variables into a single score that estimates the likelihood that a company has manipulated its earnings.

The eight indices are: DSRI (Days' Sales in Receivables Index), GMI (Gross Margin Index), AQI (Asset Quality Index), SGI (Sales Growth Index), DEPI (Depreciation Index), SGAI (SG&A Index), LVGI (Leverage Index) and TATA (Total Accruals to Total Assets). Each captures a channel through which statements are commonly distorted — inflating receivables, softening depreciation, capitalising costs that should be expensed.

The formula is: M = −4.84 + 0.92·DSRI + 0.528·GMI + 0.404·AQI + 0.892·SGI + 0.115·DEPI − 0.172·SGAI + 4.679·TATA − 0.327·LVGI. The rule of thumb: an M-Score greater than −1.78 flags a company as a likely manipulator. Note the sign — because the threshold is negative, a higher (less negative) score is the warning. The TATA term carries the largest weight, which again points back to accruals as the core mechanism.

The M-Score is powerful as a screen but blunt as a verdict. It generates false positives for fast-growing and turnaround firms whose ratios move sharply for legitimate reasons, so it belongs at the top of the funnel, not the bottom.

The Altman Z-Score

Edward Altman's Z-Score (1968) predicts bankruptcy risk, not fraud directly — but the two are correlated, because firms sliding toward distress have the strongest motive to misstate. It uses five ratios via multivariate discriminant analysis.

The original public-manufacturer model is: Z = 1.2·(Working Capital/Total Assets) + 1.4·(Retained Earnings/Total Assets) + 3.3·(EBIT/Total Assets) + 0.6·(Market Value of Equity/Total Liabilities) + 1.0·(Sales/Total Assets). Interpretation: Z above 2.99 is the safe zone, 1.81 to 2.99 is the grey zone, and below 1.81 is the distress zone. Variants exist for private firms and non-manufacturers (the Z'- and Z''-scores) that reweight the ratios and drop the market-value term.

In fraud work, the Z-Score is best used as a motive indicator layered against the M-Score's means indicator: a company in the distress zone that also scores as a likely manipulator is a materially different risk than one showing either signal alone.

The Dechow F-Score

The Dechow, Ge, Larson and Sloan F-Score (2011) was built specifically to predict material misstatements, using a logistic regression estimated on a large sample of SEC accounting-enforcement actions. It leans on accrual quality and financial performance — changes in receivables and inventory, the proportion of soft (non-cash) assets, changes in cash sales, and other accrual-based inputs.

The output is expressed as an F-Score = predicted probability of misstatement ÷ the unconditional (base-rate) probability. An F-Score around 1.0 is normal; above 1.0 signals above-average risk, with commonly cited breakpoints around 1.85 (substantial risk) and 2.45 (high risk). Because it's calibrated on actual enforcement cases, many practitioners find it the most directly fraud-tuned of the ratio models.

The Piotroski F-Score

Joseph Piotroski's F-Score (2000) wasn't designed to catch fraud — it's a nine-point financial-strength score used in value investing — but it's a useful corroborating lens. It awards one point each across nine binary tests in three groups: profitability (positive ROA, positive operating cash flow, rising ROA, and cash flow exceeding net income), leverage/liquidity (falling long-term leverage, rising current ratio, no new share issuance), and operating efficiency (rising gross margin, rising asset turnover). Scores run 0 to 9.

The relevant signal for discrepancy detection is the cash-flow-versus-net-income test: a firm reporting rising profits but failing that check is showing exactly the accruals divergence that manipulation produces. A high headline profit with a low Piotroski score is worth a second look.

Benford's Law

Benford's Law is a statistical, rather than accounting, model. It states that in many naturally occurring datasets the leading digit is not uniformly distributed: the probability that the first digit is d follows P(d) = log₁₀(1 + 1/d), so 1 appears as the leading digit about 30.1% of the time, 2 about 17.6%, down to 9 at about 4.6%.

Forensic analysts run the general ledger, invoices or expense lines against this expected distribution using first-digit, second-digit and first-two-digit tests, then measure conformity with statistics like the Mean Absolute Deviation (MAD), chi-square or Z-tests. Numbers that people fabricate — to sit just under an approval threshold, for instance — tend to break the pattern. Benford's strength is spotting manipulation at the transaction level that ratio models, which work on aggregates, can miss. Its limits matter too: it needs large samples, doesn't apply to assigned or bounded numbers (invoice IDs, prices clustered around round points), and there's no single agreed conformity cutoff, so it flags anomalies rather than proving intent.

Accruals models: Jones and Modified Jones

Where the M-Score bundles accruals into one term, the Jones (1991) and Modified Jones models isolate discretionary accruals directly. They regress total accruals on the change in revenue (adjusted for the change in receivables) and gross property, plant and equipment; the residual — the portion of accruals not explained by normal business activity — is the discretionary component and the proxy for earnings management. These models are the academic workhorses behind much of the fraud literature and are common in expert analysis, though they require peer-group estimation and are sensitive to model specification.

Machine learning and anomaly detection

The current frontier combines the models above with machine learning. Two broad approaches are in use.

Supervised models — logistic regression, random forests, gradient boosting — are trained on labelled cases of known fraud (typically SEC or regulator enforcement actions). Crucially, the best of these don't discard the classical models; they use the M-Score, Z-Score, F-Score and Benford statistics as input features, letting the algorithm learn non-linear interactions the linear formulas miss. Recent studies pairing Altman and Beneish inputs inside a random forest report meaningfully better detection than either score alone.

Unsupervised models — clustering, isolation forests, autoencoders — don't need labelled fraud. They learn what normal looks like across a company's history or a peer set and flag statistical outliers. This matters because fraud is rare and novel schemes have no prior label. The trade-off is interpretability: a flag with no explanation is hard to action, which is why hybrid designs that combine an unsupervised anomaly score with Benford-style tests and Bayesian probability scoring are gaining ground — they cut false positives while keeping the reasoning legible to an auditor.

Putting it together

No competent analyst runs one model. The discipline is triangulation across three questions: does the company have a motive (distress — Z-Score), does the pattern show the means (earnings manipulation — M-Score, F-Score, discretionary accruals), and does the granular data conform (Benford's Law, transaction-level anomaly detection)? A company lighting up on all three is a genuinely different animal from one tripping a single screen.

Two disciplines keep this honest. First, calibrate to the base rate — real fraud is rare, so even a good model produces mostly false positives, and the models are a reason to look, never a conclusion. Second, remember what each model actually measures: almost every one of them is, at heart, a way of asking whether reported earnings are backed by cash. When they aren't, the balance sheet is usually where the discrepancy has been parked.

The models find the smoke. Confirming the fire is still human work — reading the disclosures, testing the transactions, and asking the questions the numbers can only hint at.

References

Foundational models

Beneish, M. D. (1999). “The Detection of Earnings Manipulation.” Financial Analysts Journal, 55(5), 24–36.

Altman, E. I. (1968). “Financial Ratios, Discriminant Analysis and the Prediction of Corporate Bankruptcy.” The Journal of Finance, 23(4), 589–609.

Dechow, P. M., Ge, W., Larson, C. R., & Sloan, R. G. (2011). “Predicting Material Accounting Misstatements.” Contemporary Accounting Research, 28(1), 17–82.

Dechow, P. M., Sloan, R. G., & Sweeney, A. P. (1995). “Detecting Earnings Management.” The Accounting Review, 70(2), 193–225. — the Modified Jones model.

Jones, J. J. (1991). “Earnings Management During Import Relief Investigations.” Journal of Accounting Research, 29(2), 193–228.

Piotroski, J. D. (2000). “Value Investing: Using Historical Financial Statement Information to Separate Winners from Losers.” Journal of Accounting Research, 38 (Supplement), 1–41.

Benford, F. (1938). “The Law of Anomalous Numbers.” Proceedings of the American Philosophical Society, 78(4), 551–572.

Nigrini, M. J. (2012). Benford's Law: Applications for Forensic Accounting, Auditing, and Fraud Detection. Wiley — the standard practitioner reference for applying Benford's Law in forensic work.

Recent research and applied studies

Özari, Ç., Can, E. N., & Demirkale, Ö. (2025). “Financial Fraud Detection with Altman Z-Score and Beneish M-Score via Random Forest.” SAGE Open. Read

ODU Cybersecurity Undergraduate Research (2025). “Leveraging Benford's Law and Machine Learning for Financial Fraud Detection.” Read

Note: journal breakpoints for the Dechow F-Score (≈1.85 substantial, ≈2.45 high risk) and Benford conformity cutoffs are commonly cited approximations; confirm against the original papers before relying on them in formal work.