Benford, Policy Thresholds and Alert Capacity at Meridian Health Plans
Meridian Health Plans reimburses about 45,000 employee expense claims a year. The analytics team built two rules. Rule A flags exact duplicates (same employee, same amount, same date, same merchant) and produced 340 hits last year. Rule B uses fuzzy matching on amount within 2 percent and merchant name similarity, and produced 900 hits. Investigators have 120 hours a year to work alerts, and a typical review takes two hours. A first-digit Benford test on the corporate card population returned a p-value below 0.01, but a follow-up chart shows a spike at $2,499 because policy caps reimbursements at $2,500 without a second approver. Management's stated conclusion is that 'the Benford failure proves fraud in the card programme.'
1. Assess management's conclusion. What does the Benford result actually tell you, and what should you do next?
Read the worked answer
The conclusion does not follow. Benford's law describes the expected first-digit distribution of naturally occurring, unconstrained numeric populations. A reimbursement cap with no second approver creates an artificial ceiling, and claimants shave amounts to sit just under it. A spike at $2,499 is exactly what a conforming population should look like under that policy. The test is detecting your own policy, not fraud.
What significance does mean. The population deviates from the expected distribution. That is a screen telling you where to look. A p-value below 0.01 means the deviation is unlikely to be chance; it says nothing about intent and cannot identify an individual fraudulent transaction.
Next steps.
- Re-run the test excluding the $2,300–$2,500 band. If conformity returns, the anomaly is a policy artefact.
- Examine the $2,499 cluster line by line for split claims (two claims at $1,300 in the same week), round-number shaving and repeat claimants.
- Segment the cluster by cost centre and approver. A cluster concentrated under one approver is a very different signal from one spread evenly across the population.
- Fix the control that created the artefact: move to approval bands, or set the second-approver threshold at a non-round number.
Report language. 'The first-digit distribution is non-conforming; the deviation is concentrated at the $2,500 policy threshold and is consistent with a legitimate policy effect. No fraud conclusion is drawn.'
2. With 120 investigator hours and 1,240 total alerts, how do you allocate effort? Propose a prioritisation method and justify it.
Read the worked answer
Capacity arithmetic first. 120 hours ÷ 2 hours per review = 60 reviews against 1,240 alerts. You cannot review everything, so allocation must be by expected value, not by queue order.
Estimate precision before allocating. Pull a random sample of 25 from each rule and review them in full (about 50 hours). Suppose Rule A yields 12 confirmed issues (48 percent precision) and Rule B yields 3 (12 percent). Expected confirmed cases if everything went to A is roughly 163; if everything went to B, roughly 108. Expected value per review hour is far higher on Rule A.
Recommended allocation.
- Rule A to near-exhaustion, but cut the 340 with a second filter: amounts above a materiality floor, employees previously flagged, new merchants, repeat amounts, weekend submission. That should bring it to roughly 60–80 reviews.
- Remaining hours to Rule B only where the alert also carries a risk attribute, not on the whole 900.
- Reserve about 10 percent of hours for follow-up on confirmed cases - that is where recovery actually happens.
State the trade-off explicitly. Low precision on Rule B is acceptable if it surfaces cases Rule A misses. The error is spending hours uniformly across alerts because the queue is first-in-first-out.
Report to the audit committee: alerts raised, alerts reviewed, precision by rule, confirmed cases, value recovered, mean hours per confirmed case. Falling precision means the rule needs rebuilding - not that fraud has stopped.
3. A senior manager whose claims were cleared asks to see the alert that flagged him and the analyst's working notes. How do you respond?
Read the worked answer
Decline the request, and explain why in neutral terms.
Reasons.
- The alert and the analyst's notes are internal fraud-risk monitoring records, not an investigative finding. They contain a rule threshold, not an allegation.
- Disclosing rule logic to a subject teaches the population how to evade it; the rules are only useful while they are not widely known.
- The notes may reference other employees' data, which cannot be disclosed to him.
- There is no obligation to show working papers when the outcome was 'no further action'.
What you can say. Confirm in writing that his claims were reviewed, that the review was closed with no finding against him, and that no further action is being taken. Give a short, factual statement he can rely on. If he is subject to a disciplinary or performance process elsewhere, route any further disclosure through HR and counsel.
What to record. The date of the request, what he asked for, what was provided, and the reason disclosure was limited. Note also whether the alert was a genuine false positive or an artefact of the rule - repeated requests from the same individual are worth a second look at the underlying data.