# CPA Audit Pack — Anomaly Layer (W1)

**Hypothesis:** Three deterministic, exact-arithmetic journal-entry anomaly tests
(Benford first-digit MAD, round-number, just-under-threshold) can be applied to
200 real UK Cabinet Office transactions and will produce findings attributable
entirely to human-supplied thresholds, with no AI-chosen risk cutoffs, no
probabilistic inference, and byte-identical results on every run.

**Verdict:** CONFIRMED — all five pre-registered bars pass.

---

## Data

- Source: `experiments/accounting_familiar/ledger_real.json`
- Records: 200 Cabinet Office debit transactions, January 2024
- Arithmetic: integer pence = `round(amount * 100)` — exact, no floating-point accumulation

---

## Attributed (human-supplied) Parameters

The AI executes and reports; it never picks a risk threshold.

| Parameter ref | Value | Meaning |
|---|---|---|
| `param:Nigrini-MAD-cutoff` | 0.006 | Nigrini 2012 "acceptable conformity" boundary |
| `param:BENFORD_MIN_N` | 100 | Minimum n; test abstains below this |
| `param:round_unit_1_pence` | 100,000 | £1,000 |
| `param:round_unit_2_pence` | 1,000,000 | £10,000 |
| `param:materiality_threshold_T_pence` | 5,000,000 | £50,000 (Cabinet Office approval tier) |
| `param:just_under_band_pence` | 500,000 | £5,000 band below T |

---

## Test Results (exact numbers from results.json)

### Test 1 — Benford First-Digit MAD

| Dataset | MAD | Flagged |
|---|---|---|
| Real data (200 transactions) | **0.0202071013** | YES — MAD > 0.006 |
| Uniform control (deterministic) | 0.0593466647 | YES |
| Benford-generated control | 0.0015845733 | NO |

First-digit distribution (real data, counts out of 200):

| Digit | Count | Observed freq | Benford expected | |Δ| |
|---|---|---|---|---|
| 1 | 46 | 0.230 | 0.30103 | 0.07103 |
| 2 | 37 | 0.185 | 0.17609 | 0.00891 |
| 3 | 34 | 0.170 | 0.12494 | 0.04506 |
| 4 | 22 | 0.110 | 0.09691 | 0.01309 |
| 5 | 19 | 0.095 | 0.07918 | 0.01582 |
| 6 | 15 | 0.075 | 0.06695 | 0.00805 |
| 7 | 11 | 0.055 | 0.05799 | 0.00299 |
| 8 | 10 | 0.050 | 0.05115 | 0.00115 |
| 9 | 6 | 0.030 | 0.04576 | 0.01576 |

Finding: "flagged by Benford-MAD rule at param:Nigrini-MAD-cutoff=0.0060; MAD=0.020207 > cutoff;
finding for human review"

Note: the MAD at 0.020 suggests non-conformance; the dominant driver is digit 1 being
under-represented (0.230 vs Benford 0.301) and digit 3 over-represented. This is a
finding for human review — it may reflect the government spend distribution (large
contracts, rounded to specific tiers) rather than any anomaly.

### Test 2 — Round Numbers

| Rule | Flagged count |
|---|---|
| Exact multiples of £1,000 | **14 rows** |
| Exact multiples of £10,000 | **6 rows** |

Rows flagged as exact £10,000 multiples:
- row 12: £160,000.00 — ARMED FORCES COVENANT FUND TRUST (1037195307)
- row 29: £70,000.00 — CENTRAL CHANCERY OF THE ORDERS OF KNIGHTHOOD (1037194333)
- row 120: £80,000.00 — MINISTRY OF JUSTICE (2037002489)
- row 143: £500,000.00 — QUANTEXA LTD (1037196401)
- row 144: £100,000.00 — QUANTEXA LTD (1037196401)
- row 149: £80,000.00 — SAYARI LABS INC. (20002602)

### Test 3 — Just-Under Threshold

Window: [£45,000.00, £50,000.00) — within £5,000 below param:materiality_threshold_T=£50,000.

**8 rows flagged:**

| Row | Amount (£) | Distance below £50k | Supplier |
|---|---|---|---|
| 24 | 47,016.40 | £2,983.60 | CAPGEMINI UK PLC |
| 104 | 49,753.23 | £246.77 | INTEGRITY RESEARCH & CONSULTANCY |
| 114 | 47,735.00 | £2,265.00 | LIVE GROUP LTD |
| 131 | 47,020.04 | £2,979.96 | MYCSP LTD |
| 148 | 47,350.00 | £2,650.00 | RAINMAKER SOLUTIONS LTD |
| 151 | 46,240.33 | £3,759.67 | SECURITY SERVICES GROUP |
| 183 | 47,520.00 | £2,480.00 | CABINET OFFICE |
| 189 | 45,882.00 | £4,118.00 | i10 Limited |

Finding: "flagged by just-under-threshold rule: 8 amounts fall in [£45,000.00, £50,000.00)
— within £5,000.00 below param:materiality_threshold_T=£50,000.00; finding for human review"

---

## Pre-Registered Bars (all evaluated before computation, all PASS)

| Bar | Description | Result |
|---|---|---|
| B1 | Benford MAD re-derivable: both methods agree | PASS — diff=6.94e-18 |
| B2 | Flag fires IFF MAD > attributed cutoff; n < min_n => REFUSES | PASS |
| B3 | Zero confident-error outputs (no 'fraud'/'guilt' anywhere) | PASS |
| B4 | Controls discriminate: MAD(uniform) > MAD(real) > MAD(benford_ctrl) | PASS — 0.0593 > 0.0202 > 0.0016 |
| B5 | Determinism: byte-identical results.json (sha256 identical) | PASS |

SHA-256 (both passes): `4ab99aa59529302f5c9241b0f07a0b1ea1c4ae2555509cb81567f437fc6ae2f4`

---

## Files

- `run.py` — the deterministic verifier; pure stdlib, zero RNG, zero model training
- `results.json` — per-test results + attributed parameters + bar evaluations
- `README.md` — this file (generated to reflect results.json exactly)

## Scope

These are findings for human review, not verdicts. Every flag is attributed to an
explicit, human-supplied rule and threshold. No test ever concludes fraud or guilt.
The Benford non-conformance of this dataset likely reflects the structure of public
sector procurement (contract tiers, approval-threshold rounding) — that is a
hypothesis for the next experiment, not a conclusion of this one.
