🔍 Detecting GL Anomalies with Benford's Law - First Digit Analysis

I'm excited to share a workflow I built for General Ledger anomaly detection using Benford's Law First-Digit Analysis — now available on KNIME Hub.

https://hub.knime.com/s/oJY9mGI_yOX5lqm5

Most Benford's Law implementations I've seen treat the entire dataset as one population. That works for demos, but in real audit work, segmentation is non-negotiable requirement, need to handle multiple diverse sub-groups.

What It Does

The workflow runs a full Benford's Law analysis across multiple GL account code sub-groups automatically, using a two-level anomaly flagging approach:

• 📊 Dataset Level — MAD (Mean Absolute Deviation) scores each Account Code segment against Nigrini's conformity thresholds

• 🔢 Digit Level — Gate 1 (Absolute Deviation) × Gate 2 (Z-Score); a digit is flagged only when both gates fire, so findings hold up under scrutiny

A Few Things I'm Particularly Happy With

Group Loop — the entire analysis iterates over each Account Code segment automatically. No manual slicing, no separate workflows per segment.

Empty Table Switch — quietly handles iterations where no anomalies are found, keeping the pipeline stable without manual intervention.

Email alert with attachment — the anomaly report lands in your inbox automatically at the end of each run. Genuinely useful for recurring audit cycles.

The Dataset

I used an anonymized GL from a real accounting environment, published on Kaggle:
🔗 Anonymized General Ledger Dataset

Download it, plug it in, and you should be good to go.