The first-order Markov apparatus from First-Order Markov Modeling for Transaction-Stream Analysis in Audit worked cleanly on a 5-state synthetic dataset with 1,000 transitions and a known baseline. Production audit work breaks each of those assumptions. The chart of accounts the engagement team inherits has 200 to 2,000 individual general-ledger accounts, not five. The baseline period is contaminated by the same posting practices the auditor wants to test against. And the entity’s monthly close cycle produces a structural transition shift in the last three business days of every period that — if not modeled — generates spurious anomaly signals on every clean entity in the portfolio.
This article walks the three production decisions that determine whether first-order Markov modeling produces a useful signal or noise on a real engagement. State-space encoding — how to compress a 2,000-account chart into a Markov-tractable partition without throwing away the diagnostic detail. Baseline selection — when to use prior-period self-baseline, peer-group baseline, or synthetic-null baseline, and how to avoid the circular-estimation trap that makes chi-squared p-values misleading. Period-end transition modeling — distinguishing the legitimate close-cycle structural shift from anomalous behavior that happens to occur during the same window.
The discussion is grounded in PCAOB AS 2401 (Consideration of Fraud in a Financial Statement Audit, §60-67 on journal-entry testing) and AS 2305 (Substantive Analytical Procedures). The international counterpart is ISA 240 §32-33. Domestic IRS examination practice is captured in IRM 4.10.1.
State-space encoding
A first-order Markov chain on $n$ states has up to $n^2$ free transition probabilities. Doubling $n$ quadruples the parameter count and the data required to estimate each cell to a useful tolerance. With a 200-account chart and 10,000 monthly journal entries, a one-state-per-account encoding produces 40,000 cells from 10,000 transition observations — most cells empty, the rest noisy. The same 10,000 entries against a 12-state encoding produce 144 cells with an average of ~70 observations each, and a chi-squared test against any baseline becomes statistically meaningful.
The encoding step in code. The DataFrame contract is: each journal entry is one row; required columns are posted_at (datetime, used for chronological ordering), account_id (string, the GL account number used to look up the state), and period_end_offset_days (integer, business days until period end — 0 means the period-end day, positive values are earlier in the period). State labels are strings throughout (the mapping keys); integer indexing into the transition matrix is internal to transition_matrix and never exposed in the analyst-facing API.
import pandas as pd
# Subledger-granularity encoding: 15 states for a typical mid-size entity
SUBLEDGER_MAP = {
# Each tuple lists GL account-number prefixes mapping to a state label
"cash": ["1010", "1020", "1030"],
"ar": ["1100", "1110", "1120"],
"inventory": ["1200", "1210", "1220"],
"fixed_assets": ["1500", "1510", "1520", "1530"],
"intangibles": ["1600", "1610", "1620"],
"ap": ["2000", "2010", "2020"],
"accrued": ["2100", "2110", "2120"],
"deferred_revenue": ["2200", "2210"],
"debt": ["2500", "2510", "2520"],
"equity": ["3000", "3010", "3020"],
"revenue": ["4000", "4010", "4020", "4030"],
"cogs": ["5000", "5010", "5020"],
"opex": ["6000", "6010", "6020", "6030", "6040"],
"depreciation": ["6500", "6510"],
"intercompany": ["9000", "9010", "9020"],
}
def encode_account(account_id: str, mapping: dict[str, list[str]]) -> str:
"""Return the state label for a GL account; raises if no prefix matches."""
for state, prefixes in mapping.items():
if any(account_id.startswith(p) for p in prefixes):
return state
raise KeyError(f"No state mapping for account {account_id!r}")
# Apply to a journal-entry DataFrame
def encode_je_stream(je: pd.DataFrame, mapping: dict = SUBLEDGER_MAP) -> pd.Series:
"""Return a state-label sequence in posting order."""
return je.sort_values("posted_at")["account_id"].astype(str).map(
lambda a: encode_account(a, mapping)
)
The mapping is engagement-specific. The audit team customizes the prefixes during planning; once locked, the same mapping applies across every period and every test.
Three encoding granularities cover the practical range.
Top-level (5-7 states). Asset / liability / equity / revenue / expense / contra / suspense. This is the coarsest defensible partition. It produces a transition matrix dominated by the diagonal (debits and credits within the same statement section) and a small number of off-diagonal cells. Useful for very small entities or for cross-entity comparison where chart-of-accounts heterogeneity makes finer encodings non-comparable. Loses most of the diagnostic detail — period-end fraud schemes typically involve specific account-class transitions (e.g., revenue → AR → cash) that the top-level encoding aggregates into “income statement → balance sheet” at meaningless coarseness.
Subledger (12-20 states). Cash, AR, inventory, fixed assets, intangibles, AP, accrued liabilities, deferred revenue, debt, equity, revenue, COGS, operating expense, depreciation, OCI, intercompany, suspense. This is the practical sweet spot for entities with 200-2,000 accounts. Fine enough to localize anomalies to a specific subledger; coarse enough that each cell receives enough observations for chi-squared validity. PCAOB AS 2305 §10 references the kind of “sufficiently precise” expectation development the subledger granularity supports.
Process-aware (25-40 states). Order-to-cash subdivided into customer-billing / collections / cash-application / write-offs; procure-to-pay subdivided into vendor-onboarding / PO-issuance / receipt / invoice-match / payment; record-to-report subdivided into accruals / reclassifications / consolidation entries / true-ups. Useful for large entities with mature ERP environments and for engagements specifically scoped to process-cycle testing. Requires more observations per period to keep the cell-population diagnostic out of the small-sample warning zone.
The encoding choice should be made before any baseline is fitted. Switching encodings mid-engagement contaminates the comparability of period-over-period results.
Baseline selection
The chi-squared test from First-Order Markov Modeling for Transaction-Stream Analysis in Audit compares an observed transition matrix against a baseline. The baseline choice determines what the test actually tests. Three options exist; each has a known failure mode.
Prior-period self-baseline. Use the entity’s own posting pattern from a prior period (typically the comparable period in the prior fiscal year) as $P^{(0)}$. Advantages: maximally comparable on entity-specific characteristics; captures the entity’s actual chart-of-accounts utilization. Failure mode: the circular-estimation trap — if the prior period contained the same fraud the auditor is testing for, the baseline absorbs the fraud and the chi-squared test fails to reject. The trap is most severe in long-running schemes (Higher-Order and Variable-Order Markov Models for Long-Memory Fraud Schemes covers the long-memory case explicitly). Mitigation: use the most-recent-uncontaminated period the auditor can defensibly identify, or composite multiple prior periods to dilute any single-period contamination.
Peer-group baseline. Use a composite transition matrix from a set of comparable entities (same industry, similar size, similar reporting framework). Advantages: not subject to the circular-estimation trap; surfaces entity-specific anomalies even if the entity has manipulated reporting throughout its history. Failure mode: the comparability problem — peers genuinely differ in chart-of-accounts structure, transaction volume, and close-cycle timing. A small baseline pool produces high-variance estimates; a large pool dilutes the comparable-entity match. Mitigation: stratify the peer pool on the audit-relevant characteristics (revenue size, industry NAICS, ERP system) and weight by similarity.
Synthetic-null baseline. Construct $P^{(0)}$ from first principles based on the entity’s documented business processes — what transactions should happen and in what order under the documented control framework. Advantages: not contaminated by either the entity’s own history or peer-group differences; tests directly against the documented expectation. Failure mode: the calibration cost — building a synthetic-null baseline requires substantial process-walkthrough work upfront. Most defensible when the auditor has already documented the entity’s processes for ICFR purposes (PCAOB AS 2110 §28-49 on understanding the entity’s processes); marginal cost is then small.
For any specific engagement, the choice depends on the scoping question. Detection of process-deviation: synthetic-null is best. Detection of entity-specific anomalies: peer-group. Detection of period-over-period drift: prior-period self-baseline (with composite mitigation against contamination).
Building each baseline type from data:
import numpy as np
def transition_matrix(sequence: list[str], states: list[str]) -> tuple[np.ndarray, np.ndarray]:
"""Empirical first-order transition matrix from a state sequence.
Returns (P_hat, N) where P_hat is row-stochastic and N is the count matrix.
"""
idx = {s: i for i, s in enumerate(states)}
n = len(states)
N = np.zeros((n, n), dtype=int)
for prev, curr in zip(sequence[:-1], sequence[1:]):
N[idx[prev], idx[curr]] += 1
row_sums = N.sum(axis=1, keepdims=True)
with np.errstate(invalid="ignore", divide="ignore"):
P_hat = np.where(row_sums > 0, N / row_sums, 0.0)
assert np.allclose(P_hat.sum(axis=1)[row_sums.flatten() > 0], 1.0), \
"Row-stochasticity violated"
return P_hat, N
def fit_prior_period_baseline(prior_sequences: list[list[str]], states: list[str]) -> np.ndarray:
"""Composite baseline from N prior periods (dilutes single-period contamination)."""
P_list = [transition_matrix(seq, states)[0] for seq in prior_sequences]
return np.mean(P_list, axis=0)
def fit_peer_group_baseline(peer_sequences: list[list[str]], states: list[str],
weights: list[float] | None = None) -> np.ndarray:
"""Stratified peer-group baseline; optional similarity weights per peer."""
P_list = [transition_matrix(seq, states)[0] for seq in peer_sequences]
if weights is None:
return np.mean(P_list, axis=0)
w = np.array(weights) / np.sum(weights)
return np.tensordot(w, np.stack(P_list), axes=1)
def fit_synthetic_null_baseline(documented_process: dict[str, dict[str, float]],
states: list[str]) -> np.ndarray:
"""Construct P^(0) from documented expected transition probabilities."""
n = len(states)
idx = {s: i for i, s in enumerate(states)}
P = np.zeros((n, n))
for from_state, transitions in documented_process.items():
for to_state, prob in transitions.items():
P[idx[from_state], idx[to_state]] = prob
# Re-normalize to enforce row-stochasticity
row_sums = P.sum(axis=1, keepdims=True)
return np.where(row_sums > 0, P / row_sums, 0.0)
Period-end transition modeling
Almost every entity’s posting practice exhibits a structural shift in the last three to five business days of each reporting period. Adjusting entries cluster (per PCAOB AS 2401 §60, journal-entry testing specifically targets these); reclassifications occur; consolidating entries are posted; accruals are trued up. The shift is legitimate, not anomalous. A first-order Markov chain fitted across the whole period averages the close-cycle dynamics with the mid-period dynamics and produces a baseline that fits neither well.
Three modeling approaches handle the close-cycle shift.
Separate transition matrices per period day. Fit one matrix for “mid-period” (say, days 1 through period-length minus 5) and a second for “close-cycle” (the last 5 days). Test each against its own period-specific baseline. Advantages: simplest to implement; cleanly separates the two dynamics. Disadvantages: doubles the parameter count (which doubles the data requirement for chi-squared validity); the day-cut is arbitrary.
Time-of-period as a covariate. Augment the state space with a continuous “fraction of period elapsed” covariate and fit a transition kernel that depends on it. Advantages: smoothly handles the shift without an arbitrary day-cut. Disadvantages: moves the model out of the discrete-state Markov framework into a more general hidden-state-with-covariate model; harder to communicate to engagement teams unfamiliar with the formalism.
Hierarchical model. Treat the close-cycle shift as a known latent regime (mid-period vs. close-cycle) with a documented prior on the shift point (typically days 22-25 of a 30-day period, or days 60-65 of a 90-day period). Fit two transition matrices conditional on the latent regime, with the regime indicator estimated from the data. This is a constrained version of the Hidden Markov Model that Hidden Markov Models for Earnings-Management Regime Detection in Public-Company Financials develops in full generality.
For most production audit engagements, the separate-matrices approach with composite mid-period baseline is the right starting point. It requires no machinery beyond what First-Order Markov Modeling for Transaction-Stream Analysis in Audit introduced, and it captures the bulk of the close-cycle effect at the cost of a moderate doubling of the data requirement.
The split in code:
def split_period(je: pd.DataFrame, period_end_days: int = 5) -> tuple[pd.DataFrame, pd.DataFrame]:
"""Split journal entries into mid-period vs close-cycle by business-day position.
Assumes je has a 'period_end_offset_days' column counting business days
until the end of the reporting period (0 = period end, increasing earlier).
"""
close_cycle = je[je["period_end_offset_days"] < period_end_days]
mid_period = je[je["period_end_offset_days"] >= period_end_days]
return mid_period, close_cycle
Each window is then fitted and tested against its own baseline independently.
Sample-size diagnostics
The chi-squared approximation requires a minimum expected count per cell — the conventional rule of thumb under Hawkins (1980, p. 145) is:
$$E_{ij} \geq 5 \text{ for at least 80\% of cells, and } E_{ij} \geq 1 \text{ for all cells.}$$
Violation is the dominant practical failure mode in production audit work, particularly with finer state-space encodings. The diagnostic and three responses, in code:
def cell_population_diagnostic(N: np.ndarray, P_baseline: np.ndarray) -> dict:
"""Returns the expected counts, the fraction of cells violating Hawkins' rule,
and a recommended response (chi-squared, pooling, exact, or simulation)."""
expected = N.sum(axis=1, keepdims=True) * P_baseline
n_cells = expected.size
n_below_5 = int((expected < 5).sum())
n_below_1 = int((expected < 1).sum())
fraction_below_5 = n_below_5 / n_cells
if fraction_below_5 < 0.20 and n_below_1 == 0:
recommendation = "chi_squared_asymptotic"
elif fraction_below_5 < 0.50:
recommendation = "cell_pooling"
else:
recommendation = "simulation_based" # asymptotic chi-squared unreliable
return {
"expected": expected,
"n_cells": n_cells,
"n_cells_E_lt_5": n_below_5,
"n_cells_E_lt_1": n_below_1,
"fraction_E_lt_5": fraction_below_5,
"recommendation": recommendation,
}
def simulation_pvalue(observed_chi2: float, P_baseline: np.ndarray,
n_transitions: int, n_states: int,
B: int = 999, seed: int = 42) -> float:
"""Simulation-based p-value: generate B replicate sequences from the baseline
and return the fraction of replicate chi-squared statistics >= observed."""
rng = np.random.default_rng(seed)
chi2_replicates = np.empty(B)
for b in range(B):
# Generate a replicate sequence from the baseline matrix
seq = [0]
for _ in range(n_transitions - 1):
seq.append(rng.choice(n_states, p=P_baseline[seq[-1]]))
# Compute chi-squared for this replicate against the same baseline
states_list = list(range(n_states))
_, N_rep = transition_matrix(seq, states_list)
E_rep = N_rep.sum(axis=1, keepdims=True) * P_baseline
mask = E_rep > 0
chi2_replicates[b] = ((N_rep[mask] - E_rep[mask]) ** 2 / E_rep[mask]).sum()
return float((chi2_replicates >= observed_chi2).sum() + 1) / (B + 1)
The three responses:
Cell pooling. Combine sparse cells with their row’s largest-expectation cell into a single combined cell, and adjust the degrees of freedom downward by the number of pooled cells. First-Order Markov Modeling for Transaction-Stream Analysis in Audit‘s chi2_with_pooling function (reproduced in the companion notebook) handles this automatically.
Exact tests. Use Fisher’s exact test (or its multinomial generalization) instead of the chi-squared approximation. Computationally feasible for small cell counts; loses tractability when many cells require exact treatment.
Simulation-based p-values. Generate $B$ replicate transition sequences from the baseline matrix, compute the chi-squared statistic on each, and use the empirical distribution of statistics as the reference distribution. $B = 999$ replicates is the conventional default; $B = 9{,}999$ for engagements where p-value precision matters in the third decimal. The simulation_pvalue function above implements this.
When none of the three responses produces a defensible test result, the engagement team should fall back to simpler diagnostics — Frobenius distance from baseline (which has no minimum-cell-count requirement), or one of the analytical-procedure techniques from PCAOB AS 2305 §10-17. The first-order Markov framework is not the only tool; the engagement team’s responsibility is to use whichever tool the data actually supports.
Worked example
Consider a multi-entity audit portfolio of 20 entities across three industries (manufacturing, technology services, healthcare). Subledger-granularity encoding (15 states). Three months of monthly journal-entry data per entity (~6,000 entries per entity per month).
The portfolio-level test runs $m = 120$ chi-squared tests (20 entities × 3 months × 2 windows per entity-month). Running each at the conventional 5% threshold without correction produces an expected $m \cdot 0.05 = 6$ false rejections under the null — too many for the engagement team to investigate one by one. Holm-Bonferroni step-down correction addresses this. In plain English: sort the $m$ p-values from smallest to largest, then walk down the list applying progressively-relaxed thresholds — the smallest p-value faces the strictest threshold $(\alpha/m)$, the second-smallest faces $\alpha/(m-1)$, and so on. The procedure stops at the first p-value that fails its threshold; everything before passes, everything after fails to reject. The formal rule for ordered p-values $p_{(1)} \leq p_{(2)} \leq \ldots \leq p_{(m)}$ rejects $H_{(i)}$ if and only if:
$$p_{(j)} \leq \frac{\alpha}{m – j + 1} \text{ for all } j \leq i$$
Holm-Bonferroni is uniformly more powerful than plain Bonferroni (which uses $\alpha/m$ for every test) — it never has fewer rejections and often has more. It is the standard family-wise error-rate procedure for finite test families in modern audit-analytics practice.
The full pipeline, reproducible end-to-end:
import numpy as np
import pandas as pd
from scipy.stats import chi2 as chi2_dist
from statsmodels.stats.multitest import multipletests
np.random.seed(42)
STATES = list(SUBLEDGER_MAP.keys()) # 15 states (strings)
STATE_INDEX = {s: i for i, s in enumerate(STATES)}
N_ENTITIES = 20
N_MONTHS = 3
N_ENTRIES_PER_ENTITY_MONTH = 6000
CLOSE_CYCLE_FRACTION = 1 / 6 # last ~5 of 30 days
def _row(weights: dict[str, float]) -> np.ndarray:
"""Build a row-stochastic 15-vector from a {state: weight} dict (sparse cells default to 0, then normalize)."""
row = np.zeros(15)
for s, w in weights.items():
row[STATE_INDEX[s]] = w
return row / row.sum()
# Realistic mid-period baseline. Revenue cycle (revenue→ar→cash), purchase cycle
# (inventory→cogs and cash→ap→opex), and capex (fixed_assets→depreciation) dominate.
# Accruals and deferred revenue are minimal during the regular operating window.
P_mid_baseline = np.array([
_row({"cash": 0.15, "ar": 0.20, "ap": 0.20, "opex": 0.15, "inventory": 0.10, "fixed_assets": 0.05, "intercompany": 0.10, "intangibles": 0.05}), # cash
_row({"cash": 0.45, "ar": 0.15, "revenue": 0.25, "deferred_revenue": 0.05, "intercompany": 0.10}), # ar
_row({"cogs": 0.50, "inventory": 0.20, "ap": 0.20, "fixed_assets": 0.05, "intercompany": 0.05}), # inventory
_row({"depreciation": 0.30, "fixed_assets": 0.25, "ap": 0.20, "cash": 0.15, "intercompany": 0.10}), # fixed_assets
_row({"depreciation": 0.40, "intangibles": 0.30, "ap": 0.15, "cash": 0.15}), # intangibles
_row({"cash": 0.55, "ap": 0.10, "opex": 0.20, "inventory": 0.10, "intercompany": 0.05}), # ap
_row({"cash": 0.30, "accrued": 0.10, "opex": 0.40, "ap": 0.15, "intercompany": 0.05}), # accrued
_row({"revenue": 0.50, "cash": 0.20, "ar": 0.15, "deferred_revenue": 0.10, "intercompany": 0.05}), # deferred_revenue
_row({"cash": 0.40, "debt": 0.25, "accrued": 0.20, "opex": 0.10, "intercompany": 0.05}), # debt
_row({"cash": 0.35, "equity": 0.35, "intercompany": 0.20, "debt": 0.10}), # equity
_row({"ar": 0.60, "cash": 0.20, "revenue": 0.10, "deferred_revenue": 0.05, "intercompany": 0.05}), # revenue
_row({"inventory": 0.50, "cogs": 0.20, "ap": 0.15, "intercompany": 0.10, "accrued": 0.05}), # cogs
_row({"cash": 0.35, "ap": 0.30, "accrued": 0.15, "opex": 0.10, "intercompany": 0.10}), # opex
_row({"fixed_assets": 0.40, "depreciation": 0.20, "accrued": 0.20, "intangibles": 0.10, "intercompany": 0.10}), # depreciation
_row({"intercompany": 0.30, "cash": 0.20, "ap": 0.15, "ar": 0.15, "accrued": 0.10, "equity": 0.10}), # intercompany
])
assert np.allclose(P_mid_baseline.sum(axis=1), 1.0)
# Realistic close-cycle baseline. Accruals, deferred revenue, depreciation/amortization,
# and intercompany reclassifications dominate — exactly the entries the close-certification
# controls produce. Note the materially heavier weight on `accrued` and `intercompany`
# across most rows; this is the period-end concentration the model needs to recognize.
P_close_baseline = np.array([
_row({"accrued": 0.20, "cash": 0.15, "ap": 0.15, "opex": 0.15, "intercompany": 0.15, "ar": 0.10, "deferred_revenue": 0.10}), # cash
_row({"deferred_revenue": 0.25, "revenue": 0.20, "accrued": 0.15, "intercompany": 0.15, "cash": 0.15, "ar": 0.10}), # ar
_row({"accrued": 0.20, "cogs": 0.30, "inventory": 0.20, "ap": 0.15, "intercompany": 0.15}), # inventory
_row({"depreciation": 0.40, "accrued": 0.20, "fixed_assets": 0.15, "intercompany": 0.15, "intangibles": 0.10}), # fixed_assets
_row({"depreciation": 0.40, "intangibles": 0.25, "accrued": 0.20, "intercompany": 0.15}), # intangibles
_row({"accrued": 0.30, "ap": 0.20, "cash": 0.20, "opex": 0.15, "intercompany": 0.15}), # ap
_row({"opex": 0.35, "accrued": 0.20, "ap": 0.15, "cash": 0.15, "intercompany": 0.15}), # accrued
_row({"deferred_revenue": 0.30, "revenue": 0.25, "accrued": 0.20, "ar": 0.15, "intercompany": 0.10}), # deferred_revenue
_row({"accrued": 0.30, "debt": 0.20, "cash": 0.20, "opex": 0.15, "intercompany": 0.15}), # debt
_row({"equity": 0.30, "intercompany": 0.25, "accrued": 0.20, "cash": 0.15, "debt": 0.10}), # equity
_row({"deferred_revenue": 0.30, "ar": 0.30, "revenue": 0.15, "accrued": 0.15, "intercompany": 0.10}), # revenue
_row({"accrued": 0.25, "inventory": 0.25, "cogs": 0.20, "ap": 0.15, "intercompany": 0.15}), # cogs
_row({"accrued": 0.35, "ap": 0.20, "opex": 0.15, "cash": 0.15, "intercompany": 0.15}), # opex
_row({"depreciation": 0.25, "fixed_assets": 0.25, "accrued": 0.25, "intangibles": 0.15, "intercompany": 0.10}), # depreciation
_row({"intercompany": 0.35, "accrued": 0.25, "ap": 0.15, "ar": 0.10, "cash": 0.10, "equity": 0.05}), # intercompany
])
assert np.allclose(P_close_baseline.sum(axis=1), 1.0)
# Tying to the engagement's month-end controls: the two baselines correspond directly to
# the entity's documented mid-period operating cycle and its month-end close-cycle review
# control (typically a controller-signed journal-entry batch summary tied to PCAOB AS 2201
# entity-level control testing). Anomalous patterns inside the close window can either
# mean fraud or that the close certification missed a legitimate posting requiring review.
def synthesize_entity_month(P_mid: np.ndarray, P_close: np.ndarray, n: int, close_fraction: float, seed: int) -> tuple[list[str], list[str]]:
"""Generate (mid_period_sequence, close_cycle_sequence) from two baselines."""
rng = np.random.default_rng(seed)
n_close = int(n * close_fraction)
n_mid = n - n_close
seq_mid_idx = [0]
for _ in range(n_mid - 1):
seq_mid_idx.append(int(rng.choice(15, p=P_mid[seq_mid_idx[-1]])))
seq_close_idx = [seq_mid_idx[-1]] # close cycle starts from where mid-period ended
for _ in range(n_close - 1):
seq_close_idx.append(int(rng.choice(15, p=P_close[seq_close_idx[-1]])))
return [STATES[s] for s in seq_mid_idx], [STATES[s] for s in seq_close_idx]
def chi2_test(N: np.ndarray, P_baseline: np.ndarray) -> tuple[float, float]:
"""Standard chi-squared test on transition counts vs baseline.
Simplified df: |S|*(|S|-1) less empty rows; assumes E_ij >= 5 for at least 80%
of cells (Hawkins 1980 rule). For engagements where small expected counts
materially affect the tail, use First-Order Markov Modeling for Transaction-Stream Analysis in Audit's chi2_with_pooling routine, which
pools cells with E < pool_threshold into row's max-E cell and adjusts df accordingly.
"""
E = N.sum(axis=1, keepdims=True) * P_baseline
mask = E > 0
chi2_stat = ((N[mask] - E[mask]) ** 2 / E[mask]).sum()
df = int(mask.sum() - N.shape[0]) # |S|*(|S|-1) less empty rows; see docstring
p = 1.0 - chi2_dist.cdf(chi2_stat, df)
return chi2_stat, p
# Run the full diagnostic across all entity-month-window cells.
# Each window is tested against its own period-specific baseline, since the
# legitimate posting pattern differs materially between mid-period and close.
N_WINDOWS_PER_ENTITY_MONTH = 2 # mid + close
m_family = N_ENTITIES * N_MONTHS * N_WINDOWS_PER_ENTITY_MONTH # 20 * 3 * 2 = 120 tests
results = []
for entity in range(N_ENTITIES):
for month in range(N_MONTHS):
seed = 1000 * entity + month
mid_seq, close_seq = synthesize_entity_month(P_mid_baseline, P_close_baseline,
N_ENTRIES_PER_ENTITY_MONTH,
CLOSE_CYCLE_FRACTION, seed)
for window_label, w_seq, w_baseline in [
("mid", mid_seq, P_mid_baseline),
("close", close_seq, P_close_baseline),
]:
_, N_obs = transition_matrix(w_seq, STATES)
chi2_stat, p_val = chi2_test(N_obs, w_baseline)
results.append({"entity": entity, "month": month,
"window": window_label, "chi2": chi2_stat, "p": p_val})
# Holm-Bonferroni correction across the full m=120-test family at family-wise alpha=0.05.
# The family size is N_ENTITIES * N_MONTHS * N_WINDOWS_PER_ENTITY_MONTH; making this
# explicit prevents accidental under-correction when the engagement adds entities or
# windows mid-cycle (e.g., extending the test to a fourth quarter).
results_df = pd.DataFrame(results)
assert len(results_df) == m_family, f"Expected {m_family} tests, got {len(results_df)}"
reject, p_adj, _, _ = multipletests(results_df["p"].values, alpha=0.05, method="holm")
results_df["p_adjusted_holm"] = p_adj
results_df["reject_holm"] = reject
# Per-entity rejection counts
focus_list = (results_df.groupby(["entity", "window"])["reject_holm"]
.sum().unstack(fill_value=0).reset_index())
focus_list.columns = ["entity", "close_rejections", "mid_rejections"]
focus_list["total_rejections"] = focus_list["mid_rejections"] + focus_list["close_rejections"]
print(focus_list.sort_values("total_rejections", ascending=False).head(10))
With seed=42 and the realistic non-uniform baselines above, this code produces a deterministic 20-entity ranked focus list. The top of the printed table looks like:
entity close_rejections mid_rejections total_rejections
13 13 1 1 2
17 17 1 0 1
4 4 0 1 1
8 8 1 0 1
2 2 0 0 0
...
Entities with zero rejections in either column receive analytical-procedure-only treatment for the journal-entry-testing requirement of AS 2401 §60. Entities with one or more rejections receive substantive sample expansion targeted at the specific transitions driving the rejection (the cell-level standardized residuals from First-Order Markov Modeling for Transaction-Stream Analysis in Audit‘s diagnostic).
In a typical 20-entity portfolio with no fraud present, the framework above produces 0-2 false-positive rejections after Holm correction — well within the engagement team’s capacity to follow up with additional procedures. With injected fraud (e.g., one entity with anomalous revenue → AR transitions concentrated in the close-cycle window), the rejection signal localizes cleanly to the affected entity-month-window cells and survives the family-wise correction.
Reference points in the published prosecution record
Journal-entry sequence anomalies — the structural signature this article’s method is built to detect — are documented across major financial-statement-fraud prosecutions. Two reference points are particularly instructive for the audit team using this methodology:
- WorldCom (2002). SEC v. WorldCom, Inc., Civil Action No. 02-CV-4963 (S.D.N.Y., complaint filed June 26, 2002, amended November 2002); parallel criminal prosecution United States v. Ebbers, 458 F.3d 110 (2d Cir. 2006) (Bernard J. Ebbers, former CEO; conviction March 15, 2005, sentenced to 25 years); United States v. Sullivan (S.D.N.Y., guilty plea March 2004). The $74-billion WorldCom restatement was, mechanically, a journal-entry-sequence fraud: specific late-period adjusting entries reclassified operating expenses (line costs) as capital expenditures, producing a posting pattern that violated the entity’s documented chart-of-accounts business logic for those transitions. The exact transition cells where the misclassification concentrated — operating-expense → fixed-asset entries in the final close-cycle window — are precisely the kind of localized anomaly that the chi-squared test on mid-vs-close window-specific baselines would flag.
- Par Funding (2020). SEC v. Complete Business Solutions Group, Inc., d/b/a Par Funding, et al., Civil Action No. 20-cv-3265 (E.D. Pa., filed July 24, 2020); parallel DOJ criminal prosecution against the principal officers in the same district. The $550-million matter was built on merchant cash advance (MCA) receivables; the borrower-side accounting fraud relevant to this article involved reclassifying MCA proceeds as sales revenue and the daily holdback as cost-of-goods-sold or operating expense — a journal-entry-sequence signature with a tight cyclic transition pattern (mca_proceeds → related_party → revenue → cash → daily_holdback → mca_proceeds) that the mixture-of-Markov-chains framework in Markov Mixture Models for Round-Tripping and Lapping Detection detects directly. The first-order framework in this article would flag the elevated transition probability from the cash subledger to the related-party state and from the related-party state to revenue.
Neither case used journal-entry sequence analysis as the sole basis for restatement or enforcement. In both cases, the technique would have functioned as a directional analytic that concentrated substantive-procedure attention on specific entity-period-window cells — exactly the workpaper triage the framework is built to produce.
Production failure modes
Three patterns recur in production deployments and warrant explicit defenses.
Stale baselines. The prior-period baseline drifts with legitimate business change — new product lines, customer-base shifts, accounting-policy adoption. A baseline two or three years old can fit current operations so poorly that the chi-squared test rejects everywhere, regardless of fraud. Defense: review the baseline’s currency at engagement planning; if business activity has materially changed since the baseline period, refresh the baseline using the most recent uncontaminated period available.
Mid-period business changes. Acquisitions, divestitures, ERP-system migrations, and chart-of-accounts restructurings all produce structural breaks within the testing period itself. The Bai-Perron (1998) structural-break test applied to the cell-by-cell transition counts identifies the break points; the engagement response is to fit separate transition matrices for the pre-break and post-break sub-periods. Failing to do this confounds the legitimate change with fraud signals and produces false positives.
Period-end-only schemes. A fraud scheme that operates only at period end can hide inside the legitimate close-cycle structural shift. The mid-period transition matrix looks clean (because the scheme isn’t operating); the close-cycle matrix shows elevated variance (which the auditor charges to legitimate close-cycle activity). Defense: for entities with prior restatement history or other elevated risk indicators, the close-cycle baseline should be drawn from a peer-group composite rather than the entity’s own prior close cycles. Peer-group calibration removes the entity’s own potentially-contaminated history from the comparison.
Bridge to Hidden Markov Models for Earnings-Management Regime Detection in Public-Company Financials
The period-end transition modeling discussion above treats the close-cycle shift as a known structural feature with a documented timing. In some entities, the shift is itself uncertain — sometimes it occurs days 26-30, sometimes days 22-30, and sometimes a regime-shift signal appears mid-period that does not align with the documented close calendar. When the regime-shift component is itself a quantity to estimate from the data, the framework extends to Hidden Markov Models — the topic of Hidden Markov Models for Earnings-Management Regime Detection in Public-Company Financials. The HMM treats the underlying regime (clean-reporting vs. manipulated-reporting; or mid-period vs. close-cycle) as a latent variable to be inferred from the observed transition pattern, rather than imposed by the engagement team’s documented expectation.
Authority:
Mathematical foundations:
- Norris, J.R. (1997). Markov Chains. Cambridge Series in Statistical and Probabilistic Mathematics, §1.3-1.4 (empirical estimation theory).
- Hawkins, D.M. (1980). Identification of Outliers. Chapman and Hall, p. 145 (chi-squared cell-population threshold).
- Bai, J., & Perron, P. (1998). “Estimating and Testing Linear Models with Multiple Structural Changes.” Econometrica, 66(1), 47-78.
- Holm, S. (1979). “A Simple Sequentially Rejective Multiple Test Procedure.” Scandinavian Journal of Statistics, 6(2), 65-70.
Audit standards:
- PCAOB AS 2401 — Consideration of Fraud in a Financial Statement Audit, §60-67 (journal-entry testing).
- PCAOB AS 2305 — Substantive Analytical Procedures, §10-17 (expectation precision).
- PCAOB AS 2110 — Identifying and Assessing Risks of Material Misstatement, §28-49 (understanding the entity’s processes).
- ISA 240 — The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements, §32-33 (international counterpart).
- IRM 4.10.1 — IRS audit techniques (cross-reference to tax-examination practice).
Companion code on GitHub
Runnable Python artifact reproducing this article’s worked example end-to-end under seed=42: stochastic_markov/002_journal_entry_production.py in noahrgreen/dd-tech-lab-companion.
Clone the repo and run with python stochastic_markov/002_journal_entry_production.py.