Lesson 4 of 8
Conditional probability
A forensic score flagged 16.7 percent of US listings on one day. Working out what a flag is worth needs the rarity of the thing, not the accuracy of the test.
By Javier Sanz
Founder of ValueScreener. Built Ninety Nine, a securities services provider, and sold it to a tier-one global bank; ran operations and internationalization at Alpaca, the brokerage API.
Who writes thisEditorial processLinkedIn (opens in a new tab)X (opens in a new tab)
In one minute
- The chance of A given B is not the chance of B given A, and swapping the two is the most expensive error in this subject.
- A test's accuracy and the usefulness of its flags are different questions, connected by how rare the thing is.
- When the target is rare, most of what even a good test flags will not be the target.
A forensic score flags a company. The useful question is: given the flag, how likely is the company to be doing the thing. That is not the same question as: given the thing, how likely is the score to flag it. The second is what a paper reports and the first is what a reader needs.
How often one forensic score flags a US listing
- Flagged, above minus 1.78687
- Not flagged3,430
The notation, in words
Write the chance of A, given that B is true, as "A given B". Two facts make this lesson.
First, "A given B" and "B given A" are different numbers. The chance that somebody flagged is manipulating accounts is not the chance that a manipulator gets flagged.
Second, going from one to the other requires a third number: how common the thing is in the first place. Without it the conversion cannot be done at all.
The measured flag rate
On 13 September 2026, 687 of the 4,117 active US equity listings holding a computed M-Score sat above the published cutoff of minus 1.78. That is 16.7 percent of them.
Now ask what the flag is worth. Caught accounting manipulation among US listed companies in any one year is nowhere near 16.7 percent. Whatever the true rate is, it is a small fraction of that, which means most of those 687 are not manipulators. The arithmetic of why follows without needing to know the exact rate.
Why the large group wins
The clean group here is roughly fifty times the size of the misstating group. Even a small error rate applied to a group that large produces more flags than a high catch rate applied to a small one. That relationship is fixed and has nothing to do with which score is used.
It also explains why improving a test's catch rate barely helps. Going from catching 80 percent of real cases to catching 100 percent adds 16 more true flags to a list of 687. The share that is real moves from 9.6 percent to about 12 percent, and the list is still mostly false alarms.
What to do with a flag
Treat it as an instruction to read, which is exactly what the corpus already says about this score. The flag has done its job if it moved a company from the thousands you will never open to the dozens you will. It has not told you anything about that company yet.
The error to avoid is the reverse reading: taking a 16.7 percent flag rate as a claim that one company in six is misstating its accounts. That claim is not in the data and the data cannot support it.
Check yourself
A score flags 16.7 percent of listings. What does that tell you about how many companies are misstating accounts?
- That about 16.7 percent are
- Nothing on its own, because the flag rate is not the underlying rate
- That fewer than 16.7 percent are, and the difference is the error rate
Show the answer
Answer: B.
A flag rate combines real cases with false alarms. Separating them needs the underlying rate, which has to come from somewhere other than the flag count.A test catches 80 percent of real cases. The real cases are 2 percent of the population. What is most of the flagged list?
- Real cases
- False alarms from the much larger clean group
- Impossible to say without the test's specificity
Show the answer
Answer: B.
The clean group is 49 times larger, so even a modest error rate on it produces more flags than a high catch rate on the small real group. The specificity follows from the measured total rather than being needed separately.Raising a screen's catch rate from 80 percent to 100 percent, with everything else fixed, does what to the share of its flags that are real?
- Roughly doubles it
- Moves it slightly, from about 9.6 percent to about 12 percent
- Has no effect at all
Show the answer
Answer: B.
The missing true cases are few, because the real group is small. The false alarms come from the large clean group and are untouched by a better catch rate.Sources
- Beneish, Financial Analysts Journal, 1999, "The Detection of Earnings Manipulation": the M-Score and its published cutoff of minus 1.78.
- M-Score values computed by ValueScreener across 4,117 active US equity listings, read from this product's own store on 13 September 2026. Banks, capital markets firms, equity REITs, insurers and mortgage REITs are withheld from this score and are not in the count.
- Kahneman and Lovallo, 'Timid Choices and Bold Forecasts: A Cognitive Perspective on Risk Taking', Management Science, 1993, on starting from the reference class rather than the specific case.
What this leaves out
- The 687 and the 4,117 are counts on one date. Every other figure in the worked example rests on an assumed underlying rate and an assumed catch rate, both labelled in the table.
- No published measurement of how many US listed companies are misstating accounts in a given year is used here, because we do not hold one. The arithmetic is shown at an assumed rate precisely so the reader can substitute their own.
- Listings are counted, not deduplicated companies.
- A flag is a reason to read a filing. It is not a finding about any company.
- Nothing here is advice about any security.