ACFE CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Exam Practice Test

Best practices emphasize separation:

“Interviews should be conducted one-on-one to reduce the possibility of collusion, contamination, or intimidation of witnesses” (Fraud Examiners Manual – Interviewing Guidelines).This ensures independent and uncontaminated statements.

TheFraud Examiners Manualnotes:

“Management of an organisation should ensure that the organisation has a proper and effective document retention policy in place… An effective policy requires clear retention protocols… and should be immobilised due to a pending investigation or foreseeable litigation.”

Thus, the existence of a document retention policy is a critical factor in deciding how to dispose of evidence.

“Credit card records… show card purchasing limits, previous payment history, account balance,when and where the subject has travelled, restaurants frequented, and assets acquired. In short, these records show the movements and habits of the person”.

Therefore,Bis correct.

According to CFE guidance, when planning interviews, fraud examiners should:

“Consider what the interview is intended to accomplish and state an objective.

Review the case file to ensure that important information has not been overlooked.

Prepare a list of topics and general questions.

Choose a neutral and nonthreatening environment so the subject does not feel intimidated.”

Holding the interview in a venue intended to make the subject feel uncomfortableviolates proper CFE interview practice. Hence,Dis correct.

Pretexting is defined asimpersonating someone else or making false/misleading statements to obtain information. Many jurisdictions specifically prohibitpretexting against financial institutions, which includes pretending to be a customer to access their bank account information.

TheFraud Examiners Manualnotes:

“Companies are formed by submitting some type of organisational filing… these company records are generally public records and will include: corporate name, ownership information, location of the principal office, date of incorporation”.

The Prep guide also confirms: “A company’s organisational filing with the government generally includes information about the company’s ownership, initial shareholders, and the location of its principal office”.

The Manual defines leading questions as those that contain or suggest the answer:

“Leading questions… are framed in a way that evokes a specific reply… most commonly used to confirm facts already known… Example: ‘You got promoted, right?’”

Nathaniel’s question, “When were you promoted to manager?” presumes the promotion occurred. Thisleadsthe subject by suggesting a fact that may not be true. It is not open (does not invite free narration), not complex (it asks one thing), and not closed (doesn’t call for yes/no but presumes an answer).

TheFraud Examiners Manuallistsspecific queries for accounts payable analysis, including:

“Review recurring monthly expenses and compare to posted/paid invoices.”.

While comparing book vs. tax depreciation applies toasset management(not A/P), and identifying paycheck anomalies applies topayroll(not A/P), the most effective A/P-specific test is the recurring expense comparison. Hence,Cis correct.

Websites ending in “.onion” are only accessible via specialized browsers (e.g., Tor). The Fraud Examiner prep materials note:

“.onion sites are part of the dark web, which is distinct from the surface web and deep web. Accessing requires specialized browsers” (CFE Prep – Investigations).Thus, Jade must use a dark web browser.

Observing signs of wealth (sports car, home remodeling) may raise suspicion, but by itself it doesnot provide sufficient predicationto accuse or notify management of fraud. The proper next step is to conduct discreet inquiries to determine if further evidence exists before escalating.

TheFraud Examiners Manualdefines double-negative questions as those containingtwo forms of negation in a single clause. They are confusing and “often suggest an answer opposite to the correct one.” The example given is almost identical to the question here:

“Didn’t you suspect that something wasn’t right?”.

Thus, Sylvia’s question is adouble-negative question, which should be avoided.

TheFraud Examiners Manualnotes:

“Fraud examiners are often tasked with tracing illicit transactions… For example, a victim of fraud might want a tracing search to facilitate the recovery of criminal proceeds”.

TheFraud Examiners Manualstates:

“Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction… emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive”.

Thus, statement C isNOT true.

When a respondent says “I’m too busy,” it can be diffused by stressing “the interview will be short, the interviewer is already there, the project is important, [and] the interview will not be difficult”.

Thus, stressing brevity is the recommended reaction.

Fraud examiners mustnot opine on guilt, innocence, intent, or disposition. Reports should focus onfacts and expert conclusions within their field. The Manual stresses:

“The fraud examiner should refrain from expressing opinions as to the guilt or innocence of any person or entity. Such conclusions are reserved for the trier of fact” (Fraud Examiners Manual, Reporting section).

Options A, B, and D relate toaccounting and internal control assessments, which fall within an accounting expert’s scope. OnlyCis improper because it speculates about the suspect’s character or intent, which is outside the CFE’s role.

“Once a denial is uttered, it becomes extremely difficult for the accused to change his response, because doing so would be an admission that he lied. Therefore, the interviewer must prevent an outright denial, thereby making it easier for the subject to confess”.

“One of the most effective techniques to stop or interrupt a denial is through a delaying tactic… the interviewer should attempt to delay the outright denial; he should not argue with the accused”.

Thus, Charles should interrupt with a delaying tactic.

“Alibis generally can be diffused by displaying physical evidence… evidence should be displayed one piece at a time, in reverse order of importance”【16:2014 International Fraud Examiners Manual.pdf†L11-L14】.

The Prep Guide warns: “The proper technique is not to lay it all out at once” .

Thus, showing everything at once is theleast effective.

“In jurisdictions that regulate credit information and personal data, a fraud examiner will generally need a legally acceptable reason for accessing such information from third parties… some common circumstances include when: the individual has given consent”.

Thus, with the individual’s consent, Leslie could obtain the report.

“Internal sources will sometimes be the only resource for certain types of documents—such as… employee personnel files—unless the fraud examiner has the subject’s consent or a legal order”.

External searches may reveal addresses, assets, or competitor ownership, butpersonnel files require internal/non-public access.

Detailed Explanation with Extracts= The Fraud Examiners Manual states:

“When reporting the results of a fraud examination, it is best to include copies (not originals) of important documents in the formal report”.

Originals should be safeguarded separately for evidence; reports should use copies.

Therefore, the statement is true.

TheFraud Examiners Manualclarifies:

“The recommendations section is optional, and there might be instances where the fraud examiner wishes to discuss remedial measures or specific recommendations in a separate document”.

The Prep guide also states: “A written report might include a section for recommendations”.Thus, it isnot requiredin every report.

Fraud examiners can obtain documentary evidence by consent, subpoena, or other legal means. While oral consent may sometimes be sufficient,bank records from financial institutions generally require written consent. Without written consent, the bank is not required to provide access. As stated in the manual:

“Accessing a subject’s bank records from financial institutions, for instance, generally requires written consent. If no consent is given… legal action might be required, most often a subpoena or other court order”.

Thus, although the suspect gave oral consent, Alex cannot access the bank records without written authorization or legal order.

When dealing with potentially hostile or volatile interviewees, fraud examiners are advised not to give much advance notice. This reduces the chance that the subject will prepare evasive or combative responses. TheFraud Examiners Manualemphasizes minimizing preparation time for resistant interviewees to ensure more candid responses.

The Fraud Examiners Manual explains that recommendations in a report areoptional, not mandatory. When included, they should cover remedial measures such as control reviews or increased security.

“Finally, the fraud examiner might decide to include a section for recommendations. The recommendations section should containremedial measures or specific recommendations for follow-up actions… This section is optional”.

Therefore,Cis correct. Options A and D are incorrect because recommendations are not required in every report, and B misstates its purpose.

“To locate people using online records… First, when searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

This aligns with the Prep guide: “Obtaining a past address of the subject should be the first step in trying to locate a subject using online records”.

Thus, B is correct.

When preparing to interview subjects across jurisdictions, fraud examiners must consider bothlegal rightsandcultural differences. The Manual advises examiners to:

Researchlocal lawsgoverning the right to counsel during interviews.

Understand cultural norms (e.g., greetings, eye contact).Failing to observe these can damage credibility. Thus, it is most accurate that an examiner must determine whether the subject can legally insist on a lawyer’s presence .

TheFraud Examiners Manualadvises:

“Do not slow down the interview process for note-taking. Instead, jot down key words … In general, it is better to err on the side of taking too few notes rather than too many.”

Therefore, the best practice isC.

During admission-seeking interviews, when suspects persist with denials or alibis, examiners are trained to diffuse them. Accepted techniques include:

Discussing testimony of witnesses,

Displaying physical evidence, and

Downplaying the strength of evidence.

However, manuals caution that discussing a suspect’sprior deceptionsis not an effective or recommended method to diffuse alibis. It risks confrontation and may damage rapport, reducing chances of confession.

Therefore, optionCis the exception.

The Fraud Examiners Manual and CFE Prep Guide explain that tracing loan proceeds is a key investigative tool, but its scope is limited. Specifically, it helps determine:

if proceeds were deposited into hidden accounts,

if hidden accounts were used for loan payments, and

if loans were secured by hidden assets or unknown witnesses.

However, the manuals do not state that tracing loan proceeds can identify internal control weaknesses. That is a different aspect of fraud examination, often addressed through audit procedures or control assessments.

Thus, optionDis NOT true.

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

Before conducting surveillance, a memorandum should document thebasis for the covert operation, including: (1) the information the operation is based on, (2) expected information to be gained, (3)identities of suspects(subjects) if known, and (4) operatives under the examiner’s control. Confidential sources should not be identified by name but referred to symbolically.

Fraud examination reports are not written only for internal use. The2014 International Fraud Examiners Manualclearly emphasizes:

“When drafting a report, fraud examiners must consider who might end up reading it. Fraud examiners should keep in mind that the fraud examination report will be read by the general public and adverse parties. Under no circumstances should the fraud examiner prepare a communication with the idea that the information will not be disclosed to adverse third parties. Fraud examiners should draft their reports with this caveat in mind.”

The manual further specifies the wide range of potential readers:

*“There are many individuals and groups that might end up reading a fraud examination report, including the following parties:

Company insiders (managers, board of directors, owners, investors, etc.)

Attorneys (legal counsel, prosecutors, regulators, and defense counsel)

Defendants and witnesses

Press and media outlets

Judges or juries”*

This aligns with theCFE Prep - Investigationsstudy guide, which also confirms:

“There are many parties that might read a fraud examination report, including company insiders, attorneys, defendants and witnesses, press and media outlets, and judges or juries.”

????Interpretation:

The mediamay access the report through litigation disclosures or leaks.

Opposing legal counselwill review the report during discovery or trial.

Investors and owners(company insiders) are primary stakeholders.

Thus, the only correct choice isD. All of the above, because fraud examination reports must be written withall possible audiences in mind, ensuring accuracy, clarity, impartiality, and professionalism to withstand scrutiny from multiple directions.

TheFraud Examiners Manualmakes clear:

“Fraud examiners should never offer opinions regarding guilt or innocence. Reports must be factual, objective, and free from speculation. Statements implying guilt are improper.”

Thus, while it is proper to note contradictions, evidence, or control weaknesses, it isimproper to declare the suspect guilty.

TheFraud Examiners Manualemphasizes that before commencing legal action to recover assets, the examiner must consider whether the defendant has assets worth pursuing:

“The most important question a fraud examiner should ask before beginning legal action to recover assets is whether the defendant has sufficient property or money to satisfy a judgment. Legal actions can be time-consuming and costly, and recovery efforts are futile if the defendant is judgment-proof.”

Before commencing legal action to recover assets, themost critical considerationis whether the defendant hasrecoverable assets. If the defendant lacks property or funds, pursuing legal action could be costly and ultimately fruitless.

From the2014 International Fraud Examiners Manual:

“After a fraud is discovered, fraud examiners might need to assist in making a recommendation concerning the recovery of lost assets… A domestic judgment against a foreign defendant is usually helpful for recovering the defendant’s assets located in the domestic country, but might be worthless for obtaining the defendant’s assets in a foreign country.”

This emphasizes that enforcement of judgments is only meaningful if assets exist to satisfy them.

Similarly, theCFE Prep - Investigationsmaterial highlights asset tracing and recovery as the foundation for deciding legal action:

“Records obtained from financial institutions are perhaps the single most important financial source available to fraud examiners for purposes of tracing assets.”

????Interpretation of Answer Choices:

A. Prior arrests→ Not directly relevant to whether asset recovery will succeed.

C. Statute of limitations→ Important for legal viability, but meaningless if no assets exist to recover.

D. Guilt of the suspect→ Guilt must be established in criminal cases, but in civil recovery,asset availability is paramount.

B. Defendant’s property or money→ This is themost importantpractical question, because without assets, recovery efforts will not yield compensation regardless of guilt or legal timelines.

The manuals explain that in verbal confessions, subjects oftenunderestimatethe amounts to minimize guilt, not overestimate. The process involves moving from accusation to benchmark admission, handling lies tactfully, and obtaining details by chronology, transaction, or event. Thus, optionBis NOT true.

Nonverbal deception cues include feigned unconcern, slouching, chewing objects, and manipulating clothing. Michelle’s conduct (chewing pen cap, picking at fabric, appearing unconcerned) matches these signs ofdeception.

“Introductory questions should be designed to establish rapport… Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Jason’s small talk about sports and compliments is clearly rapport building

TheFraud Examiners Manualexplains:

“Before running tests on the data, the fraud examiner must make certain the data being analysed are relevant and reliable for the objective of the engagement… Using the profile of potential frauds as a guide, the fraud examiner must identify the target data for analysis”.

The2014 International Fraud Examiners Manualprovides:

“Fraud examiners can use a correlation analysis to determine the relationships between different variables in raw data… For example, there should be a strong correlation between the independent and dependent variables because there is a direct relationship between them.Hotel costs should increase as the number of days travelled increases.”

CFE Prep – Investigationsechoes this:

“Using the correlation analysis function, fraud examiners can determine the relationships between different variables in the raw data. For example…Hotel costs should increase as the number of days travelled increases.”

Thus, the most useful analysis isCorrelation analysis.

The2014 Fraud Examiners ManualandCFE Prepexplain:

“Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.”

Thus, the correct answer isA.

The2014 International Fraud Examiners Manualexplains:

“Often, the most important evidence exists only in the form of volatile data (e.g., RAM)… If the evidence that a formally trained computer investigator needs to collect exists only in the form of volatile data stored in volatile computer memory such as RAM, and the data is expected to disappear when the computer is shut down, he should collect the data live from the suspect computer.”

Also,

“If the computer is off, leave it off… Booting up a system can alter its files… Accordingly, turning a system on could damage and taint any evidence.”

Thus, themost accurate statementisD— live data collection may be performed directly if volatile data is required.

Both the Manual and CFE Prep guides emphasize thatdeleted files are recoverable until overwritten. Once overwritten, the original data cannot be retrieved:

“Deleted files are recoverable until they are overwritten because data is not erased… until overwritten. So, deleted files that have been overwritten generally arenot recoverable.”

Other file types (deleted shortcuts, hidden files, etc.) can often be recovered, butoverwritten files are lost permanently.

TheCFE Prep – Investigationsexplains:

“Metadata is a type of computer-generated data that can be helpful in a fraud investigation. Metadata information can help determine who wrote a document; who received, opened, copied, edited, moved, or printed the document; and when these events occurred” .

Thus, metadata is the most useful for identifying who created a document.

Guidance on reports:

“A fraud examination report should be accurate, clear, and impartial. The fraud examiner should avoid technical jargon where possible and write in plain language so that readers without specialized knowledge can understand”.

Reports should only include relevant, factual findings—not every detail or opinion.

So, the most accurate statement is that jargon should be avoided.

In admission-seeking interviews, one rationalization technique is todepersonalize the victim(e.g., shifting the perception so the harm was against a company, not individuals). The example in the question—“It isn’t like you took something from a friend or neighbor”—is exactly this technique.

“When searching for an individual, the fraud examiner shouldobtain a past address of the subject, and search activities should begin with that information”.

Therefore, saying a past address is “of no help” is incorrect.

Both the Manual and CFE Prep guides emphasize that forensic imaging is essential because:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging… allows a fraud examiner to view and analyse… without altering the original data in any way”.

A forensic image is anexact, sector-by-sector copyof the drive. Thus, imaging preserves evidence integrity.

The Fraud Examiners Manual states that admission-seeking interviews should avoid yes/no questions like“Did you steal the money?”because they encourage denials. Instead, the question should be phrased as if guilt has already been established. The Manual explicitly warns:

“The accusation should be made in the form of a statement; it should not be made in the form of a question… Avoid emotive words such as steal, fraud, and crime… Example:‘It is not so much a question of what you did, but why you did it.’”

Thus, the most effective admission-seeking phrasing is:“Why did you take the money?”because it presumes involvement and encourages explanation rather than denial.

Link analysis is described as avisual analytic toolthat:

“Tracks the movement of money,”

“Demonstrates complex networks,”

“Helps identify indirect relationships with several degrees of separation,” and

“Discovers communications, patterns, and trends.”

It doesnotdisplay financial ratios—that belongs to traditionalfinancial statement/ratio analysis.

“Securities regulators… require disclosures that typically include: corporate financial statements, identification of officers and directors, identification of significant owners… and a history of the business”【10:2014 International Fraud Examiners Manual.pdf†L73-L95】.

Thus, regulatory securities records are the best source for financial statements.

The organizational filings with the government of the jurisdiction in which the company is incorporated

Explanation: Organizational filings (e.g., articles of incorporation) are generally public records and includeownership information, initial shareholders, and the location of the principal office.