CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Questions and Answers

The Fraud Examiners Manual explains:

“Before running tests on the data, the fraud examiner must make certain the data being analysed are relevant and reliable for the objective of the engagement… Using the profile of potential frauds as a guide, the fraud examiner must identify the target data for analysis”.

The CFE Prep – Investigations states:

“If a fraud examiner gets a verbal confession from the fraudster, it does not matter whether the fraudster claims his conduct was an accident. The following items of information should be obtained … admission that the accused knew the conduct was wrong, facts known only to the confessor, the accused’s motive, approximate dates, involvement of others, physical evidence, and disposition of illicit income.”

Thus, the examiner does not need a statement about accident.

The Fraud Examiners Manual states:

“The primary concern when analysing digital evidence is to maintain the integrity of the data at all times. Fraud examiners must be careful with computer equipment because a careless investigator might inadvertently alter important evidence”.

Examiners must look for both inculpatory and exculpatory evidence.

The manual and CFE Prep list the main limitations:

Coverage varies by jurisdiction.

Searches are limited in area.

Records are often abstracts.

Information may be inaccurate or outdated.

Searches can be erratic.

Nowhere is “difficulty in finding database companies” mentioned.

The Fraud Examiners Manual explains that rather than drafting an exhaustive list of questions, the interviewer should:

“formulate a brief outline of key points to discuss during the interview”.

This helps organize thoughts while allowing flexibility.

The Fraud Examiners Manual lists specific queries for accounts payable analysis, including:

“Review recurring monthly expenses and compare to posted/paid invoices.”.

While comparing book vs. tax depreciation applies to asset management (not A/P), and identifying paycheck anomalies applies to payroll (not A/P), the most effective A/P-specific test is the recurring expense comparison. Hence, C is correct.

“Securities regulators… require disclosures that typically include: corporate financial statements, identification of officers and directors, identification of significant owners… and a history of the business”【10:2014 International Fraud Examiners Manual.pdf†L73-L95】.

Thus, regulatory securities records are the best source for financial statements.

“The interviewer generally should indicate his name and company, but he should avoid stating his title. In general, the more informal the interview, the more relaxed the respondent”.

Introducing oneself only by name and company (not title like CFE or auditor) avoids intimidation and builds cooperation.

“Signs of stress do not always mean that a subject is lying… While lying and deception do cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

The Prep guide confirms: “While lying and deception do indeed cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

Therefore, Carlos should not automatically conclude deception from stress behaviors.

According to the CFE Prep - Investigations study guide:

“It is recommended that any witnesses who are considered potentially volatile be interviewed without advance notice. Surprise should be employed in any interview that is considered potentially volatile. In many instances, the potentially volatile respondent is unaware that he is going to be questioned, and will therefore be unprepared. If the interview is not conducted by surprise, the interviewer runs the risk of the respondent not showing up, showing up with a witness, or being present with counsel. A target’s friends, relatives, and romantic interests often make for a difficult interview. They perceive that the fraud examiner is deliberately targeting someone close to them.”

???? Interpretation for this scenario:

Brianna is described as very protective of her boyfriend, making her a potentially volatile witness.

Best practice is to avoid giving her advance notice (which might increase hostility, resentment, or allow preparation).

Conducting the interview with little or no notice reduces the risk of interference, ensures she is unprepared, and prevents her from appearing with legal counsel or allies.

Body language alone (e.g., avoiding eye contact) cannot be taken as proof of deception. The Manual warns against drawing conclusions from a single behavioral cue:

“Avoiding eye contact is not directly linked to deception. Such behavior could stem from cultural norms, nervousness, or personality traits. Examiners should consider clusters of behavior, context, and corroborating evidence before concluding deception”.

Therefore, C is correct.

Both the CFE Prep Guide and the Fraud Examiners Manual state that every fraud examination must be conducted under the assumption that litigation will result. This ensures that evidence is collected and preserved properly, in compliance with legal standards:

“Each fraud examination should begin with the proposition that the case will end in litigation… If the fraud examiner assumes that litigation will occur, he will conduct the examination in accordance with the proper rules of evidence”.

This principle protects the integrity of the examination and ensures admissibility of evidence if the matter proceeds to court.

Detailed Explanation with Extracts = The Fraud Examiners Manual states:

“When reporting the results of a fraud examination, it is best to include copies (not originals) of important documents in the formal report”.

Originals should be safeguarded separately for evidence; reports should use copies.

Therefore, the statement is true.

The calibration (or norming) process in interviews is meant to establish a baseline of the subject’s normal verbal and nonverbal behavior. This is done by asking noncritical background questions so that later deviations can be more reliably identified.

From the CFE Prep guide:

“The proper way an interviewer should start the calibration (norming) of a witness is through the use of: Noncritical questions on background information. … Examples of noncritical questions include ‘When did you start with the company?’ and ‘How long is your commute?’”.

Thus, the correct answer is D. “How many jobs have you had before this one?” since it is a nonthreatening background question.

The Fraud Examiners Manual explains:

“Each transaction on a blockchain ledger is recorded with a cryptographic address… by analyzing these addresses, fraud examiners can sometimes establish patterns and connections that identify users or link them to criminal activity”.

The Fraud Examiners Manual states:

“Records obtained from financial institutions are perhaps the single most important financial source available to a fraud examiner for tracing purposes”.

These records reveal deposits, withdrawals, transfers, and are essential in asset tracing.

Phone records are classified as nonpublic records. The Fraud Examiners Manual explains that personal telephone and mobile records usually require consent, subpoena, or warrant to access. Public records, by contrast, include real property ownership and corporate filings. Therefore, B is correct.

Limitations of online public record searches include:

Need to search multiple jurisdictions.

Records are often only abstracts.

Information must be verified for accuracy.There is no mention that online record vendors are “difficult to find.” In fact, many such vendors exist.

The Manual emphasizes that interviews should be held where the respondent feels comfortable and secure, not threatened:

“When possible, the interview should be held in a venue where the subject will feel comfortable and secure”.

Holding it in an uncomfortable setting is counterproductive and contrary to best practices.

The 2014 Fraud Examiners Manual and CFE Prep explain:

“Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.”

Thus, the correct answer is A.

When a respondent says “I’m too busy,” it can be diffused by stressing “the interview will be short, the interviewer is already there, the project is important, [and] the interview will not be difficult”.

Thus, stressing brevity is the recommended reaction.

“Once a suspect utters a denial, it becomes extremely difficult… therefore, the interviewer must prevent an outright denial. Fraud examiners can use several techniques to stop or interrupt denials, including delays, repeated interruptions, and reasoning”.

Thus, the correct answer is D.

The Fraud Examiners Manual states:

“Duplicate testing is used to identify transactions with duplicate values in specified fields … fields such as cheque numbers, invoice numbers, and government identification numbers … searching for duplicates within these fields can help the fraud examiner find anomalies that merit further examination”.

This directly addresses Tony’s need to ensure no two invoices have the same number.

The Fraud Examiners Manual states:

“The expenditures method works best when the subject spends illicit income on consumables (e.g., travel and entertainment), because when the subject spends the illicit income, it will not cause an increase in net worth.”

CFE Prep confirms:

“The expenditures method … is best used when the subject spends illicit income on consumables (such as travel and entertainment) that would not cause an increase in net worth.”

Thus, the correct answer is A.

The Fraud Examiners Manual notes:

“Fraud examiners are often tasked with tracing illicit transactions… For example, a victim of fraud might want a tracing search to facilitate the recovery of criminal proceeds”.

The best practices for signed statements include:

Adding omitted facts as an addendum.

Preparing separate statements for unrelated offenses.

Having witnesses to the signing.

But:

“The signed statement should be reduced to a short and concise written statement. The interviewer should prepare the statement and present it to the confessor for his signature” .

Thus, requiring the suspect to handwrite the entire statement is not a best practice.

“Internal sources will sometimes be the only resource for certain types of documents—such as… employee personnel files—unless the fraud examiner has the subject’s consent or a legal order”.

External searches may reveal addresses, assets, or competitor ownership, but personnel files require internal/non-public access.

The Fraud Examiners Manual defines double-negative questions as those containing two forms of negation in a single clause. They are confusing and “often suggest an answer opposite to the correct one.” The example given is almost identical to the question here:

“Didn’t you suspect that something wasn’t right?”.

Thus, Sylvia’s question is a double-negative question, which should be avoided.

The Fraud Examiners Manual advises avoiding prematurely alerting perpetrators. Recommended methods include:

“Conducting investigations at times when the suspect is not present (such as nonbusiness hours)”.

This avoids tipping off suspects.

The correct answer is: Whether recording is legal depends on consent laws — so the most helpful question is effectively: “Is consent required from one or all parties to record this conversation?”

Among the provided choices, the closest match is NOT listed explicitly. But based on the ACFE manuals, the correct interpretation is that none of the technical details (audio/video, file format, time, duration) matter — only the legal consent requirement matters.

Complete Detailed Explanation with Exact Extracts from Fraud Examiner (CFE) - Investigation Documents: =

The 2014 International Fraud Examiners Manual states:

“In some circumstances, recording an interview might be illegal. Some jurisdictions limit an employer’s right to record employee interviews during an investigation. In fact, in some jurisdictions, audio recording an interview is permitted only with the consent of all parties to the communication. Thus, fraud examiners should always consult with an attorney when deciding whether to record an interview.”

It further emphasizes:

“A telephone recording consent form stipulates where, when, and with whom telephone conversations can be recorded… Be cautioned that the form alone does not make the conduct of recording a telephone conversation illegal or legal.”

???? Interpretation:

The legality of recording has nothing to do with:

Audio vs video (A)

Digital file format (B)

Work hours (C)

Duration (D)

Instead, it depends entirely on jurisdictional consent laws (one-party vs all-party consent).

The Fraud Examiners Manual explains that recommendations in a report are optional, not mandatory. When included, they should cover remedial measures such as control reviews or increased security.

“Finally, the fraud examiner might decide to include a section for recommendations. The recommendations section should contain remedial measures or specific recommendations for follow-up actions … This section is optional”.

Therefore, C is correct. Options A and D are incorrect because recommendations are not required in every report, and B misstates its purpose.

To confirm ownership of a building, real estate and permit records are most useful. The Manual notes that real property records and related permits identify the owner, provide legal descriptions, and show improvements such as construction of commercial buildings. Court or voter registration records would not typically establish property ownership.

“When searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

Therefore, saying a past address is “of no help” is incorrect.

The Fraud Examiners Manual and CFE Prep Guide explain that tracing loan proceeds is a key investigative tool, but its scope is limited. Specifically, it helps determine:

if proceeds were deposited into hidden accounts,

if hidden accounts were used for loan payments, and

if loans were secured by hidden assets or unknown witnesses.

However, the manuals do not state that tracing loan proceeds can identify internal control weaknesses. That is a different aspect of fraud examination, often addressed through audit procedures or control assessments.

Thus, option D is NOT true.

“Introductory questions should be designed to establish rapport… Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Jason’s small talk about sports and compliments is clearly rapport building

The 2014 International Fraud Examiners Manual states:

“The information contained on a wire transfer generally will include the following items:

• The amount of the transfer

• The date of the transfer

• The name of the sender or originator

• The routing number of the originating bank or financial institution.”

Therefore, the correct answer is C.

The Fraud Examiners Manual makes clear that covert operations are extraordinary measures that require high skill and planning and should be used only when no other practical method is available. They carry significant risks, including embarrassment, liability, and even injury or death. Therefore, covert operations should not be the first resort but instead follow conventional evidence-gathering efforts.

The Fraud Examiners Manual notes:

“Management of an organisation should ensure that the organisation has a proper and effective document retention policy in place… An effective policy requires clear retention protocols… and should be immobilised due to a pending investigation or foreseeable litigation.”

Thus, the existence of a document retention policy is a critical factor in deciding how to dispose of evidence.

Best practices emphasize separation:

“Interviews should be conducted one-on-one to reduce the possibility of collusion, contamination, or intimidation of witnesses” (Fraud Examiners Manual – Interviewing Guidelines).This ensures independent and uncontaminated statements.

Signs of stress (e.g., shallow breathing, stuttering, shifting posture) do not automatically equal deception. The Fraud Examiners Manual states:

“Signs of stress do not always mean a subject is lying. An honest subject might feel stress simply by being questioned. Conclusions must be based on clusters of behavior and corroborating evidence, not a single indicator”.

“Due to the risks of illicit transactions, most jurisdictions require financial institutions to obtain information about the ownership and control of the foreign bank with which they maintain correspondent relationships”.

When dealing with potentially hostile or volatile interviewees, fraud examiners are advised not to give much advance notice. This reduces the chance that the subject will prepare evasive or combative responses. The Fraud Examiners Manual emphasizes minimizing preparation time for resistant interviewees to ensure more candid responses.

The recommended questioning order is:

“As a general rule, questioning should proceed from the general to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

Credit reports can sometimes be obtained legally if proper consent or a recognized legal basis (such as employment background checks, extension of credit, or legal proceedings) exists. The Manual notes:

“Access to personal credit data may be permitted when the individual has given consent or when required for employment, credit, or legal reasons”.

Thus, it is not true that credit data can never be obtained—circumstances exist where it can be done lawfully.

The manual emphasizes that interviews—especially with subjects in other jurisdictions—pose legal and cultural considerations. Fraud examiners must consider cultural norms (such as personal space, body language, and eye contact) and jurisdiction-specific laws governing the use of information from interviews. In particular, some jurisdictions limit how interview information can later be used. Therefore, the most accurate statement is that the examiner should verify such limitations before proceeding.

When preparing to interview subjects across jurisdictions, fraud examiners must consider both legal rights and cultural differences. The Manual advises examiners to:

Research local laws governing the right to counsel during interviews.

Understand cultural norms (e.g., greetings, eye contact).Failing to observe these can damage credibility. Thus, it is most accurate that an examiner must determine whether the subject can legally insist on a lawyer’s presence .

The 2014 International Fraud Examiners Manual provides examples of data analysis for accounts payable:

“Examples of data analysis queries that can be performed to help detect fraud through examination of accounts payable include:

• Audit paid invoices for manual comparison with actual invoices.

• Summarise large invoices by amount, vendor, etc.

• Identify debits to expense accounts outside of set default accounts.

• Reconcile cheque registers to disbursements by vendor invoice.”

While other functions apply to payroll or asset management, the most effective function for accounts payable fraud detection is to summarize large invoices by amount and vendor.

Best practices when working with confidential informants include documenting payments and identities in ways that protect anonymity but avoid risks. The Fraud Examiners Manual and CFE Prep emphasize avoiding cash payments because they reduce transparency and create audit trail problems. Paying in cash is therefore NOT considered a best practice, whereas using initials, obtaining receipts, and documenting informant information in reports can be acceptable methods.

Digital forensics guidance stresses:

If the computer is off, do not turn it on, because booting will alter files and timestamps.

If the computer is on and volatile data is needed (e.g., RAM), a formally trained examiner may collect it live. Otherwise, simply unplugging the system (hard shutdown) preserves volatile evidence better than a graceful shutdown.

Thus, if the evidence exists only in volatile data and the system is running, Nobles may collect it via the normal interface.

✅ Answer: A. If Lucas's computer is running, Nobles may retrieve data… if the evidence exists only in volatile data

CFE methodology stresses that fraud examinations should be conducted with the assumption that the matter could end in litigation, which directly affects evidence-handling decisions. If litigation is reasonably anticipated, organizations often must preserve potentially relevant records through measures such as litigation holds and suspension of normal record-retention/destruction practices. Disposing of evidence while litigation is likely (or while a duty to preserve could exist) can create serious consequences, including sanctions, adverse inferences, monetary penalties, and other legal repercussions for spoliation or failure to preserve evidence. Because the central risk is future legal proceedings—civil, criminal, regulatory, or employment-related—the most important consideration when deciding whether evidence can be disposed of is whether additional litigation is likely or could reasonably arise. The physical form of evidence (A) affects preservation techniques, but it is not the key decision driver for disposal. Reporting summaries (C) do not replace original evidence. Whether evidence is direct or circumstantial (D) is not the deciding factor; both can be critical depending on the case. Thus, likelihood of future litigation is the most important factor.

The digital forensics section of the Fraud Examiners Manual stresses:

No single forensic tool can recover everything.

Each has strengths and weaknesses.

Therefore, it is best to use a combination of tools during analysis.

Additionally, the examiner must look for both inculpatory and exculpatory evidence, while maintaining data integrity.

This aligns exactly with answer B.