CFE-Financial-Transactions-and-Fraud-Schemes Certified Fraud Examiner - Financial Transactions and Fraud Schemes Exam Questions and Answers

Detailed Explanation:

Rationale for Correct Answer: This is a false sale scheme, in which an employee processes fictitious transactions (such as false refunds, voids, or no-sales) to conceal theft of merchandise. Here, Brenda pretends to conduct a sale but records no payment.

Analysis of Incorrect Options:

A. Register disbursement scheme – Involves fraudulent refunds or disbursements of cash, not merchandise theft.

C. Purchasing and receiving scheme – Refers to inventory fraud during procurement, not point-of-sale theft.

D. Skimming scheme – Involves theft of cash before it enters accounting records, not merchandise theft.

Key Concept: Cash receipts and register manipulation schemes.

Detailed Explanation:

Rationale for Correct Answer: Cash larceny is the theft of cash after it has been recorded in the company’s books. Skimming, in contrast, is theft of cash before recording.

Analysis of Incorrect Options:

B & D – Both describe forms of skimming (unrecorded or understated sales).

C – Kickback scheme is corruption, not cash theft.

Key Concept: Distinguishing cash larceny (on-book theft) from skimming (off-book theft).

Detailed Explanation:

Rationale for Correct Answer:Weak or poor collection and recording procedures create opportunities for employees to skim. Without strong controls over cash receipts and documentation, employees can divert funds without detection.

Analysis of Incorrect Options:

A. Revenue sources and recording procedures – Too general; it is weak procedures that matter.

C. Internal audits and recording procedures – Audits help detect fraud, not enable it.

D. Register manipulations and recording procedures – Describes concealment, not the root cause.

Key Concept:Control weaknesses enable skimming.

Detailed Explanation:

Rationale for Correct Answer: Corporate spies do use social engineering, but their primary methods include surveillance, infiltration (e.g., posing as employees), and technical monitoring. The statement in option C is false because searching desks/workstations is a tactic, but it is not the primary method.

Analysis of Incorrect Options:

A – True; fake badges are a common infiltration tactic.

B – True; low-level jobs provide physical access.

D – True; technical surveillance is a recognized method.

Key Concept: Methods of corporate espionage.

Detailed Explanation:

Rationale for Correct Answer:This is False. Accounting is based on the objectivity principle, requiring that records and financial information be supported by objective, verifiable evidence (e.g., invoices, contracts, receipts). Subjective evidence would undermine reliability.

Analysis of Incorrect Options:

A. True – Incorrect, as subjectivity is discouraged in accounting.

B. False – Correct, since accounting relies on objective documentation.

Key Concept:Objectivity principle in accounting.

Detailed Explanation:

Rationale for Correct Answer:Studies by the ACFE consistently show that inventory and equipment are the most commonly misappropriated noncash assets. They are highly liquid, valuable, and often difficult to monitor without strong controls.

Analysis of Incorrect Options:

A. Interest & Collusion – Not physical assets.

C. Inventory & Purchase – Purchase is a process, not a physical asset.

D. Sales & Equipment – Sales are transactions, not assets.

Key Concept:Noncash asset misappropriation — inventory and equipment are the primary targets.

Detailed Explanation:

Rationale for Correct Answer:The accounting definition of assets, as cited by Marshall and in GAAP frameworks, is “probable future economic benefits obtained or controlled by a particular entity as a result of past transactions or events.” This definition underlies balance sheet recognition of assets.

Analysis of Incorrect Options:

B. Liabilities – Represent probable future sacrifices, not benefits.

C. Credentials – Irrelevant to financial reporting.

D. None of the above – Incorrect since “assets” directly matches.

Key Concept:Definition of Assets under financial accounting frameworks.

Detailed Explanation:

Rationale for Correct Answer: Misuse of noncash assets occurs when employees use company assets for personal purposes without authorization. Even though the vehicle was returned undamaged, unauthorized use and concealment by false statements makes it a fraud scheme under asset misappropriation.

Analysis of Incorrect Options:

A – Incorrect; unauthorized use with deception constitutes fraud.

B – Expense reimbursement involves falsified claims for travel/expenses, not vehicle misuse.

D – Financial statement fraud involves misstating accounting entries, unrelated here.

Key Concept: Misuse of company assets (noncash) as part of asset misappropriation.

Detailed Explanation:

Rationale for Correct Answer:Conflict of interest schemes occur when an employee, manager, or agent has an undisclosed personal interest in a transaction that is adverse to their employer. The Fraud Examiners Manual (2020) notes that one of the most common forms is when an employee has a hidden ownership or financial interest in a vendor that does business with the company. This compromises objectivity and creates self-dealing risks.

Analysis of Incorrect Options:

B. Salesman interest – Too narrow and not representative of the standard conflict scheme definition.

C. Purchaser interest – Purchasers are often involved, but the broader definition encompasses all employees.

D. Dealer interest – “Dealership interest” is not a recognized ACFE fraud scheme classification.

Key Concept: Conflict of Interest scheme under Corruption.

Detailed Explanation:

Rationale for Correct Answer:When a single employee is responsible for opening the mail and recording payments, the risk of theft of incoming checks is greatest. This lack of segregation of duties allows one person both custody of funds and recordkeeping authority, a classic internal control weakness.

Analysis of Incorrect Options:

B & C – Involving two or more employees provides better segregation of duties, reducing the risk.

D. None of the above – Incorrect since option A directly matches.

Key Concept:Segregation of duties to prevent skimming/theft of incoming checks.

Detailed Explanation:

Rationale for Correct Answer:This statement is True. Fraud examiners often analyze purchases by vendor to detect schemes where a single vendor receives disproportionately favorable treatment. This may indicate kickbacks, conflicts of interest, or vendor collusion schemes.

Analysis of Incorrect Options:

B. False – Incorrect, as vendor analysis is a valid tool to identify such schemes.

Key Concept:Purchases by vendor analysis as a fraud detection method.

Detailed Explanation:

Rationale for Correct Answer:The word delude means to mislead the mind or judgment so completely that the truth is obscured. In fraud examination, this aligns with the ACFE definition of fraud as a “deliberate misrepresentation that causes another to act to their detriment.” Fraud is not merely a false statement; it involves concealment or suppression of the truth with the intent to induce reliance. Thus, delude most accurately represents the deeper essence of fraud.

Analysis of Incorrect Options (Distractors):

A. Deceive: While fraud does involve deception, this word does not fully convey the thoroughness of obscuring the truth that fraud entails.

C. Mislead: This implies causing error or leading astray but lacks the complete concealment aspect central to fraud.

D. Beguile: Often connotes charm or trickery rather than the intentional concealment that characterizes fraud.

Key Concept:This question tests the definition and essence of fraud — specifically that fraud is not only about deceiving but about deluding, or thoroughly misleading, in a way that obscures the truth.

Detailed Explanation:

Rationale for Correct Answer:According to SAB 104, revenue recognition requires persuasive evidence of an arrangement. This does not exist if there is no written contract, purchase order, or verbal agreement supporting the transaction.

Analysis of Incorrect Options:

A. Revenue and expenses don’t match – Violates matching principle, not persuasive evidence.

C. Timings not meet properly – Refers to delivery/performance, not evidence of arrangement.

D. Capitalized expenses and liabilities – Irrelevant to revenue recognition.

Key Concept:Revenue recognition requirement: Persuasive evidence of an arrangement.

Detailed Explanation:

Rationale for Correct Answer: A major red flag of a Ponzi scheme is when the promoter has custody and control over investor funds with little to no independent oversight. This centralization allows them to use new investor money to pay old investors while concealing losses.

Analysis of Incorrect Options:

A – Ponzi operators usually pressure investors to reinvest, not take payouts, to keep funds circulating.

C – Schemes often involve overly complex or secretive strategies, not simple ones.

D – Realistic fluctuations based on markets suggest legitimate investing, not a Ponzi scheme (which typically reports steady, unrealistic returns).

Key Concept: Ponzi schemes rely on lack of oversight, unrealistic returns, and control of funds by promoters.

Detailed Explanation:

Rationale for Correct Answer:Recognized schemes for stealing inventory include:

Larceny schemes (direct theft)

Asset requisition and transfer schemes (false requisitions to divert assets)

Purchasing and receiving schemes (over-ordering or falsifying deliveries).

“Sales & Equipment handling” is not a defined fraud scheme, making D correct.

Analysis of Incorrect Options:

A. Larceny schemes – Valid theft method.

B. Asset requisition and transfer – Document manipulation method.

C. Purchasing and receiving schemes – Valid misappropriation scheme.

Key Concept:Inventory theft schemes under the Fraud Tree.

Comprehensive and Detailed Explanation From the ACFE Fraud Examiners Manual

Why the correct answer is Human Intelligence

The ACFE Fraud Examiners Manual, in the section on fraud examination tools and intelligence gathering, discusses methods of obtaining information from individuals. One of the recognized methods is Human Intelligence (HUMINT).

The Manual explains that human intelligence gathering involves:

Collecting information directly from people—often through conversation, elicitation, or interviews—sometimes while using a pretext to encourage the target to disclose information.

In this scenario:

Georgina poses as a customer (a pretext),

Contacts an employee of ERO Corp., and

Elicits sensitive information directly from that individual.

This aligns perfectly with the definition of human intelligence gathering—information obtained directly from human sources, often under false pretenses.

Why the other options are incorrect

B. Scavenging – Incorrect

The Manual describes scavenging as:

Obtaining information by searching for discarded documents or materials, such as in trash or recycling bins.

Georgina is not going through discarded materials; she is speaking directly with an employee.

C. Baiting – Incorrect

Baiting typically refers to:

Enticing someone with something of value to trick them into taking an action, often involving malware-infected media or fraudulent offers.

Georgina is not offering anything or luring the employee with incentives.

D. Open-source intelligence – Incorrect

Open-source intelligence (OSINT) refers to gathering information from:

Publicly available sources such as websites, publications, databases, or social media.

Georgina is not using public sources; she is actively eliciting confidential information from a person under false pretenses.

ACFE Manual References

The concepts used in this answer derive from the Fraud Examiners Manual (2020 International Edition), including:

Human intelligence and data collection techniques

Scavenging as an investigative method

Baiting schemes

Open-source intelligence descriptions

Detailed Explanation:

Rationale for Correct Answer:Card skimming/shimming occurs when a fraudster captures payment card data with a hidden device. In this case, the employee secretly scans the customer’s card with a small device — a textbook example of skimming.

Analysis of Incorrect Options:

A. Server keeps the card – This is theft of the card, not skimming.

B. Imitation website – This is phishing, not skimming.

D. None of the above – Incorrect since option C is correct.

Key Concept: Payment card fraud — skimming/shimming devices.

Detailed Explanation:

Rationale for Correct Answer: EFT fraud involves the unauthorized transfer of money from victims’ accounts using stolen access credentials. A hacker using stolen log-in details to redirect funds is the textbook example.

Analysis of Incorrect Options:

A – Describes identity theft/credit card fraud, not EFT fraud.

C – Describes skimming of card data, not EFT.

D – Describes payroll fraud, not EFT.

Key Concept: EFT fraud = unauthorized access to electronic banking/payment systems.

Detailed Explanation:

Rationale for Correct Answer: Expense reimbursement schemes are a common type of fraudulent disbursement. Requiring employees to submit receipts electronically improves controls by ensuring legibility, reducing the chance of altered or duplicate submissions, and creating a digital audit trail. This measure is recommended in the Fraud Examiners Manual as part of strengthening internal controls over reimbursement processes.

Analysis of Incorrect Option:

B. False – Incorrect because electronic receipt submission is indeed a recognized anti-fraud measure.

Key Concept: Fraudulent disbursements prevention through documentation controls.

Detailed Explanation:

Rationale for Correct Answer: This scheme is a business email compromise (BEC), also known as CEO fraud. Fraudsters impersonate high-ranking executives to trick employees into transferring money or disclosing confidential information.

Analysis of Incorrect Options:

A. Reverse social engineering – Involves the fraudster posing as a helper and then exploiting the victim, not impersonating executives.

B. Executive email attack – A generic term, but the ACFE recognizes BEC as the precise classification.

C. Electronic piggybacking – Refers to unauthorized access through another user’s session, not impersonation.

Key Concept: Social engineering and cyber-enabled fraud – BEC schemes.

Detailed Explanation:

Rationale for Correct Answer:Conflict of interest is often uncovered through proactive investigative methods such as tips, vendor ownership review, and employee interviews. Underbilling schemes, however, relate to Financial Statement Fraud and Revenue Recognition Manipulation, not conflict of interest detection.

Analysis of Incorrect Options:

A. Tips & Complaints – Common detection method; many corruption schemes are revealed this way.

B. Review of vendor ownership files – Critical to identify hidden ownership ties.

D. Interviews with purchasing personnel – Helps detect suspicious relationships or favoritism.

Key Concept: Detection of Conflict of Interest schemes.

Detailed Explanation:

Rationale for Correct Answer: One of the strongest internal controls against fraudulent billing schemes (such as shell companies, inflated invoices, and kickbacks) is to require competitive bidding. This ensures transparency, reduces favoritism, and makes it harder for employees and vendors to collude.

Analysis of Incorrect Options:

A – Fraud tips are valuable, but routing them only through supervisors may suppress reporting; hotlines are more effective.

B – Combining purchasing and payment increases fraud risk by reducing segregation of duties.

D – Outsourcing negotiations does not directly prevent billing fraud.

Key Concept: Internal controls and segregation of duties in preventing billing schemes.

Detailed Explanation:

Rationale for Correct Answer: Misrepresenting income, employment, or creditworthiness on a mortgage application is a classic example of residential loan fraud. This type of fraud occurs when borrowers provide false information to qualify for loans they would not otherwise receive.

Analysis of Incorrect Options:

B. Credit data blocking – Refers to suppressing negative credit information with fraudulent disputes.

C. Double-pledging collateral – Involves using the same collateral for multiple loans.

D. Linked financing – Occurs when loans are structured with related transactions to disguise financial exposure.

Key Concept: Loan and mortgage fraud – misrepresentation of borrower information.

Detailed Explanation:

Rationale for Correct Answer:When a tangible asset is stolen (removed from the books), a debit entry would be missing its corresponding credit, leaving the books out-of-balance. Fraudsters often conceal this imbalance by falsifying entries (e.g., creating fictitious expenses or adjusting asset accounts).

Analysis of Incorrect Options:

A. Journal Entries – Too general; not the condition of the books.

C. False debits – A concealment method, but not the direct result.

D. None of all – Incorrect because “out-of-balance” is accurate.

Key Concept:Concealment of asset theft and impact on accounting records.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters typically change the contact information (e.g., phone number, email) to prevent the true account holder from receiving alerts about suspicious activity. Leaving the contact information unchanged would risk detection. Thus, option B is NOT a common fraudster tactic.

Analysis of Incorrect Options:

A – True; fraudsters steal funds or make purchases.

C – True; known as “credential stuffing” or account chaining.

D – True; phishing is a primary way to obtain credentials.

Key Concept: Cyber-enabled fraud – account takeover schemes.

Detailed Explanation:

Rationale for Correct Answer:Management may overstate financial statements to (B) meet performance criteria, (C) trigger bonuses/compensation, or (D) show growth to enhance valuation for sale.However, when seeking to comply with debt covenants, management typically understates liabilities or expenses — not overstates performance. Thus, A is not aligned with overstatement motives.

Analysis of Incorrect Options:

B, C, D – All are recognized motives for overstating business performance.

A. Comply with debt covenants – More linked to manipulation of liabilities (often understatement), not overstatement of revenue.

Key Concept:Motives for overstatement in financial statement fraud.

Detailed Explanation:

Rationale for Correct Answer:When cash is stolen, the accounting equation (Assets = Liabilities + Equity) must still balance. Fraudsters may increase a liability (e.g., record fictitious payables) to cover the missing cash. This is a common concealment method.

Analysis of Incorrect Options:

A. Increasing another asset – Would require inflating assets, but this usually affects financial statement fraud, not cash theft concealment.

B. Increasing owners’ equity – Not logical without legitimate earnings or capital contributions.

D. Creating fictitious revenue – Used in financial statement fraud, not in balancing theft concealment.

Key Concept: Concealment methods for asset misappropriation — offsetting missing cash with fictitious liabilities.

Detailed Explanation:

Rationale for Correct Answer:Employees involved in bribery or corruption schemes often exhibit lifestyle red flags such as gambling habits, drug/alcohol addiction, or extravagant spending. These behaviors create financial pressures that may motivate or result from corrupt activity.

Analysis of Incorrect Options:

A, B, C individually – Each is a red flag, but the most accurate answer is all of the above.

Key Concept:Behavioral red flags in corruption cases.

Detailed Explanation:

Rationale for Correct Answer: Bid manipulation schemes occur in the procurement process and involve altering the bidding environment (e.g., extending deadlines, prematurely opening competitor bids, or changing submitted bids). Using low-quality materials is a post-award performance fraud, not bid manipulation.

Analysis of Incorrect Options:

A, C, D – All are recognized bid manipulation tactics.

Key Concept: Procurement fraud schemes – bid manipulation vs. contract performance fraud.

Detailed Explanation:

Rationale for Correct Answer:Skimming is difficult to detect because the stolen cash is never recorded (“off-book”). Therefore, it is often discovered by accident — such as customer complaints, discovery of missing deposits, or unexpected reconciliations — rather than through audits or routine controls.

Analysis of Incorrect Options:

A. Internal audits – Effective for many frauds but weak at uncovering skimming because records appear normal.

C. Internal controls – Preventive controls may deter but cannot detect unrecorded theft.

D. Occupational frauds – Too broad and not a detection method.

Key Concept:Detection of Skimming — most often accidental.

Comprehensive and Detailed Explanation

Why the correct answer is: False accounting entry

According to the ACFE Fraud Examiners Manual – Financial Transactions and Fraud Schemes, under Financial Institution Fraud → Types of Embezzlement Schemes, the Manual provides explicit descriptions of relevant banking fraud schemes, including false accounting entries.

The Manual lists False Accounting Entries as a form of embezzlement in which an employee manipulates general ledger accounts or other accounting records to conceal a theft or unauthorized activity:

“False Accounting Entries” are specifically categorized as a type of embezzlement scheme used by dishonest bank employees to hide misappropriated funds.

In this question, the accountant:

Adjusted the bank’s general ledger

With the intent to conceal the theft of customer funds

This aligns exactly with the ACFE definition of false accounting entries, which involve altering legitimate financial records to hide fraudulent actions.

Therefore, the best ACFE-defined description of the scheme is:

→ False accounting entry (Option B)

Why the other options are incorrect

A. Unauthorized withdrawal

The Manual separately defines Unauthorized Withdrawals as a type of embezzlement in which a bank employee directly removes funds from accounts without permission:

“Unauthorized Withdrawals” are listed as a distinct embezzlement scheme involving unapproved removal of customer funds.

However, in this scenario, the defining act is manipulating ledger records, not simply withdrawing funds. The nature of the concealment technique makes false accounting entry the correct classification.

C. Moving money from inactive accounts

The Manual defines:

“Moving Money from Customers’ Dormant or Inactive Accounts” as a scheme in which employees transfer funds from inactive accounts to themselves.

In this question, the stolen funds come from an active customer account, so this option does not apply.

D. Unauthorized disbursement of funds

The Manual includes:

“Unauthorized Disbursement of Funds to Outsiders” as another type of financial institution fraud.

This refers to payments made to external parties without authorization—not to ledger manipulation to hide theft.

Again, the defining characteristic in the scenario is the use of false ledger entries, which makes Option B the most accurate according to ACFE terminology.

Detailed Explanation:

Rationale for Correct Answer: Synthetic identity theft occurs when fraudsters combine real identifiers (e.g., SSN, tax ID) with fictitious details to create a “new” identity. This differs from traditional identity theft, where a real person’s identity is used in full.

Analysis of Incorrect Options:

B. Simulated identity theft – Not a standard fraud classification.

C. Traditional identity theft – Uses a complete stolen identity, not a hybrid.

D. Criminal identity theft – Involves using someone else’s identity when charged with a crime.

Key Concept: Synthetic identity theft as an evolving form of fraud.

Detailed Explanation:

Rationale for Correct Answer:Fictitious or fabricated revenues are one of the most common forms of financial statement fraud. They involve recording revenues for transactions that never occurred, thereby inflating income and misleading stakeholders.

Analysis of Incorrect Options:

B. Financial revenues – Not a fraud scheme.

C. Red flag revenues – “Red flags” are indicators of fraud, not a type of revenue.

D. Concealed revenues – Refers to hiding income, not creating fictitious sales.

Key Concept:Fictitious revenues as a core financial statement fraud scheme.

Detailed Explanation:

Rationale for Correct Answer: Economic extortion occurs when someone demands payment or benefit under threat of harm (explicit or implicit). A government official demanding money in exchange for awarding a contract is classic extortion.

Analysis of Incorrect Options:

A – This is a billing scheme (fraudulent disbursement), not extortion.

C – This is a kickback scheme (corruption).

D – This is an illegal gratuity scheme (reward after action).

Key Concept: Types of corruption—extortion vs. bribery vs. gratuities.

Detailed Explanation:

Rationale for Correct Answer:Tangible assets are those that can be physically perceived (touched, seen, etc.) and appraised (assigned a measurable value). Examples include buildings, land, equipment, and inventory. Both characteristics are correct, making C the best choice.

Analysis of Incorrect Options:

A. Capable of being perceived – True, but incomplete.

B. Capable of being appraised – True, but incomplete.

D. Neither A nor B – Incorrect since both statements are accurate.

Key Concept:Tangible Assets — physical and measurable property owned by a business.

Detailed Explanation:

Rationale for Correct Answer: Expenses appear on the income statement, not the balance sheet. The balance sheet includes assets, liabilities, and owners’ equity, representing the accounting equation.

Analysis of Incorrect Options:

A, B, D – All appear on the balance sheet.

Key Concept: Distinction between financial statements: balance sheet vs. income statement.

Detailed Explanation:

Rationale for Correct Answer:Cash larceny involves the theft of incoming cash after it has been recorded. Strong segregation of duties is critical to prevent concealment. By separating cash deposit responsibilities from bank reconciliation duties, one employee cannot both steal funds and cover their tracks.

Analysis of Incorrect Options:

A. Restricting substitution – Weakens controls; job rotation and cross-training help prevent fraud.

C. Same register use – Reduces accountability, making theft harder to trace.

D. Surprise cash counts – Strong detective control, but not as preventive as segregation of duties.

Key Concept: Preventing cash larceny through segregation of duties.

Detailed Explanation:

Rationale for Correct Answer:This is True. When an employee has significant authority or discretion in the procurement process (e.g., drafting specifications, approving vendors, or evaluating bids), they are more capable of steering contracts toward favored suppliers. This increases the risk of corruption schemes like kickbacks or bid-rigging.

Analysis of Incorrect Options:

B. False – Incorrect; influence grows with authority over procurement.

Key Concept:Procurement authority is a key risk factor for corruption.

Detailed Explanation:

Rationale for Correct Answer:John created a completely false expense claim for a meal that he did not personally pay for. This is a fictitious expense reimbursement scheme, where employees invent expenses and submit them for reimbursement.

Analysis of Incorrect Options:

A. Mischaracterized expense – Legitimate expenses claimed as business when they are personal. Not applicable here.

C. Multiple reimbursement – Involves submitting the same receipt more than once. Not the case here.

D. Overstated expense – Inflating a legitimate expense, which is not what John did.

Key Concept: Expense reimbursement fraud — fictitious expenses.

Detailed Explanation:

Rationale for Correct Answer:This is a tech-support scam, in which fraudsters trick victims into believing their computers are infected and then charge fees for unnecessary or fake repairs. The scam often targets elderly victims.

Analysis of Incorrect Options:

A. Pharming – Redirects users to fake websites, not fake support calls.

B. Bait and switch – Advertising deception, not fraudulent computer support.

D. Smishing – Fraud via SMS text messages, not on-screen computer popups.

Key Concept: Consumer fraud schemes — tech-support scams.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters conceal inventory shrinkage through multiple methods, including unrecorded sales, false write-offs, or manipulating perpetual records. The ACFE manual notes that concealment is a common theme in inventory fraud. Hence, all of the above are valid.

Analysis of Incorrect Options:

A, B, C – Each is correct individually, but the most comprehensive answer is D.

Key Concept: Concealment methods for inventory theft.

Detailed Explanation:

Rationale for Correct Answer: Illegal pyramid schemes rely on continual recruitment of new members. Early participants are paid from the investments of later recruits, meaning later participants almost always lose money. This matches option B.

Analysis of Incorrect Options:

A – Not true; pyramid-shaped hierarchies exist in legitimate organizations.

C – The goal isn’t product sales but rather recruitment; products, if present, are often incidental.

D – Incorrect because B is true.

Key Concept: Ponzi and pyramid schemes – payment to early investors with later investors’ funds.

Detailed Explanation:

Rationale for Correct Answer:Per generally accepted accounting principles, changes in accounting principles must be disclosed in the financial statements to ensure comparability and transparency. The ACFE notes that disclosures are critical to prevent misleading users of financial statements.

Analysis of Incorrect Options:

A. Subsequent events – Material subsequent events must be disclosed; this statement is false.

B. Contingent losses – Only probable and reasonably estimable losses must be disclosed. If unlikely, no disclosure is required.

C. All information – Only material information requires disclosure.

Key Concept: Disclosure requirements in financial reporting.

Detailed Explanation:

Rationale for Correct Answer:In a legitimate competitive bidding process, all bidders must be treated equally, with the same access to information, terms, and conditions. This ensures fairness and prevents procurement fraud.

Analysis of Incorrect Options:

A. Bid-rigging – The manipulation of competitive bidding, not the fair process.

B. Kickbacks – Involve secret payments, not equal bidding.

D. Bid solicitation – The stage of inviting bids, not the equal treatment requirement.

Key Concept:Competitive bidding — foundation of fairness in procurement.

Detailed Explanation:

Rationale for Correct Answer:During the solicitation phase, corrupt employees may attempt to eliminate legitimate competitors by restricting the list of vendors invited to bid. This unfairly favors a particular supplier, often in exchange for bribes or kickbacks.

Analysis of Incorrect Options:

A. Need recognition – Involves creating false or unnecessary demand, not restricting bidders.

C. False specification – Relates to vague or tailored specifications, not bid solicitation.

D. Submission – Occurs after solicitation when vendors submit bids.

Key Concept:Solicitation phase schemes — restricting competition.

Detailed Explanation:

Rationale for Correct Answer:The ACFE describes occupational fraud and abuse as an expense of doing business because organizations inevitably face losses from it, just as they incur other operating costs. This framing emphasizes the importance of prevention and detection to minimize this “expense.”

Analysis of Incorrect Options:

A. Equity – Residual ownership interest, not relevant here.

B. Balance sheet – A report, not a cost.

D. Financial record – Too vague.

Key Concept:Occupational Fraud as a Cost of Business.

Detailed Explanation:

Rationale for Correct Answer:This is True. Fraudulent financial reporting often involves manipulating depreciation. By lowering or delaying depreciation expense, companies can inflate profits and overstate asset values. This is a common method of financial statement fraud related to earnings management.

Analysis of Incorrect Options:

B. False – Incorrect, as understatement of depreciation clearly inflates reported profits.

Key Concept:Depreciation Manipulation in Financial Statement Fraud.

Detailed Explanation:

Rationale for Correct Answer:By double-entry accounting rules, every accounting entry affects at least two accounts (debit and credit). Fraudulent entries must also follow this rule, meaning manipulation will show up in at least two categories on the financial statements.

Analysis of Incorrect Options:

A. One – Impossible in double-entry accounting.

C. More than two – Possible, but not always; the minimum is two.

D. None of above – Incorrect since “at least two” is correct.

Key Concept:Double-entry accounting ensures at least two accounts are affected in every transaction, including fraudulent ones.

Detailed Explanation:

Rationale for Correct Answer:Under GAAP, revenue is recognized when it is realized or realizable and earned. This requires that the earnings process be substantially complete, and payment be reasonably assured.

Analysis of Incorrect Options:

B. Fictitious and Earned – Fictitious revenues are fraud, not recognized revenue.

C. Realized and Evidenced – Evidence supports recognition, but “earned” is the proper standard.

D. All of the above – Incorrect, since only option A is correct.

Key Concept:Revenue recognition principle — realized/realizable and earned.

Rationale for Correct Answer:In occupational fraud, the primary culprit is generally the employee (insider) who abuses their position of trust. By definition, occupational fraud involves someone inside the organization exploiting their role.

Key Concept:Employee perpetrator as the primary fraud actor in occupational fraud schemes.

Detailed Explanation:

Rationale for Correct Answer:While asset misappropriation schemes are usually committed by lower-level employees, financial statement fraud is most often committed by senior management. This is because executives have the authority to override controls, direct accounting policies, and influence financial reporting for personal gain (bonuses, stock prices, or to conceal poor performance).

Analysis of Incorrect Options:

A. Organized criminals – May commit fraud, but financial statement fraud specifically requires authority over reporting.

B. Mid and lower-level employees – Lack sufficient authority to materially alter financial statements.

D. All of the above – Incorrect, as financial statement fraud is overwhelmingly associated with senior management.

Key Concept:Management override — financial statement fraud perpetrated by those with the authority to manipulate reports.

Detailed Explanation:

Rationale for Correct Answer:Trend analysis is one of the most effective ways to detect omitted credits. By analyzing patterns in revenue, expenses, or balances over time, discrepancies such as missing credits become apparent. Forensic examiners rely on comparative financial analysis to identify anomalies that suggest manipulation.

Analysis of Incorrect Options:

A. Forced Balance – Describes concealment, not detection.

C. Expense account – Accounts can be manipulated but are not detection methods.

D. None of all – Incorrect, since trend analysis is correct.

Key Concept:Analytical procedures (trend analysis) in fraud detection.

Detailed Explanation:

Rationale for Correct Answer:Net realizable value (NRV) is the estimated selling price of an asset in the ordinary course of business, minus any costs of completion, disposal, or transportation. This is often applied in valuing accounts receivable and inventory.

Analysis of Incorrect Options:

B. Going concern – Assumption of business continuity, not asset valuation.

C. Cost – Historical cost, not future realizable value.

D. Fair value – Current market-based measure, not net proceeds after costs.

Key Concept:Net realizable value — valuation method for receivables and inventory.

Detailed Explanation:

Rationale for Correct Answer: A ghost employee scheme occurs when someone (real or fictitious) is added to payroll, and paychecks are diverted to the fraudster. The key requirement is that the “ghost” is listed on payroll records.

Analysis of Incorrect Options:

A – The ghost may be fictitious or a real former employee.

B – Employment classification is irrelevant.

C – A ghost could be a current, terminated, or entirely fictitious employee.

Key Concept: Payroll fraud – ghost employee schemes.

Detailed Explanation:

Rationale for Correct Answer: Skimming involves theft of cash before it is recorded in the books. Examining journal entries for false credits to inventory would detect inventory fraud, not skimming. Therefore, B is not useful for detecting skimming.

Analysis of Incorrect Options:

A – Confirming customer balances can reveal payments that were never posted because they were skimmed.

C – Physical counts may expose discrepancies caused by skimming disguised as inventory shortages.

D – Comparing register totals to actual cash can reveal missing amounts due to skimming.

Key Concept: Skimming detection focuses on reconciling recorded vs. unrecorded cash.

Detailed Explanation:

Rationale for Correct Answer:This statement is False. Shrinkage is a general term for unaccounted-for inventory losses, and it can indeed result from theft, errors, damage, or waste. To say shrinkage does not result from theft is misleading because theft is one of its primary causes.

Analysis of Incorrect Options:

A. True – Incorrect, as theft is often a major contributor to shrinkage.

B. False – Correct, since shrinkage can include theft.

Key Concept:Shrinkage includes theft as a cause of unexplained inventory loss.

Detailed Explanation:

Rationale for Correct Answer:Baiting is a social engineering tactic where fraudsters leave infected flash drives or storage media in public areas, hoping victims will plug them in, unknowingly installing malware. This is an accurate description.

Analysis of Incorrect Options:

A. Pharming – Involves redirecting users from legitimate websites to fraudulent ones, not mail redirection.

B. Dumpster diving – Searching physical trash for sensitive information, not computers from resellers.

C. Shoulder surfing – Observing someone’s screen or keystrokes, not access exploitation.

Key Concept: Identity theft techniques.

Detailed Explanation:

Rationale for Correct Answer:Loan fraud often involves suspicious or unusual documentation patterns. A change order submitted at the same time as a draw request is a red flag, because it suggests manipulation of project costs to justify larger draws from lenders.

Analysis of Incorrect Options:

A. Missing documents – Could indicate sloppy recordkeeping, not necessarily fraud.

B. Low turnover – Not a fraud indicator.

D. Increasing change orders – Could be suspicious, but not as strong a fraud red flag as simultaneous change order and draw request.

Key Concept: Loan fraud indicators.

Detailed Explanation:

Rationale for Correct Answer: Being prompted to install unfamiliar software is a red flag for malware or unauthorized access, often indicating that attackers are attempting to establish persistence in the system. This is a classic indicator of a compromised network.

Analysis of Incorrect Options:

A – Standard security measure, not a red flag.

C – Data from supplier countries is normal if consistent with business operations.

D – Access denial to files outside a user’s role is a normal access control, not an intrusion sign.

Key Concept: Cyberfraud detection – identifying intrusion indicators.

Detailed Explanation:

Rationale for Correct Answer:The matching principle under GAAP requires that revenues and the corresponding expenses incurred to generate those revenues be recorded in the same period. Failing to do so misstates income and violates accrual accounting.

Analysis of Incorrect Options:

B. Revenue and Income statement – The income statement is a report, not an item to be matched.

C. Income statement and Long-term contracts – Long-term contracts follow special rules (percentage of completion, completed contract), not the general matching principle.

D. Capitalized expenses and Liabilities – Not part of the matching principle.

Key Concept:Matching Principle — recording related revenues and expenses in the same period.

Detailed Explanation:

Rationale for Correct Answer:A conflict of interest occurs when an employee secretly has a personal or financial stake in a transaction, and that interest compromises their duty of loyalty to the employer. This is one of the four categories of corruption under the ACFE Fraud Tree.

Analysis of Incorrect Options:

B. Illegal sale – Not a fraud classification.

C. Unauthorized purchase – Could describe asset misuse, not corruption.

D. Financial disclosure – Relates to reporting, not the fraud itself.

Key Concept:Conflict of interest schemes as a category of corruption.

Detailed Explanation:

Rationale for Correct Answer:Upcoding occurs when a provider bills for a higher level of service than what was actually provided. Billing a 15-minute visit as a 60-minute visit is a classic upcoding scheme.

Analysis of Incorrect Options:

A. Name brand prescription – Not upcoding; this is prescribing choice, not billing fraud.

B. Multiple codes instead of one – This is unbundling, not upcoding.

D. Changing service date – This is falsifying service dates, not upcoding.

Key Concept: Health care billing fraud — upcoding vs. unbundling.

Detailed Explanation:

Rationale for Correct Answer:In fictitious revenue schemes, sales are recorded that never occurred. Because no actual customers exist, there will be no late or overdue accounts receivable. The Fraud Examiners Manual (2020) notes that unusually clean receivables aging reports—i.e., no overdue balances—can be a red flag of revenue manipulation.

Analysis of Incorrect Option:

B. False – Incorrect; the absence of overdue receivables is indeed suspicious and aligns with fictitious revenue fraud.

Key Concept: Financial statement fraud red flags — fictitious revenues.

Detailed Explanation:

Rationale for Correct Answer: The described scheme is lapping, a classic accounts receivable fraud. It involves covering up stolen payments by applying subsequent receipts from other customers to hide the shortage.

Analysis of Incorrect Options:

A. Padding – Usually refers to overstating expense reimbursements, not AR fraud.

C. Substitution – Refers to replacing missing assets with others, not AR manipulation.

D. Daisy chain – Not a recognized fraud concealment method in this context.

Key Concept: Skimming concealment techniques – lapping of receivables.

Detailed Explanation:

Rationale for Correct Answer: Human intelligence (HUMINT) involves gathering information directly from people, often through deception, elicitation, or impersonation. Georgina’s posing as a customer to obtain confidential details fits this method.

Analysis of Incorrect Options:

B. Baiting – A social engineering tactic using false promises (e.g., malware disguised as freebies).

C. Scavenging – Collecting discarded information (e.g., dumpster diving).

D. Open-source intelligence – Gathering data from public records, news, or websites, not through elicitation.

Key Concept: Methods of competitive intelligence and social engineering.

Detailed Explanation:

Rationale for Correct Answer:Fraudsters often attempt to influence or bribe employees who have access to sealed bids. Access to sealed bids provides unfair knowledge of competitors’ pricing and terms, enabling collusion or bid manipulation.

Analysis of Incorrect Options:

A. Bid-splitting – A fraud scheme, not what vendors seek access to.

C. General purchasing – Too broad; not specifically tied to vendor fraud.

D. Tailor specifications – A corruption scheme, but not the specific target of vendor bribery.

Key Concept:Sealed bid access as a key target in procurement fraud.

Detailed Explanation:

Rationale for Correct Answer:Materiality is most often associated with fraudulent financial statements because fraudsters may argue that misstatements are “immaterial.” However, deliberate misstatements of any size can be fraudulent. Materiality thus plays a critical role in assessing fraudulent statement cases.

Analysis of Incorrect Options:

B. Misappropriations – Involve theft, but materiality is less central than in reporting fraud.

C. Civil lawsuit – A possible outcome, not the core accounting issue.

D. Quality control – Not related to materiality in fraud.

Key Concept:Materiality in Financial Statement Fraud — even small misstatements may be fraudulent.