CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Questions and Answers

The2014 Fraud Examiners ManualandCFE Prepexplain:

“Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.”

Thus, the correct answer isA.

TheFraud Examiners ManualandCFE Prepemphasize:

“Generally, documentary evidence, including digital evidence, will not be admitted in a legal proceeding unless it is established as authentic… Consequently, fraud examiners who collect evidence from social media must capture, download, and preserve any useful information as soon as they discover it, and they must memorialize each step of the collection process”.

Thus, preservation for authenticity is the key.

TheFraud Examiners Manualadvises:

“Do not slow down the interview process for note-taking. Instead, jot down key words … In general, it is better to err on the side of taking too few notes rather than too many.”

Therefore, the best practice isC.

Explanation with Extracts= Predication requires sufficient circumstances to suggest fraud. TheCFE Prep Guideexplains:

“Fraud examiners should not investigate beyond the available predication… There is insufficient predication to confront Wallace or to make any direct allegations about fraud, but Carter does have adequate predication to make discreet inquiries”.Similarly, Arnold may discreetly inquire but not accuse or search property without further evidence.

“Alibis generally can be diffused by displaying physical evidence… evidence should be displayed one piece at a time, in reverse order of importance”【16:2014 International Fraud Examiners Manual.pdf†L11-L14】.

The Prep Guide warns: “The proper technique is not to lay it all out at once” .

Thus, showing everything at once is theleast effective.

Explanation: TheFraud Examiners Manualnotes that predictive modeling and data analysis allow fraud examiners to detect fraud by usinghistorical data to forecast future trends and anomalies. This matches optionB.

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

Digital forensics guidance stresses:

If the computer isoff,do not turn it on, because booting will alter files and timestamps.

If the computer isonand volatile data is needed (e.g., RAM), a formally trained examiner may collect it live. Otherwise, simply unplugging the system (hard shutdown) preserves volatile evidence better than a graceful shutdown.

Thus, if the evidence exists only in volatile data and the system is running, Nobles may collect it via the normal interface.

✅Answer: A. If Lucas's computer is running, Nobles may retrieve data… if the evidence exists only in volatile data

TheFraud Examiners Manualadvises that fraud examiners should preserve and organize evidence, and one of the key steps is toestablish a document database early. This allows examiners to track documents, index them, and link them to findings. Dusting for fingerprints, leaving originals behind, or organizing solely in chronological order are not standard best practices .

During admission-seeking interviews, when suspects persist with denials or alibis, examiners are trained to diffuse them. Accepted techniques include:

Discussing testimony of witnesses,

Displaying physical evidence, and

Downplaying the strength of evidence.

However, manuals caution that discussing a suspect’sprior deceptionsis not an effective or recommended method to diffuse alibis. It risks confrontation and may damage rapport, reducing chances of confession.

Therefore, optionCis the exception.

TheFraud Examiners Manuallists required steps before seizing evidence:

Obtain legal authority.

Review privacy issues.

Ensure software/hardware are validated.

Document surroundings, inspect for traps, image drives, etc.

There isno requirementto assemble a team exclusively of outside experts.

Before seizing evidence in adigital forensic investigation, the2014 International Fraud Examiners Manualoutlines several critical steps:

Obtain legal authority / review orders:

“Before obtaining evidence, ensure that there is legal authority to seize evidence and review the data associated with the evidence. This might require obtaining a warrant in a criminal matter or ensuring that internal policies authorise seizure for an internal investigation.”

Determine privacy issues:

“Before the fraud examiner can seize evidence, he must take certain steps to help ensure that the evidence will be admissible: He must determine whether there are any privacy interests in the item(s) to be searched… In every case where it becomes necessary to seize a computer or other device capable of storing digital evidence, the investigator should consult with legal counsel.”

Use only trained professionals/software:

“It is important to allow a trained examiner to conduct a proper seizure and examination of digital evidence to help ensure that the information can be used in a legal proceeding.”

✅These are allvalid required steps.

In contrast, the idea that the team must be composedonly of outside digital forensic expertsisNOT a required step. The Manual stresses flexibility in team composition:

“Some organisations have their own in-house personnel… while others might prefer the use of an outside examiner. Sometimes retrieving digital data is as easy as searching the target computer’s hard drive, but other times retrieval requires a thorough knowledge of computers.”

Thus, requiringonly outside expertsis not a standard step, since investigations may useinternal, external, or a mixof specialists depending on the situation.

“Once a suspect utters a denial, it becomes extremely difficult… therefore, the interviewer mustprevent an outright denial. Fraud examiners can use several techniques to stop or interrupt denials, includingdelays, repeated interruptions, and reasoning”.

Thus, the correct answer isD.

The2014 International Fraud Examiners Manualdefines:

“Fraud examination is a methodology of resolving signs or allegations of fraud from inception to disposition. The fraud examination methodology establishes a uniform, legal process for resolving signs or allegations of fraud on a timely basis.”

Similarly,CFE Prep – Investigationsconfirms:

“The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional.”

Thus, the correct answer isD.

To confirm ownership of a building,real estate and permit recordsare most useful. The Manual notes thatreal property records and related permits identify the owner, provide legal descriptions, and show improvements such as construction of commercial buildings. Court or voter registration records would not typically establish property ownership.

The Manual defines leading questions as those that contain or suggest the answer:

“Leading questions… are framed in a way that evokes a specific reply… most commonly used to confirm facts already known… Example: ‘You got promoted, right?’”

Nathaniel’s question, “When were you promoted to manager?” presumes the promotion occurred. Thisleadsthe subject by suggesting a fact that may not be true. It is not open (does not invite free narration), not complex (it asks one thing), and not closed (doesn’t call for yes/no but presumes an answer).

“Metadata information can help determine who wrote a document, who received, opened, copied, edited, moved, or printed the document, andwhen these events occurred”.

Thus, metadata is the best source for creation date.

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

Benford’s Law applies to naturally occurring sets of numbers such asinvoice amounts, expense reports, and transaction data. The Fraud Examiners Manual shows Benford’s Law tests applied to vendor payments to detect anomalies like duplicate or inflated invoices. Telephone numbers, employee IDs, and bank account numbers areassigned numbersand do not follow Benford’s distribution, so they are unsuitable for this test.

When introducing themselves, fraud examiners should avoid titles likeinvestigatororCertified Fraud Examinerthat might raise suspicion or defensiveness. TheManualrecommends using neutral titles such asauditorbecause it is less threatening and more acceptable in an organizational setting.

Signs of stress (e.g., shallow breathing, stuttering, shifting posture) do not automatically equal deception. TheFraud Examiners Manualstates:

“Signs of stress do not always mean a subject is lying. An honest subject might feel stress simply by being questioned. Conclusions must be based on clusters of behavior and corroborating evidence, not a single indicator”.

“The interviewer must not express disgust, outrage, or moral condemnation… the basic logic of obtaining confessions can be summed up asmaximize sympathy and minimize the perception of moral wrongdoing”.

Sympathy creates an environment conducive to confession, while other options (third-party presence, emphasizing immorality, or pressuring with time) are explicitly discouraged.

“The locations of the subject’s residences and businesses (e.g., through analysing the payments of utility bills)… The cities and countries in which the subject conducts business (e.g., through analysing the payments for carrier services to deliver packages)”【6:2014 International Fraud Examiners Manual.pdf†L57-L77】.

They donotdirectly prove skimming or show market values of real estate.

“Introductory questions should be designed to establish rapport… Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Jason’s small talk about sports and compliments is clearly rapport building

TheFraud Examiners Manualclarifies:

“The recommendations section is optional, and there might be instances where the fraud examiner wishes to discuss remedial measures or specific recommendations in a separate document”.

The Prep guide also states: “A written report might include a section for recommendations”.Thus, it isnot requiredin every report.

The Fraud Examiners Manual makes clear that covert operations areextraordinary measuresthat require high skill and planning and should be used only when no other practical method is available. They carry significant risks, includingembarrassment, liability, and even injury or death. Therefore, covert operations should not be the first resort but instead follow conventional evidence-gathering efforts.

The manuals explain that in verbal confessions, subjects oftenunderestimatethe amounts to minimize guilt, not overestimate. The process involves moving from accusation to benchmark admission, handling lies tactfully, and obtaining details by chronology, transaction, or event. Thus, optionBis NOT true.

Thecorrect answeris:Whether recording is legal depends onconsent laws— so the most helpful question is effectively:“Is consent required from one or all parties to record this conversation?”

Among the provided choices, theclosest matchisNOT listed explicitly. But based on the ACFE manuals, the correct interpretation is that none of the technical details (audio/video, file format, time, duration) matter —only the legal consent requirement matters.

Complete Detailed Explanation with Exact Extracts from Fraud Examiner (CFE) - Investigation Documents: =

The2014 International Fraud Examiners Manualstates:

“In some circumstances, recording an interview might be illegal. Some jurisdictions limit an employer’s right to record employee interviews during an investigation. In fact, in some jurisdictions, audio recording an interview is permitted only with the consent of all parties to the communication. Thus, fraud examiners should always consult with an attorney when deciding whether to record an interview.”

It further emphasizes:

“A telephone recording consent form stipulates where, when, and with whom telephone conversations can be recorded… Be cautioned that the form alone does not make the conduct of recording a telephone conversation illegal or legal.”

????Interpretation:

The legality of recording has nothing to do with:

Audio vs video(A)

Digital file format(B)

Work hours(C)

Duration(D)

Instead, it dependsentirely on jurisdictional consent laws(one-party vs all-party consent).

TheCFE Prep Guideclarifies:

“A fraud response plan outlines the actions… when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success”.

Thus, statement D is false.

The manual states:

“When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence.”

Thus,B is the least accurate statement.

The2014 International Fraud Examiners Manualprovides examples of data analysis for accounts payable:

“Examples of data analysis queries that can be performed to help detect fraud through examination of accounts payable include:

• Audit paid invoices for manual comparison with actual invoices.

•Summarise large invoices by amount, vendor, etc.

• Identify debits to expense accounts outside of set default accounts.

• Reconcile cheque registers to disbursements by vendor invoice.”

While other functions apply to payroll or asset management, themost effective function for accounts payablefraud detection is tosummarize large invoices by amount and vendor.

Limitations of online public record searches include:

Need to search multiple jurisdictions.

Records are often only abstracts.

Information must be verified for accuracy.There isno mentionthat online record vendors are “difficult to find.” In fact, many such vendors exist.

“Fraud examinations should proceed from thegeneral to the specific. That is, they should begin with general information that is known, starting at the periphery, and then move to the more specific details”.

This method avoids premature assumptions and ensures systematic evidence development.

In admission-seeking interviews, one rationalization technique is todepersonalize the victim(e.g., shifting the perception so the harm was against a company, not individuals). The example in the question—“It isn’t like you took something from a friend or neighbor”—is exactly this technique.

Explanation with Extracts= The2014 Fraud Examiners Manualstates:

“The EU Data Protection Directive … regulates the processing, using, and transferring of personal data within the European Union, and it places limits on transmitting personal data to non-EU countries”.

Therefore, a U.S.-based examiner handling HR data of an EU employee must comply with EU GDPR requirements.

The Financial Action Task Force (FATF) Recommendations, as cited in the Fraud Examiners Manual, require enhanced due diligence in correspondent banking relationships. Specifically, banks must“avoid correspondent banking with shell banks”and ensure the foreign institution is properly licensed and regulated.

This means financial institutions must confirm that the foreign correspondent bank holds the necessarylicenses or certificationsto operate legitimately.

Other options (branch addresses, tax statements, or client loan profiles) are not mandated under FATF’s correspondent banking due diligence requirements. The most critical factor is verifying the correspondent institution’slegal authorization (licenses/certifications)to prevent money laundering and terrorist financing.

Nonverbal deception cues include feigned unconcern, slouching, chewing objects, and manipulating clothing. Michelle’s conduct (chewing pen cap, picking at fabric, appearing unconcerned) matches these signs ofdeception.

TheFraud Examiners Manualstresses confidentiality:

“To preserve confidentiality, investigators should avoid transmitting confidential information by email or other electronic means whenever possible, as these are susceptible to interception or unauthorized access.”

Suspending employees or blanket bans on discussion are not best practices. Confidentiality is preserved primarily by secure communication and controlled access to information.

The2014 Fraud Examiners ManualandCFE Preplist common concealment methods:

“Some common techniques for hiding assets include transferring assets into foreign trusts, overpaying taxes, prepaying on a home mortgage, obtaining a life insurance policy, and transferring assets into someone else’s name.”

Thus, the correct answer isD.

From the2014 International Fraud Examiners Manual, under the section related to tracing financial transactions, specifically tracing the disposition of loan proceeds, the following objectives of tracing activities are explicitly outlined:

“Tracing the disposition of loan proceeds can help fraud examiners:

Determine whether loan proceeds were deposited into hidden or unknown accounts

Determine whether loan proceeds were used to pay off other loans

Identify the involvement of previously unknown individuals (potential witnesses)

Determine whether payments were made from hidden accounts

Identify undisclosed related-party transactions”

There isno mentionthat tracing loan proceeds can uncoverprevious civil offensescommitted by the subject. Civil offenses refer to non-criminal violations (e.g., breach of contract, torts), which tracing offinancial transactions like loan proceedsis not directly designed to uncover.

This isnot a recognized purposeof tracing as taught in the CFE Investigation section. The core objectives revolve around uncovering hidden assets, hidden accounts, payments, and potential witnesses —not prior legal infractions.

Therefore, thecorrect answer is A, as it is the only option that isNOT trueaccording to official CFE investigation materials.

According to theCFE Prep - Investigationsstudy guide:

“It is recommended that any witnesses who are considered potentially volatile be interviewed without advance notice. Surprise should be employed in any interview that is considered potentially volatile. In many instances, the potentially volatile respondent is unaware that he is going to be questioned, and will therefore be unprepared. If the interview is not conducted by surprise, the interviewer runs the risk of the respondent not showing up, showing up with a witness, or being present with counsel. A target’s friends, relatives, and romantic interests often make for a difficult interview. They perceive that the fraud examiner is deliberately targeting someone close to them.”

????Interpretation for this scenario:

Brianna is described asvery protective of her boyfriend, making her a potentiallyvolatile witness.

Best practice is to avoid giving heradvance notice(which might increase hostility, resentment, or allow preparation).

Conducting the interviewwith little or no noticereduces the risk of interference, ensures she is unprepared, and prevents her from appearing with legal counsel or allies.

The Manual and Prep Guide state:

“Before conducting a covert operation, it is essential that the basis for the operation be committed to writing, preferably in a memo. The memorandum should clearly state: the information upon which the covert operation will be based; the information that is expected to be gained from the operation; the identities of suspects, if known; operatives under the fraud examiner’s care, custody, or control. Confidential sources’ identities should not be disclosed.”

Thus,expected informationbelongs, butconfidential source identitiesmust not

Observing signs of wealth (sports car, home remodeling) may raise suspicion, but by itself it doesnot provide sufficient predicationto accuse or notify management of fraud. The proper next step is to conduct discreet inquiries to determine if further evidence exists before escalating.

The organizational filings with the government of the jurisdiction in which the company is incorporated

Explanation: Organizational filings (e.g., articles of incorporation) are generally public records and includeownership information, initial shareholders, and the location of the principal office.

The manual and CFE Prep list the main limitations:

Coverage varies by jurisdiction.

Searches are limited in area.

Records are often abstracts.

Information may be inaccurate or outdated.

Searches can be erratic.

Nowhere is “difficulty in finding database companies” mentioned.

Oral consent is generallynot sufficientto obtain a suspect’s bank records. TheCFE Prep - Investigationsstates:

“Accessing a subject’s bank records from financial institutions generally requires written consent. Oral consent is the least effective way to obtain permission”.

TheFraud Examiners Manualalso notes that bank information can usually only be obtained withsubpoena, search warrant, or written consent.

Best practice is to conduct interviewsindividually. The Manual states:

“When conducting interviews, witnesses should beinterviewed separately. Interviewing multiple witnesses together risks contamination of testimony and reduced reliability of responses”.

According to the2014 International Fraud Examiners Manual:

“The termfraud examinationrefers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional. The fraud examination process encompasses a variety of tasks that might include:

• Obtaining evidence

• Reporting

• Testifying

• Assisting in fraud detection and prevention”.

Similarly, in theCFE Prep - Investigationsstudy guide:

“Fraud examination is best described as…a methodology for resolving fraud allegations from inception to disposition. The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional”.

This clearly verifies thatfraud examinationis the correct term for the process of resolving fraud allegations from beginning (inception) to end (disposition).

Therefore, thecorrect answer is D. Fraud examination.

TheFraud Examiners Manualstresses that interview notes should be kept separately for each interview, even if the session is electronically recorded, because recordings can fail or be challenged. Verbatim transcripts are not expected, and impressions of guilt should never be included. Best practice is to keep clear, accurate,separate recordsfor every interview .