CFE-Investigation Questions and Answers

TheFraud Examiners Manualstresses confidentiality:

“To preserve confidentiality, investigators should avoid transmitting confidential information by email or other electronic means whenever possible, as these are susceptible to interception or unauthorized access.”

Suspending employees or blanket bans on discussion are not best practices. Confidentiality is preserved primarily by secure communication and controlled access to information.

“Internal sources will sometimes be the only resource for certain types of documents—such as… employee personnel files—unless the fraud examiner has the subject’s consent or a legal order”.

External searches may reveal addresses, assets, or competitor ownership, butpersonnel files require internal/non-public access.

Court records are frequently used in fraud investigations. Both the Prep Guide and the Manual agree thatthe court clerk’s office (court authorities) is the original and most reliable sourceof certified and accurate records.

Although commercial services and online databases exist, the manuals emphasize that reliability and certification are best ensured by going directly to the court where the case was filed.

Thus, the statement isTrue.

“Securities regulators… require disclosures that typically include: corporate financial statements, identification of officers and directors, identification of significant owners… and a history of the business”【10:2014 International Fraud Examiners Manual.pdf†L73-L95】.

Thus, regulatory securities records are the best source for financial statements.

The2014 International Fraud Examiners ManualandCFE Prep - Investigationsexplicitly state:

“Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. … when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.”

Thus, the correct answer isC.

The Fraud Examiners Manual explains that recommendations in a report areoptional, not mandatory. When included, they should cover remedial measures such as control reviews or increased security.

“Finally, the fraud examiner might decide to include a section for recommendations. The recommendations section should containremedial measures or specific recommendations for follow-up actions… This section is optional”.

Therefore,Cis correct. Options A and D are incorrect because recommendations are not required in every report, and B misstates its purpose.

According to theCFE Prep - Investigationsstudy guide:

“It is recommended that any witnesses who are considered potentially volatile be interviewed without advance notice. Surprise should be employed in any interview that is considered potentially volatile. In many instances, the potentially volatile respondent is unaware that he is going to be questioned, and will therefore be unprepared. If the interview is not conducted by surprise, the interviewer runs the risk of the respondent not showing up, showing up with a witness, or being present with counsel. A target’s friends, relatives, and romantic interests often make for a difficult interview. They perceive that the fraud examiner is deliberately targeting someone close to them.”

????Interpretation for this scenario:

Brianna is described asvery protective of her boyfriend, making her a potentiallyvolatile witness.

Best practice is to avoid giving heradvance notice(which might increase hostility, resentment, or allow preparation).

Conducting the interviewwith little or no noticereduces the risk of interference, ensures she is unprepared, and prevents her from appearing with legal counsel or allies.

TheFraud Examiners Manualstates:

“The expenditures method works best when the subject spends illicit income on consumables (e.g., travel and entertainment), because when the subject spends the illicit income, it will not cause an increase in net worth.”

CFE Prepconfirms:

“The expenditures method … is best used when the subject spends illicit income on consumables (such as travel and entertainment) that would not cause an increase in net worth.”

Thus, the correct answer isA.

TheFraud Examiners Manualexplains that before obtaining or cleansing data, the first step in using data analysis is theplanning phase. This includesunderstanding the data, articulating objectives, and building a profile of potential frauds. Without this, examiners risk inefficient analysis and overlooking key fraud risks.

✅Answer: C. Build a profile of potential frauds

TheFraud Examiners Manualexplains:

“Before running tests on the data, the fraud examiner must make certain the data being analysed are relevant and reliable for the objective of the engagement… Using the profile of potential frauds as a guide, the fraud examiner must identify the target data for analysis”.

TheFraud Examiners Manualstates:

“If a business or individual constructs a new building or makes improvements to an existing building, there should be a building permit on file with the local building authority. In many cases, the person applying for permits will be the owner or someone traceable to the owner.”

CFE Prepsupports this:

“Building permit records… are often required before most businesses can open… and often list the owner or someone traceable to the owner.”

Thus,building permit recordsare most likely to help identify the restaurant’s owner.

When preparing to interview subjects across jurisdictions, fraud examiners must consider bothlegal rightsandcultural differences. The Manual advises examiners to:

Researchlocal lawsgoverning the right to counsel during interviews.

Understand cultural norms (e.g., greetings, eye contact).Failing to observe these can damage credibility. Thus, it is most accurate that an examiner must determine whether the subject can legally insist on a lawyer’s presence .

The manuals explain that in verbal confessions, subjects oftenunderestimatethe amounts to minimize guilt, not overestimate. The process involves moving from accusation to benchmark admission, handling lies tactfully, and obtaining details by chronology, transaction, or event. Thus, optionBis NOT true.

Duringadmission-seeking interviews, fraud examiners often employrationalization techniquesto help the suspect justify their misconduct and make it easier to confess. One of these rationalizations is thealtruistic appeal.

From the2014 International Fraud Examiners Manual:

“Facilitators of communication are those socio-psychological forces that make conversations, including interviews, easier to accomplish. These facilitators require a basic understanding of what motivates people. The facilitators are: fulfilling expectations, recognition,altruistic appeals, sympathetic understanding, new experience, catharsis, need for meaning, and extrinsic rewards.”

From theCFE Prep - Investigationsstudy guide:

“Facilitators of communication… include fulfilling expectations, recognition,altruistic appeals, sympathetic understanding, new experience, catharsis, need for meaning, and extrinsic rewards.”

????Application to Scenario:

Beta says:“I know you didn’t do this for yourself; it was for your family.”

This is aclassic altruistic appeal— reframing the suspect’s motive asselfless or for the benefit of others, rather than selfish wrongdoing.

The purpose is toreduce internal resistanceto confessing by allowing the suspect to rationalize the act as being for a noble reason.

The best practices for signed statements include:

Adding omitted facts as anaddendum.

Preparingseparate statements for unrelated offenses.

Havingwitnesses to the signing.

But:

“The signed statement should be reduced to a short and concise written statement. The interviewer should prepare the statement and present it to the confessor for his signature” .

Thus, requiring the suspect to handwrite the entire statement isnot a best practice.

Digital forensics guidance stresses:

If the computer isoff,do not turn it on, because booting will alter files and timestamps.

If the computer isonand volatile data is needed (e.g., RAM), a formally trained examiner may collect it live. Otherwise, simply unplugging the system (hard shutdown) preserves volatile evidence better than a graceful shutdown.

Thus, if the evidence exists only in volatile data and the system is running, Nobles may collect it via the normal interface.

✅Answer: A. If Lucas's computer is running, Nobles may retrieve data… if the evidence exists only in volatile data

TheFraud Examiners Manualdefines double-negative questions as those containingtwo forms of negation in a single clause. They are confusing and “often suggest an answer opposite to the correct one.” The example given is almost identical to the question here:

“Didn’t you suspect that something wasn’t right?”.

Thus, Sylvia’s question is adouble-negative question, which should be avoided.

Thecorrect answeris:Whether recording is legal depends onconsent laws— so the most helpful question is effectively:“Is consent required from one or all parties to record this conversation?”

Among the provided choices, theclosest matchisNOT listed explicitly. But based on the ACFE manuals, the correct interpretation is that none of the technical details (audio/video, file format, time, duration) matter —only the legal consent requirement matters.

Complete Detailed Explanation with Exact Extracts from Fraud Examiner (CFE) - Investigation Documents: =

The2014 International Fraud Examiners Manualstates:

“In some circumstances, recording an interview might be illegal. Some jurisdictions limit an employer’s right to record employee interviews during an investigation. In fact, in some jurisdictions, audio recording an interview is permitted only with the consent of all parties to the communication. Thus, fraud examiners should always consult with an attorney when deciding whether to record an interview.”

It further emphasizes:

“A telephone recording consent form stipulates where, when, and with whom telephone conversations can be recorded… Be cautioned that the form alone does not make the conduct of recording a telephone conversation illegal or legal.”

????Interpretation:

The legality of recording has nothing to do with:

Audio vs video(A)

Digital file format(B)

Work hours(C)

Duration(D)

Instead, it dependsentirely on jurisdictional consent laws(one-party vs all-party consent).

“Signs of stress do not always mean that a subject is lying… While lying and deception do cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

The Prep guide confirms: “While lying and deception do indeed cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

Therefore, Carlos shouldnot automatically conclude deception from stress behaviors.

Best practice is to conduct interviewsindividually. The Manual states:

“When conducting interviews, witnesses should beinterviewed separately. Interviewing multiple witnesses together risks contamination of testimony and reduced reliability of responses”.

TheFraud Examiners Manualadvises:

“Do not slow down the interview process for note-taking. Instead, jot down key words … In general, it is better to err on the side of taking too few notes rather than too many.”

Therefore, the best practice isC.

The Fraud Examiners Manual explains:

“Each transaction on a blockchain ledger is recorded with a cryptographic address… by analyzing these addresses, fraud examiners can sometimes establish patterns and connections that identify users or link them to criminal activity”.

TheFraud Examiners Manualemphasizes that before commencing legal action to recover assets, the examiner must consider whether the defendant has assets worth pursuing:

“The most important question a fraud examiner should ask before beginning legal action to recover assets is whether the defendant has sufficient property or money to satisfy a judgment. Legal actions can be time-consuming and costly, and recovery efforts are futile if the defendant is judgment-proof.”

Before commencing legal action to recover assets, themost critical considerationis whether the defendant hasrecoverable assets. If the defendant lacks property or funds, pursuing legal action could be costly and ultimately fruitless.

From the2014 International Fraud Examiners Manual:

“After a fraud is discovered, fraud examiners might need to assist in making a recommendation concerning the recovery of lost assets… A domestic judgment against a foreign defendant is usually helpful for recovering the defendant’s assets located in the domestic country, but might be worthless for obtaining the defendant’s assets in a foreign country.”

This emphasizes that enforcement of judgments is only meaningful if assets exist to satisfy them.

Similarly, theCFE Prep - Investigationsmaterial highlights asset tracing and recovery as the foundation for deciding legal action:

“Records obtained from financial institutions are perhaps the single most important financial source available to fraud examiners for purposes of tracing assets.”

????Interpretation of Answer Choices:

A. Prior arrests→ Not directly relevant to whether asset recovery will succeed.

C. Statute of limitations→ Important for legal viability, but meaningless if no assets exist to recover.

D. Guilt of the suspect→ Guilt must be established in criminal cases, but in civil recovery,asset availability is paramount.

B. Defendant’s property or money→ This is themost importantpractical question, because without assets, recovery efforts will not yield compensation regardless of guilt or legal timelines.

TheFraud Examiners Manualspecifies that admission-seeking interviews should only be conducted when:

“There is a reasonable probability that the respondent has committed the act in question.

All other reasonable investigative steps have been completed.

The interviewer can reasonably control the place, time, and subject matter of the interview.”

There isno requirementthat the examiner must be sure no one else was involved. Therefore,C is correct.

The Manual defines leading questions as those that contain or suggest the answer:

“Leading questions… are framed in a way that evokes a specific reply… most commonly used to confirm facts already known… Example: ‘You got promoted, right?’”

Nathaniel’s question, “When were you promoted to manager?” presumes the promotion occurred. Thisleadsthe subject by suggesting a fact that may not be true. It is not open (does not invite free narration), not complex (it asks one thing), and not closed (doesn’t call for yes/no but presumes an answer).

The recommended questioning order is:

“As a general rule, questioning should proceed from thegeneral to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

Best practices when working with confidential informants include documenting payments and identities in ways that protect anonymity but avoid risks. TheFraud Examiners ManualandCFE Prepemphasize avoiding cash payments because they reduce transparency and create audit trail problems. Paying in cash is thereforeNOT considered a best practice, whereas using initials, obtaining receipts, and documenting informant information in reports can be acceptable methods.

TheCFE Prep – Investigationsnotes:

“Court records are best obtained from the jurisdiction in which they were filed… The most accurate records are maintained by the court of original jurisdiction, not global or aggregated databases.”

Thus, the best place for Sam is thelocal court of jurisdiction, not a global database.

“The interviewer generally should indicate his name and company, but he should avoid stating his title. In general, the more informal the interview, the more relaxed the respondent”.

Introducing oneself only by name and company (not title like CFE or auditor) avoids intimidation and builds cooperation.

When dealing with potentially hostile or volatile interviewees, fraud examiners are advised not to give much advance notice. This reduces the chance that the subject will prepare evasive or combative responses. TheFraud Examiners Manualemphasizes minimizing preparation time for resistant interviewees to ensure more candid responses.

“Once a denial is uttered, it becomes extremely difficult for the accused to change his response, because doing so would be an admission that he lied. Therefore, the interviewer must prevent an outright denial, thereby making it easier for the subject to confess”.

“One of the most effective techniques to stop or interrupt a denial is through a delaying tactic… the interviewer should attempt to delay the outright denial; he should not argue with the accused”.

Thus, Charles should interrupt with a delaying tactic.

The2014 Fraud Examiners ManualandCFE Preplist common concealment methods:

“Some common techniques for hiding assets include transferring assets into foreign trusts, overpaying taxes, prepaying on a home mortgage, obtaining a life insurance policy, and transferring assets into someone else’s name.”

Thus, the correct answer isD.

“Once a suspect utters a denial, it becomes extremely difficult… therefore, the interviewer mustprevent an outright denial. Fraud examiners can use several techniques to stop or interrupt denials, includingdelays, repeated interruptions, and reasoning”.

Thus, the correct answer isD.

“When searching for an individual, the fraud examiner shouldobtain a past address of the subject, and search activities should begin with that information”.

Therefore, saying a past address is “of no help” is incorrect.

TheFraud Examiners Manualstresses that interview notes should be kept separately for each interview, even if the session is electronically recorded, because recordings can fail or be challenged. Verbatim transcripts are not expected, and impressions of guilt should never be included. Best practice is to keep clear, accurate,separate recordsfor every interview .

TheFraud Examiners Manualnotes:

“Management of an organisation should ensure that the organisation has a proper and effective document retention policy in place… An effective policy requires clear retention protocols… and should be immobilised due to a pending investigation or foreseeable litigation.”

Thus, the existence of a document retention policy is a critical factor in deciding how to dispose of evidence.

The2014 International Fraud Examiners Manualprovides:

“Fraud examiners can use a correlation analysis to determine the relationships between different variables in raw data… For example, there should be a strong correlation between the independent and dependent variables because there is a direct relationship between them.Hotel costs should increase as the number of days travelled increases.”

CFE Prep – Investigationsechoes this:

“Using the correlation analysis function, fraud examiners can determine the relationships between different variables in the raw data. For example…Hotel costs should increase as the number of days travelled increases.”

Thus, the most useful analysis isCorrelation analysis.

When obtaining a verbal confession, the fraud examiner should secure details such as: admission of wrongdoing, number of instances, amount involved, dates, involvement of others, residual assets, and motive. However, itdoes not matter whether the suspect claims the conduct was an accident; that is not necessary to record.

TheFraud Examiners Manualstates:

“Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction… emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive”.

Thus, statement C isNOT true.

The Fraud Examiners Manual makes clear that covert operations areextraordinary measuresthat require high skill and planning and should be used only when no other practical method is available. They carry significant risks, includingembarrassment, liability, and even injury or death. Therefore, covert operations should not be the first resort but instead follow conventional evidence-gathering efforts.

TheFraud Examiners Manualwarns against phrasing admissions as direct questions using emotive terms:

“The admission-seeking interview begins with a direct accusation… The accusation should be phrased as though the accused’s guilt has already been established. Emotive words such as steal, fraud, and crime should be avoided… Wrong: ‘Did you do this?’”.

Thus, phrasing the question as“Did you steal the money?”is least effective.

Fraud examiners mustnot opine on guilt, innocence, intent, or disposition. Reports should focus onfacts and expert conclusions within their field. The Manual stresses:

“The fraud examiner should refrain from expressing opinions as to the guilt or innocence of any person or entity. Such conclusions are reserved for the trier of fact” (Fraud Examiners Manual, Reporting section).

Options A, B, and D relate toaccounting and internal control assessments, which fall within an accounting expert’s scope. OnlyCis improper because it speculates about the suspect’s character or intent, which is outside the CFE’s role.

“Introductory questions should be designed to establish rapport… Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Jason’s small talk about sports and compliments is clearly rapport building

Predictive analytics is defined as:

“the use of historical data combined with statistical, analytical, and machine learning techniques to create models that capture trends and produce forecasts”.

So, optionCbest describes predictive analytics.

The2014 International Fraud Examiners Manualexplains:

“Often, the most important evidence exists only in the form of volatile data (e.g., RAM)… If the evidence that a formally trained computer investigator needs to collect exists only in the form of volatile data stored in volatile computer memory such as RAM, and the data is expected to disappear when the computer is shut down, he should collect the data live from the suspect computer.”

Also,

“If the computer is off, leave it off… Booting up a system can alter its files… Accordingly, turning a system on could damage and taint any evidence.”

Thus, themost accurate statementisD— live data collection may be performed directly if volatile data is required.

TheFraud Examiners Manualnotes that when witnesses become hostile or argumentative, the interviewer should generally remain calm and avoid reacting to hostility. Reacting, reasoning, or arguing often escalates the situation. Instead, the interviewer should maintain control and neutrality .