CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Questions and Answers

Complex questions:

“consist of a series of interrelated questions… too complicated to be easily understood, cover more than one subject, or require more than one answer”.

The question asked by Delta (“Were you aware that the signature was forged, and why didn’t you tell anyone earlier?”) covers two issues, making itcomplex.

In admission-seeking interviews, one rationalization technique is todepersonalize the victim(e.g., shifting the perception so the harm was against a company, not individuals). The example in the question—“It isn’t like you took something from a friend or neighbor”—is exactly this technique.

TheFraud Examiners Manualexplains:

“Textual analytics is a method of using software to extract usable information from unstructured text data… it cancategorise data to reveal patterns, sentiments, and relationships indicative of fraud”.

This is the key reason fraud examiners analyze textual/unstructured data.

TheFraud Examiners Manualspecifies:

“Fraud examinations should proceed from the general to the specific. That is, they should begin with general information that is known and then move to more specific details.”

Therefore, statementB is false, making it the correct answer.

The recommended questioning order is:

“As a general rule, questioning should proceed from thegeneral to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

The Fraud Examiners Manual states:

“Duplicate testing is used to identify transactions with duplicate values in specified fields … fields such as cheque numbers, invoice numbers, and government identification numbers … searching for duplicates within these fields can help the fraud examiner find anomalies that merit further examination”.

This directly addresses Tony’s need to ensure no two invoices have the same number.

The Fraud Examiners Manual and CFE Prep Guide explain that tracing loan proceeds is a key investigative tool, but its scope is limited. Specifically, it helps determine:

if proceeds were deposited into hidden accounts,

if hidden accounts were used for loan payments, and

if loans were secured by hidden assets or unknown witnesses.

However, the manuals do not state that tracing loan proceeds can identify internal control weaknesses. That is a different aspect of fraud examination, often addressed through audit procedures or control assessments.

Thus, optionDis NOT true.

“When searching for an individual, the fraud examiner shouldobtain a past address of the subject, and search activities should begin with that information”.

Therefore, saying a past address is “of no help” is incorrect.

The calibration (or norming) process in interviews is meant to establish a baseline of the subject’s normal verbal and nonverbal behavior. This is done by askingnoncritical background questionsso that later deviations can be more reliably identified.

From the CFE Prep guide:

“The proper way an interviewer should start the calibration (norming) of a witness is through the use of:Noncritical questions on background information.… Examples of noncritical questions include ‘When did you start with the company?’ and ‘How long is your commute?’”.

Thus, the correct answer isD. “How many jobs have you had before this one?”since it is a nonthreatening background question.

According to theFraud Examiners Manual:

“Credit card records are important in tracing assets… information on credit card charges might provide leads to identifying hidden assets. For example, if a fraud examiner notices that the subject used his credit card to purchase items at a marina, the fraud examiner should investigate further to determine if the subject owns a boat”.

Therefore,Ais correct.

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

The Financial Action Task Force (FATF) Recommendations, as cited in the Fraud Examiners Manual, require enhanced due diligence in correspondent banking relationships. Specifically, banks must“avoid correspondent banking with shell banks”and ensure the foreign institution is properly licensed and regulated.

This means financial institutions must confirm that the foreign correspondent bank holds the necessarylicenses or certificationsto operate legitimately.

Other options (branch addresses, tax statements, or client loan profiles) are not mandated under FATF’s correspondent banking due diligence requirements. The most critical factor is verifying the correspondent institution’slegal authorization (licenses/certifications)to prevent money laundering and terrorist financing.

TheFraud Examiners Manualexplains that before obtaining or cleansing data, the first step in using data analysis is theplanning phase. This includesunderstanding the data, articulating objectives, and building a profile of potential frauds. Without this, examiners risk inefficient analysis and overlooking key fraud risks.

✅Answer: C. Build a profile of potential frauds

Explanation with Extracts= Predication requires sufficient circumstances to suggest fraud. TheCFE Prep Guideexplains:

“Fraud examiners should not investigate beyond the available predication… There is insufficient predication to confront Wallace or to make any direct allegations about fraud, but Carter does have adequate predication to make discreet inquiries”.Similarly, Arnold may discreetly inquire but not accuse or search property without further evidence.

For publicly traded companies, the best source for information on officers and directors is regulatory securities records. These records typically include “identification of officers and directors, financial statements, significant owners, and accountants and attorneys”.

The manual states:

“When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence.”

Thus,B is the least accurate statement.

“Before commencing a formal investigation (and especially before starting the evidence collection process), it might be necessary to prepare the subject organisation… such as preparing the managers of the employees who will be involved in the investigation, notifying key decision makers, and notifying the organisation’s legal counsel”.

It is not good practice to notify the entire workforce or inform the suspect.

Court records are frequently used in fraud investigations. Both the Prep Guide and the Manual agree thatthe court clerk’s office (court authorities) is the original and most reliable sourceof certified and accurate records.

Although commercial services and online databases exist, the manuals emphasize that reliability and certification are best ensured by going directly to the court where the case was filed.

Thus, the statement isTrue.

TheFraud Examiners Manualdefines double-negative questions as those containingtwo forms of negation in a single clause. They are confusing and “often suggest an answer opposite to the correct one.” The example given is almost identical to the question here:

“Didn’t you suspect that something wasn’t right?”.

Thus, Sylvia’s question is adouble-negative question, which should be avoided.

“Documentary evidence, including digital evidence, will not be admitted… unless it is established as authentic… fraud examiners mustcapture, download, and preserve any useful information as soon as they discover it, and memorialize each step of the collection process”.

TheFraud Examiners ManualandCFE Prep Guideboth state:

“In an admission-seeking interview, the interviewer should transition to the verbal confessionwhen the accused furnishes the first detailed information about the offence. There are three approaches to obtaining the confession: chronologically, by transaction, or by event”.

Thus,Bis the true statement.

TheFraud Examiners Manualadvises avoiding prematurely alerting perpetrators. Recommended methods include:

“Conducting investigations at times when the suspect is not present (such as nonbusiness hours)”.

This avoids tipping off suspects.

TheFraud Examiners Manualstresses that fraud examiners mustnever promise unconditional confidentiality, because findings often must be disclosed to management, auditors, or authorities. They can only offer “qualified confidentiality” (best efforts to protect identity, but with necessary limits). Therefore, optionAis the most appropriate response.

TheCFE Prep Guideclarifies:

“A fraud response plan outlines the actions… when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success”.

Thus, statement D is false.

Body language alone (e.g., avoiding eye contact) cannot be taken as proof of deception. The Manual warns against drawing conclusions from a single behavioral cue:

“Avoiding eye contact isnot directly linked to deception. Such behavior could stem from cultural norms, nervousness, or personality traits. Examiners should consider clusters of behavior, context, and corroborating evidence before concluding deception”.

Therefore,Cis correct.

The best practices for signed statements include:

Adding omitted facts as anaddendum.

Preparingseparate statements for unrelated offenses.

Havingwitnesses to the signing.

But:

“The signed statement should be reduced to a short and concise written statement. The interviewer should prepare the statement and present it to the confessor for his signature” .

Thus, requiring the suspect to handwrite the entire statement isnot a best practice.

From the2014 International Fraud Examiners Manual, under the section related to tracing financial transactions, specifically tracing the disposition of loan proceeds, the following objectives of tracing activities are explicitly outlined:

“Tracing the disposition of loan proceeds can help fraud examiners:

Determine whether loan proceeds were deposited into hidden or unknown accounts

Determine whether loan proceeds were used to pay off other loans

Identify the involvement of previously unknown individuals (potential witnesses)

Determine whether payments were made from hidden accounts

Identify undisclosed related-party transactions”

There isno mentionthat tracing loan proceeds can uncoverprevious civil offensescommitted by the subject. Civil offenses refer to non-criminal violations (e.g., breach of contract, torts), which tracing offinancial transactions like loan proceedsis not directly designed to uncover.

This isnot a recognized purposeof tracing as taught in the CFE Investigation section. The core objectives revolve around uncovering hidden assets, hidden accounts, payments, and potential witnesses —not prior legal infractions.

Therefore, thecorrect answer is A, as it is the only option that isNOT trueaccording to official CFE investigation materials.

TheFraud Examiners Manualstresses that interview notes should be kept separately for each interview, even if the session is electronically recorded, because recordings can fail or be challenged. Verbatim transcripts are not expected, and impressions of guilt should never be included. Best practice is to keep clear, accurate,separate recordsfor every interview .

“In jurisdictions that regulate credit information and personal data, a fraud examiner will generally need a legally acceptable reason for accessing such information from third parties… some common circumstances include when: the individual has given consent”.

Thus, with the individual’s consent, Leslie could obtain the report.

When a respondent says “I’m too busy,” it can be diffused by stressing “the interview will be short, the interviewer is already there, the project is important, [and] the interview will not be difficult”.

Thus, stressing brevity is the recommended reaction.

TheCFE Prep – Investigationsnotes:

“Court records are best obtained from the jurisdiction in which they were filed… The most accurate records are maintained by the court of original jurisdiction, not global or aggregated databases.”

Thus, the best place for Sam is thelocal court of jurisdiction, not a global database.

“Distractions should be kept to a minimum. Ideally, there should be no photographs, windows, or other objects in the room. Chairs should be placed about four to six feet apart, and the accused should not be permitted to sit behind any physical barriers, such as chairs, tables, or desks” .

The door should be closed (but not locked), not open .

Tables or desks should not be between interviewer and suspect .

Thus, the correct adjustment is removing distractions (pictures/posters).

When introducing themselves, fraud examiners should avoid titles likeinvestigatororCertified Fraud Examinerthat might raise suspicion or defensiveness. TheManualrecommends using neutral titles such asauditorbecause it is less threatening and more acceptable in an organizational setting.

A memorandum recording a whistleblower tip is a written record. TheFraud Examiners Manualdefinesdocumentary evidenceas evidence “presented in the form of documents such as memoranda, contracts, emails, or other records”. Testimonial evidence comes from oral statements; here, the memorandum itself is the evidence, so it is documentary.

The organizational filings with the government of the jurisdiction in which the company is incorporated

Explanation: Organizational filings (e.g., articles of incorporation) are generally public records and includeownership information, initial shareholders, and the location of the principal office.

The manual emphasizes that interviews—especially with subjects in other jurisdictions—poselegal and cultural considerations. Fraud examiners must considercultural norms (such as personal space, body language, and eye contact) and jurisdiction-specific lawsgoverning the use of information from interviews. In particular, some jurisdictions limit how interview information can later be used. Therefore, the most accurate statement is that the examiner should verify such limitations before proceeding.

TheFraud Examiners Manualspecifies that admission-seeking interviews should only be conducted when:

“There is a reasonable probability that the respondent has committed the act in question.

All other reasonable investigative steps have been completed.

The interviewer can reasonably control the place, time, and subject matter of the interview.”

There isno requirementthat the examiner must be sure no one else was involved. Therefore,C is correct.

TheFraud Examiners ManualandCFE Prepemphasize:

“Generally, documentary evidence, including digital evidence, will not be admitted in a legal proceeding unless it is established as authentic… Consequently, fraud examiners who collect evidence from social media must capture, download, and preserve any useful information as soon as they discover it, and they must memorialize each step of the collection process”.

Thus, preservation for authenticity is the key.

Link analysis is described as avisual analytic toolthat:

“Tracks the movement of money,”

“Demonstrates complex networks,”

“Helps identify indirect relationships with several degrees of separation,” and

“Discovers communications, patterns, and trends.”

It doesnotdisplay financial ratios—that belongs to traditionalfinancial statement/ratio analysis.

The manuals explain that in verbal confessions, subjects oftenunderestimatethe amounts to minimize guilt, not overestimate. The process involves moving from accusation to benchmark admission, handling lies tactfully, and obtaining details by chronology, transaction, or event. Thus, optionBis NOT true.

TheFraud Examiners Manualnotes:

“Fraud examiners are often tasked with tracing illicit transactions… For example, a victim of fraud might want a tracing search to facilitate the recovery of criminal proceeds”.

The2014 International Fraud Examiners Manualexplains:

“Often, the most important evidence exists only in the form of volatile data (e.g., RAM)… If the evidence that a formally trained computer investigator needs to collect exists only in the form of volatile data stored in volatile computer memory such as RAM, and the data is expected to disappear when the computer is shut down, he should collect the data live from the suspect computer.”

Also,

“If the computer is off, leave it off… Booting up a system can alter its files… Accordingly, turning a system on could damage and taint any evidence.”

Thus, themost accurate statementisD— live data collection may be performed directly if volatile data is required.

The2014 International Fraud Examiners Manualprovides:

“Fraud examiners can use a correlation analysis to determine the relationships between different variables in raw data… For example, there should be a strong correlation between the independent and dependent variables because there is a direct relationship between them.Hotel costs should increase as the number of days travelled increases.”

CFE Prep – Investigationsechoes this:

“Using the correlation analysis function, fraud examiners can determine the relationships between different variables in the raw data. For example…Hotel costs should increase as the number of days travelled increases.”

Thus, the most useful analysis isCorrelation analysis.

When preparing for interviews, fraud examiners should avoid scripting detailed questions. Instead, they prepare notes of key points to cover.

From the Fraud Examiners Manual:

“Whenever possible, do not prepare a list of predetermined questions to ask the subject. The interview should flow freely. The interviewer might, however, want to develop alist of key points to coverduring the interview”.

Therefore, the best preparation method is to note key points instead of detailed questions.