CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Questions and Answers

“Distractions should be kept to a minimum. Ideally, there should be no photographs, windows, or other objects in the room. Chairs should be placed about four to six feet apart, and the accused should not be permitted to sit behind any physical barriers, such as chairs, tables, or desks” .

The door should be closed (but not locked), not open .

Tables or desks should not be between interviewer and suspect .

Thus, the correct adjustment is removing distractions (pictures/posters).

When dealing with potentially hostile or volatile interviewees, fraud examiners are advised not to give much advance notice. This reduces the chance that the subject will prepare evasive or combative responses. The Fraud Examiners Manual emphasizes minimizing preparation time for resistant interviewees to ensure more candid responses.

“When searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

Therefore, saying a past address is “of no help” is incorrect.

“Signs of stress do not always mean that a subject is lying… While lying and deception do cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

The Prep guide confirms: “While lying and deception do indeed cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

Therefore, Carlos should not automatically conclude deception from stress behaviors.

The manual notes:

“Records subpoenaed in a criminal case usually are available only to the government during the investigation, and perhaps thereafter if not disclosed at trial”.

Thus, statement D is false.

The Fraud Examiners Manual notes:

“Fraud examiners are often tasked with tracing illicit transactions… For example, a victim of fraud might want a tracing search to facilitate the recovery of criminal proceeds”.

The Fraud Examiners Manual advises avoiding prematurely alerting perpetrators. Recommended methods include:

“Conducting investigations at times when the suspect is not present (such as nonbusiness hours)”.

This avoids tipping off suspects.

When a suspect becomes withdrawn or emotional after alibis are diffused:

“The interviewer should not remain silent or discourage the accused from showing emotion. Such reactions often indicate consideration of confession. At this point, the interviewer should present an alternative question and continue reinforcing guilt with evidence”.

Thus, Scarlett should continue presenting evidence.

“Metadata information can help determine who wrote a document, who received, opened, copied, edited, moved, or printed the document, and when these events occurred”.

Thus, metadata is the best source for creation date.

The Fraud Examiners Manual lists specific queries for accounts payable analysis, including:

“Review recurring monthly expenses and compare to posted/paid invoices.”.

While comparing book vs. tax depreciation applies to asset management (not A/P), and identifying paycheck anomalies applies to payroll (not A/P), the most effective A/P-specific test is the recurring expense comparison. Hence, C is correct.

The Fraud Examiners Manual explains that rather than drafting an exhaustive list of questions, the interviewer should:

“formulate a brief outline of key points to discuss during the interview”.

This helps organize thoughts while allowing flexibility.

The Fraud Examiners Manual and CFE Prep Guide explain that tracing loan proceeds is a key investigative tool, but its scope is limited. Specifically, it helps determine:

if proceeds were deposited into hidden accounts,

if hidden accounts were used for loan payments, and

if loans were secured by hidden assets or unknown witnesses.

However, the manuals do not state that tracing loan proceeds can identify internal control weaknesses. That is a different aspect of fraud examination, often addressed through audit procedures or control assessments.

Thus, option D is NOT true.

 “As a general rule, questioning should proceed from the general to the specific; it is best to seek general information before details. A variation… is to begin with known information and work towards unknown areas”【9:2014 International Fraud Examiners Manual.pdf†L39-L51】.

 Random order is not recommended and breaks the logical flow.

The Fraud Examiners Manual states:

“If a business or individual constructs a new building or makes improvements to an existing building, there should be a building permit on file with the local building authority. In many cases, the person applying for permits will be the owner or someone traceable to the owner.”

CFE Prep supports this:

“Building permit records… are often required before most businesses can open… and often list the owner or someone traceable to the owner.”

Thus, building permit records are most likely to help identify the restaurant’s owner.

The Fraud Examiners Manual states:

“The expenditures method works best when the subject spends illicit income on consumables (e.g., travel and entertainment), because when the subject spends the illicit income, it will not cause an increase in net worth.”

CFE Prep confirms:

“The expenditures method … is best used when the subject spends illicit income on consumables (such as travel and entertainment) that would not cause an increase in net worth.”

Thus, the correct answer is A.

The manual emphasizes that interviews—especially with subjects in other jurisdictions—pose legal and cultural considerations. Fraud examiners must consider cultural norms (such as personal space, body language, and eye contact) and jurisdiction-specific laws governing the use of information from interviews. In particular, some jurisdictions limit how interview information can later be used. Therefore, the most accurate statement is that the examiner should verify such limitations before proceeding.

“Once a suspect utters a denial, it becomes extremely difficult… therefore, the interviewer must prevent an outright denial. Fraud examiners can use several techniques to stop or interrupt denials, including delays, repeated interruptions, and reasoning”.

Thus, the correct answer is D.

The 2014 Fraud Examiners Manual and CFE Prep explain:

“Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.”

Thus, the correct answer is A.

Observing signs of wealth (sports car, home remodeling) may raise suspicion, but by itself it does not provide sufficient predication to accuse or notify management of fraud. The proper next step is to conduct discreet inquiries to determine if further evidence exists before escalating.

A memorandum recording a whistleblower tip is a written record. The Fraud Examiners Manual defines documentary evidence as evidence “presented in the form of documents such as memoranda, contracts, emails, or other records”. Testimonial evidence comes from oral statements; here, the memorandum itself is the evidence, so it is documentary.

The Fraud Examiners Manual advises:

“Do not slow down the interview process for note-taking. Instead, jot down key words … In general, it is better to err on the side of taking too few notes rather than too many.”

Therefore, the best practice is C.

Oral consent is generally not sufficient to obtain a suspect’s bank records. The CFE Prep - Investigations states:

“Accessing a subject’s bank records from financial institutions generally requires written consent. Oral consent is the least effective way to obtain permission”.

The Fraud Examiners Manual also notes that bank information can usually only be obtained with subpoena, search warrant, or written consent.

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

The Fraud Examiners Manual stresses that fraud examiners must never promise unconditional confidentiality, because findings often must be disclosed to management, auditors, or authorities. They can only offer “qualified confidentiality” (best efforts to protect identity, but with necessary limits). Therefore, option A is the most appropriate response.

Link analysis is described as a visual analytic tool that:

“Tracks the movement of money,”

“Demonstrates complex networks,”

“Helps identify indirect relationships with several degrees of separation,” and

“Discovers communications, patterns, and trends.”

It does not display financial ratios—that belongs to traditional financial statement/ratio analysis.

Pretexting is defined as impersonating someone else or making false/misleading statements to obtain information. Many jurisdictions specifically prohibit pretexting against financial institutions, which includes pretending to be a customer to access their bank account information.

The CFE Prep Guide clarifies:

“A fraud response plan outlines the actions… when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success”.

Thus, statement D is false.

To confirm ownership of a building, real estate and permit records are most useful. The Manual notes that real property records and related permits identify the owner, provide legal descriptions, and show improvements such as construction of commercial buildings. Court or voter registration records would not typically establish property ownership.

“Opinions or conclusions concerning the guilt or innocence of a fraud suspect is outside the scope of a fraud examination and should never be included in a report”.

Functions of a fraud examination report include presenting evidence, corroborating facts, and supporting credibility. Communicating the examiner’s qualifications to provide opinions is not a function.

Therefore, option D is not a function of a fraud examination report.

Admission-seeking interviews are designed:

“to obtain a legal admission of wrongdoing… also to distinguish innocent individuals from culpable ones and to secure a signed written statement”.

The primary purpose is obtaining a valid confession.

The Fraud Examiners Manual emphasizes that before commencing legal action to recover assets, the examiner must consider whether the defendant has assets worth pursuing:

“The most important question a fraud examiner should ask before beginning legal action to recover assets is whether the defendant has sufficient property or money to satisfy a judgment. Legal actions can be time-consuming and costly, and recovery efforts are futile if the defendant is judgment-proof.”

Before commencing legal action to recover assets, the most critical consideration is whether the defendant has recoverable assets. If the defendant lacks property or funds, pursuing legal action could be costly and ultimately fruitless.

From the 2014 International Fraud Examiners Manual:

“After a fraud is discovered, fraud examiners might need to assist in making a recommendation concerning the recovery of lost assets… A domestic judgment against a foreign defendant is usually helpful for recovering the defendant’s assets located in the domestic country, but might be worthless for obtaining the defendant’s assets in a foreign country.”

This emphasizes that enforcement of judgments is only meaningful if assets exist to satisfy them.

Similarly, the CFE Prep - Investigations material highlights asset tracing and recovery as the foundation for deciding legal action:

“Records obtained from financial institutions are perhaps the single most important financial source available to fraud examiners for purposes of tracing assets.”

???? Interpretation of Answer Choices:

A. Prior arrests → Not directly relevant to whether asset recovery will succeed.

C. Statute of limitations → Important for legal viability, but meaningless if no assets exist to recover.

D. Guilt of the suspect → Guilt must be established in criminal cases, but in civil recovery, asset availability is paramount.

B. Defendant’s property or money → This is the most important practical question, because without assets, recovery efforts will not yield compensation regardless of guilt or legal timelines.

The Fraud Examiners Manual states:

“Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction… emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive”.

Thus, statement C is NOT true.

The Financial Action Task Force (FATF) Recommendations, as cited in the Fraud Examiners Manual, require enhanced due diligence in correspondent banking relationships. Specifically, banks must “avoid correspondent banking with shell banks” and ensure the foreign institution is properly licensed and regulated.

This means financial institutions must confirm that the foreign correspondent bank holds the necessary licenses or certifications to operate legitimately.

Other options (branch addresses, tax statements, or client loan profiles) are not mandated under FATF’s correspondent banking due diligence requirements. The most critical factor is verifying the correspondent institution’s legal authorization (licenses/certifications) to prevent money laundering and terrorist financing.

The Fraud Examiners Manual defines double-negative questions as those containing two forms of negation in a single clause. They are confusing and “often suggest an answer opposite to the correct one.” The example given is almost identical to the question here:

“Didn’t you suspect that something wasn’t right?”.

Thus, Sylvia’s question is a double-negative question, which should be avoided.

“The interviewer generally should indicate his name and company, but he should avoid stating his title. In general, the more informal the interview, the more relaxed the respondent”.

Introducing oneself only by name and company (not title like CFE or auditor) avoids intimidation and builds cooperation.

The organizational filings with the government of the jurisdiction in which the company is incorporated

Organizational filings (e.g., articles of incorporation) are generally public records and include ownership information, initial shareholders, and the location of the principal office.

Social media content is dynamic—posts can be edited, deleted, or moved—so fraud examiners must preserve relevant information promptly and in a manner that supports authenticity and admissibility. CFE investigative guidance emphasizes that documentary (including digital) evidence carries limited value in legal proceedings unless it can be shown to be authentic and in substantially the same condition as when collected. Simply saving a link (Option A) is weak because the underlying content can change, and a link does not preserve what was actually observed. Requesting a copy from the platform (Option B) is often impractical as a routine step and may require legal process; it also does not replace contemporaneous preservation by the examiner. A “forensic shutdown” (Option C) is not an appropriate method for preserving web-based social media content because the key evidence exists on external servers, not solely on the examiner’s machine. Proper practice is to download/capture and preserve what was observed while documenting the collection steps and maintaining a defensible chain of custody so authenticity can be established if needed in court.

Fraud examiners must not opine on guilt, innocence, intent, or disposition. Reports should focus on facts and expert conclusions within their field. The Manual stresses:

“The fraud examiner should refrain from expressing opinions as to the guilt or innocence of any person or entity. Such conclusions are reserved for the trier of fact” (Fraud Examiners Manual, Reporting section).

Options A, B, and D relate to accounting and internal control assessments, which fall within an accounting expert’s scope. Only C is improper because it speculates about the suspect’s character or intent, which is outside the CFE’s role.

Complex questions:

“consist of a series of interrelated questions… too complicated to be easily understood, cover more than one subject, or require more than one answer”.

The question asked by Delta (“Were you aware that the signature was forged, and why didn’t you tell anyone earlier?”) covers two issues, making it complex.

When obtaining a verbal confession, the fraud examiner should secure details such as: admission of wrongdoing, number of instances, amount involved, dates, involvement of others, residual assets, and motive. However, it does not matter whether the suspect claims the conduct was an accident; that is not necessary to record.

Wire transfer records include specific transactional details:

“The information contained on a wire transfer generally will include… the amount of the transfer, the date, the name of the sender, the routing number of the originating bank, the identity of the beneficiary, [and] the routing number of the recipient bank”.

They do not list things like the type of money order, customs port of entry, or government ID numbers (CFE Prep explicitly states that recipient government IDs are not typically included).

“Fraud examinations should proceed from the general to the specific. That is, they should begin with general information that is known, starting at the periphery, and then move to the more specific details”.

This method avoids premature assumptions and ensures systematic evidence development.

After alibis are diffused, suspects may become quiet, withdrawn, or even cry. This often indicates they are considering confession. At this point, the interviewer should present an alternative question, forcing a choice between two answers that both imply guilt, thus leading toward a benchmark admission.

“Securities regulators… require disclosures that typically include: corporate financial statements, identification of officers and directors, identification of significant owners… and a history of the business”【10:2014 International Fraud Examiners Manual.pdf†L73-L95】.

Thus, regulatory securities records are the best source for financial statements.

Explanation with Extracts = The Fraud Examiners Manual explains:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging the data… allows a fraud examiner to view and analyse the contents of a computer without altering the original data in any way”.

Imaging creates an exact, sector-by-sector copy of the drive.

Thus, imaging protects original data integrity.

The manual explains:

“Link analysis is very effective for identifying indirect relationships… and is particularly useful when conducting a money laundering investigation because it can track the placement, layering, and integration of money” .

Therefore, statement A is false, making it the correct choice.

“In jurisdictions that regulate credit information and personal data, a fraud examiner will generally need a legally acceptable reason for accessing such information from third parties… some common circumstances include when: the individual has given consent”.

Thus, with the individual’s consent, Leslie could obtain the report.

The Fraud Examiners Manual warns against phrasing admissions as direct questions using emotive terms:

“The admission-seeking interview begins with a direct accusation… The accusation should be phrased as though the accused’s guilt has already been established. Emotive words such as steal, fraud, and crime should be avoided… Wrong: ‘Did you do this?’”.

Thus, phrasing the question as “Did you steal the money?” is least effective.

Benford’s Law applies to naturally occurring sets of numbers such as invoice amounts, expense reports, and transaction data. The Fraud Examiners Manual shows Benford’s Law tests applied to vendor payments to detect anomalies like duplicate or inflated invoices. Telephone numbers, employee IDs, and bank account numbers are assigned numbers and do not follow Benford’s distribution, so they are unsuitable for this test.

The Fraud Examiners Manual states:

“Duplicate testing is used to identify transactions with duplicate values in specified fields … fields such as cheque numbers, invoice numbers, and government identification numbers … searching for duplicates within these fields can help the fraud examiner find anomalies that merit further examination”.

This directly addresses Tony’s need to ensure no two invoices have the same number.