ACFE CFE-Investigation Dumps

Oral consent is generallynot sufficientto obtain a suspect’s bank records. TheCFE Prep - Investigationsstates:

“Accessing a subject’s bank records from financial institutions generally requires written consent. Oral consent is the least effective way to obtain permission”.

TheFraud Examiners Manualalso notes that bank information can usually only be obtained withsubpoena, search warrant, or written consent.

The2014 International Fraud Examiners Manualdefines:

“Fraud examination is a methodology of resolving signs or allegations of fraud from inception to disposition. The fraud examination methodology establishes a uniform, legal process for resolving signs or allegations of fraud on a timely basis.”

Similarly,CFE Prep – Investigationsconfirms:

“The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional.”

Thus, the correct answer isD.

Explanation: TheFraud Examiners Manualnotes that predictive modeling and data analysis allow fraud examiners to detect fraud by usinghistorical data to forecast future trends and anomalies. This matches optionB.

A memorandum recording a whistleblower tip is a written record. TheFraud Examiners Manualdefinesdocumentary evidenceas evidence “presented in the form of documents such as memoranda, contracts, emails, or other records”. Testimonial evidence comes from oral statements; here, the memorandum itself is the evidence, so it is documentary.

The Manual and Prep Guide state:

“Before conducting a covert operation, it is essential that the basis for the operation be committed to writing, preferably in a memo. The memorandum should clearly state: the information upon which the covert operation will be based; the information that is expected to be gained from the operation; the identities of suspects, if known; operatives under the fraud examiner’s care, custody, or control. Confidential sources’ identities should not be disclosed.”

Thus,expected informationbelongs, butconfidential source identitiesmust not

During admission-seeking interviews, when suspects persist with denials or alibis, examiners are trained to diffuse them. Accepted techniques include:

Discussing testimony of witnesses,

Displaying physical evidence, and

Downplaying the strength of evidence.

However, manuals caution that discussing a suspect’sprior deceptionsis not an effective or recommended method to diffuse alibis. It risks confrontation and may damage rapport, reducing chances of confession.

Therefore, optionCis the exception.

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

The2014 International Fraud Examiners Manualexplains:

“Often, the most important evidence exists only in the form of volatile data (e.g., RAM)… If the evidence that a formally trained computer investigator needs to collect exists only in the form of volatile data stored in volatile computer memory such as RAM, and the data is expected to disappear when the computer is shut down, he should collect the data live from the suspect computer.”

Also,

“If the computer is off, leave it off… Booting up a system can alter its files… Accordingly, turning a system on could damage and taint any evidence.”

Thus, themost accurate statementisD— live data collection may be performed directly if volatile data is required.

TheCFE Prep Guideclarifies:

“A fraud response plan outlines the actions… when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success”.

Thus, statement D is false.

When preparing for interviews, fraud examiners should avoid scripting detailed questions. Instead, they prepare notes of key points to cover.

From the Fraud Examiners Manual:

“Whenever possible, do not prepare a list of predetermined questions to ask the subject. The interview should flow freely. The interviewer might, however, want to develop alist of key points to coverduring the interview”.

Therefore, the best preparation method is to note key points instead of detailed questions.

TheFraud Examiners Manualwarns against phrasing admissions as direct questions using emotive terms:

“The admission-seeking interview begins with a direct accusation… The accusation should be phrased as though the accused’s guilt has already been established. Emotive words such as steal, fraud, and crime should be avoided… Wrong: ‘Did you do this?’”.

Thus, phrasing the question as“Did you steal the money?”is least effective.

Pretexting is defined asimpersonating someone else or making false/misleading statements to obtain information. Many jurisdictions specifically prohibitpretexting against financial institutions, which includes pretending to be a customer to access their bank account information.

TheFraud Examiners ManualandCFE Prepemphasize:

“Generally, documentary evidence, including digital evidence, will not be admitted in a legal proceeding unless it is established as authentic… Consequently, fraud examiners who collect evidence from social media must capture, download, and preserve any useful information as soon as they discover it, and they must memorialize each step of the collection process”.

Thus, preservation for authenticity is the key.

TheFraud Examiners Manualstresses that interview notes should be kept separately for each interview, even if the session is electronically recorded, because recordings can fail or be challenged. Verbatim transcripts are not expected, and impressions of guilt should never be included. Best practice is to keep clear, accurate,separate recordsfor every interview .

The Fraud Examiners Manual and CFE Prep Guide explain that tracing loan proceeds is a key investigative tool, but its scope is limited. Specifically, it helps determine:

if proceeds were deposited into hidden accounts,

if hidden accounts were used for loan payments, and

if loans were secured by hidden assets or unknown witnesses.

However, the manuals do not state that tracing loan proceeds can identify internal control weaknesses. That is a different aspect of fraud examination, often addressed through audit procedures or control assessments.

Thus, optionDis NOT true.

Digital forensics guidance stresses:

If the computer isoff,do not turn it on, because booting will alter files and timestamps.

If the computer isonand volatile data is needed (e.g., RAM), a formally trained examiner may collect it live. Otherwise, simply unplugging the system (hard shutdown) preserves volatile evidence better than a graceful shutdown.

Thus, if the evidence exists only in volatile data and the system is running, Nobles may collect it via the normal interface.

✅Answer: A. If Lucas's computer is running, Nobles may retrieve data… if the evidence exists only in volatile data

“Opinions or conclusions concerning the guilt or innocence of a fraud suspect is outside the scope of a fraud examination and should never be included in a report”.

Functions of a fraud examination report include presenting evidence, corroborating facts, and supporting credibility. Communicating the examiner’s qualifications to provide opinions isnota function.

Therefore, option D is not a function of a fraud examination report.

Benford’s Law applies to naturally occurring sets of numbers such asinvoice amounts, expense reports, and transaction data. The Fraud Examiners Manual shows Benford’s Law tests applied to vendor payments to detect anomalies like duplicate or inflated invoices. Telephone numbers, employee IDs, and bank account numbers areassigned numbersand do not follow Benford’s distribution, so they are unsuitable for this test.

“Once a suspect utters a denial, it becomes extremely difficult… therefore, the interviewer mustprevent an outright denial. Fraud examiners can use several techniques to stop or interrupt denials, includingdelays, repeated interruptions, and reasoning”.

Thus, the correct answer isD.

The manual defines:

“Open questions are those worded in a way that makes it difficult for the respondent to answer ‘yes’ or ‘no.’ The typical open question calls for a monologue response and can be answered in several different ways.”

Example given: “Please tell me about your job.”

Allison’s question (“Why did you choose to do business with that vendor?”) invites explanation, not a yes/no response — making it anopen question.

The Manual defines leading questions as those that contain or suggest the answer:

“Leading questions… are framed in a way that evokes a specific reply… most commonly used to confirm facts already known… Example: ‘You got promoted, right?’”

Nathaniel’s question, “When were you promoted to manager?” presumes the promotion occurred. Thisleadsthe subject by suggesting a fact that may not be true. It is not open (does not invite free narration), not complex (it asks one thing), and not closed (doesn’t call for yes/no but presumes an answer).

TheFraud Examiners Manualnotes:

“Management of an organisation should ensure that the organisation has a proper and effective document retention policy in place… An effective policy requires clear retention protocols… and should be immobilised due to a pending investigation or foreseeable litigation.”

Thus, the existence of a document retention policy is a critical factor in deciding how to dispose of evidence.

TheFraud Examiners Manualexplains that rather than drafting an exhaustive list of questions, the interviewer should:

“formulate a brief outline of key points to discuss during the interview”.

This helps organize thoughts while allowing flexibility.

Limitations of online public record searches include:

Need to search multiple jurisdictions.

Records are often only abstracts.

Information must be verified for accuracy.There isno mentionthat online record vendors are “difficult to find.” In fact, many such vendors exist.

“To locate people using online records… First, when searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

This aligns with the Prep guide: “Obtaining a past address of the subject should be the first step in trying to locate a subject using online records”.

Thus, B is correct.

The recommended questioning order is:

“As a general rule, questioning should proceed from thegeneral to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

Thecorrect answeris:Whether recording is legal depends onconsent laws— so the most helpful question is effectively:“Is consent required from one or all parties to record this conversation?”

Among the provided choices, theclosest matchisNOT listed explicitly. But based on the ACFE manuals, the correct interpretation is that none of the technical details (audio/video, file format, time, duration) matter —only the legal consent requirement matters.

Complete Detailed Explanation with Exact Extracts from Fraud Examiner (CFE) - Investigation Documents: =

The2014 International Fraud Examiners Manualstates:

“In some circumstances, recording an interview might be illegal. Some jurisdictions limit an employer’s right to record employee interviews during an investigation. In fact, in some jurisdictions, audio recording an interview is permitted only with the consent of all parties to the communication. Thus, fraud examiners should always consult with an attorney when deciding whether to record an interview.”

It further emphasizes:

“A telephone recording consent form stipulates where, when, and with whom telephone conversations can be recorded… Be cautioned that the form alone does not make the conduct of recording a telephone conversation illegal or legal.”

????Interpretation:

The legality of recording has nothing to do with:

Audio vs video(A)

Digital file format(B)

Work hours(C)

Duration(D)

Instead, it dependsentirely on jurisdictional consent laws(one-party vs all-party consent).

From the2014 International Fraud Examiners Manual, under the section related to tracing financial transactions, specifically tracing the disposition of loan proceeds, the following objectives of tracing activities are explicitly outlined:

“Tracing the disposition of loan proceeds can help fraud examiners:

Determine whether loan proceeds were deposited into hidden or unknown accounts

Determine whether loan proceeds were used to pay off other loans

Identify the involvement of previously unknown individuals (potential witnesses)

Determine whether payments were made from hidden accounts

Identify undisclosed related-party transactions”

There isno mentionthat tracing loan proceeds can uncoverprevious civil offensescommitted by the subject. Civil offenses refer to non-criminal violations (e.g., breach of contract, torts), which tracing offinancial transactions like loan proceedsis not directly designed to uncover.

This isnot a recognized purposeof tracing as taught in the CFE Investigation section. The core objectives revolve around uncovering hidden assets, hidden accounts, payments, and potential witnesses —not prior legal infractions.

Therefore, thecorrect answer is A, as it is the only option that isNOT trueaccording to official CFE investigation materials.

Both the Manual and CFE Prep guides emphasize that forensic imaging is essential because:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging… allows a fraud examiner to view and analyse… without altering the original data in any way”.

A forensic image is anexact, sector-by-sector copyof the drive. Thus, imaging preserves evidence integrity.

Phone records are classified asnonpublic records. TheFraud Examiners Manualexplains that personal telephone and mobile records usually requireconsent, subpoena, or warrantto access. Public records, by contrast, include real property ownership and corporate filings. Therefore,Bis correct.

“Metadata information can help determine who wrote a document, who received, opened, copied, edited, moved, or printed the document, andwhen these events occurred”.

Thus, metadata is the best source for creation date.

Fraud examiners mustnot opine on guilt, innocence, intent, or disposition. Reports should focus onfacts and expert conclusions within their field. The Manual stresses:

“The fraud examiner should refrain from expressing opinions as to the guilt or innocence of any person or entity. Such conclusions are reserved for the trier of fact” (Fraud Examiners Manual, Reporting section).

Options A, B, and D relate toaccounting and internal control assessments, which fall within an accounting expert’s scope. OnlyCis improper because it speculates about the suspect’s character or intent, which is outside the CFE’s role.

TheFraud Examiners Manualmakes clear:

“Fraud examiners should never offer opinions regarding guilt or innocence. Reports must be factual, objective, and free from speculation. Statements implying guilt are improper.”

Thus, while it is proper to note contradictions, evidence, or control weaknesses, it isimproper to declare the suspect guilty.

TheFraud Examiners Manualstates:

“If a business or individual constructs a new building or makes improvements to an existing building, there should be a building permit on file with the local building authority. In many cases, the person applying for permits will be the owner or someone traceable to the owner.”

CFE Prepsupports this:

“Building permit records… are often required before most businesses can open… and often list the owner or someone traceable to the owner.”

Thus,building permit recordsare most likely to help identify the restaurant’s owner.

Explanation with Extracts= Pretexting is:

“The act of impersonating someone else or making false or misleading statements to obtain information from financial institutions. Several jurisdictions have prohibited pretexting against financial institutions”.Thus, falsely claiming to be the spouse constitutes illegal pretexting.

Nonpublic records include banking, tax, credit, phone, credit card, and health care records.

Business entity organisational filings (corporate constitutions, articles of incorporation) are generallypublic recordsand can be obtained from the government.

Therefore, reviewing a company’s business filings doesnotrequire access to nonpublic records.

Fraud examination reports are not written only for internal use. The2014 International Fraud Examiners Manualclearly emphasizes:

“When drafting a report, fraud examiners must consider who might end up reading it. Fraud examiners should keep in mind that the fraud examination report will be read by the general public and adverse parties. Under no circumstances should the fraud examiner prepare a communication with the idea that the information will not be disclosed to adverse third parties. Fraud examiners should draft their reports with this caveat in mind.”

The manual further specifies the wide range of potential readers:

*“There are many individuals and groups that might end up reading a fraud examination report, including the following parties:

Company insiders (managers, board of directors, owners, investors, etc.)

Attorneys (legal counsel, prosecutors, regulators, and defense counsel)

Defendants and witnesses

Press and media outlets

Judges or juries”*

This aligns with theCFE Prep - Investigationsstudy guide, which also confirms:

“There are many parties that might read a fraud examination report, including company insiders, attorneys, defendants and witnesses, press and media outlets, and judges or juries.”

????Interpretation:

The mediamay access the report through litigation disclosures or leaks.

Opposing legal counselwill review the report during discovery or trial.

Investors and owners(company insiders) are primary stakeholders.

Thus, the only correct choice isD. All of the above, because fraud examination reports must be written withall possible audiences in mind, ensuring accuracy, clarity, impartiality, and professionalism to withstand scrutiny from multiple directions.

“Securities regulators… require disclosures that typically include: corporate financial statements, identification of officers and directors, identification of significant owners… and a history of the business”【10:2014 International Fraud Examiners Manual.pdf†L73-L95】.

Thus, regulatory securities records are the best source for financial statements.

Referring to the informant in the memorandum using the informant's initials

Explanation: Best practice requires that informants be identifiedonly by symbols (e.g., I-1, I-2), not by initials, to protect their identity. Cash payments are acceptable but must be accompanied by areceipt.

Best practice for signed statements:

Fraud examiners should prepare the statement, keep it concise, and ensure voluntariness and intent are clear.

While not legally required, it isrecommendedthat two individuals witness the signing.✅Answer: C. Have two individuals witness the signing of the document when possible

The Fraud Examiners Manual explains that recommendations in a report areoptional, not mandatory. When included, they should cover remedial measures such as control reviews or increased security.

“Finally, the fraud examiner might decide to include a section for recommendations. The recommendations section should containremedial measures or specific recommendations for follow-up actions… This section is optional”.

Therefore,Cis correct. Options A and D are incorrect because recommendations are not required in every report, and B misstates its purpose.

In admission-seeking interviews, one rationalization technique is todepersonalize the victim(e.g., shifting the perception so the harm was against a company, not individuals). The example in the question—“It isn’t like you took something from a friend or neighbor”—is exactly this technique.

“Even when a victim refers a fraud case for criminal prosecution, the government will usuallynot disclose the contents of nonpublic records with the victim during the investigation”.

Thus, optionDis most accurate.

TheFraud Examiners Manuallists required steps before seizing evidence:

Obtain legal authority.

Review privacy issues.

Ensure software/hardware are validated.

Document surroundings, inspect for traps, image drives, etc.

There isno requirementto assemble a team exclusively of outside experts.

Before seizing evidence in adigital forensic investigation, the2014 International Fraud Examiners Manualoutlines several critical steps:

Obtain legal authority / review orders:

“Before obtaining evidence, ensure that there is legal authority to seize evidence and review the data associated with the evidence. This might require obtaining a warrant in a criminal matter or ensuring that internal policies authorise seizure for an internal investigation.”

Determine privacy issues:

“Before the fraud examiner can seize evidence, he must take certain steps to help ensure that the evidence will be admissible: He must determine whether there are any privacy interests in the item(s) to be searched… In every case where it becomes necessary to seize a computer or other device capable of storing digital evidence, the investigator should consult with legal counsel.”

Use only trained professionals/software:

“It is important to allow a trained examiner to conduct a proper seizure and examination of digital evidence to help ensure that the information can be used in a legal proceeding.”

✅These are allvalid required steps.

In contrast, the idea that the team must be composedonly of outside digital forensic expertsisNOT a required step. The Manual stresses flexibility in team composition:

“Some organisations have their own in-house personnel… while others might prefer the use of an outside examiner. Sometimes retrieving digital data is as easy as searching the target computer’s hard drive, but other times retrieval requires a thorough knowledge of computers.”

Thus, requiringonly outside expertsis not a standard step, since investigations may useinternal, external, or a mixof specialists depending on the situation.

Complex questions:

“consist of a series of interrelated questions… too complicated to be easily understood, cover more than one subject, or require more than one answer”.

The question asked by Delta (“Were you aware that the signature was forged, and why didn’t you tell anyone earlier?”) covers two issues, making itcomplex.

Best practices for admission-seeking interviews emphasize building rapport, presenting a morally acceptable reason, and maintaining empathy to encourage a confession. The manual states examiners should “present a morally acceptable reason for the suspect’s behavior” and avoid creating hostility . Minimizing empathy is counterproductive andnot recommended.

The2014 Fraud Examiners ManualandCFE Prepexplain:

“Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.”

Thus, the correct answer isA.

TheCFE Prep – Investigationswarns against relying solely on eye contact:

“Behavioural clues are harder to read … Additionally, racial, ethnic, and economic factors should be carefully considered when observing a respondent’s behaviour. Some cultures, for example, discourage looking directly at someone. Other cultures use certain body language that might be misinterpreted.”

Therefore, lack of eye contactcannot safely be taken as proof of dishonesty.

The manual and CFE Prep list the main limitations:

Coverage varies by jurisdiction.

Searches are limited in area.

Records are often abstracts.

Information may be inaccurate or outdated.

Searches can be erratic.

Nowhere is “difficulty in finding database companies” mentioned.

Link analysis is described as avisual analytic toolthat:

“Tracks the movement of money,”

“Demonstrates complex networks,”

“Helps identify indirect relationships with several degrees of separation,” and

“Discovers communications, patterns, and trends.”

It doesnotdisplay financial ratios—that belongs to traditionalfinancial statement/ratio analysis.

Nonverbal deception cues include feigned unconcern, slouching, chewing objects, and manipulating clothing. Michelle’s conduct (chewing pen cap, picking at fabric, appearing unconcerned) matches these signs ofdeception.