Practice Free CFE-Fraud-Schemes-and-Financial-Crimes Certified Fraud Examiner -Fraud Schemes and Financial Crimes Exam Questions Answers With Explanation

Detailed Explanation:

Rationale for Correct Answer: Horizontal analysis evaluates financial statement items over multiple periods, highlighting percentage changes from one period to another . This helps detect unusual trends or anomalies.

Analysis of Incorrect Options:

A – Describes vertical analysis (common-size statements).

B – Describes ratio analysis .

D – Describes benchmarking/comparative analysis across companies.

Key Concept: Analytical procedures – horizontal vs. vertical and ratio analysis.

The correct answer is B. A request to send payment to a country different from where the third party conducts business is a significant red flag in corruption and bribery schemes. Such payment instructions can indicate attempts to conceal beneficial ownership, route funds through offshore accounts, disguise improper commissions, or make corrupt payments difficult to trace. Option A is not necessarily suspicious because many legitimate vendors use one business address and phone number. Option C can reflect legitimate competitive strength if the vendor truly provides superior services. Option D is also not inherently suspicious because lower prices may result from efficiency or market strategy. Fraud examiners should treat unusual third-party payment destinations as high-risk indicators requiring enhanced due diligence and documentation review.

================

The correct answer is A because businesses should protect employees’ and customers’ personal information, particularly when it is transmitted over wireless networks. Encryption reduces the risk that identity thieves can intercept and misuse sensitive information. Option B is poor practice because using government identification numbers as employee identification numbers increases exposure if internal records are accessed. Option C is too broad and not risk-based; access to customer information should be limited to employees with a legitimate business need, not simply management status. Option D is incorrect because regular audits and reviews of information-handling practices help identify weaknesses and improve identity theft prevention. The ACFE material emphasizes methods of preventing identity theft for businesses, including safeguards for personal identifying information.

================

Detailed Explanation:

Rationale for Correct Answer: This is True . When an employee has significant authority or discretion in the procurement process (e.g., drafting specifications, approving vendors, or evaluating bids), they are more capable of steering contracts toward favored suppliers. This increases the risk of corruption schemes like kickbacks or bid-rigging .

Analysis of Incorrect Options:

B. False – Incorrect; influence grows with authority over procurement.

Key Concept: Procurement authority is a key risk factor for corruption.

Detailed Explanation:

Rationale for Correct Answer: Affinity fraud occurs when fraudsters exploit trust within identifiable groups—such as religious, ethnic, or professional communities—making members more susceptible to deception.

Analysis of Incorrect Options:

B – Social control fraud relates to control fraud by institutions, not religious targeting.

C – Bait and switch is a deceptive sales tactic, not specific to religious groups.

D – Advance-fee scams may target anyone, not specifically religious communities.

Key Concept: Affinity fraud as a corruption/exploitation scheme.

Detailed Explanation:

Rationale for Correct Answer: Financial statement fraud typically involves overstating assets or revenues (e.g., inflating inventory, recognizing fictitious sales) and understating liabilities or expenses (e.g., hiding obligations, capitalizing expenses). This combination enhances profitability and net worth, misleading stakeholders.

Analysis of Incorrect Options:

A – Understating assets/revenue is rare since fraud usually aims to inflate results.

C – Overstating both assets and liabilities would not improve financial performance.

D – Understating both would reduce reported performance, contrary to typical fraud objectives.

Key Concept: Common patterns in financial statement fraud.

Tammy is most likely committing a structuring scheme. Structuring occurs when a person deliberately breaks transactions into smaller amounts to avoid mandatory reporting thresholds. Here, Tammy repeatedly deposits cash in amounts between $9,000 and $9,900, just below the $10,000 reporting requirement. That pattern strongly indicates an attempt to avoid currency transaction reporting. A reverse deposit scheme and remote deposit capture scheme do not describe the deliberate splitting of cash deposits to evade reporting. Integration is a later stage of money laundering in which illicit funds are reintroduced into the economy as apparently legitimate funds, but Tammy’s activity is focused on avoiding detection during placement. The ACFE material identifies repeated deposits just under the reporting threshold as a classic red flag of smurfing or structuring.

================

Detailed Explanation:

Rationale for Correct Answer: In the detection and analysis phase of cybersecurity incident response, the focus is on identifying the scope of the incident, including all breaches, compromised systems, and the method of attack. Containment, eradication, and recovery occur in later steps. Thus, identifying all breaches is the correct activity for this step.

Analysis of Incorrect Options:

A. Limiting damage – This occurs in the containment phase.

B. Creating an incident response plan – This is part of the preparation phase.

C. Restoring control of affected systems – This occurs during eradication and recovery .

Key Concept: Incident response methodology: preparation ? detection/analysis ? containment ? eradication ? recovery.

The correct answer is C. Change order abuse occurs after a contract has been awarded, when a contractor improperly increases the price, expands the work, or modifies contract terms through change orders. A corrupt contractor might submit a low bid to win the award and later recover profits through unnecessary or inflated change orders. This defeats the benefit of competitive bidding because the procuring entity no longer receives the price or terms that justified the original award. Option A is incorrect because the scheme usually increases, not decreases, the amount paid. Option B is too narrow because change order abuse can occur in competitive contracts. Option D is incorrect because the scheme often involves collusion between contractor and procurement personnel, not necessarily several contractors.

================

Rationale for Correct Answer: Strong internal controls — particularly inventory controls — are essential not just to prevent theft, but also to detect errors, reduce waste, and ensure that inventory levels are appropriate. Controls such as physical counts, reconciliations, and segregation of duties protect against misappropriation and inefficiencies.

Key Concept: Internal Controls as a preventive and detective mechanism in asset safeguarding.

The ACFE Fraud Examiners Manual addresses Expense Reimbursement Schemes under Asset Misappropriation: Fraudulent Disbursements and separates the discussion into:

Detection of Expense Reimbursement Schemes

Prevention of Expense Reimbursement Schemes

The Manual specifically identifies “Detailed Expense Reports: Submission and Review” as the prevention approach for expense reimbursement fraud.

Why A is correct

Requiring all employees to submit receipts electronically is not, by itself, a preventive control recognized by the Manual. The ACFE’s prevention focus is on requiring detailed expense reports , adequate supporting documentation, and careful review—not merely changing the format of submission from paper to electronic. In fact, because expense reimbursement fraud often involves altered receipts , fictitious receipts , and other manipulated support, simply requiring electronic submission does not meaningfully prevent the scheme. The Manual lists schemes such as altered receipts and producing fictitious receipts , showing that the problem is the authenticity and review of documentation, not whether the receipt is submitted electronically.

Why the other options are helpful

B. Comparing current expenses to budgeted expense amounts

This is helpful because the Manual includes review and analysis of expense accounts as part of detecting these schemes. Comparing reported expenses to expected or budgeted levels can reveal unusual spikes or anomalies that may indicate fraud.

C. Requiring employees to explain the specific business purpose of each expense

This is clearly helpful and consistent with the Manual’s prevention emphasis on detailed expense reports and proper documentation. Requiring a specific business purpose makes it harder to submit personal, inflated, or fictitious expenses.

D. Comparing current expenses to historical expenditure amounts

This is also helpful because the Manual’s review and analysis of expense accounts supports analytical comparisons to identify irregularities, trends, or unexplained increases in reimbursements. Historical comparison is a classic way to spot padded or abnormal expense claims.

Conclusion

Under the ACFE Manual, prevention of expense reimbursement schemes depends on detailed reporting, documentation, and review . Merely requiring receipts to be submitted electronically does not address whether the receipts are false, altered, duplicated, or unsupported. Therefore, the choice that would NOT be helpful in preventing expense reimbursement schemes is:

A. Requiring all employees to submit receipts electronically

References

ACFE Fraud Examiners Manual, 2020 International Edition

Expense Reimbursement Schemes

Detection of Expense Reimbursement Schemes / Review and Analysis of Expense Accounts

Prevention of Expense Reimbursement Schemes / Detailed Expense Reports: Submission and Review

Altered Receipts / Producing Fictitious Receipts

Guillermo’s conduct is best described as research misconduct because he fabricated data points to make his research appear more successful and to preserve grant funding. Research misconduct commonly includes fabrication, falsification, or plagiarism in proposing, performing, reviewing, or reporting research. The key fact is that Guillermo created data that did not exist and presented it as research support. Fraudulent concealment generally involves hiding material facts, not creating false research data. Fictitious claims fraud involves submitting false claims for payment, usually to a government or program, but the question focuses on the falsification of research results. Inducement fraud is broader and less precise. Because the false data directly affects the integrity of a funded study, research misconduct is the best answer.

================

The correct answer is D. Carl committed electronic payment tampering because he used stolen online banking credentials to create an unauthorized recurring electronic payment. Electronic payment tampering involves manipulating electronic disbursement systems, online banking portals, ACH transactions, wire transfers, or related payment credentials to divert funds. Although Carl uses a disguised bank account, the central misconduct is the unauthorized creation of an electronic payment, not a traditional billing scheme. A diverted revenue scheme concerns incoming receipts rather than outgoing payments. A ghost payee scheme can involve fictitious recipients, but here the best classification is electronic payment tampering because the fraud is executed through the company’s online banking system. The ACFE materials classify electronic payment tampering under fraudulent disbursement schemes.

================

Submitting token bids is a common collusive procurement fraud method known as complementary bidding, also called protective, shadow, or cover bidding. In this scheme, competing contractors submit bids that are not serious attempts to win the contract. These bids might be intentionally too high, technically unacceptable, or structured with unfavorable terms so the preferred contractor wins while the process still appears competitive. This undermines the purpose of competitive bidding, which is to place bidders on equal terms and obtain the best price and conditions. Option B is inconsistent with market division, where conspirators divide markets rather than seek all areas. Option C refers more generally to shell or fictitious bidding, and option D is a billing fraud issue, not the common collusive bidding method described here.

================

Detailed Explanation:

Rationale for Correct Answer: The phases of the bidding process include:

Presolicitation (need recognition/specification stage),

Solicitation (inviting bids),

Submission (vendors submit bids). There is no standard phase called Postsolicitation .

Analysis of Incorrect Options:

A. Presolicitation – Valid phase.

C. Solicitation – Valid phase.

D. Submission – Valid phase.

B. Postsolicitation – Not recognized as a formal bidding stage.

Key Concept: Bidding process phases — presolicitation, solicitation, submission.

Detailed Explanation:

Rationale for Correct Answer: Employees involved in bribery or corruption schemes often exhibit lifestyle red flags such as gambling habits, drug/alcohol addiction, or extravagant spending . These behaviors create financial pressures that may motivate or result from corrupt activity.

Analysis of Incorrect Options:

A, B, C individually – Each is a red flag, but the most accurate answer is all of the above .

Key Concept: Behavioral red flags in corruption cases.

Detailed Explanation:

Rationale for Correct Answer: Key GAAP principles include Conservatism , Historical Cost , and Full Disclosure . Quality control is not a GAAP principle; rather, it is a concept from auditing standards related to ensuring audit quality.

Analysis of Incorrect Options:

A. Conservatism – GAAP principle requiring cautious reporting of uncertain outcomes.

B. Cost – Historical cost principle is central to GAAP.

C. Full disclosure – Requires all relevant information to be presented.

D. Quality control – Belongs to auditing, not GAAP.

Key Concept: GAAP principles — distinguishing accounting standards from auditing practices.

Detailed Explanation:

Rationale for Correct Answer: This statement is False . Research in occupational fraud consistently shows that when employees believe there is a strong likelihood of being caught, they are less likely to engage in theft or deviant behavior. Deterrence theory emphasizes that perceived certainty of detection is one of the most effective controls against occupational fraud.

Key Concept: Deterrence through perceived detection .

Detailed Explanation:

Rationale for Correct Answer: This is a tech-support scam , in which fraudsters trick victims into believing their computers are infected and then charge fees for unnecessary or fake repairs. The scam often targets elderly victims.

Analysis of Incorrect Options:

A. Pharming – Redirects users to fake websites, not fake support calls.

B. Bait and switch – Advertising deception, not fraudulent computer support.

D. Smishing – Fraud via SMS text messages, not on-screen computer popups.

Key Concept: Consumer fraud schemes — tech-support scams.

Detailed Explanation:

Rationale for Correct Answer: Gross profit = Net sales – Cost of Goods Sold (COGS). This is the correct definition, as per standard accounting principles.

Analysis of Incorrect Options:

A. Gross revenue – Defined as total sales before deductions, not after.

B. Net profit – Net profit is after all expenses (operating, interest, taxes), not before.

D. Operating expenses – Appear after gross profit, not at the top.

Key Concept: Income statement structure and key definitions .

Detailed Explanation:

Rationale for Correct Answer: One of the key red flags of fictitious revenues is sales to related parties, shell companies, or entities with unknown substance and ownership . Such transactions are often used to inflate revenue artificially.

Analysis of Incorrect Options:

A. Slow growth/unusual profitability – Incorrect, fictitious revenue often results in rapid or unrealistic growth.

B. Growth in days’ purchases in receivables – Misstated phrase; correct indicator would be growth in days’ sales in receivables .

D. Surge in purchases – Relates more to inventory fraud than fictitious revenues.

Key Concept: Red flags of fictitious revenue — questionable counterparties and unrealistic sales growth.

The correct answer is A. The facts indicate a possible nonconforming goods scheme, in which a vendor provides goods that fail to meet contract specifications while charging as though compliant goods were supplied. The most effective detection measure before customer complaints would have been an inspection of the glass upon receipt, including its packaging, appearance, description, and conformity with the contract. This control helps identify substitutions, inferior materials, counterfeit goods, or products of lower quality than promised. Option B is indirect and less reliable than inspecting the goods. Option C relates to change order abuse rather than quality substitution. Option D focuses on the vendor’s internal cost data and would not directly confirm whether the delivered glass met CTR’s contract specifications.

The correct answer is B. In an account takeover scheme, a fraudster gains unauthorized access to a legitimate user’s account and then exploits the account for financial gain. A common method is to use stored payment card information, bank information, loyalty points, or other account credentials to place unauthorized orders or transfer value. Option A is not the best answer because fraudsters more commonly change credentials, delivery details, or security settings to maintain control, rather than merely disabling multifactor authentication immediately. Option C is incorrect because account takeover attempts often involve repeated credential stuffing or automated attacks. Option D is also unlikely because fraudsters often change contact information to intercept alerts or lock out the true account holder. Account takeover is identified in the ACFE material as an online and mobile account fraud risk.

================

Detailed Explanation:

Rationale for Correct Answer: Simply holding two jobs without disclosure is not inherently a conflict of interest unless the roles compete, overlap, or present divided loyalties. The other options all describe undisclosed financial or relational interests that conflict with the employer’s best interest.

Analysis of Incorrect Options:

A. Harriet’s stock ownership – Direct financial conflict.

C. Jennifer’s board positions – Competing loyalties between competitors.

D. Ernest hiring his brother – Nepotism without disclosure is a conflict.

Key Concept: Conflict of interest schemes in corruption.

The correct answer is C because comparing claimed travel expenses with known business-trip dates is a targeted way to detect fictitious, overstated, or personal expenses submitted for reimbursement. Expense reimbursement fraud often involves employees claiming expenses that were not actually incurred for business purposes, altering receipts, requesting multiple reimbursements, or mischaracterizing personal costs as business costs. Travel expenses outside approved trip dates are suspicious because they might represent personal travel or fabricated claims. Option A is weak because balances matching historical amounts are not inherently suspicious. Option B is inefficient and HR might not have the necessary transactional evidence. Option D is not a strong fraud indicator because lower expenses are generally less suspicious than excessive or unsupported expenses. The ACFE material emphasizes detailed review and analysis of expense reports.

================

The correct answer is insider trading. Insider trading occurs when a person who possesses material, nonpublic information buys or sells securities based on that information before it is available to the investing public. Senior staff of a publicly traded company are more likely to possess confidential information about earnings, mergers, contracts, litigation, or other business developments that could affect the company’s stock price. Requiring legal department preclearance helps prevent trades during blackout periods or when the employee has inside information. Parking involves hiding beneficial ownership of securities, selling away involves unauthorized securities sales outside a firm, and churning involves excessive trading to generate commissions. The control described is specifically designed to reduce insider trading risk.

================

The correct answer is D. Users being denied access to files they normally use is a significant indicator of possible network intrusion. Such denial might result from unauthorized permission changes, malware, ransomware encryption, account compromise, or malicious alteration of access controls. In a professional fraud examination context, this condition should trigger immediate incident-response procedures, including review of system logs, firewall records, router logs, and affected files. Options A and C describe routine security and system maintenance activities. Option B is not inherently suspicious because the country has a legitimate client connection. The ACFE computer and internet fraud materials emphasize that compromised systems should be treated as suspect and reviewed for irregularities and abnormal activity.

================

Timothy is a victim of a pig butchering scheme. This scam combines long-term relationship manipulation with fraudulent investment activity, commonly involving cryptocurrency. The fraudster builds trust over weeks or months, moves the victim to a private messaging channel, and encourages investments through a fake platform. The victim often sees apparent gains, but the trading platform is controlled by the fraudster or does not exist. Once the victim attempts to withdraw funds, the fraudster disappears or demands more money. This is not a Ponzi scheme because the facts do not involve paying old investors with new investor funds. It is not a pump-and-dump because no market manipulation of a traded security is described. It is broader than a simple advance-fee scheme.

================

Detailed Explanation:

Rationale for Correct Answer: Cressey’s research on fraud offenders found that most had non-sharable financial problems, which fell into categories such as: (1) violation of ascribed obligations, (2) business reversals, (3) physical isolation, (4) status gaining, and (5) employer-employee relations. “Larceny by fraud” is not a category of non-sharable problem but rather a type of theft scheme. Hence, D is correct.

Analysis of Incorrect Options:

A. Violation of ascribed obligations – Correctly one type of non-sharable problem.

B. Business reversals – Correctly one type of non-sharable problem.

C. Physical isolation – Correctly one type of non-sharable problem.

D. Larceny by fraud – Not a “problem” type; it is a fraud scheme.

Key Concept: Cressey’s non-sharable problems — psychological and situational pressures that contribute to occupational fraud.

Detailed Explanation:

Rationale for Correct Answer: Skimming involves the theft of cash before it is recorded in the accounting system. Since sales are never recorded, reconciling sales to receipts will not detect skimming—it can only detect larceny (theft after recording).

Analysis of Incorrect Options:

A. True – Incorrect because no discrepancy exists in the records (the sale itself is omitted).

Key Concept: Distinction between skimming (off-book theft) and cash larceny (on-book theft).

Detailed Explanation:

Rationale for Correct Answer: Data minimization —the practice of limiting the collection, storage, and retention of sensitive data to only what is necessary—reduces the potential harm in case of a breach. This is a widely recommended control for protecting proprietary information.

Analysis of Incorrect Options:

A – Monitoring competitors’ practices does not secure one’s own information.

C – Quiet rooms are not a standard security safeguard.

D – Restricting nonemployees is helpful, but overly broad and impractical as a primary recommendation.

Key Concept: Information security strategies to safeguard proprietary data.

Detailed Explanation:

Rationale for Correct Answer: The correct answer is A. Fiduciary Capacity . According to the Fraud Examiners Manual (2020 International Edition) , a fiduciary relationship exists when a person is entrusted with the property or affairs of another and is obligated to act in the best interest of that person, rather than for their own benefit. Fiduciary capacity is a key legal concept in fraud examinations, particularly in cases involving breaches of trust, embezzlement, or misappropriation.

Analysis of Incorrect Options (Distractors):

B. Embezzlement – Embezzlement is the wrongful appropriation of assets by a person entrusted with them. While it often arises from a fiduciary relationship, it describes the act of theft , not the capacity in which the person acts.

C. Conversion – Conversion refers to the unauthorized use or control over another’s property, a civil wrong, but it does not describe the relationship of acting on another’s behalf.

D. None of the above – Incorrect, since “fiduciary capacity” directly fits the definition in the question.

Key Concept: Understanding fiduciary duty and fiduciary capacity , which form the legal foundation for identifying when a person has a duty to act on behalf of another, often forming the basis for fraud-related legal claims.

Detailed Explanation:

Rationale for Correct Answer: In a legitimate competitive bidding process , all bidders must be treated equally, with the same access to information, terms, and conditions. This ensures fairness and prevents procurement fraud.

Analysis of Incorrect Options:

A. Bid-rigging – The manipulation of competitive bidding, not the fair process.

B. Kickbacks – Involve secret payments, not equal bidding.

D. Bid solicitation – The stage of inviting bids, not the equal treatment requirement.

Key Concept: Competitive bidding — foundation of fairness in procurement.

Detailed Explanation:

Rationale for Correct Answer: The ACFE emphasizes four cornerstone internal controls to prevent inventory fraud:

Proper documentation (accurate, prenumbered records),

Segregation of duties (custody, recordkeeping, and authorization separated),

Independent checks (reconciliations and audits), and

Physical safeguards (locks, cameras, restricted access).

Analysis of Incorrect Options:

B. Inventory control – Too general; physical safeguards are the key preventive measure.

C. Physical padding – Not a recognized control.

D. Prenumbered affiliations – Misworded; prenumbered documents are part of proper documentation.

Key Concept: Internal control framework for preventing inventory fraud.

Detailed Explanation:

Rationale for Correct Answer: According to ACFE’s Report to the Nations and the Fraud Examiners Manual, tips are the most common method of detecting corruption cases. Employees, vendors, or customers often report suspicious activity via hotlines or whistleblowing mechanisms.

Analysis of Incorrect Options:

A. Internal audits – Helpful but less common as the initial detection method.

B. Internal controls – Preventive, not the primary detection source.

D. By accident – Can occur, but far less common than tips.

Key Concept: Tips/whistleblowing as the primary detection method for corruption.

The correct answer is A. Electronic funds transfer fraud involves the misuse of electronic payment systems to move money improperly. A vendor submitting an electronic bill through a client’s online payment system for services not provided is a fraudulent use of electronic bill presentment or payment processes. Option B is payroll fraud, specifically falsified hours or salary. Option C involves theft and misuse of prepaid cards, not EFT manipulation by the payee. Option D describes payment card skimming, where card information is captured for later unauthorized use. The ACFE materials discuss electronic funds transfers, wire transfer fraud, electronic bill presentment and payment, and detection of EFT fraud as part of payment fraud risk.

================

Detailed Explanation:

Rationale for Correct Answer: This statement is False . Shrinkage is a general term for unaccounted-for inventory losses, and it can indeed result from theft, errors, damage, or waste . To say shrinkage does not result from theft is misleading because theft is one of its primary causes.

Analysis of Incorrect Options:

A. True – Incorrect, as theft is often a major contributor to shrinkage.

B. False – Correct, since shrinkage can include theft.

Key Concept: Shrinkage includes theft as a cause of unexplained inventory loss.

The correct answer is C. New account fraud often involves opening accounts with false, stolen, or synthetic identities. The most effective preventive measure listed is to verify the customer’s identity through reliable third-party credit reporting agencies and customer identification services. These sources can help confirm identity details, detect inconsistencies, identify suspicious histories, and reduce reliance on documents that might be forged. Employer recommendation letters are not standard or reliable identity controls. Small cash deposits are not automatically suspicious and might be normal for many customers. Sending communications to all previous residences is inefficient and unlikely to be the strongest verification method. The ACFE financial institution fraud materials identify new account fraud schemes and emphasize customer identification controls as a prevention method.

================

Detailed Explanation:

Rationale for Correct Answer: Past posting occurs when an insured reinstates or purchases insurance coverage after a loss has already occurred and then submits a false claim, backdating the loss to appear covered. Joe’s scheme fits this exactly.

Analysis of Incorrect Options:

A. Staged accident – Fraudulent accidents deliberately caused, not applicable here.

B. Inflated damages – Exaggerating actual losses, not retroactive coverage.

D. Vehicle repair – General claim fraud, but not the scheme in question.

Key Concept: Insurance fraud – past posting schemes.

The correct answer is B. When a debtor organization intends to continue as a going concern, effective insolvency practice may permit existing management to remain involved, subject to oversight by an independent insolvency representative. This approach balances operational continuity with creditor protection, transparency, and accountability. Exclusive control by secured creditors is inappropriate because insolvency proceedings must consider the legal framework and the rights of all affected parties. Creditors may have participation rights, but they do not automatically manage the organization. Mandatory shared governance between management and creditors is also not the best statement of the World Bank Principles. Professionally, the independent representative’s role is to supervise, preserve value, investigate improper transactions, and protect the integrity of the process.

================

Detailed Explanation:

Rationale for Correct Answer: Corporate spies do use social engineering, but their primary methods include surveillance, infiltration (e.g., posing as employees), and technical monitoring. The statement in option C is false because searching desks/workstations is a tactic, but it is not the primary method.

Analysis of Incorrect Options:

A – True; fake badges are a common infiltration tactic.

B – True; low-level jobs provide physical access.

D – True; technical surveillance is a recognized method.

Key Concept: Methods of corporate espionage.

Detailed Explanation:

Rationale for Correct Answer: Human intelligence (HUMINT) involves gathering information directly from people, often through deception, elicitation, or impersonation. Georgina’s posing as a customer to obtain confidential details fits this method.

Analysis of Incorrect Options:

B. Baiting – A social engineering tactic using false promises (e.g., malware disguised as freebies).

C. Scavenging – Collecting discarded information (e.g., dumpster diving).

D. Open-source intelligence – Gathering data from public records, news, or websites, not through elicitation.

Key Concept: Methods of competitive intelligence and social engineering.

Rationale for Correct Answer: The price-level adjusted historical cost method adjusts the original purchase price of an asset for inflation, providing a more current value while still tied to historical cost principles. It addresses one of the limitations of strict historical cost accounting.

Key Concept: Inflation adjustments in asset valuation.

Detailed Explanation:

Rationale for Correct Answer: Corrupt payments are not always made directly in cash. According to the Fraud Examiners Manual (2020) , one common method is disguising them as loans on favorable terms , which provide value to the recipient while appearing legitimate. This is recognized as a form of bribery or illegal gratuity.

Analysis of Incorrect Options:

B. Credit cards – Corrupt payments can be made via many channels, including credit, so this is incorrect.

C. Selling property above market value – Payments are typically disguised by undervaluing sales to recipients, not overvaluing.

D. Promises of favorable treatment – Promises alone can constitute bribery; this statement is false.

Key Concept: Methods of making corrupt payments .

Detailed Explanation:

Rationale for Correct Answer: Intangible assets are long-lived assets that lack physical substance and differ from property, plant, and equipment. Examples include goodwill, patents, trademarks, and copyrights. They provide long-term benefits but cannot be physically touched.

Analysis of Incorrect Options:

A. Tangible Assets – These have physical form (e.g., equipment, land).

C. Forced Assets – Not an accounting category.

D. None of the above – Incorrect since intangible assets match the definition.

Key Concept: Classification of Assets — tangible vs. intangible.

Detailed Explanation:

Rationale for Correct Answer: Departures from GAAP may be justified if compliance produces misleading results, if the transaction is immaterial, or if the costs exceed benefits. However, simply departing from GAAP because assets would be understated and liabilities overstated is not an acceptable reason ; GAAP requires faithful representation even if results are unfavorable.

Analysis of Incorrect Options:

A – Cost-benefit considerations are valid grounds in practice.

C – Materiality is a recognized exception to strict GAAP application.

D – Preventing misleading statements is a valid justification.

Key Concept: GAAP exceptions are limited to cost-benefit, immateriality, and preventing misleading reporting .

Detailed Explanation:

Rationale for Correct Answer: Social engineering involves manipulating or deceiving people into revealing confidential information or taking actions that aid the attacker (e.g., clicking malicious links, sharing credentials). It targets human weaknesses rather than technical vulnerabilities.

Analysis of Incorrect Options:

A. IP spoofing – Forging an IP address to disguise origin.

B. Electronic piggybacking – Unauthorized use of someone else’s access connection.

C. Packet sniffing – Monitoring data traffic across a network.

Key Concept: Cyberfraud techniques – social engineering.

The correct answer is C. Competitive intelligence is the lawful and ethical gathering and analysis of information about competitors, markets, products, customers, and industry conditions. It can support research and development, pricing decisions, strategic planning, and forecasting of competitors’ costs or business moves. Option A is incorrect because illegal or covert acquisition of commercial information describes corporate espionage, not legitimate competitive intelligence. Option B describes government intelligence activity, not business competitive intelligence. Option D is incorrect because competitive intelligence should not use the same unlawful or deceptive methods associated with espionage. The ACFE material distinguishes lawful competitive intelligence from theft of data, trade secrets, and intellectual property.

================

The correct answer is A. Holograms are specifically designed as anti-counterfeiting features and are among the most difficult physical card features for fraudsters to reproduce accurately. Counterfeit payment card schemes usually involve stolen account information being encoded or printed onto altered, blank, or counterfeit cards. Option B is incorrect because these schemes generally involve fraudsters, organized groups, or dishonest merchants, not collusion between card issuers and merchants. Option C is too absolute because modern technology allows counterfeit cards to be produced without traditional professional printing facilities. Option D is inaccurate because counterfeit cards usually rely on stolen or compromised active account data, not merely expired card numbers. The ACFE payment fraud materials emphasize card security features, counterfeit card production, and card-scrutiny controls.

================

Detailed Explanation:

Rationale for Correct Answer: This statement is False . According to ACFE studies, asset misappropriation is the most common but least costly category of occupational fraud. Fraudulent statements are the least common but most costly, while corruption falls in the middle in both frequency and cost.

Key Concept: Fraud Tree Statistics — frequency and cost comparison of asset misappropriation, corruption, and financial statement fraud.

The correct answer is C. Under accounting concepts, the cost-benefit constraint recognizes that the expected benefits of financial reporting information should justify the expected costs of providing it. A departure from GAAP may be acceptable only in limited circumstances where compliance is impracticable or the cost of compliance exceeds the benefit, provided the departure is properly evaluated and disclosed under the applicable framework. Option A is insufficient because expense alone does not justify noncompliance unless the cost-benefit threshold is met. Option B is clearly improper because improving reported profitability is a fraudulent motive, not a valid accounting reason. Option D is also not a valid justification because growth or international expansion does not permit disregarding required accounting standards.

Detailed Explanation:

Rationale for Correct Answer: Common financial statement fraud schemes include: (A) recording fictitious revenues, (C) concealing liabilities/expenses, and (D) improper asset valuations. Persuasive evidence is not a fraud scheme; it is an auditing concept used to support accounting entries.

Analysis of Incorrect Options:

A, C, D – All are well-documented methods of financial statement fraud.

B. Persuasive Evidence – Correct, since it is not part of fraud schemes.

Key Concept: Major categories of financial statement fraud schemes.

Detailed Explanation:

Rationale for Correct Answer: Cost mischarging occurs when costs are charged to improper accounts or contracts. The best way to detect it is through analytical review —comparing direct vs. indirect labor account totals across periods to identify unusual shifts or spikes.

Analysis of Incorrect Options:

A. Reviewing inspection/testing reports – Effective for detecting defective/substituted goods, not mischarging.

C. Inspecting packaging – Identifies product substitution, not accounting mischarges.

D. Examining change orders – Useful for contract fraud, but not direct mischarging.

Key Concept: Cost mischarging detection through analytical procedures .

Detailed Explanation:

Rationale for Correct Answer: Under GAAP, revenue is recognized when it is realized or realizable and earned . This requires that the earnings process be substantially complete, and payment be reasonably assured.

Analysis of Incorrect Options:

B. Fictitious and Earned – Fictitious revenues are fraud, not recognized revenue.

C. Realized and Evidenced – Evidence supports recognition, but “earned” is the proper standard.

D. All of the above – Incorrect, since only option A is correct.

Key Concept: Revenue recognition principle — realized/realizable and earned.

Detailed Explanation:

Rationale for Correct Answer: Skimming is difficult to detect because the stolen cash is never recorded (“off-book”). Therefore, it is often discovered by accident — such as customer complaints, discovery of missing deposits, or unexpected reconciliations — rather than through audits or routine controls.

Analysis of Incorrect Options:

A. Internal audits – Effective for many frauds but weak at uncovering skimming because records appear normal.

C. Internal controls – Preventive controls may deter but cannot detect unrecorded theft.

D. Occupational frauds – Too broad and not a detection method.

Key Concept: Detection of Skimming — most often accidental.

Detailed Explanation:

Rationale for Correct Answer: This is personal purchases with company funds , where an employee uses company resources to acquire goods or services for personal benefit. Baker used ABC’s funds to buy supplies for home improvements.

Analysis of Incorrect Options:

A. Pay and return scheme – Involves overpaying a vendor and pocketing the refund.

C. Pass-through scheme – Involves using a controlled company to bill the employer at inflated prices.

D. Theft of inventory – Involves stealing company stock, not purchasing items for personal use.

Key Concept: Fraudulent disbursement – billing fraud through unauthorized personal purchases.

Detailed Explanation:

Rationale for Correct Answer: Bribery prevention policies often include:

Reporting gifts (disclosure of items received from vendors),

Discounts (rules about vendor concessions),

Business meetings (clear rules on vendor-sponsored events). Resource diversions is not a standard bribery prevention policy but a form of fraud.

Analysis of Incorrect Options:

A, B, C – Legitimate examples of prevention policies.

D. Resource diversions – Not a preventive measure.

Key Concept: Anti-bribery policies — clear rules on gifts, discounts, and vendor relationships.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters conceal inventory shrinkage through multiple methods, including unrecorded sales, false write-offs, or manipulating perpetual records. The ACFE manual notes that concealment is a common theme in inventory fraud. Hence, all of the above are valid.

Analysis of Incorrect Options:

A, B, C – Each is correct individually, but the most comprehensive answer is D.

Key Concept: Concealment methods for inventory theft.

The ACFE Fraud Examiners Manual includes Kickback Schemes in the corruption section and specifically identifies Diverting Business to Vendors as a type of kickback scheme.

This question states that Bob, a purchasing agent , directed business to Oak Company, and in return Oak’s sales manager agreed to pay Bob a percentage of the extra profits . That is a classic kickback arrangement : the employee steers company business to a favored vendor in exchange for a personal financial benefit. The Manual’s examples of corruption also discuss a vendor bribing or paying a purchasing agent to receive more business.

Why the other options are incorrect

A. Economic extortion scheme

The Manual defines economic extortion as obtaining money, property, or services through coercion or threatened adverse action. That is not what happened here; Bob was paid for steering business, not coercing payment through threats.

C. Illegal gratuity scheme

The Manual explains that illegal gratuities are items of value given to reward a decision, often after the recipient has already made the decision, and this concept is primarily discussed in the public-sector context. Here, the payment is part of an agreement to direct business and share in profits, which is more accurately a kickback .

D. Diversion scheme

The relevant Manual terminology is Diverting Business to Vendors , but that appears as a subtype under Kickback Schemes . Therefore, the best answer among the options is the broader and correct classification: kickback scheme .

References

ACFE Fraud Examiners Manual, 2020 International Edition

Corruption — Kickback Schemes

Corruption — Diverting Business to Vendors

Example involving a purchasing agent receiving improper payments to steer business to a vendor

Economic Extortion definition

Illegal Gratuities definition

The correct answer is D. Liquidation bankruptcy involves identifying the debtor’s assets, selling nonexempt assets, and using the proceeds to pay creditors. After the liquidation process, the debtor may receive a discharge of eligible debts, depending on the applicable jurisdiction and the nature of the obligations. The facts state that XYZ Company must sell its properties and inventory and apply the proceeds to creditors, which is the defining feature of liquidation. Reorganization bankruptcy allows a debtor to continue operating while restructuring debts under an approved plan. Receivership is a court-supervised arrangement involving a receiver, but it is not the filing type described. “Debt forgiveness bankruptcy” is not the proper ACFE classification.

================

Detailed Explanation:

Rationale for Correct Answer: John created a completely false expense claim for a meal that he did not personally pay for. This is a fictitious expense reimbursement scheme , where employees invent expenses and submit them for reimbursement.

Analysis of Incorrect Options:

A. Mischaracterized expense – Legitimate expenses claimed as business when they are personal. Not applicable here.

C. Multiple reimbursement – Involves submitting the same receipt more than once. Not the case here.

D. Overstated expense – Inflating a legitimate expense, which is not what John did.

Key Concept: Expense reimbursement fraud — fictitious expenses .

Detailed Explanation:

Rationale for Correct Answer: Best practices in preventing EFT fraud require mailing PINs and account information separately , never together. Sending them together creates a serious security risk if intercepted.

Analysis of Incorrect Options:

A – Correct preventive measure: immediately cancel and reissue stolen access devices.

B – Correct preventive measure: validating addresses helps detect fraudulent applications.

C – Correct preventive measure: segregation of duties reduces insider fraud risks.

Key Concept: EFT fraud prevention through layered security and separation of duties.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters often attempt to influence or bribe employees who have access to sealed bids . Access to sealed bids provides unfair knowledge of competitors’ pricing and terms, enabling collusion or bid manipulation.

Analysis of Incorrect Options:

A. Bid-splitting – A fraud scheme, not what vendors seek access to.

C. General purchasing – Too broad; not specifically tied to vendor fraud.

D. Tailor specifications – A corruption scheme, but not the specific target of vendor bribery.

Key Concept: Sealed bid access as a key target in procurement fraud.

Detailed Explanation:

Rationale for Correct Answer: The described scheme is lapping , a classic accounts receivable fraud. It involves covering up stolen payments by applying subsequent receipts from other customers to hide the shortage.

Analysis of Incorrect Options:

A. Padding – Usually refers to overstating expense reimbursements, not AR fraud.

C. Substitution – Refers to replacing missing assets with others, not AR manipulation.

D. Daisy chain – Not a recognized fraud concealment method in this context.

Key Concept: Skimming concealment techniques – lapping of receivables.

The correct answer is C. The business owner is committing a falsified tax deduction scheme by fraudulently inflating production costs to reduce taxable income. Deductions are legitimate only when they accurately reflect allowable expenses. Here, the owner paid the supplier to alter the receipt so that the company appears to have incurred a higher deductible cost than it actually did. This false documentation reduces reported taxable income and therefore lowers the tax liability improperly. Option A is incorrect because the facts do not involve excise taxes on a specific class of goods. Option B is incorrect because the owner is not omitting income; they are overstating expenses. Option D is not applicable because the scheme involves deductions, not tax credits.

================

Security audits and tests, incident response plans, and separation of duties are best classified as administrative security controls because they involve policies, procedures, monitoring, governance, and assignment of responsibilities. Administrative controls are designed to manage human behavior and organizational processes that support cybersecurity. The ACFE material discusses computer security controls, including separation of duties, security audits and tests, and incident response planning, as part of a broader control environment for preventing and detecting cyberfraud. Logical access controls focus on system permissions and authentication. Physical access controls protect facilities and hardware. Technical controls are automated or technology-based safeguards. Since the listed items mainly involve procedures, oversight, and response planning, administrative security controls is the best answer.

================

Detailed Explanation:

Rationale for Correct Answer: A need recognition scheme occurs when an employee uses their influence to convince their employer to purchase unnecessary goods or services. This benefits the supplier (often paying kickbacks) but harms the employer.

Analysis of Incorrect Options:

A. Presolicitation scheme – General stage of procurement, not specific.

C. False sole-source scheme – Involves eliminating competition by claiming only one vendor can supply the good/service.

D. Submission scheme – Related to bid-rigging, not need recognition.

Key Concept: Need recognition schemes — corruption through unnecessary purchases.

Detailed Explanation:

Rationale for Correct Answer: This is a Pass-through scheme , a type of Conflict of Interest under the corruption category. In this scheme, the employee sets up a shell company to act as a vendor. The shell purchases goods from legitimate suppliers and resells them to the employer at inflated prices. Pilar’s actions align perfectly with this definition.

Analysis of Incorrect Options:

A. Need recognition scheme – Involves manipulating an employer’s need to justify a purchase, not reselling via a shell.

B. Pay and return scheme – A fraudulent disbursement scheme where overpayments are made and refunds diverted. Not applicable here.

D. Cash larceny scheme – Involves theft of incoming cash, unrelated to vendor fraud.

Key Concept: Pass-through scheme (Conflict of Interest within Corruption).

Detailed Explanation:

Rationale for Correct Answer: Accruals represent expenses that have been incurred but not yet paid. Under the accrual basis of accounting, these must be recognized in the same period as the related revenues or obligations. Common examples include accrued wages and accrued interest.

Analysis of Incorrect Options:

B. Depreciations – Allocation of asset cost, not unpaid expenses.

C. Expenses – A broader term, but not specific to unpaid obligations.

D. Financial record – Too vague.

Key Concept: Accruals under the accrual basis of accounting.

Detailed Explanation:

Rationale for Correct Answer: By double-entry accounting rules, every accounting entry affects at least two accounts (debit and credit). Fraudulent entries must also follow this rule, meaning manipulation will show up in at least two categories on the financial statements.

Analysis of Incorrect Options:

A. One – Impossible in double-entry accounting.

C. More than two – Possible, but not always; the minimum is two.

D. None of above – Incorrect since “at least two” is correct.

Key Concept: Double-entry accounting ensures at least two accounts are affected in every transaction, including fraudulent ones.

Detailed Explanation:

Rationale for Correct Answer: Card skimming/shimming occurs when a fraudster captures payment card data with a hidden device. In this case, the employee secretly scans the customer’s card with a small device — a textbook example of skimming.

Analysis of Incorrect Options:

A. Server keeps the card – This is theft of the card, not skimming.

B. Imitation website – This is phishing , not skimming.

D. None of the above – Incorrect since option C is correct.

Key Concept: Payment card fraud — skimming/shimming devices.

Detailed Explanation:

Rationale for Correct Answer: Under accrual-basis accounting , revenues are generally recognized when earned (often upon delivery of goods or services), not necessarily when cash is received. Similarly, expenses are recorded when incurred, not when paid. This provides a more accurate picture of performance and financial position.

Analysis of Incorrect Options:

A – This describes cash-basis accounting , not accrual-basis.

B – Accrual accounting is more complex, not simpler.

C – Focuses on earned revenues and incurred expenses, not immediate cash flow.

Key Concept: Accrual accounting matches revenues with expenses in the period they occur.

Detailed Explanation:

Rationale for Correct Answer: A high percentage of coding outliers (e.g., using higher-paying diagnosis or procedure codes more often than peers) is a red flag of upcoding or fraudulent billing. This signals possible abuse of reimbursement systems.

Analysis of Incorrect Options:

A – Fewer claims would not suggest fraud.

C – Matching documentation is expected, not suspicious.

D – Low profits may indicate inefficiency, not fraud.

Key Concept: Health care fraud detection through data analytics and coding anomalies.

Detailed Explanation:

Rationale for Correct Answer: Cash larceny involves the theft of incoming cash after it has been recorded. Strong segregation of duties is critical to prevent concealment. By separating cash deposit responsibilities from bank reconciliation duties , one employee cannot both steal funds and cover their tracks.

Analysis of Incorrect Options:

A. Restricting substitution – Weakens controls; job rotation and cross-training help prevent fraud.

C. Same register use – Reduces accountability, making theft harder to trace.

D. Surprise cash counts – Strong detective control, but not as preventive as segregation of duties.

Key Concept: Preventing cash larceny through segregation of duties .

The ACFE Fraud Examiners Manual addresses Nonconforming Goods or Services under Contract and Procurement Fraud . The Manual states that, to detect nonconforming schemes, the fraud examiner should examine contract specifications, contractor statements, invoices, supporting documents, the received product, and test and inspection results for discrepancies with contract specifications. It then specifically adds:

“Additionally, to detect nonconforming schemes, the fraud examiner should:

• Review correspondence and contract files for indications of noncompliance.

• Request assistance from outside technical personnel to conduct after-the-fact tests.”

This language matches Option B exactly, so it is the most appropriate detection technique.

Why the other options are incorrect

A. Interviewing complaining contractors and unsuccessful bidders about the presence of red flags

This is a detection technique the Manual associates with change order abuse , not nonconforming goods or services schemes.

C. Comparing the direct and indirect labor account totals from the prior year to the current year

This type of comparative cost analysis is more consistent with testing for cost mischarging or other accounting irregularities, not the primary detection methods for nonconforming goods/services. The Manual’s nonconforming-scheme detection guidance focuses on specifications, inspection results, product testing, and contract/correspondence review.

D. Determining if the costs of the contract have exceeded or are expected to exceed the value of the contract

That is not identified by the Manual as the most appropriate method for detecting nonconforming goods or services. Again, the Manual directs the examiner to look for noncompliance with specifications and supporting documentation.

References

ACFE Fraud Examiners Manual, 2020 International Edition

Contract and Procurement Fraud — Nonconforming Goods or Services

Detecting Nonconforming Goods or Services Schemes

Related contrast: Detecting Change Order Abuse

Detailed Explanation:

Rationale for Correct Answer: Market division and allocation agreements are a classic bid-rigging scheme in which contractors collude to evade competition by assigning territories, customers, or project types among themselves. This undermines free and open competition.

Analysis of Incorrect Options:

B – Fake contracts are not a recognized collusion tactic in competitive bidding.

C – Publishing solicitations in different outlets does not evade competition.

D – Submitting false invoices is fraud, but it occurs after contract award , not during the bidding process.

Key Concept: Bid rigging and collusion in procurement fraud.

Detailed Explanation:

Rationale for Correct Answer: Finding personal checks in the cash register is unusual, but it does not specifically indicate a register disbursement scheme (such as false refunds or voids). The other options are classic red flags for such schemes.

Analysis of Incorrect Options:

A – Missing transaction numbers suggest manipulation.

C – Excessive voids near approval limits indicate fraud concealment.

D – Allowing cashiers to void their own sales creates opportunity for abuse.

Key Concept: Register disbursement schemes and their red flags.

The correct answer is A because an unusually high number of reimbursement claims can indicate provider fraud, overutilization, fictitious services, inflated billings, or other abusive billing activity. Health care fraud detection often relies on identifying abnormal patterns compared with similar providers, patient populations, or expected service levels. A consistently low percentage of coding outliers is not, by itself, suspicious. Producing adequate supporting documentation is generally a positive sign, although the documents should still be tested for authenticity. Creating medical records during or soon after the patient visit is proper practice because records should be timely and accurate. The ACFE health care fraud material identifies provider fraud and red flags of provider fraud as important detection areas, especially where billing volume or claim patterns appear abnormal.

================

Shoulder surfing is the practice of obtaining personal or confidential information by watching or listening while a victim uses or discloses it. Common examples include observing someone enter a PIN, password, access code, or account number, or overhearing a person provide sensitive details during a conversation. Option A is inaccurate because impersonating a bank or financial institution to obtain confidential information is closer to phishing or vishing, not baiting. Option B is inaccurate because pharming redirects users to fraudulent websites, while searching used devices is a discarded-device or data-recovery risk. Option D describes dumpster diving, not phishing. The ACFE identity theft materials distinguish these methods because recognizing the specific technique is important for prevention, investigation, and victim response.

================

Detailed Explanation:

Rationale for Correct Answer: Kickbacks are undisclosed payments made by vendors to employees of purchasing companies to secure favorable treatment. They are a classic form of bribery under the corruption classification of the Fraud Tree.

Analysis of Incorrect Options:

A. Bid-rigging – Involves collusion among bidders, not secret payments.

C. Presolicitation – A phase in procurement fraud, not the scheme itself.

D. None of the above – Incorrect, as kickbacks are the precise answer.

Key Concept: Kickbacks — secret vendor payments for favorable purchasing treatment.

Detailed Explanation:

Rationale for Correct Answer: The balance sheet summarizes account balances from the ledger at a specific date, presenting assets, liabilities, and equity. It reflects the organization’s financial position and is derived from ledger balances.

Analysis of Incorrect Options:

B. Income statement – Summarizes revenues and expenses, not all ledger balances.

C. Financial statement – A general term, but the specific answer here is balance sheet.

D. General journal – Book of original entry, not a summary.

Key Concept: Balance sheet as a summary of ledger accounts.

Detailed Explanation:

Rationale for Correct Answer: Being prompted to install unfamiliar software is a red flag for malware or unauthorized access, often indicating that attackers are attempting to establish persistence in the system. This is a classic indicator of a compromised network.

Analysis of Incorrect Options:

A – Standard security measure, not a red flag.

C – Data from supplier countries is normal if consistent with business operations.

D – Access denial to files outside a user’s role is a normal access control, not an intrusion sign.

Key Concept: Cyberfraud detection – identifying intrusion indicators.

Detailed Explanation:

Rationale for Correct Answer: While asset misappropriation schemes are usually committed by lower-level employees, financial statement fraud is most often committed by senior management . This is because executives have the authority to override controls, direct accounting policies, and influence financial reporting for personal gain (bonuses, stock prices, or to conceal poor performance).

Analysis of Incorrect Options:

A. Organized criminals – May commit fraud, but financial statement fraud specifically requires authority over reporting.

B. Mid and lower-level employees – Lack sufficient authority to materially alter financial statements.

D. All of the above – Incorrect, as financial statement fraud is overwhelmingly associated with senior management.

Key Concept: Management override — financial statement fraud perpetrated by those with the authority to manipulate reports.

The correct answer is C. Economic extortion occurs when a person with authority or influence demands payment or another benefit from a victim through coercion, threat, or misuse of power. A judge threatening to rule against a defendant unless paid is a clear example because the payment is demanded under threat of adverse official action. Option A is closer to an illegal gratuity because the benefit is provided after the contract award. Option B describes attempted bribery by the driver, who offers payment to influence the officer. Option D describes a billing or kickback-type arrangement involving collusion and false services. In economic extortion, the recipient of the improper payment initiates the demand by applying pressure or threat.

================

The correct answer is D. Procurement fraud prevention requires ongoing vendor monitoring based on the organization’s highest-risk vendor schemes. Monitoring should focus on practical red flags, such as unusual pricing, duplicate vendors, related-party indicators, excessive change orders, suspicious payment patterns, or vendors lacking proper support. Option A violates segregation of duties because the person maintaining the vendor master file should not also approve invoice payments. Option B is weak because vendor background checks should occur before vendors are added to the master file, not after. Option C is incorrect because procurement monitoring should be ongoing and risk-based, not restricted to annual reviews. The ACFE material emphasizes vendor management, vendor master file controls, and monitoring based on relevant red flags.

================

Detailed Explanation:

Rationale for Correct Answer: During the solicitation phase , corrupt employees may attempt to eliminate legitimate competitors by restricting the list of vendors invited to bid. This unfairly favors a particular supplier, often in exchange for bribes or kickbacks.

Analysis of Incorrect Options:

A. Need recognition – Involves creating false or unnecessary demand, not restricting bidders.

C. False specification – Relates to vague or tailored specifications, not bid solicitation.

D. Submission – Occurs after solicitation when vendors submit bids.

Key Concept: Solicitation phase schemes — restricting competition.

Detailed Explanation:

Rationale for Correct Answer: According to the ACFE Fraud Tree, cash-related asset misappropriation schemes fall into three categories: Skimming (off-book theft), Cash Larceny (on-book theft), and Fraudulent Disbursements (bogus outflows such as billing, payroll, and check tampering) .

Analysis of Incorrect Options:

B. Fraud analysis, skimming, and cash misappropriations – “Fraud analysis” and “cash misappropriations” are not fraud tree categories.

C. Cash larceny, cash distribution, and fraudulent disbursements – “Cash distribution” is not a fraud tree category.

D. Cash distribution, skimming, and fraud analysis – Includes non-fraud tree terms.

Key Concept: Fraud Tree — Cash Schemes: Skimming, Cash Larceny, Fraudulent Disbursements.

Detailed Explanation:

Rationale for Correct Answer: Blank plastic cards are a common basis for counterfeit card production. Fraudsters encode stolen magnetic stripe or chip data onto blank cards.

Analysis of Incorrect Options:

A – False; holograms are designed to be difficult to reproduce.

B – False; high-speed printers and embossers make counterfeiting easier, not harder.

D – Incorrect, since A and B are false.

Key Concept: Counterfeit card fraud methods.

Detailed Explanation:

Rationale for Correct Answer: Bid pooling occurs when vendors collude to divide contracts among themselves. They agree in advance who will submit the lowest bid for certain contracts, ensuring each participant gets a share of the business.

Analysis of Incorrect Options:

A. Bid opening – The formal process of opening bids, not fraud.

B. Fictitious bidding – Not a standard fraud term.

D. Bid log – A record of submitted bids, not a scheme.

Key Concept: Bid pooling — collusion among vendors in bid-rigging schemes.

Detailed Explanation:

Rationale for Correct Answer: An underring occurs when an employee intentionally enters a lower sales amount into the register than what was collected from the customer. The difference is pocketed by the employee. This is a common register manipulation skimming scheme.

Analysis of Incorrect Options:

B. Recording a sale procedure – General process, not fraud.

C. Internal sales audits – Control activity, not the fraud scheme.

D. All of the above – Incorrect, since only “underring” is accurate.

Key Concept: Underring schemes in cash register fraud.

Detailed Explanation:

Rationale for Correct Answer: This is True . Fraudulent financial reporting often involves manipulating depreciation. By lowering or delaying depreciation expense, companies can inflate profits and overstate asset values. This is a common method of financial statement fraud related to earnings management.

Analysis of Incorrect Options:

B. False – Incorrect, as understatement of depreciation clearly inflates reported profits.

Key Concept: Depreciation Manipulation in Financial Statement Fraud .

The correct answer is C. In a fictitious refund scheme, an employee records a refund transaction even though no customer actually returned merchandise. The employee then removes cash from the register as if it had been paid to a customer. Because the register records a refund, the register log shows that cash should have decreased. When the employee steals the same amount of cash, the cash on hand can still match the register log, making the theft harder to detect through a simple register reconciliation. Option A is incorrect because fictitious refunds can cause inventory records to show returned goods that do not exist, which tends to overstate rather than understate inventory. Options B and D are incorrect because cash is removed and no real merchandise is returned.

================

The ACFE Fraud Examiners Manual classifies this type of conduct under Insurance Fraud ? Vehicle Insurance Schemes , and it specifically lists Past Posting as a recognized vehicle insurance fraud scheme.

In this question, Ron’s vehicle was damaged before he obtained the additional coverage, but he later submitted the claim as though the damage happened after the new coverage became effective. That is the essence of past posting : attempting to obtain insurance benefits for a loss that occurred before coverage applied , while misrepresenting the time of the loss. This matches the scenario exactly.

Why the other options are incorrect

A. Ditching

The Manual lists Ditching as a separate vehicle insurance scheme. It does not describe the act of misrepresenting the timing of a preexisting loss after increasing coverage.

B. Bait and wait

This is not the insurance-fraud classification that fits the facts given. The fraud here depends on claiming an earlier loss as a later covered loss , which is the Manual’s past posting category.

D. Double dipping

Double dipping generally refers to obtaining duplicate recovery for the same loss from multiple sources, which is not what Ron is doing here. The issue is the false date of loss , not duplicate reimbursement.

References

ACFE Fraud Examiners Manual, 2020 International Edition

Insurance Fraud — Vehicle Insurance Schemes — Past Posting

Detailed Explanation:

Rationale for Correct Answer: Irregular, low-value, or unpredictable revenue sources such as parking fees, late charges, or vending machine sales are prime skimming targets. Because they are difficult to estimate or reconcile precisely, theft of these funds is less likely to be detected quickly.

Analysis of Incorrect Options:

B. Recorded sales – These are already in the books and easier to reconcile.

C. Internal audits – A control mechanism, not a target.

D. Register manipulations – A method, not the revenue source itself.

Key Concept: Vulnerable revenue streams as skimming targets.

The correct answer is C. An unusually close or overly friendly relationship between an employee and a third-party contractor can be a red flag of corruption. Such relationships may indicate favoritism, undisclosed conflicts of interest, kickbacks, bid manipulation, or preferential treatment in procurement decisions. The behavior is not proof of wrongdoing, but it warrants further review when combined with unusual awards, pricing, sole-source justifications, weak documentation, or repeated business with the same vendor. Option A reflects proper restraint, not suspicious conduct. Option B suggests the employee is not benefiting from bribery-prone markets. Option D is generally positive because disclosure of conflicts allows the organization to evaluate and manage ethical risks. Red flags must be assessed in context with documents, transactions, and relationships.

================

Detailed Explanation:

Rationale for Correct Answer: Bribes to purchasing employees often aim to:

Ensure late bids are accepted,

Extend deadlines unfairly,

Or falsify bid logs. Bid-splitting , however, is a scheme performed to avoid approval thresholds and does not require bribery of purchasing employees.

Analysis of Incorrect Options:

A. Receipt of late bid – Real reason to bribe.

B. Extend opening date – Real reason to bribe.

D. Falsify bid log – Real reason to bribe.

C. Ensure bid-splitting – Not a bribery motivation.

Key Concept: Bribery motivations in procurement fraud.

Detailed Explanation:

Rationale for Correct Answer: Baiting is a social engineering tactic where fraudsters leave infected flash drives or storage media in public areas, hoping victims will plug them in, unknowingly installing malware. This is an accurate description.

Analysis of Incorrect Options:

A. Pharming – Involves redirecting users from legitimate websites to fraudulent ones, not mail redirection.

B. Dumpster diving – Searching physical trash for sensitive information, not computers from resellers.

C. Shoulder surfing – Observing someone’s screen or keystrokes, not access exploitation.

Key Concept: Identity theft techniques .

Cole engaged in integration when he invested the laundered funds in commercial real estate. Money laundering generally involves placement, layering, and integration. Placement introduces illicit proceeds into the financial system. Layering separates the funds from their criminal source through transfers, shell companies, foreign accounts, and other complex movements. Integration occurs when the funds are reintroduced into the economy in a way that makes them appear legitimate, such as purchasing or investing in real estate. Cole’s earlier use of XYZ Inc., foreign accounts, and transfers reflects layering. The final use of the funds by Cole Real Estate to invest in commercial real estate represents integration because the illicit proceeds are converted into an apparently legitimate business asset.

Detailed Explanation:

Rationale for Correct Answer: Hollinger and Clark’s research emphasized that management policy should focus on: (1) developing a clear understanding of theft behavior and its causes, and (2) enforcing sanctions consistently. Both are necessary to reduce employee deviance and occupational fraud. Thus, C. Both A & B is correct.

Key Concept: Hollinger-Clark Study — policy implications for managing employee theft.

The correct answer is B. Cash register disbursement schemes commonly involve false voids, false refunds, or unauthorized register activity. Secure access codes help establish individual accountability and prevent one employee from processing fraudulent transactions under another employee’s credentials. Training employees not to share access codes strengthens this control. Option A is weak because announced cash counts reduce deterrence; surprise counts are more effective. Option C does not provide meaningful control because another non-supervising employee might not detect or challenge improper activity. Option D is inappropriate because employees should not independently reconcile their own register activity; independent review is necessary. The professional control principle is to restrict access, preserve accountability, and require supervisory or independent review of register disbursements.

================