CFE-Investigation Practice Exam Questions with Answers Certified Fraud Examiner (CFE) - Investigation Certification

The organizational filings with the government of the jurisdiction in which the company is incorporated

Explanation: Organizational filings (e.g., articles of incorporation) are generally public records and includeownership information, initial shareholders, and the location of the principal office.

“Securities regulators… require disclosures that typically include: corporate financial statements, identification of officers and directors, identification of significant owners… and a history of the business”?10:2014 International Fraud Examiners Manual.pdf†L73-L95?.

Thus, regulatory securities records are the best source for financial statements.

TheFraud Examiners Manualexplains:

“Textual analytics is a method of using software to extract usable information from unstructured text data… it cancategorise data to reveal patterns, sentiments, and relationships indicative of fraud”.

This is the key reason fraud examiners analyze textual/unstructured data.

When obtaining a verbal confession, the fraud examiner should secure details such as: admission of wrongdoing, number of instances, amount involved, dates, involvement of others, residual assets, and motive. However, itdoes not matter whether the suspect claims the conduct was an accident; that is not necessary to record.

The Manual defines leading questions as those that contain or suggest the answer:

“Leading questions… are framed in a way that evokes a specific reply… most commonly used to confirm facts already known… Example: ‘You got promoted, right?’”

Nathaniel’s question, “When were you promoted to manager?” presumes the promotion occurred. Thisleadsthe subject by suggesting a fact that may not be true. It is not open (does not invite free narration), not complex (it asks one thing), and not closed (doesn’t call for yes/no but presumes an answer).

TheFraud Examiners ManualandCFE Prepemphasize:

“Generally, documentary evidence, including digital evidence, will not be admitted in a legal proceeding unless it is established as authentic… Consequently, fraud examiners who collect evidence from social media must capture, download, and preserve any useful information as soon as they discover it, and they must memorialize each step of the collection process”.

Thus, preservation for authenticity is the key.

“Electronic payment records can be valuable in tracing investigations… they can reveal, among other things,assets the subject has purchased”.

They can also reveal loans, real estate taxes, and business locations, but not directly whether Lottie is “skimming” funds.

Body language alone (e.g., avoiding eye contact) cannot be taken as proof of deception. The Manual warns against drawing conclusions from a single behavioral cue:

“Avoiding eye contact isnot directly linked to deception. Such behavior could stem from cultural norms, nervousness, or personality traits. Examiners should consider clusters of behavior, context, and corroborating evidence before concluding deception”.

Therefore,Cis correct.

TheFraud Examiners Manualspecifies that admission-seeking interviews should only be conducted when:

“There is a reasonable probability that the respondent has committed the act in question.

All other reasonable investigative steps have been completed.

The interviewer can reasonably control the place, time, and subject matter of the interview.”

There isno requirementthat the examiner must be sure no one else was involved. Therefore,C is correct.

Best practice for signed statements:

Fraud examiners should prepare the statement, keep it concise, and ensure voluntariness and intent are clear.

While not legally required, it isrecommendedthat two individuals witness the signing.?Answer: C. Have two individuals witness the signing of the document when possible

“The interviewer generally should indicate his name and company, but he should avoid stating his title. In general, the more informal the interview, the more relaxed the respondent”.

Introducing oneself only by name and company (not title like CFE or auditor) avoids intimidation and builds cooperation.

During admission-seeking interviews, when suspects persist with denials or alibis, examiners are trained to diffuse them. Accepted techniques include:

Discussing testimony of witnesses,

Displaying physical evidence, and

Downplaying the strength of evidence.

However, manuals caution that discussing a suspect’sprior deceptionsis not an effective or recommended method to diffuse alibis. It risks confrontation and may damage rapport, reducing chances of confession.

Therefore, optionCis the exception.

Explanation: After alibis are diffused, suspects may become quiet, withdrawn, or even cry. This often indicates they are considering confession. At this point, the interviewer should present analternative question, forcing a choice between two answers that both imply guilt, thus leading toward a benchmark admission.

The manual notes:

“Records subpoenaed in a criminal case usually are available only to the government during the investigation, and perhaps thereafter if not disclosed at trial”.

Thus, statement D is false.

TheFraud Examiners Manualclarifies:

“The recommendations section is optional, and there might be instances where the fraud examiner wishes to discuss remedial measures or specific recommendations in a separate document”.

The Prep guide also states: “A written report might include a section for recommendations”.Thus, it isnot requiredin every report.

TheCFE Prep Guideclarifies:

“A fraud response plan outlines the actions… when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success”.

Thus, statement D is false.

TheFraud Examiners Manualstates:

“The primary concern when analysing digital evidence is to maintain the integrity of the data at all times. Fraud examiners must be careful with computer equipment because a careless investigator might inadvertently alter important evidence”.

Examiners must look for both inculpatory and exculpatory evidence.

The Financial Action Task Force (FATF) Recommendations, as cited in the Fraud Examiners Manual, require enhanced due diligence in correspondent banking relationships. Specifically, banks must“avoid correspondent banking with shell banks”and ensure the foreign institution is properly licensed and regulated.

This means financial institutions must confirm that the foreign correspondent bank holds the necessarylicenses or certificationsto operate legitimately.

Other options (branch addresses, tax statements, or client loan profiles) are not mandated under FATF’s correspondent banking due diligence requirements. The most critical factor is verifying the correspondent institution’slegal authorization (licenses/certifications)to prevent money laundering and terrorist financing.

The Fraud Examiners Manual makes clear that covert operations areextraordinary measuresthat require high skill and planning and should be used only when no other practical method is available. They carry significant risks, includingembarrassment, liability, and even injury or death. Therefore, covert operations should not be the first resort but instead follow conventional evidence-gathering efforts.

“Alibis generally can be diffused by displaying physical evidence… evidence should be displayed one piece at a time, in reverse order of importance”?16:2014 International Fraud Examiners Manual.pdf†L11-L14?.

The Prep Guide warns: “The proper technique is not to lay it all out at once” .

Thus, showing everything at once is theleast effective.

The manual explains:

“After the interviewer establishes rapport through normal conversation, he must observe the respondent’s reactions. This will serve as a baseline for observing behaviour when questions that are more sensitive are asked.”

A neutral, non-threatening question such as“How long have you been in this department?”is ideal for establishing a baseline.

The manual emphasizes that interviews—especially with subjects in other jurisdictions—poselegal and cultural considerations. Fraud examiners must considercultural norms (such as personal space, body language, and eye contact) and jurisdiction-specific lawsgoverning the use of information from interviews. In particular, some jurisdictions limit how interview information can later be used. Therefore, the most accurate statement is that the examiner should verify such limitations before proceeding.

TheFraud Examiners Manualclearly states:

“Accessing information set to private could result in claims under privacy laws. Thus, information on social media sites that is restricted by privacy settings could result in liability for fraud examiners due to violation of users’ privacy rights.”

Therefore,D is correct

The2014 International Fraud Examiners Manualstates:

“Asset hiders look for certain characteristics in the financial vehicles they use to conceal assets. Asset hiders want products that are liquid (i.e., items that can be purchased and sold in a short period of time). Moreover, asset hiders want products that are difficult to trace or untraceable. With such instruments, asset hiders can break or muddy links between the initial receipt of the assets and their final disposition. Asset hiders also look for products that are secure and accessible.”

TheCFE Prep - Investigationsguide confirms:

“Asset hiders want products that are liquid, difficult to trace, secure, and accessible… NOT transparent.”

????Interpretation:

Accessibility= common desirable trait (correct).

Transparency= opposite of concealment (not desirable).

Exclusivity= not a standard consideration.

Traceability= asset hiders want the opposite (difficult to trace).

“Documentary evidence, including digital evidence, will not be admitted… unless it is established as authentic… fraud examiners mustcapture, download, and preserve any useful information as soon as they discover it, and memorialize each step of the collection process”.

According to the2014 International Fraud Examiners Manual:

“The termfraud examinationrefers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional. The fraud examination process encompasses a variety of tasks that might include:

• Obtaining evidence

• Reporting

• Testifying

• Assisting in fraud detection and prevention”.

Similarly, in theCFE Prep - Investigationsstudy guide:

“Fraud examination is best described as…a methodology for resolving fraud allegations from inception to disposition. The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional”.

This clearly verifies thatfraud examinationis the correct term for the process of resolving fraud allegations from beginning (inception) to end (disposition).

Therefore, thecorrect answer is D. Fraud examination.

“Once a denial is uttered, it becomes extremely difficult for the accused to change his response, because doing so would be an admission that he lied. Therefore, the interviewer must prevent an outright denial, thereby making it easier for the subject to confess”.

“One of the most effective techniques to stop or interrupt a denial is through a delaying tactic… the interviewer should attempt to delay the outright denial; he should not argue with the accused”.

Thus, Charles should interrupt with a delaying tactic.

The Manual emphasizes that interviews should be held where the respondent feelscomfortable and secure, not threatened:

“When possible, the interview should be held in a venue where the subject will feel comfortable and secure”.

Holding it in an uncomfortable setting is counterproductive and contrary to best practices.

TheFraud Examiners Manualdefines:

“Testimonial evidence is that evidence which is presented in the form of witness statements, whether oral or written, offered in response to questions” (Fraud Examiners Manual – Evidence section).The colleague’s statement overhearing a conversation istestimonial evidence.

“Introductory questions should be designed to establish rapport… Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Jason’s small talk about sports and compliments is clearly rapport building

“The failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding, or, even if admitted, it might not be given much weight because evidence of questionable authenticity does not provide reliable proof.”

Therefore,D is the most accurate statement.

“Opinions or conclusions concerning the guilt or innocence of a fraud suspect is outside the scope of a fraud examination and should never be included in a report”.

Functions of a fraud examination report include presenting evidence, corroborating facts, and supporting credibility. Communicating the examiner’s qualifications to provide opinions isnota function.

Therefore, option D is not a function of a fraud examination report.

“The locations of the subject’s residences and businesses (e.g., through analysing the payments of utility bills)… The cities and countries in which the subject conducts business (e.g., through analysing the payments for carrier services to deliver packages)”?6:2014 International Fraud Examiners Manual.pdf†L57-L77?.

They donotdirectly prove skimming or show market values of real estate.

Explanation with Extracts= Predication requires sufficient circumstances to suggest fraud. TheCFE Prep Guideexplains:

“Fraud examiners should not investigate beyond the available predication… There is insufficient predication to confront Wallace or to make any direct allegations about fraud, but Carter does have adequate predication to make discreet inquiries”.Similarly, Arnold may discreetly inquire but not accuse or search property without further evidence.

Predictive analytics is defined as:

“the use of historical data combined with statistical, analytical, and machine learning techniques to create models that capture trends and produce forecasts”.

So, optionCbest describes predictive analytics.

According to CFE guidance, when planning interviews, fraud examiners should:

“Consider what the interview is intended to accomplish and state an objective.

Review the case file to ensure that important information has not been overlooked.

Prepare a list of topics and general questions.

Choose a neutral and nonthreatening environment so the subject does not feel intimidated.”

Holding the interview in a venue intended to make the subject feel uncomfortableviolates proper CFE interview practice. Hence,Dis correct.

The best practices for signed statements include:

Adding omitted facts as anaddendum.

Preparingseparate statements for unrelated offenses.

Havingwitnesses to the signing.

But:

“The signed statement should be reduced to a short and concise written statement. The interviewer should prepare the statement and present it to the confessor for his signature” .

Thus, requiring the suspect to handwrite the entire statement isnot a best practice.

The Fraud Examiners Manual explains:

“Each transaction on a blockchain ledger is recorded with a cryptographic address… by analyzing these addresses, fraud examiners can sometimes establish patterns and connections that identify users or link them to criminal activity”.

Explanation with Extracts= The2014 Fraud Examiners Manualstates:

“The EU Data Protection Directive … regulates the processing, using, and transferring of personal data within the European Union, and it places limits on transmitting personal data to non-EU countries”.

Therefore, a U.S.-based examiner handling HR data of an EU employee must comply with EU GDPR requirements.

Credit reports can sometimes be obtained legally if properconsentor a recognized legal basis (such as employment background checks, extension of credit, or legal proceedings) exists. The Manual notes:

“Access to personal credit data may be permitted when theindividual has given consentor when required for employment, credit, or legal reasons”.

Thus, it isnot truethat credit data can never be obtained—circumstances exist where it can be done lawfully.

TheFraud Examiners Manualexplains:

“Benford’s Law applies to data that is not assigned (such as IDs or phone numbers) but that occurs naturally in transactions. For example, payment amounts, invoice values, and expense reimbursements are well suited.”

Thus,payment amountsare best suited for Benford’s Law.

The recommended questioning order is:

“As a general rule, questioning should proceed from thegeneral to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

According to theFraud Examiners Manual:

“Credit card records are important in tracing assets… information on credit card charges might provide leads to identifying hidden assets. For example, if a fraud examiner notices that the subject used his credit card to purchase items at a marina, the fraud examiner should investigate further to determine if the subject owns a boat”.

Therefore,Ais correct.

TheFraud Examiners Manualadvises that fraud examiners should preserve and organize evidence, and one of the key steps is toestablish a document database early. This allows examiners to track documents, index them, and link them to findings. Dusting for fingerprints, leaving originals behind, or organizing solely in chronological order are not standard best practices .

Limitations of online public record searches include:

Need to search multiple jurisdictions.

Records are often only abstracts.

Information must be verified for accuracy.There isno mentionthat online record vendors are “difficult to find.” In fact, many such vendors exist.

The2014 Fraud Examiners ManualandCFE Prepexplain:

“Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.”

Thus, the correct answer isA.