Practice Free CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Exam Questions Answers With Explanation

Observing signs of wealth (sports car, home remodeling) may raise suspicion, but by itself it does not provide sufficient predication to accuse or notify management of fraud. The proper next step is to conduct discreet inquiries to determine if further evidence exists before escalating.

The Fraud Examiners Manual explains that before obtaining or cleansing data, the first step in using data analysis is the planning phase. This includes understanding the data, articulating objectives, and building a profile of potential frauds. Without this, examiners risk inefficient analysis and overlooking key fraud risks.

? Answer: C. Build a profile of potential frauds

The manual defines:

“Open questions are those worded in a way that makes it difficult for the respondent to answer ‘yes’ or ‘no.’ The typical open question calls for a monologue response and can be answered in several different ways.”

Example given: “Please tell me about your job.”

Allison’s question (“Why did you choose to do business with that vendor?”) invites explanation, not a yes/no response — making it an open question.

The Fraud Examiners Manual defines double-negative questions as those containing two forms of negation in a single clause. They are confusing and “often suggest an answer opposite to the correct one.” The example given is almost identical to the question here:

“Didn’t you suspect that something wasn’t right?”.

Thus, Sylvia’s question is a double-negative question, which should be avoided.

The Fraud Examiners Manual makes clear that covert operations are extraordinary measures that require high skill and planning and should be used only when no other practical method is available. They carry significant risks, including embarrassment, liability, and even injury or death. Therefore, covert operations should not be the first resort but instead follow conventional evidence-gathering efforts.

The Manual defines leading questions as those that contain or suggest the answer:

“Leading questions… are framed in a way that evokes a specific reply… most commonly used to confirm facts already known… Example: ‘You got promoted, right?’”

Nathaniel’s question, “When were you promoted to manager?” presumes the promotion occurred. This leads the subject by suggesting a fact that may not be true. It is not open (does not invite free narration), not complex (it asks one thing), and not closed (doesn’t call for yes/no but presumes an answer).

When preparing for interviews, fraud examiners should avoid scripting detailed questions. Instead, they prepare notes of key points to cover.

From the Fraud Examiners Manual:

“Whenever possible, do not prepare a list of predetermined questions to ask the subject. The interview should flow freely. The interviewer might, however, want to develop a list of key points to cover during the interview”.

Therefore, the best preparation method is to note key points instead of detailed questions.

The 2014 International Fraud Examiners Manual provides examples of data analysis for accounts payable:

“Examples of data analysis queries that can be performed to help detect fraud through examination of accounts payable include:

• Audit paid invoices for manual comparison with actual invoices.

• Summarise large invoices by amount, vendor, etc.

• Identify debits to expense accounts outside of set default accounts.

• Reconcile cheque registers to disbursements by vendor invoice.”

While other functions apply to payroll or asset management, the most effective function for accounts payable fraud detection is to summarize large invoices by amount and vendor.

“Electronic payment records can be valuable in tracing investigations… they can reveal, among other things, assets the subject has purchased”.

They can also reveal loans, real estate taxes, and business locations, but not directly whether Lottie is “skimming” funds.

The 2014 International Fraud Examiners Manual and CFE Prep - Investigations explicitly state:

“Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. … when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.”

Thus, the correct answer is C.

The recommended questioning order is:

“As a general rule, questioning should proceed from the general to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

CFE Prep clarifies entrapment:

“Entrapment occurs when law enforcement induces a person to commit a crime that he is not predisposed to commit… It is imperative that adequate predication exists before the operation is commenced. For example, if the officer received a reliable tip, that could serve as adequate predication.”

Here, the officer acted on a reliable tip, so the entrapment claim would fail.

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

The Fraud Examiners Manual advises:

“Do not slow down the interview process for note-taking. Instead, jot down key words … In general, it is better to err on the side of taking too few notes rather than too many.”

Therefore, the best practice is C.

From the 2014 International Fraud Examiners Manual, under the section related to tracing financial transactions, specifically tracing the disposition of loan proceeds, the following objectives of tracing activities are explicitly outlined:

“Tracing the disposition of loan proceeds can help fraud examiners:

Determine whether loan proceeds were deposited into hidden or unknown accounts

Determine whether loan proceeds were used to pay off other loans

Identify the involvement of previously unknown individuals (potential witnesses)

Determine whether payments were made from hidden accounts

Identify undisclosed related-party transactions”

There is no mention that tracing loan proceeds can uncover previous civil offenses committed by the subject. Civil offenses refer to non-criminal violations (e.g., breach of contract, torts), which tracing of financial transactions like loan proceeds is not directly designed to uncover.

This is not a recognized purpose of tracing as taught in the CFE Investigation section. The core objectives revolve around uncovering hidden assets, hidden accounts, payments, and potential witnesses — not prior legal infractions.

Therefore, the correct answer is A, as it is the only option that is NOT true according to official CFE investigation materials.

Social media content is dynamic—posts can be edited, deleted, or moved—so fraud examiners must preserve relevant information promptly and in a manner that supports authenticity and admissibility. CFE investigative guidance emphasizes that documentary (including digital) evidence carries limited value in legal proceedings unless it can be shown to be authentic and in substantially the same condition as when collected. Simply saving a link (Option A) is weak because the underlying content can change, and a link does not preserve what was actually observed. Requesting a copy from the platform (Option B) is often impractical as a routine step and may require legal process; it also does not replace contemporaneous preservation by the examiner. A “forensic shutdown” (Option C) is not an appropriate method for preserving web-based social media content because the key evidence exists on external servers, not solely on the examiner’s machine. Proper practice is to download/capture and preserve what was observed while documenting the collection steps and maintaining a defensible chain of custody so authenticity can be established if needed in court.

CFE interviewing guidance emphasizes that legal considerations can materially affect how interviews are conducted and that employee rights and obligations vary by jurisdiction and by case. In particular, whether a subject has a duty to cooperate (and the extent to which an organization can compel cooperation) can differ across jurisdictions and can also be constrained by contractual rights (e.g., union agreements, employment contracts) and local regulations. Because June’s subject is from a different jurisdiction, the most appropriate preparation step is to verify jurisdiction-specific rules that could limit compulsion or otherwise affect the interview’s legal permissibility and risk profile. Option D directly addresses this core cross-jurisdiction concern: what can legally be required of the subject. Option A is not a CFE-recommended preparatory focus; examiners should adapt to legal and procedural requirements rather than “teach” their own cultural practices to the subject. Option B is inappropriate and contrary to professional interviewing principles (the goal is cooperation, not discomfort). Option C is incorrect because consultation with counsel is not limited to “third jurisdiction” scenarios; the guidance underscores that interview-related legal risks and jurisdictional differences often warrant counsel input. Therefore, D best reflects CFE investigation knowledge for cross-jurisdiction interviewing readiness.

The Fraud Examiners Manual specifies:

“Fraud examinations should proceed from the general to the specific. That is, they should begin with general information that is known and then move to more specific details.”

Therefore, statement B is false, making it the correct answer.

Best practice is to conduct interviews individually. The Manual states:

“When conducting interviews, witnesses should be interviewed separately. Interviewing multiple witnesses together risks contamination of testimony and reduced reliability of responses”.

Explanation with Extracts = The Fraud Examiners Manual explains:

“Conducting digital forensic investigations in the cloud environment (i.e., cloud forensics) presents challenges not faced in traditional forensic practices… Some of the important challenges… Lack of frameworks and specialist tools, Lack of information accessibility, Lack of data control, Jurisdiction of storage…” .

Specifically: “With cloud computing, clients of cloud service providers do not have physical control of the media or the network on which their data resides, and this lack of data control can complicate efforts to collect data stored on the cloud” .

Thus, lack of data control is a unique challenge.

Signs of stress (e.g., shallow breathing, stuttering, shifting posture) do not automatically equal deception. The Fraud Examiners Manual states:

“Signs of stress do not always mean a subject is lying. An honest subject might feel stress simply by being questioned. Conclusions must be based on clusters of behavior and corroborating evidence, not a single indicator”.

The 2014 Fraud Examiners Manual and CFE Prep list common concealment methods:

“Some common techniques for hiding assets include transferring assets into foreign trusts, overpaying taxes, prepaying on a home mortgage, obtaining a life insurance policy, and transferring assets into someone else’s name.”

Thus, the correct answer is D.

After alibis are diffused, suspects may become quiet, withdrawn, or even cry. This often indicates they are considering confession. At this point, the interviewer should present an alternative question, forcing a choice between two answers that both imply guilt, thus leading toward a benchmark admission.

When dealing with potentially hostile or volatile interviewees, fraud examiners are advised not to give much advance notice. This reduces the chance that the subject will prepare evasive or combative responses. The Fraud Examiners Manual emphasizes minimizing preparation time for resistant interviewees to ensure more candid responses.

The Fraud Examiners Manual notes:

“Fraud examiners are often tasked with tracing illicit transactions… For example, a victim of fraud might want a tracing search to facilitate the recovery of criminal proceeds”.

The Fraud Examiners Manual specifies that admission-seeking interviews should only be conducted when:

“There is a reasonable probability that the respondent has committed the act in question.

All other reasonable investigative steps have been completed.

The interviewer can reasonably control the place, time, and subject matter of the interview.”

There is no requirement that the examiner must be sure no one else was involved. Therefore, C is correct.

“To locate people using online records… First, when searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

This aligns with the Prep guide: “Obtaining a past address of the subject should be the first step in trying to locate a subject using online records”.

Thus, B is correct.

The 2014 International Fraud Examiners Manual states:

“Asset hiders look for certain characteristics in the financial vehicles they use to conceal assets. Asset hiders want products that are liquid (i.e., items that can be purchased and sold in a short period of time). Moreover, asset hiders want products that are difficult to trace or untraceable. With such instruments, asset hiders can break or muddy links between the initial receipt of the assets and their final disposition. Asset hiders also look for products that are secure and accessible.”

The CFE Prep - Investigations guide confirms:

“Asset hiders want products that are liquid, difficult to trace, secure, and accessible… NOT transparent.”

???? Interpretation:

Accessibility = common desirable trait (correct).

Transparency = opposite of concealment (not desirable).

Exclusivity = not a standard consideration.

Traceability = asset hiders want the opposite (difficult to trace).

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

During admission-seeking interviews, when suspects persist with denials or alibis, examiners are trained to diffuse them. Accepted techniques include:

Discussing testimony of witnesses,

Displaying physical evidence, and

Downplaying the strength of evidence.

However, manuals caution that discussing a suspect’s prior deceptions is not an effective or recommended method to diffuse alibis. It risks confrontation and may damage rapport, reducing chances of confession.

Therefore, option C is the exception.

When a witness resists an interview with “I’m too busy,” CFE interview guidance treats this as a common barrier that may conceal other causes—reluctance, discomfort, ego concerns, or simply a desire to avoid involvement. The recommended approach is to reduce resistance by emphasizing cooperation, importance, and minimal burden: communicate that the witness’s help is needed, the interview will be brief, and it will not be difficult. Option D directly reflects these recommended diffusion techniques by stressing both the importance of the witness’s assistance and the short duration of the meeting, which lowers the perceived cost of participation. Option A is inappropriate and potentially coercive, may exceed the examiner’s authority, and can create hostility or claims of intimidation—undermining credibility and reliability of information obtained. Option C is confrontational and escalates resistance without advancing the interview. Option B can be helpful as a scheduling accommodation, but CFE guidance for this specific resistance phrase prioritizes overcoming the objection by reassuring brevity and importance, making D the best answer among the options.

Fraud examination reports are not written only for internal use. The 2014 International Fraud Examiners Manual clearly emphasizes:

“When drafting a report, fraud examiners must consider who might end up reading it. Fraud examiners should keep in mind that the fraud examination report will be read by the general public and adverse parties. Under no circumstances should the fraud examiner prepare a communication with the idea that the information will not be disclosed to adverse third parties. Fraud examiners should draft their reports with this caveat in mind.”

The manual further specifies the wide range of potential readers:

*“There are many individuals and groups that might end up reading a fraud examination report, including the following parties:

Company insiders (managers, board of directors, owners, investors, etc.)

Attorneys (legal counsel, prosecutors, regulators, and defense counsel)

Defendants and witnesses

Press and media outlets

Judges or juries”*

This aligns with the CFE Prep - Investigations study guide, which also confirms:

“There are many parties that might read a fraud examination report, including company insiders, attorneys, defendants and witnesses, press and media outlets, and judges or juries.”

???? Interpretation:

The media may access the report through litigation disclosures or leaks.

Opposing legal counsel will review the report during discovery or trial.

Investors and owners (company insiders) are primary stakeholders.

Thus, the only correct choice is D. All of the above, because fraud examination reports must be written with all possible audiences in mind, ensuring accuracy, clarity, impartiality, and professionalism to withstand scrutiny from multiple directions.

The Fraud Examiners Manual stresses that fraud examiners must never promise unconditional confidentiality, because findings often must be disclosed to management, auditors, or authorities. They can only offer “qualified confidentiality” (best efforts to protect identity, but with necessary limits). Therefore, option A is the most appropriate response.

“The interviewer must not express disgust, outrage, or moral condemnation… the basic logic of obtaining confessions can be summed up as maximize sympathy and minimize the perception of moral wrongdoing”.

Sympathy creates an environment conducive to confession, while other options (third-party presence, emphasizing immorality, or pressuring with time) are explicitly discouraged.

A key principle in fraud examinations is confidentiality. Fraud examiners must avoid tipping off the suspect, which could lead to destruction of evidence or flight. Measures include limiting discussions, informing only those with a legitimate need-to-know, and investigating discreetly.

The Fraud Examiners Manual advises avoiding prematurely alerting perpetrators. Recommended methods include:

“Conducting investigations at times when the suspect is not present (such as nonbusiness hours)”.

This avoids tipping off suspects.

The manual emphasizes that interviews—especially with subjects in other jurisdictions—pose legal and cultural considerations. Fraud examiners must consider cultural norms (such as personal space, body language, and eye contact) and jurisdiction-specific laws governing the use of information from interviews. In particular, some jurisdictions limit how interview information can later be used. Therefore, the most accurate statement is that the examiner should verify such limitations before proceeding.

Predictive analytics is defined as:

“the use of historical data combined with statistical, analytical, and machine learning techniques to create models that capture trends and produce forecasts”.

So, option C best describes predictive analytics.

The Fraud Examiners Manual advises that fraud examiners should preserve and organize evidence, and one of the key steps is to establish a document database early. This allows examiners to track documents, index them, and link them to findings. Dusting for fingerprints, leaving originals behind, or organizing solely in chronological order are not standard best practices .

Explanation with Extracts = Pretexting is:

“The act of impersonating someone else or making false or misleading statements to obtain information from financial institutions. Several jurisdictions have prohibited pretexting against financial institutions”.Thus, falsely claiming to be the spouse constitutes illegal pretexting.

The Fraud Examiners Manual explains:

“Each transaction on a blockchain ledger is recorded with a cryptographic address… by analyzing these addresses, fraud examiners can sometimes establish patterns and connections that identify users or link them to criminal activity”.

When introducing themselves, fraud examiners should avoid titles like investigator or Certified Fraud Examiner that might raise suspicion or defensiveness. The Manual recommends using neutral titles such as auditor because it is less threatening and more acceptable in an organizational setting.

Before pursuing litigation, fraud examiners are advised to consider whether nonlegal remedies (e.g., restitution agreements, settlements, insurance recovery) are possible, since legal actions can be costly, slow, and uncertain. Statutes of limitation and guilt are legal issues for attorneys and courts, but examiners must weigh recovery options first.

“Even when a victim refers a fraud case for criminal prosecution, the government will usually not disclose the contents of nonpublic records with the victim during the investigation”.

Thus, option D is most accurate.

The CFE Prep – Investigations states:

“If a fraud examiner gets a verbal confession from the fraudster, it does not matter whether the fraudster claims his conduct was an accident. The following items of information should be obtained … admission that the accused knew the conduct was wrong, facts known only to the confessor, the accused’s motive, approximate dates, involvement of others, physical evidence, and disposition of illicit income.”

Thus, the examiner does not need a statement about accident.

“Internal sources will sometimes be the only resource for certain types of documents—such as… employee personnel files—unless the fraud examiner has the subject’s consent or a legal order”.

External searches may reveal addresses, assets, or competitor ownership, but personnel files require internal/non-public access.

The best practices for signed statements include:

Adding omitted facts as an addendum.

Preparing separate statements for unrelated offenses.

Having witnesses to the signing.

But:

“The signed statement should be reduced to a short and concise written statement. The interviewer should prepare the statement and present it to the confessor for his signature” .

Thus, requiring the suspect to handwrite the entire statement is not a best practice.

“Once a suspect utters a denial, it becomes extremely difficult… therefore, the interviewer must prevent an outright denial. Fraud examiners can use several techniques to stop or interrupt denials, including delays, repeated interruptions, and reasoning”.

Thus, the correct answer is D.

“Distractions should be kept to a minimum. Ideally, there should be no photographs, windows, or other objects in the room. Chairs should be placed about four to six feet apart, and the accused should not be permitted to sit behind any physical barriers, such as chairs, tables, or desks” .

The door should be closed (but not locked), not open .

Tables or desks should not be between interviewer and suspect .

Thus, the correct adjustment is removing distractions (pictures/posters).