ACFE CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Exam Practice Test

The2014 International Fraud Examiners Manualprovides examples of data analysis for accounts payable:

“Examples of data analysis queries that can be performed to help detect fraud through examination of accounts payable include:

• Audit paid invoices for manual comparison with actual invoices.

•Summarise large invoices by amount, vendor, etc.

• Identify debits to expense accounts outside of set default accounts.

• Reconcile cheque registers to disbursements by vendor invoice.”

While other functions apply to payroll or asset management, themost effective function for accounts payablefraud detection is tosummarize large invoices by amount and vendor.

“Fraud examinations should proceed from thegeneral to the specific. That is, they should begin with general information that is known, starting at the periphery, and then move to the more specific details”.

This method avoids premature assumptions and ensures systematic evidence development.

“Even when a victim refers a fraud case for criminal prosecution, the government will usuallynot disclose the contents of nonpublic records with the victim during the investigation”.

Thus, optionDis most accurate.

TheFraud Examiners Manualclearly states:

“Accessing information set to private could result in claims under privacy laws. Thus, information on social media sites that is restricted by privacy settings could result in liability for fraud examiners due to violation of users’ privacy rights.”

Therefore,D is correct

The organizational filings with the government of the jurisdiction in which the company is incorporated

Explanation: Organizational filings (e.g., articles of incorporation) are generally public records and includeownership information, initial shareholders, and the location of the principal office.

“Documentary evidence, including digital evidence, will not be admitted… unless it is established as authentic… fraud examiners mustcapture, download, and preserve any useful information as soon as they discover it, and memorialize each step of the collection process”.

Explanation with Extracts= TheFraud Examiners Manualexplains:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging the data… allows a fraud examiner to view and analyse the contents of a computer without altering the original data in any way”.

Imaging creates an exact, sector-by-sector copy of the drive.

Thus, imaging protects original data integrity.

The Fraud Examiners Manual defines compliance verification as:

“Compliance verification determines whether company policies are met by employee transactions. For example, when employees are out of town, do they adhere to the company policy of not spending more than $30 a day for meals?” .

Thus, the correct function iscompliance verification.

TheFraud Examiners Manualadvises:

“Do not slow down the interview process for note-taking. Instead, jot down key words … In general, it is better to err on the side of taking too few notes rather than too many.”

Therefore, the best practice isC.

The Fraud Examiners Manual states:

“Duplicate testing is used to identify transactions with duplicate values in specified fields … fields such as cheque numbers, invoice numbers, and government identification numbers … searching for duplicates within these fields can help the fraud examiner find anomalies that merit further examination”.

This directly addresses Tony’s need to ensure no two invoices have the same number.

Best practices when working with confidential informants include documenting payments and identities in ways that protect anonymity but avoid risks. TheFraud Examiners ManualandCFE Prepemphasize avoiding cash payments because they reduce transparency and create audit trail problems. Paying in cash is thereforeNOT considered a best practice, whereas using initials, obtaining receipts, and documenting informant information in reports can be acceptable methods.

From the2014 International Fraud Examiners Manual, under the section related to tracing financial transactions, specifically tracing the disposition of loan proceeds, the following objectives of tracing activities are explicitly outlined:

“Tracing the disposition of loan proceeds can help fraud examiners:

Determine whether loan proceeds were deposited into hidden or unknown accounts

Determine whether loan proceeds were used to pay off other loans

Identify the involvement of previously unknown individuals (potential witnesses)

Determine whether payments were made from hidden accounts

Identify undisclosed related-party transactions”

There isno mentionthat tracing loan proceeds can uncoverprevious civil offensescommitted by the subject. Civil offenses refer to non-criminal violations (e.g., breach of contract, torts), which tracing offinancial transactions like loan proceedsis not directly designed to uncover.

This isnot a recognized purposeof tracing as taught in the CFE Investigation section. The core objectives revolve around uncovering hidden assets, hidden accounts, payments, and potential witnesses —not prior legal infractions.

Therefore, thecorrect answer is A, as it is the only option that isNOT trueaccording to official CFE investigation materials.

TheFraud Examiners Manualexplains that rather than drafting an exhaustive list of questions, the interviewer should:

“formulate a brief outline of key points to discuss during the interview”.

This helps organize thoughts while allowing flexibility.

Benford’s Law applies to naturally occurring sets of numbers such asinvoice amounts, expense reports, and transaction data. The Fraud Examiners Manual shows Benford’s Law tests applied to vendor payments to detect anomalies like duplicate or inflated invoices. Telephone numbers, employee IDs, and bank account numbers areassigned numbersand do not follow Benford’s distribution, so they are unsuitable for this test.

The recommended questioning order is:

“As a general rule, questioning should proceed from thegeneral to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

The Manual emphasizes that interviews should be held where the respondent feelscomfortable and secure, not threatened:

“When possible, the interview should be held in a venue where the subject will feel comfortable and secure”.

Holding it in an uncomfortable setting is counterproductive and contrary to best practices.

Guidance on reports:

“A fraud examination report should be accurate, clear, and impartial. The fraud examiner should avoid technical jargon where possible and write in plain language so that readers without specialized knowledge can understand”.

Reports should only include relevant, factual findings—not every detail or opinion.

So, the most accurate statement is that jargon should be avoided.

Admission-seeking interviews are designed:

“to obtain a legal admission of wrongdoing… also to distinguish innocent individuals from culpable ones and to secure a signed written statement”.

The primary purpose is obtaining a valid confession.

When a respondent says “I’m too busy,” it can be diffused by stressing “the interview will be short, the interviewer is already there, the project is important, [and] the interview will not be difficult”.

Thus, stressing brevity is the recommended reaction.

The manual emphasizes that interviews—especially with subjects in other jurisdictions—poselegal and cultural considerations. Fraud examiners must considercultural norms (such as personal space, body language, and eye contact) and jurisdiction-specific lawsgoverning the use of information from interviews. In particular, some jurisdictions limit how interview information can later be used. Therefore, the most accurate statement is that the examiner should verify such limitations before proceeding.

The Financial Action Task Force (FATF) Recommendations, as cited in the Fraud Examiners Manual, require enhanced due diligence in correspondent banking relationships. Specifically, banks must“avoid correspondent banking with shell banks”and ensure the foreign institution is properly licensed and regulated.

This means financial institutions must confirm that the foreign correspondent bank holds the necessarylicenses or certificationsto operate legitimately.

Other options (branch addresses, tax statements, or client loan profiles) are not mandated under FATF’s correspondent banking due diligence requirements. The most critical factor is verifying the correspondent institution’slegal authorization (licenses/certifications)to prevent money laundering and terrorist financing.

The Fraud Examiners Manual explains:

“Each transaction on a blockchain ledger is recorded with a cryptographic address… by analyzing these addresses, fraud examiners can sometimes establish patterns and connections that identify users or link them to criminal activity”.

The manual defines:

“Open questions are those worded in a way that makes it difficult for the respondent to answer ‘yes’ or ‘no.’ The typical open question calls for a monologue response and can be answered in several different ways.”

Example given: “Please tell me about your job.”

Allison’s question (“Why did you choose to do business with that vendor?”) invites explanation, not a yes/no response — making it anopen question.

“The failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding, or, even if admitted, it might not be given much weight because evidence of questionable authenticity does not provide reliable proof.”

Therefore,D is the most accurate statement.

Explanation: After alibis are diffused, suspects may become quiet, withdrawn, or even cry. This often indicates they are considering confession. At this point, the interviewer should present analternative question, forcing a choice between two answers that both imply guilt, thus leading toward a benchmark admission.

TheInternet archives(e.g., the Wayback Machine at archive.org) allow fraud examiners to retrieve prior versions of web pages, including deleted content such as company statements.

✅Answer: C. The internet archives

Oral consent is generallynot sufficientto obtain a suspect’s bank records. TheCFE Prep - Investigationsstates:

“Accessing a subject’s bank records from financial institutions generally requires written consent. Oral consent is the least effective way to obtain permission”.

TheFraud Examiners Manualalso notes that bank information can usually only be obtained withsubpoena, search warrant, or written consent.

“Before commencing a formal investigation (and especially before starting the evidence collection process), it might be necessary to prepare the subject organisation… such as preparing the managers of the employees who will be involved in the investigation, notifying key decision makers, and notifying the organisation’s legal counsel”.

It is not good practice to notify the entire workforce or inform the suspect.

TheCFE Prep – Investigationsexplains:

“Metadata is a type of computer-generated data that can be helpful in a fraud investigation. Metadata information can help determine who wrote a document; who received, opened, copied, edited, moved, or printed the document; and when these events occurred” .

Thus, metadata is the most useful for identifying who created a document.

“Once a denial is uttered, it becomes extremely difficult for the accused to change his response, because doing so would be an admission that he lied. Therefore, the interviewer must prevent an outright denial, thereby making it easier for the subject to confess”.

“One of the most effective techniques to stop or interrupt a denial is through a delaying tactic… the interviewer should attempt to delay the outright denial; he should not argue with the accused”.

Thus, Charles should interrupt with a delaying tactic.

Fraud examiners mustnot opine on guilt, innocence, intent, or disposition. Reports should focus onfacts and expert conclusions within their field. The Manual stresses:

“The fraud examiner should refrain from expressing opinions as to the guilt or innocence of any person or entity. Such conclusions are reserved for the trier of fact” (Fraud Examiners Manual, Reporting section).

Options A, B, and D relate toaccounting and internal control assessments, which fall within an accounting expert’s scope. OnlyCis improper because it speculates about the suspect’s character or intent, which is outside the CFE’s role.

TheFraud Examiners Manualdefines:

“Testimonial evidence is that evidence which is presented in the form of witness statements, whether oral or written, offered in response to questions” (Fraud Examiners Manual – Evidence section).The colleague’s statement overhearing a conversation istestimonial evidence.

Thecorrect answeris:Whether recording is legal depends onconsent laws— so the most helpful question is effectively:“Is consent required from one or all parties to record this conversation?”

Among the provided choices, theclosest matchisNOT listed explicitly. But based on the ACFE manuals, the correct interpretation is that none of the technical details (audio/video, file format, time, duration) matter —only the legal consent requirement matters.

Complete Detailed Explanation with Exact Extracts from Fraud Examiner (CFE) - Investigation Documents: =

The2014 International Fraud Examiners Manualstates:

“In some circumstances, recording an interview might be illegal. Some jurisdictions limit an employer’s right to record employee interviews during an investigation. In fact, in some jurisdictions, audio recording an interview is permitted only with the consent of all parties to the communication. Thus, fraud examiners should always consult with an attorney when deciding whether to record an interview.”

It further emphasizes:

“A telephone recording consent form stipulates where, when, and with whom telephone conversations can be recorded… Be cautioned that the form alone does not make the conduct of recording a telephone conversation illegal or legal.”

????Interpretation:

The legality of recording has nothing to do with:

Audio vs video(A)

Digital file format(B)

Work hours(C)

Duration(D)

Instead, it dependsentirely on jurisdictional consent laws(one-party vs all-party consent).

The2014 International Fraud Examiners Manualstates:

“The information contained on a wire transfer generally will include the following items:

• The amount of the transfer

• The date of the transfer

•The name of the sender or originator

• The routing number of the originating bank or financial institution.”

Therefore, the correct answer isC.

The best practices for signed statements include:

Adding omitted facts as anaddendum.

Preparingseparate statements for unrelated offenses.

Havingwitnesses to the signing.

But:

“The signed statement should be reduced to a short and concise written statement. The interviewer should prepare the statement and present it to the confessor for his signature” .

Thus, requiring the suspect to handwrite the entire statement isnot a best practice.

The Manual and Prep Guide state:

“Before conducting a covert operation, it is essential that the basis for the operation be committed to writing, preferably in a memo. The memorandum should clearly state: the information upon which the covert operation will be based; the information that is expected to be gained from the operation; the identities of suspects, if known; operatives under the fraud examiner’s care, custody, or control. Confidential sources’ identities should not be disclosed.”

Thus,expected informationbelongs, butconfidential source identitiesmust not

According to theFraud Examiners Manual:

“Credit card records are important in tracing assets… information on credit card charges might provide leads to identifying hidden assets. For example, if a fraud examiner notices that the subject used his credit card to purchase items at a marina, the fraud examiner should investigate further to determine if the subject owns a boat”.

Therefore,Ais correct.

The manual states:

“When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence.”

Thus,B is the least accurate statement.

TheFraud Examiners Manualspecifies that admission-seeking interviews should only be conducted when:

“There is a reasonable probability that the respondent has committed the act in question.

All other reasonable investigative steps have been completed.

The interviewer can reasonably control the place, time, and subject matter of the interview.”

There isno requirementthat the examiner must be sure no one else was involved. Therefore,C is correct.

TheFraud Examiners Manualnotes:

“Companies are formed by submitting some type of organisational filing… these company records are generally public records and will include: corporate name, ownership information, location of the principal office, date of incorporation”.

The Prep guide also confirms: “A company’s organisational filing with the government generally includes information about the company’s ownership, initial shareholders, and the location of its principal office”.

Nonpublic records include banking, tax, credit, phone, credit card, and health care records.

Business entity organisational filings (corporate constitutions, articles of incorporation) are generallypublic recordsand can be obtained from the government.

Therefore, reviewing a company’s business filings doesnotrequire access to nonpublic records.

A memorandum recording a whistleblower tip is a written record. TheFraud Examiners Manualdefinesdocumentary evidenceas evidence “presented in the form of documents such as memoranda, contracts, emails, or other records”. Testimonial evidence comes from oral statements; here, the memorandum itself is the evidence, so it is documentary.

The Fraud Examiners Manual and CFE Prep Guide explain that tracing loan proceeds is a key investigative tool, but its scope is limited. Specifically, it helps determine:

if proceeds were deposited into hidden accounts,

if hidden accounts were used for loan payments, and

if loans were secured by hidden assets or unknown witnesses.

However, the manuals do not state that tracing loan proceeds can identify internal control weaknesses. That is a different aspect of fraud examination, often addressed through audit procedures or control assessments.

Thus, optionDis NOT true.

“Once a suspect utters a denial, it becomes extremely difficult… therefore, the interviewer mustprevent an outright denial. Fraud examiners can use several techniques to stop or interrupt denials, includingdelays, repeated interruptions, and reasoning”.

Thus, the correct answer isD.

The Manual says admission-seeking interviews should be conducted only when:

There is reasonable probability the subject committed the act,

All other reasonable investigative steps are complete, and

“The interviewer can reasonably control the place, time, and subject matter of the interview.”.Therefore, Erica must ensure control oftime, place, and contentbefore scheduling.

The2014 International Fraud Examiners ManualandCFE Prep - Investigationsexplicitly state:

“Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. … when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.”

Thus, the correct answer isC.

TheFraud Examiners Manualexplains:

“A Certified Fraud Examiner should not promise confidentiality or leniency to an informant to obtain testimony… the confidentiality relationship runs first to the client or employer”.

Thus, Lisa cannot guarantee full confidentiality but may state she will do her best.

Link analysis is described as avisual analytic toolthat:

“Tracks the movement of money,”

“Demonstrates complex networks,”

“Helps identify indirect relationships with several degrees of separation,” and

“Discovers communications, patterns, and trends.”

It doesnotdisplay financial ratios—that belongs to traditionalfinancial statement/ratio analysis.

TheCFE Prep – Investigationswarns against relying solely on eye contact:

“Behavioural clues are harder to read … Additionally, racial, ethnic, and economic factors should be carefully considered when observing a respondent’s behaviour. Some cultures, for example, discourage looking directly at someone. Other cultures use certain body language that might be misinterpreted.”

Therefore, lack of eye contactcannot safely be taken as proof of dishonesty.

When preparing for interviews, fraud examiners should avoid scripting detailed questions. Instead, they prepare notes of key points to cover.

From the Fraud Examiners Manual:

“Whenever possible, do not prepare a list of predetermined questions to ask the subject. The interview should flow freely. The interviewer might, however, want to develop alist of key points to coverduring the interview”.

Therefore, the best preparation method is to note key points instead of detailed questions.

The2014 International Fraud Examiners Manualdefines:

“Fraud examination is a methodology of resolving signs or allegations of fraud from inception to disposition. The fraud examination methodology establishes a uniform, legal process for resolving signs or allegations of fraud on a timely basis.”

Similarly,CFE Prep – Investigationsconfirms:

“The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional.”

Thus, the correct answer isD.