ACFE CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Exam Practice Test

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

According to the2014 International Fraud Examiners Manual:

“The termfraud examinationrefers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional. The fraud examination process encompasses a variety of tasks that might include:

• Obtaining evidence

• Reporting

• Testifying

• Assisting in fraud detection and prevention”.

Similarly, in theCFE Prep - Investigationsstudy guide:

“Fraud examination is best described as…a methodology for resolving fraud allegations from inception to disposition. The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional”.

This clearly verifies thatfraud examinationis the correct term for the process of resolving fraud allegations from beginning (inception) to end (disposition).

Therefore, thecorrect answer is D. Fraud examination.

Explanation with Extracts= Predication requires sufficient circumstances to suggest fraud. TheCFE Prep Guideexplains:

“Fraud examiners should not investigate beyond the available predication… There is insufficient predication to confront Wallace or to make any direct allegations about fraud, but Carter does have adequate predication to make discreet inquiries”.Similarly, Arnold may discreetly inquire but not accuse or search property without further evidence.

“Credit card records… show card purchasing limits, previous payment history, account balance,when and where the subject has travelled, restaurants frequented, and assets acquired. In short, these records show the movements and habits of the person”.

Therefore,Bis correct.

“In jurisdictions that regulate credit information and personal data, a fraud examiner will generally need a legally acceptable reason for accessing such information from third parties… some common circumstances include when: the individual has given consent”.

Thus, with the individual’s consent, Leslie could obtain the report.

A memorandum recording a whistleblower tip is a written record. TheFraud Examiners Manualdefinesdocumentary evidenceas evidence “presented in the form of documents such as memoranda, contracts, emails, or other records”. Testimonial evidence comes from oral statements; here, the memorandum itself is the evidence, so it is documentary.

Explanation with Extracts= TheFraud Examiners Manualexplains:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging the data… allows a fraud examiner to view and analyse the contents of a computer without altering the original data in any way”.

Imaging creates an exact, sector-by-sector copy of the drive.

Thus, imaging protects original data integrity.

Observing signs of wealth (sports car, home remodeling) may raise suspicion, but by itself it doesnot provide sufficient predicationto accuse or notify management of fraud. The proper next step is to conduct discreet inquiries to determine if further evidence exists before escalating.

The manual and CFE Prep list the main limitations:

Coverage varies by jurisdiction.

Searches are limited in area.

Records are often abstracts.

Information may be inaccurate or outdated.

Searches can be erratic.

Nowhere is “difficulty in finding database companies” mentioned.

When preparing to interview subjects across jurisdictions, fraud examiners must consider bothlegal rightsandcultural differences. The Manual advises examiners to:

Researchlocal lawsgoverning the right to counsel during interviews.

Understand cultural norms (e.g., greetings, eye contact).Failing to observe these can damage credibility. Thus, it is most accurate that an examiner must determine whether the subject can legally insist on a lawyer’s presence .

Credit reports can sometimes be obtained legally if properconsentor a recognized legal basis (such as employment background checks, extension of credit, or legal proceedings) exists. The Manual notes:

“Access to personal credit data may be permitted when theindividual has given consentor when required for employment, credit, or legal reasons”.

Thus, it isnot truethat credit data can never be obtained—circumstances exist where it can be done lawfully.

Nonpublic records include banking, tax, credit, phone, credit card, and health care records.

Business entity organisational filings (corporate constitutions, articles of incorporation) are generallypublic recordsand can be obtained from the government.

Therefore, reviewing a company’s business filings doesnotrequire access to nonpublic records.

Before pursuing litigation, fraud examiners are advised to consider whethernonlegal remedies(e.g., restitution agreements, settlements, insurance recovery) are possible, since legal actions can be costly, slow, and uncertain. Statutes of limitation and guilt are legal issues for attorneys and courts, but examiners must weigh recovery options first.

Guidance on reports:

“A fraud examination report should be accurate, clear, and impartial. The fraud examiner should avoid technical jargon where possible and write in plain language so that readers without specialized knowledge can understand”.

Reports should only include relevant, factual findings—not every detail or opinion.

So, the most accurate statement is that jargon should be avoided.

TheFraud Examiners Manualadvises avoiding prematurely alerting perpetrators. Recommended methods include:

“Conducting investigations at times when the suspect is not present (such as nonbusiness hours)”.

This avoids tipping off suspects.

“Metadata information can help determine who wrote a document, who received, opened, copied, edited, moved, or printed the document, andwhen these events occurred”.

Thus, metadata is the best source for creation date.

Fraud examiners mustnot opine on guilt, innocence, intent, or disposition. Reports should focus onfacts and expert conclusions within their field. The Manual stresses:

“The fraud examiner should refrain from expressing opinions as to the guilt or innocence of any person or entity. Such conclusions are reserved for the trier of fact” (Fraud Examiners Manual, Reporting section).

Options A, B, and D relate toaccounting and internal control assessments, which fall within an accounting expert’s scope. OnlyCis improper because it speculates about the suspect’s character or intent, which is outside the CFE’s role.

TheFraud Examiners Manualexplains:

“Benford’s Law applies to data that is not assigned (such as IDs or phone numbers) but that occurs naturally in transactions. For example, payment amounts, invoice values, and expense reimbursements are well suited.”

Thus,payment amountsare best suited for Benford’s Law.

The Manual emphasizes that interviews should be held where the respondent feelscomfortable and secure, not threatened:

“When possible, the interview should be held in a venue where the subject will feel comfortable and secure”.

Holding it in an uncomfortable setting is counterproductive and contrary to best practices.

The2014 International Fraud Examiners Manualstates:

“The information contained on a wire transfer generally will include the following items:

• The amount of the transfer

• The date of the transfer

•The name of the sender or originator

• The routing number of the originating bank or financial institution.”

Therefore, the correct answer isC.

To confirm ownership of a building,real estate and permit recordsare most useful. The Manual notes thatreal property records and related permits identify the owner, provide legal descriptions, and show improvements such as construction of commercial buildings. Court or voter registration records would not typically establish property ownership.

Both the CFE Prep Guide and the Fraud Examiners Manual state thatevery fraud examination must be conducted under the assumption that litigation will result. This ensures that evidence is collected and preserved properly, in compliance with legal standards:

“Each fraud examination should begin with the proposition that the case will end in litigation… If the fraud examiner assumes that litigation will occur, he will conduct the examination in accordance with the proper rules of evidence”.

This principle protects the integrity of the examination and ensures admissibility of evidence if the matter proceeds to court.

Predictive analytics is defined as:

“the use of historical data combined with statistical, analytical, and machine learning techniques to create models that capture trends and produce forecasts”.

So, optionCbest describes predictive analytics.

The manual explains:

“After the interviewer establishes rapport through normal conversation, he must observe the respondent’s reactions. This will serve as a baseline for observing behaviour when questions that are more sensitive are asked.”

A neutral, non-threatening question such as“How long have you been in this department?”is ideal for establishing a baseline.

“Records obtained from financial institutions are perhaps the single most important financial source available to a fraud examiner for tracing purposes. They can be used as evidence for fraud, uncover criminal profits, identify criminal assets, and locate assets”.

The2014 Fraud Examiners ManualandCFE Preplist common concealment methods:

“Some common techniques for hiding assets include transferring assets into foreign trusts, overpaying taxes, prepaying on a home mortgage, obtaining a life insurance policy, and transferring assets into someone else’s name.”

Thus, the correct answer isD.

The2014 International Fraud Examiners ManualandCFE Prep - Investigationsexplicitly state:

“Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. … when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.”

Thus, the correct answer isC.

TheCFE Prep – Investigationsstates:

“If a fraud examiner gets a verbal confession from the fraudster, it does not matter whether the fraudster claims his conduct was an accident. The following items of information should be obtained … admission that the accused knew the conduct was wrong, facts known only to the confessor, the accused’s motive, approximate dates, involvement of others, physical evidence, and disposition of illicit income.”

Thus, the examiner doesnotneed a statement about accident.

“Signs of stress do not always mean that a subject is lying… While lying and deception do cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

The Prep guide confirms: “While lying and deception do indeed cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

Therefore, Carlos shouldnot automatically conclude deception from stress behaviors.

The recommended questioning order is:

“As a general rule, questioning should proceed from thegeneral to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

TheFraud Examiners Manualspecifies:

“Fraud examinations should proceed from the general to the specific. That is, they should begin with general information that is known and then move to more specific details.”

Therefore, statementB is false, making it the correct answer.

TheFraud Examiners Manualexplains that before obtaining or cleansing data, the first step in using data analysis is theplanning phase. This includesunderstanding the data, articulating objectives, and building a profile of potential frauds. Without this, examiners risk inefficient analysis and overlooking key fraud risks.

✅Answer: C. Build a profile of potential frauds

TheInternet archives(e.g., the Wayback Machine at archive.org) allow fraud examiners to retrieve prior versions of web pages, including deleted content such as company statements.

✅Answer: C. The internet archives

Explanation: After alibis are diffused, suspects may become quiet, withdrawn, or even cry. This often indicates they are considering confession. At this point, the interviewer should present analternative question, forcing a choice between two answers that both imply guilt, thus leading toward a benchmark admission.

“Documentary evidence, including digital evidence, will not be admitted… unless it is established as authentic… fraud examiners mustcapture, download, and preserve any useful information as soon as they discover it, and memorialize each step of the collection process”.

Referring to the informant in the memorandum using the informant's initials

Explanation: Best practice requires that informants be identifiedonly by symbols (e.g., I-1, I-2), not by initials, to protect their identity. Cash payments are acceptable but must be accompanied by areceipt.

The calibration (or norming) process in interviews is meant to establish a baseline of the subject’s normal verbal and nonverbal behavior. This is done by askingnoncritical background questionsso that later deviations can be more reliably identified.

From the CFE Prep guide:

“The proper way an interviewer should start the calibration (norming) of a witness is through the use of:Noncritical questions on background information.… Examples of noncritical questions include ‘When did you start with the company?’ and ‘How long is your commute?’”.

Thus, the correct answer isD. “How many jobs have you had before this one?”since it is a nonthreatening background question.

TheCFE Prep Guideclarifies:

“A fraud response plan outlines the actions… when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success”.

Thus, statement D is false.

When a respondent says “I’m too busy,” it can be diffused by stressing “the interview will be short, the interviewer is already there, the project is important, [and] the interview will not be difficult”.

Thus, stressing brevity is the recommended reaction.

The Fraud Examiners Manual explains:

“Each transaction on a blockchain ledger is recorded with a cryptographic address… by analyzing these addresses, fraud examiners can sometimes establish patterns and connections that identify users or link them to criminal activity”.

Both the Manual and CFE Prep guides emphasize thatdeleted files are recoverable until overwritten. Once overwritten, the original data cannot be retrieved:

“Deleted files are recoverable until they are overwritten because data is not erased… until overwritten. So, deleted files that have been overwritten generally arenot recoverable.”

Other file types (deleted shortcuts, hidden files, etc.) can often be recovered, butoverwritten files are lost permanently.

TheFraud Examiners Manualnotes that EU privacy laws (e.g., EU Data Protection Directive, precursor to GDPR) restrict or prohibit the transfer of personal data to non-EU countries without compliance:

“Many foreign countries—and those in the European Union (EU) in particular—restrict or prohibit processing and transferring personal data… The EU’s directive… places limits on transmitting personal data to non-EU countries”.

Thus, since the fraud examiner is handling data about an EU-based employee, GDPR compliance is required, even if the examiner is outside the EU.

The manual notes:

“Records subpoenaed in a criminal case usually are available only to the government during the investigation, and perhaps thereafter if not disclosed at trial”.

Thus, statement D is false.

Body language alone (e.g., avoiding eye contact) cannot be taken as proof of deception. The Manual warns against drawing conclusions from a single behavioral cue:

“Avoiding eye contact isnot directly linked to deception. Such behavior could stem from cultural norms, nervousness, or personality traits. Examiners should consider clusters of behavior, context, and corroborating evidence before concluding deception”.

Therefore,Cis correct.

The2014 International Fraud Examiners Manualprovides:

“Fraud examiners can use a correlation analysis to determine the relationships between different variables in raw data… For example, there should be a strong correlation between the independent and dependent variables because there is a direct relationship between them.Hotel costs should increase as the number of days travelled increases.”

CFE Prep – Investigationsechoes this:

“Using the correlation analysis function, fraud examiners can determine the relationships between different variables in the raw data. For example…Hotel costs should increase as the number of days travelled increases.”

Thus, the most useful analysis isCorrelation analysis.

TheFraud Examiners Manualnotes:

“Management of an organisation should ensure that the organisation has a proper and effective document retention policy in place… An effective policy requires clear retention protocols… and should be immobilised due to a pending investigation or foreseeable litigation.”

Thus, the existence of a document retention policy is a critical factor in deciding how to dispose of evidence.

TheFraud Examiners Manuallistsspecific queries for accounts payable analysis, including:

“Review recurring monthly expenses and compare to posted/paid invoices.”.

While comparing book vs. tax depreciation applies toasset management(not A/P), and identifying paycheck anomalies applies topayroll(not A/P), the most effective A/P-specific test is the recurring expense comparison. Hence,Cis correct.