ACFE CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Exam Practice Test

The Fraud Examiners Manual notes:

“Management of an organisation should ensure that the organisation has a proper and effective document retention policy in place… An effective policy requires clear retention protocols… and should be immobilised due to a pending investigation or foreseeable litigation.”

Thus, the existence of a document retention policy is a critical factor in deciding how to dispose of evidence.

The Fraud Examiners Manual stresses that interview notes should be kept separately for each interview, even if the session is electronically recorded, because recordings can fail or be challenged. Verbatim transcripts are not expected, and impressions of guilt should never be included. Best practice is to keep clear, accurate, separate records for every interview .

In admission-seeking interviews, one rationalization technique is to depersonalize the victim (e.g., shifting the perception so the harm was against a company, not individuals). The example in the question—“It isn’t like you took something from a friend or neighbor”—is exactly this technique.

Admission-seeking interviews are designed:

“to obtain a legal admission of wrongdoing… also to distinguish innocent individuals from culpable ones and to secure a signed written statement”.

The primary purpose is obtaining a valid confession.

Textual analytics is used to extract investigative insight from unstructured data—communications and documents that are not stored in standard database fields—such as emails, chats, memos, and other narrative text. CFE investigative guidance explains that textual analysis applies linguistic methods and statistical techniques to identify themes, anomalies, and linkages within large volumes of text. Its purpose is not to determine truthfulness or deception with certainty (Option A), because text analytics cannot reliably “detect lies” in a definitive way. Nor is its primary objective to guarantee discovery of a confession (Option B); admissions can appear, but that is not the defining function of the approach. Option C aligns more with flow-of-funds visualization or link/relationship charting for financial movements rather than analyzing language content. Instead, textual analysis is performed to categorize and structure text so patterns, sentiments, recurring topics, and relationships between people and events become visible—helping examiners prioritize leads, identify risk indicators, and focus investigative testing on communications most indicative of potential fraud.

“Alibis generally can be diffused by displaying physical evidence… evidence should be displayed one piece at a time, in reverse order of importance”【16:2014 International Fraud Examiners Manual.pdf†L11-L14】.

The Prep Guide warns: “The proper technique is not to lay it all out at once” .

Thus, showing everything at once is the least effective.

For publicly traded companies, the best source for information on officers and directors is regulatory securities records. These records typically include “identification of officers and directors, financial statements, significant owners, and accountants and attorneys”.

“Once a suspect utters a denial, it becomes extremely difficult… therefore, the interviewer must prevent an outright denial. Fraud examiners can use several techniques to stop or interrupt denials, including delays, repeated interruptions, and reasoning”.

Thus, the correct answer is D.

The Fraud Examiners Manual explains:

“A Certified Fraud Examiner should not promise confidentiality or leniency to an informant to obtain testimony… the confidentiality relationship runs first to the client or employer”.

Thus, Lisa cannot guarantee full confidentiality but may state she will do her best.

Fraud examiners can obtain documentary evidence by consent, subpoena, or other legal means. While oral consent may sometimes be sufficient, bank records from financial institutions generally require written consent. Without written consent, the bank is not required to provide access. As stated in the manual:

“Accessing a subject’s bank records from financial institutions, for instance, generally requires written consent. If no consent is given… legal action might be required, most often a subpoena or other court order”.

Thus, although the suspect gave oral consent, Alex cannot access the bank records without written authorization or legal order.

Best practice is to conduct interviews individually. The Manual states:

“When conducting interviews, witnesses should be interviewed separately. Interviewing multiple witnesses together risks contamination of testimony and reduced reliability of responses”.

Signs of stress (e.g., shallow breathing, stuttering, shifting posture) do not automatically equal deception. The Fraud Examiners Manual states:

“Signs of stress do not always mean a subject is lying. An honest subject might feel stress simply by being questioned. Conclusions must be based on clusters of behavior and corroborating evidence, not a single indicator”.

CFE admission-seeking guidance explains that once a suspect begins providing detailed information about the offense, the interviewer should transition to obtaining a verbal confession and then “probe gently” for additional details—preferably details only the subject would know. As part of confirming the general details of the offense during the verbal confession, the interviewer should obtain key baseline facts such as estimates of amounts involved, identification of other parties involved, and the location of physical evidence. Among the choices, a general estimate of the amount of money involved (A) is explicitly aligned with what the CFE guidance expects the interviewer to gather during the verbal admission stage because it helps establish scope and supports later corroboration and restitution analysis. Option B is less fitting because the emphasis is on what the suspect can reliably provide (their own actions and knowledge), not “facts known to others.” Option C attempts to build a defense narrative rather than obtain factual admission details. Option D may be useful for remediation later, but it is not a primary objective during the verbal confession stage.

Best practices when working with confidential informants include documenting payments and identities in ways that protect anonymity but avoid risks. The Fraud Examiners Manual and CFE Prep emphasize avoiding cash payments because they reduce transparency and create audit trail problems. Paying in cash is therefore NOT considered a best practice, whereas using initials, obtaining receipts, and documenting informant information in reports can be acceptable methods.

“When searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

Therefore, saying a past address is “of no help” is incorrect.

The Fraud Examiners Manual makes clear:

“Fraud examiners should never offer opinions regarding guilt or innocence. Reports must be factual, objective, and free from speculation. Statements implying guilt are improper.”

Thus, while it is proper to note contradictions, evidence, or control weaknesses, it is improper to declare the suspect guilty.

CFE investigative guidance recognizes online databases as valuable tools for locating public records quickly, but it also highlights practical limitations. The most significant limitation is that availability and coverage differ widely by jurisdiction. Some jurisdictions provide extensive online access to court files, property records, corporate registrations, and liens, while others provide limited access, partial indexing, or require in-person requests. This variability affects completeness and can create false negatives (records exist but are not available electronically). The guidance also cautions that online results may be abstracts, may not include supporting documentation, and can lag behind official updates—so investigators should verify key records with the originating agency when accuracy and completeness matter. Option A is not the primary limitation described; the more common problem is incomplete access rather than excessive detail. Option C is too absolute; errors can occur, but CFE methodology emphasizes validation, not the claim that records are “rarely correct.” Option D is also overstated; while source credibility matters, the fundamental limitation is uneven jurisdictional availability and completeness.

The Fraud Examiners Manual states that admission-seeking interviews should avoid yes/no questions like “Did you steal the money?” because they encourage denials. Instead, the question should be phrased as if guilt has already been established. The Manual explicitly warns:

“The accusation should be made in the form of a statement; it should not be made in the form of a question… Avoid emotive words such as steal, fraud, and crime… Example: ‘It is not so much a question of what you did, but why you did it.’”

Thus, the most effective admission-seeking phrasing is: “Why did you take the money?” because it presumes involvement and encourages explanation rather than denial.

Explanation with Extracts = The Fraud Examiners Manual explains:

“Conducting digital forensic investigations in the cloud environment (i.e., cloud forensics) presents challenges not faced in traditional forensic practices… Some of the important challenges… Lack of frameworks and specialist tools, Lack of information accessibility, Lack of data control, Jurisdiction of storage…” .

Specifically: “With cloud computing, clients of cloud service providers do not have physical control of the media or the network on which their data resides, and this lack of data control can complicate efforts to collect data stored on the cloud” .

Thus, lack of data control is a unique challenge.

The 2014 International Fraud Examiners Manual provides:

“Fraud examiners can use a correlation analysis to determine the relationships between different variables in raw data… For example, there should be a strong correlation between the independent and dependent variables because there is a direct relationship between them. Hotel costs should increase as the number of days travelled increases.”

CFE Prep – Investigations echoes this:

“Using the correlation analysis function, fraud examiners can determine the relationships between different variables in the raw data. For example… Hotel costs should increase as the number of days travelled increases.”

Thus, the most useful analysis is Correlation analysis.

The manual notes:

“Records subpoenaed in a criminal case usually are available only to the government during the investigation, and perhaps thereafter if not disclosed at trial”.

Thus, statement D is false.

According to the 2014 International Fraud Examiners Manual:

“The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional. The fraud examination process encompasses a variety of tasks that might include:

• Obtaining evidence

• Reporting

• Testifying

• Assisting in fraud detection and prevention”.

Similarly, in the CFE Prep - Investigations study guide:

“Fraud examination is best described as… a methodology for resolving fraud allegations from inception to disposition. The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional”.

This clearly verifies that fraud examination is the correct term for the process of resolving fraud allegations from beginning (inception) to end (disposition).

Therefore, the correct answer is D. Fraud examination.

CFE guidance on tracing illicit transactions explains that financial institution records—especially account statements—are among the most important sources for tracing because they can reveal transfers, counterparties, and leads to additional evidence. In the cryptocurrency context, the Manual specifically notes that when reviewing account statements, fraud examiners should look for transactions involving cryptocurrency exchanges and for payments to or deposits from such exchanges. Those banking “on-ramps/off-ramps” can connect a real-world identity (account holder) to crypto activity and help establish ownership or control indicators (e.g., exchange deposits/withdrawals, recurring transfers, related payment records). Option B is incorrect because public blockchains show transactions and addresses, but they generally do not contain direct personal identifiers. Option C is too broad and not supported as a “most accurate” statement across jurisdictions; requirements vary and many exchanges apply identification controls. Option D is incorrect because the Manual states that most cryptocurrencies rely on public blockchains that make transactions visible, not private blockchains. Therefore, A is the most accurate statement: ownership clues can sometimes be derived from bank statements that show exchange-related activity and related financial footprints.

The Fraud Examiners Manual notes:

“Fraud examiners are often tasked with tracing illicit transactions… For example, a victim of fraud might want a tracing search to facilitate the recovery of criminal proceeds”.

To confirm ownership of a building, real estate and permit records are most useful. The Manual notes that real property records and related permits identify the owner, provide legal descriptions, and show improvements such as construction of commercial buildings. Court or voter registration records would not typically establish property ownership.

The Fraud Examiners Manual explains that rather than drafting an exhaustive list of questions, the interviewer should:

“formulate a brief outline of key points to discuss during the interview”.

This helps organize thoughts while allowing flexibility.

Both the Manual and CFE Prep guides emphasize that deleted files are recoverable until overwritten. Once overwritten, the original data cannot be retrieved:

“Deleted files are recoverable until they are overwritten because data is not erased… until overwritten. So, deleted files that have been overwritten generally are not recoverable.”

Other file types (deleted shortcuts, hidden files, etc.) can often be recovered, but overwritten files are lost permanently.

The Fraud Examiners Manual notes:

“Companies are formed by submitting some type of organisational filing… these company records are generally public records and will include: corporate name, ownership information, location of the principal office, date of incorporation”.

The Prep guide also confirms: “A company’s organisational filing with the government generally includes information about the company’s ownership, initial shareholders, and the location of its principal office”.

“Even when a victim refers a fraud case for criminal prosecution, the government will usually not disclose the contents of nonpublic records with the victim during the investigation”.

Thus, option D is most accurate.

CFE methodology stresses that fraud examinations should be conducted with the assumption that the matter could end in litigation, which directly affects evidence-handling decisions. If litigation is reasonably anticipated, organizations often must preserve potentially relevant records through measures such as litigation holds and suspension of normal record-retention/destruction practices. Disposing of evidence while litigation is likely (or while a duty to preserve could exist) can create serious consequences, including sanctions, adverse inferences, monetary penalties, and other legal repercussions for spoliation or failure to preserve evidence. Because the central risk is future legal proceedings—civil, criminal, regulatory, or employment-related—the most important consideration when deciding whether evidence can be disposed of is whether additional litigation is likely or could reasonably arise. The physical form of evidence (A) affects preservation techniques, but it is not the key decision driver for disposal. Reporting summaries (C) do not replace original evidence. Whether evidence is direct or circumstantial (D) is not the deciding factor; both can be critical depending on the case. Thus, likelihood of future litigation is the most important factor.

CFE Prep clarifies entrapment:

“Entrapment occurs when law enforcement induces a person to commit a crime that he is not predisposed to commit… It is imperative that adequate predication exists before the operation is commenced. For example, if the officer received a reliable tip, that could serve as adequate predication.”

Here, the officer acted on a reliable tip, so the entrapment claim would fail.

Social media content is dynamic—posts can be edited, deleted, or moved—so fraud examiners must preserve relevant information promptly and in a manner that supports authenticity and admissibility. CFE investigative guidance emphasizes that documentary (including digital) evidence carries limited value in legal proceedings unless it can be shown to be authentic and in substantially the same condition as when collected. Simply saving a link (Option A) is weak because the underlying content can change, and a link does not preserve what was actually observed. Requesting a copy from the platform (Option B) is often impractical as a routine step and may require legal process; it also does not replace contemporaneous preservation by the examiner. A “forensic shutdown” (Option C) is not an appropriate method for preserving web-based social media content because the key evidence exists on external servers, not solely on the examiner’s machine. Proper practice is to download/capture and preserve what was observed while documenting the collection steps and maintaining a defensible chain of custody so authenticity can be established if needed in court.

The 2014 International Fraud Examiners Manual defines:

“Fraud examination is a methodology of resolving signs or allegations of fraud from inception to disposition. The fraud examination methodology establishes a uniform, legal process for resolving signs or allegations of fraud on a timely basis.”

Similarly, CFE Prep – Investigations confirms:

“The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional.”

Thus, the correct answer is D.

Digital forensics guidance stresses:

If the computer is off, do not turn it on, because booting will alter files and timestamps.

If the computer is on and volatile data is needed (e.g., RAM), a formally trained examiner may collect it live. Otherwise, simply unplugging the system (hard shutdown) preserves volatile evidence better than a graceful shutdown.

Thus, if the evidence exists only in volatile data and the system is running, Nobles may collect it via the normal interface.

✅ Answer: A. If Lucas's computer is running, Nobles may retrieve data… if the evidence exists only in volatile data

The Fraud Examiners Manual states:

“The primary concern when analysing digital evidence is to maintain the integrity of the data at all times. Fraud examiners must be careful with computer equipment because a careless investigator might inadvertently alter important evidence”.

Examiners must look for both inculpatory and exculpatory evidence.

The Fraud Examiners Manual lists required steps before seizing evidence:

Obtain legal authority.

Review privacy issues.

Ensure software/hardware are validated.

Document surroundings, inspect for traps, image drives, etc.

There is no requirement to assemble a team exclusively of outside experts.

Before seizing evidence in a digital forensic investigation, the 2014 International Fraud Examiners Manual outlines several critical steps:

Obtain legal authority / review orders:

“Before obtaining evidence, ensure that there is legal authority to seize evidence and review the data associated with the evidence. This might require obtaining a warrant in a criminal matter or ensuring that internal policies authorise seizure for an internal investigation.”

Determine privacy issues:

“Before the fraud examiner can seize evidence, he must take certain steps to help ensure that the evidence will be admissible: He must determine whether there are any privacy interests in the item(s) to be searched… In every case where it becomes necessary to seize a computer or other device capable of storing digital evidence, the investigator should consult with legal counsel.”

Use only trained professionals/software:

“It is important to allow a trained examiner to conduct a proper seizure and examination of digital evidence to help ensure that the information can be used in a legal proceeding.”

✅ These are all valid required steps.

In contrast, the idea that the team must be composed only of outside digital forensic experts is NOT a required step. The Manual stresses flexibility in team composition:

“Some organisations have their own in-house personnel… while others might prefer the use of an outside examiner. Sometimes retrieving digital data is as easy as searching the target computer’s hard drive, but other times retrieval requires a thorough knowledge of computers.”

Thus, requiring only outside experts is not a standard step, since investigations may use internal, external, or a mix of specialists depending on the situation.

The CFE Prep Guide clarifies:

“A fraud response plan outlines the actions… when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success”.

Thus, statement D is false.

The Fraud Examiners Manual lists specific queries for accounts payable analysis, including:

“Review recurring monthly expenses and compare to posted/paid invoices.”.

While comparing book vs. tax depreciation applies to asset management (not A/P), and identifying paycheck anomalies applies to payroll (not A/P), the most effective A/P-specific test is the recurring expense comparison. Hence, C is correct.

A memorandum recording a whistleblower tip is a written record. The Fraud Examiners Manual defines documentary evidence as evidence “presented in the form of documents such as memoranda, contracts, emails, or other records”. Testimonial evidence comes from oral statements; here, the memorandum itself is the evidence, so it is documentary.

“Internal sources will sometimes be the only resource for certain types of documents—such as… employee personnel files—unless the fraud examiner has the subject’s consent or a legal order”.

External searches may reveal addresses, assets, or competitor ownership, but personnel files require internal/non-public access.

The Fraud Examiners Manual clarifies:

“The recommendations section is optional, and there might be instances where the fraud examiner wishes to discuss remedial measures or specific recommendations in a separate document”.

The Prep guide also states: “A written report might include a section for recommendations”.Thus, it is not required in every report.

Explanation with Extracts = The 2014 Fraud Examiners Manual states:

“The EU Data Protection Directive … regulates the processing, using, and transferring of personal data within the European Union, and it places limits on transmitting personal data to non-EU countries”.

Therefore, a U.S.-based examiner handling HR data of an EU employee must comply with EU GDPR requirements.

The Fraud Examiners Manual states:

“If a business or individual constructs a new building or makes improvements to an existing building, there should be a building permit on file with the local building authority. In many cases, the person applying for permits will be the owner or someone traceable to the owner.”

CFE Prep supports this:

“Building permit records… are often required before most businesses can open… and often list the owner or someone traceable to the owner.”

Thus, building permit records are most likely to help identify the restaurant’s owner.

The digital forensics section of the Fraud Examiners Manual stresses:

No single forensic tool can recover everything.

Each has strengths and weaknesses.

Therefore, it is best to use a combination of tools during analysis.

Additionally, the examiner must look for both inculpatory and exculpatory evidence, while maintaining data integrity.

This aligns exactly with answer B.

Complex questions:

“consist of a series of interrelated questions… too complicated to be easily understood, cover more than one subject, or require more than one answer”.

The question asked by Delta (“Were you aware that the signature was forged, and why didn’t you tell anyone earlier?”) covers two issues, making it complex.

“Signs of stress do not always mean that a subject is lying… While lying and deception do cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

The Prep guide confirms: “While lying and deception do indeed cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

Therefore, Carlos should not automatically conclude deception from stress behaviors.

The Fraud Examiners Manual advises:

“Do not slow down the interview process for note-taking. Instead, jot down key words … In general, it is better to err on the side of taking too few notes rather than too many.”

Therefore, the best practice is C.

The Fraud Examiners Manual clearly states:

“Accessing information set to private could result in claims under privacy laws. Thus, information on social media sites that is restricted by privacy settings could result in liability for fraud examiners due to violation of users’ privacy rights.”

Therefore, D is correct

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

The Fraud Examiners Manual stresses confidentiality:

“To preserve confidentiality, investigators should avoid transmitting confidential information by email or other electronic means whenever possible, as these are susceptible to interception or unauthorized access.”

Suspending employees or blanket bans on discussion are not best practices. Confidentiality is preserved primarily by secure communication and controlled access to information.

The Fraud Examiners Manual stresses that fraud examiners must never promise unconditional confidentiality, because findings often must be disclosed to management, auditors, or authorities. They can only offer “qualified confidentiality” (best efforts to protect identity, but with necessary limits). Therefore, option A is the most appropriate response.

The manual defines:

“Open questions are those worded in a way that makes it difficult for the respondent to answer ‘yes’ or ‘no.’ The typical open question calls for a monologue response and can be answered in several different ways.”

Example given: “Please tell me about your job.”

Allison’s question (“Why did you choose to do business with that vendor?”) invites explanation, not a yes/no response — making it an open question.