ACFE Study Guide 2026

The primary role of a fraud examiner is to proactively detect, investigate, and resolve instances of fraudulent activity. This involves gathering evidence, interviewing witnesses, analyzing financial data, and preparing comprehensive reports to document findings, ultimately aiming to prevent future fraud and support legal actions.

A bit-stream image (or forensic image) is an exact, bit-for-bit copy of an entire storage device, including deleted files, file fragments in slack space, and unallocated clusters. [5, 13, 23] This is the only method that preserves all potential evidence. A logical copy or standard backup only captures active, non-deleted files and would miss crucial artifacts necessary for the investigation. [5, 18]

A material weakness is a significant deficiency in internal control where there is a reasonable possibility that a material misstatement of the financial statements would not be prevented or detected on a timely basis.

Data analytics helps detect fraud schemes by processing and analyzing large volumes of financial data to identify irregularities, anomalies, and unusual patterns. These deviations from expected behavior can serve as red flags, indicating potential fraudulent activities that might otherwise go unnoticed through traditional auditing methods. By highlighting suspicious transactions or trends, data analytics enables targeted investigations and proactive fraud prevention.

Bid splitting involves breaking a large purchase into smaller transactions to circumvent policies requiring competitive bidding above certain dollar thresholds.

A deposition is a formal, out-of-court sworn testimony of a witness or party involved in a lawsuit, taken under oath before a court reporter. It allows attorneys to gather information, assess witness credibility, and preserve testimony for potential use at trial, helping to prepare for litigation and discover facts.