CFE Exam — Questions and Answers

Question 1: A 'qui tam' lawsuit under the False Claims Act allows:

Corporations to sue competitor companies
Foreign nationals to pursue U.S. fraud claims
Private citizens (relators) to sue on behalf of the government and share in any recovery (Correct answer)
Only the Attorney General to sue

Correct answer: Private citizens (relators) to sue on behalf of the government and share in any recovery

Qui tam provisions let private whistleblowers (relators) file suit on the government's behalf and receive 15–30% of recovered funds.

Question 2: What is a fraud risk assessment?

An analysis of fraud vulnerabilities (Correct answer)
An employee survey on job satisfaction.
A physical fitness evaluation.
A legal court report.

Correct answer: An analysis of fraud vulnerabilities

A fraud risk assessment is a systematic process of identifying and evaluating an organization's susceptibility to fraud. It involves analyzing potential fraud schemes, identifying weaknesses in internal controls, and assessing the likelihood and impact of various fraud risks, allowing organizations to implement targeted prevention and detection measures.

Question 3: A company's code of ethics is MOST effective when it:

Is supported by tone at the top and enforced consistently (Correct answer)
Is distributed only to senior management
Is posted on the company website without formal training
Focuses exclusively on financial reporting obligations

Correct answer: Is supported by tone at the top and enforced consistently

A code of ethics is most effective when leadership demonstrates commitment to it and violations are consistently addressed regardless of the offender's position.

Question 4: Which of the following is an example of a 'leading question' that should generally be avoided with witnesses?

What, if anything, did you observe on that day?
Can you describe what happened on the day in question?
How would you describe your working relationship with the accused?
Did you see the defendant sign the check? (Correct answer)

Correct answer: Did you see the defendant sign the check?

Leading questions like 'Did you see...' suggest the expected answer and can taint witness testimony.

Question 5: Which standard framework governs the admissibility of scientific or technical expert testimony in US federal courts, relevant to digital forensics experts?

Kumho standard exclusively
Frye standard
Daubert standard (Correct answer)
Federal Rules of Evidence Rule 404(b)

Correct answer: Daubert standard

The Daubert standard (from Daubert v. Merrell Dow Pharmaceuticals) requires judges to evaluate whether expert methodology is scientifically valid and reliably applied.

Question 6: Which document is most useful for detecting fictitious vendor disbursements in a financial statement fraud scheme?

Petty cash log
Vendor master file (Correct answer)
Bank reconciliation
Fixed asset register

Correct answer: Vendor master file

The vendor master file reveals whether payees are legitimate, registered businesses with proper addresses, tax IDs, and contact information.

Question 7: A company's board has three members: the CEO, the CEO's spouse, and a retired executive who receives consulting income from the firm. Which statement is MOST accurate?

None of the board members qualify as independent directors (Correct answer)
The board structure complies with typical governance best practices
The board has adequate independence because it has three members
Only the retired executive is not independent

Correct answer: None of the board members qualify as independent directors

The CEO lacks independence by definition, the CEO's spouse has a family relationship, and the consulting income gives the retired executive a material relationship — none are independent.

Question 8: A company discloses a contingent liability only in footnotes without accruing it, despite evidence the loss is probable and estimable. This violates:

ASC 842 lease accounting rules
ASC 450 contingency standards (Correct answer)
ASC 606 revenue recognition guidance
ASC 350 goodwill impairment rules

Correct answer: ASC 450 contingency standards

ASC 450 (formerly SFAS 5) requires accrual of a loss contingency when it is probable that a liability has been incurred and the amount is reasonably estimable.

Question 9: Under the Sarbanes-Oxley Act, which officer must certify the accuracy of a public company's financial statements?

External auditor and Audit Committee Chair
CEO and CFO (Correct answer)
Controller and Treasurer
Chief Compliance Officer and General Counsel

Correct answer: CEO and CFO

SOX Section 302 requires the CEO and CFO to personally certify that financial statements fairly present the company's condition.

Question 10: Which element distinguishes a 'predication' from mere suspicion in launching a fraud investigation?

A court order authorizing the investigation
A credible indication that fraud may have occurred (Correct answer)
A signed confession from the suspect
Approval from law enforcement

Correct answer: A credible indication that fraud may have occurred

Predication is the totality of circumstances that would lead a reasonable professional to believe fraud has occurred, is occurring, or will occur—it does not require proof.

Question 11: Which of the following best describes the concept of 'tone at the top' in corporate governance?

The volume of ethics training sessions conducted annually
The strictness of disciplinary policies for lower-level employees
The ethical environment established by senior leadership through their actions (Correct answer)
The number of policies included in the employee handbook

Correct answer: The ethical environment established by senior leadership through their actions

Tone at the top refers to the ethical culture and values that senior leadership models through their own conduct and decisions.

Question 12: How can metadata embedded in a Microsoft Word document assist a fraud examiner?

It can expose the author's name, revision history, and creation date (Correct answer)
It contains a digital signature verifiable by ACFE
It shows which printer was used to produce the document
It reveals the document's encryption key

Correct answer: It can expose the author's name, revision history, and creation date

Word document metadata (stored in document properties) often includes the original author, last editor, total editing time, and revision dates that can contradict a suspect's claims.

Question 13: What is 'anti-forensics' and why is it relevant to fraud examiners?

Software that automates evidence collection
Methods used to destroy, hide, or alter digital evidence to impede investigations (Correct answer)
Chain-of-custody documentation procedures
Techniques used to authenticate digital evidence in court

Correct answer: Methods used to destroy, hide, or alter digital evidence to impede investigations

Anti-forensics encompasses techniques like data wiping, timestamp manipulation, and encryption that suspects use to obstruct forensic examination.

Question 14: Which of the following best describes the concept of 'inherent risk' in a fraud risk assessment?

The risk that auditors fail to detect fraud
The risk of fraud after controls are applied
The risk arising from ineffective internal audits
The risk of fraud that exists before considering any controls (Correct answer)

Correct answer: The risk of fraud that exists before considering any controls

Inherent risk is the exposure to fraud that exists in the absence of any mitigating controls.

Question 15: What is the significance of the 'Garrity warning' in a fraud investigation involving a public employee?

It compels the employee to submit to a polygraph examination
It requires the employee to waive attorney-client privilege
It grants immunity from civil liability
It informs the employee that statements made under compulsion cannot be used in criminal proceedings (Correct answer)

Correct answer: It informs the employee that statements made under compulsion cannot be used in criminal proceedings

A Garrity warning advises public employees that compelled statements made under threat of job loss cannot be used against them in criminal proceedings.

Question 16: In a fraud investigation, what is the purpose of an 'exit interview' or 'admission-seeking interview' at the conclusion of an investigation?

To formally terminate the suspect's employment
To deliver the final investigative report to management
To present evidence to the suspect and obtain an admission or explanation (Correct answer)
To notify law enforcement of findings

Correct answer: To present evidence to the suspect and obtain an admission or explanation

An admission-seeking interview presents evidence to the suspect in a structured way to elicit a confession, explanation, or denial that can be evaluated.

Question 17: Which component of the COSO Internal Control Framework addresses the tone set by leadership regarding ethics and control?

Monitoring Activities
Risk Assessment
Control Environment (Correct answer)
Control Activities

Correct answer: Control Environment

The Control Environment is the foundation of the COSO framework and encompasses the ethical values, governance structure, and management philosophy that set the tone for internal control.

Question 18: In procurement fraud, what does 'specification manipulation' involve?

Altering invoice specifications after delivery
Manipulating contract terms after award
Writing bid specifications tailored to a favored vendor's capabilities (Correct answer)
Changing product specifications to reduce quality

Correct answer: Writing bid specifications tailored to a favored vendor's capabilities

Specification manipulation involves crafting bid requirements so narrowly or specifically that only a favored vendor can qualify, rigging the selection process.

Question 19: Which data analysis technique is MOST effective for detecting fictitious vendors in a purchasing scheme?

Duplicate payment analysis
Vendor master file review (Correct answer)
Ratio analysis
Horizontal analysis

Correct answer: Vendor master file review

Reviewing the vendor master file for incomplete addresses, missing tax IDs, employee addresses, or sequential invoice numbers can reveal fictitious vendors.

Question 20: Which COSO framework component involves identifying and analyzing risks that could prevent an organization from achieving its objectives?

Risk Assessment (Correct answer)
Information and Communication
Monitoring Activities
Control Activities

Correct answer: Risk Assessment

The Risk Assessment component requires management to identify internal and external risks and analyze their likelihood and impact on achieving organizational objectives.

Question 21: When interviewing multiple witnesses to the same fraud, the examiner should generally:

Allow witnesses to review documentary evidence before the interview
Conduct all interviews simultaneously in a group setting
Share the statements of prior witnesses to refresh each interviewee's memory
Interview witnesses separately to prevent contamination of accounts (Correct answer)

Correct answer: Interview witnesses separately to prevent contamination of accounts

Separate interviews prevent witnesses from aligning stories, contaminating independent recollections, or being influenced by dominant personalities.

Question 22: In the context of fraud risk assessment, 'tone at the top' is evaluated primarily because it affects which fraud triangle element?

Opportunity
All three elements (Correct answer)
Rationalization
Pressure

Correct answer: All three elements

A poor tone at the top can create pressure through unrealistic expectations, opportunities through weak oversight, and rationalization through modeling unethical behavior.

Question 23: In a Ponzi scheme, returns paid to earlier investors are funded by:

Capital contributions from new investors (Correct answer)
Interest earned on pooled deposits
Revenue from ancillary business operations
Legitimate investment profits

Correct answer: Capital contributions from new investors

Ponzi schemes use money from new investors to pay returns to earlier investors, creating the illusion of a profitable investment when no real returns are generated.

Question 24: What is the primary purpose of criminal law?

To ensure corporate profits.
To punish and deter criminal behavior (Correct answer)
To enforce ethical behavior in companies.
To regulate business practices.

Correct answer: To punish and deter criminal behavior

The primary purpose of criminal law is to protect society by defining and punishing offenses against the public order. It aims to hold individuals accountable for their unlawful actions, deter both the offender and others from committing similar crimes, and ensure public safety and justice through penalties like fines or imprisonment.

Question 25: What is the forensic significance of the Windows 'LNK' (shortcut) files?

They contain browser session cookies for linked websites
They log all failed login attempts on the system
They store encrypted copies of recently accessed documents
They can reveal the original path, creation date, and MAC address of files accessed even from removed devices (Correct answer)

Correct answer: They can reveal the original path, creation date, and MAC address of files accessed even from removed devices

Windows LNK files record metadata about the target file including timestamps, volume serial number, and network share details, revealing access to files on now-absent drives.

Question 26: Under the Federal Rules of Evidence, electronically stored information (ESI) is generally treated as which type of evidence?

Documentary evidence subject to authentication and best evidence requirements (Correct answer)
Circumstantial evidence inadmissible in civil proceedings
Hearsay that is inadmissible without exception
A business record automatically admissible without authentication

Correct answer: Documentary evidence subject to authentication and best evidence requirements

ESI is treated as documentary evidence under FRE 901 (authentication) and FRE 1001-1008 (best evidence rule), requiring the proponent to show it is what it purports to be.

Question 27: Which behavior is a potential verbal indicator of deception according to fraud examination principles?

Giving direct, concise answers to all questions
Providing excessive unsolicited detail and qualifications (Correct answer)
Asking clarifying questions before answering
Maintaining consistent eye contact throughout

Correct answer: Providing excessive unsolicited detail and qualifications

Deceptive individuals may over-explain, add unnecessary qualifications, or provide excessive detail to appear credible.

Question 28: What is 'complementary bidding' in a bid rigging conspiracy?

Offering price matching as a competitive strategy
Submitting bids that complement each other's scope
Bidding on complementary product categories
Submitting intentionally losing bids to make a predetermined winner appear competitive (Correct answer)

Correct answer: Submitting intentionally losing bids to make a predetermined winner appear competitive

Complementary bidding involves conspirators submitting deliberately high or otherwise unacceptable bids so that the designated winner appears to win a legitimate competition.

Question 29: Segregation of duties is most effective at preventing fraud when it separates which three functions?

Purchasing, receiving, and shipping
Payroll, HR, and benefits
Authorization, custody, and recordkeeping (Correct answer)
Budgeting, forecasting, and variance analysis

Correct answer: Authorization, custody, and recordkeeping

Effective segregation of duties requires that no single individual can authorize a transaction, maintain physical custody of the related asset, and record the transaction.

Question 30: What type of data exists in a storage device's unallocated space?

Fragments of previously deleted files that have not been overwritten (Correct answer)
Real-time process memory snapshots
Only the operating system files
Current user session cookies

Correct answer: Fragments of previously deleted files that have not been overwritten

Unallocated space contains remnants of deleted files whose sectors have not yet been reused, making it a rich source of recoverable evidence.

Question 31: Which of the following is a key part of interviewing witnesses?

Taking detailed notes and staying neutral (Correct answer)
Interrupting frequently.
Avoiding follow-up questions.
Using accusatory language.

Correct answer: Taking detailed notes and staying neutral

When interviewing witnesses, it is crucial for investigators to take detailed notes and maintain a neutral stance. Staying neutral prevents influencing the witness's testimony, while detailed notes ensure that all pertinent information is accurately captured and can be reliably referenced later, preserving the integrity of the witness's account.

Question 32: Which of the following BEST illustrates a conflict of interest in a corporate governance context?

An auditor who issues a qualified opinion on financial statements
A board member who disagrees with management's strategic plan
A procurement officer who awards a contract to their spouse's company (Correct answer)
An employee who reports a compliance violation anonymously

Correct answer: A procurement officer who awards a contract to their spouse's company

Awarding a contract to a spouse's company puts personal financial interests directly in conflict with the obligation to act in the organization's best interest.

Question 33: Under FinCEN's Customer Due Diligence (CDD) Rule, what ownership threshold triggers beneficial ownership identification for legal entities?

25% or more ownership (Correct answer)
10% or more ownership
51% or more ownership
5% or more ownership

Correct answer: 25% or more ownership

FinCEN's CDD Rule requires financial institutions to identify individuals who own 25% or more of a legal entity customer.

Question 34: The primary purpose of the 'integration' stage in money laundering is to:

Separate illegal funds from their criminal source
Deposit large amounts of cash in small increments
Reintroduce laundered funds into the legitimate economy (Correct answer)
Create layers of transactions to obscure audit trails

Correct answer: Reintroduce laundered funds into the legitimate economy

Integration is the final stage where laundered funds re-enter the legitimate financial system, appearing as normal business income or legitimate assets.

Question 35: The statute of limitations for fraud typically begins to run from the date:

The victim discovered or should have discovered the fraud (Correct answer)
The fraud was committed
Law enforcement was notified
The fraudster was identified

Correct answer: The victim discovered or should have discovered the fraud

Most jurisdictions apply the 'discovery rule,' starting the limitations period when the victim discovered or reasonably should have discovered the fraud.

Question 36: According to the ACFE's fraud risk management principles, what should happen after a fraud risk assessment is completed and risks are prioritized?

Management should design or enhance anti-fraud controls and responses for the highest-priority risks (Correct answer)
The assessment results should remain confidential and be shared only with external auditors
All identified risks should be immediately reported to law enforcement
The board should take direct operational control of the affected departments

Correct answer: Management should design or enhance anti-fraud controls and responses for the highest-priority risks

After prioritization, management is responsible for developing or strengthening controls and other responses targeted at the highest-rated fraud risks.

Question 37: Which red flag in accounts receivable aging most strongly suggests fictitious revenues?

A large balance from a single new customer with no payment activity (Correct answer)
A decrease in days sales outstanding (DSO)
A decrease in the allowance for doubtful accounts
An increase in early-payment discounts taken

Correct answer: A large balance from a single new customer with no payment activity

A large, stagnant receivable from a new customer with no cash collections is a classic sign of a fictitious sale that was never expected to be paid.

Question 38: In fraud cases, the 'economic loss rule' generally prevents plaintiffs from recovering in tort for:

Losses that are difficult to quantify
Physical injuries caused by the fraud
Purely monetary losses when no physical harm or property damage occurred (Correct answer)
Losses suffered by third parties

Correct answer: Purely monetary losses when no physical harm or property damage occurred

The economic loss rule bars tort recovery for purely financial losses absent personal injury or property damage, though fraud is a recognized exception in many jurisdictions.

Question 39: Which of the following is the MOST critical component for maintaining the chain of custody for a piece of digital evidence to ensure its admissibility in court?

A detailed, chronological log documenting everyone who handled the evidence, when they handled it, and for what purpose. [2, 16] (Correct answer)
Making multiple backup copies of the evidence on different media types.
Storing the evidence in a climate-controlled, secure facility.
Using only court-approved forensic software for the analysis.

Correct answer: A detailed, chronological log documenting everyone who handled the evidence, when they handled it, and for what purpose. [2, 16]

The chain of custody is a formal, written record that documents the complete history of the evidence, from seizure to presentation in court. [2, 16] This chronological log, detailing every person who handled the evidence, the dates and times of transfer, and the purpose of the handling, is essential to demonstrate that the evidence has not been tampered with or compromised. [2, 10, 15]

Question 40: Which type of fraud scheme is most directly mitigated by implementing a mandatory vacation policy for employees in sensitive positions?

Skimming and lapping schemes (Correct answer)
Financial statement fraud
Payroll fraud
Vendor kickback schemes

Correct answer: Skimming and lapping schemes

Mandatory vacations force others to cover an employee's duties, which can expose ongoing skimming or lapping schemes that require constant maintenance.

Question 41: What is 'motivational interviewing' most useful for in a fraud investigation context?

Documenting the chain of custody for interview recordings
Forcing a rapid confession from an uncooperative subject
Encouraging reluctant witnesses or subjects to voluntarily provide information (Correct answer)
Establishing the elements of the fraud scheme through questioning

Correct answer: Encouraging reluctant witnesses or subjects to voluntarily provide information

Motivational interviewing uses empathy and open-ended dialogue to resolve ambivalence and encourage subjects to share information willingly.

Question 42: What does the term 'burden of proof' mean?

The timeline for a legal filing.
The summary judgment by the court.
The obligation to prove one's assertion (Correct answer)
The total amount of evidence in a case.

Correct answer: The obligation to prove one's assertion

The 'burden of proof' refers to the legal obligation on a party in a lawsuit to prove its assertions or claims to the court. In criminal cases, the prosecution bears the burden to prove guilt beyond a reasonable doubt, while in civil cases, the plaintiff typically needs to prove their case by a preponderance of the evidence.

Question 43: A vendor master file review is BEST described as which type of anti-fraud control?

Detective (Correct answer)
Corrective
Compensating
Preventive

Correct answer: Detective

Reviewing the vendor master file helps detect fictitious vendors, duplicate entries, or unauthorized changes that may indicate accounts payable fraud after the fact.

Question 44: A CFE reviewing bank records notices a customer deposits $9,500 in cash on Monday, $9,400 on Tuesday, and $9,800 on Wednesday at three different branches. This pattern suggests:

Legitimate payroll deposits
Structuring to evade CTR filing requirements (Correct answer)
Over-the-counter bond purchases
Normal business cash management

Correct answer: Structuring to evade CTR filing requirements

Multiple sub-threshold cash deposits across different branches over consecutive days is a textbook structuring pattern designed to avoid the $10,000 CTR trigger.

Question 45: What is the primary purpose of asking assessment questions during a fraud examination interview?

To establish rapport and a baseline for the subject's normal behavior.
To observe the subject's verbal and non-verbal responses to hypothetical, morally-tinged questions. (Correct answer)
To obtain a legally binding confession to the fraudulent act.
To gather basic background and biographical information from the subject.

Correct answer: To observe the subject's verbal and non-verbal responses to hypothetical, morally-tinged questions.

Assessment questions are designed to gauge a subject's credibility by asking hypothetical questions that touch upon the themes of the fraud. The examiner observes the subject's reactions to these questions to look for signs of deception before making a direct accusation.

Question 46: During a fraud investigation, an examiner suspects that a witness is being untruthful but lacks sufficient evidence to confront them. The best next step is to:

Accuse the witness of lying to prompt an emotional reaction
Continue gathering information through non-confrontational questioning while documenting inconsistencies (Correct answer)
Share the suspicion with other witnesses to gauge their reaction
End the interview immediately and report the witness as a suspect

Correct answer: Continue gathering information through non-confrontational questioning while documenting inconsistencies

Continuing to gather information through careful questioning allows the examiner to build a stronger evidentiary foundation before any confrontation.

Question 47: A defendant charged with fraud may raise the 'good faith' defense by demonstrating that they:

Caused minimal financial harm
Consulted an attorney before acting
Voluntarily returned the proceeds
Genuinely believed their representations were true (Correct answer)

Correct answer: Genuinely believed their representations were true

Good faith negates the scienter element by showing the defendant sincerely believed their representations were accurate, eliminating intent to deceive.

Question 48: A Certified Fraud Examiner is leading a new fraud risk assessment for a retail company that has never performed one before. According to the ACFE's guidance, which of the following is the most appropriate first step in this process?

Identifying the potential inherent fraud risks relevant to the company's operations, industry, and locations. (Correct answer)
Designing and implementing a new set of preventive and detective controls.
Testing the operating effectiveness of the company's existing anti-fraud controls.
Reporting the initial assessment findings and recommendations to the audit committee.

Correct answer: Identifying the potential inherent fraud risks relevant to the company's operations, industry, and locations.

The first step in any fraud risk assessment is to identify the universe of potential fraud risks that could apply to the organization before any controls are considered. [7, 12] This involves understanding the business and its environment to brainstorm where and how fraud could occur. Subsequent steps involve assessing the identified risks, evaluating the controls in place, and then making recommendations.

Question 49: What is the primary purpose of a fraud risk assessment?

To replace the internal audit function
To prosecute fraudsters
To identify and prioritize fraud vulnerabilities (Correct answer)
To satisfy regulatory requirements only

Correct answer: To identify and prioritize fraud vulnerabilities

A fraud risk assessment identifies where an organization is vulnerable to fraud so resources can be prioritized to address the highest-risk areas.

Question 50: In securities fraud cases under SEC Rule 10b-5, which of the following is NOT a required element?

Material misrepresentation or omission
Proof of a specific dollar loss by each investor (Correct answer)
Use of interstate commerce or the mails
Connection to the purchase or sale of securities

Correct answer: Proof of a specific dollar loss by each investor

Rule 10b-5 does not require proof of a specific dollar loss; it requires materiality, scienter, reliance, and connection to a securities transaction.

Question 51: Which document is most useful for detecting a disbursement fraud scheme involving fictitious vendors?

Vendor master file compared against employee data (Correct answer)
Accounts receivable aging report
Bank reconciliation statements
General ledger trial balance

Correct answer: Vendor master file compared against employee data

Comparing the vendor master file to employee records (names, addresses, SSNs, bank accounts) can reveal shell companies set up by insiders.

Question 52: Which cryptocurrency characteristic makes it particularly attractive for the placement stage of money laundering?

Peer-to-peer transactions can occur without a regulated financial intermediary (Correct answer)
Blockchain transactions are fully anonymous with no audit trail
Cryptocurrency values are stable, reducing conversion risk
All crypto exchanges are located in unregulated jurisdictions

Correct answer: Peer-to-peer transactions can occur without a regulated financial intermediary

Peer-to-peer crypto transactions can bypass traditional financial institutions, allowing funds to be moved without triggering BSA reporting requirements at the placement stage.

Question 53: An organization's anti-bribery policy should MOST importantly include which of the following?

Absolute prohibition on facilitation payments and clear due diligence requirements for third parties (Correct answer)
A minimum dollar threshold below which gifts do not need to be reported
A list of approved gift recipients at partner companies
Provisions allowing payments that are customary in local cultures

Correct answer: Absolute prohibition on facilitation payments and clear due diligence requirements for third parties

Effective anti-bribery policies require comprehensive third-party due diligence and clear prohibitions, as bribes are often paid through agents and intermediaries.

Question 54: What does 'MAC times' refer to in digital forensics?

Master Allocation Chart time entries
Media Access Control timestamps on network packets
Modified, Accessed, and Created/Changed timestamps on files (Correct answer)
Machine Authentication Certificate timestamps

Correct answer: Modified, Accessed, and Created/Changed timestamps on files

MAC times (Modified, Accessed, Changed/Created) are file system metadata timestamps that help establish a timeline of file activity.

Question 55: Which tool is commonly used in forensic accounting?

Excel and data analytics software (Correct answer)
Mechanical drafting tools.
Blueprint software.
Medical imaging equipment.

Correct answer: Excel and data analytics software

Forensic accounting heavily relies on analyzing large volumes of financial data to detect anomalies and patterns indicative of fraud. Tools like Microsoft Excel and specialized data analytics software enable forensic accountants to efficiently process, sort, filter, and visualize data, uncovering hidden transactions and discrepancies crucial for investigations.

Question 56: What is an example of a corruption scheme?

Undisclosed conflicts of interest (Correct answer)
Duplicate time sheets.
Misclassified expense reports.
Falsified inventory records.

Correct answer: Undisclosed conflicts of interest

An undisclosed conflict of interest is a classic example of a corruption scheme. This occurs when an employee, in a position of trust, makes business decisions that benefit a related party (e.g., a company owned by a family member) without disclosing this relationship to their employer. Such actions prioritize personal gain over the company's best interests, constituting a breach of ethics and often a form of fraud.

Question 57: Which internal control is MOST effective at detecting skimming at a retail point-of-sale?

Mandatory vacation policies
Annual inventory audits
Surprise cash counts and register reconciliations (Correct answer)
Segregation of purchasing duties

Correct answer: Surprise cash counts and register reconciliations

Surprise cash counts compared against register tapes or POS records expose discrepancies created by skimming before cash is recorded.

Question 58: A red flag for potential payroll fraud is when:

Multiple employees share the same bank account for direct deposit (Correct answer)
Employee names appear on multiple payroll registers
Overtime payments increase during peak business seasons
New hires are added to payroll after HR approval

Correct answer: Multiple employees share the same bank account for direct deposit

Multiple employees sharing one bank account is a strong indicator of ghost employee schemes where fictitious workers' wages are directed to the fraudster's account.

Question 59: A financial institution that fails to implement an adequate AML program can be prosecuted under which theory even if it did not knowingly process illegal funds?

Deliberate ignorance / willful blindness (Correct answer)
Respondeat superior negligence
Vicarious liability
Strict product liability

Correct answer: Deliberate ignorance / willful blindness

The willful blindness doctrine holds that deliberately avoiding knowledge of suspicious activity is equivalent to actual knowledge for criminal liability purposes.

Question 60: A company's fraud risk assessment identifies a risk of bid rigging in its procurement department. Which control would MOST directly address this risk?

Requiring dual signatures on all disbursements over $10,000
Implementing a blind bidding process with independent bid committee review (Correct answer)
Conducting annual background checks on all employees
Installing surveillance cameras in the finance office

Correct answer: Implementing a blind bidding process with independent bid committee review

A blind bidding process with independent review prevents procurement staff from influencing bid outcomes, directly addressing bid rigging risk.

Question 61: A Suspicious Activity Report (SAR) filed under the Bank Secrecy Act must generally be filed within how many days of detecting a suspicious transaction?

90 days
30 days (Correct answer)
15 days
60 days

Correct answer: 30 days

Financial institutions must file a SAR within 30 days of initially detecting facts that may constitute a basis for filing, or 60 days if no suspect is identified.

Question 62: Which of the following BEST describes a 'zero-tolerance' fraud policy?

Employees receive a warning for first-time minor fraud
No fraud, regardless of amount, is overlooked or handled informally (Correct answer)
Only large frauds are prosecuted
All fraud suspects are immediately arrested

Correct answer: No fraud, regardless of amount, is overlooked or handled informally

A zero-tolerance policy means every instance of fraud is formally investigated and sanctioned consistently, regardless of the dollar amount or the perpetrator's position.

Question 63: Which amendment protects against unreasonable searches and seizures?

Eighth Amendment.
Fourth Amendment (Correct answer)
First Amendment.
Sixth Amendment.

Correct answer: Fourth Amendment

The Fourth Amendment to the U.S. Constitution protects individuals from unreasonable searches and seizures by the government. It requires that law enforcement obtain a warrant, based on probable cause, before conducting searches or seizing property, thereby safeguarding privacy and preventing arbitrary government intrusion into personal affairs.

Question 64: The 'deliberate ignorance' or 'willful blindness' doctrine in fraud cases allows courts to find scienter when a defendant:

Accidentally overlooked warning signs
Consciously avoided learning facts that would confirm illegal activity (Correct answer)
Failed to implement internal controls
Delegated oversight to subordinates

Correct answer: Consciously avoided learning facts that would confirm illegal activity

Willful blindness imputes knowledge when a defendant deliberately avoids information to maintain plausible deniability about an obvious fraud.

Question 65: Which method is commonly used in payroll fraud schemes?

Fixed asset revaluation.
Inventory write-offs.
Ghost employees (Correct answer)
Purchase order discounts.

Correct answer: Ghost employees

Ghost employees are a common method used in payroll fraud schemes. This involves adding fictitious individuals to the company's payroll system who do not actually work for the organization. The fraudster then collects the paychecks or direct deposits intended for these non-existent employees, diverting company funds for personal gain. This scheme exploits weaknesses in payroll processing and oversight.

Question 66: Which of the following best describes 'file slack space' in digital forensics?

The unused space between the end of a file's data and the end of its last allocated cluster (Correct answer)
Temporary files created by the OS during file operations
Space reserved by the file system for metadata
Empty sectors at the end of a hard drive partition

Correct answer: The unused space between the end of a file's data and the end of its last allocated cluster

File slack is the area between the end of a file's logical content and the end of its last storage cluster, which may contain remnants of previously stored data.

Question 67: Which analytical technique is most effective for detecting corruption in vendor master files?

Comparing vendor addresses to employee home addresses (Correct answer)
Analyzing accounts receivable aging reports
Reviewing general ledger trial balances
Testing bank deposit cutoff procedures

Correct answer: Comparing vendor addresses to employee home addresses

Matching vendor addresses against employee home addresses can reveal shell companies or conflict-of-interest arrangements set up by employees.

Question 68: What is a common motive behind fraudulent disbursements?

Staff appreciation bonuses.
Government mandates.
Lack of internal controls (Correct answer)
Efficient reporting systems.

Correct answer: Lack of internal controls

A common motive behind fraudulent disbursements is the exploitation of a lack of internal controls within an organization. Weaknesses such as insufficient segregation of duties, inadequate authorization processes, or poor oversight create opportunities for fraudsters to manipulate payment systems. These vulnerabilities allow individuals to process unauthorized payments, often for personal enrichment, without detection.

Question 69: Which of the following is the MOST effective way to ensure that a fraud risk assessment remains current and relevant?

Performing a full assessment every ten years
Delegating all updates to the external auditors annually
Updating the assessment periodically and whenever significant organizational changes occur (Correct answer)
Conducting the assessment only when a fraud is detected

Correct answer: Updating the assessment periodically and whenever significant organizational changes occur

Fraud risk assessments should be refreshed on a regular schedule and triggered by major events like reorganizations, new products, or mergers.

Question 70: A fraud examiner needs to analyze an employee's hard drive for evidence, including files the employee may have recently deleted. Which data acquisition method is MOST appropriate for this task?

Backing up the drive using the operating system's standard backup utility.
A targeted file copy of all files with relevant extensions (e.g., .docx, .xlsx).
Creating a bit-stream image of the entire hard drive. (Correct answer)
A logical acquisition that copies only the user's document folders.

Correct answer: Creating a bit-stream image of the entire hard drive.

A bit-stream image (or forensic image) is an exact, bit-for-bit copy of an entire storage device, including deleted files, file fragments in slack space, and unallocated clusters. [5, 13, 23] This is the only method that preserves all potential evidence. A logical copy or standard backup only captures active, non-deleted files and would miss crucial artifacts necessary for the investigation. [5, 18]

Question 71: What is the purpose of a 'Know Your Customer' (KYC) program at financial institutions?

To cross-sell financial products based on customer profiles
To comply with credit underwriting requirements
To verify customer identity and assess money laundering risk (Correct answer)
To satisfy FDIC deposit insurance documentation rules

Correct answer: To verify customer identity and assess money laundering risk

KYC programs are designed to verify the identity of customers and understand the nature of their activities to assess money laundering and terrorist financing risk.

Question 72: Which of the following is NOT considered a fundamental component of an effective corporate ethics and compliance program?

Regular, effective training and communication for all employees.
A guarantee of bonuses for employees who report misconduct. (Correct answer)
Clear, written standards and procedures, including a code of conduct.
A confidential reporting mechanism and whistleblower protection policies.

Correct answer: A guarantee of bonuses for employees who report misconduct.

An effective ethics program includes written standards, training, and a secure reporting mechanism. While some companies may choose to reward whistleblowers, a guarantee of bonuses is not a required or fundamental component. The focus is on creating a safe and clear process for reporting, protecting the reporter from retaliation, and ensuring the allegations are investigated, rather than on providing financial incentives as a baseline policy.

Question 73: What is 'bid splitting' in the context of procurement fraud?

Splitting the kickback between two employees
Sharing a winning bid among multiple vendors
Dividing a large purchase into smaller ones to avoid competitive bidding thresholds (Correct answer)
Submitting the same bid to multiple buyers

Correct answer: Dividing a large purchase into smaller ones to avoid competitive bidding thresholds

Bid splitting involves breaking a large purchase into smaller transactions to circumvent policies requiring competitive bidding above certain dollar thresholds.

Question 74: Which red flag most strongly suggests a conflict of interest in a vendor relationship?

A vendor with a long payment history
A vendor with multiple product lines
A vendor's address matching an employee's home address (Correct answer)
A vendor operating in multiple states

Correct answer: A vendor's address matching an employee's home address

A vendor address matching an employee's home address is a strong red flag indicating the employee may have an undisclosed financial interest in the vendor.

Question 75: A fraud examiner is asked to testify as an expert witness. What is the MOST important qualification required for this role?

Having law enforcement experience
Possessing specialized knowledge, skill, or experience relevant to the matter (Correct answer)
Being employed by a government agency
Holding a CPA license

Correct answer: Possessing specialized knowledge, skill, or experience relevant to the matter

Under Federal Rule of Evidence 702, an expert witness must possess specialized knowledge, skill, experience, training, or education relevant to the subject matter.

Question 76: Which element distinguishes an internal audit function from external audit in the context of fraud detection?

External auditors are required to detect all fraud above a materiality threshold
External auditors conduct surprise cash counts as their primary fraud procedure
Internal auditors work year-round with continuous access to company data and operations (Correct answer)
Internal auditors report directly to the external auditor

Correct answer: Internal auditors work year-round with continuous access to company data and operations

Internal auditors have continuous, ongoing access to operations and data throughout the year, enabling more timely fraud detection than the periodic external audit.

Question 77: What is the primary objective of financial statement fraud?

To follow tax regulations.
To improve employee morale.
To report financial losses accurately.
To manipulate financial results for personal or corporate gain (Correct answer)

Correct answer: To manipulate financial results for personal or corporate gain

The primary objective of financial statement fraud is to intentionally misrepresent a company's financial health to deceive stakeholders. This manipulation is typically undertaken for personal gain, such as executive bonuses tied to performance, or corporate gain, like attracting investors or securing loans. It involves falsifying records to present a more favorable financial picture than reality.

Question 78: After a fraud risk assessment identifies a significant risk of check tampering in the accounts payable department, management decides to eliminate paper checks and move all vendor payments to a third-party electronic payment platform that requires dual authentication. This action is an example of which type of risk response?

Accepting the risk
Transferring the risk (Correct answer)
Mitigating the risk
Avoiding the risk

Correct answer: Transferring the risk

Transferring risk involves shifting the risk to a third party. By using a third-party payment platform, the company is transferring some of the processing risk and control responsibility. Mitigation involves reducing risk by implementing internal controls. Avoidance means ceasing the activity causing the risk. Acceptance means taking no action.

Question 79: Which of the following best describes the 'hawala' system in the context of money laundering?

A UN-supervised remittance platform for developing nations
A formal SWIFT-based international wire transfer network
An informal value transfer system operating outside regulated banking (Correct answer)
A crypto-to-fiat conversion service licensed in multiple jurisdictions

Correct answer: An informal value transfer system operating outside regulated banking

Hawala is an informal value transfer system based on trust between brokers, operating largely outside regulated financial channels, making it attractive to money launderers.

Question 80: In fraud prosecutions, 'constructive knowledge' means the defendant:

Personally observed the fraud occur
Confessed to knowing about the scheme
Had access to facts that would have revealed the truth to a reasonable person (Correct answer)
Knew and participated in every step

Correct answer: Had access to facts that would have revealed the truth to a reasonable person

Constructive knowledge is imputed when a person had sufficient information available that a reasonable person would have investigated and discovered the truth.

Question 81: Which data analysis method is best suited to identifying employees who are also listed as vendors in the accounts payable system?

Benford's Law
Trend analysis
Cross-matching employee and vendor master files (Correct answer)
Regression analysis

Correct answer: Cross-matching employee and vendor master files

Cross-matching employee data (names, addresses, SSNs, bank accounts) against the vendor master file directly identifies conflicts of interest or fictitious vendor relationships.

Question 82: What is the primary legal risk of recording an interview without the subject's knowledge?

The subject can claim the recording was altered or edited
Violation of federal or state wiretapping laws that require one or all-party consent (Correct answer)
Recording without consent voids any confession obtained
The recording will be too low quality to use as evidence

Correct answer: Violation of federal or state wiretapping laws that require one or all-party consent

Many states require all-party consent to record conversations, and covert recording without legal authority can expose investigators to criminal liability.

Question 83: What is the role of a fraud examiner?

To prepare tax filings.
To oversee procurement.
To defend criminal suspects.
To detect and investigate fraudulent activity (Correct answer)

Correct answer: To detect and investigate fraudulent activity

The primary role of a fraud examiner is to proactively detect, investigate, and resolve instances of fraudulent activity. This involves gathering evidence, interviewing witnesses, analyzing financial data, and preparing comprehensive reports to document findings, ultimately aiming to prevent future fraud and support legal actions.

Question 84: Which of the following would be a red flag suggesting an employee is receiving bribes from a vendor?

The employee takes all of their allotted vacation time
The employee frequently requests internal audit reviews
The employee's lifestyle noticeably exceeds their known salary (Correct answer)
The employee has been with the company for over ten years

Correct answer: The employee's lifestyle noticeably exceeds their known salary

Living beyond one's apparent means is a classic behavioral red flag indicating an employee may be receiving undisclosed income from a fraudulent source.

Question 85: A company reports strong operating cash flow while net income is declining. This divergence most likely indicates:

Financial statement fraud inflating operating cash flow
Asset misappropriation reducing both income and cash flow
Revenue recognition fraud boosting income ahead of cash
Legitimate differences between accrual income and cash collections (Correct answer)

Correct answer: Legitimate differences between accrual income and cash collections

It is common and legitimate for operating cash flow and net income to diverge due to timing differences in accruals, depreciation, and working capital changes.

Question 86: When evaluating whether a board is exercising proper oversight of management, fraud examiners should FIRST assess:

The educational credentials of individual board members
The number of board meetings held per year
The board's composition, independence, and access to information (Correct answer)
Whether the board has adopted a formal meeting agenda template

Correct answer: The board's composition, independence, and access to information

Effective oversight depends on whether directors are truly independent, have appropriate expertise, and receive timely and complete information from management.

Question 87: Which element distinguishes larceny by trick from obtaining property by false pretenses?

Whether the offender used written or verbal misrepresentations
The value of the property taken
Whether possession alone or both title and possession were obtained through deception (Correct answer)
Whether the victim was a business or individual

Correct answer: Whether possession alone or both title and possession were obtained through deception

In larceny by trick, only possession is transferred through deception; in false pretenses, both title and possession are transferred, making the distinction legally significant for charging purposes.

Question 88: Which standard governs whether a search conducted by a private party (non-government actor) is subject to Fourth Amendment restrictions?

The totality of the circumstances test
The reasonable expectation of privacy test always applies
Private searches require a warrant if they involve electronic devices
The Fourth Amendment does not apply to purely private searches (Correct answer)

Correct answer: The Fourth Amendment does not apply to purely private searches

The Fourth Amendment protects against unreasonable government searches; it does not apply to searches conducted by private parties acting independently and not at the direction of law enforcement.

Question 89: In digital forensics, what is the primary purpose of creating a cryptographic hash (e.g., MD5 or SHA-256) of a digital evidence file immediately after acquisition?

To verify the integrity of the evidence and prove it has not been altered. [6, 8] (Correct answer)
To encrypt the evidence to prevent unauthorized access.
To create a searchable index of the file's contents.
To compress the file for efficient long-term storage.

Correct answer: To verify the integrity of the evidence and prove it has not been altered. [6, 8]

A cryptographic hash function generates a unique, fixed-size string of characters, often called a "digital fingerprint," from a digital file. [6] This is used to verify the integrity and authenticity of the evidence. [8, 19] If the original evidence and a forensic copy have the same hash value, it proves that the copy is an exact duplicate and that the original has not been tampered with since collection. [6, 17]

Question 90: A forensic accountant notices that Days Sales Outstanding (DSO) has risen sharply while revenue also increased. The most suspicious explanation is:

The company extended credit terms to win new legitimate customers
Seasonal demand caused a temporary build-up of receivables
The company recorded fictitious sales that are not being collected (Correct answer)
The company changed its billing cycle from monthly to quarterly

Correct answer: The company recorded fictitious sales that are not being collected

Fictitious revenue produces receivables that never convert to cash, causing DSO to balloon even as reported revenues climb.

Question 91: A fraud examiner interviewing a suspect who is also represented by legal counsel should:

Interview the suspect only if they waive their right to counsel in writing
Avoid the interview entirely and rely only on documentary evidence
Contact counsel before conducting the interview (Correct answer)
Proceed with the interview without notifying counsel

Correct answer: Contact counsel before conducting the interview

Ethical and legal standards require that an attorney's client not be interviewed without counsel's knowledge and consent once representation is established.

Question 92: Which fraud prevention measure specifically targets the 'pressure' element of the fraud triangle?

Surprise audits
Employee assistance programs (EAPs) (Correct answer)
Access controls
Segregation of duties

Correct answer: Employee assistance programs (EAPs)

Employee assistance programs address financial, personal, or addiction pressures that may drive employees to commit fraud, directly targeting the pressure element.

Question 93: Which type of background check is MOST relevant when hiring for a position with access to financial assets?

Personality assessment
Credit history check (Correct answer)
Physical fitness evaluation
Social media screening

Correct answer: Credit history check

A credit history check is especially relevant for financial positions because financial stress is a key fraud pressure, and past financial irresponsibility may signal risk.

Question 94: Under the USA PATRIOT Act, financial institutions are required to implement Customer Identification Programs (CIP) to verify:

The beneficial owners of all corporate accounts
The identity of customers opening new accounts (Correct answer)
The source of all wire transfers exceeding $3,000
The creditworthiness of loan applicants

Correct answer: The identity of customers opening new accounts

CIP requirements under the USA PATRIOT Act mandate that financial institutions collect and verify identifying information from customers opening new accounts.

Question 95: An employee in the accounts receivable department steals a customer's payment before it is recorded in the company's books. To conceal the theft, the employee applies a payment from another customer to the first customer's account. This fraudulent scheme is best described as:

Skimming
Billing Scheme
Cash Larceny
Lapping (Correct answer)

Correct answer: Lapping

Lapping is a common accounts receivable fraud scheme where an employee steals a payment from one customer and then uses a subsequent payment from another customer to cover the first theft, creating a continuous cycle that is difficult to detect. Skimming is the theft of cash before it's recorded, but lapping specifically involves the continuous covering of stolen funds with new payments. Cash larceny is the theft of cash that has already been recorded on the books. A billing scheme involves creating fraudulent invoices to generate a payment.

Question 96: A CFE discovers that a client's company has been making round-trip transactions where funds leave the company and return disguised as foreign investment. This is known as:

Round-tripping (Correct answer)
Asset cycling
Loan-back scheme
Double invoicing

Correct answer: Round-tripping

Round-tripping involves sending money offshore and reintroducing it as foreign investment, making domestic funds appear to come from a foreign source.

Question 97: Under 31 U.S.C. § 5318(g), financial institutions that file SARs in good faith are protected from civil liability. This protection is commonly known as:

Qualified immunity
Safe harbor provision (Correct answer)
Good Samaritan doctrine
Whistleblower shield

Correct answer: Safe harbor provision

The safe harbor provision protects financial institutions and their employees from civil liability for filing SARs, even if the reported activity turns out to be innocent.

Question 98: During a fraud investigation, which type of interview is typically conducted first to gather preliminary information without alerting the suspect?

Informational interview (Correct answer)
Confrontational interview
Admission-seeking interview
Cognitive interview

Correct answer: Informational interview

Informational interviews are conducted early in an investigation to gather facts from witnesses and peripheral parties without disclosing suspicions.

Question 99: Which control activity directly reduces the risk of unauthorized access to financial systems?

Mandatory vacation policies for all employees
Role-based access controls (RBAC) limiting system permissions to job-required functions (Correct answer)
Annual physical inventory counts
Monthly account reconciliations performed by the accounting team

Correct answer: Role-based access controls (RBAC) limiting system permissions to job-required functions

Role-based access controls restrict system access to only the functions required for an employee's specific job, reducing the opportunity to commit or conceal fraud through unauthorized system use.

Question 100: Which liability omission scheme most directly understates a company's reported obligations?

Accelerating revenue recognition
Failing to accrue warranty liabilities (Correct answer)
Overstating depreciation
Understating inventory write-downs

Correct answer: Failing to accrue warranty liabilities

Failing to accrue known warranty obligations keeps liabilities artificially low and overstates net income by avoiding the related expense.

Question 101: How does job rotation deter fraud?

It reduces productivity.
It causes confusion in the workplace.
It prevents employees from establishing schemes (Correct answer)
It eliminates vacation needs.

Correct answer: It prevents employees from establishing schemes

Job rotation involves periodically moving employees to different roles or tasks. This practice deters fraud by preventing any single employee from having continuous control over a process, making it difficult to conceal fraudulent activities. It also allows another employee to review the work, potentially uncovering irregularities.

Question 102: Under the Foreign Corrupt Practices Act (FCPA), which of the following is a valid affirmative defense?

The payment amount was below $10,000
The payment was made to a government official who requested it
The foreign country's laws do not prohibit such payments
The payment was a reasonable and bona fide business expenditure directly related to the promotion of products or services (Correct answer)

Correct answer: The payment was a reasonable and bona fide business expenditure directly related to the promotion of products or services

The FCPA provides an affirmative defense for payments that are lawful under the written laws of the foreign country or constitute reasonable bona fide business expenditures.

Question 103: According to the ACFE's 2024 Report to the Nations, financial statement fraud schemes are the least common type of occupational fraud but cause the highest median losses. What is a primary reason for this characteristic?

The schemes are often simple to execute and difficult to conceal over long periods.
The impact is usually confined to a single department and does not affect the entire organization.
These schemes are typically perpetrated by lower-level employees who have direct access to cash.
They often involve senior executives or management who can override internal controls. (Correct answer)

Correct answer: They often involve senior executives or management who can override internal controls.

Financial statement fraud often involves high-level executives who have the authority to override internal controls, manipulate accounting records, and conceal their actions. This level of involvement allows the fraud to continue for longer periods and involve larger sums, leading to significant median losses despite being less frequent than other fraud types like asset misappropriation.

Question 104: Under the Sarbanes-Oxley Act (SOX) Section 404, who is responsible for assessing the effectiveness of internal controls over financial reporting?

The internal audit department only
Management and the external auditor (Correct answer)
The SEC directly
The audit committee of the board

Correct answer: Management and the external auditor

SOX Section 404 requires both management to assess and report on internal controls over financial reporting and the external auditor to attest to that assessment.

Question 105: A company records a sale and simultaneously agrees to repurchase the same goods at a higher price. This is best described as:

Bill-and-hold fraud
Consignment fraud
Round-tripping (Correct answer)
Channel stuffing

Correct answer: Round-tripping

Round-tripping creates fictitious revenue by cycling cash through sham transactions that net no real economic benefit.

Question 106: Which of the following is the PRIMARY reason asset misappropriation schemes are so prevalent compared to other occupational fraud categories?

They are the hardest to detect by auditors
They cause the greatest financial losses per incident
They are the easiest to prosecute criminally
They are the most numerous and accessible to employees at all levels (Correct answer)

Correct answer: They are the most numerous and accessible to employees at all levels

Asset misappropriation is the most common fraud category because opportunities exist at virtually every organizational level wherever employees handle cash, inventory, or other assets.

Question 107: Benford's Law is most effective as an analytical tool for detecting asset misappropriation because:

It identifies vendors without tax ID numbers
It reveals unusual digit distributions in financial data suggesting manipulation (Correct answer)
It matches purchase orders to receiving reports
It compares headcount to payroll totals

Correct answer: It reveals unusual digit distributions in financial data suggesting manipulation

Benford's Law predicts natural digit frequency distributions, and deviations—such as an excess of numbers just below approval thresholds—can signal fabricated transactions.

Question 108: A perpetrator uses a business checking account to pay personal credit card bills by writing checks from the company. This scheme is most accurately classified as:

Forged maker scheme
Authorized maker scheme
Personal purchases scheme (Correct answer)
Check kiting

Correct answer: Personal purchases scheme

A personal purchases scheme occurs when an employee uses company funds or accounts to pay for personal expenses, misappropriating organizational assets.

Question 109: An employee uses a company credit card for personal purchases and submits the statements for payment. This scheme is BEST categorized as:

Misuse of company property
Check tampering
Non-cash misappropriation
Expense reimbursement fraud (Correct answer)

Correct answer: Expense reimbursement fraud

Charging personal expenses to a company credit card and seeking reimbursement or payment is classified as expense reimbursement fraud.

Question 110: Which internal control activity is the MOST fundamental for preventing asset misappropriation?

Frequent management meetings
Bonding of employees
Insurance policies
Segregation of duties (Correct answer)

Correct answer: Segregation of duties

Segregation of duties ensures no single employee controls all aspects of a transaction, making it much harder to commit and conceal asset misappropriation.

Question 111: Which of the following is NOT a required element of civil fraud under most U.S. jurisdictions?

Intent to deceive
A written contract (Correct answer)
False representation of a material fact
Resulting damages

Correct answer: A written contract

Civil fraud does not require a written contract; it can occur through oral or implied misrepresentations.

Question 112: Which international body maintains a list of 'high-risk jurisdictions subject to a call for action' that financial institutions use to assess AML risk?

Financial Action Task Force (FATF) (Correct answer)
Bank for International Settlements (BIS)
World Bank Group
International Monetary Fund (IMF)

Correct answer: Financial Action Task Force (FATF)

FATF publishes its 'black list' and 'grey list' of high-risk and non-cooperative jurisdictions, which financial institutions use to calibrate AML due diligence.

Question 113: According to the ACFE, which industry tends to have the highest frequency of occupational fraud cases?

Government and public administration
Healthcare
Manufacturing
Banking and financial services (Correct answer)

Correct answer: Banking and financial services

Banking and financial services organizations are frequently the most-reported industry in ACFE fraud studies due to the high volume and liquidity of assets handled.

Question 114: What is the primary purpose of a write blocker in digital forensics?

To speed up the imaging process
To verify the hash value of the evidence
To prevent any data from being written to the evidence drive during acquisition (Correct answer)
To encrypt the evidence drive

Correct answer: To prevent any data from being written to the evidence drive during acquisition

A write blocker prevents the forensic tool from altering the evidence drive by blocking all write commands while allowing read operations.

Question 115: Which of the following best describes 'constructive fraud' as distinguished from actual fraud?

A breach of legal or equitable duty that the law treats as fraudulent regardless of intent to deceive (Correct answer)
A fraud scheme requiring three or more participants
Fraud involving construction industry contracts
Fraud committed using electronic means

Correct answer: A breach of legal or equitable duty that the law treats as fraudulent regardless of intent to deceive

Constructive fraud involves a breach of fiduciary or legal duty that the law treats as fraudulent without requiring proof of actual intent to deceive.

Question 116: For a misrepresentation to be considered an element of fraud, it must be about a 'material' fact. A fact is considered material if it:

Is completely unknown to the public.
Results in a financial loss greater than a specific statutory amount.
Would likely influence the decision-making of a reasonable person. (Correct answer)
Is communicated in writing rather than orally.

Correct answer: Would likely influence the decision-making of a reasonable person.

A material fact is one that is significant enough to influence a reasonable person's decision in a transaction. It doesn't need to be in writing, completely secret, or cause a specific dollar amount of loss. The key is its importance to the decision-making process.

Question 117: When investigating a suspected money laundering case, which type of analysis maps the flow of funds through multiple accounts and entities?

Vertical analysis
Regression analysis
Ratio analysis
Link analysis (Correct answer)

Correct answer: Link analysis

Link analysis visually maps relationships and fund flows between accounts, individuals, and entities, helping investigators trace the movement of laundered money.

Question 118: Wire fraud under 18 U.S.C. § 1343 differs from mail fraud primarily in that it involves:

A higher monetary threshold
Only computer-based schemes
Mandatory restitution orders
Electronic communications in interstate or foreign commerce (Correct answer)

Correct answer: Electronic communications in interstate or foreign commerce

Wire fraud extends the fraud statutes to schemes using wire, radio, or television communications transmitted in interstate or foreign commerce.

Question 119: What is the primary purpose of the 'cognitive interview' technique used in fraud investigations?

To detect deception through behavioral analysis
To establish rapport before confrontation
To enhance memory retrieval by reinstating the original context (Correct answer)
To induce a confession through psychological pressure

Correct answer: To enhance memory retrieval by reinstating the original context

The cognitive interview uses mental reinstatement of context and other memory-enhancement strategies to help witnesses recall more accurate details.

Question 120: Under the ACFE's fraud tree, 'corruption' schemes are distinct because they:

Always involve external parties and never insiders
Involve the fraudster using their influence rather than taking assets directly (Correct answer)
Require falsification of financial statements
Only occur in government entities

Correct answer: Involve the fraudster using their influence rather than taking assets directly

Corruption schemes involve employees misusing their position and influence—such as through bribery or conflicts of interest—rather than directly stealing assets.

Question 121: A residual fraud risk is best defined as:

The initial fraud risk before any assessment is conducted
Fraud risk discovered after an investigation is complete
The fraud risk remaining after management's response and controls are applied (Correct answer)
Risk that cannot be quantified in monetary terms

Correct answer: The fraud risk remaining after management's response and controls are applied

Residual risk is what remains after controls and other mitigating responses have been implemented to address inherent risk.

Question 122: A fraud examiner discovers mid-interview that the witness is also a suspect. The examiner should:

Continue the interview without changing approach to avoid tipping off the subject
Confront the subject immediately with all available evidence
Reassess the interview strategy and consider the subject's legal rights (Correct answer)
Immediately terminate the interview and arrest the suspect

Correct answer: Reassess the interview strategy and consider the subject's legal rights

When a witness becomes a suspect, the examiner must reassess the approach and ensure the subject's rights are protected before continuing.

Question 123: Under the Electronic Communications Privacy Act (ECPA), a 'pen register' captures:

All data transmitted over a network connection
The dialing, routing, addressing, and signaling information of communications but not content (Correct answer)
The identity of all parties to a communication
The content of telephone conversations

Correct answer: The dialing, routing, addressing, and signaling information of communications but not content

A pen register records outgoing dialing, routing, addressing, and signaling information but is legally prohibited from capturing the content of any communication.

Question 124: The 'fraud triangle,' as described in the ACFE's guidance, consists of which three elements?

Pressure, opportunity, and rationalization (Correct answer)
Risk, control, and detection
Motive, means, and method
Intent, capability, and concealment

Correct answer: Pressure, opportunity, and rationalization

The fraud triangle identifies three conditions that are typically present when fraud occurs: perceived pressure (incentive/need), perceived opportunity, and the ability to rationalize the act.

Question 125: In network forensics, what does 'pcap' data contain?

Encrypted VPN tunnel endpoints
Full packet captures of network traffic including payloads (Correct answer)
A summary report of bandwidth utilization
A log of user authentication failures

Correct answer: Full packet captures of network traffic including payloads

PCAP (Packet Capture) files store raw network packets, allowing examiners to reconstruct sessions, recover transmitted files, and identify communications.

Question 126: A fraud examiner is investigating cryptocurrency transactions. What tool or resource is most useful for tracing Bitcoin wallet-to-wallet transfers?

Public blockchain explorers like blockchain.com combined with chain analysis software (Correct answer)
Traditional bank wire transfer records
WHOIS domain lookup services
Social media OSINT tools

Correct answer: Public blockchain explorers like blockchain.com combined with chain analysis software

Bitcoin's public blockchain records all transactions permanently; blockchain explorers and chain analysis tools (e.g., Chainalysis) trace fund flows between pseudonymous wallets.

Question 127: Which document comparison would BEST help detect an altered payee check tampering scheme?

Comparing vendor invoices to purchase orders
Comparing inventory counts to purchase records
Comparing original check images from the bank to the amounts in the cash disbursements journal (Correct answer)
Comparing payroll registers to HR headcount

Correct answer: Comparing original check images from the bank to the amounts in the cash disbursements journal

Retrieving original cancelled check images and comparing payee names and amounts to recorded disbursements reveals alterations made after a check left the organization.

Question 128: What is a 'pay-and-return' scheme in accounts payable fraud?

Paying a vendor twice and keeping the duplicate payment refund (Correct answer)
Returning merchandise for a cash refund
A vendor returning defective goods for payment
Paying early to obtain a discount and returning the savings

Correct answer: Paying a vendor twice and keeping the duplicate payment refund

In a pay-and-return scheme, an employee processes a duplicate payment to a vendor, and when the vendor refunds it, the employee intercepts and keeps the refund check.

Question 129: Which internal control is most effective at preventing top-management financial statement fraud?

Requiring dual authorization for accounts payable disbursements
Segregation of duties between cash receipts and accounts receivable posting
Mandatory vacation policies for accounting staff
An independent, empowered audit committee with financial expertise (Correct answer)

Correct answer: An independent, empowered audit committee with financial expertise

Because top management can override many operational controls, an independent audit committee that oversees financial reporting and the external auditor is the strongest check.

Question 130: The legal concept of 'piercing the corporate veil' allows creditors to:

Access privileged communications between a corporation and its attorneys
Hold shareholders personally liable for corporate debts when the corporate form is misused (Correct answer)
Sue corporate officers personally for breach of fiduciary duty
Force a corporation to disclose trade secrets in litigation

Correct answer: Hold shareholders personally liable for corporate debts when the corporate form is misused

Piercing the corporate veil is an equitable remedy allowing courts to hold shareholders personally liable when the corporate form is used to perpetrate fraud or injustice.

Question 131: Which element of fraud, as defined by the ACFE, refers to the perpetrator's justification or rationalization of the fraudulent act?

Opportunity
Pressure
Rationalization (Correct answer)
Capability

Correct answer: Rationalization

The Fraud Triangle's rationalization element represents the mental process by which perpetrators justify their actions to themselves, such as 'I'm just borrowing the money.'

Question 132: The term 'larceny' in the context of asset misappropriation refers to:

Theft of cash before it is recorded in the accounting system
Falsifying financial statements to conceal losses
Unauthorized use of company credit cards
Theft of cash or assets after they have been recorded in the books (Correct answer)

Correct answer: Theft of cash or assets after they have been recorded in the books

Larceny involves the theft of assets that have already been recorded on the books, distinguishing it from skimming where assets are taken before recording.

Question 133: Which of the following scenarios describes a non-cash asset misappropriation scheme?

A cashier voids a legitimate sale and pockets the customer's cash payment.
A warehouse employee steals a pallet of inventory and sells it to a third party. (Correct answer)
A manager approves a payment for a fake invoice from a shell company she created.
An accountant forges a signature on a company check and makes it payable to himself.

Correct answer: A warehouse employee steals a pallet of inventory and sells it to a third party.

Non-cash asset misappropriation involves the theft or misuse of physical assets such as inventory, equipment, or supplies. Stealing inventory from a warehouse falls directly into this category. The other options are all cash misappropriation schemes: voiding a sale is a form of fraudulent disbursement from the register, forging a check is check tampering, and approving a fake invoice is a billing scheme.

Question 134: Which legal doctrine allows investigators to examine financial records without a subpoena if a third party (such as a bank) voluntarily produces them?

Third-party doctrine (Correct answer)
Exigent circumstances doctrine
Plain view doctrine
Good faith exception

Correct answer: Third-party doctrine

The third-party doctrine holds that individuals have no reasonable expectation of privacy in records voluntarily shared with third parties like banks.

Question 135: An employee steals blank company checks, makes them payable to herself, and signs them using the controller's signature stamp. This is classified as:

Forged maker scheme (Correct answer)
Forged endorsement scheme
Altered payee scheme
Authorized maker scheme

Correct answer: Forged maker scheme

A forged maker scheme involves creating an unauthorized check by forging or misusing the signature of the authorized signer (the 'maker').

Question 136: Which analytical technique is most effective for detecting fictitious vendors in a vendor master file?

Duplicate name and address matching (Correct answer)
Benford's Law analysis of invoice amounts
Ratio analysis
Variance analysis

Correct answer: Duplicate name and address matching

Matching for duplicate vendor names, addresses, phone numbers, and tax IDs is the most direct method to identify fictitious or duplicate vendors in the master file.

Question 137: The legal doctrine of 'respondeat superior' holds that:

A superior court's ruling supersedes a lower court's decision
An employer is vicariously liable for torts committed by employees within the scope of employment (Correct answer)
Judges must defer to agency interpretations of their own regulations
Corporate officers must respond to all government inquiries personally

Correct answer: An employer is vicariously liable for torts committed by employees within the scope of employment

Respondeat superior is a doctrine of vicarious liability under which employers are held responsible for the wrongful acts of their employees committed during the course and scope of employment.

Question 138: Which professional is most at risk of being used as a 'gatekeeper' in a money laundering scheme?

A payroll administrator processing employee wages
A bank teller processing routine deposits
An attorney forming shell companies on behalf of anonymous clients (Correct answer)
A retail cashier accepting credit card payments

Correct answer: An attorney forming shell companies on behalf of anonymous clients

Attorneys, accountants, and other professionals who form companies or manage funds for clients can be exploited as gatekeepers to obscure beneficial ownership.

Question 139: When conducting fraud risk interviews with process owners, which question type is MOST effective at uncovering hidden fraud risks?

Questions focused only on past frauds that have been detected
Open-ended questions asking what could go wrong in their area and how (Correct answer)
Closed-ended yes/no questions about policy compliance
Questions that ask employees to rate their own honesty

Correct answer: Open-ended questions asking what could go wrong in their area and how

Open-ended questions encourage process owners to think creatively about vulnerabilities and often surface risks that structured questionnaires miss.

Question 140: Punitive damages in civil fraud cases are typically available when the defendant's conduct was:

Merely mistaken
Negligent
Caused by an employee without management knowledge
Malicious, oppressive, or fraudulent with conscious disregard for others' rights (Correct answer)

Correct answer: Malicious, oppressive, or fraudulent with conscious disregard for others' rights

Punitive damages require proof of egregious conduct beyond ordinary fraud — typically malice or conscious disregard — to punish and deter particularly reprehensible behavior.

Question 141: What governance structure characteristic is MOST associated with weak oversight and increased fraud risk?

Robust internal audit function reporting to the audit committee
Dominant CEO who also serves as board chairman (Correct answer)
Strong separation of duties in financial processes
Board with a majority of independent directors

Correct answer: Dominant CEO who also serves as board chairman

A CEO who also chairs the board creates a power imbalance where the executive can effectively control the body meant to oversee them, increasing fraud risk.

Question 142: Which surveillance method involves an investigator physically following a subject to observe their activities and movements?

Undercover surveillance
Moving surveillance (Correct answer)
Stationary surveillance
Electronic surveillance

Correct answer: Moving surveillance

Moving surveillance, also called a 'tail,' involves investigators physically following a subject to observe activities and record movements.

Question 143: Under the Foreign Corrupt Practices Act (FCPA), which of the following payments to a foreign official is explicitly permitted?

Gifts above $250 to procurement officers
Payments to obtain a major construction contract
Facilitation payments to expedite routine government actions (Correct answer)
Payments funneled through third-party agents

Correct answer: Facilitation payments to expedite routine government actions

The FCPA contains a narrow exception for 'facilitating payments' (also called grease payments) made to expedite routine non-discretionary government functions.

Question 144: A company discovers that several payments just below the $10,000 manager approval threshold were made to a new vendor. This pattern is MOST indicative of:

Larceny of checks
Inventory shrinkage
Structuring to avoid controls (Correct answer)
Lapping

Correct answer: Structuring to avoid controls

Keeping transactions just below authorization thresholds—known as 'threshold abuse' or structuring—is a common concealment technique in billing and disbursement fraud.

Question 145: In a 'pay-and-return' bribery scheme, which party typically initiates the corrupt payment?

The employee demands payment as a condition of doing business
The auditor discovers and reports the arrangement
The vendor initiates by offering payment to the employee (Correct answer)
Senior management authorizes the payment to maintain vendor relations

Correct answer: The vendor initiates by offering payment to the employee

In a pay-and-return (bribery) scheme, the vendor proactively offers a kickback or bribe to the employee to gain a business advantage, distinguishing it from extortion where the employee demands payment.

Question 146: Which type of analysis compares a company's financial ratios to industry benchmarks to identify anomalies that may indicate fraud?

Benford's Law analysis
Industry comparative analysis (Correct answer)
Vertical analysis
Horizontal analysis

Correct answer: Industry comparative analysis

Industry comparative analysis benchmarks a company's financial metrics against industry peers to identify outliers that may signal fraudulent manipulation.

Question 147: In securities law, insider trading based on material non-public information violates SEC Rule 10b-5 under which legal theory when a corporate outsider misappropriates information?

The short-swing profit theory
The misappropriation theory (Correct answer)
The classical theory
The tipping theory

Correct answer: The misappropriation theory

The misappropriation theory holds that a person who misappropriates confidential information from a source to whom they owe a duty of trust violates Rule 10b-5 by trading on that information.

Question 148: The Beneish M-Score model is used to:

Calculate restitution in fraud litigation
Quantify the dollar amount stolen in asset misappropriation
Rank industries by likelihood of financial statement fraud
Identify companies with a high probability of earnings manipulation (Correct answer)

Correct answer: Identify companies with a high probability of earnings manipulation

The Beneish M-Score uses eight financial ratios to flag companies statistically likely to have manipulated reported earnings.

Question 149: Benford's Law is used in fraud detection primarily because:

Fraudulently created numbers tend not to follow the natural distribution of leading digits found in real-world data (Correct answer)
Fraudsters consistently choose high numbers to avoid detection
Benford's Law identifies duplicate transactions in large datasets
All financial transactions should begin with the digit '1' under accounting standards

Correct answer: Fraudulently created numbers tend not to follow the natural distribution of leading digits found in real-world data

Benford's Law predicts that in naturally occurring datasets, smaller leading digits appear more frequently; fraudsters who invent numbers often violate this pattern.

Question 150: Which of the following best describes 'channel stuffing'?

Manipulating depreciation schedules to reduce expenses
Shipping excess product to distributors to inflate period-end revenue (Correct answer)
Delaying vendor payments to improve working capital ratios
Creating fictitious customers in the accounts receivable ledger

Correct answer: Shipping excess product to distributors to inflate period-end revenue

Channel stuffing involves pushing unsold product onto distributors, often with side agreements allowing returns, to inflate reported revenues artificially.

Question 151: When examining browser history for evidence of fraud, which artifact reveals sites visited even after history was manually cleared in most Chromium-based browsers?

DNS cache entries and browser cache thumbnails (Correct answer)
The hosts file in the operating system
The browser's bookmarks file
Browser extension manifests

Correct answer: DNS cache entries and browser cache thumbnails

DNS cache and thumbnail/favicon databases may retain visited site evidence even when browsing history is manually deleted from within the browser.

Question 152: When fraud is discovered, what should an organization do FIRST before taking any further action?

Terminate the suspected employee immediately
Notify all employees of the incident
Consult legal counsel and secure evidence (Correct answer)
Contact law enforcement

Correct answer: Consult legal counsel and secure evidence

Consulting legal counsel and securing evidence ensures proper handling that preserves the organization's legal options and prevents inadvertent destruction of evidence.

Question 153: Which form of bid rigging involves competitors agreeing in advance on who will win a particular contract?

Subcontracting schemes
Bid suppression
Complementary bidding
Bid rotation (Correct answer)

Correct answer: Bid rotation

Bid rotation is a collusion scheme where competitors take turns winning contracts, ensuring each participant gets a share of the business over time.

Question 154: A company operates in an industry with high cash transaction volume. When conducting a fraud risk assessment, this environmental factor primarily elevates which category of fraud risk?

Asset misappropriation (Correct answer)
Corruption and bribery
Cybersecurity fraud
Financial statement fraud

Correct answer: Asset misappropriation

High cash transaction volume significantly increases the risk of asset misappropriation, particularly cash theft and skimming schemes.

Question 155: What is the primary goal of a fraud awareness training program?

To certify employees as fraud examiners
To help employees recognize red flags and understand reporting channels (Correct answer)
To replace internal audit functions
To train employees to conduct internal investigations

Correct answer: To help employees recognize red flags and understand reporting channels

Fraud awareness training helps employees spot warning signs of fraud and know how and where to report suspicions, increasing the likelihood of early detection.

Question 156: A company discovers that an employee has been submitting expense reports for personal meals and entertainment while falsely labeling them as business expenses. This is best classified as:

Billing scheme
Payroll fraud
Skimming
Expense reimbursement fraud (Correct answer)

Correct answer: Expense reimbursement fraud

Expense reimbursement fraud occurs when employees claim personal expenses as business-related to receive unauthorized reimbursements.

Question 157: Which of the following is a key principle of the UK Bribery Act that differs from the US Foreign Corrupt Practices Act?

The UK Act applies only to bribery of foreign officials, not domestic officials
The UK Act prohibits all facilitation payments with no exception (Correct answer)
The UK Act imposes criminal penalties only on corporations, not individuals
The UK Act requires registration with a government anti-bribery registry

Correct answer: The UK Act prohibits all facilitation payments with no exception

Unlike the FCPA which permits facilitation payments, the UK Bribery Act 2010 prohibits all bribes including small facilitation payments.

Question 158: Which disclosure requirement under SEC Regulation S-K is most relevant to detecting executive-level financial statement fraud?

Item 303 — Management's Discussion and Analysis (MD&A) (Correct answer)
Item 201 — Market price of common equity
Item 101 — Business description
Item 402 — Executive compensation tables

Correct answer: Item 303 — Management's Discussion and Analysis (MD&A)

MD&A (Item 303) requires management to discuss results of operations, liquidity, and known trends; fraudulent statements in the MD&A can directly mask underlying financial manipulation.

Question 159: In the context of fraud, 'concealment' as a form of misrepresentation requires:

Verbal denial of wrongdoing
Active destruction of documents
Use of encrypted communications
A duty to disclose that was breached (Correct answer)

Correct answer: A duty to disclose that was breached

Concealment constitutes fraud when a party with a legal duty to disclose material information intentionally withholds it.

Question 160: A fraud risk assessment reveals that an organization's anonymous hotline has received zero reports over three years. A fraud examiner should interpret this finding as:

Potentially indicating low awareness of the hotline or fear of retaliation rather than absence of fraud (Correct answer)
Evidence that the fraud prevention program is highly effective
A sign that the organization should discontinue the hotline
Conclusive evidence that no fraud is occurring

Correct answer: Potentially indicating low awareness of the hotline or fear of retaliation rather than absence of fraud

Zero reports on a hotline may reflect poor awareness, lack of trust, or fear of retaliation rather than an absence of fraud.

Question 161: An interviewer should use the 'funnel approach' to structure questions by:

Alternating between friendly and confrontational questions
Starting with specific accusatory questions and broadening to general topics
Beginning with broad open-ended questions and narrowing to specific details (Correct answer)
Asking only closed-ended questions throughout the interview

Correct answer: Beginning with broad open-ended questions and narrowing to specific details

The funnel approach starts with broad questions to gather narrative information, then narrows to specific details to probe inconsistencies.

Question 162: A fraudster seeking to conceal liabilities and expenses to make a company appear more profitable would be MOST likely to:

Fail to record vendor invoices received near the end of the accounting period. (Correct answer)
Record a sale for goods that have been shipped but not yet ordered by the customer.
Create a 'cookie jar' reserve in a profitable year to be used in a less profitable year.
Inflate the value of inventory by not writing off obsolete stock.

Correct answer: Fail to record vendor invoices received near the end of the accounting period.

The most straightforward way to conceal liabilities and expenses is to simply fail to record them. By not entering vendor invoices into the accounts payable system, the company understates its liabilities and corresponding expenses, which in turn inflates net income.

Question 163: According to ACFE guidance, which department should ideally own and oversee the fraud risk management program?

Board of directors and senior management (Correct answer)
Legal counsel only
External auditors
IT department

Correct answer: Board of directors and senior management

The board of directors and senior management bear ultimate responsibility for the fraud risk management program, as governance starts at the top.

Question 164: An employee misappropriates company funds over three years before detection. The ACFE data shows that longer-duration schemes tend to cause:

No difference in loss amounts
Lower losses because auditors catch them sooner
Smaller losses due to smaller individual transactions
Larger median losses than schemes detected quickly (Correct answer)

Correct answer: Larger median losses than schemes detected quickly

ACFE research consistently shows that fraud schemes lasting longer cause significantly higher median losses because the fraud compounds over time before detection.

Question 165: Which ratio trend is most consistent with understated inventory write-downs used to inflate earnings?

Declining gross margin paired with rising current ratio
Rising inventory turnover paired with declining gross margin
Stable inventory turnover paired with stable net income
Declining inventory turnover paired with rising gross margin (Correct answer)

Correct answer: Declining inventory turnover paired with rising gross margin

Keeping obsolete inventory on the books at inflated values artificially raises the gross margin while slowing inventory turns as stale goods linger.

Question 166: An employee submits expense reports for the same business meal twice using slightly different dates. This is best classified as which type of scheme?

Payroll ghost employee
Duplicate reimbursement scheme (Correct answer)
Inventory theft
Shell company scheme

Correct answer: Duplicate reimbursement scheme

Duplicate reimbursement schemes involve submitting the same expense multiple times, sometimes with altered details to avoid detection.

Question 167: A fraud examiner facilitates a brainstorming session with the sales department to identify potential fraud risks. The examiner asks the team, "If you wanted to inflate your sales numbers to get a bigger bonus, and you couldn't get caught, how would you do it?" This risk identification technique is best described as:

Residual risk calculation.
Root cause analysis.
Control environment assessment.
Thinking like a fraudster. (Correct answer)

Correct answer: Thinking like a fraudster.

The technique of 'thinking like a fraudster' involves putting participants in the mindset of a perpetrator to brainstorm how they might exploit vulnerabilities or override controls. [18] This is a highly effective method for identifying specific, relevant fraud scenarios during the risk identification phase of a fraud risk assessment. [10, 14]

Question 168: According to the ACFE Report to the Nations, what is the MOST common detection method for asset misappropriation schemes?

Tip (Correct answer)
External audit
Internal audit
Management review

Correct answer: Tip

Tips—often from employees, customers, or vendors—are consistently the leading fraud detection method across all scheme categories in ACFE research.

Question 169: Why is it important for organizations to publicize disciplinary actions taken against fraud perpetrators?

To comply with SEC disclosure rules
To reinforce deterrence by demonstrating real consequences (Correct answer)
To satisfy external audit requirements
To reduce insurance premiums

Correct answer: To reinforce deterrence by demonstrating real consequences

Publishing outcomes (appropriately and lawfully) demonstrates that fraud has real consequences, strengthening the deterrent effect on other employees.

Question 170: The Racketeer Influenced and Corrupt Organizations (RICO) Act requires proof of a 'pattern of racketeering activity,' which generally means:

Five predicate acts committed by the same person
Three or more predicate acts forming a continuous enterprise
At least one predicate act within the past five years
At least two predicate acts within ten years (Correct answer)

Correct answer: At least two predicate acts within ten years

RICO requires a pattern of racketeering activity, which courts have interpreted as at least two related predicate acts occurring within ten years of each other.

Question 171: Which element is NOT required to establish wire fraud under 18 U.S.C. § 1343?

Use of interstate wire communications
Obtaining money or property by means of false pretenses
Proof that a victim actually suffered financial loss (Correct answer)
A scheme to defraud

Correct answer: Proof that a victim actually suffered financial loss

Wire fraud does not require proof of actual loss; the statute is violated when the defendant uses wire communications in furtherance of a scheme to defraud, regardless of whether the scheme succeeds.

Question 172: Under the Uniform Commercial Code (UCC), which of the following constitutes 'fraud in the factum' that renders a negotiable instrument void (not merely voidable)?

A signer who was under economic duress when executing the instrument
A signer who was deceived about the very nature of the instrument being signed (Correct answer)
A signer who was induced by misrepresentations about the value of goods
A signer who lacked full contractual capacity at the time of signing

Correct answer: A signer who was deceived about the very nature of the instrument being signed

Fraud in the factum occurs when a party is deceived about the nature of the instrument itself (e.g., told they are signing a receipt when signing a promissory note), making the instrument void and unenforceable even against a holder in due course.

Question 173: A suspect claims a financial spreadsheet was never modified after its creation date. What forensic technique can refute or support this claim?

Reviewing the file's digital signature certificate
Checking the file's size against a known database
Analyzing MFT timestamps, file metadata, and shadow copy versions (Correct answer)
Running the file through antivirus software

Correct answer: Analyzing MFT timestamps, file metadata, and shadow copy versions

NTFS MFT timestamps, embedded document metadata, and Volume Shadow Copies can collectively establish the true modification history of a file.

Question 174: What is the first step in a fraud investigation?

Report to media outlets.
Notify clients immediately.
Preserve relevant evidence (Correct answer)
Interview suspects first.

Correct answer: Preserve relevant evidence

The first and most critical step in a fraud investigation is to preserve all relevant evidence. This ensures that crucial information is not altered, destroyed, or lost, maintaining its integrity and admissibility in legal proceedings. Failure to properly preserve evidence can severely compromise the entire investigation and potential prosecution.

Question 175: Under the Federal Sentencing Guidelines, organizational defendants may reduce their culpability score by demonstrating:

That the company self-insured against fraud losses
That the CEO had no knowledge of the offense
The existence of an effective compliance and ethics program (Correct answer)
That the offense involved less than $500,000 in harm

Correct answer: The existence of an effective compliance and ethics program

Organizations can reduce their culpability multiplier under the Federal Sentencing Guidelines by showing they had an effective compliance and ethics program in place at the time of the offense.

Question 176: Which element is NOT required to prove commercial bribery under most US state laws?

The bribed party must be a government official (Correct answer)
The recipient was an agent or employee of another
The intent was to influence the agent's actions on behalf of their principal
A thing of value was offered or given

Correct answer: The bribed party must be a government official

Commercial bribery applies to private-sector employees and agents; the involvement of a government official is not required (that falls under public bribery statutes).

Question 177: Under the Reid Technique, the 'theme development' phase is designed to:

Confront the subject with physical evidence
Gather biographical background information
Establish the timeline of events
Provide the subject with moral justification or minimization for their actions (Correct answer)

Correct answer: Provide the subject with moral justification or minimization for their actions

Theme development offers the suspect a moral or psychological justification for their behavior to reduce resistance and encourage admission.

Question 178: An employee uses a company credit card to purchase a home theater system for personal use and submits the expense report with a receipt from a business dinner of the same amount. This is an example of which type of asset misappropriation scheme?

Expense Reimbursement Fraud (Correct answer)
Check Tampering
Billing Scheme
Theft of Non-Cash Assets

Correct answer: Expense Reimbursement Fraud

This is a classic example of expense reimbursement fraud, where an employee makes a claim for reimbursement of fictitious or inflated business expenses. The employee is mischaracterizing a personal expense as a legitimate business expense to receive payment from the company. A billing scheme would involve creating a fake invoice, check tampering involves altering a company check, and theft of non-cash assets would involve stealing something like inventory or equipment.

Question 179: A company controller books journal entries to reduce the allowance for doubtful accounts, thereby increasing net income. This is an example of:

Concealed liabilities scheme
Skimming from receivables
Improper asset valuation (Correct answer)
Fraudulent expense manipulation

Correct answer: Improper asset valuation

Manipulating the allowance for doubtful accounts affects asset valuation by overstating net receivables, which in turn inflates reported net income.

Question 180: Why should a fraud examiner avoid taking extensive notes during the initial rapport-building phase of an interview?

Excessive note-taking can disrupt eye contact and hinder rapport development (Correct answer)
Note-taking is prohibited by professional standards during interviews
Notes are inadmissible as evidence if taken during the interview
Note-taking signals to the subject that the interview is formal and adversarial

Correct answer: Excessive note-taking can disrupt eye contact and hinder rapport development

During rapport building, maintaining natural conversation flow and eye contact is more important than detailed note-taking.

Question 181: An investigator suspects an employee is smuggling proprietary data out of the company by hiding it within large, seemingly innocuous image files that are emailed to a personal account. This technique of concealing data within another file is known as:

Steganography (Correct answer)
Hashing
Compression
Encryption

Correct answer: Steganography

Steganography is the practice of concealing a file, message, image, or video within another file, message, image, or video. [28, 29] In this scenario, the suspect is hiding proprietary data (the message) inside image files (the carrier). This technique is a common method for covert communication and data exfiltration. [22, 28]

Question 182: Which file system artifact is most useful for identifying when a file was deleted on a Windows NTFS volume?

Prefetch files
The MFT $BITMAP attribute
The $Recycle.Bin folder and $I files (Correct answer)
Windows Event Log entries

Correct answer: The $Recycle.Bin folder and $I files

The $Recycle.Bin folder stores $I files (index files) that contain the original path and deletion timestamp for each deleted file.

Question 183: Which financial ratio anomaly might suggest that a company is inflating its reported revenue through fictitious sales?

Gross margin declining as revenue rises
DSO increasing significantly while revenue rises (Correct answer)
Accounts payable turnover increasing
Days Sales Outstanding (DSO) declining while revenue rises

Correct answer: DSO increasing significantly while revenue rises

Rising DSO alongside revenue growth suggests customers are not actually paying, which is consistent with fictitious or prematurely recognized sales.

Question 184: The ACFE's Fraud Risk Management Guide recommends that fraud risk assessments be conducted by whom?

External auditors exclusively
A cross-functional team that includes management, internal audit, legal, and compliance (Correct answer)
Law enforcement representatives
The CFO and finance team only

Correct answer: A cross-functional team that includes management, internal audit, legal, and compliance

The ACFE guide recommends a multidisciplinary team to capture diverse perspectives on fraud risks across all organizational functions.

Question 185: In a Ponzi scheme money laundering investigation, early investor returns paid from new investor funds are best characterized as:

Civil fraud requiring SEC referral only
Theft subject to state prosecution only
Legitimate returns subject to capital gains tax only
Proceeds of wire fraud potentially subject to money laundering charges (Correct answer)

Correct answer: Proceeds of wire fraud potentially subject to money laundering charges

Payments to early Ponzi investors using funds from later investors constitute proceeds of wire or mail fraud, making subsequent transactions potential money laundering violations.

Question 186: A fraud examiner is reviewing emails for evidence. Which chain of custody step is MOST critical when collecting digital evidence?

Printing all emails to paper
Deleting irrelevant emails to reduce volume
Creating a forensic image of the original media (Correct answer)
Forwarding relevant emails to a personal account

Correct answer: Creating a forensic image of the original media

Creating a forensic image preserves the integrity of digital evidence and ensures the original data is not altered, maintaining chain of custody.

Question 187: The ACFE defines 'corruption' in its Fraud Tree as schemes in which employees:

Manipulate financial statements to meet earnings targets
Collude with external auditors to issue clean opinions on false financials
Misuse their influence in business transactions in ways that violate their duty to their employer (Correct answer)
Steal cash or inventory for personal use

Correct answer: Misuse their influence in business transactions in ways that violate their duty to their employer

Corruption involves employees abusing their authority or influence—through bribery, kickbacks, or conflicts of interest—to benefit at the employer's expense.

Question 188: Which of the following is a key distinction between a fact-gathering interview and an admission-seeking interview (interrogation) in a corporate fraud investigation?

Fact-gathering interviews must be recorded by law, whereas admission-seeking interviews do not require recording.
An admission-seeking interview is the first step in any investigation, followed by fact-gathering interviews.
An admission-seeking interview is conducted by law enforcement, while a fact-gathering interview is conducted by a CFE.
A fact-gathering interview is non-accusatory and designed to gather information, while an admission-seeking interview is accusatory and intended to obtain a confession. (Correct answer)

Correct answer: A fact-gathering interview is non-accusatory and designed to gather information, while an admission-seeking interview is accusatory and intended to obtain a confession.

The fundamental difference lies in their purpose and tone. A fact-gathering interview is a non-accusatory process of collecting information. An admission-seeking interview (or interrogation) is conducted only when the examiner is reasonably certain of the subject's guilt and its purpose is to obtain a confession.

Question 189: A compliance officer discovers that the CFO is circumventing internal controls. What is the MOST appropriate initial action?

Document the concern but take no action until a pattern emerges
Escalate to the audit committee or board, bypassing the CFO (Correct answer)
Report directly to the CFO to give them a chance to self-correct
Immediately notify law enforcement without informing the board

Correct answer: Escalate to the audit committee or board, bypassing the CFO

When suspected misconduct involves a senior executive, proper escalation goes around that executive to the board or audit committee, which has oversight authority.

Question 190: Which red flag is most indicative of a bid-rigging scheme in procurement?

An employee submits expense reports late
Contracts are approved by two separate managers
A winning bidder repeatedly submits prices just below competitors' bids (Correct answer)
A vendor provides volume discounts

Correct answer: A winning bidder repeatedly submits prices just below competitors' bids

Consistently winning bids by a very slim margin above competitors suggests the winning vendor may have advance knowledge of competitor pricing.

Question 191: A fraud examiner recovers a suspect's smartphone. Which extraction method yields the most comprehensive data, including deleted records?

File system extraction
Manual (manual screen capture)
Physical extraction (Correct answer)
Logical extraction

Correct answer: Physical extraction

Physical extraction creates a bit-for-bit image of the device's memory chip, allowing recovery of deleted data and unallocated space artifacts.

Question 192: During a forensic investigation of cloud storage, which legal instrument is typically required to compel a US-based cloud provider to produce user data?

A search warrant or court order under the Stored Communications Act (SCA) (Correct answer)
An administrative subpoena issued by the ACFE
A National Security Letter
A civil subpoena duces tecum

Correct answer: A search warrant or court order under the Stored Communications Act (SCA)

The Stored Communications Act governs law enforcement access to electronic communications stored by third-party providers, generally requiring a warrant or court order.

Question 193: Under the Bank Secrecy Act, what is the maximum civil penalty per willful violation for failing to file a Currency Transaction Report?

$25,000
$10,000
$1,000,000
$100,000 (Correct answer)

Correct answer: $100,000

The BSA provides for civil penalties of up to $100,000 per willful violation for failure to file CTRs.

Question 194: What is 'statement analysis' in the context of fraud interviews?

Recording and transcribing interview statements verbatim
Comparing witness statements to documentary evidence
Analyzing financial statements for irregularities
Examining the linguistic content of written or verbal statements for indicators of deception (Correct answer)

Correct answer: Examining the linguistic content of written or verbal statements for indicators of deception

Statement analysis examines word choice, structure, and content of statements to identify linguistic indicators that may signal deception.

Question 195: Which ethical framework holds that the morality of an action is determined solely by its consequences?

Rights-based theory
Consequentialism (Correct answer)
Deontological ethics
Virtue ethics

Correct answer: Consequentialism

Consequentialism judges the rightness of actions based on their outcomes and effects, not on the nature of the actions themselves.

Question 196: Under the False Claims Act, the qui tam provision allows:

Private citizens to file lawsuits on behalf of the government and share in any recovery (Correct answer)
The government to sue contractors without prior notice
Whistleblowers to receive immunity from criminal prosecution
Judges to impose treble damages without a jury trial

Correct answer: Private citizens to file lawsuits on behalf of the government and share in any recovery

The qui tam provision of the False Claims Act permits private individuals (relators) to file suit on behalf of the government and receive 15–30% of any monetary recovery.

Question 197: The 'fraud risk universe' in an organization's fraud risk assessment refers to:

External fraud threats from cybercriminals only
The list of convicted fraudsters in the industry
All conceivable fraud schemes the organization could face (Correct answer)
Only frauds that have been committed in the past year

Correct answer: All conceivable fraud schemes the organization could face

The fraud risk universe encompasses all potential fraud schemes and scenarios that could affect an organization, regardless of whether they have occurred.

Question 198: In a fraud investigation interview, 'active listening' techniques include all of the following EXCEPT:

Using minimal verbal encouragers like 'I see' or 'go on'
Maintaining appropriate eye contact
Interrupting frequently to clarify minor points (Correct answer)
Paraphrasing the subject's statements to confirm understanding

Correct answer: Interrupting frequently to clarify minor points

Frequent interruptions disrupt narrative flow and signal inattentiveness, which is contrary to active listening principles.

Question 199: A CFE is interviewing a warehouse manager suspected of inventory theft. The interview begins with general, non-threatening questions about the manager's job duties, the warehouse layout, and typical processes. This initial phase of the interview is primarily intended to:

Establish rapport and observe the subject's baseline behavioral norms. (Correct answer)
Use rationalization to minimize the moral gravity of the offense.
Obtain a written confession from the subject as quickly as possible.
Confront the subject directly with evidence of the theft.

Correct answer: Establish rapport and observe the subject's baseline behavioral norms.

The introductory phase of an interview is crucial for building rapport and establishing a baseline of the subject's normal, non-stressed verbal and non-verbal behavior. This baseline is then used as a point of comparison when more sensitive questions are asked later, helping the examiner to spot potential signs of deception.

Question 200: Which type of audit committee independence concern arises when a committee member receives consulting fees from the company?

Material relationship that compromises independence (Correct answer)
Reputational conflict
Structural independence failure
Procedural bias

Correct answer: Material relationship that compromises independence

Receiving consulting fees creates a material financial relationship between the director and the company, which compromises audit committee independence.

Question 201: Which principle of the PEACE model (used in investigative interviewing) emphasizes allowing the subject to provide a full account without interruption?

Preparation and Planning
Closure
Account (Correct answer)
Engage and Explain

Correct answer: Account

The Account phase of the PEACE model focuses on obtaining the subject's full, uninterrupted narrative before probing for details.

Question 202: To enhance corporate accountability and restore investor confidence after major accounting scandals, the Sarbanes-Oxley Act of 2002 (SOX) instituted several key reforms. Which provision of SOX directly holds CEOs and CFOs personally accountable for the accuracy of their company's financial statements?

Section 302, which requires officer certification of financial reports. (Correct answer)
Section 201, which restricts services offered by auditors.
Section 404, which requires an internal control report.
Section 806, which provides whistleblower protection.

Correct answer: Section 302, which requires officer certification of financial reports.

Section 302 of the Sarbanes-Oxley Act explicitly requires the principal officers (typically the CEO and CFO) of the company to certify in each annual or quarterly report that the report is accurate and complete, and that they are responsible for establishing and maintaining effective internal controls. This personal certification makes it much more difficult for top executives to claim ignorance of fraudulent reporting within their organizations.

Question 203: What is the fraud triangle?

An inventory management method.
An IRS regulation.
A model explaining fraud risk factors (Correct answer)
A geometric auditing tool.

Correct answer: A model explaining fraud risk factors

The fraud triangle is a widely recognized model in criminology and auditing that identifies three conditions generally present when occupational fraud occurs: pressure, opportunity, and rationalization. Understanding these factors helps organizations design controls to prevent and detect fraudulent activities. It provides a framework for assessing fraud risk.

Question 204: A material misrepresentation in fraud is best defined as one that:

Involves a large sum of money
Occurs more than once
Is made in writing
Would influence a reasonable person's decision (Correct answer)

Correct answer: Would influence a reasonable person's decision

Materiality means the false statement was significant enough that a reasonable person would consider it important when making a decision.

Question 205: Which of the following fraud schemes would a fraud risk assessment focused on the revenue cycle most likely identify as a key risk?

Fictitious sales recorded to inflate revenue (Correct answer)
Ghost employee schemes in payroll
Unauthorized wire transfers to personal accounts
Duplicate payments to vendors

Correct answer: Fictitious sales recorded to inflate revenue

Fictitious or premature revenue recognition is the primary financial statement fraud risk in the revenue cycle.

Question 206: A buyer accepts personal gifts from a vendor in exchange for awarding contracts at above-market prices. How does this relate to asset misappropriation?

It is a non-cash misappropriation
It is a billing scheme under asset misappropriation
It is a cash larceny scheme
It is a form of corruption, not asset misappropriation (Correct answer)

Correct answer: It is a form of corruption, not asset misappropriation

Accepting kickbacks or gifts in exchange for favorable contract awards is classified as corruption (bribery/kickbacks) under the ACFE Fraud Tree, distinct from asset misappropriation.

Question 207: Under the Sherman Antitrust Act, bid rigging is classified as which type of violation?

An administrative violation
A rule-of-reason violation
A civil infraction requiring restitution only
A per se illegal violation (Correct answer)

Correct answer: A per se illegal violation

Bid rigging is treated as a per se illegal violation under the Sherman Antitrust Act, meaning it is automatically illegal regardless of any claimed justification.

Question 208: An investigator notices a car dealership accepting large cash payments for vehicles and then depositing only small amounts over time. This is an example of:

Hawala network use
Trade-based money laundering
Integration through real estate
Structuring using a business front (Correct answer)

Correct answer: Structuring using a business front

Using a cash-intensive business to break up and deposit illicit funds in small increments is structuring facilitated through a business front.

Question 209: A whistleblower tip to the SEC alleging financial statement fraud would most likely be routed to which program?

FASB Standards Advisory Council
SEC Office of the Whistleblower under Dodd-Frank (Correct answer)
PCAOB Ethics Hotline
FINRA BrokerCheck

Correct answer: SEC Office of the Whistleblower under Dodd-Frank

The SEC's Office of the Whistleblower, established by Dodd-Frank Section 922, accepts tips and awards 10–30% of sanctions exceeding $1 million to qualifying whistleblowers.

Question 210: The equitable remedy of 'disgorgement' in fraud cases requires the wrongdoer to:

Return all profits gained through the fraudulent conduct (Correct answer)
Pay double the victim's losses
Fund a compliance program
Publicly admit the fraud

Correct answer: Return all profits gained through the fraudulent conduct

Disgorgement strips the fraudster of ill-gotten gains regardless of whether those profits exceed the victim's actual losses, preventing unjust enrichment.

Question 211: A company implements mandatory job rotation for employees handling cash. This control primarily addresses which fraud triangle element?

Rationalization
Pressure
Motivation
Opportunity (Correct answer)

Correct answer: Opportunity

Job rotation reduces the opportunity for fraud by preventing any single employee from maintaining exclusive, continuous control over assets or processes.

Question 212: What should a fraud examiner do if a subject invokes their right to counsel during an interrogation?

Continue questioning on unrelated topics until counsel arrives
Immediately cease all questioning and honor the invocation (Correct answer)
Ask the subject to reconsider before stopping the interview
Request that the subject sign a written waiver before stopping

Correct answer: Immediately cease all questioning and honor the invocation

Once a subject invokes the right to counsel, all questioning must stop immediately, as required by constitutional protections.

Question 213: A grand jury subpoena issued in a federal fraud investigation requires the recipient to:

Appear with counsel present at all times during testimony
Retain legal counsel before complying
Receive advance notice at least 30 days before the return date
Produce documents or testimony as specified, unless a valid privilege applies (Correct answer)

Correct answer: Produce documents or testimony as specified, unless a valid privilege applies

Recipients of grand jury subpoenas must comply by producing the requested documents or testimony, though they may invoke valid privileges such as the Fifth Amendment or attorney-client privilege.

Question 214: Which behavioral red flag is commonly associated with employees committing procurement fraud?

Living beyond apparent means or refusing to take vacation (Correct answer)
Consistently arriving early and leaving on time
Requesting transfers to other departments
Frequently requesting expense reimbursements

Correct answer: Living beyond apparent means or refusing to take vacation

Employees committing procurement fraud often display lifestyle indicators inconsistent with their salary, and may avoid vacations that would require others to handle their duties.

Question 215: A company is suspected of engaging in a financial statement fraud scheme involving timing differences. Which of the following actions would be the MOST likely indicator of this type of fraud?

Holding the books open after the close of an accounting period to record sales from the subsequent period. (Correct answer)
Failing to disclose significant pending litigation that could materially impact the company's financial position.
Consistently reporting strong sales growth while its primary competitors are experiencing a downturn.
Creating fictitious invoices for non-existent customers to boost accounts receivable.

Correct answer: Holding the books open after the close of an accounting period to record sales from the subsequent period.

Timing difference frauds involve recording revenues or expenses in improper periods. Holding the books open to include sales from the next period is a classic example of accelerating revenue recognition to manipulate financial results for the current period.

Question 216: Which stage of the money laundering cycle involves moving funds through complex financial transactions to disguise their origin?

Placement
Structuring
Layering (Correct answer)
Integration

Correct answer: Layering

Layering is the second stage of money laundering, designed to put distance between criminal proceeds and their source through complex transactions.

Question 217: Under the ACFE Fraud Tree, which of the following is a sub-category of payroll schemes?

Larceny of cash on hand
Skimming
Shell companies
Ghost employees (Correct answer)

Correct answer: Ghost employees

Ghost employees—fictitious workers added to payroll to divert paychecks—are a recognized sub-category under payroll fraud in the ACFE Fraud Tree.

Question 218: Lapping is primarily associated with which asset misappropriation category?

Payroll fraud
Non-cash misappropriation
Inventory theft
Cash skimming of receivables (Correct answer)

Correct answer: Cash skimming of receivables

Lapping conceals stolen receivable payments by applying later customers' payments to earlier accounts, a classic cash skimming concealment technique.

Question 219: What does 'order of volatility' dictate in a digital forensics investigation?

The ranking of evidence by its admissibility in court
The priority order for collecting evidence, from most to least transient (Correct answer)
The sequence for cataloging physical documents
The sequence in which suspects should be interviewed

Correct answer: The priority order for collecting evidence, from most to least transient

Order of volatility (per RFC 3227) guides examiners to collect most volatile data first (RAM, CPU cache) before collecting less volatile data (hard drives, backups).

Question 220: Which of the following is the primary purpose of benchmarking during a fraud risk assessment?

To compare employee salaries against industry averages
To compare an organization's fraud controls against peer organizations or best practices (Correct answer)
To measure the time it takes to detect a fraud scheme
To calculate the dollar value of past fraud losses

Correct answer: To compare an organization's fraud controls against peer organizations or best practices

Benchmarking in fraud risk assessment involves comparing an organization's controls and risk posture against industry peers or established best practices to identify gaps.

Question 221: During a fraud risk assessment, which of the following would be considered an 'anti-fraud control' rather than a fraud risk?

Mandatory ethics training for all employees (Correct answer)
High employee turnover in accounting
Management pressure to meet revenue targets
Lack of segregation of duties

Correct answer: Mandatory ethics training for all employees

Mandatory ethics training is an anti-fraud control designed to reduce rationalization and deter fraudulent behavior, not a risk factor.

Question 222: In a 'lapping' scheme used to conceal accounts receivable theft, the fraudster:

Writes off stolen receivable balances as uncollectible to remove them from the books
Applies a later customer's payment to an earlier customer's account to cover the stolen amount (Correct answer)
Records fictitious sales returns to offset the missing receivable balance
Issues credit memos to customers whose payments were stolen

Correct answer: Applies a later customer's payment to an earlier customer's account to cover the stolen amount

Lapping is a continuous cover-up where stolen cash from one customer is concealed by applying subsequent customers' payments to the victim account, requiring perpetual maintenance.

Question 223: Which ratio analysis technique is MOST useful for identifying fictitious employee payments?

Gross margin analysis
Headcount-to-payroll cost ratio over time (Correct answer)
Days sales outstanding trend
Accounts payable turnover

Correct answer: Headcount-to-payroll cost ratio over time

Monitoring the ratio of payroll expense to headcount highlights periods where payroll cost rises without a corresponding increase in employees, suggesting ghost employees.

Question 224: How can data analytics help detect fraud schemes?

By identifying irregularities in financial data (Correct answer)
By creating more paperwork.
By reducing the need for training.
By eliminating internal audits.

Correct answer: By identifying irregularities in financial data

Data analytics helps detect fraud schemes by processing and analyzing large volumes of financial data to identify irregularities, anomalies, and unusual patterns. These deviations from expected behavior can serve as red flags, indicating potential fraudulent activities that might otherwise go unnoticed through traditional auditing methods. By highlighting suspicious transactions or trends, data analytics enables targeted investigations and proactive fraud prevention.

Question 225: The USA PATRIOT Act expanded BSA requirements to include which new category of financial institution in AML program obligations?

Grocery stores accepting EBT payments
Commercial landlords accepting monthly rent payments
Nonprofit charitable organizations receiving foreign donations
Broker-dealers, mutual funds, and money services businesses (Correct answer)

Correct answer: Broker-dealers, mutual funds, and money services businesses

The USA PATRIOT Act extended BSA AML program requirements to broker-dealers, mutual funds, money services businesses, and other non-bank financial institutions.

Question 226: Which type of question is most effective for gathering detailed narrative information from a cooperative witness?

Closed-ended questions
Compound questions
Leading questions
Open-ended questions (Correct answer)

Correct answer: Open-ended questions

Open-ended questions invite the interviewee to provide full narrative responses rather than simple yes/no answers.

Question 227: In the context of legal fraud, what does the term 'scienter' refer to?

The financial loss suffered by the victim.
The causal link between the misrepresentation and the damages.
The perpetrator's knowledge of the statement's falsity and intent to deceive. (Correct answer)
The victim's reasonable reliance on the false statement.

Correct answer: The perpetrator's knowledge of the statement's falsity and intent to deceive.

Scienter refers to the mental state of the person making the false statement. It means the person knew the representation was false or made it with reckless disregard for the truth, and had the intent to deceive the victim. It is a critical element that distinguishes fraud from negligent misrepresentation.

Question 228: Which scenario BEST illustrates the rationalization element of the fraud triangle?

An employee has access to company funds without oversight
An employee needs money to pay medical bills
An employee believes the company underpays and they deserve more (Correct answer)
An employee is passed over for promotion

Correct answer: An employee believes the company underpays and they deserve more

Rationalization occurs when a person justifies their fraudulent behavior with a belief such as 'I deserve this' or 'the company owes me.'

Question 229: Which of the following best describes 'structuring' as a money laundering technique?

Breaking up large cash deposits into smaller amounts below reporting thresholds to avoid detection (Correct answer)
Creating complex corporate structures across multiple jurisdictions to hide asset ownership
Mixing legitimate business revenue with criminal proceeds in the same bank account
Using trade-based transactions to overvalue goods and transfer value across borders

Correct answer: Breaking up large cash deposits into smaller amounts below reporting thresholds to avoid detection

Structuring, also called 'smurfing,' involves deliberately breaking cash transactions into smaller amounts—typically below $10,000—to avoid Currency Transaction Report filing requirements.

Question 230: Which of the following best describes a 'fraud risk scenario' as used in a formal fraud risk assessment?

A historical fraud case study from another organization
A general category of fraud such as 'asset misappropriation'
A specific, plausible description of how a fraud scheme could be perpetrated in the organization (Correct answer)
A statistical forecast of expected fraud losses

Correct answer: A specific, plausible description of how a fraud scheme could be perpetrated in the organization

A fraud risk scenario is a concrete, organization-specific description of how a particular fraud scheme could be carried out given the entity's people, processes, and systems.

Question 231: Under the Federal Mail Fraud Statute (18 U.S.C. § 1341), federal jurisdiction is established when:

The fraud exceeds $10,000
The mails or private carriers are used in furtherance of a scheme to defraud (Correct answer)
The fraud crosses state lines
The victim is a federal employee

Correct answer: The mails or private carriers are used in furtherance of a scheme to defraud

The Mail Fraud Statute only requires that the defendant used the U.S. mail or private interstate carriers as part of executing the fraudulent scheme.

Question 232: Under common law, which element of fraud requires that the victim actually relied on the false representation?

Proximate causation
Justifiable reliance (Correct answer)
Scienter
Materiality

Correct answer: Justifiable reliance

Justifiable reliance means the victim must have reasonably relied on the misrepresentation when making their decision.

Question 233: Which internal control procedure is most effective at detecting duplicate payments to vendors?

Reconciling bank statements monthly
Requiring two approvals for all invoices over $10,000
Conducting physical inventory counts quarterly
Running automated data analytics to match invoice numbers, amounts, and vendor IDs (Correct answer)

Correct answer: Running automated data analytics to match invoice numbers, amounts, and vendor IDs

Automated matching of invoice numbers, amounts, and vendor identifiers quickly flags duplicate submissions that might otherwise slip through manual review.

Question 234: In a proactive fraud audit, which technique involves applying Benford's Law?

Analyzing the frequency distribution of leading digits in financial data to identify anomalies (Correct answer)
Comparing budget variances to prior period actuals
Testing controls over access to financial systems
Interviewing employees about known fraud risks

Correct answer: Analyzing the frequency distribution of leading digits in financial data to identify anomalies

Benford's Law predicts the expected frequency of leading digits in naturally occurring datasets; deviations from this distribution can signal fabricated or manipulated numbers.

Question 235: In the context of evidence law, the best evidence rule requires that:

The original document must be produced to prove the contents of a writing (Correct answer)
Electronic evidence must be certified by a forensic expert
Physical evidence must be preserved in its original condition
Only expert witnesses may testify about complex financial transactions

Correct answer: The original document must be produced to prove the contents of a writing

The best evidence rule (Federal Rule of Evidence 1002) requires that an original document be produced when its contents are at issue, unless an exception applies.

Question 236: What is 'data carving' in the context of digital forensics?

Removing irrelevant files from an evidence image to reduce its size
Extracting encrypted data using brute-force key recovery
Physically dismantling a hard drive to access platters
Recovering files from unallocated space based on file signatures without relying on file system metadata (Correct answer)

Correct answer: Recovering files from unallocated space based on file signatures without relying on file system metadata

Data carving identifies file headers and footers (magic bytes) in raw storage to reconstruct files even when directory entries have been deleted.

Question 237: Which type of training helps prevent fraud?

Public speaking classes.
Sales pitching training.
Fraud awareness training (Correct answer)
Conflict negotiation workshops.

Correct answer: Fraud awareness training

Fraud awareness training educates employees about the different types of fraud, common red flags, and the organization's policies and procedures for reporting suspicious activities. This knowledge empowers employees to recognize and report potential fraud, acting as a crucial first line of defense in prevention efforts and fostering a culture of vigilance.

Question 238: An effective corporate code of conduct is a cornerstone of a strong ethical culture. Which of the following elements is MOST critical for ensuring a code of conduct is an effective anti-fraud tool rather than just a document?

Requiring all employees to pass a multiple-choice test on the code's contents annually.
Consistent enforcement of the code and visible disciplinary action for violations. (Correct answer)
Ensuring the document is written by the external legal counsel.
Making the document publicly available on the company website.

Correct answer: Consistent enforcement of the code and visible disciplinary action for violations.

While training and accessibility are important, a code of conduct loses its power if it is not consistently enforced. When employees see that violations, especially by senior personnel, are ignored or handled leniently, the code becomes meaningless. Visible, consistent, and fair disciplinary action reinforces the 'tone at the top' and demonstrates a true commitment to ethical behavior, which acts as a powerful deterrent to fraud.

Question 239: An employee with access to the accounts payable system creates a duplicate payment by processing an invoice twice. To conceal the fraud, she deletes one invoice from the system after the payment clears. This is an example of:

Shell company scheme
Personal purchases scheme
Fictitious vendor scheme
Duplicate payment scheme (Correct answer)

Correct answer: Duplicate payment scheme

Duplicate payment schemes involve intentionally paying the same legitimate invoice more than once and diverting the second payment.

Question 240: A 'compensating control' is best described as:

A redundant control that duplicates the function of another control
A financial incentive paid to employees who report fraud
A control that mitigates risk when the primary control cannot be implemented (Correct answer)
A corrective action taken after a fraud has been discovered

Correct answer: A control that mitigates risk when the primary control cannot be implemented

A compensating control is an alternative control that reduces risk to an acceptable level when the ideal primary control—such as segregation of duties—cannot be practically implemented.

Question 241: An independent director on a corporate board is BEST defined as one who:

Has no material relationship with the company beyond their directorship (Correct answer)
Represents institutional shareholders on the board
Holds a significant ownership stake in the company
Was previously an executive at the company more than five years ago

Correct answer: Has no material relationship with the company beyond their directorship

Independence requires that a director have no material financial or personal relationships with the company that could compromise their objectivity.

Question 242: Which of the following is an example of volatile data that must be collected first at a live fraud scene?

Documents stored on an external hard drive
Database backup files on a NAS device
Contents of RAM including running processes and open network connections (Correct answer)
Emails archived in a PST file

Correct answer: Contents of RAM including running processes and open network connections

RAM is volatile and its contents are lost when a system is powered off, so live system memory must be captured before any shutdown.

Question 243: Which control BEST prevents a single employee from both initiating and approving vendor payments?

Physical access restrictions
Dual authorization requirements (Correct answer)
Positive pay
Bank reconciliation

Correct answer: Dual authorization requirements

Dual authorization requires a second independent approver for payments, preventing one person from controlling the entire disbursement process.

Question 244: A 'ghost employee' scheme is detected when auditors find:

Employees with unusually high overtime hours
Payroll records for workers with no HR file, time records, or supervisors (Correct answer)
Commission payments exceeding base salary for sales staff
Multiple employees in the same department earning similar wages

Correct answer: Payroll records for workers with no HR file, time records, or supervisors

Ghost employees are fictitious persons on the payroll who have no corresponding employment documentation, timesheets, or identifiable supervisors.

Question 245: In fraud risk assessment terminology, 'risk tolerance' refers to:

The maximum dollar loss an auditor will accept before issuing a qualified opinion
The time period over which fraud risks are assessed
The amount of residual fraud risk an organization is willing to accept (Correct answer)
The number of fraud incidents allowed per fiscal year

Correct answer: The amount of residual fraud risk an organization is willing to accept

Risk tolerance defines the level of residual fraud risk that the board and management consider acceptable given the cost of controls.

Question 246: When conducting a background investigation on a fraud suspect, which source provides the MOST comprehensive information about prior civil litigation?

DMV records
PACER (Public Access to Court Electronic Records) (Correct answer)
Social media profiles
Credit bureau reports

Correct answer: PACER (Public Access to Court Electronic Records)

PACER provides access to federal court records including civil suits, bankruptcies, and criminal cases, making it a primary source for litigation history.

Question 247: A conflict of interest fraud scheme most commonly involves an employee who:

Creates fictitious vendors in the accounts payable system
Skims cash receipts before they are recorded
Has an undisclosed personal stake in a transaction that affects their employer (Correct answer)
Forges a supervisor's signature on a purchase order

Correct answer: Has an undisclosed personal stake in a transaction that affects their employer

A conflict of interest occurs when an employee has an undisclosed personal or financial interest in a transaction that could benefit them at the employer's expense.

Question 248: A company overstates goodwill by failing to record required impairment. The primary impact is:

Understated revenue and understated net income
Overstated total assets and overstated net income (Correct answer)
Overstated cash flow from operations
Understated total equity and overstated liabilities

Correct answer: Overstated total assets and overstated net income

Skipping a required impairment charge keeps goodwill inflated on the balance sheet (overstating assets) and avoids the expense that would reduce net income.

Question 249: A company conducts an annual 'fraud risk workshop' with department heads to identify emerging schemes. This practice BEST exemplifies which step in fraud risk management?

Fraud investigation
Compliance reporting
Reactive fraud response
Ongoing fraud risk assessment (Correct answer)

Correct answer: Ongoing fraud risk assessment

Regularly convening stakeholders to identify new fraud risks is an example of ongoing, proactive fraud risk assessment embedded in normal business operations.

Question 250: Under the Bank Secrecy Act (BSA), financial institutions are required to file a Currency Transaction Report (CTR) for cash transactions exceeding what threshold?

$50,000
$10,000 (Correct answer)
$25,000
$5,000

Correct answer: $10,000

The BSA requires financial institutions to file a CTR for any cash transaction exceeding $10,000 in a single business day.

Question 251: Which of the following is considered a 'red flag' or behavioral indicator that might suggest an employee is involved in an asset misappropriation scheme?

Consistently refusing to take vacation or share job duties. (Correct answer)
Participating in multiple company-sponsored social events.
Frequently complaining about the company's coffee quality.
Requesting additional training on new accounting software.

Correct answer: Consistently refusing to take vacation or share job duties.

Employees involved in fraud often avoid taking time off or letting others handle their tasks because they fear their scheme will be discovered in their absence. This unwillingness to share duties is a classic behavioral red flag. The other options are generally normal workplace behaviors and not typically associated with fraudulent activity.

Question 252: What is the primary purpose of a 'vendor audit right' clause in a procurement contract?

To give the buying organization the right to inspect the vendor's records for billing accuracy (Correct answer)
To allow the vendor to audit the buyer's internal processes
To require vendors to maintain ISO certification
To restrict vendor subcontracting arrangements

Correct answer: To give the buying organization the right to inspect the vendor's records for billing accuracy

A vendor audit right clause permits the purchasing organization to review the vendor's books and records to verify that charges billed match actual costs incurred.

Question 253: The False Claims Act (31 U.S.C. § 3729) primarily addresses fraud against:

Foreign governments
The federal government (Correct answer)
State governments only
Private insurance companies

Correct answer: The federal government

The False Claims Act imposes civil and criminal liability on persons who knowingly submit false claims for payment to the U.S. federal government.

Question 254: What is the legal significance of a 'Garrity warning' in the context of public employee interviews?

It notifies the employee that the interview is being recorded
It establishes that the employee has waived their Fifth Amendment rights
It advises the employee of their right to counsel before any interview
It warns that statements compelled under threat of termination cannot be used in criminal proceedings (Correct answer)

Correct answer: It warns that statements compelled under threat of termination cannot be used in criminal proceedings

Garrity warnings protect public employees from having compelled statements used against them criminally, stemming from Garrity v. New Jersey.

Question 255: The 'fraud triangle' concept was developed primarily by which researcher?

Joseph Wells
Edwin Sutherland
W. Steve Albrecht
Donald Cressey (Correct answer)

Correct answer: Donald Cressey

Donald Cressey developed the fraud triangle model based on his research into embezzlers, identifying pressure, opportunity, and rationalization as the three elements.

Question 256: Under the Foreign Corrupt Practices Act (FCPA), which of the following payments to a foreign official is generally permitted?

Payments disguised as charitable donations to influence an official
Payments to retain an existing government contract through improper means
Facilitating payments to expedite routine governmental actions (Correct answer)
Payments to win a new government contract

Correct answer: Facilitating payments to expedite routine governmental actions

The FCPA contains a narrow exception for facilitating payments made to expedite or secure the performance of routine, non-discretionary governmental actions.

Question 257: The term 'scienter' in fraud law refers to:

Knowledge of falsity or reckless disregard for the truth (Correct answer)
The identity of the victim
The amount of damages suffered
Physical evidence of the scheme

Correct answer: Knowledge of falsity or reckless disregard for the truth

Scienter is the mental state element requiring the perpetrator to have known the statement was false or acted with reckless disregard for its truth.

Question 258: Which financial statement fraud scheme involves recording revenue before it is earned or realizable?

Cookie jar reserves
Round-tripping
Premature revenue recognition (Correct answer)
Channel stuffing

Correct answer: Premature revenue recognition

Premature revenue recognition records sales before all revenue recognition criteria are met, overstating current period income.

Question 259: Under the federal sentencing guidelines, which factor most significantly increases a fraud defendant's offense level and sentence?

Whether the defendant cooperated after arrest
The number of states where the fraud occurred
The geographic scope of the scheme
The amount of intended loss or actual loss to victims (Correct answer)

Correct answer: The amount of intended loss or actual loss to victims

The loss amount is the primary driver of offense level under USSG §2B1.1, with each increase in loss tier adding points that substantially increase the sentencing range.

Question 260: In digital evidence handling, what is a 'forensic image' as opposed to a simple file copy?

A log file generated by antivirus software
A screenshot of the suspect's desktop
A sector-by-sector duplicate that captures all data including unallocated space (Correct answer)
A compressed archive of the user's document folder

Correct answer: A sector-by-sector duplicate that captures all data including unallocated space

A forensic image is a bit-for-bit copy of every sector on a storage device, preserving deleted files, slack space, and other artifacts a file copy would miss.

Question 261: Which asset misappropriation scheme would MOST likely be uncovered by comparing the vendor master file to the employee master file?

Shell company/fictitious vendor scheme (Correct answer)
Register disbursement fraud
Lapping
Ghost employee scheme

Correct answer: Shell company/fictitious vendor scheme

Matching vendor addresses, phone numbers, or bank accounts against employee records can expose shell companies controlled by insiders.

Question 262: A purchasing manager sets up a shell company and submits invoices to her employer for goods never delivered. The invoices are approved and paid. This scheme is categorized as:

Non-accomplice vendor scheme
Personal purchases scheme
Pay-and-return scheme
Shell company scheme (Correct answer)

Correct answer: Shell company scheme

A shell company scheme involves creating a fictitious business entity to submit fraudulent invoices to the victim organization.

Question 263: During a fraud risk assessment, the team has identified over fifty potential fraud schemes. Which of the following factors are MOST crucial for prioritizing these identified risks for further action and resource allocation?

The number of employees involved in the process and their tenure.
The likelihood of the scheme occurring and its potential significance or impact. [3, 4, 6] (Correct answer)
The ease of detection and the availability of external auditors.
The complexity of the scheme and the cost of a potential investigation.

Correct answer: The likelihood of the scheme occurring and its potential significance or impact. [3, 4, 6]

Risk prioritization is a critical step in the assessment process. To effectively allocate limited resources, organizations must evaluate each identified fraud risk based on its likelihood (probability of occurrence) and its potential significance or impact (financial, reputational, etc.). [3, 5, 6] Risks with high likelihood and high impact are prioritized for the strongest response.

Question 264: The ACFE's Fraud Tree classifies corruption schemes under which major branch?

Financial Statement Fraud
Asset Misappropriation
Corruption (Correct answer)
Fraudulent Disbursements

Correct answer: Corruption

The ACFE Fraud Tree organizes occupational fraud into three major branches: Asset Misappropriation, Corruption, and Financial Statement Fraud.

Question 265: Which of the following best describes a 'trust account' conversion scheme?

Establishing a fraudulent trust to hide assets from creditors
Using escrow or client trust funds for the perpetrator's personal benefit (Correct answer)
Manipulating trust account interest calculations to overcharge clients
Converting foreign currency trust accounts to domestic currency fraudulently

Correct answer: Using escrow or client trust funds for the perpetrator's personal benefit

Trust account conversion occurs when a fiduciary—such as an attorney or real estate agent—misappropriates funds held in trust for clients.

Question 266: Which purchasing scheme involves an employee authorizing payment for goods received at inflated prices due to a secret arrangement with the vendor?

Skimming scheme
Larceny scheme
Lapping scheme
Overbilling scheme (Correct answer)

Correct answer: Overbilling scheme

An overbilling scheme involves a vendor charging more than the agreed or market price, with an employee facilitating this in exchange for a kickback from the excess amount.

Question 267: What is the goal of conducting background checks during investigations?

To monitor work attendance.
To identify any criminal history or red flags (Correct answer)
To validate insurance coverage.
To create a new employment profile.

Correct answer: To identify any criminal history or red flags

The goal of conducting background checks during investigations is to identify any criminal history, financial irregularities, or other red flags associated with individuals of interest. This helps assess credibility, uncover potential motives, and build a comprehensive profile, which is crucial for understanding their potential involvement in fraudulent activities.

Question 268: Which governance document typically establishes the fiduciary duties of corporate board members?

The external auditor's engagement letter
The company's whistleblower policy
Corporate bylaws and applicable state corporate law (Correct answer)
The annual proxy statement

Correct answer: Corporate bylaws and applicable state corporate law

Fiduciary duties of directors are primarily established by corporate bylaws and the state corporate law under which the company is incorporated.

Question 269: When using data analytics as part of a fraud risk assessment, what is the primary goal?

To replace the need for fraud risk interviews
To identify anomalies and patterns that may indicate fraud risk exposure (Correct answer)
To automate the entire fraud risk assessment process
To calculate the total cost of all detected frauds

Correct answer: To identify anomalies and patterns that may indicate fraud risk exposure

Data analytics in fraud risk assessment is used to surface anomalies, outliers, and unusual patterns that signal areas of elevated fraud risk.

Question 270: Why is ethical culture important in fraud deterrence?

It reduces employee morale.
It encourages transparency and integrity (Correct answer)
It promotes secrecy.
It complicates policy writing.

Correct answer: It encourages transparency and integrity

An ethical culture within an organization is crucial for fraud deterrence because it fosters an environment where employees are expected to act with honesty and integrity. This promotes transparency, discourages fraudulent behavior, and encourages employees to report misconduct, thereby strengthening the organization's overall defense against fraud.

Question 271: Which technique helps identify hidden assets?

Facility maintenance logs.
Confidential HR records.
Surveillance footage.
Asset tracing (Correct answer)

Correct answer: Asset tracing

Asset tracing is a specialized investigative technique used to identify, locate, and recover assets that have been illegally obtained, laundered, or concealed. It involves meticulously following financial trails through various accounts, transactions, and jurisdictions to uncover hidden wealth and facilitate its recovery for victims or legal action.

Question 272: In a civil fraud lawsuit, the burden of proof standard typically required is:

Clear and convincing evidence
Probable cause
Beyond a reasonable doubt (Correct answer)
Preponderance of the evidence

Correct answer: Beyond a reasonable doubt

Most civil fraud claims require proof by a preponderance of the evidence, meaning it is more likely than not that fraud occurred.

Question 273: In a money laundering investigation, 'red flags' related to wire transfers include which of the following?

Wires processed during normal banking hours with standard fees
Wires accompanied by a signed letter from the company CFO
Wires to high-risk jurisdictions with no apparent business purpose (Correct answer)
Wires sent to established trading partners in amounts matching invoices

Correct answer: Wires to high-risk jurisdictions with no apparent business purpose

Wire transfers to high-risk or secrecy jurisdictions with no apparent legitimate business purpose are a classic red flag for potential money laundering.

Question 274: Which doctrine holds that a corporation can be held liable for fraud committed by its employees acting within the scope of their employment?

Piercing the corporate veil
Alter ego
Respondeat superior (Correct answer)
Successor liability

Correct answer: Respondeat superior

Respondeat superior ('let the master answer') makes employers vicariously liable for torts, including fraud, committed by employees in the course of their duties.

Question 275: A money launderer uses a legitimate restaurant business to commingle illegal cash with daily sales receipts, inflating reported revenues. This primarily exploits which characteristic?

The cash-intensive nature of restaurant operations (Correct answer)
High employee turnover in food service
Restaurants' exemption from BSA reporting requirements
The perishable nature of restaurant inventory making audits difficult

Correct answer: The cash-intensive nature of restaurant operations

Cash-intensive businesses like restaurants are attractive for commingling because large cash revenues are normal and harder to distinguish from illicit funds.

Question 276: What does the term 'money laundering' specifically describe in the context of fraud investigations?

Overstating cash balances on financial statements
The process of making illegally obtained funds appear legitimate (Correct answer)
Converting personal assets into business assets to avoid taxes
Transferring funds between related business entities

Correct answer: The process of making illegally obtained funds appear legitimate

Money laundering is the process of concealing the origin of illegally obtained money by passing it through a complex sequence of banking transfers or commercial transactions.

Question 277: Which of the following is a key limitation of relying solely on past fraud losses to assess current fraud risk?

Past losses reflect detected frauds only and may miss undetected schemes (Correct answer)
Historical data is always overstated due to insurance recoveries
Historical data cannot be used in statistical models
Fraud loss data is protected by attorney-client privilege

Correct answer: Past losses reflect detected frauds only and may miss undetected schemes

Historical fraud loss data only captures detected and reported incidents, leaving undetected frauds — which may represent the majority — entirely unmeasured.

Question 278: Under the Sarbanes-Oxley Act, which officer must personally certify the accuracy of financial statements filed with the SEC?

Chief Financial Officer only
Chief Compliance Officer
Both CEO and CFO (Correct answer)
External auditor

Correct answer: Both CEO and CFO

SOX Section 302 requires both the CEO and CFO to personally certify the accuracy of financial reports filed with the SEC.

Question 279: Which of the following is an essential element required to prove a claim of common law fraud?

Justifiable reliance by the victim on the misrepresentation (Correct answer)
A written contract outlining the transaction
Proof of negligence on the part of the defendant
A fiduciary relationship between the plaintiff and defendant

Correct answer: Justifiable reliance by the victim on the misrepresentation

To establish a claim for fraud, the victim must prove they justifiably relied on the perpetrator's material misrepresentation. This means the victim's reliance was reasonable under the circumstances. The other options are not universally required elements; fraud can occur without a fiduciary relationship, a written contract, and it requires intent (scienter), not just negligence.

Question 280: Which governance structure is MOST effective at overseeing fraud risk management?

A committee of senior operational managers
External auditors serving as primary overseers
The CFO acting alone as chief risk officer
An audit committee composed of independent directors (Correct answer)

Correct answer: An audit committee composed of independent directors

An independent audit committee provides objective oversight of fraud risk because its members are not part of management and have no operational conflicts of interest.

Question 281: A constructive trust in fraud cases is best described as:

A court order freezing the defendant's assets
A formal trust agreement signed under duress
An equitable remedy imposing a trust on property obtained through fraud to benefit the victim (Correct answer)
A criminal forfeiture of illegally obtained property

Correct answer: An equitable remedy imposing a trust on property obtained through fraud to benefit the victim

A constructive trust is an equitable device that treats a fraud defendant as a trustee of wrongfully obtained property, compelling its transfer to the rightful owner.

Question 282: A company overstates its inventory balance by counting items that have already been sold. The primary effect of this manipulation on the financial statements is:

Overstated cost of goods sold and understated net income
Understated cost of goods sold and overstated net income (Correct answer)
Overstated revenue and understated liabilities
Understated revenue and overstated liabilities

Correct answer: Understated cost of goods sold and overstated net income

Overstating ending inventory reduces cost of goods sold on the income statement, which directly inflates gross profit and net income.

Question 283: Which governance concept refers to the separation of the roles of board chairman and chief executive officer?

Dual mandate principle
Leadership separation doctrine
Board duality (Correct answer)
Role bifurcation

Correct answer: Board duality

Board duality refers to having separate individuals serve as board chairman and CEO, which is considered a governance best practice to prevent power concentration.

Question 284: What is the primary objective of conducting a fraud risk assessment within an organization?

To guarantee the complete prevention of all fraudulent activities.
To assign accountability for past fraudulent incidents.
To fulfill the minimum requirements of regulatory compliance without further strategic action.
To proactively identify specific fraud schemes the organization is susceptible to and evaluate the controls mitigating those risks. [1] (Correct answer)

Correct answer: To proactively identify specific fraud schemes the organization is susceptible to and evaluate the controls mitigating those risks. [1]

The primary goal of a fraud risk assessment is to be a proactive tool that helps an organization identify its unique vulnerabilities to internal and external fraud. [5] By understanding these specific risks, management can then evaluate, design, and implement the most effective anti-fraud controls. [1] It is not primarily for assigning blame (investigation), and it cannot guarantee the prevention of all fraud.

Question 285: Which technique do fraudsters use to conceal improper related-party transactions in financial statements?

Including them in the auditor's report
Omitting disclosure and structuring them to appear arm's-length (Correct answer)
Reporting them in management discussion and analysis only
Recording them at above-market prices and disclosing them fully

Correct answer: Omitting disclosure and structuring them to appear arm's-length

Fraudsters hide related-party dealings by omitting required disclosures and pricing transactions as if conducted between unrelated parties.

Question 286: What is 'parallel construction' and why is it controversial in fraud investigations?

Using both forensic accounting and digital forensics in the same case
Simultaneously interviewing multiple witnesses to compare accounts
Concealing the true origin of evidence by reconstructing an alternative discovery narrative (Correct answer)
Building redundant evidence chains from multiple sources to corroborate findings

Correct answer: Concealing the true origin of evidence by reconstructing an alternative discovery narrative

Parallel construction conceals how evidence was originally obtained by creating a false alternative discovery story, raising serious legal and ethical concerns.

Question 287: Which of the following is considered a 'material weakness' under PCAOB standards?

A minor control gap identified by management during self-assessment
Any error found during an audit, regardless of dollar amount
A significant deficiency where there is a reasonable possibility of a material misstatement not being prevented or detected (Correct answer)
A control deficiency corrected before the fiscal year end

Correct answer: A significant deficiency where there is a reasonable possibility of a material misstatement not being prevented or detected

A material weakness is a significant deficiency in internal control where there is a reasonable possibility that a material misstatement of the financial statements would not be prevented or detected on a timely basis.

Question 288: A company capitalizes ordinary repair costs as long-term assets to reduce current expenses. This scheme primarily overstates:

Revenue
Net income and total assets (Correct answer)
Accounts receivable
Cash from financing activities

Correct answer: Net income and total assets

Capitalizing expenses reduces the current-period expense charge, inflating net income and simultaneously overstating assets on the balance sheet.

Question 289: A purchasing manager creates a fictitious vendor, approves invoices to that vendor, and diverts payments to a personal bank account. Which element distinguishes this from a simple billing scheme?

The absence of goods or services
The use of a personal bank account
The fictitious nature of the vendor (Correct answer)
The manager's approval authority

Correct answer: The fictitious nature of the vendor

A shell company or fictitious vendor scheme is specifically characterized by the vendor having no real existence, making it a subset of billing fraud.

Question 290: A Certified Fraud Examiner is reviewing a company's financial statements and notes a significant, unexplained increase in the book value of its assets, particularly in inventory and receivables. There is also a notable divergence between reported net income and cash flow from operations. According to the ACFE, these red flags are most commonly associated with which financial statement fraud scheme?

Fictitious revenues
Improper disclosures
Improper asset valuation (Correct answer)
Concealed liabilities and expenses

Correct answer: Improper asset valuation

Improper asset valuation involves inflating the value of assets to present a healthier financial picture. Red flags include unusual increases in the book value of assets like inventory and receivables, and a growing gap between reported profits and actual cash flow, which can indicate that the 'paper' profits are not being realized in cash.

Question 291: Which branch of law deals with private rights and remedies?

Civil law (Correct answer)
Criminal law.
Tax law.
Environmental law.

Correct answer: Civil law

Civil law deals with disputes between individuals, organizations, or between the two, focusing on private rights and remedies rather than criminal punishment. It covers areas such as contracts, property, personal injury, and family matters, aiming to resolve conflicts and provide compensation or specific performance to the injured party.

Question 292: In the context of email fraud investigations, what does 'email header analysis' primarily reveal?

The encryption method used
The recipient's read receipt status
The content of attachments
The routing path and originating server of a message (Correct answer)

Correct answer: The routing path and originating server of a message

Email headers contain 'Received' fields that trace the message's path through mail servers, helping identify the true originating IP address.

Question 293: The 'Wicklander-Zulawski' interview technique differs from the Reid Technique primarily in that it:

Prohibits the use of open-ended questions
Requires law enforcement presence during all interviews
Uses a non-accusatory, conversational approach to elicit admissions (Correct answer)
Relies exclusively on polygraph results to guide questioning

Correct answer: Uses a non-accusatory, conversational approach to elicit admissions

The WZ technique emphasizes a non-confrontational, non-accusatory conversational style to reduce resistance and encourage voluntary disclosures.

Question 294: Which situation represents a classic 'opportunity' factor that enables occupational fraud?

An employee is going through a divorce
A single employee both approves and processes vendor payments (Correct answer)
An employee believes management is dishonest
An employee wants a lifestyle beyond their salary

Correct answer: A single employee both approves and processes vendor payments

When one employee both approves and processes payments, they have unchecked access and control, creating a clear opportunity to commit and conceal fraud.

Question 295: Which laundering technique involves purchasing and reselling high-value assets such as real estate or jewelry to obscure the origins of illicit funds?

Asset conversion (Correct answer)
Smurfing
Structuring
Commingling

Correct answer: Asset conversion

Asset conversion is a layering technique where illegal proceeds are used to purchase legitimate assets that are later sold to generate apparently clean funds.

Question 296: In corporate ethics, the 'rationalization' element of the fraud triangle refers to:

The justification a fraudster uses to make their actions seem acceptable (Correct answer)
The organizational process for rationalizing budget variances
A fraudster's logical calculation of detection probability
The ethical reasoning used by compliance officers

Correct answer: The justification a fraudster uses to make their actions seem acceptable

Rationalization is the self-justification that allows fraudsters to reconcile their behavior with their self-image as honest people.

Question 297: Which financial statement fraud motivation is described by the 'pressure' element in the fraud triangle?

Rationalizing that the fraud is temporary or justified
Access to the accounting system through privileged credentials
Personal financial stress or pressure to meet earnings targets (Correct answer)
Weak internal controls that allow manipulation to go undetected

Correct answer: Personal financial stress or pressure to meet earnings targets

Pressure (or incentive) is the motivating force — such as debt, bonus targets, or analyst expectations — that drives a person to commit fraud.

Question 298: Under Federal Rule of Evidence 404(b), evidence of prior bad acts is generally inadmissible to prove character but may be admissible to prove:

Intent, knowledge, identity, motive, or absence of mistake (Correct answer)
That the defendant committed crimes throughout their life
The defendant's propensity to commit fraud
Prior convictions for any felony offense

Correct answer: Intent, knowledge, identity, motive, or absence of mistake

Rule 404(b) permits prior bad act evidence for purposes such as proving motive, opportunity, intent, preparation, plan, knowledge, identity, or absence of mistake or accident.

Question 299: Which of the following is a verbal cue that may indicate deception during an interview?

Recalling specific, and sometimes irrelevant, details of an event with ease.
Providing answers that are direct, spontaneous, and concise.
Using oaths or swearing to bolster the credibility of their statements. (Correct answer)
A consistent and firm denial of the allegation.

Correct answer: Using oaths or swearing to bolster the credibility of their statements.

Deceptive subjects may use oaths (e.g., "I swear to God," "on my honor") more frequently than truthful subjects to add weight to their false statements, believing it makes them more convincing. Truthful subjects often feel the facts will speak for themselves and have less need for such verbal crutches.

Question 300: An organization's fraud risk assessment reveals a high-likelihood, low-impact risk. The most appropriate management response is typically to:

Transfer the risk through insurance immediately
Accept the risk with no action
Implement cost-effective controls to reduce likelihood (Correct answer)
Escalate the risk to the board for immediate resolution

Correct answer: Implement cost-effective controls to reduce likelihood

High-likelihood, low-impact risks are best addressed by implementing controls that reduce how often the fraud could occur.

Question 301: When conducting a covert investigation, what is the BIGGEST risk of interviewing a suspect prematurely?

The suspect may file a defamation lawsuit
The suspect may request legal counsel
The investigation budget may be exceeded
The suspect may destroy evidence or alert co-conspirators (Correct answer)

Correct answer: The suspect may destroy evidence or alert co-conspirators

Premature suspect interviews can tip off the subject, causing evidence destruction, flight, or warnings to co-conspirators before the investigation is complete.

Question 302: In the structured sequence of interviewing, which type of question is used only when the fraud examiner is reasonably certain of the subject's guilt and all other reasonable investigative steps have been completed?

Informational Questions
Assessment Questions
Introductory Questions
Admission-Seeking Questions (Correct answer)

Correct answer: Admission-Seeking Questions

Admission-seeking questions are used in the final stage of the interview process, which is essentially an interrogation. They are direct, accusatory questions designed to obtain a confession after the investigation has yielded sufficient evidence to believe the subject is culpable.

Question 303: Which of the following is the most common organizational control for preventing conflicts of interest?

Mandatory job rotation every six months
External audit of all vendor contracts
Dual-signature requirements on all disbursements
Annual conflict of interest disclosure policy and certification (Correct answer)

Correct answer: Annual conflict of interest disclosure policy and certification

Requiring employees to annually disclose and certify any conflicts of interest is the most direct control for identifying undisclosed relationships.

Question 304: Which approach is most effective when an interview subject provides inconsistent statements?

Ignore inconsistencies to avoid disrupting rapport
Ask the subject to clarify and explain the inconsistency without accusation (Correct answer)
Immediately accuse the subject of lying and end the interview
Confront the subject with all evidence simultaneously

Correct answer: Ask the subject to clarify and explain the inconsistency without accusation

Asking the subject to clarify inconsistencies without accusation allows them to either correct genuine errors or further implicate themselves.

Question 305: A car salesman tells a potential buyer that a used car is "the best deal in town." The buyer purchases the car and later finds a similar car for a lower price elsewhere. Why would a fraud claim based on the salesman's statement likely fail?

The buyer suffered no financial damages.
The buyer did not sign a statement of reliance.
The salesman did not have a duty to disclose competitor pricing.
The statement was an opinion, not a misrepresentation of a material fact. (Correct answer)

Correct answer: The statement was an opinion, not a misrepresentation of a material fact.

The salesman's statement that the car is the "best deal in town" is considered puffery or a statement of opinion, not a statement of a material fact. For a statement to be an element of fraud, it must be a misrepresentation of an existing, verifiable fact. Opinions, predictions, or exaggerated sales talk are generally not actionable as fraud.

Question 306: What is the significance of 'paralinguistic cues' in fraud interviews?

They refer to the use of visual aids during the interview
They describe the physical arrangement of the interview room
They include vocal characteristics like tone, pace, and pitch that may indicate deception (Correct answer)
They are written behavioral assessment tools completed after the interview

Correct answer: They include vocal characteristics like tone, pace, and pitch that may indicate deception

Paralinguistic cues such as changes in voice pitch, speaking pace, and hesitations can provide additional context for assessing truthfulness.

Question 307: Which U.S. law requires financial transparency and accountability in corporations?

FOIA.
Sarbanes-Oxley Act (Correct answer)
FERPA.
HIPAA.

Correct answer: Sarbanes-Oxley Act

The Sarbanes-Oxley Act (SOX) is a U.S. federal law enacted in 2002 in response to major corporate accounting scandals. Its purpose is to protect investors by improving the accuracy and reliability of financial reporting in public companies. SOX mandates strict reforms to enhance corporate governance, internal controls, and accountability for financial transparency.

Question 308: Which of the following is one of the five principal categories of financial statement fraud as classified by the Association of Certified Fraud Examiners (ACFE)?

Corruption and bribery
Concealed liabilities and expenses (Correct answer)
Insider trading
Asset misappropriation

Correct answer: Concealed liabilities and expenses

The ACFE categorizes financial statement fraud into five main types: fictitious revenues, timing differences, improper asset valuations, concealed liabilities and expenses, and improper disclosures. Asset misappropriation and corruption are separate major categories of occupational fraud, and insider trading is a securities fraud.

Question 309: Under the Sarbanes-Oxley Act Section 806, which employees are protected from retaliation for reporting fraud?

Only employees who report fraud to the SEC directly
Any employee in the United States who reports any type of fraud
Employees of publicly traded companies and their contractors who report securities violations (Correct answer)
Only senior executives of publicly traded companies

Correct answer: Employees of publicly traded companies and their contractors who report securities violations

SOX Section 806 protects employees of publicly traded companies and their subsidiaries or contractors who report violations of securities laws or SEC rules.

Question 310: An employee is caught submitting personal expenses on a company credit card. The manager quietly returns the money and takes no further action. What fraud prevention principle does this violate?

The requirement to file insurance claims
The principle of consistent and transparent enforcement (Correct answer)
Mandatory external audit referral
The need for forensic analysis

Correct answer: The principle of consistent and transparent enforcement

Handling fraud quietly without formal action violates consistent enforcement, which is essential for maintaining credible deterrence and fairness.

Question 311: Which element is considered the most cost-effective fraud deterrent in an organization?

Strong internal controls (Correct answer)
Forensic accounting reviews
Insurance coverage
Frequent external audits

Correct answer: Strong internal controls

Strong internal controls are considered the most cost-effective deterrent because they proactively prevent fraud rather than detect it after the fact.

Question 312: Which digital forensics concept ensures that a forensic copy is an exact bit-for-bit duplicate of the original storage media?

Chain of custody documentation
Hash value verification (Correct answer)
Metadata extraction
File carving

Correct answer: Hash value verification

Hash values (MD5, SHA-256) generated before and after copying verify that the forensic image is an exact duplicate and has not been altered.

Question 313: According to ACFE research, what percentage of occupational fraud cases are detected through tips?

About 65%
About 43% (Correct answer)
About 20%
About 10%

Correct answer: About 43%

ACFE's Report to the Nations consistently shows that tips are the most common detection method, accounting for roughly 43% of cases.

Question 314: Which of the following best describes the role of an audit committee in fraud governance?

Approving all major vendor contracts to prevent kickbacks
Conducting investigations into all fraud allegations internally
Performing day-to-day transaction testing and reconciliations
Providing independent oversight of financial reporting and internal controls on behalf of the board (Correct answer)

Correct answer: Providing independent oversight of financial reporting and internal controls on behalf of the board

The audit committee serves as an independent body within the board that oversees the integrity of financial reporting, the effectiveness of internal controls, and the activities of both internal and external auditors.

Question 315: Which ACFE statistic highlights the importance of proactive fraud detection in financial statement fraud cases?

External auditors detect financial statement fraud in the majority of cases
The median duration of financial statement fraud is longer than other fraud schemes, averaging over 24 months (Correct answer)
Most cases are detected within the first month after fraud begins
Financial statement fraud is more commonly self-reported by perpetrators than other schemes

Correct answer: The median duration of financial statement fraud is longer than other fraud schemes, averaging over 24 months

ACFE Report to the Nations data consistently shows financial statement fraud schemes persist for a median of 24+ months, causing greater total losses the longer they go undetected.

Question 316: Which international anti-corruption framework requires companies to conduct due diligence on third-party agents to avoid liability for bribery committed on their behalf?

US Dodd-Frank whistleblower provisions
US Sherman Antitrust Act
Sarbanes-Oxley Act Section 302
UK Bribery Act 2010 (Correct answer)

Correct answer: UK Bribery Act 2010

The UK Bribery Act's Section 7 corporate offense requires organizations to implement 'adequate procedures,' including third-party due diligence, to avoid liability for bribery by associated persons.

Question 317: What is the primary difference between 'concealment' money laundering and 'promotion' money laundering under 18 U.S.C. § 1956?

Concealment is a civil violation; promotion is a criminal offense
Concealment involves drug proceeds only; promotion applies to all crimes
Concealment hides proceeds of past crimes; promotion uses funds to facilitate future crimes (Correct answer)
Concealment requires a foreign transaction; promotion is domestic only

Correct answer: Concealment hides proceeds of past crimes; promotion uses funds to facilitate future crimes

Concealment money laundering involves disguising the nature or source of criminal proceeds, while promotion money laundering uses those proceeds to further criminal activity.

Question 318: A fraudster purchases lottery tickets at face value, then claims to have 'won' the lottery to explain a large cash windfall. This technique is called:

Loan-back scheme
Layering (Correct answer)
Round-tripping
White label laundering

Correct answer: Layering

Purchasing winning lottery tickets from actual winners to explain illicit funds is a form of layering that creates a legitimate-appearing source of income.

Question 319: Which of the following best describes a 'kickback' scheme in the context of occupational fraud?

A vendor secretly pays an employee for directing business to that vendor (Correct answer)
A manager inflates their expense report for personal gain
An employee steals cash directly from the company register
An executive misrepresents revenue on financial statements

Correct answer: A vendor secretly pays an employee for directing business to that vendor

A kickback is a secret payment made by a vendor to an employee in exchange for steering business or favorable contract terms to that vendor.

Question 320: Which COSO component is most directly addressed when an organization identifies fraud risk as part of its enterprise risk management process?

Control activities
Information and communication
Risk assessment (Correct answer)
Monitoring activities

Correct answer: Risk assessment

COSO's ERM framework places fraud risk identification within the Risk Assessment component, which involves identifying and analyzing risks to achieving objectives.

Question 321: Under the Dodd-Frank Act, SEC whistleblowers who provide original information leading to enforcement actions resulting in sanctions over $1 million may receive:

5–10% of sanctions collected
A fixed award of $100,000
25–50% of sanctions collected
10–30% of sanctions collected (Correct answer)

Correct answer: 10–30% of sanctions collected

The Dodd-Frank Act provides eligible whistleblowers 10–30% of monetary sanctions collected in SEC enforcement actions exceeding $1 million.

Question 322: What is 'structuring' (also known as 'smurfing') in the context of financial fraud?

Creating a corporate structure to hide beneficial ownership
Structuring loan repayments to minimize interest costs
Breaking large cash transactions into smaller amounts to avoid CTR reporting requirements (Correct answer)
Organizing financial records into structured databases for analysis

Correct answer: Breaking large cash transactions into smaller amounts to avoid CTR reporting requirements

Structuring involves deliberately breaking up cash transactions into amounts below $10,000 to avoid triggering Currency Transaction Report requirements, which is itself a federal crime.

Question 323: A supervisor approves overtime for employees who did not actually work those hours, splitting the fraudulent pay. This is classified as:

Falsified hours and salary scheme (Correct answer)
Ghost employee scheme
Expense reimbursement fraud
Commission scheme

Correct answer: Falsified hours and salary scheme

Falsified hours and salary schemes involve misrepresenting time worked or pay rates to fraudulently increase payroll disbursements.

Question 324: In a kickback scheme involving procurement, which party typically initiates the fraudulent arrangement?

An external auditor
The CFO
A government regulator
A company employee with purchasing authority (Correct answer)

Correct answer: A company employee with purchasing authority

Kickback schemes typically involve an employee with purchasing authority who awards contracts to vendors in exchange for secret payments.

Question 325: The FCPA applies to which of the following entities?

Only publicly traded Fortune 500 companies
Only US government contractors
US issuers, domestic concerns, and certain foreign persons acting within the US (Correct answer)
Only multinational corporations with revenues exceeding $1 billion

Correct answer: US issuers, domestic concerns, and certain foreign persons acting within the US

The FCPA applies broadly to US issuers (public companies), US domestic concerns (citizens, nationals, residents, and US businesses), and foreign persons who take acts in furtherance of an FCPA violation while in the US.

Question 326: The ACFE recommends that organizations implement a fraud risk assessment as part of their overall anti-fraud program. What is the primary output of a fraud risk assessment?

A schedule for conducting surprise audits throughout the year
A prioritized inventory of fraud risks and the controls designed to mitigate each risk (Correct answer)
A complete list of all employees who have access to financial systems
A report on historical fraud losses for insurance purposes

Correct answer: A prioritized inventory of fraud risks and the controls designed to mitigate each risk

A fraud risk assessment produces a prioritized register of identified fraud risks, the likelihood and impact of each, and maps existing or needed controls to each risk.

Question 327: Why is documentation critical in investigations?

It reduces staff workload.
It speeds up the trial process.
It ensures consistency and builds credibility (Correct answer)
It confuses the defense attorneys.

Correct answer: It ensures consistency and builds credibility

Thorough documentation is critical in investigations because it provides a clear, verifiable record of all steps taken, evidence collected, and conclusions reached. This meticulous record-keeping ensures consistency throughout the investigation, supports the findings with credible evidence, and can withstand scrutiny in legal proceedings, building overall credibility.

Question 328: During a fraud risk assessment, an interviewer asks employees whether they are aware of any pressure to meet financial targets through questionable methods. This technique primarily assesses which fraud triangle element?

Rationalization
Opportunity
Pressure/Incentive (Correct answer)
Capability

Correct answer: Pressure/Incentive

Questions about pressure to meet financial targets directly probe the Pressure/Incentive leg of the fraud triangle.

Question 329: During a fraud investigation, an examiner discovers a suspect used TOR (The Onion Router). What limitation does TOR use present for investigators?

TOR encrypts and routes traffic through multiple relays, masking the user's true IP address (Correct answer)
TOR is illegal to use, making prosecution straightforward
TOR creates permanent log files accessible to law enforcement
TOR only works on mobile devices, limiting its use

Correct answer: TOR encrypts and routes traffic through multiple relays, masking the user's true IP address

TOR anonymizes internet traffic by routing it through a series of encrypted relay nodes, making it extremely difficult to trace the originating IP address.

Question 330: Which internal control weakness most commonly enables procurement fraud to occur?

Inadequate cybersecurity controls
Insufficient physical security over inventory
Absence of an employee assistance program
Lack of segregation of duties in the purchasing and payment cycle (Correct answer)

Correct answer: Lack of segregation of duties in the purchasing and payment cycle

Allowing one employee to both authorize purchases and approve payments removes the cross-check that would detect fictitious vendors or inflated invoices.

Question 331: An examiner discovers that a suspect used a virtual machine (VM) for financial transactions. Where is the most valuable forensic data typically found?

The suspect's email client on the host machine
The VM's .vmdk or .vhd disk image file on the host system (Correct answer)
The VM software's installation directory
The host operating system's pagefile.sys only

Correct answer: The VM's .vmdk or .vhd disk image file on the host system

The virtual disk image file (.vmdk, .vhd) contains the entire guest OS file system and can be mounted and examined like a physical drive.

Question 332: Which component of an ethics program is MOST critical for setting the right organizational culture?

Whistleblower hotline
Annual compliance training
Written code of conduct
Tone at the top from leadership (Correct answer)

Correct answer: Tone at the top from leadership

Tone at the top—the ethical example set by senior management—is widely considered the most critical factor in establishing an anti-fraud culture.

Question 333: In a 'forced balancing' scheme, an employee manipulates bank reconciliations by:

Stealing cash and replacing it with IOUs recorded as reconciling items
Delaying deposits to inflate the apparent cash balance at period end
Inserting fabricated reconciling items to make the books match the bank statement despite discrepancies (Correct answer)
Creating fictitious bank accounts to hide diverted funds

Correct answer: Inserting fabricated reconciling items to make the books match the bank statement despite discrepancies

Forced balancing involves entering false reconciling items—such as unsupported adjustments or fictitious outstanding checks—to mask cash theft in reconciliation records.

Question 334: Under the Sarbanes-Oxley Act Section 1348, securities fraud carries a maximum prison sentence of:

20 years (Correct answer)
25 years
10 years
5 years

Correct answer: 20 years

SOX Section 1348 established a maximum 20-year prison sentence for securities fraud, significantly increasing penalties from pre-SOX levels.

Question 335: When investigating a potential bribery scheme, which document type is most valuable for identifying undisclosed relationships between an employee and a vendor?

Petty cash logs
Bank reconciliation statements
Fixed asset registers
Conflict of interest disclosure forms (Correct answer)

Correct answer: Conflict of interest disclosure forms

Conflict of interest disclosure forms require employees to declare personal relationships or financial interests in vendors, making them a primary document in bribery investigations.

Question 336: Which of the following best describes the 'assumptive question' technique in interrogation?

Asking questions that assume the subject's innocence to build rapport
Phrasing questions that presuppose the subject's guilt to elicit admissions (Correct answer)
Repeating questions multiple times to catch inconsistencies
Using hypothetical scenarios to gauge the subject's reaction

Correct answer: Phrasing questions that presuppose the subject's guilt to elicit admissions

Assumptive questions are worded as if the subject's involvement is already established, making denial more difficult.

Question 337: What is 'proactive data analysis' in the context of fraud deterrence?

Investigating fraud after it is reported
Training employees on data security
Auditing data backups annually
Continuously monitoring transactions to detect anomalies before losses escalate (Correct answer)

Correct answer: Continuously monitoring transactions to detect anomalies before losses escalate

Proactive data analysis involves continuously reviewing transaction data for red flags and anomalies to catch potential fraud early, before significant losses occur.

Question 338: A Certified Fraud Examiner is questioning a subject about potential expense reimbursement fraud. The examiner states, "With the intense pressure to meet sales goals and the complicated expense reporting system, I can understand how someone might bend the rules just to keep up." Which persuasion technique is the examiner using?

Minimizing the moral seriousness of the act
Directly accusing the subject with evidence
Projecting blame onto the victim or company
Offering a morally acceptable reason for the behavior (Correct answer)

Correct answer: Offering a morally acceptable reason for the behavior

This is an example of rationalization. The examiner is providing a morally justifiable or understandable reason for the subject's potential actions, making it psychologically easier for the subject to confess. This technique is designed to show empathy and reduce the subject's resistance to admitting guilt.

Question 339: Which of the following is a red flag for accounts payable fraud?

Employee training sessions.
Consistent supplier pricing.
Regular audit cycles.
Multiple payments to the same invoice (Correct answer)

Correct answer: Multiple payments to the same invoice

Multiple payments to the same invoice is a significant red flag for accounts payable fraud. This irregularity suggests that a fraudster might be processing duplicate payments, often diverting the extra funds to an unauthorized account they control. Such an anomaly indicates a breakdown in internal controls and warrants immediate investigation to prevent financial loss.

Question 340: The RICO statute (18 U.S.C. § 1961–1968) requires proof of a 'pattern of racketeering activity,' which typically means:

Continuous criminal activity for at least five years
One predicate act committed by multiple defendants
At least two related predicate acts within a ten-year period (Correct answer)
Three or more co-conspirators

Correct answer: At least two related predicate acts within a ten-year period

A RICO pattern requires at least two predicate offenses (including fraud) that are related and continuous, occurring within a ten-year period.

Question 341: In a real estate money laundering scheme, which tactic is most commonly used during the integration stage?

Transferring title through a series of shell LLCs
Purchasing property with cash and reselling at market value (Correct answer)
Mortgaging a property and defaulting on the loan
Renting properties to collect legitimate rental income

Correct answer: Purchasing property with cash and reselling at market value

Buying property with dirty cash and selling it converts illicit funds into apparently legitimate proceeds from a real estate transaction.

Question 342: When documenting witness statements during a fraud investigation, what is the preferred method to ensure accuracy?

Recording verbatim responses and having the witness review and sign (Correct answer)
Relying solely on investigator memory without written notes
Paraphrasing the witness's account in the investigator's own words
Summarizing key points in bullet form without witness review

Correct answer: Recording verbatim responses and having the witness review and sign

Recording verbatim responses and obtaining witness review and signature ensures accuracy and reduces disputes about what was said during the interview.

Question 343: When investigating a suspected procurement fraud, which document should a fraud examiner prioritize obtaining first?

Personnel records of suspected employees
Bank statements of the suspect vendor
Contracts, purchase orders, and invoices related to suspect vendors (Correct answer)
Competitor bid records

Correct answer: Contracts, purchase orders, and invoices related to suspect vendors

Contracts, purchase orders, and invoices form the paper trail at the core of procurement fraud and establish the basis for comparing authorized versus actual transactions.

Question 344: Which PCAOB standard requires external auditors to assess the risk of material misstatement due to fraud?

AS 2101
AS 2401 (Correct answer)
AS 2605
AS 3101

Correct answer: AS 2401

PCAOB AS 2401 (Consideration of Fraud in a Financial Statement Audit) requires auditors to explicitly consider fraud risks during audit planning and execution.

Question 345: Which of the following best describes 'regulatory capture' as an ethics concern?

A regulator physically seizing a company's records during an investigation
A company capturing market share through regulatory arbitrage
Corporate espionage targeting regulatory agencies
A regulatory agency coming to advance the interests of those it is supposed to regulate (Correct answer)

Correct answer: A regulatory agency coming to advance the interests of those it is supposed to regulate

Regulatory capture occurs when a regulatory agency is dominated by the industry it is supposed to oversee, undermining independent oversight.

Question 346: Which element distinguishes criminal fraud from civil fraud in most U.S. jurisdictions?

Whether the victim is an individual or corporation
The geographic scope of the scheme
The burden of proof standard — beyond a reasonable doubt vs. preponderance of evidence (Correct answer)
The amount of financial loss

Correct answer: The burden of proof standard — beyond a reasonable doubt vs. preponderance of evidence

Criminal fraud requires proof beyond a reasonable doubt, while civil fraud is proven by a preponderance of the evidence (more likely than not).

Question 347: Which component of the COSO Internal Control framework addresses the organization's commitment to integrity and ethical values?

Monitoring Activities
Risk Assessment
Control Activities
Control Environment (Correct answer)

Correct answer: Control Environment

The Control Environment is the foundation of COSO's framework and includes the tone set by management regarding integrity, ethics, and governance.

Question 348: A payroll clerk adds a deceased employee to the payroll for two months after death, depositing checks into a joint account. This is BEST classified as:

Expense reimbursement fraud
Falsified hours scheme
Ghost employee scheme (Correct answer)
Commission scheme

Correct answer: Ghost employee scheme

Continuing to pay a deceased employee without authorization creates a ghost employee—a fraudulent payroll record for a person who cannot work.

Question 349: Which auditing standard requires external auditors to assess the risk of material misstatement due to fraud in every audit?

AU-C Section 240 / ISA 240 (Correct answer)
SAS No. 70
ISAE 3402
PCAOB AS 2201

Correct answer: AU-C Section 240 / ISA 240

AU-C 240 (US GAAS) and ISA 240 (international) require auditors to specifically consider and assess the risk of material misstatement arising from fraud in every financial statement audit.

Question 350: Which analytical procedure compares each financial statement line item as a percentage of a base figure within the same period?

Trend analysis
Horizontal analysis
Regression analysis
Vertical (common-size) analysis (Correct answer)

Correct answer: Vertical (common-size) analysis

Vertical analysis expresses each line item as a percentage of a base (e.g., total assets or net sales), enabling within-period structural comparisons.

Question 351: Which internal control can prevent fraudulent check tampering?

Annual company retreat.
Loyalty reward programs.
Segregation of duties (Correct answer)
Centralized payroll authority.

Correct answer: Segregation of duties

Segregation of duties is a crucial internal control that can prevent fraudulent check tampering. By separating the responsibilities for authorizing payments, preparing checks, signing checks, and reconciling bank statements among different individuals, it becomes much harder for any single person to commit and conceal fraud. This control introduces a system of checks and balances, reducing the opportunity for illicit activities.

Question 352: Which type of financial statement fraud involves recording revenue before it has been earned or before the earnings process is complete?

Fictitious revenue
Premature revenue recognition (Correct answer)
Revenue smoothing
Channel stuffing

Correct answer: Premature revenue recognition

Premature revenue recognition records sales before all conditions for revenue recognition under accounting standards have been met.

Question 353: The statute of limitations for civil RICO claims under federal law is:

7 years from the commencement of the enterprise
2 years from discovery of the injury
4 years from discovery of the injury (Correct answer)
5 years from the last predicate act

Correct answer: 4 years from discovery of the injury

The Supreme Court established a four-year statute of limitations for civil RICO claims, running from when the plaintiff discovered or should have discovered the injury.

Question 354: Under COSO's Enterprise Risk Management framework, which of the following is an example of a 'risk appetite' statement?

The company's external auditor assesses fraud risk annually
The company will never exceed a 2% loss ratio on its investment portfolio (Correct answer)
The company will conduct quarterly risk assessments in all business units
The company maintains directors and officers liability insurance

Correct answer: The company will never exceed a 2% loss ratio on its investment portfolio

A risk appetite statement defines the amount of risk an organization is willing to accept in pursuit of its objectives, expressed as a quantitative threshold.

Question 355: What is a 'subcontractor kickback' scheme in construction procurement fraud?

A general contractor receiving secret payments from subcontractors in exchange for favorable subcontract awards (Correct answer)
A contractor billing for unauthorized subcontract work
A subcontractor paying workers off the books
A subcontractor overcharging the prime contractor

Correct answer: A general contractor receiving secret payments from subcontractors in exchange for favorable subcontract awards

In a subcontractor kickback scheme, a general contractor's employee steers subcontracts to certain firms in exchange for secret payments, inflating overall project costs.

Question 356: A warehouse employee steals raw materials and conceals the theft by falsifying inventory count sheets. The ACFE classifies this under which broad category?

Corruption
Cash on hand theft
Non-cash misappropriation (Correct answer)
Fraudulent statements

Correct answer: Non-cash misappropriation

Theft of non-cash assets such as inventory or supplies falls under the non-cash misappropriation category of asset misappropriation.

Question 357: During a fraud investigation, a key witness refuses to cooperate. In a private investigation (non-law enforcement), what legal tool can COMPEL testimony?

A search warrant
A grand jury subpoena
An arrest warrant
A civil subpoena issued through litigation (Correct answer)

Correct answer: A civil subpoena issued through litigation

In civil proceedings, a subpoena can compel witness testimony or document production; private investigators without law enforcement authority must rely on civil process.

Question 358: During a fraud interview, a subject crosses their arms, avoids eye contact, and turns slightly away. These behaviors are best described as:

Signs the subject is about to confess
Indicators of cooperation
Possible signs of discomfort that require additional context (Correct answer)
Clear indicators of deception

Correct answer: Possible signs of discomfort that require additional context

Nonverbal behaviors must be interpreted in clusters and context, as no single behavior reliably indicates deception.

Question 359: Which interview technique involves asking a suspect to recount events in reverse chronological order to detect deception?

PEACE model
Strategic Use of Evidence (SUE)
Reverse order questioning (Correct answer)
Cognitive interview technique

Correct answer: Reverse order questioning

Reverse order questioning asks subjects to recount events backwards, which is cognitively demanding for liars but easier for truthful subjects who recall actual memories.

Question 360: In the context of ACFE's fraud tree, where do procurement and vendor fraud schemes primarily fall?

Financial statement fraud
Corruption
Asset misappropriation
Both corruption and asset misappropriation depending on the scheme (Correct answer)

Correct answer: Both corruption and asset misappropriation depending on the scheme

Procurement fraud schemes span multiple branches: kickbacks and conflicts of interest fall under Corruption, while shell company invoicing and overbilling fall under Asset Misappropriation.

Question 361: Which characteristic most distinguishes a pyramid scheme from a Ponzi scheme?

In pyramid schemes, participants actively recruit new members to earn returns (Correct answer)
Pyramid schemes always involve securities fraud while Ponzi schemes do not
Pyramid schemes always involve physical goods while Ponzi schemes are purely financial
Ponzi schemes require a central operator while pyramid schemes are self-sustaining indefinitely

Correct answer: In pyramid schemes, participants actively recruit new members to earn returns

In pyramid schemes, each participant must recruit others to earn money, creating an exponentially growing recruitment requirement that guarantees collapse.

Question 362: What is the primary difference between cash larceny and skimming?

Cash larceny is the theft of cash that has already been recorded on the company's books, while skimming is the theft of off-book funds. (Correct answer)
Cash larceny is a fraudulent disbursement scheme, while skimming is a corruption scheme.
Skimming involves stealing cash that has already been recorded on the company's books, while cash larceny is the theft of off-book funds.
Cash larceny involves stealing from the cash register, while skimming involves stealing inventory.

Correct answer: Cash larceny is the theft of cash that has already been recorded on the company's books, while skimming is the theft of off-book funds.

The key distinction between cash larceny and skimming lies in the timing of the theft relative to the company's accounting records. Cash larceny is the theft of cash that has already been entered into the accounting system ('on-book' theft). Skimming is the theft of cash before it has been recorded ('off-book' theft), which makes it harder to detect as there is no initial record of the funds.

Question 363: Which analytical procedure is MOST effective at detecting fictitious vendor invoices when no goods or services were received?

Three-way matching of purchase orders, receiving reports, and invoices (Correct answer)
Aging of accounts receivable
Bank reconciliation
Payroll register review

Correct answer: Three-way matching of purchase orders, receiving reports, and invoices

Three-way matching requires a purchase order, a receiving report confirming delivery, and an invoice to all agree before payment is authorized, exposing invoices with no corresponding receipt of goods.

Question 364: Which of the following scenarios lacks the essential element of 'damages' for a successful civil fraud claim?

A buyer is induced by a false statement to purchase a worthless piece of land.
A homeowner pays a contractor for expensive repairs that were never actually performed.
An investor is told a company's stock will double, buys it, but sells it a week later for a small profit before the fraud is revealed. (Correct answer)
A person invests in a company based on fraudulent financial statements and loses their entire investment.

Correct answer: An investor is told a company's stock will double, buys it, but sells it a week later for a small profit before the fraud is revealed.

To prove fraud in a civil case, the victim must have suffered actual, measurable damages as a result of the misrepresentation. In the scenario where the investor sold the stock for a profit, they did not suffer a financial loss, even though they were deceived. The other scenarios all involve a clear financial loss directly resulting from the fraud.

Question 365: Which of the following activities is the clearest indicator of "structuring," a money laundering technique designed to evade reporting requirements?

Making multiple cash deposits, each just under $10,000, at different branches or on different days. (Correct answer)
Commingling illicit cash with the daily receipts of a legitimate cash-intensive business.
Using a single, large wire transfer to move funds to an offshore jurisdiction known for bank secrecy.
Exchanging a large volume of small-denomination bills for large-denomination bills.

Correct answer: Making multiple cash deposits, each just under $10,000, at different branches or on different days.

Structuring, also known as smurfing, specifically refers to the act of breaking up large cash transactions into smaller, individual transactions to fall below the currency transaction reporting (CTR) threshold, which is over $10,000 in the U.S. [2, 3, 7] This is done to avoid the automatic reporting that such a large transaction would trigger. [1, 6]

Question 366: A fraud examiner is reviewing an organization's internal controls. Which condition most increases the risk that internal controls will fail to prevent fraud?

Hiring new employees without industry experience
The use of manual rather than automated controls
Outsourcing payroll to a third-party provider
Management override of established controls (Correct answer)

Correct answer: Management override of established controls

Management override is a significant fraud risk because those with authority can circumvent even well-designed controls, which is why it is identified in both COSO and ISA 240.

Question 367: What is a deposition in legal proceedings?

A witness statement at trial.
A ruling by a judge.
A lawyer’s closing argument.
A sworn testimony taken before trial (Correct answer)

Correct answer: A sworn testimony taken before trial

A deposition is a formal, out-of-court sworn testimony of a witness or party involved in a lawsuit, taken under oath before a court reporter. It allows attorneys to gather information, assess witness credibility, and preserve testimony for potential use at trial, helping to prepare for litigation and discover facts.

Question 368: Why do fraudsters use shell companies?

To comply with regulations.
To reduce business complexity.
To facilitate fraudulent financial transactions (Correct answer)
To attract investors.

Correct answer: To facilitate fraudulent financial transactions

Fraudsters use shell companies primarily to facilitate fraudulent financial transactions by creating a facade of legitimate business activity. These non-operating entities are often used to generate fake invoices, funnel illicit funds, or obscure the true beneficiaries of transactions. This tactic makes it significantly harder for auditors and investigators to trace the flow of money and identify the perpetrators of fraud.

Question 369: A deferred prosecution agreement (DPA) between a corporation and the DOJ typically requires the corporation to:

Admit to factual allegations, pay penalties, and implement compliance reforms while prosecution is suspended (Correct answer)
Dismiss all employees involved in the underlying conduct
Waive all attorney-client privilege permanently
Plead guilty to all charged offenses before the agreement takes effect

Correct answer: Admit to factual allegations, pay penalties, and implement compliance reforms while prosecution is suspended

Under a DPA, prosecution is deferred while the company agrees to cooperate, pay financial penalties, accept compliance monitors if required, and remediate the conduct—with charges dismissed upon successful completion.

Question 370: Which statement BEST describes the role of internal audit in corporate governance?

Internal audit reports to the CFO to ensure financial accuracy
Internal audit replaces the need for an external auditor
Internal audit provides independent assurance on risk management and controls (Correct answer)
Internal audit's primary duty is detecting employee theft

Correct answer: Internal audit provides independent assurance on risk management and controls

Internal audit provides independent, objective assurance to the board and management on the effectiveness of governance, risk management, and internal controls.

Question 371: Which financial transaction is considered suspicious?

A recurring monthly rent payment.
Payroll direct deposit.
Bank loan disbursement.
A $9,999 cash deposit (Correct answer)

Correct answer: A $9,999 cash deposit

A $9,999 cash deposit is considered suspicious because it is just below the $10,000 threshold that triggers mandatory reporting to the IRS via a Currency Transaction Report (CTR). This practice, known as 'structuring,' is often used to avoid detection by financial institutions and law enforcement, suggesting potential money laundering or other illicit activities.

Question 372: What is the best use of silence during a fraud interview?

Silence signals to the subject that the interview has concluded
Silence should always be filled by the examiner with follow-up questions
Silence is only appropriate after obtaining a full confession
Strategic silence after a question encourages the subject to fill the void with more information (Correct answer)

Correct answer: Strategic silence after a question encourages the subject to fill the void with more information

People are uncomfortable with silence and often continue speaking to fill it, sometimes revealing information they had not intended to share.

Question 373: Which type of internal control is designed to detect fraud after it has occurred?

Corrective control
Detective control (Correct answer)
Directive control
Preventive control

Correct answer: Detective control

Detective controls are designed to identify and surface fraud or errors that have already occurred, such as account reconciliations or exception reports.

Question 374: What is 'mens rea' in legal terms?

Physical evidence found at a crime scene.
A motive based on financial gain.
The criminal intent of a person committing the act (Correct answer)
A type of legal contract.

Correct answer: The criminal intent of a person committing the act

'Mens rea' is a Latin term meaning 'guilty mind' and refers to the criminal intent or mental state of a person when committing an act. For most crimes, the prosecution must prove that the defendant acted with a specific criminal intent, alongside the physical act (actus reus), to establish culpability and secure a conviction.

Question 375: What is the purpose of a MD5 or SHA-256 hash in digital forensics?

To index files for rapid keyword searching
To encrypt sensitive case notes
To compress evidence files for storage efficiency
To verify that a forensic copy is identical to the original evidence (Correct answer)

Correct answer: To verify that a forensic copy is identical to the original evidence

Cryptographic hashes create a unique digital fingerprint of data; matching hashes between original and copy confirm that no bits were altered during acquisition.

Question 376: What is a common deterrent used by organizations?

Anonymous tip hotlines (Correct answer)
Community outreach events.
Social media posts.
Unmonitored forums.

Correct answer: Anonymous tip hotlines

Anonymous tip hotlines are a highly effective deterrent and detection mechanism for fraud. They provide a safe and confidential channel for employees, customers, or other stakeholders to report suspicious activities without fear of retaliation, often leading to the discovery of fraud that might otherwise go undetected and enabling timely investigation.

Question 377: A sales representative collects customer cash payments and records them as 'sales returns' to balance the books. This concealment technique is known as:

Conversion
False account entries
Lapping
Write-off scheme (Correct answer)

Correct answer: Write-off scheme

Recording stolen cash as fictitious write-offs, returns, or discounts is a false account entries concealment method used in skimming schemes.

Question 378: Which of the following scenarios most clearly illustrates 'collusion risk' in a fraud risk assessment?

A single employee who has both custody of assets and recording responsibility
A manager who fails to review monthly bank reconciliations
Two employees who agree to circumvent segregation of duties controls together (Correct answer)
An IT administrator with excessive system access privileges

Correct answer: Two employees who agree to circumvent segregation of duties controls together

Collusion risk arises when two or more individuals work together to bypass controls that would prevent fraud by a single person.

Question 379: In a bill-and-hold arrangement used fraudulently, the seller records revenue even though:

The price has not been agreed upon
The invoice has not been issued
The buyer has not yet placed an order
The goods have not been shipped and the buyer has no risk of ownership (Correct answer)

Correct answer: The goods have not been shipped and the buyer has no risk of ownership

Fraudulent bill-and-hold schemes book revenue while goods remain with the seller and the buyer bears no real risk, violating revenue recognition criteria.

Question 380: Which of the following is a key indicator of trade-based money laundering (TBML)?

Shipments insured for replacement value
Consistent invoice amounts matching market prices
Use of letters of credit with major banks
Over- or under-invoicing of goods and services (Correct answer)

Correct answer: Over- or under-invoicing of goods and services

Over- or under-invoicing is the primary TBML technique, allowing the transfer of value between parties while disguising the true nature of funds.

Question 381: What does 'bid suppression' mean in a bid rigging conspiracy?

Artificially lowering a bid to win a contract
Suppressing bid results from public disclosure
Withdrawing a previously submitted bid
Agreeing not to submit a bid so that a designated conspirator wins (Correct answer)

Correct answer: Agreeing not to submit a bid so that a designated conspirator wins

Bid suppression occurs when one or more competitors agree to refrain from submitting bids so that a pre-selected conspirator wins the contract unopposed.

Question 382: What is chain of custody?

A method of conducting audits.
The order of suspect interrogation.
Legal rights of investigators.
Tracking the handling of evidence (Correct answer)

Correct answer: Tracking the handling of evidence

Chain of custody refers to the documented chronological history of the seizure, custody, control, transfer, analysis, and disposition of physical or electronic evidence. Maintaining a strict chain of custody ensures the integrity and authenticity of evidence, proving that it has not been tampered with and is admissible in court.

Question 383: What is the primary purpose of a board audit committee in the context of fraud prevention?

Overseeing financial reporting and internal controls (Correct answer)
Selecting the company's external legal counsel
Approving executive compensation packages
Managing day-to-day accounting operations

Correct answer: Overseeing financial reporting and internal controls

The audit committee oversees financial reporting integrity, internal controls, and the external audit process to detect and prevent fraud.

Question 384: During a financial statement fraud investigation, which source best corroborates reported revenue figures?

Internal sales reports prepared by management
Board-approved budgets
Third-party bank statements and customer confirmations (Correct answer)
Prior-year audited financial statements

Correct answer: Third-party bank statements and customer confirmations

Bank statements and direct customer confirmations are independent of management and provide the strongest corroboration that cash was actually received for claimed sales.

Question 385: When examining a suspicious electronic document, a fraud examiner analyzes its metadata. Which of the following pieces of information is an example of what could be found in the file's metadata?

A complete history of all text that was ever deleted from the document.
A recording of the keystrokes used to create the document's content.
The dates the file was created and last modified. [31, 35] (Correct answer)
The IP address of every computer that has ever accessed the file.

Correct answer: The dates the file was created and last modified. [31, 35]

Metadata is "data about data." For a file, it includes properties such as the file creation date, last modification date, last access date, and the author's name or user account. [31, 32, 35] This information can be critical in a fraud investigation to establish a timeline of events and determine who was responsible for the document's contents. [33, 34]

Question 386: Which Miranda warning element is most critical to establish before conducting a custodial interrogation?

The right to a speedy trial
The right to remain silent (Correct answer)
The right to confront witnesses
The right to a jury trial

Correct answer: The right to remain silent

Miranda warnings must inform suspects of their right to remain silent before custodial interrogations, or statements may be suppressed.

Question 387: A company's senior management team consistently emphasizes the importance of meeting aggressive quarterly revenue targets. They offer substantial bonuses for hitting these targets and publicly criticize managers who fall short. However, the company's official code of conduct explicitly prohibits channel stuffing and recording sales before they are earned. When an internal audit discovers that a sales manager has been pressuring staff to ship unordered products to distributors at the end of a quarter, this situation MOST directly indicates a failure in:

The company's whistleblower protection program.
The establishment of a proper 'tone at the top'. (Correct answer)
The segregation of duties within the sales department.
The external audit function's oversight.

Correct answer: The establishment of a proper 'tone at the top'.

The 'tone at the top' refers to the ethical atmosphere created by the organization's leadership. In this scenario, while the written code of conduct is appropriate, management's actions and reward system create a conflicting message that prioritizes performance over ethical behavior. This pressure from leadership directly undermines the formal policies and fosters an environment where fraud is more likely to occur.

Question 388: Which financial instrument is most commonly associated with the 'smurfing' technique in money laundering?

Cashier's checks over $50,000
Wire transfers above $10,000
Foreign currency exchanges
Multiple cash deposits below the CTR reporting threshold (Correct answer)

Correct answer: Multiple cash deposits below the CTR reporting threshold

Smurfing involves breaking large sums into smaller deposits below the $10,000 Currency Transaction Report threshold to avoid detection.

Question 389: Which legal remedy allows a fraud victim to return both parties to their pre-transaction positions by unwinding the contract?

Rescission (Correct answer)
Specific performance
Declaratory judgment
Injunction

Correct answer: Rescission

Rescission voids the fraudulently induced contract and restores each party to the position they occupied before the transaction.

Question 390: An employee in accounts payable alters a legitimate vendor's bank account number in the system to redirect payments to her own account. This is an example of:

Register disbursement fraud
ACH/EFT fraud (Correct answer)
Check tampering
Billing scheme

Correct answer: ACH/EFT fraud

Redirecting ACH or EFT payments by changing vendor banking details in the system is a form of electronic payment fraud, not check tampering.

Question 391: Which of the following best describes 'economic extortion' as a form of corruption?

An employee inflates vendor invoices and pockets the difference
An employee demands payment from a vendor in exchange for awarding them a contract (Correct answer)
An employee creates a shell company to receive fraudulent payments
A vendor bribes a purchasing agent to be placed on the approved vendor list

Correct answer: An employee demands payment from a vendor in exchange for awarding them a contract

Economic extortion occurs when an employee demands something of value from a third party as a condition for taking or refraining from taking an official action.

Question 392: Which federal statute specifically criminalizes computer fraud and unauthorized access to protected computer systems?

Electronic Communications Privacy Act
Digital Millennium Copyright Act
Computer Fraud and Abuse Act (Correct answer)
Stored Communications Act

Correct answer: Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (CFAA) is the primary federal law criminalizing unauthorized access to computer systems and related fraud.

Question 393: What is the primary purpose of a 'net worth analysis' in a fraud investigation?

To calculate damages owed to the victim
To value seized assets for forfeiture
To determine the suspect's credit score
To identify unexplained increases in a subject's wealth (Correct answer)

Correct answer: To identify unexplained increases in a subject's wealth

Net worth analysis compares changes in a subject's net worth over time to identify wealth that cannot be explained by reported income, suggesting hidden income from fraud.

Question 394: Which ratio is most directly inflated by a scheme that understates cost of goods sold through inventory manipulation?

Gross profit margin (Correct answer)
Current ratio
Interest coverage ratio
Debt-to-equity ratio

Correct answer: Gross profit margin

Understating COGS directly increases gross profit, causing the gross profit margin to appear higher than actual operating performance warrants.

Question 395: A fraud risk assessment team discovers that management routinely overrides system-generated purchase order approvals. This finding is best classified as:

A detection risk issue
A fraud risk indicator related to management override of controls (Correct answer)
A control deficiency only
An inherent fraud risk

Correct answer: A fraud risk indicator related to management override of controls

Management override of controls is a classic fraud risk indicator that can enable financial statement fraud or asset misappropriation.

Question 396: An attorney-client privilege can be overcome under the crime-fraud exception when:

The client sought the attorney's assistance to commit or plan a future crime or fraud (Correct answer)
The attorney has personal knowledge of the client's past crimes
The communication occurred in a group setting with third parties present
The client is accused of a serious felony

Correct answer: The client sought the attorney's assistance to commit or plan a future crime or fraud

The crime-fraud exception strips attorney-client privilege when the client consulted the attorney to facilitate an ongoing or future crime or fraud.

Question 397: An investigator is tracing illicitly obtained funds. The suspect made numerous wire transfers between various shell corporations in different jurisdictions, purchased and quickly sold securities, and exchanged currencies multiple times. These actions BEST represent which stage of the money laundering process?

Placement
Layering (Correct answer)
Structuring
Integration

Correct answer: Layering

Layering is the stage where the launderer creates complex layers of financial transactions to obscure the audit trail and sever the link to the original crime. [4, 8] The described actions—using shell companies, rapid securities trading, and currency exchanges—are classic layering techniques designed to make the funds difficult to trace. [9, 22] Placement is the initial introduction of the funds, and integration is the final re-entry into the legitimate economy. [5, 15] Structuring is a method used in the placement stage, not a stage itself. [1, 5]

Question 398: Under the ACFE Code of Professional Standards, a fraud examiner must NOT do which of the following during an investigation?

Express an opinion on guilt or innocence in a written report (Correct answer)
Interview witnesses under oath
Use data analytics to identify anomalies
Review financial records provided by the client

Correct answer: Express an opinion on guilt or innocence in a written report

ACFE standards prohibit fraud examiners from expressing personal opinions about a subject's guilt or innocence in written reports, as that determination belongs to courts.

Question 399: Which financial statement fraud scheme involves recording sales before the earnings process is complete?

Channel stuffing
Round-tripping
Fictitious revenues
Premature revenue recognition (Correct answer)

Correct answer: Premature revenue recognition

Premature revenue recognition records revenue before all criteria under GAAP (e.g., delivery, risk transfer) are satisfied.

Question 400: Which of the following is an example of a preventive control in a fraud prevention framework?

Analyzing vendor payment trends quarterly
Conducting surprise audits
Reviewing exception reports after month-end
Requiring dual authorization for wire transfers (Correct answer)

Correct answer: Requiring dual authorization for wire transfers

Requiring dual authorization prevents unauthorized transfers from occurring at all, making it a preventive control rather than a detective one.

Question 401: Which of the following governance failures was MOST prominently associated with the Enron scandal?

Failure to file required SEC disclosures on time
Board waiving its own code of ethics to allow off-balance-sheet transactions (Correct answer)
Inadequate cybersecurity controls on financial systems
Excessive CEO compensation without shareholder approval

Correct answer: Board waiving its own code of ethics to allow off-balance-sheet transactions

Enron's board voted to waive its own code of ethics to allow CFO Andrew Fastow to manage the SPEs that concealed liabilities off the balance sheet.

Question 402: When is it appropriate to use a polygraph examination in a fraud investigation?

As the primary evidence to establish guilt in criminal proceedings
As a voluntary investigative tool when the subject consents and applicable law permits (Correct answer)
As a mandatory screening tool for all fraud suspects
As a replacement for witness interviews when documentary evidence is insufficient

Correct answer: As a voluntary investigative tool when the subject consents and applicable law permits

Polygraphs are investigative tools requiring voluntary consent and are generally inadmissible as evidence in US courts but can guide the direction of an investigation.

Question 403: What is the primary function of the Financial Action Task Force (FATF) in the global fight against money laundering and terrorist financing?

To directly seize the assets of sanctioned countries and terrorist organizations.
To set international standards and promote the effective implementation of legal, regulatory, and operational measures. (Correct answer)
To act as a global central bank for processing cross-border suspicious activity reports.
To prosecute individuals and entities involved in international money laundering schemes.

Correct answer: To set international standards and promote the effective implementation of legal, regulatory, and operational measures.

The FATF is an inter-governmental, policy-making body whose primary purpose is to set international standards (known as the FATF Recommendations) to combat money laundering and terrorist financing. [10, 19] It promotes the effective implementation of these standards through peer reviews but does not have any direct investigative, prosecutorial, or asset seizure powers. [12, 13]

Question 404: Under the Business Judgment Rule, courts will generally NOT second-guess a board decision if directors:

Followed the recommendation of outside legal counsel
Made the decision in good faith, on an informed basis, and without conflicts of interest (Correct answer)
Achieved a profitable outcome for shareholders
Obtained a fairness opinion from an investment bank

Correct answer: Made the decision in good faith, on an informed basis, and without conflicts of interest

The Business Judgment Rule protects directors who acted in good faith, were adequately informed, and had no personal interest in the outcome.

Question 405: Which internal control is most effective against fraud?

Single-employee oversight.
Segregation of duties (Correct answer)
Unmonitored bonuses.
Management override.

Correct answer: Segregation of duties

Segregation of duties is a fundamental internal control that divides critical tasks among different employees to prevent any single individual from having complete control over a process. This significantly reduces the opportunity for fraud by requiring collusion to bypass controls, making it much harder for one person to commit and conceal fraudulent acts.

Question 406: In the context of financial statement fraud, 'channel stuffing' primarily involves:

Understating channel distribution costs to inflate margins
Creating fictitious customer accounts to record sales
Recording revenue from products shipped to customers who did not order them or have side agreements to return goods (Correct answer)
Accelerating cash collection to boost period-end cash balances

Correct answer: Recording revenue from products shipped to customers who did not order them or have side agreements to return goods

Channel stuffing pushes excess inventory to distributors—often with undisclosed return rights—to artificially inflate period-end revenue figures.

Question 407: A whistleblower who reports securities fraud under the Dodd-Frank Act is entitled to:

A monetary award of 10-30% of sanctions exceeding $1 million (Correct answer)
Guaranteed employment reinstatement regardless of circumstances
Full immunity from all civil and criminal liability
A fixed government payment of $50,000 per valid report

Correct answer: A monetary award of 10-30% of sanctions exceeding $1 million

Dodd-Frank provides whistleblowers with 10-30% of monetary sanctions collected in SEC enforcement actions exceeding $1 million.

Question 408: Which financial ratio or metric is most useful in detecting overbilling by vendors during a procurement fraud investigation?

Debt-to-equity ratio
Accounts receivable turnover
Gross margin percentage by vendor compared to industry benchmarks (Correct answer)
Current ratio

Correct answer: Gross margin percentage by vendor compared to industry benchmarks

Comparing a vendor's gross margin percentage to industry benchmarks can reveal whether prices charged to the organization are significantly above market, suggesting overbilling.

Question 409: Which of the following best illustrates 'segregation of duties' as a fraud prevention control?

The CFO reviews all journal entries made during the year
One employee handles all aspects of payroll processing to ensure consistency
External auditors verify all bank reconciliations quarterly
The employee who approves vendor invoices is different from the one who processes payment (Correct answer)

Correct answer: The employee who approves vendor invoices is different from the one who processes payment

Segregation of duties requires that no single individual control all phases of a transaction, so that approval and payment functions are separated.

Question 410: Which type of financial statement fraud involves management using aggressive estimates to overstate pension plan assets?

Liability omission
Fictitious revenues
Premature revenue recognition
Improper asset valuation (Correct answer)

Correct answer: Improper asset valuation

Overstating pension asset returns or discount rates is an improper asset valuation scheme that reduces reported pension obligations and improves reported earnings.

Question 411: Which strategy is recommended when an interviewee provides a denial during a fraud interrogation?

Allow the subject to make denials freely without interruption
Immediately confront the subject with all available evidence
Cut off denials quickly to maintain interrogation momentum (Correct answer)
Accept the denial and end the interview

Correct answer: Cut off denials quickly to maintain interrogation momentum

In interrogation, allowing denials to develop gives the subject psychological reinforcement; cutting them off early keeps the interrogator in control.

Question 412: When an investigator discovers that a suspect used a shell company to conceal fraud proceeds, which technique is MOST appropriate to trace the funds?

Trend analysis
Content analysis
Link analysis (Correct answer)
Ratio analysis

Correct answer: Link analysis

Link analysis maps relationships between entities, people, and transactions to reveal hidden connections such as shell company ownership.

Question 413: Which investigative technique involves analyzing check digit anomalies and sequence gaps in invoice or check numbers to detect fraud?

Benford's Law analysis
Sequence gap analysis (Correct answer)
Statistical sampling
Regression analysis

Correct answer: Sequence gap analysis

Sequence gap analysis examines numbering sequences for missing, duplicated, or out-of-order documents that may indicate fraudulent additions or removals.

Question 414: When prioritizing fraud risks identified during an assessment, which factor is typically used alongside likelihood to determine overall risk rating?

Number of employees involved
Impact or significance (Correct answer)
Regulatory jurisdiction
Detection lag time

Correct answer: Impact or significance

Fraud risks are typically rated by combining the likelihood of occurrence with the potential impact or significance of the fraud.

Question 415: What is the main advantage of a confidential employee hotline compared to open-door reporting policies?

It bypasses management entirely
It encourages reporting by reducing fear of retaliation (Correct answer)
It is cheaper to operate
It only accepts anonymous tips

Correct answer: It encourages reporting by reducing fear of retaliation

Confidential hotlines encourage reporting because employees fear less retaliation when their identity is protected, leading to more tips being submitted.

Question 416: The duty of loyalty requires corporate directors to:

Act in the best interests of the corporation rather than personal interests (Correct answer)
Put personal interests ahead of shareholder interests when in conflict
Always vote with management recommendations
Maintain loyalty to the CEO who appointed them

Correct answer: Act in the best interests of the corporation rather than personal interests

The duty of loyalty requires directors to prioritize the corporation's best interests over their own personal financial interests or those of other parties.

Question 417: What is the function of regulatory law?

To supervise jury selection.
To implement and enforce specific legislation (Correct answer)
To repeal criminal codes.
To define constitutional rights.

Correct answer: To implement and enforce specific legislation

Regulatory law is created by administrative agencies to implement and enforce specific legislation passed by a legislative body. These regulations provide detailed rules and standards that govern various industries and activities, ensuring compliance with legal mandates and protecting public interests, such as environmental protection or consumer safety.

Question 418: Which doctrine allows a court to void a contract if one party used unfair bargaining power to obtain grossly one-sided terms?

Fraudulent misrepresentation
Undue influence
Promissory estoppel
Unconscionability (Correct answer)

Correct answer: Unconscionability

Unconscionability permits courts to refuse enforcement of contracts that are oppressively one-sided or result from unfair bargaining processes.

Question 419: Under the Stored Communications Act (SCA), law enforcement generally must obtain a search warrant to access:

Subscriber registration information
Email headers and routing information
Email content stored for 180 days or fewer (Correct answer)
IP address login records

Correct answer: Email content stored for 180 days or fewer

Following the Sixth Circuit's Warshak decision and subsequent DOJ policy, law enforcement must obtain a warrant to compel disclosure of email content regardless of storage duration.

Question 420: A key investigative technique for identifying unreported income in a money laundering case is the net worth method, which works by:

Analyzing debt-to-equity ratios across multiple accounting periods
Calculating the present value of all future cash flows from assets
Subtracting total liabilities from total assets at year-end only
Comparing increases in net worth plus living expenses to known income sources (Correct answer)

Correct answer: Comparing increases in net worth plus living expenses to known income sources

The net worth method detects hidden income by measuring unexplained increases in wealth relative to reported income, a technique used by the IRS and CFEs.

Question 421: Which control is most effective at preventing employees from creating fictitious vendors?

Monthly vendor reconciliations
Requiring dual authorization for vendor master file changes (Correct answer)
Annual vendor audits
Segregating invoice processing from payment

Correct answer: Requiring dual authorization for vendor master file changes

Requiring dual authorization (two separate employees) to add or modify vendor master file records prevents any single employee from creating a fictitious vendor unilaterally.

Question 422: A cashier voids a legitimate sale transaction after collecting payment from the customer and pockets the cash. This is BEST described as:

Register disbursement fraud
Skimming
Voiding and cash theft (larceny) (Correct answer)
Refund scheme

Correct answer: Voiding and cash theft (larceny)

Voiding a legitimate transaction after collecting cash and stealing the proceeds is a form of cash larceny because the sale was recorded before being reversed.

Question 423: What is the main goal of fraud prevention programs?

To encourage anonymous behavior.
To deter and reduce opportunities for fraud (Correct answer)
To monitor employee vacation time.
To eliminate internal audits.

Correct answer: To deter and reduce opportunities for fraud

The main goal of fraud prevention programs is to create an environment where fraud is difficult to commit, easy to detect, and likely to be punished. By implementing strong internal controls, ethical policies, and regular monitoring, organizations aim to deter potential fraudsters and significantly reduce the opportunities for fraudulent activities.

Question 424: A manufacturing company has been capitalizing routine maintenance costs as fixed assets rather than expensing them as incurred. What is the primary effect of this fraudulent accounting practice on the company's financial statements in the period the costs were incurred?

It understates revenues and overstates assets.
It understates assets and understates net income.
It overstates assets and overstates net income. (Correct answer)
It overstates liabilities and understates net income.

Correct answer: It overstates assets and overstates net income.

By improperly capitalizing expenses, the company avoids recognizing the full expense on the income statement in the current period. This leads to an overstatement of net income. Simultaneously, capitalizing the cost adds it to the balance sheet as an asset, thereby overstating total assets. This was a key element in the WorldCom fraud.

Question 425: In assessing financial statement fraud risk, which combination of factors most elevates concern?

Conservative accounting policies, diverse customer base, and low debt
Stable industry, experienced management, and strong audit committee
Declining revenue, fixed compensation, and Big-4 auditor
Rapid revenue growth, management override of controls, and performance-based bonuses (Correct answer)

Correct answer: Rapid revenue growth, management override of controls, and performance-based bonuses

Rapid growth pressure, unchecked management override, and incentive-heavy pay structures are classic red flags that align all three fraud triangle elements.

Question 426: Which of the following is a primary responsibility of a company's audit committee in the context of corporate governance and fraud prevention?

Executing the day-to-day internal control procedures.
Managing the company's quarterly and annual budgeting process.
Overseeing the financial reporting process and the work of external auditors. (Correct answer)
Personally conducting all internal fraud investigations.

Correct answer: Overseeing the financial reporting process and the work of external auditors.

The audit committee, a subcommittee of the board of directors, is responsible for the oversight of financial reporting, internal controls, and both internal and external auditors. This oversight role is crucial for ensuring the integrity of financial statements and deterring fraud. They do not manage day-to-day operations or execute controls themselves, but they ensure that management has designed and implemented effective systems.

Question 427: The Financial Action Task Force (FATF) Recommendations are best described as:

A US-specific framework administered by FinCEN
Criminal statutes adopted by the United Nations
Internationally recognized standards for combating money laundering and terrorist financing (Correct answer)
Legally binding international laws enforceable in all member nations

Correct answer: Internationally recognized standards for combating money laundering and terrorist financing

FATF Recommendations are internationally recognized standards, not binding law, but they guide national AML/CFT legislation across member countries.

Question 428: Which of the following BEST describes a 'pass-through' billing scheme?

An employee steals inventory and sells it to a competitor
An employee intercepts vendor refund checks
An employee submits personal expenses as business expenses
An employee creates a fictitious vendor that buys goods at cost and resells them to the employer at inflated prices (Correct answer)

Correct answer: An employee creates a fictitious vendor that buys goods at cost and resells them to the employer at inflated prices

A pass-through scheme uses a fraudster-controlled intermediary company that purchases goods legitimately and resells them to the victim organization at a markup, generating illicit profit.

Question 429: A CFO instructs accounting staff to capitalize routine maintenance expenses rather than expensing them immediately. The primary effect of this fraudulent accounting is:

Overstated assets and overstated current-period net income (Correct answer)
Overstated current liabilities and understated net income
Understated assets and overstated expenses
No effect on net income since total costs remain the same

Correct answer: Overstated assets and overstated current-period net income

Capitalizing expenses instead of expensing them immediately reduces current-period costs, inflating net income while also overstating the asset base.

Question 430: Pre-employment screening is MOST effective at preventing fraud when it includes which element?

Psychological stress testing
Physical examination
Verification of references and credentials (Correct answer)
Drug testing only

Correct answer: Verification of references and credentials

Verifying references and credentials helps confirm honesty, qualifications, and past behavior, which are strong indicators of future integrity.

Question 431: Which type of check tampering scheme involves an employee intercepting outgoing checks and forging the payee's endorsement to deposit them personally?

Authorized maker scheme
Forged endorsement scheme (Correct answer)
Forged maker scheme
Altered payee scheme

Correct answer: Forged endorsement scheme

A forged endorsement scheme occurs when an employee intercepts a legitimately issued check and forges the payee's signature to redirect the funds.

Question 432: Which of the following is a primary benefit of formally documenting the organization's fraud risk assessment process and its results?

It eliminates the possibility of residual fraud risk in the organization.
It provides a rational basis for management to design, implement, and evaluate its anti-fraud controls. [1, 2] (Correct answer)
It satisfies all requirements for obtaining a business crime insurance policy.
It serves as conclusive evidence in legal proceedings against any future fraudsters.

Correct answer: It provides a rational basis for management to design, implement, and evaluate its anti-fraud controls. [1, 2]

Formal documentation creates a clear record of the identified risks, the assessment of their likelihood and impact, and the evaluation of existing controls. This documentation provides the foundation and rationale for management's decisions regarding where to invest in new or enhanced anti-fraud controls and serves as a baseline for future assessments. [1, 22]

Question 433: The 'reasonable person' standard in ethics compliance programs refers to:

The minimum legal standard required to avoid prosecution
Behavior that a typical, prudent person would consider acceptable under the circumstances (Correct answer)
The judgment of the most senior compliance officer at the firm
The average salary of an employee in the relevant industry

Correct answer: Behavior that a typical, prudent person would consider acceptable under the circumstances

The reasonable person standard asks whether an objective, prudent individual in the same situation would consider the conduct appropriate.

Question 434: In a check tampering scheme, an employee intercepts checks made payable to vendors and alters the payee name to herself before depositing them. This is an example of:

Authorized maker scheme
Forged maker scheme
Altered payee scheme (Correct answer)
Concealed check scheme

Correct answer: Altered payee scheme

An altered payee scheme involves changing the name of the legitimate payee on a check to redirect funds to the fraudster.

Question 435: The 'particularity requirement' under Federal Rule of Civil Procedure 9(b) requires that fraud allegations be pled with:

Specificity as to the time, place, and content of each alleged misrepresentation (Correct answer)
Documentary evidence attached to the complaint
Expert witness affidavits
General notice of the claim

Correct answer: Specificity as to the time, place, and content of each alleged misrepresentation

Rule 9(b) mandates that plaintiffs alleging fraud specify the who, what, when, where, and how of each fraudulent statement to protect defendants from vague accusations.

Question 436: The 'diamond model' of fraud extends the fraud triangle by adding which fourth element?

Collusion
Greed
Concealment
Capability (Correct answer)

Correct answer: Capability

David Wolfe and Dana Hermanson added 'capability'—the fraudster's skills, position, and ability to execute and conceal fraud—as a fourth element to the diamond model.

Question 437: A payroll clerk creates a fictitious employee in the company's payroll system and arranges for the ghost employee's paycheck to be directly deposited into a bank account controlled by the clerk. This type of asset misappropriation is a form of:

Skimming
Expense Reimbursement Fraud
Fraudulent Disbursement (Correct answer)
Non-cash Misappropriation

Correct answer: Fraudulent Disbursement

This scenario describes a fraudulent disbursement, specifically a payroll scheme. A fraudulent disbursement occurs when an employee causes the organization to issue a payment for a dishonest purpose. Creating a 'ghost employee' is a classic method for this type of fraud. Skimming involves off-book theft of incoming cash. Expense reimbursement fraud involves false claims for expenses, and non-cash misappropriation involves the theft of physical assets like inventory.

Question 438: The ACFE's fraud prevention model emphasizes that deterrence is achieved primarily through:

Eliminating all cash transactions
The perception that fraud will be detected and punished (Correct answer)
Harsh punishments for all employees
Outsourcing all financial functions

Correct answer: The perception that fraud will be detected and punished

Deterrence works by making potential fraudsters believe they will be caught and face consequences, which requires both detection capability and consistent enforcement.

Question 439: Under the U.S. Bank Secrecy Act (BSA), a financial institution is generally required to file a Suspicious Activity Report (SAR) for a transaction that it knows, suspects, or has reason to suspect involves funds derived from illegal activities and aggregates to at least what threshold when a suspect can be identified?

$5,000 (Correct answer)
$3,000
$10,000
$25,000

Correct answer: $5,000

The Bank Secrecy Act, as enforced by FinCEN, requires financial institutions like banks and broker-dealers to file a SAR for suspicious transactions that aggregate to at least $5,000 where a suspect can be identified. [31, 34] The $10,000 threshold applies to Currency Transaction Reports (CTRs), not necessarily SARs, although structuring to avoid the CTR threshold is a reason to file a SAR. [32, 33, 35]

Question 440: What is a whistleblower?

A legal prosecutor.
An external consultant.
A contract negotiator.
A person reporting internal fraud (Correct answer)

Correct answer: A person reporting internal fraud

A whistleblower is an individual, typically an employee, who reports alleged dishonest or illegal activities occurring within a company or government agency. Whistleblowers play a critical role in uncovering fraud and corruption, often protected by laws designed to prevent retaliation for their disclosures.

Question 441: Which of the following scenarios represents a 'fictitious refund' scheme?

A vendor credits the company for returned goods
A customer requests a refund for a defective product
A manager approves refunds for returns that never occurred and routes the cash to herself (Correct answer)
An employee falsifies her expense report

Correct answer: A manager approves refunds for returns that never occurred and routes the cash to herself

Fictitious refund schemes involve employees generating fraudulent refund transactions for non-existent returns and diverting the cash or credit to themselves.

Question 442: A CFE is investigating a public official suspected of accepting bribes. The official's known legitimate income is approximately $150,000 per year, yet they have recently purchased a luxury yacht, two vacation homes, and several high-end vehicles. To prove that the official's expenditures exceed their legitimate sources of funds, which investigative method would be MOST effective?

Forensic audit of public records
Net worth analysis (Correct answer)
Bank deposit analysis
Asset misappropriation review

Correct answer: Net worth analysis

Net worth analysis is an indirect method of proving illicit income by calculating the difference between a person's assets and liabilities over time. [27, 28] It compares the subject's change in net worth plus their known living expenses to their known legitimate income. [20] A significant excess of expenditures and wealth accumulation over known income serves as powerful circumstantial evidence of illicit enrichment, which is central to this bribery case. [29]

Question 443: An internal auditor discovers that the same employee approves purchase orders and signs vendor checks. This is an example of:

A corrective control failure
An adequate compensating control
A detective control deficiency
A segregation of duties weakness (Correct answer)

Correct answer: A segregation of duties weakness

When one employee controls both the authorization of a purchase and the disbursement of funds, a critical segregation of duties weakness exists that enables fraud.

Question 444: A Certified Fraud Examiner arrives to seize a computer that is currently powered on and is suspected of containing evidence of an ongoing data exfiltration scheme. To ensure that crucial, time-sensitive evidence is not lost, which of the following actions should be performed FIRST?

Disconnect the computer from the network to stop the data exfiltration.
Photograph the screen and all physical connections to the computer.
Perform a live acquisition to capture the contents of RAM. (Correct answer)
Create a bit-stream image of the hard drive.

Correct answer: Perform a live acquisition to capture the contents of RAM.

Volatile data, such as the contents of Random Access Memory (RAM), is lost when a computer loses power. [1, 4] A live acquisition captures this data, which can include running processes, active network connections, encryption keys, and passwords—all of which are critical evidence in a data exfiltration case and would be lost if the machine were powered down first. [1, 3]

Question 445: Which of the following is considered a 'predicate offense' under the federal money laundering statutes (18 U.S.C. § 1956)?

Regulatory violations that carry only administrative penalties
Jaywalking
Specified unlawful activities (SUAs) such as drug trafficking and fraud (Correct answer)
Civil contract disputes

Correct answer: Specified unlawful activities (SUAs) such as drug trafficking and fraud

Federal money laundering statutes require that the funds involved proceed from a 'specified unlawful activity' (SUA), which includes drug trafficking, fraud, and over 200 other predicate offenses.

Question 446: What legal principle ensures a person cannot be tried twice for the same offense?

Habeas corpus.
Double jeopardy (Correct answer)
Probable cause.
Subpoena power.

Correct answer: Double jeopardy

Double jeopardy is a legal principle, enshrined in the Fifth Amendment of the U.S. Constitution, that prevents an individual from being prosecuted or punished twice for the same offense after an acquittal or conviction. This protection ensures fairness and prevents the government from repeatedly harassing individuals over a single alleged crime.

Question 447: A fraud examiner conducting an interview in a private company setting should be aware that Miranda rights:

Must be read at the start of every fraud examination interview
Apply only when government agents conduct custodial interrogations (Correct answer)
Apply to all fraud interviews regardless of who conducts them
Are waived automatically when the subject signs an employment agreement

Correct answer: Apply only when government agents conduct custodial interrogations

Miranda warnings are constitutionally required only for custodial interrogations conducted by government agents, not private investigators.

Question 448: An auditor performs 'cut-off testing' primarily to detect:

Understated accounts payable balances
Overstated fixed asset valuations
Revenue and expense transactions recorded in the wrong accounting period (Correct answer)
Misclassified equity versus debt instruments

Correct answer: Revenue and expense transactions recorded in the wrong accounting period

Cut-off testing verifies that transactions are recorded in the correct accounting period, a critical control against premature or delayed recognition.

Question 449: Which statute is the primary US federal law criminalizing money laundering?

18 U.S.C. § 1956 (Correct answer)
31 U.S.C. § 5313
21 U.S.C. § 881
12 U.S.C. § 1829b

Correct answer: 18 U.S.C. § 1956

18 U.S.C. § 1956 is the primary federal money laundering statute, prohibiting financial transactions involving proceeds of specified unlawful activities.

Question 450: Which of the following best describes 'steganography' as it relates to fraud investigations?

Fragmenting files across multiple storage devices
Hiding data within innocuous files such as images or audio (Correct answer)
Encrypting financial records with a strong cipher
Using anonymizing networks to mask internet traffic

Correct answer: Hiding data within innocuous files such as images or audio

Steganography conceals secret data within ordinary-looking files, which fraudsters may use to covertly transfer stolen information.

Question 451: Which data analytics test is most useful for identifying fictitious vendors used in a corruption scheme?

Tracing cash receipts to bank deposit slips
Reconciling payroll deductions to HR records
Recalculating depreciation on fixed assets
Searching for vendors with PO boxes or incomplete addresses lacking phone numbers (Correct answer)

Correct answer: Searching for vendors with PO boxes or incomplete addresses lacking phone numbers

Fictitious vendors often lack complete contact information, using PO boxes or missing phone numbers because they do not conduct legitimate business.

Question 452: Which type of procurement fraud occurs when an employee creates a fictitious vendor and submits invoices for goods or services never provided?

Shell company fraud (Correct answer)
Kickback scheme
Duplicate payment fraud
Bid rigging

Correct answer: Shell company fraud

Shell company fraud involves setting up a fictitious vendor entity to submit fraudulent invoices, diverting payments to the fraudster.

Question 453: Which of the following best describes the purpose of a 'surprise audit' in a fraud prevention program?

To train new auditors on fieldwork procedures
To satisfy SOX Section 302 certification requirements
To deter fraud by introducing the unpredictability of detection (Correct answer)
To replace the annual financial statement audit

Correct answer: To deter fraud by introducing the unpredictability of detection

Surprise audits deter fraud by removing the predictability that allows fraudsters to conceal their schemes before a scheduled audit.

Question 454: A fraud examiner finds that critical log files on a corporate server were deleted two hours after an internal audit was announced. What forensic concept is most relevant?

Best evidence rule
Hearsay exception
Spoliation of evidence (Correct answer)
Chain of custody

Correct answer: Spoliation of evidence

Spoliation is the intentional or negligent destruction of evidence, which can result in adverse inference instructions or sanctions against the spoliating party.

Question 455: A Certified Fraud Examiner (CFE) working as an internal auditor for a large corporation discovers credible evidence that the Chief Financial Officer (CFO) has been deliberately misclassifying capital expenditures to inflate net income. The CFO is the CFE's direct supervisor and warns the CFE that pursuing the matter will end their career. According to the ACFE Code of Professional Ethics, what is the CFE's primary obligation?

To resign immediately to avoid a conflict of interest.
To comply with the supervisor's directive to protect their employment.
To keep the information confidential as it was obtained during a professional engagement.
To report the findings to a higher level of authority, such as the audit committee or the board of directors. (Correct answer)

Correct answer: To report the findings to a higher level of authority, such as the audit committee or the board of directors.

The ACFE Code of Professional Ethics requires members to act with integrity and diligence. While confidentiality is an obligation, it does not override the duty to report illegal acts or fraud within the organization. The proper course of action is to bypass the conflicted supervisor and report the material findings to a higher authority within the governance structure, such as the audit committee, which has oversight responsibility.

Question 456: Which of the following is an example of a 'related-party transaction' that could indicate financial statement fraud?

A subsidiary paying management fees to the parent company per a disclosed agreement
An employee receiving year-end bonuses approved by the board
A company purchasing supplies from a vendor owned by the CEO at above-market prices without disclosure (Correct answer)
A company selling products to a publicly traded customer at standard market rates

Correct answer: A company purchasing supplies from a vendor owned by the CEO at above-market prices without disclosure

Undisclosed transactions with related parties at non-arm's-length prices can be used to inflate expenses, transfer profits, or manipulate financial results.

Question 457: When assessing fraud risk related to financial reporting, which of the following revenue recognition scenarios represents the highest fraud risk?

Dividend income recognized when declared
Subscription revenue recognized ratably over contract periods
Point-of-sale retail transactions recorded daily
Revenue from long-term contracts recognized using percentage-of-completion estimates (Correct answer)

Correct answer: Revenue from long-term contracts recognized using percentage-of-completion estimates

Percentage-of-completion accounting requires significant management estimates, creating opportunity to manipulate reported revenue and earnings.

Question 458: Which legal theory allows prosecutors to charge multiple defendants in a fraud scheme even if each person only participated in part of the overall plan?

Strict liability
Conspiracy (Correct answer)
Negligence per se
Respondeat superior

Correct answer: Conspiracy

Conspiracy charges hold all co-conspirators liable for acts committed in furtherance of the shared agreement, even if each participated differently.

Question 459: Under the UK Bribery Act 2010, which offense is unique compared to the FCPA?

Offering a bribe to a foreign official
Paying a bribe to a domestic government official
Failure of a commercial organization to prevent bribery (Correct answer)
Receiving a bribe as a public official

Correct answer: Failure of a commercial organization to prevent bribery

Section 7 of the UK Bribery Act creates a strict liability corporate offense for failing to prevent bribery, which has no direct equivalent in the FCPA.

Question 460: In the context of fraud investigations, what does 'spoliation of evidence' refer to?

Failure to disclose evidence to opposing counsel
The intentional destruction or alteration of evidence (Correct answer)
Improper storage of physical evidence
Unauthorized access to confidential records

Correct answer: The intentional destruction or alteration of evidence

Spoliation refers to the intentional or negligent destruction, alteration, or concealment of evidence relevant to an investigation or litigation.

Question 461: When a fraud examiner prepares a written investigative report, which content should generally be EXCLUDED to maintain professional standards?

Recommendations for internal control improvements
A summary of evidence gathered
Personal opinions about the subject's character or morality (Correct answer)
A factual timeline of events

Correct answer: Personal opinions about the subject's character or morality

ACFE professional standards require fraud examiners to exclude personal opinions about a subject's character, limiting reports to factual findings and objective conclusions.

Question 462: An employee suspected of embezzlement used a personal Gmail account on a corporate laptop. Which artifact on the laptop is most likely to contain evidence of those webmail sessions?

Browser cache, cookies, and IndexedDB/Local Storage files (Correct answer)
The laptop's BIOS event log
The corporate VPN configuration files
The Windows registry's HKLM\SAM hive

Correct answer: Browser cache, cookies, and IndexedDB/Local Storage files

Web browsers cache page content, store authentication cookies, and maintain local databases that can contain session tokens, message fragments, and attachment filenames from webmail use.

Question 463: A company implements a hotline allowing anonymous reporting of suspected fraud. According to the ACFE, this control primarily reduces fraud by:

Automatically detecting financial statement anomalies
Deterring fraud through fear of detection (Correct answer)
Reducing the number of external audits required
Eliminating the need for internal audits

Correct answer: Deterring fraud through fear of detection

Fraud hotlines deter potential perpetrators by increasing the perceived likelihood of detection through peer reporting, which is the primary preventive mechanism.

Question 464: A Suspicious Activity Report (SAR) filed with FinCEN must be kept confidential because:

It contains classified government intelligence
Tipping off the subject could obstruct the investigation and is prohibited by law (Correct answer)
FinCEN requires a 180-day embargo on all financial filings
SAR filers are immune from civil liability only if the report stays secret

Correct answer: Tipping off the subject could obstruct the investigation and is prohibited by law

Federal law prohibits SAR filers from disclosing the existence of a SAR to the subject because it could alert them to an investigation and result in criminal obstruction.

Question 465: A certified fraud examiner discovers that a purchasing manager awarded a contract to a company owned by their spouse. This is best classified as:

A check tampering scheme
A false invoice scheme
A skimming scheme
A conflict of interest (Correct answer)

Correct answer: A conflict of interest

Awarding a contract to a relative's company without disclosure is a textbook conflict of interest, a subcategory of corruption fraud.

Question 466: What does the term 'beneficial owner' mean in the context of anti-money laundering regulations?

The attorney who sets up a shell company
The bank that holds the account
A government agency that benefits from seizure
The natural person who ultimately owns or controls a legal entity (Correct answer)

Correct answer: The natural person who ultimately owns or controls a legal entity

A beneficial owner is the natural person(s) who ultimately owns or controls a legal entity, which FinCEN's CDD rule requires financial institutions to identify.

Question 467: What is the maximum federal prison term for a single count of wire fraud under 18 U.S.C. § 1343?

20 years (Correct answer)
10 years
5 years
30 years

Correct answer: 20 years

Wire fraud carries a maximum sentence of 20 years per count, increasing to 30 years when the fraud affects a financial institution.

Question 468: A 'bid-rigging' scheme in procurement fraud most commonly involves:

Inflating the quantity of goods received
Submitting false invoices after contract award
Colluding with vendors to predetermine the winning bidder (Correct answer)
Employees stealing inventory after procurement

Correct answer: Colluding with vendors to predetermine the winning bidder

Bid rigging is a form of corruption where competitors collude to ensure a predetermined vendor wins a contract, often at an inflated price.

Question 469: An import/export company is under investigation for money laundering. The company's invoices show it purchased electronic components from a foreign supplier for $50 per unit, but investigators determine the fair market value of the components is only $5 per unit. This practice allows the company to transfer significant value offshore. This scheme is a classic example of which form of money laundering?

Bulk cash smuggling
Shell corporation layering
Structuring
Trade-Based Money Laundering (TBML) through over-invoicing (Correct answer)

Correct answer: Trade-Based Money Laundering (TBML) through over-invoicing

Trade-Based Money Laundering (TBML) involves exploiting international trade to move value across borders. [16] Over-invoicing, as described in the scenario, is a common TBML technique where the importer pays a fraudulently inflated price for goods, effectively sending the excess, illicit funds to the exporter under the guise of a legitimate commercial transaction. [11, 14, 21]

Question 470: Why should management set the tone at the top?

To prioritize sales over integrity.
To enforce cost-cutting policies.
To set ethical standards for all employees (Correct answer)
To control hiring processes.

Correct answer: To set ethical standards for all employees

Management's "tone at the top" establishes the ethical climate of an organization. By demonstrating a strong commitment to integrity and ethical behavior, leaders influence employees to adhere to these standards. This fosters a culture that discourages fraud and misconduct, setting clear expectations for all employees.

Question 471: Which Windows registry hive contains information about recently accessed USB devices?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)
HKEY_LOCAL_MACHINE\SECURITY
HKEY_LOCAL_MACHINE\SOFTWARE
HKEY_CURRENT_USER\Software\Microsoft\Office

Correct answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

The USBSTOR key records the vendor, product, and serial number of every USB storage device ever connected to the system.

Question 472: The 'honest services' theory of fraud, recognized in 18 U.S.C. § 1346, covers schemes that deprive citizens or employers of:

The intangible right to honest services (Correct answer)
Government benefits
Tangible property only
Intellectual property rights

Correct answer: The intangible right to honest services

Section 1346 extends mail and wire fraud to cover deprivation of the intangible right to honest services, typically applied to bribery and kickback schemes.

Question 473: Which characteristic of an effective ethics hotline is MOST critical to encouraging employee use?

Requirement to submit complaints in writing with signature
Availability only during business hours
Guaranteed anonymity and non-retaliation protections (Correct answer)
Hotline managed directly by the CEO's office

Correct answer: Guaranteed anonymity and non-retaliation protections

Employees will only use a hotline if they trust their identity will be protected and they won't face retaliation for raising concerns.

Question 474: A 'shell company' scheme most directly supports which type of corruption fraud?

Billing for services not rendered through a fictitious entity (Correct answer)
Falsifying travel expense reimbursements
Altering physical inventory counts
Skimming receipts at the point of sale

Correct answer: Billing for services not rendered through a fictitious entity

Shell companies are commonly used to fraudulently bill an employer for goods or services never received, routing payments to an account controlled by the fraudster.

Question 475: An organization wants to assess fraud risks in its procurement process. Which approach provides the most direct insight into potential fraud schemes?

Surveying customers about their satisfaction with vendor products
Reviewing the organization's mission statement
Comparing payroll costs to industry benchmarks
Mapping procurement process flows to identify control gaps and scheme opportunities (Correct answer)

Correct answer: Mapping procurement process flows to identify control gaps and scheme opportunities

Process mapping identifies where assets change hands and where controls may be absent, directly revealing where fraud schemes could occur.

Question 476: A company's CFO knowingly inflates the value of inventory in the financial statements to secure a bank loan. The bank, relying on these false statements, approves the loan. The company later defaults. Which legal element of fraud is best demonstrated by the bank approving the loan based on the false financials?

Scienter
Justifiable reliance (Correct answer)
Material misrepresentation
Damages

Correct answer: Justifiable reliance

The bank's action of approving the loan demonstrates justifiable reliance. The bank depended on the truthfulness of the financial statements when making its lending decision. While material misrepresentation (the inflated inventory), scienter (the CFO's knowledge), and damages (the loan default) are also present, the bank's action of lending money is the clearest example of reliance.

Question 477: According to the ACFE, how does organizational size typically affect fraud losses?

Larger organizations always suffer greater total losses
Size has no meaningful impact on fraud losses
Mid-sized firms have the highest fraud rates
Smaller organizations tend to suffer larger median losses relative to revenue (Correct answer)

Correct answer: Smaller organizations tend to suffer larger median losses relative to revenue

Smaller organizations tend to have weaker internal controls and thus suffer proportionally larger losses relative to their size, even though total dollar losses may be smaller.

CFE Exam

The Certified Fraud Examiner (CFE) credential denotes proven expertise in fraud prevention, detection, and deterrence.

500

Questions

480 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds