ACFE Investigation 2 — Questions and Answers
Question 1: During a fraud investigation, which type of interview is typically conducted first to gather preliminary information without alerting the suspect?
- Admission-seeking interview
- Cognitive interview
- Informational interview (Correct answer)
- Confrontational interview
Correct answer: Informational interview
Informational interviews are conducted early in an investigation to gather facts from witnesses and peripheral parties without disclosing suspicions.
Question 2: What is the primary purpose of a 'net worth analysis' in a fraud investigation?
- To calculate damages owed to the victim
- To identify unexplained increases in a subject's wealth (Correct answer)
- To determine the suspect's credit score
- To value seized assets for forfeiture
Correct answer: To identify unexplained increases in a subject's wealth
Net worth analysis compares changes in a subject's net worth over time to identify wealth that cannot be explained by reported income, suggesting hidden income from fraud.
Question 3: Which legal doctrine allows investigators to examine financial records without a subpoena if a third party (such as a bank) voluntarily produces them?
- Plain view doctrine
- Third-party doctrine (Correct answer)
- Exigent circumstances doctrine
- Good faith exception
Correct answer: Third-party doctrine
The third-party doctrine holds that individuals have no reasonable expectation of privacy in records voluntarily shared with third parties like banks.
Question 4: When an investigator discovers that a suspect used a shell company to conceal fraud proceeds, which technique is MOST appropriate to trace the funds?
- Content analysis
- Link analysis (Correct answer)
- Ratio analysis
- Trend analysis
Correct answer: Link analysis
Link analysis maps relationships between entities, people, and transactions to reveal hidden connections such as shell company ownership.
Question 5: A fraud examiner is reviewing emails for evidence. Which chain of custody step is MOST critical when collecting digital evidence?
- Printing all emails to paper
- Creating a forensic image of the original media (Correct answer)
- Deleting irrelevant emails to reduce volume
- Forwarding relevant emails to a personal account
Correct answer: Creating a forensic image of the original media
Creating a forensic image preserves the integrity of digital evidence and ensures the original data is not altered, maintaining chain of custody.
Question 6: Which element distinguishes a 'predication' from mere suspicion in launching a fraud investigation?
- A signed confession from the suspect
- A credible indication that fraud may have occurred (Correct answer)
- Approval from law enforcement
- A court order authorizing the investigation
Correct answer: A credible indication that fraud may have occurred
Predication is the totality of circumstances that would lead a reasonable professional to believe fraud has occurred, is occurring, or will occur—it does not require proof.
Question 7: Under the ACFE Code of Professional Standards, a fraud examiner must NOT do which of the following during an investigation?
- Interview witnesses under oath
- Express an opinion on guilt or innocence in a written report (Correct answer)
- Review financial records provided by the client
- Use data analytics to identify anomalies
Correct answer: Express an opinion on guilt or innocence in a written report
ACFE standards prohibit fraud examiners from expressing personal opinions about a subject's guilt or innocence in written reports, as that determination belongs to courts.
ACFE Investigation 2
During a fraud investigation, which type of interview is typically conducted first to gather preliminary information without alerting the suspect?