Certified Fraud Examiner Evidence and Legal Systems Questions and Answers — Questions and Answers
Question 1: During a fraud investigation, a Certified Fraud Examiner (CFE) interviews an employee who states, "My manager, Sarah, told me yesterday that she saw the controller altering invoices after hours." In a court of law, this employee's statement would most likely be considered what type of evidence?
- Demonstrative evidence
- Direct evidence
- Hearsay evidence (Correct answer)
- Real evidence
Correct answer: Hearsay evidence
Hearsay is an out-of-court statement offered to prove the truth of the matter asserted. The employee is repeating what Sarah (the declarant) said outside of court to prove that the controller was altering invoices. This is a classic example of hearsay and is generally inadmissible unless it falls under a specific exception.
Question 2: A fraud case against a company is being tried simultaneously in both criminal and civil court. Which of the following correctly describes the difference in the burden of proof required for each case?
- The burden of proof is "beyond a reasonable doubt" for both proceedings.
- The burden is "preponderance of the evidence" for the criminal case and "beyond a reasonable doubt" for the civil case.
- The burden is "clear and convincing evidence" for both proceedings.
- The burden is "beyond a reasonable doubt" for the criminal case and "preponderance of the evidence" for the civil case. (Correct answer)
Correct answer: The burden is "beyond a reasonable doubt" for the criminal case and "preponderance of the evidence" for the civil case.
In criminal law, the prosecution has the high burden of proving the defendant's guilt "beyond a reasonable doubt." In civil cases, the plaintiff's burden is lower, typically requiring proof by a "preponderance of the evidence," which means it is more likely than not that the claim is true.
Question 3: A CFE seizes a laptop believed to contain evidence of an embezzlement scheme. To ensure the digital evidence is admissible in court, which of the following is the MOST critical initial step for the CFE to take?
- Immediately create a forensic image of the hard drive and calculate its hash value. (Correct answer)
- Open and review all suspicious files to confirm their relevance to the case.
- Install forensic software directly onto the laptop to begin the analysis.
- Interview the laptop's user to get their password and a list of key documents.
Correct answer: Immediately create a forensic image of the hard drive and calculate its hash value.
The most critical initial step is to preserve the integrity of the original evidence. Creating a bit-for-bit forensic image (a copy) of the hard drive and then calculating a cryptographic hash value of both the original and the copy ensures that the original data is unaltered. All analysis is then performed on the copy. This process is fundamental to maintaining the chain of custody for digital evidence.
Question 4: A fraud examiner, testifying as a fact witness in a criminal trial, is asked by the prosecutor for their opinion on whether the defendant's actions were intentionally deceptive. How should the fraud examiner respond?
- Provide a detailed opinion based on their experience and analysis of the evidence.
- State that they cannot answer because the question calls for an opinion, which is beyond the scope of a fact witness's testimony. (Correct answer)
- Answer the question but qualify that it is a personal belief, not a professional conclusion.
- Request to be qualified as an expert witness before answering the question.
Correct answer: State that they cannot answer because the question calls for an opinion, which is beyond the scope of a fact witness's testimony.
A fact witness testifies about what they have seen, heard, or personally experienced. They are not permitted to offer opinions, interpretations, or conclusions about the facts. Providing an opinion on the defendant's intent (deception) is the role of an expert witness, who has been qualified by the court based on specialized knowledge.
Question 5: In preparation for a fraud trial, an attorney asks a CFE to create several charts and graphs that summarize complex financial transactions to help the jury understand the flow of funds. This type of evidence is best classified as:
- Real evidence
- Testimonial evidence
- Documentary evidence
- Demonstrative evidence (Correct answer)
Correct answer: Demonstrative evidence
Demonstrative evidence is evidence that illustrates or helps explain a fact or the testimony of a witness. It is not the actual object from the event (real evidence) but a representation, such as a chart, diagram, or model, created to aid understanding.
Question 6: A corporation's general counsel hires a CFE to conduct an internal investigation into a suspected kickback scheme in anticipation of litigation. The CFE's final report and related communications would MOST likely be protected from disclosure to opposing counsel under which legal doctrine?
- The crime-fraud exception
- The work product doctrine (Correct answer)
- The best evidence rule
- The hearsay rule
Correct answer: The work product doctrine
The work product doctrine protects materials prepared by or for a party or their representative (including an attorney or consultant like a CFE) in anticipation of litigation. Because the CFE was hired by legal counsel specifically in anticipation of litigation, their work product, including reports and communications, is generally shielded from discovery.
Certified Fraud Examiner Evidence and Legal Systems Questions and Answers
During a fraud investigation, a Certified Fraud Examiner (CFE) interviews an employee who states, "My manager, Sarah, told me yesterday that she saw the controller altering invoices after hours." In a court of law, this employee's statement would most likely be considered what type of evidence?