CFE Cheat Sheet 2026

The 30 highest-yield CFE facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. An organization discovers that its fraud risk assessment failed to identify a significant payroll fraud. Which assessment weakness most likely caused this gap? → The assessment team lacked subject matter expertise in payroll processes
2. An independent director is best described as someone who: → Has no material relationship with the company outside the directorship
3. A 'poison pill' defense mechanism is designed to protect a company against: → Hostile takeover attempts
4. Under the Sarbanes-Oxley Act, the CEO and CFO must certify financial statements under which section? → Section 302
5. A CFE notices a suspect's story has inconsistencies between the first and second telling. What is the best next step? → Ask the suspect to repeat the story a third time from a different starting point
6. Which fraud risk factor is MOST associated with management override of internal controls? → Management's incentive compensation tied to earnings targets
7. Which of the following is a common red flag that might indicate an employee is involved in an asset misappropriation scheme? → The employee consistently lives a lifestyle that appears to be beyond their known salary.
8. When a CFE prepares a written report of investigation findings, it should: → Be limited to factual findings and supported by evidence
9. A 'shell company' is most commonly used in money laundering schemes to: → Conceal the true ownership and origin of funds through complex corporate layers
10. Which type of documentary evidence is typically most useful in proving a check tampering scheme? → Original cancelled checks, bank statements, and signature cards
11. Under the ACFE's classification of financial statement fraud schemes, which category includes understating the allowance for doubtful accounts? → Improper asset valuations
12. Which type of question is most effective at the start of an interview to build rapport and gather background information? → Open-ended questions
13. When a fraudster intercepts an incoming check and deposits it into their own account, this is called: → Stolen checks
14. The 'fraud triangle' concept was originally introduced by which criminologist? → Donald Cressey
15. Which type of corruption scheme involves a vendor paying a company employee for confidential bid information? → Bid rigging
16. The 'Benford's Law' analysis technique in fraud investigations is used to: → Detect anomalies in numerical data by comparing leading digit frequency distributions
17. During an interview, the subject says 'To be honest with you...' before answering a key question. How should this qualifier be interpreted? → As a potential verbal indicator that the subject may be less than fully honest otherwise
18. Which ratio is most useful for detecting potential inventory fraud that inflates reported profits? → Gross margin ratio
19. During an investigation, a fraud examiner obtains evidence through an illegal search. This evidence is MOST likely to be: → Admissible if the examiner is a private party, not law enforcement
20. Which federal law provides the primary basis for prosecuting money laundering in the United States? → 18 U.S.C. § 1956
21. In civil litigation, what is the standard of proof required to prevail in a fraud case? → Preponderance of the evidence
22. Which element is NOT required to prove civil fraud in a U.S. court? → Criminal intent beyond a reasonable doubt
23. Under the ACFE Code of Professional Ethics, a fraud examiner who receives gifts from a suspect under investigation should: → Refuse all gifts and report the attempt to supervisors
24. Which of the following is the MOST significant risk factor for financial statement fraud according to the fraud triangle? → High pressure on management to meet earnings targets combined with weak internal controls
25. In fraud investigation, what is a 'net worth analysis' used to detect? → Unexplained increases in a suspect's personal wealth
26. Which of the following tasks does not fall under the purview of bankruptcy courts? → Supervising bankruptcy petitions
27. A fraud examiner reviewing emails discovers attorney-client privileged communications that are relevant to the investigation. The examiner should: → Immediately stop reviewing and consult legal counsel before proceeding
28. Data analytics used to detect payroll fraud would most likely flag which of the following as suspicious? → Two employees sharing the same bank account routing and account number
29. When assessing fraud risk at the account level, which of the following factors should receive the MOST weight? → The susceptibility of the account to manipulation and the materiality of the balance
30. Under the ACFE's classification of asset misappropriation, 'skimming' differs from 'cash larceny' primarily because: → Skimming occurs before the cash is recorded in the company's books