CFA Investigation Memo & Case File 3 — Questions and Answers
Question 1: Which tabbing or indexing system is commonly recommended for organizing a physical fraud investigation case file?
- Alphabetical order by suspect name
- Chronological order only, with no sub-tabs
- A logical structure with sections for background, evidence, interviews, and legal referrals (Correct answer)
- Random order maintained as documents are received
Correct answer: A logical structure with sections for background, evidence, interviews, and legal referrals
Organizing a case file into logical sections (background, evidence, interviews, referrals) makes the file easy to navigate and present in legal proceedings.
Question 2: When a fraud examiner receives a subpoena for records in the case file, the first action should be to:
- Immediately produce all documents requested
- Notify legal counsel and preserve all relevant documents without alteration (Correct answer)
- Destroy documents that could incriminate the organization
- Redact all suspect names before producing records
Correct answer: Notify legal counsel and preserve all relevant documents without alteration
Upon receiving a subpoena, the examiner must notify legal counsel and implement a litigation hold to prevent spoliation of evidence.
Question 3: A case file memo references surveillance footage captured on Day 5 of the investigation. The footage file is stored digitally. What must accompany it in the case file?
- A certified copy notarized by a public official
- Metadata documentation and a hash value to verify the file has not been altered (Correct answer)
- A written transcript of all activity in the footage
- Approval from the suspect to use the footage
Correct answer: Metadata documentation and a hash value to verify the file has not been altered
Digital evidence integrity is verified through hash values (e.g., MD5 or SHA-256), which confirm the file has not been modified since collection.
Question 4: In a fraud case file, a 'suspect profile' document typically includes which of the following?
- The suspect's personal social media passwords
- Background information, role within the organization, and documented behavioral red flags (Correct answer)
- A polygraph test result as the primary evidence
- Psychological diagnosis from a licensed therapist
Correct answer: Background information, role within the organization, and documented behavioral red flags
A suspect profile compiles factual background, organizational role, and documented red flags to provide context for the investigation.
Question 5: Which of the following memo entries would be INAPPROPRIATE in a professionally maintained fraud case file?
- 'Witness stated she observed the subject falsifying invoices on March 3.'
- 'Subject appears to be lying based on his nervous demeanor during the interview.' (Correct answer)
- 'Document reviewed: Purchase order #4421, dated February 14, discrepancy noted on line 7.'
- 'Interview conducted on April 2; memorandum prepared same day.'
Correct answer: 'Subject appears to be lying based on his nervous demeanor during the interview.'
Characterizing a subject's demeanor as evidence of lying is an unsupported subjective conclusion inappropriate for an objective investigation record.
Question 6: What does a 'tickler' or 'follow-up' section in a case file serve?
- It records humor or informal observations by the examiner
- It tracks pending investigative steps, outstanding requests, and deadlines (Correct answer)
- It lists all individuals who have read the file
- It stores duplicate copies of key evidence
Correct answer: It tracks pending investigative steps, outstanding requests, and deadlines
A tickler section ensures that open action items, pending document requests, and follow-up interviews are tracked and not overlooked.
Question 7: Why is it important to document the date and time a memo is created, not merely the date it is finalized?
- Regulators require both dates for tax purposes
- The creation timestamp can establish when the examiner first documented a finding, which may be critical in litigation (Correct answer)
- It helps calculate the examiner's billable hours accurately
- Courts require dual timestamps on all legal documents
Correct answer: The creation timestamp can establish when the examiner first documented a finding, which may be critical in litigation
Creation timestamps establish the chronological record of when information was documented, which can be pivotal if the investigation's timeline is challenged.
CFA Investigation Memo & Case File 3
Which tabbing or indexing system is commonly recommended for organizing a physical fraud investigation case file?