CFE Conducting Investigations 5 — Questions and Answers
Question 1: A fraud examiner is writing the final investigation report. Which element is MOST important to include to ensure the report's usefulness?
- Opinions about the subject's character and past behavior
- Factual findings supported by specific evidence with clear source citations (Correct answer)
- Recommendations for the criminal prosecution strategy
- Speculation about additional fraud that may have occurred
Correct answer: Factual findings supported by specific evidence with clear source citations
Effective investigation reports present factual findings tied to specific evidence; opinions, speculation, and prosecutorial recommendations exceed the examiner's proper role.
Question 2: Which of the following interview approaches is MOST appropriate when a fraud examiner needs to establish rapport with a reluctant witness?
- Begin with accusatory questions to establish authority
- Start with non-threatening, open-ended questions about the witness's background (Correct answer)
- Inform the witness that their answers may be used against them
- Conduct the interview with multiple examiners present to apply pressure
Correct answer: Start with non-threatening, open-ended questions about the witness's background
Establishing rapport through open-ended, non-threatening questions encourages reluctant witnesses to share information more freely.
Question 3: Under the ACFE Code of Professional Ethics, a fraud examiner who receives gifts from a suspect under investigation should:
- Accept gifts of nominal value only and disclose them
- Refuse all gifts and report the attempt to supervisors (Correct answer)
- Accept gifts as long as they do not influence the investigation outcome
- Report the gift to the suspect's attorney as a courtesy
Correct answer: Refuse all gifts and report the attempt to supervisors
The ACFE Code requires fraud examiners to refuse gifts that could compromise their objectivity and to report such attempts to maintain professional integrity.
Question 4: A fraud examiner reviewing emails discovers attorney-client privileged communications that are relevant to the investigation. The examiner should:
- Review the communications since fraud investigations override privilege
- Immediately stop reviewing and consult legal counsel before proceeding (Correct answer)
- Copy the communications and secure them without reading further
- Disclose the discovery to all members of the investigation team
Correct answer: Immediately stop reviewing and consult legal counsel before proceeding
Inadvertent disclosure of privileged communications requires immediate cessation of review and consultation with legal counsel to avoid waiving the privilege.
Question 5: The 'Benford's Law' analysis technique in fraud investigations is used to:
- Determine the legal standard of proof in civil fraud cases
- Detect anomalies in numerical data by comparing leading digit frequency distributions (Correct answer)
- Calculate the expected rate of fraud in a given industry
- Establish the minimum dollar amount that constitutes material fraud
Correct answer: Detect anomalies in numerical data by comparing leading digit frequency distributions
Benford's Law states that in naturally occurring datasets, leading digits follow a predictable distribution; deviations may indicate data manipulation.
Question 6: When an investigation involves potential criminal violations, at what point should a fraud examiner TYPICALLY coordinate with law enforcement?
- After the investigation is fully complete and the final report is written
- Before beginning any investigative steps to avoid interfering with criminal proceedings
- After consulting with legal counsel and management to determine the appropriate timing (Correct answer)
- Only if the fraud exceeds a specific dollar threshold set by statute
Correct answer: After consulting with legal counsel and management to determine the appropriate timing
The timing of law enforcement coordination should be determined in consultation with legal counsel and management to protect the investigation and the organization's interests.
Question 7: A fraud examiner conducting an investigation discovers that a colleague on the investigation team has been sharing confidential case details with the subject. This situation MOST requires:
- Quietly removing the colleague from the case without documentation
- Immediately reporting the breach to appropriate supervisors and documenting the incident (Correct answer)
- Confronting the colleague directly and warning them to stop
- Continuing the investigation without addressing the breach to avoid delays
Correct answer: Immediately reporting the breach to appropriate supervisors and documenting the incident
A confidentiality breach must be reported to supervisors and documented immediately to protect the investigation's integrity and prevent further compromise.
CFE Conducting Investigations 5
A fraud examiner is writing the final investigation report.
Which element is MOST important to include to ensure the report's usefulness?