Certified Fraud Specialist (CFS) Exam — Questions and Answers

Question 1: An e-commerce fraud scheme uses 'card-not-present' (CNP) fraud. Which characteristic defines this fraud type?

The fraudster manufactures counterfeit physical cards with stolen data
Stolen card data is used for online or phone transactions where the physical card is not required (Correct answer)
The fraud occurs at ATMs using compromised PINs and cloned cards
The physical credit card is stolen and used at point-of-sale terminals

Correct answer: Stolen card data is used for online or phone transactions where the physical card is not required

Card-not-present fraud exploits online or telephone transactions where only card numbers, expiration dates, and CVV codes are needed, making physical card possession unnecessary.

Question 2: A suspect arrested for a crime gives police another person's identity. The innocent person then has arrest records attached to their identity. This is called:

Impersonation of a law enforcement officer
Warrant fraud
Obstruction identity fraud
Criminal identity theft (Correct answer)

Correct answer: Criminal identity theft

Criminal identity theft occurs when a person arrested for a crime uses someone else's identifying information, causing the innocent person to have a criminal record they cannot easily clear.

Question 3: Which type of evidence is an expert witness most typically asked to interpret in a complex financial fraud case?

Physical evidence such as fingerprints and DNA
Demonstrative evidence such as courtroom reenactments
Testimonial evidence from eyewitnesses to the crime
Documentary evidence such as financial statements, bank records, and emails (Correct answer)

Correct answer: Documentary evidence such as financial statements, bank records, and emails

Fraud examiners are primarily engaged to analyze and explain documentary financial evidence — the paper (or digital) trail that proves or disproves the fraud.

Question 4: Which federal law primarily governs unauthorized access to computers and networks in the United States, making cyber fraud activities prosecutable?

Gramm-Leach-Bliley Act (GLBA)
Computer Fraud and Abuse Act (CFAA) (Correct answer)
Sarbanes-Oxley Act (SOX)
Electronic Communications Privacy Act (ECPA)

Correct answer: Computer Fraud and Abuse Act (CFAA)

The Computer Fraud and Abuse Act (CFAA) is the primary U.S. federal statute criminalizing unauthorized computer access, hacking, and related cyber fraud activities.

Question 5: When implementing fraud risk assessment frameworks practices, what should CFS professionals prioritize?

Alignment with professional standards, stakeholder needs, and organizational goals (Correct answer)
Personal preferences and comfort level
Cost reduction as the sole objective
Speed of implementation above all else

Correct answer: Alignment with professional standards, stakeholder needs, and organizational goals

Effective implementation of fraud risk assessment frameworks requires balancing professional standards, stakeholder needs, and organizational objectives for optimal results.

Question 6: An anonymous tip hotline is considered a critical anti-fraud control primarily because it:

Provides employees a safe, confidential channel to report suspected misconduct without fear of retaliation (Correct answer)
Satisfies regulatory compliance requirements for public companies
Replaces the need for traditional internal audit functions
Allows management to monitor employee communications

Correct answer: Provides employees a safe, confidential channel to report suspected misconduct without fear of retaliation

Confidential hotlines lower the personal risk of reporting by protecting the reporter's identity, which ACFE data shows makes tips the single most effective detection mechanism for occupational fraud.

Question 7: Which scheme involves a fraudster using a company's trade secrets or intellectual property for personal gain?

False invoicing
Conversion of assets
Economic espionage / IP theft (Correct answer)
Embezzlement

Correct answer: Economic espionage / IP theft

Economic espionage or IP theft involves stealing proprietary information, trade secrets, or intellectual property for competitive or personal financial advantage.

Question 8: Which analytical technique flags transactions that fall just below an approval threshold repeatedly?

Benford's Law analysis
Regression analysis
Threshold circumvention detection (Correct answer)
Ratio analysis

Correct answer: Threshold circumvention detection

Threshold circumvention detection identifies patterns where amounts cluster just below approval limits, a common fraud indicator.

Question 9: Which fraud scheme involves artificially inflating a company's reported revenue through fictitious sales?

Channel stuffing
Revenue recognition fraud
Fictitious revenue scheme (Correct answer)
Round-tripping

Correct answer: Fictitious revenue scheme

A fictitious revenue scheme records sales that never occurred, directly inflating reported revenue and assets on the financial statements.

Question 10: Which statement BEST describes the difference between a reservation of rights letter and a coverage denial in insurance fraud investigations?

A reservation of rights letter waives all coverage defenses; a denial preserves them
A denial is issued mid-investigation; a reservation of rights is issued only after investigation concludes
Both letters have identical legal effect on the insurer's coverage obligations
A reservation of rights letter allows investigation to continue while preserving defenses; a denial closes the claim (Correct answer)

Correct answer: A reservation of rights letter allows investigation to continue while preserving defenses; a denial closes the claim

A reservation of rights letter notifies the insured that the insurer is investigating potential coverage defenses without waiving them, while a denial concludes the coverage decision.

Question 11: What is the primary goal of regulatory compliance programs?

To ensure adherence to laws and regulations. (Correct answer)
To delay reporting.
To increase sales.
To avoid audits.

Correct answer: To ensure adherence to laws and regulations.

The primary goal of regulatory compliance programs is to ensure that an organization adheres to all applicable laws, regulations, industry standards, and internal policies. These programs help mitigate legal and reputational risks, avoid penalties, and foster a culture of ethical conduct. By proactively managing compliance, organizations demonstrate their commitment to operating responsibly and lawfully.

Question 12: Under the Dodd-Frank Act, the SEC Whistleblower Program awards qualifying whistleblowers what percentage of sanctions collected?

1–5%
10–30% (Correct answer)
51–75%
31–50%

Correct answer: 10–30%

The SEC Whistleblower Program awards qualifying individuals between 10% and 30% of monetary sanctions exceeding $1 million collected in enforcement actions.

Question 13: An employee alters a vendor's bank account number in the payment system to redirect funds to a personal account. This is best classified as:

Accounts payable tampering (Correct answer)
Skimming
Bribery
Financial statement fraud

Correct answer: Accounts payable tampering

Altering vendor payment details to divert funds is a form of accounts payable tampering, a type of asset misappropriation.

Question 14: Which fraud risk assessment technique involves comparing an organization's control environment against a defined set of criteria or standards?

Benchmarking against a control framework (Correct answer)
Delphi technique
Benchmarking
Brainstorming

Correct answer: Benchmarking against a control framework

Benchmarking against a control framework, such as COSO or ISO 31000, measures an organization's controls against established criteria to identify gaps.

Question 15: When the judge asks an expert witness to clarify a technical term 'in plain English,' the witness should:

Politely explain that simplification would distort the meaning
Ask the retaining attorney to answer on their behalf
Refer the judge to the written report for the definition
Provide a clear analogy or everyday comparison without sacrificing accuracy (Correct answer)

Correct answer: Provide a clear analogy or everyday comparison without sacrificing accuracy

Judges and juries are lay audiences; clear analogies that preserve accuracy are both professional and effective.

Question 16: When a company self-reports fraud to the DOJ before an investigation begins, it generally receives credit for voluntary disclosure under which framework?

COSO Internal Control Framework
DOJ Corporate Enforcement Policy (Correct answer)
SEC Regulation FD
Federal Sentencing Guidelines culpability score reduction

Correct answer: DOJ Corporate Enforcement Policy

The DOJ's Corporate Enforcement Policy provides companies that voluntarily self-disclose, cooperate, and remediate with potential declinations or reduced penalties.

Question 17: Which legal doctrine allows prosecutors to hold a corporation criminally liable for crimes committed by its employees acting within the scope of their employment?

Vicarious estoppel
Alter ego doctrine
Piercing the corporate veil
Respondeat superior (Correct answer)

Correct answer: Respondeat superior

Respondeat superior ('let the master answer') is the doctrine under which corporations face criminal liability for employees' acts within the scope of employment.

Question 18: Under SEC Rule 10b-5, insider trading liability requires proof that the defendant traded while in possession of material, nonpublic information obtained through a:

Negligent misrepresentation
Breach of fiduciary duty or similar duty of trust and confidence (Correct answer)
Regulatory filing error
Public disclosure violation

Correct answer: Breach of fiduciary duty or similar duty of trust and confidence

Under the misappropriation theory, insider trading liability requires a breach of a duty of trust and confidence owed to the source of the information.

Question 19: According to ACFE research, approximately what percentage of occupational fraud cases involve asset misappropriation?

Approximately 40%
Approximately 86% (Correct answer)
Approximately 95%
Approximately 60%

Correct answer: Approximately 86%

The ACFE Report to the Nations consistently shows asset misappropriation represents approximately 86% of all occupational fraud cases, making it the most frequent category.

Question 20: An employee is suspected of exfiltrating trade secrets via personal email. Which digital artifact would BEST confirm the specific files sent?

Windows Event Log ID 4624 (logon events)
The company's firewall logs alone
Browser cookies from the company laptop
Email server logs combined with attachment metadata from the sent folder (Correct answer)

Correct answer: Email server logs combined with attachment metadata from the sent folder

Email server logs capture message metadata including sender, recipient, timestamps, and attachment names, while the sent folder retains actual content, together providing the strongest evidence.

Question 21: When conducting a fraud investigation involving digital evidence, hash values are used to:

Compress large data sets for easier analysis
Verify that digital files have not been altered since collection (Correct answer)
Authenticate the identity of the investigator accessing files
Encrypt sensitive documents before storage

Correct answer: Verify that digital files have not been altered since collection

Hash values (e.g., MD5, SHA-256) create a unique fingerprint of digital files, allowing investigators to prove files were not modified after collection.

Question 22: During a fraud interview, the examiner presents a document that contradicts the witness's statement. The witness immediately changes their story entirely. What should the examiner do?

Accept the new story since it now matches the evidence
Destroy the original statement to avoid confusion
End the interview and refer the matter to law enforcement
Note the inconsistency, probe why the account changed, and assess credibility (Correct answer)

Correct answer: Note the inconsistency, probe why the account changed, and assess credibility

Sudden account changes when confronted with evidence require probing to understand whether the change reflects new recollection or evasion.

Question 23: What distinguishes embezzlement from theft?

Embezzlement involves misappropriating property lawfully entrusted to the fraudster (Correct answer)
Theft always involves physical property
Embezzlement involves force or threat
Embezzlement requires a third-party accomplice

Correct answer: Embezzlement involves misappropriating property lawfully entrusted to the fraudster

Embezzlement involves the fraudulent conversion of property by someone who was lawfully entrusted with it, distinguishing it from ordinary theft where no prior lawful possession exists.

Question 24: In federal court, communications between a testifying expert and retaining counsel are:

Generally protected except for communications that contain facts the expert considered, compensation details, and instructions affecting opinions (Correct answer)
Only discoverable if the expert is being paid more than $500 per hour
Fully discoverable by the opposing party without restriction
Completely protected under attorney-client privilege

Correct answer: Generally protected except for communications that contain facts the expert considered, compensation details, and instructions affecting opinions

FRCP 26(b)(4)(C) protects most draft reports and attorney-expert communications, but requires disclosure of facts provided, compensation, and any assumptions counsel directed the expert to make.

Question 25: When implementing insurance fraud investigation practices, what should CFS professionals prioritize?

Cost reduction as the sole objective
Speed of implementation above all else
Alignment with professional standards, stakeholder needs, and organizational goals (Correct answer)
Personal preferences and comfort level

Correct answer: Alignment with professional standards, stakeholder needs, and organizational goals

Effective implementation of insurance fraud investigation requires balancing professional standards, stakeholder needs, and organizational objectives for optimal results.

Question 26: A Deferred Prosecution Agreement (DPA) differs from a Non-Prosecution Agreement (NPA) primarily in that a DPA:

Requires no admission of wrongdoing
Grants full immunity from prosecution
Files charges that are held in abeyance pending compliance (Correct answer)
Is only available to individuals, not corporations

Correct answer: Files charges that are held in abeyance pending compliance

In a DPA, the government files criminal charges but agrees to defer prosecution if the company meets compliance conditions, whereas an NPA involves no filed charges.

Question 27: Which expense reimbursement fraud involves an employee submitting the same expense more than once?

Overstated expense scheme
Altered receipt scheme
Fictitious expense scheme
Duplicate reimbursement scheme (Correct answer)

Correct answer: Duplicate reimbursement scheme

Duplicate reimbursement fraud occurs when an employee submits the same receipt or expense claim multiple times, often through different channels or time periods.

Question 28: What is the primary purpose of a corporate code of conduct?

To satisfy IRS reporting requirements
To define the company's marketing strategy
To establish employee compensation scales
To set behavioral standards and ethical expectations for all employees (Correct answer)

Correct answer: To set behavioral standards and ethical expectations for all employees

A corporate code of conduct establishes the ethical standards, behaviors, and values expected of all employees, forming the foundation of an anti-fraud culture.

Question 29: Under the Federal Rules of Civil Procedure Rule 26(a)(2), an expert's written report must include:

A complete statement of all opinions and the basis and reasons for them (Correct answer)
Only the final conclusions without underlying data
The expert's billing records and hourly rate details
All communications between the expert and retaining counsel

Correct answer: A complete statement of all opinions and the basis and reasons for them

FRCP 26(a)(2) requires the report to contain all opinions the expert intends to express, plus the basis, reasoning, data considered, and exhibits.

Question 30: What is the purpose of a 'clawback' provision in executive compensation agreements as a fraud deterrent?

To require executives to invest in company stock
To allow the company to recover previously paid bonuses if financial statements are later restated due to fraud (Correct answer)
To defer bonus payments for five years automatically
To cap total annual compensation

Correct answer: To allow the company to recover previously paid bonuses if financial statements are later restated due to fraud

Clawback provisions reduce the incentive to manipulate earnings by allowing companies to recover bonuses tied to results that are later found to be misstated.

Question 31: An expert witness who testifies about matters outside the scope of their disclosed opinions may face:

Automatic disqualification from all future federal court testimony
No consequence, as experts may freely expand their testimony at trial
Exclusion of the out-of-scope testimony and potential sanctions under FRCP 37 (Correct answer)
Criminal contempt charges under 18 U.S.C. § 401

Correct answer: Exclusion of the out-of-scope testimony and potential sanctions under FRCP 37

FRCP 37(c)(1) provides that failure to properly disclose expert opinions results in exclusion of that testimony and potentially other sanctions.

Question 32: Which FCPA provision prohibits U.S. companies from bribing foreign government officials to obtain or retain business?

Accounting provisions
Disclosure provisions
Internal controls provisions
Anti-bribery provisions (Correct answer)

Correct answer: Anti-bribery provisions

The FCPA's anti-bribery provisions explicitly prohibit offering, paying, or authorizing payments to foreign officials to obtain or retain business.

Question 33: What is the relationship between money laundering & aml compliance and overall Certified Fraud Specialist professional competency?

It is a minor supplementary skill
It only applies to senior practitioners
They are completely unrelated areas
It is an essential component that strengthens the overall competency framework (Correct answer)

Correct answer: It is an essential component that strengthens the overall competency framework

Money Laundering & AML Compliance is an essential component of the CFS competency framework, strengthening overall professional capability and credibility.

Question 34: Which internal control is MOST effective at preventing unauthorized journal entries used to conceal embezzlement?

Monthly bank reconciliations prepared by the bookkeeper
Requiring dual signatures on checks over $5,000
Segregation of duties between journal entry preparers and approvers (Correct answer)
Annual external audit of financial statements

Correct answer: Segregation of duties between journal entry preparers and approvers

Requiring a separate, independent approver for journal entries prevents a single employee from both creating and posting entries that hide theft.

Question 35: A drug trafficking organization uses a chain of legitimate restaurants to mix drug proceeds with lawful restaurant revenues before reporting it as business income. This technique primarily exploits which money laundering stage?

Extraction through wire transfers
Layering through correspondent banking
Placement through commingling (Correct answer)
Integration through trade finance

Correct answer: Placement through commingling

Commingling illegal proceeds with legitimate business revenues is a placement technique that makes the illicit funds appear to be lawful income.

Question 36: In fraud investigations, 'corroborating evidence' refers to:

Additional evidence that supports or confirms other evidence already gathered (Correct answer)
Evidence that directly proves the fraud occurred
Testimony obtained from a co-conspirator
Documents seized under a search warrant

Correct answer: Additional evidence that supports or confirms other evidence already gathered

Corroborating evidence independently supports or strengthens other evidence, increasing the overall reliability of the investigative findings.

Question 37: An investigator reviewing a life insurance application discovers the insured's medical history was misrepresented. The insured died within the contestability period. The insurer's BEST course of action is:

Refer immediately to the state insurance department before any claim decision
Reduce the death benefit by the fraudulent premium differential
Rescind the policy and deny the claim based on material misrepresentation (Correct answer)
Pay the claim to avoid bad faith exposure

Correct answer: Rescind the policy and deny the claim based on material misrepresentation

Material misrepresentation on an application allows the insurer to rescind the policy during the contestability period, typically two years.

Question 38: Which identity theft scenario best illustrates 'true name fraud'?

A fraudster slightly alters their own identity details to evade detection
Someone uses another real person's actual identity to obtain credit (Correct answer)
A fraudster uses all fabricated information to create a fake person
A company employee steals customer data for personal gain

Correct answer: Someone uses another real person's actual identity to obtain credit

True name fraud occurs when a thief uses a real victim's actual name, Social Security number, and other identifying information to open new accounts or obtain services.

Question 39: In the context of premium fraud, 'fronting' refers to:

Creating a fictitious business to obtain commercial coverage
Falsifying a company's payroll to reduce workers' comp premiums
Using a low-risk driver as the listed primary driver to reduce auto premiums for a high-risk actual driver (Correct answer)
Submitting claims before the premium payment clears

Correct answer: Using a low-risk driver as the listed primary driver to reduce auto premiums for a high-risk actual driver

Fronting places a lower-risk driver as the named insured on an auto policy to obtain cheaper premiums for a higher-risk primary driver.

Question 40: Which technique is MOST appropriate when an investigator wants to assess the truthfulness of a subject's statement without a formal interview?

Covert surveillance
Statement analysis of written accounts (Correct answer)
Social media monitoring
Polygraph examination

Correct answer: Statement analysis of written accounts

Statement analysis examines the linguistic structure of written or verbal accounts to identify deception indicators without formal interrogation.

Question 41: What is the main purpose of the Foreign Corrupt Practices Act (FCPA)?

To regulate environmental practices.
To establish labor laws.
To manage tax reporting.
To prevent bribery of foreign officials. (Correct answer)

Correct answer: To prevent bribery of foreign officials.

The main purpose of the Foreign Corrupt Practices Act (FCPA) is to prevent the bribery of foreign officials by U.S. companies and individuals. This law prohibits offering or giving anything of value to foreign government officials to obtain or retain business. The FCPA aims to combat corruption on an international scale and promote fair and transparent business practices globally.

Question 42: What is a common method used by fraudsters to conceal asset misappropriation?

Refusing to sign expense reports.
Recording fake sales to inflate revenue.
Creating fictitious vendors or invoices. (Correct answer)
Reporting extra hours worked.

Correct answer: Creating fictitious vendors or invoices.

Creating fictitious vendors or invoices is a common method fraudsters use to conceal asset misappropriation, particularly in schemes like false billing or procurement fraud. By generating fake documentation for goods or services never received, they can authorize payments that are then diverted for personal gain. This method makes it appear as though legitimate business expenses are being paid, masking the theft of company funds.

Question 43: Which of the following best describes a 'residual risk' in the context of fraud risk assessment?

The risk transferred to a third party through insurance
The risk identified but deemed immaterial for reporting
The risk of fraud that remains after management applies controls (Correct answer)
The initial fraud risk before any controls are applied

Correct answer: The risk of fraud that remains after management applies controls

Residual risk is the exposure that remains after existing controls have been applied to the inherent risk, representing the net fraud exposure.

Question 44: When implementing witness interviewing techniques practices, what should CFS professionals prioritize?

Speed of implementation above all else
Personal preferences and comfort level
Alignment with professional standards, stakeholder needs, and organizational goals (Correct answer)
Cost reduction as the sole objective

Correct answer: Alignment with professional standards, stakeholder needs, and organizational goals

Effective implementation of witness interviewing techniques requires balancing professional standards, stakeholder needs, and organizational objectives for optimal results.

Question 45: How should CFS professionals measure success in identity theft & prevention?

Using defined metrics, benchmarks, and regular evaluation against established goals (Correct answer)
By comparing only to minimum requirements
Success measurement is not applicable
Through subjective self-assessment only

Correct answer: Using defined metrics, benchmarks, and regular evaluation against established goals

Success in identity theft & prevention is measured through defined metrics and benchmarks, with regular evaluation against established professional goals.

Question 46: An investigator uses social engineering to gain access to a suspect's computer files without authorization. This action is best described as:

An illegal and unethical method that violates privacy laws (Correct answer)
Acceptable only with verbal management approval
Ethically permissible if fraud is suspected
A legitimate covert investigation technique

Correct answer: An illegal and unethical method that violates privacy laws

Unauthorized access to computer files via social engineering violates computer fraud laws (e.g., CFAA) and professional ethics regardless of suspected wrongdoing.

Question 47: Under the USA PATRIOT Act Section 312, US financial institutions must apply Enhanced Due Diligence (EDD) to correspondent accounts opened for:

US credit unions offering international wire services
Foreign branches of US banks
Foreign banks operating under offshore banking licenses with no physical presence (Correct answer)
Domestic community banks with assets under $1 billion

Correct answer: Foreign banks operating under offshore banking licenses with no physical presence

Section 312 requires EDD for foreign banks with offshore banking licenses (shell banks) or those operating in jurisdictions deemed high risk by the US government.

Question 48: Which document best supports detection of fictitious employees in a payroll fraud scheme?

Bank reconciliations
Fixed asset register
Vendor invoices
HR personnel files with verified I-9 forms (Correct answer)

Correct answer: HR personnel files with verified I-9 forms

Verifying personnel files and I-9 documentation confirms that all employees on payroll are legitimate, real individuals.

Question 49: A company executive who turns government informant and cooperates with prosecutors typically receives a formal agreement known as a:

Plea agreement
Deferred prosecution agreement
Non-prosecution agreement
Cooperation agreement (Correct answer)

Correct answer: Cooperation agreement

A cooperation agreement formalizes the terms under which a defendant provides substantial assistance to prosecutors in exchange for sentencing consideration.

Question 50: A fraud examiner reviewing IT general controls would focus on all of the following EXCEPT:

Physical security of data centers
Change management procedures
Access controls to systems and data
Gross profit margin trends (Correct answer)

Correct answer: Gross profit margin trends

Gross profit margin trends are a financial analytical procedure, not an IT general control; IT general controls cover access, change management, operations, and physical security.

Question 51: During an interview, the subject uses excessive qualifiers such as 'to the best of my recollection' and 'I believe.' In deception analysis, this pattern is MOST associated with:

Possible evasion or uncertainty about a scripted story (Correct answer)
High confidence truthfulness
Normal language patterns for educated professionals
Indicators of cognitive impairment

Correct answer: Possible evasion or uncertainty about a scripted story

Excessive qualifiers can signal that a subject is hedging to avoid being caught in a direct lie about events they know occurred.

Question 52: In a civil fraud case, the standard of proof required to prevail is:

Preponderance of the evidence (Correct answer)
Probable cause
Clear and convincing evidence
Beyond a reasonable doubt

Correct answer: Preponderance of the evidence

Civil fraud claims require proof by a preponderance of the evidence (more likely than not), though some jurisdictions require clear and convincing evidence.

Question 53: How does internal controls & auditing contribute to professional excellence in CFS certification?

It enhances competency, improves outcomes, and supports continuous professional growth (Correct answer)
It benefits organizations but not individual practitioners
It only matters during certification exams
It has no measurable impact on practice

Correct answer: It enhances competency, improves outcomes, and supports continuous professional growth

Internal Controls & Auditing is integral to CFS professional excellence, directly enhancing competency and driving measurable improvement in practice outcomes.

Question 54: Which concept describes the risk that remains after management has implemented controls to reduce inherent risk?

Audit risk
Detection risk
Control risk
Residual risk (Correct answer)

Correct answer: Residual risk

Residual risk is the remaining exposure after controls have been applied; it represents the risk that the organization accepts or must further mitigate.

Question 55: Advance fee fraud (also known as 419 fraud) primarily targets victims by:

Filing false tax returns using stolen Social Security numbers
Promising large returns in exchange for an upfront payment that is never returned (Correct answer)
Cloning credit cards at point-of-sale terminals
Hacking into bank accounts directly

Correct answer: Promising large returns in exchange for an upfront payment that is never returned

Advance fee fraud tricks victims into paying upfront fees with false promises of receiving much larger sums, after which the fraudster disappears with the fee.

Question 56: A consumer discovers their medical records contain treatments they never received. This is an example of:

Insurance premium fraud
Medical identity theft (Correct answer)
Healthcare billing fraud
Prescription drug diversion

Correct answer: Medical identity theft

Medical identity theft occurs when someone uses another person's identity to obtain healthcare services, prescriptions, or medical devices, corrupting the victim's medical records.

Question 57: Which type of audit opinion is issued when financial statements are free of material misstatement but the auditor has a scope limitation?

Qualified opinion (Correct answer)
Disclaimer of opinion
Unmodified opinion
Adverse opinion

Correct answer: Qualified opinion

A qualified opinion is issued when the financial statements are fairly presented except for a specific matter, including certain scope limitations.

Question 58: According to ACFE research, what is the most common initial detection method for occupational fraud, including asset misappropriation?

External audit
Internal audit review
A tip from an employee or other informant (Correct answer)
Automated fraud detection software

Correct answer: A tip from an employee or other informant

ACFE research consistently shows that tips are the most frequent initial detection method for occupational fraud, underscoring the critical importance of anonymous reporting hotlines.

Question 59: Which red flag is most commonly associated with billing fraud by an accounts payable clerk?

Declining vendor count
Invoices lacking purchase order numbers (Correct answer)
Increasing inventory levels
Lower-than-average expense ratios

Correct answer: Invoices lacking purchase order numbers

Fraudulent invoices often bypass the normal purchase order process, making the absence of a PO number a key red flag.

Question 60: Under the Federal Sentencing Guidelines, what term describes a formal program designed to prevent and detect criminal conduct within an organization?

Risk management plan
Effective compliance and ethics program (Correct answer)
Internal control framework
Whistleblower protection policy

Correct answer: Effective compliance and ethics program

The Federal Sentencing Guidelines use the term 'effective compliance and ethics program' to describe the formal structure organizations must have to earn culpability score reductions.

Question 61: A significant deficiency in internal controls differs from a material weakness in that:

A significant deficiency must be reported to external regulators immediately
Material weaknesses only apply to IT controls while significant deficiencies apply to financial controls
A material weakness represents a higher probability of material misstatement than a significant deficiency (Correct answer)
A significant deficiency involves more employees than a material weakness

Correct answer: A material weakness represents a higher probability of material misstatement than a significant deficiency

A material weakness indicates a reasonable possibility of material misstatement, while a significant deficiency is a lesser but still noteworthy control gap that warrants attention.

Question 62: An employee who reports suspected fraud internally but is then terminated may have a retaliation claim under which SOX provision?

Section 806 (Correct answer)
Section 1107
Section 404
Section 302

Correct answer: Section 806

SOX Section 806 protects employees of publicly traded companies who report suspected securities fraud from retaliation.

Question 63: The legal concept that evidence obtained through an unlawful search cannot be used in criminal proceedings is known as the:

Plain view doctrine
Exclusionary rule (Correct answer)
Fruit of the poisonous tree doctrine
Good faith exception

Correct answer: Exclusionary rule

The exclusionary rule bars the use of evidence obtained in violation of the Fourth Amendment in criminal prosecutions.

Question 64: The primary purpose of a fraud risk register is to:

Maintain a log of all internal audit findings for the year
Track the employment history of employees convicted of fraud
Record identified fraud risks, their assessments, and assigned responses (Correct answer)
Document confirmed fraud incidents for law enforcement referral

Correct answer: Record identified fraud risks, their assessments, and assigned responses

A fraud risk register serves as the central repository for all identified fraud risks, their likelihood/impact ratings, existing controls, and planned remediation actions.

Question 65: Which of the following best describes 'trade-based money laundering' (TBML)?

Laundering funds through commodity futures contracts
Using barter transactions to avoid cash reporting
Using stock market trades to conceal fraud proceeds
Over- or under-invoicing goods in international trade to transfer value across borders (Correct answer)

Correct answer: Over- or under-invoicing goods in international trade to transfer value across borders

TBML exploits international trade by manipulating invoice prices to move value between countries while disguising it as legitimate commerce.

Question 66: Which control is most effective at preventing payroll fraud involving fictitious (ghost) employees?

Management approval of all overtime requests
Fully automated payroll processing systems
Mandatory direct deposit for all employees
Segregation of duties between HR and payroll combined with periodic headcount verification (Correct answer)

Correct answer: Segregation of duties between HR and payroll combined with periodic headcount verification

Segregating HR functions (adding/removing employees) from payroll processing, combined with physical headcount verification, prevents one person from unilaterally creating and paying ghost employees.

Question 67: What is the primary purpose of fraud risk assessments in an organization?

To calculate financial losses from past fraud.
To identify and evaluate potential fraud risks within the organization. (Correct answer)
To establish internal audit schedules.
To hire external fraud investigators.

Correct answer: To identify and evaluate potential fraud risks within the organization.

Fraud risk assessments are a critical proactive measure for organizations. Their primary purpose is to systematically identify potential vulnerabilities and scenarios where fraud could occur within the organization. By evaluating the likelihood and impact of these risks, management can then implement targeted controls and strategies to mitigate them, thereby protecting assets and reputation.

Question 68: An expert witness who becomes 'an advocate for the client' rather than an objective analyst is said to suffer from:

Cognitive dissonance
Advocacy bias or 'hired gun' syndrome (Correct answer)
The halo effect
Confirmation bias only

Correct answer: Advocacy bias or 'hired gun' syndrome

'Hired gun' syndrome describes the loss of objectivity when an expert becomes psychologically aligned with the client's position rather than the evidence.

Question 69: A bank customer deposits $9,500 on Monday and $9,500 on Tuesday to avoid CTR reporting. This behavior is known as:

Placement
Layering
Structuring (smurfing) (Correct answer)
Integration

Correct answer: Structuring (smurfing)

Structuring, also called smurfing, involves breaking up large cash transactions into smaller amounts to evade reporting thresholds.

Question 70: A claimant submitting a disability claim under a long-term disability policy is videotaped performing heavy construction work. During the recorded statement, the investigator should:

Ask open-ended questions about daily activities without revealing the video (Correct answer)
Request the claimant sign a medical authorization before discussing activities
Terminate the interview and refer directly to law enforcement
Immediately confront the claimant with the surveillance video

Correct answer: Ask open-ended questions about daily activities without revealing the video

Investigators should use open-ended questions to obtain the claimant's own account of their limitations before disclosing contradictory evidence.

Question 71: A company requires that journal entries above $10,000 be approved by the CFO. This control is best classified as:

Detective control
Compensating control
Preventive control (Correct answer)
Corrective control

Correct answer: Preventive control

Requiring CFO approval before posting large journal entries is a preventive control because it stops unauthorized entries from being recorded.

Question 72: A witness interview reveals that an employee was aware of a fraud scheme but did not report it. Under which legal theory could this witness potentially face liability?

Willful blindness or conscious avoidance (Correct answer)
Respondeat superior
Vicarious liability only
The witness has no legal exposure for non-disclosure

Correct answer: Willful blindness or conscious avoidance

Willful blindness doctrine holds that a party cannot deliberately avoid knowledge of illegal activity to escape liability.

Question 73: Which act established the Public Company Accounting Oversight Board (PCAOB)?

Securities Exchange Act of 1934
Sarbanes-Oxley Act (Correct answer)
Gramm-Leach-Bliley Act
Dodd-Frank Act

Correct answer: Sarbanes-Oxley Act

SOX Section 101 created the PCAOB as a nonprofit corporation to oversee audits of public companies and protect investors.

Question 74: When serving legal process to obtain electronic evidence from a U.S.-based social media company, which legal instrument compels the company to produce subscriber information and content?

A subpoena or court order under 18 U.S.C. § 2703 (Stored Communications Act) (Correct answer)
A letter rogatory
A cease and desist letter
An administrative law judge order

Correct answer: A subpoena or court order under 18 U.S.C. § 2703 (Stored Communications Act)

The Stored Communications Act (18 U.S.C. § 2703) establishes the legal framework requiring government entities to use subpoenas, court orders, or warrants to compel electronic service providers to disclose user data.

Question 75: Under the Foreign Corrupt Practices Act (FCPA), which type of payment to a foreign official is specifically exempted from anti-bribery provisions?

Gifts exceeding $250 to customs officials
Payments disguised as consulting fees
Payments to secure large government contracts
Facilitating payments for routine governmental actions already owed (Correct answer)

Correct answer: Facilitating payments for routine governmental actions already owed

The FCPA's narrow 'facilitating payments' exception covers small payments to expedite routine, non-discretionary government actions such as processing permits.

Question 76: A Politically Exposed Person (PEP) is best defined as:

A customer with transactions exceeding $1 million annually
An individual entrusted with a prominent public function and their close associates (Correct answer)
Any customer flagged by law enforcement
Any foreign national opening a US bank account

Correct answer: An individual entrusted with a prominent public function and their close associates

PEPs are individuals who hold or have held prominent public positions — such as heads of state, senior politicians, or military officers — and pose higher corruption and bribery risks.

Question 77: What challenge is most commonly encountered in money laundering & aml compliance within Certified Fraud Specialist practice?

Unlimited budget allocation
Lack of available training materials
Resistance to change and difficulty maintaining consistency across stakeholders (Correct answer)
Excessive regulatory support

Correct answer: Resistance to change and difficulty maintaining consistency across stakeholders

The most common challenge in money laundering & aml compliance is overcoming resistance to change while maintaining consistent implementation across diverse stakeholders.

Question 78: An organization identifies a fraud risk but determines that the cost of controls exceeds the potential loss. The appropriate risk response is to:

Avoid the risk by exiting the business activity entirely
Accept the risk and document the decision with board awareness (Correct answer)
Transfer the risk through an employee fidelity bond
Implement the controls anyway to demonstrate due diligence

Correct answer: Accept the risk and document the decision with board awareness

When control costs exceed the expected loss, risk acceptance is appropriate, but the decision should be documented and approved by appropriate governance levels.

Question 79: A billing scheme using a shell company typically involves:

Using company credit cards for personal purchases
Overstating legitimate vendor invoices by a small percentage
Submitting invoices from a fictitious company controlled by the fraudster (Correct answer)
Falsifying expense reports for non-existent travel

Correct answer: Submitting invoices from a fictitious company controlled by the fraudster

Shell company billing schemes involve the fraudster establishing a fictitious vendor entity and submitting invoices for goods or services never actually provided.

Question 80: An investigator conducting surveillance must ensure that all surveillance activities:

Comply with applicable laws regarding privacy and public versus private spaces (Correct answer)
Are approved by the subject's employer before beginning
Are conducted only during normal business hours
Include audio recording to capture conversations as evidence

Correct answer: Comply with applicable laws regarding privacy and public versus private spaces

Surveillance must operate within legal privacy frameworks; what is permissible in public may not be in private spaces, and recording laws vary by jurisdiction.

Question 81: The 'layering' stage of money laundering is primarily designed to:

Create distance between funds and their criminal origin through complex transactions (Correct answer)
Make laundered funds appear as legitimate income
Bribe financial institution employees
Introduce illegal funds into the financial system

Correct answer: Create distance between funds and their criminal origin through complex transactions

Layering involves creating a complex web of financial transactions — wire transfers, shell companies, currency conversions — to obscure the audit trail.

Question 82: Which IRS form must U.S. persons file to report a financial interest in or signature authority over foreign financial accounts exceeding $10,000?

Form 8938
FinCEN Form 114 (FBAR) (Correct answer)
Form 5471
Form 1099-INT

Correct answer: FinCEN Form 114 (FBAR)

FinCEN Form 114, known as the FBAR, must be filed annually by U.S. persons with foreign financial account balances exceeding $10,000 at any point during the year.

Question 83: When an attorney instructs an expert witness 'don't volunteer information' before testimony, this instruction is:

A form of witness tampering under federal law
Unethical and should be reported to the bar
Irrelevant since experts must answer all questions fully
A standard and legitimate preparation instruction (Correct answer)

Correct answer: A standard and legitimate preparation instruction

Advising a witness to answer only what is asked, without volunteering extra information, is standard and permissible trial preparation.

Question 84: Which international body issues the global anti-money laundering standards known as the '40 Recommendations'?

World Bank
Basel Committee on Banking Supervision
FATF (Financial Action Task Force) (Correct answer)
IMF

Correct answer: FATF (Financial Action Task Force)

The Financial Action Task Force (FATF) is the intergovernmental body that develops and promotes the 40 Recommendations as the global AML/CFT standard.

Question 85: When interviewing a fraud suspect using the cognitive interview technique, what is the primary goal?

Confronting the suspect with contradictory evidence
Obtaining a confession as quickly as possible
Maximizing the amount of accurate information recalled (Correct answer)
Establishing a rapport before accusatory questioning

Correct answer: Maximizing the amount of accurate information recalled

The cognitive interview uses memory-enhancing techniques to help subjects recall more complete and accurate information.

Question 86: Which regulatory body oversees securities markets in the U.S.?

Environmental Protection Agency.
Occupational Safety and Health Administration.
Federal Trade Commission.
Securities and Exchange Commission (SEC). (Correct answer)

Correct answer: Securities and Exchange Commission (SEC).

The Securities and Exchange Commission (SEC) is the primary regulatory body that oversees securities markets in the U.S. Its mission is to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation. The SEC achieves this by enforcing federal securities laws, requiring public companies to disclose financial information, and regulating market participants.

Question 87: Which psychological concept explains why a witness might change their account when they learn that others have given different statements?

Anchoring effect
Dunning-Kruger effect
Social conformity pressure (Correct answer)
Confirmation bias

Correct answer: Social conformity pressure

Social conformity pressure can cause witnesses to alter their accounts to align with what they believe others have said.

Question 88: An investigator discovers that a key witness has a financial incentive to provide favorable testimony. This situation represents a risk to which investigative principle?

Confidentiality
Due professional care
Witness reliability and credibility (Correct answer)
Chain of custody

Correct answer: Witness reliability and credibility

A witness with a financial incentive has a bias that undermines their credibility and the reliability of their testimony in the investigation.

Question 89: Which act requires publicly traded companies to establish internal controls over financial reporting?

Sarbanes-Oxley Act. (Correct answer)
Dodd-Frank Act.
Health Insurance Portability and Accountability Act.
Gramm-Leach-Bliley Act.

Correct answer: Sarbanes-Oxley Act.

The Sarbanes-Oxley Act (SOX) of 2002 specifically requires publicly traded companies to establish and maintain adequate internal controls over financial reporting. Section 404 of SOX mandates that management assess the effectiveness of these controls annually, and external auditors must attest to management's assessment. This provision aims to enhance the accuracy and reliability of financial statements and protect investors.

Question 90: Under the attorney-client privilege, communications are protected only when they are made:

Between a client and attorney for the purpose of seeking legal advice (Correct answer)
Between any employees discussing legal matters
In writing and marked confidential
With in-house counsel in all circumstances

Correct answer: Between a client and attorney for the purpose of seeking legal advice

Attorney-client privilege protects confidential communications between a client and their attorney made for the purpose of obtaining legal advice.

Question 91: Which method is commonly used to conceal fraudulent financial transactions?

Using transparent accounting methods.
Reporting transactions immediately.
Disclosing transactions in financial statements.
Layering transactions to obscure their origin. (Correct answer)

Correct answer: Layering transactions to obscure their origin.

Layering transactions is a common method used by fraudsters to conceal the origin and nature of illicit funds or fraudulent financial transactions. This involves conducting a series of complex and often numerous transactions, such as moving money through multiple bank accounts or different types of investments. The goal is to obscure the audit trail, making it extremely difficult to trace the funds back to their illegal source and legitimize their appearance.

Question 92: A supervisor who approves their own subordinate's expense reports is an example of a breakdown in:

Physical access controls
Background check procedures
Segregation of duties (Correct answer)
IT general controls

Correct answer: Segregation of duties

Segregation of duties requires that no single person control all phases of a transaction, including both submission and approval.

Question 93: Which circumstance would most appropriately lead an expert witness to change their opinion before trial?

New documentary evidence is produced in discovery that contradicts prior assumptions (Correct answer)
Retaining counsel pressures the expert to align with a higher damages figure
The opposing expert published a paper disagreeing with the methodology
The client's settlement demand increases significantly

Correct answer: New documentary evidence is produced in discovery that contradicts prior assumptions

New material evidence that changes the factual basis of an opinion legitimately requires the expert to revise their conclusions.

Question 94: In fraud risk assessment, 'collusion' is significant because it:

Defeats segregation of duties controls that would otherwise prevent fraud (Correct answer)
Is always detectable through standard data analytics procedures
Requires involvement of external parties to be classified as fraud
Reduces the likelihood that fraud will be material in amount

Correct answer: Defeats segregation of duties controls that would otherwise prevent fraud

Collusion between two or more individuals allows them to circumvent segregation of duties, which is one of the most fundamental preventive controls against fraud.

Question 95: Which of the following is a red flag of financial statement fraud?

Regular cash flow reports.
Sudden unexplained spikes in revenue. (Correct answer)
Consistent financial growth.
Decreasing expenses.

Correct answer: Sudden unexplained spikes in revenue.

Sudden unexplained spikes in revenue are a significant red flag for financial statement fraud. Such increases, especially when not supported by corresponding business activity, market growth, or economic conditions, often indicate aggressive or fraudulent revenue recognition practices. Fraudsters might record fictitious sales, prematurely recognize revenue, or manipulate sales figures to artificially inflate the company's financial performance.

Question 96: Which ethical principle requires a fraud investigator to maintain competence in the methods and tools used during an investigation?

Due professional care (Correct answer)
Objectivity
Confidentiality
Independence

Correct answer: Due professional care

Due professional care requires investigators to possess the knowledge, skills, and diligence necessary to perform their work competently.

Question 97: Which regulatory requirement focuses on protecting personal health information?

Sarbanes-Oxley Act.
Health Insurance Portability and Accountability Act (HIPAA). (Correct answer)
Consumer Protection Act.
Fair Credit Reporting Act.

Correct answer: Health Insurance Portability and Accountability Act (HIPAA).

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes national standards to protect sensitive patient health information. It mandates strict rules for healthcare providers, health plans, and other entities regarding the privacy and security of Protected Health Information (PHI). HIPAA ensures individuals' medical records and personal health data are kept confidential and secure.

Question 98: In a corporate investigation, documents created by outside counsel while conducting an internal investigation are typically protected from disclosure under:

Spousal privilege
Work product doctrine (Correct answer)
The business records exception
The common interest privilege

Correct answer: Work product doctrine

The work product doctrine protects documents prepared by or for an attorney in anticipation of litigation, including internal investigation materials.

Question 99: Which hashing algorithm is currently recommended for verifying digital forensic evidence integrity due to its collision resistance?

SHA-1
MD5
SHA-256 (Correct answer)
CRC32

Correct answer: SHA-256

SHA-256 is currently recommended for forensic integrity verification as MD5 and SHA-1 have known collision vulnerabilities that could theoretically be exploited to challenge evidence authenticity.

Question 100: How does fraud risk assessment frameworks contribute to professional excellence in CFS certification?

It benefits organizations but not individual practitioners
It only matters during certification exams
It enhances competency, improves outcomes, and supports continuous professional growth (Correct answer)
It has no measurable impact on practice

Correct answer: It enhances competency, improves outcomes, and supports continuous professional growth

Fraud Risk Assessment Frameworks is integral to CFS professional excellence, directly enhancing competency and driving measurable improvement in practice outcomes.

Question 101: The 'reasonable assurance' concept in internal controls means that:

External auditors guarantee the accuracy of financial statements
All fraud will be detected by an effective control system
Controls eliminate all material risks if properly designed
The cost of controls should not exceed the expected benefit (Correct answer)

Correct answer: The cost of controls should not exceed the expected benefit

Reasonable assurance acknowledges that controls involve cost-benefit tradeoffs and that no system can eliminate all risk, but costs of controls should not exceed their benefits.

Question 102: When a suspect's hard drive is seized, the FIRST action a digital forensics examiner should take is:

Create a forensic bit-for-bit image of the drive before any analysis (Correct answer)
Power on the system to check running processes
Search the drive for documents containing financial data
Install forensic software directly onto the suspect drive

Correct answer: Create a forensic bit-for-bit image of the drive before any analysis

Creating a verified forensic image preserves the original evidence in its exact state, allowing all analysis to be performed on copies without risking alteration of the original.

Question 103: Under the Sarbanes-Oxley Act, what is the maximum criminal penalty for knowingly destroying documents to obstruct a federal investigation?

25 years imprisonment
20 years imprisonment (Correct answer)
5 years imprisonment
10 years imprisonment

Correct answer: 20 years imprisonment

SOX Section 1102 imposes up to 20 years imprisonment for knowingly destroying or falsifying records to obstruct a federal investigation.

Question 104: Which of the following is a PRIMARY responsibility of the board of directors in the fraud risk management framework?

Designing specific internal controls for each business unit
Overseeing management's fraud risk assessment process (Correct answer)
Conducting day-to-day transaction monitoring
Performing investigative procedures when fraud is suspected

Correct answer: Overseeing management's fraud risk assessment process

The board provides oversight of management's fraud risk management activities, ensuring the program is adequate and functioning effectively.

Question 105: A fraud risk assessment reveals a high-likelihood, low-impact scheme. According to risk management best practices, this risk should primarily be:

Avoided by discontinuing the related business process
Mitigated with cost-effective preventive controls (Correct answer)
Accepted without controls because the impact is low
Transferred to an insurer immediately

Correct answer: Mitigated with cost-effective preventive controls

High-likelihood risks warrant active mitigation even when impact is low, because frequent occurrences can accumulate into significant aggregate losses.

Question 106: What is the best description of the 'fraud triangle'?

An audit procedure.
A model illustrating pressure, opportunity, and rationalization behind fraud. (Correct answer)
A method to calculate fraud losses.
A legal framework for prosecuting fraud.

Correct answer: A model illustrating pressure, opportunity, and rationalization behind fraud.

The 'fraud triangle' is a widely recognized model that explains the three conditions typically present when an individual commits fraud. These elements are perceived financial pressure (a motive), perceived opportunity (the means to commit and conceal), and rationalization (justifying the dishonest act). Understanding this model helps organizations develop more effective fraud prevention and detection strategies by addressing these underlying factors.

Question 107: The ACFE's Report to the Nations consistently finds that the most common method of detecting occupational fraud is:

Management review
Tips (Correct answer)
External audit
Internal audit

Correct answer: Tips

According to ACFE research, tips — often received through hotlines — are the leading fraud detection method across all organization sizes.

Question 108: In a digital fraud investigation involving deleted files, which concept explains why deleted files may still be recoverable from a hard drive?

Deleting a file typically removes only the directory entry while the actual data blocks remain until overwritten (Correct answer)
RAID redundancy automatically preserves deleted files
Cloud backup systems automatically restore deleted files to local storage
Operating systems maintain a 30-day hidden recycle buffer for all deletions

Correct answer: Deleting a file typically removes only the directory entry while the actual data blocks remain until overwritten

Most operating systems mark deleted file space as available but don't immediately overwrite data blocks, allowing forensic tools to recover file content until those blocks are reused.

Question 109: Which law mandates organizations to safeguard consumer financial information?

Freedom of Information Act.
Fair Labor Standards Act.
Federal Arbitration Act.
Gramm-Leach-Bliley Act. (Correct answer)

Correct answer: Gramm-Leach-Bliley Act.

The Gramm-Leach-Bliley Act (GLBA) is a U.S. federal law that requires financial institutions to explain their information-sharing practices to customers and to safeguard sensitive data. It mandates that these institutions protect the privacy of consumer financial information. This includes implementing security measures to prevent unauthorized access to or use of such data.

Question 110: How does expert testimony & court presentation contribute to professional excellence in CFS certification?

It only matters during certification exams
It enhances competency, improves outcomes, and supports continuous professional growth (Correct answer)
It benefits organizations but not individual practitioners
It has no measurable impact on practice

Correct answer: It enhances competency, improves outcomes, and supports continuous professional growth

Expert Testimony & Court Presentation is integral to CFS professional excellence, directly enhancing competency and driving measurable improvement in practice outcomes.

Question 111: When assessing fraud risks in a decentralized organization with multiple subsidiaries, which approach is MOST comprehensive?

Conducting separate assessments at each subsidiary and aggregating results (Correct answer)
Performing the assessment only at the parent company headquarters
Relying on each subsidiary's external auditor to assess fraud risk
Applying the same risk profile from the parent to all subsidiaries

Correct answer: Conducting separate assessments at each subsidiary and aggregating results

Each subsidiary may face unique fraud risks based on its geography, operations, and control environment, so separate assessments that are then aggregated provide the most complete picture.

Question 112: The 'conscious avoidance' or 'willful blindness' doctrine in fraud cases allows courts to infer knowledge when a defendant:

Relied on advice of counsel
Deliberately avoided learning facts that would confirm wrongdoing (Correct answer)
Actively participated in the scheme
Reported concerns to management

Correct answer: Deliberately avoided learning facts that would confirm wrongdoing

Willful blindness applies when a defendant deliberately avoided learning the truth, allowing courts to infer knowledge equivalent to actual knowledge.

Question 113: An investigator is conducting a net worth analysis on a fraud suspect. What does a significant unexplained increase in net worth suggest?

Inheritance from family members
Legitimate investment success
Normal salary progression
Possible undisclosed income from fraud proceeds (Correct answer)

Correct answer: Possible undisclosed income from fraud proceeds

Unexplained net worth increases that exceed known income sources are a classic indicator of concealed fraud proceeds.

Question 114: Which of the following is a preventive measure against vendor fraud?

Allowing vendors to set payment terms.
Vendor audits and verification. (Correct answer)
Approving all vendor payments without review.
Using only paper checks for payments.

Correct answer: Vendor audits and verification.

Vendor audits and verification are crucial preventive measures against vendor fraud. By regularly reviewing vendor contracts, invoices, and performance, and verifying the legitimacy of vendors and the services or goods they provide, organizations can detect and deter schemes. This includes identifying fictitious vendors, inflated billing, or kickbacks, ensuring that payments are made only for legitimate business purposes.

Question 115: Which SOX section protects employees of publicly traded companies who report fraud from retaliation?

Section 404
Section 806 (Correct answer)
Section 409
Section 302

Correct answer: Section 806

SOX Section 806 prohibits publicly traded companies from retaliating against employees who provide information about potential securities fraud to regulators or supervisors.

Question 116: Which element is NOT required to prove mail fraud under 18 U.S.C. § 1341?

A scheme to defraud
Use of the U.S. mail
Intent to defraud
Actual financial loss by the victim (Correct answer)

Correct answer: Actual financial loss by the victim

Mail fraud does not require proof of actual financial loss — only a scheme to defraud, intent, and use of the mails to execute the scheme.

Question 117: Which documentation method is considered BEST practice for recording a fraud witness interview?

Verbatim notes or audio/video recording with proper consent (Correct answer)
Mental notes taken after the interview ends
Only documenting information that supports the investigation theory
Paraphrased summaries written during the interview

Correct answer: Verbatim notes or audio/video recording with proper consent

Verbatim notes or recordings provide the most accurate, defensible record and prevent later disputes about what was said.

Question 118: How does witness interviewing techniques contribute to professional excellence in CFS certification?

It benefits organizations but not individual practitioners
It only matters during certification exams
It enhances competency, improves outcomes, and supports continuous professional growth (Correct answer)
It has no measurable impact on practice

Correct answer: It enhances competency, improves outcomes, and supports continuous professional growth

Witness Interviewing Techniques is integral to CFS professional excellence, directly enhancing competency and driving measurable improvement in practice outcomes.

Question 119: The term 'trier of fact' in the context of expert testimony refers to:

The jury in a jury trial, or the judge in a bench trial (Correct answer)
The judge in all cases, whether bench or jury trial
The lead attorney who evaluates the expert's report
The appellate court that reviews the trial record

Correct answer: The jury in a jury trial, or the judge in a bench trial

The trier of fact is whoever determines the facts of the case — the jury in a jury trial or the judge in a bench trial.

Question 120: When a financial institution files a Suspicious Activity Report (SAR), which of the following is true?

The institution must freeze the subject's account immediately
The institution must notify the subject of the SAR
The SAR is automatically shared with foreign regulators
The institution is prohibited from disclosing the SAR to the subject (Correct answer)

Correct answer: The institution is prohibited from disclosing the SAR to the subject

Federal law prohibits financial institutions from disclosing that a SAR has been filed or the contents of a SAR to the subject of the report.

Question 121: Which control is essential to ensure the integrity of financial reporting?

Ignoring small discrepancies.
Hiring more accountants.
Segregation of duties.
Regular account reconciliations. (Correct answer)

Correct answer: Regular account reconciliations.

Regular account reconciliations are essential for ensuring the integrity and accuracy of financial reporting. This process involves comparing internal financial records (e.g., general ledger balances) with external statements (e.g., bank statements, vendor invoices). By identifying and investigating any discrepancies, organizations can detect errors, omissions, or potential fraudulent activities, thereby maintaining reliable financial data.

Question 122: In the PEACE model of interviewing, what does the letter 'E' (second E) stand for?

Evaluation (Correct answer)
Explanation
Evidence
Engagement

Correct answer: Evaluation

In the PEACE model, the second E stands for Evaluation, where the interviewer assesses the account obtained against known facts.

Question 123: In a jury trial, the fraud examiner is presenting a chart showing a complex embezzlement scheme. The most effective presentation technique is to:

Use only written descriptions to avoid visual distraction
Build the chart incrementally, explaining each layer before adding the next (Correct answer)
Display all transactions simultaneously in a dense spreadsheet format
Present the chart only in the written report, not during live testimony

Correct answer: Build the chart incrementally, explaining each layer before adding the next

Incremental visual building helps jurors follow complex financial narratives without becoming overwhelmed.

Question 124: Under the Uniform Commercial Code (UCC), which Article governs the sale of goods and is most relevant to commercial fraud schemes?

Article 9
Article 4
Article 3
Article 2 (Correct answer)

Correct answer: Article 2

UCC Article 2 governs contracts for the sale of goods and is central to commercial fraud claims involving misrepresentation in product transactions.

Question 125: The term 'de-risking' in the AML context refers to:

Using AI to identify and mitigate fraud patterns
Converting high-risk accounts to lower-risk products
Implementing stronger internal controls to reduce ML risk
Financial institutions exiting entire market segments or customer categories to avoid AML compliance costs (Correct answer)

Correct answer: Financial institutions exiting entire market segments or customer categories to avoid AML compliance costs

De-risking occurs when financial institutions terminate relationships with entire customer categories — such as money transmitters or foreign banks — rather than managing individual customer risk.

Question 126: The legal principle that prevents prosecutors from trying a defendant twice for the same offense is known as:

Statute of limitations
Collateral estoppel
Double jeopardy (Correct answer)
Res judicata

Correct answer: Double jeopardy

The Double Jeopardy Clause of the Fifth Amendment prohibits a second prosecution for the same offense after acquittal or conviction.

Question 127: When an internal auditor discovers evidence of fraud during a routine audit, the recommended next step is to:

Report findings directly to law enforcement
Expand audit procedures and notify appropriate management or legal counsel (Correct answer)
Immediately confront the suspect employee
Terminate the audit and wait for instructions

Correct answer: Expand audit procedures and notify appropriate management or legal counsel

Upon discovering fraud indicators, the auditor should expand testing to understand the scope and promptly inform appropriate management or legal counsel rather than self-investigate.

Question 128: Which control best mitigates the risk of a system administrator granting themselves unauthorized access rights?

User access reviews conducted by business process owners (Correct answer)
Automatic session timeouts
Encryption of data at rest
Password complexity requirements

Correct answer: User access reviews conducted by business process owners

Having business process owners (not IT) periodically review and certify user access ensures that IT staff cannot grant themselves inappropriate permissions undetected.

Question 129: When auditors select transactions that do NOT appear in the system to test whether they were recorded, this is called:

Accuracy testing
Cutoff testing
Existence testing
Completeness testing (Correct answer)

Correct answer: Completeness testing

Completeness testing ensures all transactions that should be recorded have been captured, detecting schemes that involve omitting entries.

Question 130: What is the relationship between fraud risk assessment frameworks and overall Certified Fraud Specialist professional competency?

They are completely unrelated areas
It is a minor supplementary skill
It is an essential component that strengthens the overall competency framework (Correct answer)
It only applies to senior practitioners

Correct answer: It is an essential component that strengthens the overall competency framework

Fraud Risk Assessment Frameworks is an essential component of the CFS competency framework, strengthening overall professional capability and credibility.

Question 131: Under the Foreign Corrupt Practices Act, which of the following is a valid affirmative defense?

The bribe was paid to a low-level government employee
The foreign official initiated the request for payment
The payment was a reasonable and bona fide business expenditure (Correct answer)
The company had no knowledge of local laws

Correct answer: The payment was a reasonable and bona fide business expenditure

The FCPA provides an affirmative defense for payments that were reasonable, bona fide expenditures directly related to the promotion or performance of a contract.

Question 132: An employee submits claims for reimbursement of 500 miles of business driving that never actually occurred. This is classified as:

A fictitious expense scheme (Correct answer)
A mischaracterized expense scheme
A multiple reimbursement scheme
An inflated expense scheme

Correct answer: A fictitious expense scheme

Claiming reimbursement for expenses that never occurred constitutes a fictitious expense scheme, as the underlying cost was entirely fabricated rather than merely exaggerated.

Question 133: How should CFS professionals measure success in insurance fraud investigation?

Through subjective self-assessment only
Using defined metrics, benchmarks, and regular evaluation against established goals (Correct answer)
By comparing only to minimum requirements
Success measurement is not applicable

Correct answer: Using defined metrics, benchmarks, and regular evaluation against established goals

Success in insurance fraud investigation is measured through defined metrics and benchmarks, with regular evaluation against established professional goals.

Question 134: What is the primary purpose of a hotline as an anti-fraud control?

Automate transaction approvals
Replace internal audits
Provide anonymous tips about suspected misconduct (Correct answer)
Increase employee productivity

Correct answer: Provide anonymous tips about suspected misconduct

Ethics hotlines give employees and third parties a confidential channel to report suspected fraud without fear of retaliation.

Question 135: A clawback policy in executive compensation is designed to:

Provide deferred compensation to executives upon retirement
Limit the total amount executives can earn annually
Recover compensation paid based on restated or fraudulent financial results (Correct answer)
Increase executive bonuses for meeting fraud prevention targets

Correct answer: Recover compensation paid based on restated or fraudulent financial results

Clawback policies allow companies to recover previously paid compensation when it was based on financial results that are later found to have been misstated or fraudulently reported.

Question 136: Pre-employment background checks are most effective at reducing which fraud risk?

Management override
Collusion among existing employees
Hiring individuals with prior fraud history (Correct answer)
Vendor invoice manipulation

Correct answer: Hiring individuals with prior fraud history

Background checks screen candidates for criminal history, prior terminations for cause, and credential fraud before they are hired.

Question 137: A bank teller processes multiple cash deposits just under $10,000 over several days for the same customer. What term describes this activity?

Structuring (smurfing) (Correct answer)
Integration
Placement
Layering

Correct answer: Structuring (smurfing)

Structuring, also called smurfing, involves breaking large cash amounts into smaller transactions to evade the $10,000 CTR filing threshold.

Question 138: Under RICO, what is the minimum number of predicate acts required to establish a 'pattern of racketeering activity'?

One act
Five acts
Three acts
Two acts (Correct answer)

Correct answer: Two acts

RICO requires at least two predicate acts of racketeering within a 10-year period to establish a pattern of racketeering activity.

Question 139: Under Dodd-Frank, a whistleblower who voluntarily provides original information leading to an SEC enforcement action yielding over $1 million may receive:

20–40% of the sanction
30–50% of the sanction
10–30% of the sanction (Correct answer)
5–10% of the sanction

Correct answer: 10–30% of the sanction

Dodd-Frank's SEC whistleblower program awards between 10% and 30% of sanctions collected in qualifying enforcement actions exceeding $1 million.

Question 140: Which data breach notification trigger most commonly affects organizations' obligations under state identity theft laws?

Any accidental data access by an employee
Loss of encrypted data regardless of key exposure
Unauthorized acquisition of unencrypted personal information (Correct answer)
Access by a vendor with a valid NDA

Correct answer: Unauthorized acquisition of unencrypted personal information

Most state breach notification laws are triggered by unauthorized acquisition of unencrypted personal information, with encryption providing a safe harbor in many jurisdictions.

Question 141: A fraud examiner conducting an asset search discovers property held in a spouse's name. The examiner should:

Immediately freeze the asset pending investigation
Document the asset and investigate whether it represents concealed fraud proceeds (Correct answer)
Report the spouse as a co-conspirator without further investigation
Disregard assets not directly in the suspect's name

Correct answer: Document the asset and investigate whether it represents concealed fraud proceeds

Assets held by family members may represent attempts to conceal fraud proceeds; the examiner must document and investigate the connection.

Question 142: Which board governance failure was a primary contributing factor in major corporate scandals such as Enron?

Too many independent directors on the board
Lack of board oversight and failure to challenge management (Correct answer)
Overly strict application of accounting standards
Excessive reliance on internal audit reports

Correct answer: Lack of board oversight and failure to challenge management

In Enron and similar scandals, boards failed to exercise adequate oversight and ask tough questions of management, allowing fraudulent schemes to persist for years.

Question 143: Which of the following is an example of a 'loaded question' that should be avoided in witness interviews?

'When did you first notice the discrepancy?'
'Why did you cover up the fraud scheme?' (Correct answer)
'What was your relationship with the suspect?'
'Can you describe what you observed?'

Correct answer: 'Why did you cover up the fraud scheme?'

Loaded questions assume guilt or a specific fact not yet established, which can contaminate witness responses and undermine credibility.

Question 144: Child identity theft often goes undetected for years primarily because:

Federal law prohibits credit checks on minors
Creditors are not required to report fraud involving minors
Children cannot file fraud alerts
Children's Social Security numbers are rarely monitored for credit activity (Correct answer)

Correct answer: Children's Social Security numbers are rarely monitored for credit activity

Since children do not have credit histories that are actively monitored, fraudsters can exploit their clean SSNs for years before the victim discovers the theft, often upon turning 18.

Question 145: According to ISO 31000, the fraud risk assessment process should be:

Delegated entirely to external consultants for objectivity
Conducted once during organizational formation and updated only after incidents
An iterative process integrated into organizational management (Correct answer)
Performed only when required by regulatory mandate

Correct answer: An iterative process integrated into organizational management

ISO 31000 emphasizes that risk management, including fraud risk assessment, should be iterative, dynamic, and integrated into the organization's ongoing management activities.

Question 146: Under SOX Section 404, management is required to:

Assess and report on the effectiveness of internal controls over financial reporting (Correct answer)
Submit quarterly fraud risk assessments to the SEC
Hire an external forensic accountant annually
Rotate external auditors every five years

Correct answer: Assess and report on the effectiveness of internal controls over financial reporting

SOX Section 404 requires management to evaluate and report on the effectiveness of internal controls over financial reporting, with the external auditor attesting to that assessment.

Question 147: Which of the following statements about the use of informants in fraud investigations is TRUE?

Informants must always be disclosed to the court in all circumstances
Information from informants should be independently corroborated before acting on it (Correct answer)
Using informants is inherently unethical and should be avoided
Informant testimony alone is sufficient to conclude fraud occurred

Correct answer: Information from informants should be independently corroborated before acting on it

Informant information carries credibility risks and must be independently verified through corroborating evidence before conclusions are drawn.

Question 148: Which statute makes it a federal crime to conduct a financial transaction involving proceeds from specified unlawful activity with intent to promote that activity?

Money Laundering Control Act (18 U.S.C. § 1956) (Correct answer)
Patriot Act
Currency and Foreign Transactions Reporting Act
Bank Secrecy Act

Correct answer: Money Laundering Control Act (18 U.S.C. § 1956)

18 U.S.C. § 1956 criminalizes conducting financial transactions with proceeds of specified unlawful activity when done to promote, conceal, or evade reporting.

Question 149: Which database tool is used by U.S. life and health insurers to detect whether a deceased claimant had other life insurance policies in force?

ISO ClaimSearch
NICB VINCheck
CLUE Report
MIB Group database (Correct answer)

Correct answer: MIB Group database

MIB Group (formerly Medical Information Bureau) maintains an industry database of underwriting information, including prior life and health applications.

Question 150: An attorney asks the fraud examiner to include in their report a conclusion that goes beyond the data they reviewed. The examiner should:

Include the conclusion but add a footnote disclaiming personal responsibility
Refuse and explain that opinions must be supported by the evidence reviewed (Correct answer)
Include the conclusion since the attorney has legal authority over the case strategy
Ask a junior analyst to sign the report instead

Correct answer: Refuse and explain that opinions must be supported by the evidence reviewed

Expert opinions must be grounded in sufficient facts and data; an expert who exceeds their evidentiary basis risks Daubert exclusion and damages their credibility.

Question 151: What is the key objective of anti-money laundering (AML) regulations?

To enforce labor laws.
To increase tax revenue.
To regulate stock markets.
To detect and prevent money laundering activities. (Correct answer)

Correct answer: To detect and prevent money laundering activities.

Anti-money laundering (AML) regulations are a set of laws, regulations, and procedures aimed at preventing criminals from disguising illegally obtained funds as legitimate income. Their primary objective is to detect and report suspicious financial transactions. By doing so, AML regulations help combat financial crimes, terrorism financing, and other illicit activities.

Certified Fraud Specialist (CFS) Exam

The Certified Fraud Specialist (CFS) certification validates expertise in fraud prevention, detection, investigation, and resolution across various sectors.

150

Questions

180 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds