CFE Conducting Investigations 2 — Questions and Answers
Question 1: During a fraud investigation, an examiner discovers that a key witness is also a potential suspect. What is the BEST initial approach?
- Immediately confront the witness with the allegations
- Interview the witness as a neutral party while preserving the ability to re-interview later (Correct answer)
- Exclude the witness from the investigation entirely
- Refer the matter to law enforcement before conducting any interview
Correct answer: Interview the witness as a neutral party while preserving the ability to re-interview later
Interviewing a potential witness/suspect neutrally preserves investigative flexibility and avoids tipping off the subject prematurely.
Question 2: Which type of evidence is considered MOST reliable in a fraud investigation because it is created contemporaneously with the events?
- Testimonial evidence
- Documentary evidence (Correct answer)
- Demonstrative evidence
- Opinion evidence
Correct answer: Documentary evidence
Documentary evidence created at the time of the events is generally considered most reliable because it reflects real-time records rather than after-the-fact recollections.
Question 3: A fraud examiner is conducting surveillance on a suspect. Which activity would MOST likely require prior legal authorization?
- Observing the suspect in a public parking lot
- Recording conversations in a private office without consent (Correct answer)
- Photographing the suspect entering a public building
- Reviewing the suspect's publicly listed social media posts
Correct answer: Recording conversations in a private office without consent
Recording private conversations without consent typically requires legal authorization under federal and state wiretapping laws.
Question 4: When an investigation reveals evidence of criminal activity, the fraud examiner should PRIMARILY:
- Immediately confront the perpetrator to recover losses
- Continue the investigation independently to gather maximum evidence
- Report findings to the appropriate level of management or legal counsel (Correct answer)
- Publish findings to deter other potential fraudsters
Correct answer: Report findings to the appropriate level of management or legal counsel
The fraud examiner should report criminal evidence to management or legal counsel, who will determine whether to involve law enforcement.
Question 5: Which technique is MOST effective for detecting fictitious vendor fraud in a company's accounts payable system?
- Matching vendor addresses against employee addresses (Correct answer)
- Reviewing expense reports for personal charges
- Analyzing payroll records for ghost employees
- Comparing bank statements with cash receipts
Correct answer: Matching vendor addresses against employee addresses
Fictitious vendor fraud often involves vendors using the same address as an employee, making address matching a key detection technique.
Question 6: During a computer forensic examination, the FIRST step an examiner should take upon receiving digital evidence is to:
- Begin searching for deleted files immediately
- Create a forensic image/bit-for-bit copy of the media (Correct answer)
- Interview the device's last known user
- Install forensic software directly on the original device
Correct answer: Create a forensic image/bit-for-bit copy of the media
Creating a forensic bit-for-bit copy preserves the integrity of the original evidence while allowing analysis to proceed on the copy.
Question 7: An employee reports potential fraud to the fraud examiner but requests anonymity. The examiner should FIRST:
- Refuse to accept anonymous tips to maintain investigative integrity
- Accept the tip and assess its credibility before taking further action (Correct answer)
- Immediately disclose the tipster's identity to management
- Close the matter since anonymous allegations cannot be investigated
Correct answer: Accept the tip and assess its credibility before taking further action
Anonymous tips should be accepted and evaluated for credibility; many valid fraud investigations begin with anonymous reports.
CFE Conducting Investigations 2
During a fraud investigation, an examiner discovers that a key witness is also a potential suspect.
What is the BEST initial approach?