CFE - Certified Fraud Examiner — Questions and Answers

Question 1: Environmental, Social, and Governance (ESG) reporting is most directly associated with which stakeholder concern?

Broader corporate accountability to multiple stakeholder groups (Correct answer)
Reducing the external audit fee
Limiting board diversity requirements
Short-term earnings maximization for equity traders

Correct answer: Broader corporate accountability to multiple stakeholder groups

ESG reporting reflects a company's accountability to investors, employees, communities, and regulators — not just short-term shareholders.

Question 2: During an audit, the auditor looks at the situation of the person being audited and plans the audit accordingly:

High order
Fraudulent
First order (Correct answer)
Zero order

Correct answer: First order

First-order planning is when the auditor assesses the auditee's specific circumstances and tailors the audit strategy accordingly at the outset. 'Zero order' and 'high order' don't describe this initial context-based planning, and 'fraudulent' is unrelated to the level of planning.

Question 3: Which analytical procedure involves tracing a transaction from its origin through all processing steps to the final recorded amount?

Confirmations
Vouching
Tracing (Correct answer)
Substantive testing

Correct answer: Tracing

Tracing follows a transaction forward from its source document through the accounting records to verify completeness and accuracy of recording.

Question 4: Which of the following is the BEST example of a 'red flag' in a company's gift and entertainment records that warrants further investigation for bribery?

Frequent expensive gifts to the same foreign official clustered around contract award dates (Correct answer)
Business meals attended by multiple company and client employees
Annual holiday gifts sent to all clients valued at $25 each
A single lunch with a domestic vendor representative costing $75

Correct answer: Frequent expensive gifts to the same foreign official clustered around contract award dates

A pattern of expensive gifts to the same official concentrated around contract decisions is a strong indicator that the gifts are bribes intended to influence procurement outcomes.

Question 5: A CFE seizes a laptop believed to contain evidence of an embezzlement scheme. To ensure the digital evidence is admissible in court, which of the following is the MOST critical initial step for the CFE to take?

Immediately create a forensic image of the hard drive and calculate its hash value. (Correct answer)
Install forensic software directly onto the laptop to begin the analysis.
Open and review all suspicious files to confirm their relevance to the case.
Interview the laptop's user to get their password and a list of key documents.

Correct answer: Immediately create a forensic image of the hard drive and calculate its hash value.

The most critical initial step is to preserve the integrity of the original evidence. Creating a bit-for-bit forensic image (a copy) of the hard drive and then calculating a cryptographic hash value of both the original and the copy ensures that the original data is unaltered. All analysis is then performed on the copy. This process is fundamental to maintaining the chain of custody for digital evidence.

Question 6: In digital forensics, what does the term 'chain of custody' refer to?

The sequence of financial transactions in a fraud scheme
The hierarchy of management involved in approving transactions
The order in which computer files were accessed
The documented handling of evidence from collection through trial (Correct answer)

Correct answer: The documented handling of evidence from collection through trial

Chain of custody is the chronological documentation showing the seizure, custody, control, transfer, analysis, and disposition of physical or digital evidence.

Question 7: A 'poison pill' defense mechanism is designed to protect a company against:

Employee whistleblower claims
Hostile takeover attempts (Correct answer)
Internal financial fraud by executives
Regulatory non-compliance penalties

Correct answer: Hostile takeover attempts

A poison pill (shareholder rights plan) dilutes a hostile acquirer's stake, making a takeover prohibitively expensive.

Question 8: A company discovers that its petty cash fund consistently requires reimbursement more frequently than expected. The most likely fraudulent explanation is:

The fund custodian is making unsupported disbursements and pocketing cash (Correct answer)
Employees are using the fund for approved minor purchases more efficiently
The fund amount was set too low for current business needs
Inflation has increased the cost of typical petty cash purchases

Correct answer: The fund custodian is making unsupported disbursements and pocketing cash

Frequent, unexplained depletion of petty cash beyond normal usage patterns is a classic indicator of the custodian stealing from the fund.

Question 9: An organization's ethics hotline is BEST classified as which type of anti-fraud control?

Directive
Preventive
Corrective
Detective (Correct answer)

Correct answer: Detective

An ethics hotline allows employees to report suspected fraud after it has begun, making it a detective control that helps uncover ongoing schemes.

Question 10: The Foreign Corrupt Practices Act (FCPA) prohibits which of the following?

Bribing foreign government officials to obtain or retain business (Correct answer)
U.S. companies from operating in foreign countries without a license
Transferring funds to offshore accounts without disclosure
Importing goods without paying customs duties

Correct answer: Bribing foreign government officials to obtain or retain business

The FCPA makes it illegal for U.S. persons and companies to bribe foreign officials to gain a business advantage, and requires accurate books and records.

Question 11: Which of the following represents the strongest evidence that a ghost employee scheme has been occurring?

An employee paid by direct deposit who has never visited the payroll office
A payroll record with no corresponding HR personnel file, time records, or tax withholding history (Correct answer)
An employee who works in a different building than their supervisor
Payroll records that show consistent hours across all pay periods

Correct answer: A payroll record with no corresponding HR personnel file, time records, or tax withholding history

A ghost employee has no supporting HR documentation, no verifiable work history, and no legitimate employment records because they do not actually exist.

Question 12: Which metadata attribute can help a CFE determine when a document was originally created on a computer?

File extension
Font embedded in the document
File creation timestamp (Correct answer)
File size

Correct answer: File creation timestamp

File creation timestamps stored in metadata can indicate when a document was first created, though they can be altered, so corroboration with other evidence is essential.

Question 13: Under the ACFE's classification of financial statement fraud schemes, which category includes understating the allowance for doubtful accounts?

Timing differences
Fictitious revenues
Concealed liabilities and expenses
Improper asset valuations (Correct answer)

Correct answer: Improper asset valuations

Understating the allowance for doubtful accounts is an improper asset valuation scheme because it overstates the net realizable value of accounts receivable.

Question 14: An employee submits expense reports for the same business meal twice, once using the restaurant receipt and once using a credit card statement. This is an example of which scheme?

Fictitious expense reimbursement
Mischaracterized expense
Altered receipt scheme
Multiple reimbursement scheme (Correct answer)

Correct answer: Multiple reimbursement scheme

A multiple reimbursement scheme involves submitting the same legitimate expense more than once through different documents to obtain duplicate payments.

Question 15: Which analytical technique compares an organization's financial ratios to industry benchmarks to identify anomalies?

Vertical analysis
Ratio analysis (Correct answer)
Horizontal analysis
Regression analysis

Correct answer: Ratio analysis

Ratio analysis compares financial metrics to industry norms or historical data to identify potential fraud indicators.

Question 16: Which of the following is a common technique used to perpetrate a timing difference fraud scheme?

Improperly capitalizing research and development costs
Recording fictitious assets to offset fake sales
Keeping the sales journal open past the period's cutoff date (Correct answer)
Omitting significant contingent liabilities from the financial statement disclosures

Correct answer: Keeping the sales journal open past the period's cutoff date

Keeping the sales journal open after the end of the accounting period allows a company to include sales from the next period in the current period's results. This is a classic timing difference scheme designed to improperly accelerate revenue recognition and inflate current period earnings.

Question 17: In a Business Email Compromise (BEC) scheme, the fraudster typically impersonates which individual to authorize fraudulent wire transfers?

An IT support technician requesting credentials
A government regulator demanding compliance fees
A new vendor seeking payment setup
A senior executive such as the CEO or CFO (Correct answer)

Correct answer: A senior executive such as the CEO or CFO

BEC schemes most commonly involve impersonating a senior executive (CEO or CFO) to pressure finance employees into authorizing fraudulent wire transfers.

Question 18: Which fraud scheme would most likely be identified by reviewing split purchase orders?

Billing scheme using fictitious vendors
Skimming
Bid rigging (Correct answer)
Payroll ghost employee scheme

Correct answer: Bid rigging

Split purchase orders are a red flag for bid rigging or circumventing competitive bidding thresholds, allowing purchases to be made without proper approval.

Question 19: An employee steals cash before it is recorded in the company's accounting system. This is an example of which fraud scheme?

Cash larceny
Kiting
Skimming (Correct answer)
Lapping

Correct answer: Skimming

Skimming is an off-book fraud where cash is stolen before it is recorded in the accounting system, making it harder to detect.

Question 20: When a CFE preserves digital evidence, what is the first critical step to ensure admissibility and integrity?

Copy files directly onto the investigator's laptop
Delete temporary files to reduce storage
Open and review files on the original device
Create a forensic image and verify it with a hash value (Correct answer)

Correct answer: Create a forensic image and verify it with a hash value

Creating a bit-for-bit forensic image and verifying it with a cryptographic hash (MD5 or SHA) ensures the copy is identical to the original and preserves chain of custody.

Question 21: Which of the following is an example of a red flag on a financial statement?

A large number of bank reconciliations have not been completed (Correct answer)
A low rate of employee turnover
A consistent increase in sales revenue over several quarters

Correct answer: A large number of bank reconciliations have not been completed

Explanation: In a financial statement, a red flag is something like many unfinished bank reconciliations. It suggests that there may be fraud involving cash or bank accounts, which may need to be looked into further.

Question 22: Which type of corruption scheme involves a vendor paying a company employee for confidential bid information?

Illegal gratuity
Bribery
Economic extortion
Bid rigging (Correct answer)

Correct answer: Bid rigging

Bid rigging occurs when competitors collude or insiders provide inside information to give a vendor an unfair advantage in a competitive bidding process.

Question 23: Which document would an examiner most likely review to detect the understatement of accounts payable near fiscal year-end?

The fixed asset rollforward schedule
The accounts receivable aging schedule
Subsequent disbursements after year-end (Correct answer)
Bank reconciliation statements

Correct answer: Subsequent disbursements after year-end

Reviewing cash disbursements made shortly after year-end can reveal invoices that existed at year-end but were not recorded, indicating understated payables.

Question 24: An employee forges a supervisor's signature on a check made payable to herself. To conceal the theft, she records the disbursement as a payment to a legitimate vendor. This concealment technique is known as:

Forced account balance
Journal entry manipulation (Correct answer)
Ledger entry suppression
Fictitious debit entry

Correct answer: Journal entry manipulation

Recording the fraudulent disbursement as a payment to a real vendor through a journal entry masks the theft within routine operating transactions.

Question 25: The Sarbanes-Oxley Act Section 302 requires which of the following?

CEOs and CFOs to personally certify the accuracy of financial reports (Correct answer)
Audit committees to be composed entirely of independent directors
External auditors to certify internal controls quarterly
Companies to maintain a whistleblower hotline

Correct answer: CEOs and CFOs to personally certify the accuracy of financial reports

SOX Section 302 requires the principal executive and financial officers to personally certify the accuracy of periodic financial reports.

Question 26: Data analytics used to detect payroll fraud would most likely flag which of the following as suspicious?

Employees who consistently use direct deposit
Employees with the same last name in different departments
A high ratio of salaried to hourly employees
Two employees sharing the same bank account routing and account number (Correct answer)

Correct answer: Two employees sharing the same bank account routing and account number

Duplicate bank account numbers on different employee records indicate a ghost employee whose pay is being diverted to a real person's account.

Question 27: Transparency International's Corruption Perceptions Index (CPI) is used in fraud examinations primarily to:

Identify specific corrupt officials in foreign governments
Certify that a company's anti-corruption program is adequate
Assess the relative risk of corruption in countries where a company operates (Correct answer)
Determine the penalty amount for FCPA violations

Correct answer: Assess the relative risk of corruption in countries where a company operates

The CPI ranks countries by perceived public sector corruption, helping fraud examiners prioritize due diligence and compliance resources in higher-risk jurisdictions.

Question 28: The ACFE's Report to the Nations consistently shows that the MOST common initial detection method for occupational fraud is:

Internal audit
Management review
External audit
Tips (Correct answer)

Correct answer: Tips

According to the ACFE's Report to the Nations, tips are by far the most common way occupational fraud is initially detected, often via hotlines.

Question 29: Which of the following statements about the Sarbanes-Oxley Act (SOX) Section 302 is correct?

It requires senior executives to personally certify the accuracy of financial reports and disclosure controls (Correct answer)
It requires external auditors to assess internal controls over financial reporting
It mandates criminal penalties for document shredding during federal investigations
It establishes the Public Company Accounting Oversight Board (PCAOB)

Correct answer: It requires senior executives to personally certify the accuracy of financial reports and disclosure controls

SOX Section 302 requires the CEO and CFO to personally certify the accuracy of financial statements and the effectiveness of disclosure controls each reporting period.

Question 30: A company's agent in a foreign country secures government contracts by paying local officials. The company claims it did not know about the payments. Under the FCPA, the company:

Is exempt because it lacked direct knowledge of the corrupt payments
Is only liable if the agent was a direct employee rather than a contractor
Cannot be held liable because only the agent who made payments is responsible
May still be liable if it consciously disregarded red flags suggesting the payments were occurring (Correct answer)

Correct answer: May still be liable if it consciously disregarded red flags suggesting the payments were occurring

The FCPA recognizes 'conscious disregard' and 'willful blindness' as sufficient knowledge, so companies cannot avoid liability by deliberately ignoring red flags.

Question 31: Which legal concept allows a fraud examiner to testify about conclusions drawn from their investigation, even if those conclusions are based on specialized knowledge?

Lay witness testimony
Expert witness testimony (Correct answer)
Res ipsa loquitur
Hearsay exception

Correct answer: Expert witness testimony

Expert witnesses are permitted to offer opinion testimony on matters within their specialized knowledge, including fraud examination findings.

Question 32: Which of the following is the best definition of 'earnings management' as it relates to financial statement fraud?

The process of improving earnings through legitimate operational improvements
Any intentional misstatement in financial statements regardless of materiality
The use of accounting discretion within GAAP to present results that meet management's targets rather than economic reality (Correct answer)
The restatement of prior-period earnings due to clerical errors

Correct answer: The use of accounting discretion within GAAP to present results that meet management's targets rather than economic reality

Earnings management exploits discretion within accounting standards to influence reported results, which may cross the line into fraud when it becomes deliberate misrepresentation.

Question 33: According to the ACFE's 2024 'Occupational Fraud: A Report to the Nations,' which category of occupational fraud was the most common?

Asset Misappropriation (Correct answer)
Corruption
Cybercrime
Financial Statement Fraud

Correct answer: Asset Misappropriation

The ACFE's 2024 Report to the Nations found that asset misappropriation was the most common type of occupational fraud, occurring in 89% of cases. Corruption was the second most common at 48%, and financial statement fraud was the least common at 5%.

Question 34: Which document analysis technique involves examining the pressure indentations on paper beneath a written document?

Thin layer chromatography
Infrared luminescence
ESDA (Electrostatic Detection Apparatus) (Correct answer)
Spectrographic analysis

Correct answer: ESDA (Electrostatic Detection Apparatus)

ESDA detects latent impressions on paper caused by writing pressure, useful for detecting altered or forged documents.

Question 35: Which financial statement red flag is most commonly associated with a billing scheme involving fictitious vendors?

Unexplained increase in cost of goods sold or operating expenses (Correct answer)
Significant increase in fixed asset additions
Declining gross profit margin combined with rising revenue
Sudden decrease in accounts receivable turnover

Correct answer: Unexplained increase in cost of goods sold or operating expenses

Fictitious vendor payments inflate operating expenses or COGS without a corresponding business benefit, causing unexplained expense increases.

Question 36: A related-party transaction must typically be disclosed and approved because it creates a risk of:

Triggering mandatory external audit requirements
Violating stock exchange listing standards on board composition
Conflict of interest that could harm the company for a director or officer's personal benefit (Correct answer)
Excessive regulatory scrutiny of routine business

Correct answer: Conflict of interest that could harm the company for a director or officer's personal benefit

Related-party transactions involve parties with pre-existing relationships with the company and carry inherent conflict-of-interest risk that could result in unfavorable deal terms.

Question 37: A fraud examiner discovers that a contractor paid a city inspector's personal credit card bill in exchange for approving a substandard building. This BEST illustrates which type of corruption scheme?

Kickback
Extortion
Bribery (Correct answer)
Embezzlement

Correct answer: Bribery

Bribery involves offering, giving, receiving, or soliciting something of value to influence an official act, which matches paying the inspector's bill for approval.

Question 38: Which term describes malware that encrypts a victim's files and demands payment for the decryption key?

Ransomware (Correct answer)
Rootkit
Adware
Spyware

Correct answer: Ransomware

Ransomware is malicious software that encrypts the victim's data and demands a ransom, typically in cryptocurrency, in exchange for the decryption key.

Question 39: In fraud investigations, why is it important to interview friendly witnesses before suspects?

To give suspects time to prepare accurate responses
Because friendly witnesses must sign off on the investigation before it can proceed
To establish baseline facts and context before confronting those potentially involved (Correct answer)
To avoid legal liability by interviewing cooperative parties first

Correct answer: To establish baseline facts and context before confronting those potentially involved

Interviewing cooperative parties first builds the factual foundation and helps the examiner identify key inconsistencies to probe when questioning suspects.

Question 40: A company uses bill-and-hold arrangements to accelerate revenue. For such revenue to be legitimate under U.S. GAAP, which condition must be met?

The goods must be physically delivered to a third-party warehouse
The buyer must have requested the arrangement and have a genuine business reason for it (Correct answer)
The seller must retain title to the goods indefinitely
The transaction must be approved by both internal and external auditors

Correct answer: The buyer must have requested the arrangement and have a genuine business reason for it

Under U.S. GAAP and ASC 606, bill-and-hold revenue is only appropriate if the customer has requested it for a substantive business reason and bears the risks of ownership.

Question 41: Which governance structure is characterized by a supervisory board overseeing a separate management board, common in Germany and the Netherlands?

Unitary board structure
Committee-led board structure
Two-tier board structure (Correct answer)
Advisory board structure

Correct answer: Two-tier board structure

The two-tier (dual) board structure separates strategic oversight (supervisory board) from executive management (management board), common in continental Europe.

Question 42: Which fraud risk assessment output is most useful for communicating results to the board of directors?

Raw data from analytics tests
Detailed transaction-level exception reports
A risk heat map showing likelihood and impact of key fraud risks (Correct answer)
Walk-through documentation for each business process

Correct answer: A risk heat map showing likelihood and impact of key fraud risks

A risk heat map provides a visual, high-level summary of fraud risks that is appropriate for board-level audiences who need strategic rather than operational detail.

Question 43: Under the ACFE's fraud prevention framework, which action is described as a 'deterrent' rather than a 'detection' measure?

Surprise cash counts in high-risk areas
Reviewing exception reports from the accounting system
Forensic accounting review of historical transactions
Publicizing the successful prosecution of a former employee for fraud (Correct answer)

Correct answer: Publicizing the successful prosecution of a former employee for fraud

Publicizing prosecution outcomes deters potential fraudsters by demonstrating that fraud will be discovered and has serious consequences, without detecting an existing scheme.

Question 44: A company fails to disclose a material contingent liability in its financial statement footnotes. This omission is best classified as:

Improper asset valuation
Fictitious revenue
Timing difference
Concealed liabilities and expenses (Correct answer)

Correct answer: Concealed liabilities and expenses

Omitting material contingent liabilities from footnote disclosures is a form of concealing liabilities, even if no journal entry misstatement is involved.

Question 45: According to the ACFE, which industry experiences the highest median loss per fraud case?

Government and public administration
Healthcare
Mining (Correct answer)
Banking and financial services

Correct answer: Mining

ACFE Report to the Nations data consistently shows that the mining industry suffers among the highest median losses per fraud case due to low case volume and large asset values.

Question 46: Which of the following is considered a fraudulent disbursement scheme?

Pocketing a customer's payment before it is entered into the sales system.
Misusing a company vehicle for personal errands.
Stealing cash from a co-worker's desk.
Creating a shell company and submitting fake invoices for payment. (Correct answer)

Correct answer: Creating a shell company and submitting fake invoices for payment.

A fraudulent disbursement scheme involves a person causing their employer to issue a payment for a fictitious or improper purpose. [9, 13] Creating a shell company to submit fake invoices is a classic example of a billing scheme, which falls under the category of fraudulent disbursements. [23] The other options describe theft of assets already on hand, skimming, or misuse of non-cash assets.

Question 47: Which financial statement fraud scheme is most associated with the term 'round-tripping'?

A company records returned goods as new sales in the following period
A company simultaneously buys and sells the same asset with a related party at a gain
A company splits sales transactions to avoid revenue recognition thresholds
A company loans funds to a customer who uses them to purchase the company's own products, artificially inflating revenue (Correct answer)

Correct answer: A company loans funds to a customer who uses them to purchase the company's own products, artificially inflating revenue

Round-tripping involves a company lending money to a buyer who immediately uses it to purchase from the lender, creating fictitious revenue with no economic substance.

Question 48: A fraud examiner wants to verify a suspect's alibi without revealing what evidence exists. Which strategy is most appropriate?

Delay the interview until all evidence is confirmed
Use strategic use of evidence (SUE) by asking open questions before revealing known facts (Correct answer)
Ask directly whether the suspect has an alibi
Present all evidence immediately to prompt a quick admission

Correct answer: Use strategic use of evidence (SUE) by asking open questions before revealing known facts

The Strategic Use of Evidence technique withholds known facts while asking open questions, exposing inconsistencies when the suspect's story contradicts undisclosed evidence.

Question 49: Under the False Claims Act's qui tam provisions, who is entitled to file a lawsuit on behalf of the U.S. government and potentially receive a portion of any recovery?

Any U.S. citizen who suspects government contractor fraud
A private individual (relator) who has inside knowledge of fraud (Correct answer)
Only federal prosecutors
The Inspector General of the affected agency

Correct answer: A private individual (relator) who has inside knowledge of fraud

The False Claims Act's qui tam provisions allow private whistleblowers (relators) with inside knowledge to sue on the government's behalf and collect 15–30% of any recovery.

Question 50: When prioritizing fraud risks, organizations typically plot likelihood against which other dimension?

Cost of investigation
Potential impact or significance (Correct answer)
Detection speed
Number of employees involved

Correct answer: Potential impact or significance

Risk matrices plot the likelihood of a fraud scheme occurring against its potential impact, allowing organizations to prioritize high-risk areas for control investment.

Question 51: Which of the following is the best example of 'structuring' (also known as smurfing)?

Converting cash into cryptocurrency to conceal its origin
Depositing $12,000 in cash in one transaction to avoid detection
Breaking large cash deposits into multiple transactions below $10,000 to avoid CTR filing (Correct answer)
Transferring funds through multiple international jurisdictions

Correct answer: Breaking large cash deposits into multiple transactions below $10,000 to avoid CTR filing

Structuring involves deliberately splitting cash transactions below the $10,000 threshold to avoid Currency Transaction Report requirements.

Question 52: Under the Bank Secrecy Act, U.S. financial institutions must file a Suspicious Activity Report (SAR) within how many days of detecting a suspicious transaction?

15 days
60 days
45 days
30 days (Correct answer)

Correct answer: 30 days

Financial institutions must file a SAR within 30 calendar days after the date of initial detection of a suspicious transaction, with a 60-day extension if no suspect is identified.

Question 53: What is the concept of 'anti-fraud training' specifically designed to accomplish among non-financial employees?

Teach employees to perform forensic accounting on their own records
Help employees recognize red flags of fraud and understand their reporting obligations (Correct answer)
Replace the need for a dedicated compliance function
Enable employees to conduct internal investigations independently

Correct answer: Help employees recognize red flags of fraud and understand their reporting obligations

Anti-fraud training equips employees at all levels to recognize warning signs and empowers them to report concerns through appropriate channels.

Question 54: Which of the following is a RED FLAG suggesting that a board may be ineffective at fraud prevention?

Regular board turnover of independent directors
Dominant CEO who also chairs the board with no lead independent director (Correct answer)
Active and well-resourced audit committee
Robust anonymous hotline with board-level reporting

Correct answer: Dominant CEO who also chairs the board with no lead independent director

A dominant CEO who also controls the board removes a critical check on executive authority, significantly increasing fraud risk.

Question 55: In continuous auditing, what is the primary advantage of using automated exception reporting?

It eliminates the need for human judgment in fraud investigations
It allows real-time or near-real-time identification of transactions that fall outside defined parameters (Correct answer)
It replaces the need for internal controls entirely
It encrypts all transaction data to prevent unauthorized access

Correct answer: It allows real-time or near-real-time identification of transactions that fall outside defined parameters

Automated exception reporting continuously monitors transactions against predefined rules and immediately flags anomalies, enabling faster detection than periodic manual review.

Question 56: During an admission-seeking interview with a suspect, the fraud examiner asks, "It must have been difficult to support your family on your salary, wasn't it?" This question is an example of which type of admission-seeking technique?

A benchmark admission
A direct accusation
A leading question
Offering rationalization (Correct answer)

Correct answer: Offering rationalization

This technique is known as offering rationalization. The examiner suggests a morally justifiable reason for the suspect's actions, making it easier for them to confess by framing the act as understandable under the circumstances. It is a key step in lowering a suspect's resistance to confessing.

Question 57: A purchasing manager splits a $45,000 purchase order into three $15,000 orders to avoid the $20,000 competitive bidding threshold. This is known as:

Fictitious invoicing
Bid suppression
Bid rigging
Bid splitting (or 'structured' purchasing) (Correct answer)

Correct answer: Bid splitting (or 'structured' purchasing)

Bid splitting involves breaking a large purchase into smaller amounts specifically to circumvent procurement thresholds that require competitive bidding.

Question 58: In a fraud investigation, which document would a fraud examiner most likely subpoena to trace hidden assets through real estate?

Employee handbook
Accounts payable ledger
IRS Form W-2
County deed records (Correct answer)

Correct answer: County deed records

County deed records show property ownership transfers and values, making them essential for tracing real estate assets that a subject may be trying to hide.

Question 59: During a fraud risk assessment workshop for a hospital's billing department, participants are asked to consider incentives, opportunities, and rationalizations that could lead to fraudulent activity. This exercise directly relates to which classic fraud theory?

The General Theory of Crime
The Routine Activity Theory
The Theory of Differential Association
The Fraud Triangle (Correct answer)

Correct answer: The Fraud Triangle

The Fraud Triangle, developed by Donald Cressey, posits that fraud is likely to occur when three elements are present: a perceived pressure (incentive), a perceived opportunity, and a way to rationalize the dishonest act. Brainstorming these elements is a key technique in identifying specific fraud risks within an organization.

Question 60: An employee reports potential fraud to the fraud examiner but requests anonymity. The examiner should FIRST:

Close the matter since anonymous allegations cannot be investigated
Accept the tip and assess its credibility before taking further action (Correct answer)
Immediately disclose the tipster's identity to management
Refuse to accept anonymous tips to maintain investigative integrity

Correct answer: Accept the tip and assess its credibility before taking further action

Anonymous tips should be accepted and evaluated for credibility; many valid fraud investigations begin with anonymous reports.

Question 61: In occupational fraud, which department most commonly perpetrates billing schemes?

Internal audit
Accounts payable (Correct answer)
Information technology
Human resources

Correct answer: Accounts payable

Accounts payable employees have access to the payment process, making them the most common perpetrators of billing schemes.

Question 62: When examining digital evidence in a fraud case, what is the first critical step a forensic examiner should take upon receiving a digital device?

Connect the device to the internet to check for cloud backups
Create a forensic bit-for-bit image of the original media (Correct answer)
Run antivirus software to ensure the device is safe to examine
Begin searching file directories for relevant documents

Correct answer: Create a forensic bit-for-bit image of the original media

Creating a verified forensic image (bit-for-bit copy) preserves the original evidence, allows analysis without risk of altering the original, and supports chain of custody.

Question 63: A fraud case against a company is being tried simultaneously in both criminal and civil court. Which of the following correctly describes the difference in the burden of proof required for each case?

The burden is "preponderance of the evidence" for the criminal case and "beyond a reasonable doubt" for the civil case.
The burden of proof is "beyond a reasonable doubt" for both proceedings.
The burden is "clear and convincing evidence" for both proceedings.
The burden is "beyond a reasonable doubt" for the criminal case and "preponderance of the evidence" for the civil case. (Correct answer)

Correct answer: The burden is "beyond a reasonable doubt" for the criminal case and "preponderance of the evidence" for the civil case.

In criminal law, the prosecution has the high burden of proving the defendant's guilt "beyond a reasonable doubt." In civil cases, the plaintiff's burden is lower, typically requiring proof by a "preponderance of the evidence," which means it is more likely than not that the claim is true.

Question 64: Under the Bank Secrecy Act (BSA), financial institutions in the U.S. must file a Currency Transaction Report (CTR) for cash transactions exceeding:

$25,000
$5,000
$50,000
$10,000 (Correct answer)

Correct answer: $10,000

The BSA requires financial institutions to file a CTR for any cash transaction exceeding $10,000 in a single business day.

Question 65: When auditing for financial statement fraud, which ratio would most directly indicate potential revenue overstatement?

Current ratio
Receivables-to-sales ratio trending upward (Correct answer)
Fixed asset turnover declining
Interest coverage ratio falling

Correct answer: Receivables-to-sales ratio trending upward

An increasing receivables-to-sales ratio suggests that reported sales are growing faster than actual cash collections, a key indicator of fictitious or premature revenue.

Question 66: Which investigative technique is MOST effective for detecting corruption schemes where the perpetrator is a government official receiving cash bribes?

Review of the official's email correspondence
Analysis of accounts payable records at the paying company
Net worth analysis comparing lifestyle to known income (Correct answer)
Examination of vendor master file changes

Correct answer: Net worth analysis comparing lifestyle to known income

Net worth analysis identifies unexplained wealth by comparing an official's known income to their actual assets and lifestyle, revealing unexplained cash receipts.

Question 67: A fraud examiner is analyzing expense reports and finds that an employee consistently submits meal receipts just below the $75 threshold that requires a detailed business purpose justification. This pattern most likely indicates:

The employee is unusually cost-conscious and budget-aware
The employee is structuring expenses to avoid required documentation controls (Correct answer)
The company's policy threshold is set at the appropriate level
The pattern is coincidental and requires no further investigation

Correct answer: The employee is structuring expenses to avoid required documentation controls

Consistently submitting amounts just below a control threshold is a structuring technique that signals awareness of the control and deliberate avoidance of its requirements.

Question 68: Under the ACFE Code of Professional Ethics, a fraud examiner who receives gifts from a suspect under investigation should:

Accept gifts as long as they do not influence the investigation outcome
Accept gifts of nominal value only and disclose them
Report the gift to the suspect's attorney as a courtesy
Refuse all gifts and report the attempt to supervisors (Correct answer)

Correct answer: Refuse all gifts and report the attempt to supervisors

The ACFE Code requires fraud examiners to refuse gifts that could compromise their objectivity and to report such attempts to maintain professional integrity.

Question 69: The Occupational Fraud and Abuse classification system developed by the ACFE categorizes asset misappropriation into two main branches. These are:

On-book schemes and off-book schemes
Theft schemes and concealment schemes
Cash schemes and non-cash schemes (Correct answer)
Internal schemes and external schemes

Correct answer: Cash schemes and non-cash schemes

The ACFE's fraud tree divides asset misappropriation into cash schemes (skimming, larceny, fraudulent disbursements) and non-cash schemes (misuse and larceny of non-cash assets).

Question 70: Which analytical procedure would most likely detect fictitious sales recorded near a fiscal year-end?

Analyzing days sales outstanding (DSO) trends over time (Correct answer)
Reviewing the debt-to-equity ratio quarter over quarter
Calculating the gross margin percentage annually
Comparing the current ratio to prior periods

Correct answer: Analyzing days sales outstanding (DSO) trends over time

A spike in DSO indicates that receivables are growing faster than sales, a red flag for fictitious revenues that are never collected.

Question 71: Which of the following is an example of an 'assumptive question' used in interrogation?

'Did you take the money?'
'Why do you think someone would steal from the company?'
'How many times did you access the petty cash fund without authorization?' (Correct answer)
'Can you tell me about your responsibilities?'

Correct answer: 'How many times did you access the petty cash fund without authorization?'

Assumptive questions presuppose that the act occurred and ask about details, making it harder for the guilty party to simply deny the behavior.

Question 72: When a fraud examiner detects a pattern where large cash deposits are made just below reporting thresholds over multiple days at different branches, the most likely violation is:

Structuring under 31 U.S.C. § 5324 (Correct answer)
Wire fraud under 18 U.S.C. § 1343
Tax evasion under IRC Section 61
Securities fraud under the Securities Exchange Act

Correct answer: Structuring under 31 U.S.C. § 5324

31 U.S.C. § 5324 specifically prohibits structuring transactions to evade currency reporting requirements, which is exactly what this pattern describes.

Question 73: Real estate is often used as a money laundering vehicle because:

Large amounts of money can be absorbed, and properties can be resold to generate seemingly legitimate proceeds (Correct answer)
Real estate transactions are always publicly disclosed to law enforcement
Real estate agents are required to report all transactions to FinCEN
Property values are highly regulated and cannot be manipulated

Correct answer: Large amounts of money can be absorbed, and properties can be resold to generate seemingly legitimate proceeds

Real estate allows launderers to absorb large sums, inflate or deflate prices, and ultimately sell the property to produce apparently legitimate proceeds.

Question 74: A fraud examiner is conducting surveillance on a suspect. Which activity would MOST likely require prior legal authorization?

Observing the suspect in a public parking lot
Photographing the suspect entering a public building
Recording conversations in a private office without consent (Correct answer)
Reviewing the suspect's publicly listed social media posts

Correct answer: Recording conversations in a private office without consent

Recording private conversations without consent typically requires legal authorization under federal and state wiretapping laws.

Question 75: A fraud examiner working an internal investigation interviews an employee suspected of embezzlement. What Miranda warning consideration applies in this scenario?

Miranda warnings are always required before any fraud interview
Miranda warnings are only required when government agents conduct custodial interrogations (Correct answer)
Miranda warnings are required whenever the suspect denies wrongdoing
Miranda warnings must be given by all certified fraud examiners

Correct answer: Miranda warnings are only required when government agents conduct custodial interrogations

Miranda warnings are constitutionally required only when government (law enforcement) agents conduct custodial interrogations; private investigators and corporate fraud examiners are not bound by this requirement.

Question 76: The primary difference between cash larceny and skimming is:

The amount of money stolen.
The perpetrator's level of authority within the company.
Whether the theft involves physical currency or electronic funds.
Whether the stolen funds were on the company's books before the theft. (Correct answer)

Correct answer: Whether the stolen funds were on the company's books before the theft.

The key distinction between cash larceny and skimming lies in the timing of the theft relative to the company's accounting records. Skimming is the theft of cash *before* it is recorded (off-book), while cash larceny is the theft of cash that has *already* been recorded (on-book). [2, 7, 8] This makes skimming schemes generally more difficult to detect as they leave no direct audit trail. [1]

Question 77: When conducting a cognitive interview, what technique helps witnesses retrieve more accurate memories?

Mentally reinstating the environmental and emotional context of the event (Correct answer)
Limiting the witness to a brief summary
Asking leading questions to prompt recall
Interrupting frequently to clarify details

Correct answer: Mentally reinstating the environmental and emotional context of the event

Mental reinstatement of context activates associated memories and improves the completeness and accuracy of recall.

Question 78: A fraud examiner conducting an investigation discovers that a colleague on the investigation team has been sharing confidential case details with the subject. This situation MOST requires:

Continuing the investigation without addressing the breach to avoid delays
Confronting the colleague directly and warning them to stop
Immediately reporting the breach to appropriate supervisors and documenting the incident (Correct answer)
Quietly removing the colleague from the case without documentation

Correct answer: Immediately reporting the breach to appropriate supervisors and documenting the incident

A confidentiality breach must be reported to supervisors and documented immediately to protect the investigation's integrity and prevent further compromise.

Question 79: Which of the following is a primary financial statement red flag indicating potential asset overstatement through capitalization fraud?

Decreasing long-term debt with stable interest expense
Increasing accounts receivable turnover
Capital expenditures growing significantly faster than revenue or industry peers (Correct answer)
Declining accounts payable with stable revenue

Correct answer: Capital expenditures growing significantly faster than revenue or industry peers

When capital expenditures grow much faster than revenue or industry norms, it may indicate that operating expenses are being improperly capitalized to inflate assets.

Question 80: In a civil fraud case, the doctrine of 'fraudulent concealment' is legally significant because it:

Can toll (pause) the statute of limitations until the fraud is discovered (Correct answer)
Automatically doubles the damages available to the plaintiff
Shifts the burden of proof from plaintiff to defendant
Allows the case to be heard by a magistrate judge rather than a district judge

Correct answer: Can toll (pause) the statute of limitations until the fraud is discovered

Fraudulent concealment tolls the statute of limitations, preventing the clock from running while the fraud remains hidden, so the limitations period begins when the victim discovers or should have discovered the fraud.

Question 81: Under the Sarbanes-Oxley Act of 2002 (SOX), which of the following is a key requirement for the audit committees of publicly traded companies?

All members of the audit committee must be Certified Public Accountants (CPAs).
The audit committee must meet on a daily basis to review all financial transactions.
The committee must be directly responsible for the appointment, compensation, and oversight of the external auditor. (Correct answer)
The Chief Financial Officer (CFO) must serve as the chairperson of the audit committee.

Correct answer: The committee must be directly responsible for the appointment, compensation, and oversight of the external auditor.

Section 301 of the Sarbanes-Oxley Act mandates that the audit committee of a public company shall be directly responsible for appointing, compensating, and overseeing the work of the external audit firm. This provision is crucial for ensuring auditor independence from management. While financial literacy is required and having a financial expert is encouraged, not all members must be CPAs. The CFO, being part of management, cannot be an independent member of the committee.

Question 82: A government official accepts a lavish trip from a construction company. A month later, the official awards a non-competitive, high-value contract to that same company. This scenario most likely represents which type of corruption scheme?

Bribery (Correct answer)
Illegal Gratuity
Conflict of Interest
Economic Extortion

Correct answer: Bribery

Bribery involves offering, giving, receiving, or soliciting anything of value to influence an official act. In this case, the lavish trip was likely provided with the intent to influence the awarding of the contract, which constitutes a quid pro quo arrangement.

Question 83: Which of the following best describes a 'pass-through' vendor scheme?

A vendor is paid before goods are received to take advantage of early-payment discounts
A vendor invoices for goods delivered through a third-party shipper
An employee-controlled entity buys goods and resells them to the employer at an inflated price (Correct answer)
An employee reroutes vendor payments through their personal bank account

Correct answer: An employee-controlled entity buys goods and resells them to the employer at an inflated price

In a pass-through scheme, the fraudster's entity purchases goods at market price and resells them to the employer at a markup, capturing the profit as illicit gain.

Question 84: Under the USA PATRIOT Act, financial institutions are required to implement Customer Identification Programs (CIPs). At minimum, CIPs must collect which of the following for individual customers?

Name, social media profiles, references, and investment history
Name, date of birth, address, and identification number (Correct answer)
Name, employer, income, and tax returns
Name, address, credit score, and employment history

Correct answer: Name, date of birth, address, and identification number

CIPs must collect at minimum the customer's name, date of birth, address, and identification number (such as Social Security Number or passport number).

Question 85: A fraud risk assessment should be updated most frequently when which of the following occurs?

A new CFE joins the compliance team
A significant organizational change such as a merger occurs (Correct answer)
The annual audit cycle begins
Employee headcount increases by 5%

Correct answer: A significant organizational change such as a merger occurs

Material organizational changes such as mergers, acquisitions, or restructurings introduce new fraud risks that require the assessment to be revised promptly.

Question 86: When a fraud examiner analyzes financial statements, which accounting concept describes the requirement that transactions be recorded in the period they occur, regardless of when cash changes hands?

Accrual basis accounting (Correct answer)
Revenue recognition principle
Cash basis accounting
Matching principle

Correct answer: Accrual basis accounting

Accrual accounting records revenues when earned and expenses when incurred regardless of cash flow, and manipulating accruals is a common method of financial statement fraud.

Question 87: Which of the following is an example of a detective control in a fraud risk management program?

Surprise cash counts (Correct answer)
Dual-signature authorization on checks
Pre-employment background checks
Segregation of duties

Correct answer: Surprise cash counts

Surprise cash counts detect discrepancies after they occur rather than preventing them, making them a detective rather than preventive control.

Question 88: Which analytical procedure compares each line item in a financial statement as a percentage of a base figure (e.g., total sales) to identify unusual relationships?

Benford's Law analysis
Ratio analysis
Common-size financial statement analysis (Correct answer)
Trend analysis

Correct answer: Common-size financial statement analysis

Common-size analysis expresses each line item as a percentage of a base amount, making it easy to spot proportions that deviate from expectations.

Question 89: A company requires all employees to take vacations of at least one consecutive week. What fraud scheme is this policy specifically designed to detect?

Check tampering and lapping schemes (Correct answer)
Conflicts of interest with vendors
Expense reimbursement fraud
Bid rigging in procurement

Correct answer: Check tampering and lapping schemes

Mandatory vacations expose lapping and check-tampering schemes because a substitute must handle the work, making it difficult for the fraudster to continue concealment.

Question 90: An examiner reviewing accounts receivable finds several large balances that have been written off as uncollectible, all approved by the same accounts receivable clerk. What fraud scheme should be suspected?

Skimming with write-off concealment (Correct answer)
Lapping of customer payments
Billing scheme using fictitious customers
Kiting between customer accounts

Correct answer: Skimming with write-off concealment

Writing off a customer's balance as bad debt after pocketing their payment is a common concealment technique that removes the evidence of the original theft.

Question 91: Under the Foreign Corrupt Practices Act (FCPA), which of the following payments is explicitly permitted?

Payments disguised as consulting fees to foreign officials
Payments to foreign officials to win government contracts
Gifts given to influence business decisions of foreign officials
Facilitating payments to expedite routine governmental actions (Correct answer)

Correct answer: Facilitating payments to expedite routine governmental actions

The FCPA contains a narrow exception for facilitating payments (also called grease payments) made to expedite routine, non-discretionary governmental actions.

Question 92: Under U.S. federal law, what statute most directly criminalizes bank fraud?

31 U.S.C. § 5313 (CTR reporting)
18 U.S.C. § 1344 (bank fraud) (Correct answer)
18 U.S.C. § 1341 (mail fraud)
18 U.S.C. § 1956 (money laundering)

Correct answer: 18 U.S.C. § 1344 (bank fraud)

18 U.S.C. § 1344 specifically criminalizes schemes to defraud financial institutions or to obtain bank money, funds, or credits by fraud.

Question 93: Which of the following is an example of a 'kickback' scheme in a procurement context?

A manager inflates expense reports to receive excess reimbursement
An employee steals inventory and sells it to an outside buyer
A vendor pays a portion of contract proceeds back to the employee who approved the contract (Correct answer)
A contractor bills for services not rendered on a government project

Correct answer: A vendor pays a portion of contract proceeds back to the employee who approved the contract

A kickback occurs when a vendor returns a portion of contract proceeds to the employee who influenced the award, creating an improper benefit for the corrupt employee.

Question 94: A Certified Fraud Examiner is reviewing the governance structure of a privately-held company. The CFE notes that the board of directors consists of the CEO, the CEO's brother (who is the COO), the company's long-time external lawyer, and two retired executives who are close personal friends of the CEO. Which corporate governance weakness is MOST apparent from this structure?

A significant lack of independent directors. (Correct answer)
Absence of a designated financial expert.
Insufficient segregation of accounting duties.
Lack of a formal whistleblower policy.

Correct answer: A significant lack of independent directors.

An effective board of directors requires independence to provide objective oversight and challenge management's decisions. A board composed of insiders (CEO, COO) and individuals with close personal or business relationships with the CEO (lawyer, friends) lacks the independence necessary for effective governance and creates a higher risk of management override and unchecked authority.

Question 95: An employee is told by a foreign customs official that goods will be held indefinitely unless a payment is made to release them. This BEST illustrates:

Bid rigging
Active bribery
Commercial bribery
Economic extortion (Correct answer)

Correct answer: Economic extortion

When a public official demands payment under threat of harm or withholding a service, it constitutes economic extortion rather than voluntary bribery.

Question 96: Which of the following scenarios best illustrates a 'fictitious refund' scheme at a retail company?

A manager reverses a previous overcharge and credits the customer account
A cashier processes a refund for merchandise returned by a customer and keeps the cash
A cashier processes a refund for merchandise that was never returned and pockets the cash (Correct answer)
A cashier issues store credit instead of a cash refund without authorization

Correct answer: A cashier processes a refund for merchandise that was never returned and pockets the cash

A fictitious refund scheme involves processing a return transaction for merchandise that was not actually returned, generating cash that the employee steals.

Question 97: Which of the following is the MOST common reason employees fail to report suspected fraud?

Fear of retaliation from management or colleagues (Correct answer)
Lack of awareness that fraud is occurring
Uncertainty about how to contact law enforcement
Belief that fraud only harms shareholders

Correct answer: Fear of retaliation from management or colleagues

Research consistently shows that fear of retaliation is the leading barrier to fraud reporting, underscoring the need for robust whistleblower protections.

Question 98: Which of the following is common for looking at data during a fraud investigation?

Regression analysis
Cluster analysis
Frequency analysis (Correct answer)
T-test analysis

Correct answer: Frequency analysis

Explanation: During a fraud investigation, one of the most common ways to look at data is through frequency analysis. It involves looking for patterns or oddities in how often transactions happen, how much they cost, or other things that could be signs of fraud.

Question 99: Which technique is MOST effective for detecting fictitious vendor fraud in a company's accounts payable system?

Analyzing payroll records for ghost employees
Matching vendor addresses against employee addresses (Correct answer)
Reviewing expense reports for personal charges
Comparing bank statements with cash receipts

Correct answer: Matching vendor addresses against employee addresses

Fictitious vendor fraud often involves vendors using the same address as an employee, making address matching a key detection technique.

Question 100: What is the primary goal of job rotation policies in fraud prevention?

To limit the opportunity for any single employee to conceal fraudulent activity (Correct answer)
To cross-train employees for operational flexibility
To reduce employee burnout from repetitive tasks
To comply with labor union requirements

Correct answer: To limit the opportunity for any single employee to conceal fraudulent activity

Job rotation disrupts long-standing collusion opportunities and makes it harder for employees to perpetuate concealed fraud schemes over time.

Question 101: Under the ACFE's classification of asset misappropriation, 'skimming' differs from 'cash larceny' primarily because:

Skimming only applies to electronic payments
Cash larceny requires collusion while skimming does not
Skimming occurs before the cash is recorded in the company's books (Correct answer)
Skimming involves larger dollar amounts than cash larceny

Correct answer: Skimming occurs before the cash is recorded in the company's books

Skimming is an off-book scheme where cash is stolen before it enters the accounting records, making it harder to detect through record review.

Question 102: When a CFE prepares a written report of investigation findings, it should:

Contain the CFE's personal assessment of the suspect's character
Recommend specific criminal charges to be filed
Include the CFE's opinion on the suspect's guilt
Be limited to factual findings and supported by evidence (Correct answer)

Correct answer: Be limited to factual findings and supported by evidence

CFE investigation reports should objectively present factual findings supported by evidence without expressing opinions on guilt or recommending charges.

Question 103: In a bid-rigging scheme, which party is MOST likely to be the bribe payer?

The losing bidders who were compensated for submitting inflated bids
The winning bidder who coordinated with competitors (Correct answer)
The government procurement officer who accepted payment
The internal auditor who failed to detect the scheme

Correct answer: The winning bidder who coordinated with competitors

In bid rigging, the winning bidder typically pays bribes to the procurement official and may compensate losing bidders to submit sham bids, making them the primary bribe payer.

Question 104: Which of the following payroll schemes is most likely to be revealed by comparing current payroll records to terminated employee files?

Wage rate alteration
Commission fraud
Ghost employee scheme using former employee identities (Correct answer)
Fictitious hours scheme

Correct answer: Ghost employee scheme using former employee identities

Continuing to pay a terminated employee's record after separation, and diverting the funds, is detected when active payroll is compared against the HR termination list.

Question 105: A payroll clerk creates a fictitious employee in the company's payroll system, complete with a fake social security number and address. Each pay period, the clerk processes a paycheck for this 'ghost employee' and deposits it into a bank account they control. This is an example of what type of asset misappropriation?

Cash larceny
Skimming
Payroll fraud (Correct answer)
Check tampering

Correct answer: Payroll fraud

This scenario describes a ghost employee scheme, which is a common type of payroll fraud. [15] Payroll fraud involves an employee manipulating the payroll system to generate fraudulent payments. [11] Check tampering involves altering a legitimate check, while skimming and larceny relate to the theft of incoming cash.

Question 106: In the Beneish M-Score model used to detect earnings manipulation, which variable specifically measures changes in depreciation methods or useful life estimates?

Depreciation index (DEPI) (Correct answer)
Total accruals to total assets (TATA)
Sales growth index (SGI)
Asset quality index (AQI)

Correct answer: Depreciation index (DEPI)

The Depreciation Index (DEPI) in the Beneish model measures whether a firm is slowing depreciation, which can signal earnings management.

Question 107: Which of the following describes a 'pass-through' scheme in the context of vendor fraud?

A company passes financial losses to a subsidiary
An employee passes invoices through multiple approvers without review
An auditor passes control testing to an offshore firm
A fraudster buys goods at market price and resells them to the victim company at an inflated price (Correct answer)

Correct answer: A fraudster buys goods at market price and resells them to the victim company at an inflated price

In a pass-through scheme, an intermediary entity buys goods or services at normal cost and resells them to the victim company at an inflated price, pocketing the difference.

Question 108: A fraud examiner, testifying as a fact witness in a criminal trial, is asked by the prosecutor for their opinion on whether the defendant's actions were intentionally deceptive. How should the fraud examiner respond?

Provide a detailed opinion based on their experience and analysis of the evidence.
State that they cannot answer because the question calls for an opinion, which is beyond the scope of a fact witness's testimony. (Correct answer)
Request to be qualified as an expert witness before answering the question.
Answer the question but qualify that it is a personal belief, not a professional conclusion.

Correct answer: State that they cannot answer because the question calls for an opinion, which is beyond the scope of a fact witness's testimony.

A fact witness testifies about what they have seen, heard, or personally experienced. They are not permitted to offer opinions, interpretations, or conclusions about the facts. Providing an opinion on the defendant's intent (deception) is the role of an expert witness, who has been qualified by the court based on specialized knowledge.

Question 109: Which element is NOT required to prove occupational fraud in a civil case?

A false representation was made
The perpetrator had a prior criminal record (Correct answer)
The victim suffered damages
The victim relied on the misrepresentation

Correct answer: The perpetrator had a prior criminal record

Prior criminal history is not a required element of civil fraud; the elements focus on the act, reliance, and resulting harm.

Question 110: When conducting due diligence on a third-party agent in a high-risk country, which factor is MOST concerning from an anti-corruption standpoint?

The agent has personal relationships with government decision-makers and demands unusually high commissions (Correct answer)
The agent requests payment in the local currency rather than US dollars
The agent is not publicly traded and has no formal office
The agent has operated in the country for only two years

Correct answer: The agent has personal relationships with government decision-makers and demands unusually high commissions

Government connections combined with unusually high commissions create a high risk that funds are being channeled as bribes to those officials.

Question 111: A Suspicious Activity Report (SAR) must be filed by U.S. financial institutions within how many calendar days of detecting a suspicious transaction?

60 days
30 days (Correct answer)
45 days
15 days

Correct answer: 30 days

FinCEN regulations require financial institutions to file a SAR within 30 calendar days of detecting suspicious activity, with a 60-day extension if no suspect is identified.

Question 112: Which of the following best describes a 'shell company' used in a fraudulent billing scheme?

A fictitious entity created to receive fraudulent payments from the victim organization (Correct answer)
A legitimate company with a separate bank account for fraud proceeds
A company that only sells shells and other commodities
A subsidiary formed to evade taxes legally

Correct answer: A fictitious entity created to receive fraudulent payments from the victim organization

In fraudulent billing schemes, perpetrators set up shell companies—entities with no real operations—to receive payments for goods or services never provided.

Question 113: The Benford's Law analysis technique is used in fraud examinations primarily to:

Identify duplicate invoice numbers in accounts payable
Compare vendor addresses against employee addresses
Detect anomalies in the natural distribution of leading digits in financial data (Correct answer)
Calculate the expected loss from an asset misappropriation scheme

Correct answer: Detect anomalies in the natural distribution of leading digits in financial data

Benford's Law predicts the frequency of leading digits in naturally occurring datasets; deviations from this distribution can signal fabricated or manipulated numbers.

Question 114: Which of the following tasks does not fall under the purview of bankruptcy courts?

Approving reorganization plans
Appointing trustees, examiners and committees
Supervising bankruptcy petitions (Correct answer)
Conducting hearings and trials to resolve disputes

Correct answer: Supervising bankruptcy petitions

Supervising the filing of bankruptcy petitions is an administrative/clerical function, not a duty of the bankruptcy court itself. The court's role is to oversee the legal proceedings — conducting hearings and trials, appointing trustees and committees, and approving reorganization plans.

Question 115: Under the Foreign Corrupt Practices Act (FCPA), which of the following is considered a 'foreign official'?

A foreign national working for a US company abroad
A private sector employee of a foreign company
An employee of a state-owned enterprise (Correct answer)
A US citizen employed by a foreign private firm

Correct answer: An employee of a state-owned enterprise

The FCPA defines 'foreign official' to include employees of government-owned or government-controlled entities, such as state-owned enterprises.

Question 116: Why is a fraud investigation done in the first place?

To recover losses resulting from fraudulent activity
To determine if fraud has occurred (Correct answer)
To punish individuals who have engaged in fraudulent activity

Correct answer: To determine if fraud has occurred

Explanation: The main goal of a fraud investigation is to find out if fraud has happened. This could mean gathering evidence, talking to people, and looking at financial records to determine the fraud size and type.

Question 117: Which of the following best describes the 'net worth method' used in fraud investigations?

Determining the fair market value of assets seized in a fraud case
Estimating unreported income by comparing changes in net worth to reported income (Correct answer)
Assessing the financial health of a victim organization post-fraud
Calculating the total losses attributable to a fraud scheme

Correct answer: Estimating unreported income by comparing changes in net worth to reported income

The net worth method calculates increases in a suspect's net worth that exceed reported income, suggesting unreported income from fraud.

Question 118: Which of the following best describes 'trade-based money laundering' (TBML)?

Laundering money through over- or under-invoicing of goods and services in international trade (Correct answer)
Using stock market trades to layer criminal proceeds
Using cryptocurrency exchanges to launder money internationally
Moving cash physically across borders in commercial freight

Correct answer: Laundering money through over- or under-invoicing of goods and services in international trade

TBML exploits international trade by manipulating the price, quantity, or quality of goods/services in invoices to transfer value across borders and obscure the origin of funds.

Question 119: Under the ACFE Fraud Tree, which of the following is classified as a 'fraudulent disbursement' scheme?

Submitting fictitious expense reimbursement claims (Correct answer)
Stealing blank company checks from the supply cabinet
Diverting incoming customer payments before recording them
Skimming receipts from cash sales

Correct answer: Submitting fictitious expense reimbursement claims

Fraudulent disbursements involve causing the company to issue payments through legitimate-appearing channels, such as reimbursing fabricated personal expenses.

Question 120: What is the recommended seating arrangement for a private investigative interview to minimize the subject's anxiety?

Side-by-side at a 90-degree angle with no barrier between them (Correct answer)
Glass wall separating interviewer and subject
Subject seated lower than the interviewer
Interviewer behind a large desk to project authority

Correct answer: Side-by-side at a 90-degree angle with no barrier between them

A side-by-side or 90-degree arrangement without a physical barrier reduces confrontational dynamics and promotes open communication.

Question 121: A fraud examiner is writing the final investigation report. Which element is MOST important to include to ensure the report's usefulness?

Speculation about additional fraud that may have occurred
Opinions about the subject's character and past behavior
Recommendations for the criminal prosecution strategy
Factual findings supported by specific evidence with clear source citations (Correct answer)

Correct answer: Factual findings supported by specific evidence with clear source citations

Effective investigation reports present factual findings tied to specific evidence; opinions, speculation, and prosecutorial recommendations exceed the examiner's proper role.

Question 122: Which internal control framework is most widely used by U.S. public companies for SOX Section 404 compliance?

COBIT
COSO Internal Control — Integrated Framework (Correct answer)
NIST Cybersecurity Framework
ISO 31000

Correct answer: COSO Internal Control — Integrated Framework

The COSO Internal Control — Integrated Framework is the standard used by most U.S. public companies to assess and report on internal controls under SOX 404.

Question 123: Which of the following is a common form of financial statement fraud?

Stealing inventory from the warehouse
Overstating expenses to reduce taxes (Correct answer)
Diverting cash receipts to a personal account

Correct answer: Overstating expenses to reduce taxes

Explanation: One common type of financial statement fraud is overstating expenses to lower taxes. It involves making up expenses or making expenses that don't exist to lower taxable income.

Question 124: Which of the following is an example of a 'soft' control in a fraud prevention program?

Dual signature requirements for checks over $10,000
An organizational culture that encourages speaking up about ethical concerns (Correct answer)
Quarterly reconciliation of bank statements
IT access restrictions that limit system permissions by job role

Correct answer: An organizational culture that encourages speaking up about ethical concerns

Soft controls like culture, tone, and norms influence behavior but are not procedural or technical safeguards — yet they are critical to an effective fraud prevention environment.

Question 125: A payroll clerk adds a fictitious employee to the payroll system and diverts the paychecks to their own account. This scheme is called:

Ghost employee scheme (Correct answer)
Commission fraud
Worker's compensation fraud
Expense reimbursement fraud

Correct answer: Ghost employee scheme

A ghost employee scheme involves adding a non-existent (or former) employee to payroll and diverting the wages to the perpetrator.

Question 126: Which component of the COSO Internal Control framework is most directly concerned with fraud risk assessment?

Monitoring Activities
Information and Communication
Risk Assessment (Correct answer)
Control Activities

Correct answer: Risk Assessment

The Risk Assessment component of COSO specifically includes identifying and analyzing risks, including fraud risks, that may prevent the organization from achieving its objectives.

Question 127: In a fraud investigation, 'metadata' from electronic documents can be valuable primarily because it reveals what information?

Data about when a file was created, modified, and by whom (Correct answer)
The market value of the document's contents
Encryption keys used to protect confidential files
The identity of individuals who printed the document

Correct answer: Data about when a file was created, modified, and by whom

Metadata (data about data) embedded in electronic files can reveal creation dates, modification history, author names, and version history — often crucial for detecting document fraud or backdating.

Question 128: During a fraud risk assessment, which approach involves analyzing data to identify anomalies that may indicate fraud?

Data analytics (Correct answer)
Inherent risk mapping
Qualitative risk ranking
Walk-through testing

Correct answer: Data analytics

Data analytics involves examining large volumes of transactional data to detect patterns, outliers, or anomalies that could signal fraudulent activity.

Question 129: A fraud examiner reviewing bank statements notices several round-dollar transactions just below the $10,000 CTR reporting threshold. This pattern is MOST indicative of:

Legitimate tax planning strategies
Normal business cash flow management
Accounts payable float management
Structuring, which is itself a federal crime (Correct answer)

Correct answer: Structuring, which is itself a federal crime

Structuring (also called 'smurfing') involves deliberately breaking up transactions to avoid Currency Transaction Report requirements and is a federal crime.

Question 130: Which of the following is a common red flag that might indicate an employee is involved in an asset misappropriation scheme?

The employee frequently works overtime and completes all assigned tasks.
The employee consistently lives a lifestyle that appears to be beyond their known salary. (Correct answer)
The employee takes all of their allotted vacation time each year.
The employee regularly shares job duties with colleagues to promote teamwork.

Correct answer: The employee consistently lives a lifestyle that appears to be beyond their known salary.

A lifestyle that appears beyond one's means is a significant behavioral red flag for fraud. [3, 25, 26] It suggests the individual may have an illicit source of income. Other common red flags include an unwillingness to share duties (to prevent discovery), defensiveness, and experiencing financial difficulties. [24]

Question 131: Which of the following activities is MOST critical for evaluating the operating effectiveness of existing anti-fraud controls during a fraud risk assessment?

Reviewing the written policies and procedures manual.
Conducting transactional testing and observing control activities. (Correct answer)
Brainstorming potential new fraud schemes with the risk assessment team.
Interviewing senior management about their commitment to ethics.

Correct answer: Conducting transactional testing and observing control activities.

While reviewing policies (design effectiveness) and interviewing management are important, evaluating operating effectiveness requires determining if the controls are actually working as intended. This is best accomplished through activities like testing a sample of transactions to see if the control was applied correctly, observing employees performing control activities, and conducting walkthroughs.

Question 132: When a fraud examiner identifies a potential conflict of interest in conducting an assigned investigation, the MOST appropriate action is to:

Assign a junior team member to conduct the investigation instead
Disclose the conflict to supervisors and recuse if necessary (Correct answer)
Proceed with the investigation but document the conflict
Ignore the conflict if it is unlikely to affect the outcome

Correct answer: Disclose the conflict to supervisors and recuse if necessary

Disclosing conflicts of interest and recusing when appropriate preserves the examiner's objectivity and the investigation's credibility.

Question 133: Under the Federal Rules of Evidence, electronically stored information (ESI) is considered which type of evidence?

Documentary evidence subject to authenticity requirements (Correct answer)
Privileged evidence exempt from discovery
Demonstrative evidence only
Hearsay evidence inadmissible without exception

Correct answer: Documentary evidence subject to authenticity requirements

ESI is treated as documentary evidence and must meet authenticity requirements under FRE Rule 901 to be admissible, demonstrating it is what the proponent claims.

Question 134: Which technique do fraudsters use to make an email appear to come from a legitimate source by altering the 'From' field?

Vishing
Email spoofing (Correct answer)
Smishing
Phishing

Correct answer: Email spoofing

Email spoofing involves forging the sender's address in the email header to make the message appear to originate from a trusted or legitimate source.

Question 135: What does the term 'shell company' refer to in a fraud context?

A fictitious or inactive entity used to disguise financial transactions (Correct answer)
A holding company with multiple subsidiaries
A company that sells petroleum products
A company in the process of liquidation

Correct answer: A fictitious or inactive entity used to disguise financial transactions

A shell company is an entity with no real operations used to funnel fraudulent payments, launder money, or conceal asset ownership.

Question 136: When an organization implements a mandatory vacation policy, which fraud risk does it primarily mitigate?

Financial statement manipulation at the CFO level
Frauds that require continuous concealment by the perpetrator (Correct answer)
Theft of physical assets from remote locations
Bribery by external parties

Correct answer: Frauds that require continuous concealment by the perpetrator

Mandatory vacations force someone else to perform the absent employee's duties, which often exposes schemes that require ongoing manual concealment such as lapping.

Question 137: Which governance mechanism best addresses the principal-agent problem between shareholders and management?

Reducing the external auditor's scope
Increasing the number of board meetings
Consolidating decision-making authority in the CEO
Aligning executive pay with long-term shareholder value (Correct answer)

Correct answer: Aligning executive pay with long-term shareholder value

Equity-based compensation and long-term incentives align management interests with shareholder interests, mitigating the principal-agent conflict.

Question 138: A fraud examiner discovers that a key witness has died before trial. Which hearsay exception would most likely allow admission of that witness's prior sworn deposition testimony?

Present sense impression
Former testimony (Correct answer)
Dying declaration
Excited utterance

Correct answer: Former testimony

Under FRE 804(b)(1), former testimony given under oath is admissible when the declarant is unavailable, provided the opposing party had an opportunity to cross-examine.

Question 139: Which of the following is the MOST effective internal control to prevent bribery in a company's procurement function?

Requiring all vendors to be publicly traded companies
Limiting all contracts to amounts under a fixed dollar threshold
Annual employee acknowledgment of the code of conduct
Mandatory rotation of procurement personnel and segregation of contract approval duties (Correct answer)

Correct answer: Mandatory rotation of procurement personnel and segregation of contract approval duties

Personnel rotation disrupts established corrupt relationships while segregation of duties prevents any single employee from both selecting vendors and approving payments.

Question 140: Which of the following internal controls is specifically designed to prevent check tampering?

Storing blank checks in a locked location accessible only to authorized personnel (Correct answer)
Reconciling vendor statements to accounts payable ledgers monthly
Requiring purchase orders for all acquisitions over $500
Rotating employees among different job functions quarterly

Correct answer: Storing blank checks in a locked location accessible only to authorized personnel

Restricting physical access to blank check stock prevents unauthorized individuals from writing or altering checks payable to themselves.

Question 141: Which of the following best describes the role of 'tone at the top' in financial statement fraud prevention?

It is an SEC requirement that mandates written ethics policies for public companies
It describes how senior management's ethical culture influences the organization's fraud risk environment (Correct answer)
It is a PCAOB standard requiring auditors to assess management's communication practices
It refers to the external auditor's communication style with the audit committee

Correct answer: It describes how senior management's ethical culture influences the organization's fraud risk environment

Tone at the top reflects the ethical culture set by senior leadership, which strongly influences whether employees throughout the organization engage in or resist fraudulent behavior.

Question 142: In the context of corruption, 'state capture' refers to:

When government officials take over private businesses through regulatory action
The arrest and prosecution of corrupt government officials
When private entities corrupt government processes to shape laws and regulations in their favor (Correct answer)
A government's nationalization of private companies suspected of bribery

Correct answer: When private entities corrupt government processes to shape laws and regulations in their favor

State capture describes a systemic form of grand corruption where private interests subvert government institutions to obtain favorable policies, laws, or contracts.

Question 143: A fraud examiner discovers that a suspect wired $500,000 in illicit proceeds through three different banks before depositing the funds in a legitimate investment account. This process most likely constitutes:

Layering (Correct answer)
Structuring
Integration
Placement only

Correct answer: Layering

Layering is the second stage of money laundering, involving complex transactions through multiple accounts or entities to obscure the audit trail.

Question 144: Which type of analysis detects fraud by looking for duplicate invoice numbers, vendor addresses matching employee addresses, or payments just below approval thresholds?

Predictive modeling
Data mining or anomaly detection (Correct answer)
Regression analysis
Monte Carlo simulation

Correct answer: Data mining or anomaly detection

Data mining and anomaly detection techniques systematically search large datasets for patterns such as duplicate payments, related-party conflicts, or threshold manipulation that indicate fraud.

Question 145: Which element is most critical when establishing a tone at the top for fraud prevention?

Hiring an external ethics officer
Posting the code of conduct in break rooms
Conducting annual fraud training webinars
Senior management visibly modeling ethical behavior (Correct answer)

Correct answer: Senior management visibly modeling ethical behavior

Tone at the top requires senior leaders to demonstrably model the ethical conduct they expect, as employees take behavioral cues from leadership.

Question 146: What does a 'clawback' provision in executive compensation primarily aim to achieve in fraud prevention?

Recovering bonuses paid based on fraudulent financial results (Correct answer)
Limiting total executive pay to industry benchmarks
Ensuring executives receive deferred compensation
Requiring executives to invest their bonuses in company stock

Correct answer: Recovering bonuses paid based on fraudulent financial results

Clawback provisions allow organizations to reclaim compensation paid to executives whose bonuses were tied to financial results later found to be fraudulent.

Question 147: Which fraud risk factor is most directly reduced by conducting thorough background checks before hiring?

Rationalization for committing fraud
Capability to commit fraud (Correct answer)
Pressure or incentive to commit fraud
Opportunity to commit fraud

Correct answer: Capability to commit fraud

Background checks help screen out candidates with a history of dishonesty or relevant crimes, reducing the pool of people with demonstrated capability to commit fraud.

Question 148: During a financial statement fraud investigation, an examiner identifies that revenue appears to be significantly overstated. The MOST appropriate analytical technique to use initially would be:

Cash flow analysis comparing beginning and ending balances
Ratio analysis comparing accounts payable to total liabilities
Vertical analysis of a single year's income statement
Horizontal analysis comparing revenue trends over multiple periods (Correct answer)

Correct answer: Horizontal analysis comparing revenue trends over multiple periods

Horizontal analysis across multiple periods reveals unusual trends or anomalies in revenue recognition that may indicate manipulation.

Question 149: A company has been consistently reporting significant revenue growth and high net income, yet its operating cash flow is persistently negative. This discrepancy is most likely a red flag for which of the following financial statement fraud schemes?

Improper disclosures
Improper asset valuation
Concealed liabilities and expenses
Fictitious revenues (Correct answer)

Correct answer: Fictitious revenues

When a company records fictitious sales, it increases its reported revenue and net income, but no cash is actually collected. This leads to a growing gap between net income and operating cash flow, as the cash flow statement will reflect the lack of actual cash receipts.

Question 150: Which concept describes the idea that fraud risk is heightened when one employee handles multiple phases of the same transaction?

Authorization bypass
Tone at the top weakness
Lack of oversight
Segregation of duties failure (Correct answer)

Correct answer: Segregation of duties failure

Segregation of duties failure occurs when one person controls initiation, authorization, and recording of a transaction, creating an unchecked opportunity for fraud.

Question 151: Which inventory fraud scheme involves an employee recording fictitious inventory to inflate assets?

Purchase returns fraud
Fictitious revenues
Fraudulent shipping
Inventory padding (Correct answer)

Correct answer: Inventory padding

Inventory padding involves recording nonexistent or overvalued inventory to inflate reported assets on the balance sheet.

Question 152: What is the primary purpose of a Fraud Risk Management Program (FRMP) as defined by the ACFE and COSO?

To replace the need for external audits and regulatory oversight
To establish a comprehensive framework for preventing, detecting, and responding to fraud (Correct answer)
To document fraud losses for insurance reimbursement purposes
To detect all instances of fraud before they are reported externally

Correct answer: To establish a comprehensive framework for preventing, detecting, and responding to fraud

An FRMP provides an integrated framework covering governance, risk assessment, prevention controls, detection mechanisms, and response procedures.

Question 153: Which of the following methods is typically the most effective for obtaining documentary evidence?

Perceived strength of the predication
Possible cost of the investigation
All of the above (Correct answer)
Possible public exposure resulting because of the investigation

Correct answer: All of the above

Effective gathering of documentary evidence typically relies on a combination of techniques rather than a single method, so 'All of the above' is correct. Using multiple approaches together yields more reliable and comprehensive documentation than any one alone.

Question 154: Which ratio is commonly used to detect potential revenue fraud by comparing recorded cash receipts to reported sales?

Debt-to-equity ratio
Current ratio
Accounts receivable turnover
Cash-to-sales ratio (Correct answer)

Correct answer: Cash-to-sales ratio

The cash-to-sales ratio helps detect revenue fraud — if reported sales rise but cash receipts do not keep pace, it may indicate fictitious revenue.

Question 155: Which type of evidence is considered the most reliable in fraud investigations because it speaks for itself without requiring interpretation?

Real evidence (Correct answer)
Circumstantial evidence
Testimonial evidence
Demonstrative evidence

Correct answer: Real evidence

Real evidence (physical objects, documents, recordings) is considered highly reliable because it directly proves a fact without depending on witness credibility.

Question 156: A Certified Fraud Examiner is leading a fraud risk assessment for a manufacturing company. The team has identified various potential fraud schemes. According to the COSO/ACFE Fraud Risk Management Guide, what is the next logical step in the process?

Implement new, broad-based anti-fraud controls across the entire organization.
Assess the likelihood and significance of the identified fraud risks. (Correct answer)
Immediately begin a covert investigation of high-risk employees.
Disregard low-impact risks and focus solely on high-impact scenarios.

Correct answer: Assess the likelihood and significance of the identified fraud risks.

After identifying potential fraud schemes, the next step in a structured fraud risk assessment is to assess the likelihood of each risk occurring and the potential significance (or impact) if it did. This analysis allows the organization to prioritize risks and determine where to focus its control activities. Implementing controls or starting investigations before this analysis would be premature.

Question 157: Which of the following best illustrates the concept of 'regulatory capture' as it relates to corporate governance?

A company successfully lobbying for favorable tax legislation
A regulator becoming so aligned with the industry it oversees that it no longer serves the public interest (Correct answer)
Management capturing control of the board through strategic director appointments
Shareholders using proxy votes to block a board nominee

Correct answer: A regulator becoming so aligned with the industry it oversees that it no longer serves the public interest

Regulatory capture occurs when the regulating agency advances the interests of the regulated industry rather than the public, weakening external governance controls.

Question 158: When an investigation reveals evidence of criminal activity, the fraud examiner should PRIMARILY:

Report findings to the appropriate level of management or legal counsel (Correct answer)
Continue the investigation independently to gather maximum evidence
Immediately confront the perpetrator to recover losses
Publish findings to deter other potential fraudsters

Correct answer: Report findings to the appropriate level of management or legal counsel

The fraud examiner should report criminal evidence to management or legal counsel, who will determine whether to involve law enforcement.

Question 159: In a financial statement fraud investigation, which of the following would be the LEAST useful source of evidence when evaluating revenue recognition?

Customer confirmations of purchases
Side agreements between the company and customers
The company's own accounts receivable subsidiary ledger without corroboration (Correct answer)
Shipping documents and delivery confirmations

Correct answer: The company's own accounts receivable subsidiary ledger without corroboration

The company's own accounts receivable ledger is an internal record that can be manipulated by fraudsters, making it the least reliable source without independent corroboration.

Question 160: During an admission-seeking interview, a suspect's speech patterns change significantly. Which of the following verbal cues is most commonly associated with deception?

The use of oaths and character testimony, such as 'I swear I didn't do it.' (Correct answer)
Using increasingly complex sentence structures
Providing direct and concise answers to all questions
Speaking at a consistent and measured pace

Correct answer: The use of oaths and character testimony, such as 'I swear I didn't do it.'

Deceptive individuals often overuse oaths and character testimony to add credibility to their false statements. Liars may also exhibit changes in speech pace or sentence structure, but over-the-top declarations of honesty are a classic verbal red flag. Consistent pace and direct answers are more indicative of truthfulness.

Question 161: Under the PEACE model of interviewing, what does the letter 'E' in the middle of the acronym stand for?

Evaluation
Engage and Explain (Correct answer)
Evidence gathering
Explanation

Correct answer: Engage and Explain

In the PEACE model, the middle 'E' stands for Engage and Explain, where the interviewer builds rapport and outlines the interview process.

Question 162: Which of the following BEST describes the 'books and records' provision of the FCPA?

It requires companies to report all government contacts to the SEC
It requires issuers to maintain accurate records that fairly reflect company transactions (Correct answer)
It prohibits companies from maintaining offshore accounts
It mandates that all foreign payments be recorded in a separate ledger

Correct answer: It requires issuers to maintain accurate records that fairly reflect company transactions

The FCPA's books and records provision requires covered issuers to maintain books and records that accurately and fairly reflect transactions and dispositions of assets.

Question 163: Which tool is most commonly used by forensic examiners to recover deleted files from a hard drive?

Wireshark (network packet analyzer)
EnCase or FTK (forensic imaging software) (Correct answer)
Splunk (log management platform)
SQL query analyzer

Correct answer: EnCase or FTK (forensic imaging software)

Forensic imaging software such as EnCase or FTK (Forensic Toolkit) can recover deleted files by accessing unallocated disk space before it is overwritten.

Question 164: What is the primary purpose of a honeypot in a fraud detection context?

To back up transaction records for audit purposes
To encrypt sensitive financial data
To lure and detect unauthorized users or fraudsters accessing systems (Correct answer)
To authenticate employee credentials

Correct answer: To lure and detect unauthorized users or fraudsters accessing systems

A honeypot is a decoy system or data set designed to attract and identify unauthorized access attempts, helping organizations detect insider threats or external attackers.

Question 165: A company records a long-term lease as an operating lease when it should be classified as a finance lease. The primary financial statement effect is:

Understated liabilities and overstated net income in early lease periods (Correct answer)
Understated assets and understated liabilities, with understated expenses in early periods
Overstated liabilities and understated expenses in early lease periods
Overstated assets and overstated liabilities

Correct answer: Understated liabilities and overstated net income in early lease periods

Misclassifying a finance lease as an operating lease keeps both the asset and liability off-balance-sheet and understates interest and amortization expense in early periods, inflating net income.

Question 166: Which U.S. law created the Public Company Accounting Oversight Board (PCAOB)?

Dodd-Frank Act
Foreign Corrupt Practices Act
Securities Exchange Act of 1934
Sarbanes-Oxley Act (Correct answer)

Correct answer: Sarbanes-Oxley Act

The Sarbanes-Oxley Act of 2002 (SOX) established the PCAOB to oversee auditors of public companies in response to major accounting scandals like Enron.

Question 167: Which of the following is the MOST effective method for identifying fraud risks that insiders are unlikely to voluntarily disclose during interviews?

Comparison to competitor financial ratios
Anonymous employee surveys (Correct answer)
Review of prior year audit reports
Structured interviews with senior management

Correct answer: Anonymous employee surveys

Anonymous surveys allow employees at all levels to report concerns without fear of identification, surfacing fraud risks that structured interviews with management would miss.

Question 168: The UK Bribery Act 2010 differs from the FCPA primarily in that it:

Excludes facilitation payments from its scope entirely
Only applies to UK citizens regardless of where the bribe occurs
Criminalizes commercial bribery between private parties without any government nexus (Correct answer)
Requires proof of intent to defraud the government

Correct answer: Criminalizes commercial bribery between private parties without any government nexus

The UK Bribery Act covers both public and private sector bribery, making it broader than the FCPA which focuses primarily on bribing foreign government officials.

Question 169: The 'big bath' accounting technique refers to:

Recording large one-time gains to offset recurring losses
Gradually overstating earnings across multiple periods to avoid detection
Reversing prior-period accruals to inflate current income
Taking all possible write-downs in a single bad period to improve future reported earnings (Correct answer)

Correct answer: Taking all possible write-downs in a single bad period to improve future reported earnings

A 'big bath' involves taking excessive charges in one poor period so that future periods appear more profitable, often occurring during management changes.

Question 170: Which of the following financial statement fraud techniques involves recording revenue before it has been earned?

Fictitious revenue
Channel stuffing
Round-tripping
Premature revenue recognition (Correct answer)

Correct answer: Premature revenue recognition

Premature revenue recognition records revenue before the earnings process is complete, violating accrual accounting principles and overstating current-period income.

Question 171: An organization discovers that its fraud risk assessment failed to identify a significant payroll fraud. Which assessment weakness most likely caused this gap?

The assessment was conducted too early in the fiscal year
The risk heat map used too many color categories
Management approved the final risk ranking
The assessment team lacked subject matter expertise in payroll processes (Correct answer)

Correct answer: The assessment team lacked subject matter expertise in payroll processes

Lack of subject matter expertise in the area being assessed is a common cause of fraud risk gaps, as assessors may not know what schemes are possible in that function.

Question 172: When interviewing a whistleblower who reports a bribery scheme, a fraud examiner should FIRST:

Immediately confront the accused employee with the allegations
Require the whistleblower to provide written evidence before proceeding
Assess the credibility of the allegation and document the information provided without prejudging the outcome (Correct answer)
Report the allegation directly to law enforcement before conducting any internal review

Correct answer: Assess the credibility of the allegation and document the information provided without prejudging the outcome

Fraud examiners should first evaluate the allegation's credibility and thoroughly document what the whistleblower reports, maintaining objectivity before taking further action.

Question 173: A purchasing manager accepts a vacation trip from a supplier before awarding them a contract. Under fraud classification, this is BEST described as:

Economic extortion
Bribery (Correct answer)
Conflict of interest
Illegal gratuity

Correct answer: Bribery

When a thing of value is given to influence a future business decision, it constitutes bribery; the vacation was received before the contract award as inducement.

Question 174: Which of the following is the most effective anti-fraud control according to ACFE research?

External audits
Mandatory vacation policies
Surprise cash counts
Hotlines for reporting tips (Correct answer)

Correct answer: Hotlines for reporting tips

ACFE research consistently shows that tips—often received through hotlines—are the most common method of detecting fraud.

Question 175: A warehouse employee removes inventory for personal use and disguises the shortage by creating fictitious 'damaged goods' write-offs. Which internal control would most directly detect this fraud?

Pre-numbered receiving reports
Segregation of duties between purchasing and accounts payable
Mandatory vacation policy for warehouse staff
Periodic physical inventory counts reconciled to perpetual records (Correct answer)

Correct answer: Periodic physical inventory counts reconciled to perpetual records

Physical inventory counts compared to perpetual records reveal unexplained shrinkage that cannot be fully justified by legitimate write-offs.

Question 176: During a fraud examination, an examiner discovers that a company's accounts payable aging report shows many vendor invoices paid within one day of receipt, all approved by the same manager. This pattern is most consistent with:

A lapping scheme targeting accounts receivable
Ghost employee payroll fraud
A kickback or billing fraud scheme requiring rapid payment (Correct answer)
Efficient cash management practices

Correct answer: A kickback or billing fraud scheme requiring rapid payment

Unusually rapid invoice approvals by a single individual suggest the approver has a personal interest in ensuring the vendor is paid quickly, a hallmark of kickback arrangements.

Question 177: Which of the following is a key distinction between bribery and an illegal gratuity?

An illegal gratuity is given after an official act is performed, without evidence of a prior agreement to influence the act. (Correct answer)
Bribery is a criminal offense, while an illegal gratuity is only a civil violation.
The value of the item offered is significantly higher in bribery cases.
Bribery involves public officials, whereas illegal gratuities involve private sector employees.

Correct answer: An illegal gratuity is given after an official act is performed, without evidence of a prior agreement to influence the act.

The primary difference between bribery and an illegal gratuity is the element of intent and timing. Bribery requires proof that the payment was offered with the intent to influence a future official act (a quid pro quo). An illegal gratuity is a reward given *after* an official has already taken an action, without proof of a pre-existing agreement to be influenced.

Question 178: Which concept describes the separation of the roles of board chair and chief executive officer?

Dual mandate
Leadership separation (Correct answer)
Leadership duality
Board independence

Correct answer: Leadership separation

Leadership separation (splitting the chair and CEO roles) is considered a best practice for strengthening board oversight.

Question 179: All of the following are common red flags associated with bribery and corruption EXCEPT:

Consistently rotating winning bidders on government contracts to ensure fairness. (Correct answer)
Unusually close associations between an employee and a vendor or customer.
The involvement of unnecessary middlemen or agents in a transaction.
An employee living a lifestyle that appears to exceed their known salary.

Correct answer: Consistently rotating winning bidders on government contracts to ensure fairness.

Consistently rotating winning bidders is generally a sign of a fair and competitive process, not a red flag for corruption. In contrast, a pattern where vendors appear to be taking turns winning bids could be a red flag for collusion or bid-rigging.

Question 180: Which evidentiary concept holds that the original document must be produced when its content is at issue, rather than a copy or oral description?

Completeness Doctrine
Best Evidence Rule (Correct answer)
Parol Evidence Rule
Authentication Requirement

Correct answer: Best Evidence Rule

The Best Evidence Rule (FRE 1002) requires the original document when proving its contents, though duplicates are generally admissible unless authenticity is genuinely questioned.

Question 181: An employee at a retail store processes a customer's cash payment for a $100 item but only records a sale of $20 in the cash register, pocketing the $80 difference. This cash has not yet been recorded on the company's books. Which type of asset misappropriation scheme does this scenario describe?

Billing scheme
Cash larceny
Skimming (Correct answer)
Expense reimbursement fraud

Correct answer: Skimming

This is an example of a skimming scheme, specifically an understated sales scheme. Skimming is the theft of cash *before* it has been recorded in the company's accounting system. [1] In this case, the employee stole the cash before the full transaction was officially recorded, making it an 'off-book' fraud which is harder to detect than cash larceny.

Question 182: What is the statute of limitations for wire fraud under federal law (18 U.S.C. § 1343)?

3 years from the date of the last fraudulent act
10 years if financial institutions are involved
5 years from the date of the last fraudulent act (Correct answer)
7 years from the date of the last fraudulent act

Correct answer: 5 years from the date of the last fraudulent act

The general federal statute of limitations for wire fraud is 5 years from the date of the offense, extended to 10 years if the fraud affected a financial institution.

Question 183: Which scenario represents a segregation of duties violation that creates fraud risk?

The CFO reviews the internal audit report before the board does
The same clerk who approves vendor invoices also signs the payment checks (Correct answer)
The external auditor tests controls designed by management
A manager approves expense reports submitted by direct reports

Correct answer: The same clerk who approves vendor invoices also signs the payment checks

Allowing one person to both approve invoices and issue payments eliminates a key check, enabling them to create fictitious payables and steal funds.

Question 184: When a board member sits on the boards of two competing companies, this is known as a:

Dual mandate
Interlocking directorate (Correct answer)
Cross-directorship
Competitive conflict

Correct answer: Interlocking directorate

An interlocking directorate occurs when a director serves on the boards of competing firms, raising antitrust and conflict-of-interest concerns.

Question 185: Which federal agency has primary jurisdiction for investigating securities fraud in the United States?

Financial Crimes Enforcement Network (FinCEN)
Federal Bureau of Investigation (FBI)
Securities and Exchange Commission (SEC) (Correct answer)
U.S. Secret Service

Correct answer: Securities and Exchange Commission (SEC)

The SEC has primary civil and regulatory authority over securities fraud, though the FBI handles criminal investigations often in parallel with SEC civil enforcement.

Question 186: Which of the following describes a 'pervasive' fraud risk versus a 'localized' fraud risk?

Pervasive risks are more common; localized risks are rare
Pervasive risks occur in public companies; localized risks occur in private companies
Pervasive risks involve collusion; localized risks involve a single perpetrator
Pervasive risks affect the entire organization; localized risks affect specific accounts or processes (Correct answer)

Correct answer: Pervasive risks affect the entire organization; localized risks affect specific accounts or processes

Pervasive fraud risks — such as management override — can affect all financial statement assertions, while localized risks are confined to specific processes or accounts.

Question 187: An ethics hotline receives a tip alleging payroll fraud. To maintain tipster confidence in the program, the organization should PRIMARILY ensure:

The tipster's identity is protected and the tip is investigated promptly (Correct answer)
All tips are shared with the accused employee's direct supervisor
Tips are published in a sanitized quarterly report to employees
Only HR staff can access hotline reports

Correct answer: The tipster's identity is protected and the tip is investigated promptly

Confidentiality and prompt follow-through are the two pillars that maintain employee willingness to report suspected fraud.

Question 188: Which of the following BEST describes 'clawback' provisions in executive compensation plans?

Deferral arrangements that delay bonus payments by three years
Provisions that accelerate vesting upon a change of control
Mechanisms to cap total executive pay at a multiple of median worker pay
Requirements that executives return previously paid compensation if fraud is discovered (Correct answer)

Correct answer: Requirements that executives return previously paid compensation if fraud is discovered

Clawback provisions allow a company to recover incentive compensation paid to executives when it is later determined to have been based on fraudulent or restated financial results.

Question 189: What is 'steganography' in the context of digital fraud?

Creating fake digital invoices with embedded macros
Spoofing IP addresses to hide network activity
Encrypting financial data using advanced algorithms
Hiding secret data within ordinary digital files such as images or audio (Correct answer)

Correct answer: Hiding secret data within ordinary digital files such as images or audio

Steganography is the practice of concealing information within other non-secret data or files (e.g., hiding text inside an image) to avoid detection.

Question 190: Which data analysis technique involves comparing an organization's financial ratios to industry norms to identify anomalies suggesting fraud?

Benford's Law analysis
Ratio analysis (Correct answer)
Cluster analysis
Regression analysis

Correct answer: Ratio analysis

Ratio analysis compares key financial metrics against industry benchmarks or historical trends to identify unusual deviations that may indicate fraud or manipulation.

Question 191: A CFE conducting an interview in a whistleblower investigation must balance information gathering with what primary concern?

Protecting the whistleblower's confidentiality and safety (Correct answer)
Maximizing the number of questions asked
Ensuring the interview is completed within one hour
Recording the session for public disclosure

Correct answer: Protecting the whistleblower's confidentiality and safety

Whistleblower protection is both an ethical duty and a legal requirement; exposing a source can deter future reporting and expose the organization to liability.

Question 192: A company records a sale at the time a contract is signed, even though delivery won't occur for six months and the buyer has a full right of return. This is an example of:

Premature revenue recognition (Correct answer)
Improper asset valuation
Fictitious revenue
Concealed liabilities

Correct answer: Premature revenue recognition

Recording revenue before delivery and before the right of return expires violates revenue recognition principles and constitutes premature recognition.

Question 193: Which of the following scenarios illustrates the 'pressure' element of the Fraud Triangle in a financial statement fraud context?

An accountant believes everyone inflates expense reports
A CEO must meet Wall Street earnings forecasts to prevent stock options from expiring worthless (Correct answer)
A controller is unaware that manipulating reserves is prohibited
A CFO has sole access to the general ledger system

Correct answer: A CEO must meet Wall Street earnings forecasts to prevent stock options from expiring worthless

Financial pressure on the CEO to meet earnings targets represents the pressure element, creating the motivation necessary for financial statement fraud.

Question 194: When examining a company for financial statement fraud, a forensic accountant discovers that the auditor issued an unqualified opinion despite significant internal control deficiencies. This situation most likely suggests:

The auditor may have failed to detect or report material weaknesses, indicating audit failure (Correct answer)
The internal control deficiencies were immaterial and did not require disclosure
The auditor colluded with management to conceal the fraud
The SEC automatically investigates when unqualified opinions are issued on flawed statements

Correct answer: The auditor may have failed to detect or report material weaknesses, indicating audit failure

An unqualified audit opinion despite material weaknesses suggests the auditor failed in their responsibilities, though collusion cannot be assumed without additional evidence.

Question 195: Which of the following best describes 'mens rea' in the context of fraud?

The harm caused to the victim
The guilty mind or criminal intent required for fraud (Correct answer)
The physical act of committing fraud
The financial gain obtained by the fraudster

Correct answer: The guilty mind or criminal intent required for fraud

Mens rea refers to the criminal intent or guilty mind that must be proven alongside the physical act (actus reus) to establish most fraud offenses.

Question 196: In a lapping scheme, the fraudster typically:

Submits personal expenses as business reimbursements
Creates fictitious employees on the payroll
Uses one customer's payment to cover a previous customer's stolen payment (Correct answer)
Inflates inventory counts to overstate assets

Correct answer: Uses one customer's payment to cover a previous customer's stolen payment

Lapping involves stealing one customer's payment and covering it with a subsequent customer's payment, creating a perpetual cycle.

Question 197: Which practice BEST demonstrates that a board is exercising effective oversight of management-prepared financial information?

Meeting privately with the external auditor without management present (Correct answer)
Accepting financial reports without questions to maintain a cooperative culture
Delegating all financial review to the CFO
Limiting the scope of internal audit to reduce operating costs

Correct answer: Meeting privately with the external auditor without management present

Private (executive) sessions between the audit committee and external auditors without management present allow candid communication about management's integrity and reporting quality.

Question 198: A Certified Fraud Examiner is reviewing a company's vendor files and discovers several red flags of a potential bribery scheme. Which of the following is the STRONGEST indicator of bribery?

A vendor's address is a post office box.
Payments to a vendor have increased dramatically over the last year without a corresponding increase in goods or services. (Correct answer)
A key procurement manager has an unusually close, undisclosed relationship with a specific vendor.
The company has been using the same vendor for over ten years without a competitive bidding process.

Correct answer: Payments to a vendor have increased dramatically over the last year without a corresponding increase in goods or services.

While all options can be red flags, a dramatic increase in payments to a vendor without a justifiable business reason (like more services or goods) is a very strong indicator that the excess money is being funneled for an illicit purpose, such as a kickback or bribe payment.

Question 199: What is 'chain of custody' primarily designed to ensure in a fraud investigation?

That evidence has not been tampered with from collection to courtroom (Correct answer)
That witnesses are available for cross-examination
That hearsay statements are properly documented
That subpoenas are served in the correct legal order

Correct answer: That evidence has not been tampered with from collection to courtroom

Chain of custody is the documented, unbroken sequence of possession and control over evidence to prove it has not been altered, contaminated, or tampered with.

Question 200: Which type of computer fraud involves an employee inserting unauthorized code that skims small amounts from many accounts into a single account?

Trojan horse attack
Round-down scheme (Correct answer)
Salami technique
Logic bomb

Correct answer: Round-down scheme

A round-down scheme (also called a salami attack) involves programming a system to round down fractions of cents from many transactions and accumulate those fractions in a single account.

Question 201: A 'ghost employee' scheme involves:

Paying inflated wages to a real employee in collusion with payroll staff
Falsifying time records for legitimate employees
Adding fictitious employees to payroll and collecting their paychecks (Correct answer)
Misclassifying workers as contractors to reduce payroll taxes

Correct answer: Adding fictitious employees to payroll and collecting their paychecks

Ghost employee schemes involve adding nonexistent workers to payroll and diverting their paychecks to the fraudster.

Question 202: A company is praised for its comprehensive fraud prevention program, which includes a robust code of conduct and strong internal controls. However, a post-fraud analysis reveals that several employees were aware of misconduct but never came forward. Which program element most likely failed?

The annual fraud risk assessment process.
The trust and accessibility of the whistleblower reporting mechanism. (Correct answer)
The segregation of duties within the accounting department.
The process for conducting pre-employment background screening.

Correct answer: The trust and accessibility of the whistleblower reporting mechanism.

A critical component of a fraud prevention program is a safe and trusted way for employees to report suspicions. If employees are aware of fraud but do not report it, it often indicates a failure in the reporting mechanism. This could be due to a lack of awareness of the hotline, a fear of retaliation, or a belief that reports will not be taken seriously.

Question 203: A fraud examiner needs to obtain bank records from a financial institution without tipping off the suspect. Which legal mechanism is most appropriate in a civil investigation?

Search warrant
Grand jury subpoena
Civil subpoena duces tecum (Correct answer)
Consent form signed by the account holder

Correct answer: Civil subpoena duces tecum

A civil subpoena duces tecum compels third-party institutions to produce records in civil proceedings and can be served directly on the bank without notifying the suspect.

Question 204: Which factor most significantly increases the fraud risk associated with journal entries?

Entries made early in the month
Recurring entries posted automatically by the system
Top-side entries made by senior management near period-end (Correct answer)
Entries that are rounded to the nearest dollar

Correct answer: Top-side entries made by senior management near period-end

Top-side journal entries made by management near period-end are a primary vehicle for financial statement fraud and represent a significant fraud risk indicator.

Question 205: Horizontal analysis of financial statements is used to detect financial statement fraud by:

Tracking changes in financial statement line items across multiple periods to identify unusual trends (Correct answer)
Benchmarking a company's ratios against industry peer averages
Analyzing the relationship between gross profit and operating expenses in one period
Comparing each line item to total assets or total revenue within the same period

Correct answer: Tracking changes in financial statement line items across multiple periods to identify unusual trends

Horizontal analysis compares financial data across time periods, helping examiners identify anomalous spikes or drops that may indicate fraudulent manipulation.

Question 206: A company's CEO consistently dismisses the importance of the corporate code of conduct during meetings, often stating, "We need to do whatever it takes to meet our quarterly numbers." This attitude has led middle managers to approve questionable expense reports and ignore inventory control weaknesses. This scenario is a prime example of a failure in what aspect of corporate governance?

Whistleblower protection policy
Audit committee independence
The 'tone at the top' (Correct answer)
Segregation of duties

Correct answer: The 'tone at the top'

The 'tone at the top' refers to the ethical atmosphere created by an organization's leadership. When senior management demonstrates a disregard for ethical standards and internal controls, it creates a culture where such behavior is implicitly condoned, increasing the risk of fraud throughout the organization.

Question 207: Under the Sarbanes-Oxley Act, the CEO and CFO must certify financial statements under which section?

Section 201
Section 404
Section 302 (Correct answer)
Section 301

Correct answer: Section 302

Section 302 of SOX requires the CEO and CFO to personally certify the accuracy of financial reports.

Question 208: An independent director is best described as someone who:

Owns a significant equity stake in the company
Was nominated by the founding family of the corporation
Has served on the board for more than ten years
Has no material relationship with the company outside the directorship (Correct answer)

Correct answer: Has no material relationship with the company outside the directorship

Independence requires the absence of material relationships (financial, personal, or professional) that could compromise a director's objective judgment.

Question 209: Which of the following would MOST likely qualify as 'instrumentalities of a foreign government' under the FCPA?

A privately held company that supplies goods exclusively to the foreign government
A publicly traded foreign company that has government pension funds as minority shareholders
A foreign nonprofit organization that receives partial government grant funding
A government-controlled national oil company whose board is appointed by the ministry of energy (Correct answer)

Correct answer: A government-controlled national oil company whose board is appointed by the ministry of energy

Courts have consistently held that state-owned enterprises controlled by and performing a function of the government qualify as instrumentalities under the FCPA.

Question 210: During a fraud investigation, an examiner discovers that a key witness is also a potential suspect. What is the BEST initial approach?

Immediately confront the witness with the allegations
Interview the witness as a neutral party while preserving the ability to re-interview later (Correct answer)
Exclude the witness from the investigation entirely
Refer the matter to law enforcement before conducting any interview

Correct answer: Interview the witness as a neutral party while preserving the ability to re-interview later

Interviewing a potential witness/suspect neutrally preserves investigative flexibility and avoids tipping off the subject prematurely.

Question 211: Under ASC 606, revenue is recognized when:

Cash is received from the customer
Performance obligations are satisfied (Correct answer)
The invoice is issued to the customer
A contract is signed with the customer

Correct answer: Performance obligations are satisfied

ASC 606 requires revenue recognition when (or as) performance obligations are satisfied by transferring control of promised goods or services to customers.

Question 212: Which of the following is the primary purpose of a risk-based approach (RBA) in AML compliance programs?

To ensure all customers are treated identically regardless of transaction volume
To automate all AML monitoring without human review
To allocate compliance resources proportionally to the level of money laundering risk posed by customers and products (Correct answer)
To eliminate all risk of money laundering at a financial institution

Correct answer: To allocate compliance resources proportionally to the level of money laundering risk posed by customers and products

The risk-based approach focuses enhanced scrutiny and compliance resources on higher-risk customers, products, and geographies rather than applying uniform controls to all.

Question 213: An employee steals a company laptop and then signs a surplus property disposal form to make it appear the laptop was properly scrapped. Which category of asset misappropriation does this represent?

Fraudulent disbursement
Cash larceny
Non-cash asset larceny (Correct answer)
Skimming

Correct answer: Non-cash asset larceny

Theft of physical non-cash assets such as equipment, combined with falsified disposal documentation, falls under the non-cash larceny branch of asset misappropriation.

Question 214: Which type of documentary evidence in a fraud case is most likely to be challenged on authentication grounds?

Printed screenshots of email conversations (Correct answer)
Bank statements produced directly by the financial institution
Audited financial statements with auditor signatures
Original signed contracts held by the victim company

Correct answer: Printed screenshots of email conversations

Printed screenshots are easily manipulated and lack inherent authentication markers, making them more vulnerable to challenges than documents obtained directly from authoritative sources.

Question 215: A fraud examiner is reviewing a company's financial statements and notices a significant increase in gross margin, which is inconsistent with industry trends. Additionally, the days' sales in receivables ratio has increased dramatically. This combination of red flags is most indicative of which financial statement fraud scheme?

Fictitious revenues (Correct answer)
Concealed liabilities and expenses
Improper asset valuation
Improper disclosures

Correct answer: Fictitious revenues

Recording fictitious revenues increases the gross margin because there are no associated costs of goods sold. It also increases the days' sales in receivables ratio because the fake sales result in accounts receivable that are never collected, causing the receivables balance to grow disproportionately to actual sales.

Question 216: Which of the following statements about Benford's Law is CORRECT?

It predicts that each leading digit (1–9) appears with equal frequency in naturally occurring data sets
It predicts that lower leading digits (1, 2, 3) occur more frequently in naturally occurring data sets (Correct answer)
It was developed specifically to detect payroll fraud
It applies only to data sets with more than one million entries

Correct answer: It predicts that lower leading digits (1, 2, 3) occur more frequently in naturally occurring data sets

Benford's Law states that in many naturally occurring numerical data sets, the digit 1 appears as the leading digit about 30% of the time, with frequency decreasing for higher digits.

Question 217: A board that rubber-stamps all management proposals without independent scrutiny is exhibiting:

Board capture (Correct answer)
Effective risk governance
Active stewardship
Sound fiduciary oversight

Correct answer: Board capture

Board capture describes a situation where management effectively controls the board, undermining independent oversight.

Question 218: Which of the following changes in financial ratios is MOST associated with increased risk of revenue fraud?

Rising revenue growth that significantly outpaces industry peers with no clear business driver (Correct answer)
Increasing accounts payable turnover
Decreasing days sales outstanding (DSO) with stable revenue
Stable gross margin with slight revenue decline

Correct answer: Rising revenue growth that significantly outpaces industry peers with no clear business driver

Revenue growth that significantly exceeds industry benchmarks without a clear business explanation is a classic red flag for fictitious revenue recognition or channel stuffing.

Question 219: The Foreign Corrupt Practices Act (FCPA) prohibits U.S. companies from doing which of the following?

Hiring foreign nationals as employees
Bribing foreign government officials to obtain business (Correct answer)
Importing goods from sanctioned countries
Competing with foreign state-owned enterprises

Correct answer: Bribing foreign government officials to obtain business

The FCPA makes it illegal for U.S. persons and companies to bribe foreign government officials to obtain or retain business.

Question 220: According to the false billing scheme,

Employees cause their company to purchase merchandise that the company does not need (Correct answer)
Employees do not cause their company to purchase merchandise that the company does not need
Employees do not cause their company to sale merchandise that the company does not need
Employees cause their company to sale merchandise that the company does not need

Correct answer: Employees cause their company to purchase merchandise that the company does not need

Explanation: A fraudulent billing scheme refers to fraud in which an employee causes their company to pay false invoices or bills for goods or services that were never received or performed. The employee typically creates or approves fraudulent invoices from a shell company or a non-existent vendor and then authorizes payment to that vendor, allowing the employee to collect the payment for themselves.

Question 221: A payroll supervisor adds fictitious employees to the payroll and deposits their paychecks into accounts she controls. What is the most effective preventive control against this scheme?

Requiring dual approval for all vendor payments
Mandatory use of direct deposit for all employees
Independent verification of new employee data against HR records (Correct answer)
Monthly bank reconciliations performed by a senior accountant

Correct answer: Independent verification of new employee data against HR records

Comparing payroll records to HR-authorized employee rosters ensures that every person receiving a paycheck is a legitimate, authorized employee.

Question 222: Which of the following is a characteristic behavioral red flag ('red flag') of an employee committing asset misappropriation?

Consistently completing work assignments ahead of schedule
Refusing to take vacation or cross-train colleagues on their duties (Correct answer)
Frequently arriving at work early and staying late without overtime pay
Volunteering for additional compliance duties

Correct answer: Refusing to take vacation or cross-train colleagues on their duties

Employees who refuse vacations or resist having others learn their duties often do so to prevent the discovery of ongoing fraud schemes.

Question 223: Which of the following is a characteristic of a truthful denial during an interrogation?

Soft, qualified language such as 'I don't think I did'
Avoidance of the subject's own name
Immediate, direct, and specific denial (Correct answer)
Offering unsolicited alternative suspects immediately

Correct answer: Immediate, direct, and specific denial

Truthful denials tend to be spontaneous, direct, and unqualified, whereas deceptive denials are often hedged or delayed.

Question 224: Which doctrine holds that a corporation is criminally liable for crimes committed by its employees acting within the scope of their employment?

Vicarious immunity
Respondeat superior (Correct answer)
Alter ego doctrine
Piercing the corporate veil

Correct answer: Respondeat superior

Respondeat superior ('let the master answer') is the doctrine under which corporations can be held criminally liable for employee misconduct within the scope of employment.

Question 225: Which type of documentary evidence is typically most useful in proving a check tampering scheme?

Original cancelled checks, bank statements, and signature cards (Correct answer)
Payroll registers and W-2 forms
Fixed asset schedules and depreciation records
Vendor contracts and purchase orders

Correct answer: Original cancelled checks, bank statements, and signature cards

Cancelled checks reveal alterations to payee names or amounts, and comparison to signature cards shows unauthorized endorsements or forged signatures.

Question 226: An organization decides to stop offering credit card payments for online sales to eliminate the risk of chargeback fraud. This is an example of which type of fraud risk response?

Risk Transfer
Risk Mitigation
Risk Acceptance
Risk Avoidance (Correct answer)

Correct answer: Risk Avoidance

Risk avoidance is a response strategy where the organization decides to exit or not engage in the activities that give rise to the risk. By ceasing to accept credit card payments, the company is avoiding the associated chargeback fraud risk entirely. Mitigation involves reducing the risk, transfer involves sharing it (like insurance), and acceptance means taking no action.

Question 227: What distinguishes an illegal gratuity from a bribe according to the ACFE's fraud classification?

An illegal gratuity always involves a government employee while bribes involve private parties
An illegal gratuity is given after an official act as a reward rather than to influence a future act (Correct answer)
An illegal gratuity requires a written agreement between the parties
An illegal gratuity involves a smaller dollar amount than a bribe

Correct answer: An illegal gratuity is given after an official act as a reward rather than to influence a future act

An illegal gratuity is provided after an official act as a reward, whereas a bribe is given before or during the act to influence the outcome.

Question 228: What is the key advantage of using data analytics in a proactive fraud prevention program?

It satisfies all regulatory reporting requirements automatically
It detects anomalies and patterns that may indicate fraud before significant losses occur (Correct answer)
It eliminates the need for internal audit staff
It replaces the need for employee background checks

Correct answer: It detects anomalies and patterns that may indicate fraud before significant losses occur

Data analytics continuously monitors transactions for red flags, enabling earlier detection and limiting fraud losses compared to periodic manual reviews.

Question 229: In financial statement fraud, channel stuffing refers to:

Pressuring distributors to accept excess inventory to inflate current-period sales (Correct answer)
Understating liabilities to improve the balance sheet
Recording revenue from future periods in the current period
Creating fictitious sales transactions with fabricated customers

Correct answer: Pressuring distributors to accept excess inventory to inflate current-period sales

Channel stuffing involves shipping excess goods to distributors at period end to inflate reported sales figures.

Question 230: Under the ACFE's occupational fraud classification system, which category includes financial statement fraud?

Embezzlement
Asset misappropriation
Financial statement fraud (Correct answer)
Corruption

Correct answer: Financial statement fraud

The ACFE Occupational Fraud and Abuse Classification System (Fraud Tree) has three primary branches: asset misappropriation, corruption, and financial statement fraud.

Question 231: Which internal control is most effective at preventing a billing scheme involving fictitious vendors?

Mandatory vacation policies
Physical inventory counts
Vendor master file maintenance with independent approval (Correct answer)
Bank reconciliations

Correct answer: Vendor master file maintenance with independent approval

Maintaining a controlled vendor master file with independent approval of new vendors prevents employees from adding fictitious vendors to submit fraudulent invoices.

Question 232: A net worth analysis in a fraud investigation is primarily used to:

Identify unexplained increases in a subject's wealth beyond known income (Correct answer)
Calculate the organization's financial loss from fraud
Assess the market value of seized property
Determine the replacement cost of stolen assets

Correct answer: Identify unexplained increases in a subject's wealth beyond known income

Net worth analysis compares a subject's assets and liabilities over time to identify wealth increases that cannot be explained by legitimate income.

Question 233: Which of the following schemes involves a company recording expenses in one period while deferring associated revenue recognition to a later period to manage earnings?

Timing differences — accelerating expenses (Correct answer)
Cookie jar reserves
Improper asset valuation
Channel stuffing

Correct answer: Timing differences — accelerating expenses

Accelerating expense recognition into the current period while deferring related revenues is a timing difference scheme used to create reserves for future earnings boosts.

Question 234: Which of the following interview approaches is MOST appropriate when a fraud examiner needs to establish rapport with a reluctant witness?

Inform the witness that their answers may be used against them
Start with non-threatening, open-ended questions about the witness's background (Correct answer)
Conduct the interview with multiple examiners present to apply pressure
Begin with accusatory questions to establish authority

Correct answer: Start with non-threatening, open-ended questions about the witness's background

Establishing rapport through open-ended, non-threatening questions encourages reluctant witnesses to share information more freely.

Question 235: Which of the following scenarios most directly represents a failure of the duty of care by a corporate director?

Voting against a merger the director personally dislikes
Disclosing a conflict of interest before a board vote
Approving a major acquisition without reviewing any financial analysis (Correct answer)
Resigning from the board after a strategic disagreement

Correct answer: Approving a major acquisition without reviewing any financial analysis

The duty of care requires directors to make decisions based on adequate information; approving a major transaction without review clearly breaches this duty.

Question 236: When an organization performs a vendor due diligence review as part of its fraud prevention program, what is the PRIMARY concern being addressed?

Confirming that vendors are registered in the correct business jurisdiction
Ensuring vendors comply with the organization's environmental policies
Verifying that vendors carry adequate insurance coverage
Identifying vendors with histories of fraudulent billing, bribery, or criminal conduct (Correct answer)

Correct answer: Identifying vendors with histories of fraudulent billing, bribery, or criminal conduct

Vendor due diligence screens for red flags such as prior fraud convictions, bribery records, or shell company structures that indicate elevated risk of procurement fraud.

Question 237: An employee uses a company-owned delivery truck to run a personal moving business on weekends, keeping all the profits. This is best described as what form of asset misappropriation?

Misuse of non-cash assets (Correct answer)
Corruption
Billing scheme
Inventory theft

Correct answer: Misuse of non-cash assets

This is a classic example of the misuse of non-cash assets. The employee is not stealing the asset itself (the truck), but is using it for personal gain without authorization, which constitutes a form of misappropriation. [11, 23] This differs from outright theft of inventory or creating fraudulent payments.

Question 238: Which type of fraudulent disbursement involves creating payments to fictitious employees on the payroll?

Workers' compensation fraud
Ghost employee scheme (Correct answer)
Pay rate fraud
Commission scheme

Correct answer: Ghost employee scheme

A ghost employee scheme involves adding fictitious employees to the payroll so the fraudster can divert the corresponding paychecks.

Question 239: What is the primary purpose of a grand jury in a federal fraud investigation?

To decide whether probable cause exists to indict a suspect (Correct answer)
To hear appeals from lower court decisions
To determine guilt or innocence at trial
To sentence convicted defendants

Correct answer: To decide whether probable cause exists to indict a suspect

A grand jury reviews evidence presented by prosecutors and determines whether probable cause exists to formally charge (indict) a suspect with a crime.

Question 240: A company's anti-bribery policy prohibits giving gifts to foreign officials but makes an exception for promotional items of nominal value. This exception is MOST consistent with:

The FCPA's affirmative defense for reasonable and bona fide promotional expenditures (Correct answer)
The Foreign Agents Registration Act's disclosure requirements
OECD Anti-Bribery Convention requirements for zero tolerance
The UK Bribery Act's prohibition on all gifts to foreign officials regardless of value

Correct answer: The FCPA's affirmative defense for reasonable and bona fide promotional expenditures

The FCPA provides an affirmative defense for payments that are lawful under the written laws of the foreign country and are reasonable bona fide promotional expenditures.

Question 241: Fraudsters try to influence the choice of a contractor during which phase of the competitive bidding process by limiting the number of competitors from whom bids are sought.

False specification
Submission
Solicitation (Correct answer)
Need recognition

Correct answer: Solicitation

Explanation: Fraudsters attempt to influence the selection of a contractor by restricting the pool of competitors from whom bids are sought during the solicitation phase of the competitive bidding process.

Question 242: Which technique involves walking through a process from beginning to end to identify potential fraud opportunities?

Fraud brainstorming
Process walk-through (Correct answer)
Risk heat mapping
Benchmarking

Correct answer: Process walk-through

A process walk-through traces a transaction from initiation to recording, helping assessors spot control gaps and fraud opportunities at each step.

Question 243: A buyer at a manufacturing company receives cash payments from a supplier in exchange for steering contracts to that supplier. Under the ACFE classification, this is best described as:

Financial statement fraud — revenue manipulation
Asset misappropriation — billing scheme
Corruption — bribery/kickback (Correct answer)
Asset misappropriation — non-cash scheme

Correct answer: Corruption — bribery/kickback

Receiving payments for influencing business decisions on behalf of another party is a corruption scheme (bribery/kickback), not asset misappropriation, under the ACFE fraud tree.

Question 244: Which of the following financial statement fraud schemes would most directly cause gross profit margin to be overstated?

Overstating accounts payable
Failing to record accrued interest expense
Capitalizing SG&A expenses as intangible assets
Understating cost of goods sold (Correct answer)

Correct answer: Understating cost of goods sold

Gross profit margin equals (Sales minus COGS) divided by Sales, so understating COGS directly inflates this metric.

Question 245: A company discovers its subsidiary in a foreign country made improper payments to government officials. The company voluntarily discloses this to the DOJ and SEC. What is the MOST likely outcome compared to non-disclosure?

Automatic immunity from prosecution under safe harbor provisions
Reduced penalties and potential declination of prosecution due to cooperation credit (Correct answer)
Increased scrutiny leading to harsher penalties for self-reporting
No difference because voluntary disclosure does not affect FCPA enforcement outcomes

Correct answer: Reduced penalties and potential declination of prosecution due to cooperation credit

The DOJ and SEC's FCPA Corporate Enforcement Policy provides significant credit—including possible declinations—for companies that voluntarily disclose, cooperate, and remediate.

Question 246: The 'tone at the top' concept in fraud prevention primarily refers to which of the following?

The frequency of board meetings
The number of compliance policies issued
The volume of internal audit communications
Management's attitude and commitment to ethical conduct (Correct answer)

Correct answer: Management's attitude and commitment to ethical conduct

Tone at the top reflects how senior management's ethical behavior and commitment to integrity sets the cultural standard for the entire organization.

Question 247: Which of the following is a common red flag indicating a vendor may be paying bribes to obtain contracts?

The vendor requests payment through a third-party intermediary in a high-risk jurisdiction (Correct answer)
The vendor's prices are significantly below market rates
The vendor frequently wins contracts in highly competitive markets
The vendor has long-standing relationships with the purchasing company

Correct answer: The vendor requests payment through a third-party intermediary in a high-risk jurisdiction

Requests to route payments through third-party intermediaries, especially in high-risk jurisdictions, are classic red flags for bribery and corruption schemes.

Question 248: The 'fraud triangle' theory attributes occupational fraud to three conditions. Which of the following is NOT one of them?

Rationalization
Perceived pressure
Opportunity
Greed (Correct answer)

Correct answer: Greed

The fraud triangle consists of perceived pressure, opportunity, and rationalization—greed is not one of the three elements.

Question 249: Which of the following actions by senior management is most effective in establishing a strong 'tone at the top' that promotes an ethical, anti-fraud culture?

Requiring all employees to complete an annual online ethics training module.
Consistently enforcing anti-fraud policies and taking visible disciplinary action against violators, regardless of their position or seniority. (Correct answer)
Sending a company-wide email once a year condemning fraudulent behavior.
Placing anti-fraud posters in the company breakroom.

Correct answer: Consistently enforcing anti-fraud policies and taking visible disciplinary action against violators, regardless of their position or seniority.

While emails, training, and posters are supportive activities, the most powerful message management can send is through its actions. When employees see that the anti-fraud policies are applied consistently to everyone, from entry-level staff to senior executives, it demonstrates a genuine commitment to an ethical culture. This 'walking the talk' is the core of an effective tone at the top.

Question 250: A CFE notices a suspect's story has inconsistencies between the first and second telling. What is the best next step?

Ignore the inconsistencies and move on
Ask the suspect to repeat the story a third time from a different starting point (Correct answer)
End the interview and escalate to law enforcement
Immediately accuse the suspect of lying

Correct answer: Ask the suspect to repeat the story a third time from a different starting point

Asking the suspect to retell the story from a different point tests memory and often reveals further inconsistencies or admissions.

Question 251: An effective corporate anti-corruption compliance program should include which of the following as a core element?

Outsourcing all compliance functions to external legal counsel
A blanket prohibition on all business entertainment globally regardless of local customs
Restricting business operations to countries with a CPI score above 70
Risk-based due diligence on third parties commensurate with the corruption risk they present (Correct answer)

Correct answer: Risk-based due diligence on third parties commensurate with the corruption risk they present

Risk-based third-party due diligence is a cornerstone of effective anti-corruption programs because third parties are the most common conduit for corrupt payments.

Question 252: A retail company is suspected of concealing liabilities to improve its debt-to-equity ratio. Which of the following actions would be a common way to perpetrate this type of fraud?

Failing to record warranty obligations for products sold (Correct answer)
Capitalizing operating expenses
Creating fictitious sales invoices to non-existent customers
Stuffing distribution channels with more product than can be sold

Correct answer: Failing to record warranty obligations for products sold

Failing to record warranty obligations is a form of concealing liabilities. By not recognizing this future obligation as a liability, the company understates its total liabilities, thereby artificially improving its debt-to-equity ratio and overall financial appearance.

Question 253: What term describes the degree to which management and employees are committed to creating a culture of ethical behavior and fraud awareness?

Tone at the top (Correct answer)
Control environment
Governance framework
Risk appetite

Correct answer: Tone at the top

Tone at the top refers to the ethical climate set by senior leadership, which is a primary determinant of the organization's overall anti-fraud culture.

Question 254: A fraud examiner obtains bank records through a grand jury subpoena. This type of evidence is considered which of the following?

Testimonial evidence
Physical evidence
Demonstrative evidence
Documentary evidence (Correct answer)

Correct answer: Documentary evidence

Bank records, invoices, and other written documents obtained during an investigation are classified as documentary evidence.

Question 255: Which statement about the False Claims Act is accurate?

It allows private citizens to file suit on behalf of the government and share in any recovery (Correct answer)
It only applies to healthcare fraud cases
It imposes criminal penalties exclusively for false tax filings
It was enacted specifically to combat financial statement fraud

Correct answer: It allows private citizens to file suit on behalf of the government and share in any recovery

The False Claims Act's qui tam provisions allow whistleblowers (relators) to sue on the government's behalf and receive a portion of the recovered funds.

Question 256: What does a fraud risk assessment try to do most?

To detect fraudulent activity that has already occurred
To identify areas of the organization that are susceptible to fraud (Correct answer)
To punish employees who engage in fraudulent activity

Correct answer: To identify areas of the organization that are susceptible to fraud

Explanation: The main purpose of a fraud risk assessment is to find places in an organization where fraud could happen. It means looking at the internal control systems, policies, and procedures to stop fraud and determining possible weaknesses and risks.

Question 257: Benford's Law is most useful in fraud detection for analyzing which type of data?

Fixed employee salaries and benefits data
Encrypted transaction records
Random numbers generated by a computer
Naturally occurring financial figures such as invoice amounts or expense reports (Correct answer)

Correct answer: Naturally occurring financial figures such as invoice amounts or expense reports

Benford's Law predicts the frequency distribution of leading digits in naturally occurring numerical data; deviations from this distribution in financial data can signal fabricated numbers.

Question 258: The term 'skimming' in occupational fraud refers to which type of scheme?

Removing cash before it is recorded in the accounting system (Correct answer)
Manipulating bank reconciliations
Inflating reported sales figures
Falsifying vendor invoices

Correct answer: Removing cash before it is recorded in the accounting system

Skimming is an off-book fraud where cash is stolen before it is entered into the accounting records, making it difficult to detect through normal reconciliations.

Question 259: Which of the following represents the clearest distinction between the responsibilities of the board of directors and senior management in the context of fraud risk management?

Management is responsible for hiring external auditors, while the board is responsible for overseeing the internal audit function.
The board is responsible for designing internal controls, while management is responsible for testing their effectiveness.
The board has the ultimate responsibility for fraud risk oversight, while management is responsible for the day-to-day implementation of anti-fraud programs. (Correct answer)
Management is responsible for setting the 'tone at the top,' while the board is responsible for communicating it to employees.

Correct answer: The board has the ultimate responsibility for fraud risk oversight, while management is responsible for the day-to-day implementation of anti-fraud programs.

Corporate governance principles separate the roles of oversight and execution. The board of directors is responsible for overseeing the organization's strategic direction and governance, which includes the oversight of fraud risk management. Senior management, led by the CEO, is tasked with the operational responsibility of designing, implementing, and maintaining the specific anti-fraud programs and internal controls.

Question 260: Which element of the Fraud Triangle refers to a perpetrator's ability to rationalize fraudulent behavior as acceptable?

Opportunity
Rationalization (Correct answer)
Motivation
Pressure

Correct answer: Rationalization

Rationalization is the cognitive process by which a fraudster justifies dishonest acts to themselves, completing the Fraud Triangle.

Question 261: Which of the following is an example of direct evidence in a fraud case?

An analysis proving that the suspect had opportunity to commit fraud
A witness testifying they personally saw the suspect alter a check (Correct answer)
Surveillance footage showing the suspect near the accounting department
Bank records showing unusual transaction patterns

Correct answer: A witness testifying they personally saw the suspect alter a check

Direct evidence proves a fact without requiring any inference, such as eyewitness testimony of the act itself.

Question 262: Which type of fraud involves creating fictitious identities by combining real and fabricated personal information to obtain credit?

Bust-out fraud
Card-not-present fraud
Synthetic identity fraud (Correct answer)
Account takeover fraud

Correct answer: Synthetic identity fraud

Synthetic identity fraud uses a blend of real information (often a Social Security number) combined with fabricated details to create a new fraudulent identity.

Question 263: Which fraud risk factor is MOST associated with management override of internal controls?

High staff turnover in accounting
Poor employee morale
Management's incentive compensation tied to earnings targets (Correct answer)
Lack of employee training

Correct answer: Management's incentive compensation tied to earnings targets

When management compensation is heavily tied to reported earnings, there is strong incentive to override controls to manipulate financial results.

Question 264: A 'shell company' is most commonly used in money laundering schemes to:

Facilitate legitimate cross-border trade transactions
Conceal the true ownership and origin of funds through complex corporate layers (Correct answer)
Provide legitimate payroll services to employees
Obtain government contracts through competitive bidding

Correct answer: Conceal the true ownership and origin of funds through complex corporate layers

Shell companies, which have no real operations, are used to conceal the beneficial ownership of assets and obscure the paper trail of illicit funds.

Question 265: In the Reid Technique, what does the 'positive confrontation' step involve?

Telling the suspect confidently that the investigation has established their involvement (Correct answer)
Offering a reduced sentence in exchange for a confession
Presenting the suspect with physical evidence of guilt
Asking the suspect to explain why they committed the crime

Correct answer: Telling the suspect confidently that the investigation has established their involvement

Positive confrontation is a direct, confident statement that the investigation concludes the suspect's involvement, not a question or threat.

Question 266: Which element is NOT required to prove civil fraud in the United States?

Justifiable reliance by the victim
A material false representation
A criminal conviction of the perpetrator (Correct answer)
Knowledge of falsity or reckless disregard for truth

Correct answer: A criminal conviction of the perpetrator

Civil fraud does not require a criminal conviction; it only requires proof of the core elements by a preponderance of the evidence.

Question 267: Which of the following is a PRIMARY objective of a fraud risk assessment?

Prosecuting perpetrators of fraud
Identifying inherent fraud risks and evaluating controls (Correct answer)
Detecting ongoing fraud schemes
Calculating the financial losses from past frauds

Correct answer: Identifying inherent fraud risks and evaluating controls

A fraud risk assessment aims to identify where fraud could occur and evaluate the effectiveness of existing controls to mitigate those risks.

Question 268: Which remedy allows a court to seize property that is the proceeds of fraud before a civil judgment is entered?

Replevin
Injunction
Attachment (Correct answer)
Subrogation

Correct answer: Attachment

Pre-judgment attachment allows a court to seize or freeze a defendant's property before a final civil judgment to preserve assets for potential recovery.

Question 269: A city council member votes to award a construction contract to a firm after receiving concealed campaign contributions from the firm's owner. This BEST describes which corruption scheme?

Economic extortion by the council member
Conflict of interest with no corrupt intent
Political corruption through improper campaign contributions (Correct answer)
Commercial bribery between private parties

Correct answer: Political corruption through improper campaign contributions

Using concealed campaign contributions to influence an official vote on a government contract constitutes political corruption, a form of public sector bribery.

Question 270: A company capitalizes routine maintenance costs as long-term assets rather than expensing them. This scheme primarily results in:

Overstated net income and understated assets
Understated net income and understated liabilities
Overstated net income and overstated assets (Correct answer)
Understated net income and overstated assets

Correct answer: Overstated net income and overstated assets

Capitalizing expenses that should be expensed defers cost recognition, overstating both current net income and the asset base on the balance sheet.

Question 271: A Certified Fraud Examiner (CFE) obtains a series of original invoices during an investigation. To ensure the invoices are admissible as evidence in a legal proceeding, what is the MOST critical process the CFE must maintain from the moment of collection?

Chain of custody (Correct answer)
Predication log
Evidence corroboration
Document analysis

Correct answer: Chain of custody

The chain of custody is the chronological documentation showing the seizure, custody, control, transfer, analysis, and disposition of evidence. Maintaining a proper chain of custody is paramount to proving the integrity of the evidence and is critical for its admissibility in court. A break in the chain can lead to the evidence being challenged and potentially excluded.

Question 272: What is the primary distinction between a bribe and a facilitating payment under the FCPA?

Facilitating payments must be reported to the SEC while bribes do not
Facilitating payments are made to expedite routine non-discretionary government actions (Correct answer)
Facilitating payments are always made in cash while bribes can be any value
Facilitating payments are paid to private individuals while bribes go to officials

Correct answer: Facilitating payments are made to expedite routine non-discretionary government actions

Facilitating payments, also called grease payments, are made to expedite or secure the performance of routine, non-discretionary governmental actions and are a narrow exception under the FCPA.

Question 273: According to the ACFE, approximately what percentage of occupational frauds are detected by tips?

About 60%
About 33%
About 20%
About 43% (Correct answer)

Correct answer: About 43%

ACFE research consistently shows tips are the most common fraud detection method, accounting for roughly 43% of detected cases.

Question 274: Which ratio is most useful for detecting potential inventory fraud that inflates reported profits?

Gross margin ratio (Correct answer)
Debt-to-equity ratio
Return on equity
Current ratio

Correct answer: Gross margin ratio

An unusually high or fluctuating gross margin ratio can signal inventory overstatement, since inflating inventory reduces cost of goods sold and boosts reported margins.

Question 275: A journal that keeps track of all sales made on credit or cash is:

General journal
Accounts receivable journal (Correct answer)
Disbursement journal
Accounts payable journal

Correct answer: Accounts receivable journal

Explanation: An accounts receivable journal keeps track of all sales made on credit or cash. It records the date, customer name, invoice number, amount of the deal, and any payments made on the account. This information is then used to generate customer statements and track the overall accounts receivable balance.

Question 276: The Caremark standard holds that a board can be liable for fraud losses if it:

Failed to establish any system to monitor legal compliance (Correct answer)
Hired an external auditor who missed fraud indicators
Approved a high-risk business strategy that later failed
Compensated executives with stock options rather than salary

Correct answer: Failed to establish any system to monitor legal compliance

Under the Caremark doctrine, directors face liability if they utterly failed to implement information and reporting systems to detect illegal conduct.

Question 277: Which of the following best describes the 'Ponzi scheme' impact on financial statements?

Expenses are understated because early investors' returns come from later investors' principal
All of the above characterize how Ponzi operators misrepresent financials
Liabilities are understated because investor returns are treated as capital gains
Assets are overstated because investor funds are recorded as operating revenue (Correct answer)

Correct answer: Assets are overstated because investor funds are recorded as operating revenue

Ponzi scheme operators typically misrepresent financial statements by recording investor deposits as revenue, overstating assets and hiding the true liability to investors.

Question 278: An accounts payable clerk creates a vendor in the system using her own home address and submits invoices for services never rendered. This scheme is best classified as:

Shell company scheme (Correct answer)
Personal purchase scheme
Pay-and-return scheme
Pass-through scheme

Correct answer: Shell company scheme

A shell company scheme involves establishing a fictitious vendor entity—often with no real business operations—to submit fraudulent invoices.

Question 279: Which anti-fraud measure most directly addresses the 'rationalization' element of the fraud triangle?

Installing surveillance cameras in financial areas
Implementing segregation of duties
Enforcing a zero-tolerance fraud policy communicated to all employees (Correct answer)
Conducting surprise audits of cash drawers

Correct answer: Enforcing a zero-tolerance fraud policy communicated to all employees

A clearly communicated zero-tolerance policy challenges the rationalizations fraudsters use by making clear that no excuse justifies dishonest behavior.

Question 280: The 'fraud theory' approach to investigating requires the examiner to:

Formulate a hypothesis about how the fraud was committed and test it with evidence (Correct answer)
Begin by assuming the suspect is guilty and work backward
Conduct random audits without a predetermined focus
Interview all employees before reviewing any documents

Correct answer: Formulate a hypothesis about how the fraud was committed and test it with evidence

The fraud theory approach involves developing a hypothesis about the scheme and then systematically gathering evidence to confirm or refute it.

Question 281: According to the principles of a sound fraud risk management program, which of the following is considered a foundational component?

A strong governance structure and a commitment to ethical conduct from senior management. (Correct answer)
A policy of prosecuting every employee found to have committed fraud, regardless of the amount.
A dedicated fraud investigation unit with unlimited resources.
The use of advanced AI-powered fraud detection software.

Correct answer: A strong governance structure and a commitment to ethical conduct from senior management.

An effective fraud risk management program is built upon a strong governance foundation. This includes a clear commitment from the board and senior management, the establishment of clear ethical policies, and assigning specific roles for fraud prevention. Without this 'tone at the top,' even the best controls and software can fail.

Question 282: An audit committee charter should specify all of the following EXCEPT:

Procedures for handling complaints about accounting matters
Daily operational responsibilities of the CFO (Correct answer)
Authority to engage outside advisors
Committee composition and independence requirements

Correct answer: Daily operational responsibilities of the CFO

The CFO's daily operational duties are a management responsibility and are not governed by the audit committee charter.

Question 283: What legal doctrine requires that evidence obtained through illegal means be excluded from trial proceedings?

The Best Evidence Rule
The Parol Evidence Rule
The Fruit of the Poisonous Tree Doctrine
The Exclusionary Rule (Correct answer)

Correct answer: The Exclusionary Rule

The Exclusionary Rule bars the use of evidence obtained in violation of a defendant's constitutional rights, serving as a deterrent against unlawful government conduct.

Question 284: Which organization publishes the Report to the Nations on Occupational Fraud and Abuse?

ACFE (Correct answer)
FBI
AICPA
IIA

Correct answer: ACFE

The Association of Certified Fraud Examiners (ACFE) publishes the Report to the Nations, the primary global study on occupational fraud.

Question 285: A CFE reviewing network logs to detect unauthorized data exfiltration would most likely look for which indicator?

High CPU usage during business hours
Large outbound data transfers to unknown external IP addresses at unusual hours (Correct answer)
Frequent password change requests by IT administrators
Multiple failed login attempts from internal IP addresses

Correct answer: Large outbound data transfers to unknown external IP addresses at unusual hours

Large volumes of outbound data to unknown or unauthorized external destinations, especially during off-hours, are a primary indicator of data exfiltration by an insider threat or attacker.

Question 286: When interviewing a subject who invokes their Fifth Amendment right against self-incrimination in an internal investigation, the fraud examiner should:

Continue questioning on unrelated topics while respecting the invocation
Consult legal counsel and document the invocation (Correct answer)
Cease all questioning immediately and close the investigation
Threaten termination to compel the subject to answer

Correct answer: Consult legal counsel and document the invocation

Consulting legal counsel and documenting the invocation is the appropriate response to protect the investigation and the organization's legal position.

Question 287: Which of the following would be considered a 'related party transaction' red flag in a financial statement fraud investigation?

Purchasing supplies from an unrelated vendor at market rates
Sales to a company partially owned by the CEO at above-market prices (Correct answer)
Issuing stock options to employees at fair market value
Obtaining a bank loan at the prevailing interest rate

Correct answer: Sales to a company partially owned by the CEO at above-market prices

Sales to a related party at inflated prices can be used to fabricate revenue, making related party transactions a significant red flag for financial statement fraud.

Question 288: Which board committee is primarily responsible for overseeing the internal audit function and financial reporting integrity?

Compensation committee
Audit committee (Correct answer)
Risk committee
Nominating committee

Correct answer: Audit committee

The audit committee oversees internal audit, external audit relationships, and financial reporting to ensure integrity.

Question 289: Which of the following best describes a 'lapping' scheme in accounts receivable?

Inflating invoice amounts before posting to the ledger
Creating fictitious customer accounts to divert refunds
Stealing a customer payment and covering it with a subsequent customer's payment (Correct answer)
Writing off customer balances after pocketing cash

Correct answer: Stealing a customer payment and covering it with a subsequent customer's payment

Lapping involves stealing one customer's payment and then using a later customer's payment to cover the first theft, creating a rolling shortage.

Question 290: Which of the following best describes 'channel stuffing' as a financial statement fraud technique?

Recognizing revenue from consignment sales before goods are sold
Delaying the recording of returned merchandise to overstate revenue
Pressuring distributors to accept excess inventory to boost reported sales (Correct answer)
Inflating inventory by recording fictitious goods in transit

Correct answer: Pressuring distributors to accept excess inventory to boost reported sales

Channel stuffing involves pressuring distributors or customers to accept more inventory than they need, artificially inflating sales figures.

Question 291: An external auditor is examining a manufacturing company's financial statements. Which of the following findings would be the STRONGEST indicator of improper asset valuation?

Fixed assets are recorded at values significantly higher than their current market appraisal, with minimal accumulated depreciation. (Correct answer)
The company has a large number of complex related-party transactions that are not clearly described in the footnotes.
There has been a significant increase in the allowance for doubtful accounts.
The company changed its inventory valuation method from LIFO to FIFO during the year.

Correct answer: Fixed assets are recorded at values significantly higher than their current market appraisal, with minimal accumulated depreciation.

Recording fixed assets at values well above their market appraisal and applying minimal depreciation is a direct method of inflating asset values on the balance sheet. This overstates the company's net worth and can mislead investors and creditors about its true financial health.

Question 292: Which fraud scheme involves an employee submitting the same legitimate expense more than once for reimbursement?

Multiple reimbursement scheme (Correct answer)
Personal purchase scheme
Fictitious expense scheme
Overstated expense scheme

Correct answer: Multiple reimbursement scheme

A multiple reimbursement scheme occurs when an employee submits duplicate copies of the same legitimate receipt to receive double (or more) reimbursement.

Question 293: An employee of a large corporation is responsible for selecting a new software vendor. A salesperson from one of the bidding companies offers the employee's son a full scholarship to a prestigious university. In return, the employee ensures that the salesperson's company is awarded the multi-million dollar contract. This is an example of:

Commercial Bribery (Correct answer)
Official Bribery
Illegal Gratuity
Economic Extortion

Correct answer: Commercial Bribery

Commercial bribery involves the corruption of a private individual to gain a commercial or business advantage. In this scenario, an employee of a private company accepted something of value that influenced their decision in a business transaction, which is the definition of commercial bribery.

Question 294: A company implements continuous monitoring software that flags all journal entries posted after business hours. This is an example of which type of control?

Corrective control
Preventive control
Detective control (Correct answer)
Directive control

Correct answer: Detective control

Flagging unusual journal entries is a detective control because it identifies anomalies after they occur rather than stopping them beforehand.

Question 295: Under which evidentiary rule would a fraud examiner's interview notes most likely be protected from opposing counsel's discovery in a U.S. civil case?

Hearsay rule
Attorney-client privilege
Work product doctrine (Correct answer)
Best evidence rule

Correct answer: Work product doctrine

The work product doctrine protects documents and notes prepared by or at the direction of an attorney in anticipation of litigation from opposing discovery.

Question 296: A cash register operator voids a transaction after a customer has paid and then pockets the cash. This scheme is most accurately described as:

Cash larceny through forced balancing
Skimming via false voids (Correct answer)
Refund fraud
Register disbursement scheme

Correct answer: Skimming via false voids

Recording a false void after cash is received removes the sale from the register tape, allowing the employee to steal the cash while the records appear balanced.

Question 297: An organization discovers that its anti-fraud controls failed to prevent a $500,000 embezzlement. Which step best improves the control environment going forward?

Publish the fraud case details company-wide
Prosecute the perpetrator to signal zero tolerance
Conduct a root-cause analysis to identify control gaps and remediate them (Correct answer)
Increase the external audit frequency

Correct answer: Conduct a root-cause analysis to identify control gaps and remediate them

Root-cause analysis identifies the specific control weaknesses that allowed the fraud, enabling targeted remediation to prevent recurrence.

Question 298: A fraud examiner reviewing contracts notices a vendor consistently wins bids by exactly 1% below the next lowest competitor. This pattern MOST suggests:

The vendor is using aggressive but legal pricing strategies
The vendor has more efficient operations than its competitors
The winning vendor has access to competitors' confidential bid information through a corrupt insider (Correct answer)
The procurement process is functioning as intended through fair competition

Correct answer: The winning vendor has access to competitors' confidential bid information through a corrupt insider

Consistently winning by a narrow margin that closely tracks competitors' bids strongly suggests bid leakage—an insider is sharing competitor pricing with the winning vendor.

Question 299: An employee uses a company credit card to purchase personal electronics and then submits the expense report listing the items as 'office supplies.' This is best classified as:

Overstated expense scheme
Fictitious expense reimbursement
Mischaracterized expense scheme
Personal purchase scheme using company funds (Correct answer)

Correct answer: Personal purchase scheme using company funds

A personal purchase scheme involves using a company-issued payment method to buy items for personal benefit, regardless of how it is labeled on the expense report.

Question 300: Which of the following is the most common method used to overstate inventory in a financial statement fraud scheme?

Understating the LIFO reserve
Recording fictitious inventory at inflated prices
Delaying the write-off of obsolete inventory
Both A and B (Correct answer)

Correct answer: Both A and B

Both delaying obsolescence write-offs and recording fictitious inventory at inflated prices are common techniques used to overstate inventory balances.

Question 301: When designing a fraud risk assessment, which factor should be evaluated to determine inherent fraud risk?

The likelihood and potential impact of various fraud schemes absent controls (Correct answer)
The number of employees in each department
The organization's external audit opinion from the prior year
The strength of existing controls in each business area

Correct answer: The likelihood and potential impact of various fraud schemes absent controls

Inherent risk is assessed before considering controls — it reflects the raw exposure to each fraud scheme based on likelihood and magnitude.

Question 302: During a fraud examination of a construction company that uses the percentage-of-completion method for revenue recognition, a fraud examiner discovers that management has been manipulating the estimated costs to complete long-term projects. What is the most likely fraudulent outcome of this manipulation?

Concealment of expenses
Understatement of liabilities
Premature revenue recognition (Correct answer)
Overstatement of inventory

Correct answer: Premature revenue recognition

By artificially lowering the estimated costs to complete a project, management can inflate the calculated percentage of completion. This leads to recognizing a larger portion of the total contract revenue in the current period than is actually warranted, which is a form of premature revenue recognition.

Question 303: The term 'beneficial owner' in AML compliance refers to:

The natural person who ultimately owns or controls a legal entity or account (Correct answer)
The trustee of a legal trust arrangement
The registered agent of a corporation
The compliance officer responsible for AML oversight

Correct answer: The natural person who ultimately owns or controls a legal entity or account

A beneficial owner is the natural person who ultimately owns or controls an entity, or on whose behalf a transaction is conducted, regardless of who appears on official documents.

Question 304: Which of the following is the ACFE's recommended first step when a fraud examiner suspects a bribery scheme but lacks direct evidence?

Immediately notify law enforcement and suspend the suspect
Interview the suspected employee to obtain a confession
Announce an internal audit to deter further corrupt acts
Conduct a detailed lifestyle analysis of suspected employees (Correct answer)

Correct answer: Conduct a detailed lifestyle analysis of suspected employees

Lifestyle analysis—comparing known income to observed spending and assets—can reveal unexplained wealth that suggests undisclosed bribery income without tipping off the suspect.

Question 305: Which of the following is the MOST significant risk factor for financial statement fraud according to the fraud triangle?

Frequent turnover in the accounting department
Lack of written accounting policies
High pressure on management to meet earnings targets combined with weak internal controls (Correct answer)
Complexity of the company's product offerings

Correct answer: High pressure on management to meet earnings targets combined with weak internal controls

The fraud triangle requires pressure, opportunity, and rationalization — intense earnings pressure combined with weak controls addresses two of the three elements simultaneously.

Question 306: Which of the following elements must be proven to establish a violation of the FCPA's anti-bribery provisions?

A written agreement between the payer and the foreign official
A payment or offer of payment to a foreign official to obtain or retain business (Correct answer)
Evidence that the payment was recorded in the company's financial statements
Proof that the foreign official actually took the desired action after receiving payment

Correct answer: A payment or offer of payment to a foreign official to obtain or retain business

The FCPA requires proof of a payment or offer to a foreign official with corrupt intent to obtain or retain business; the official's follow-through action is not required.

Question 307: Under the FCPA's internal controls provision, which type of company is subject to the requirement?

Any company incorporated in the United States
Any US company operating in foreign countries regardless of SEC registration
Only companies with revenues exceeding $1 billion annually
Issuers whose securities are registered with the SEC or required to file reports with the SEC (Correct answer)

Correct answer: Issuers whose securities are registered with the SEC or required to file reports with the SEC

The FCPA's internal controls provisions apply to 'issuers,' meaning companies whose securities are registered under or required to file reports with the SEC.

Question 308: Which law requires U.S. companies to maintain accurate books and records and have adequate internal controls, regardless of whether bribery occurs?

Foreign Corrupt Practices Act (Correct answer)
Dodd-Frank Act
Bank Secrecy Act
Sarbanes-Oxley Act Section 404

Correct answer: Foreign Corrupt Practices Act

The FCPA's accounting provisions require companies to keep accurate books and records and maintain a system of internal accounting controls, independently of its anti-bribery provisions.

Question 309: The 'cookie jar reserve' technique involves a company:

Using actuarial reserves to manipulate pension expense
Overstating reserves in good years and releasing them in bad years to smooth earnings (Correct answer)
Creating fictitious reserve accounts to hide embezzled funds
Understating reserves in good years and overstating them in bad years to smooth earnings

Correct answer: Overstating reserves in good years and releasing them in bad years to smooth earnings

Cookie jar reserves involve building up excess reserves during profitable periods and releasing them during poor periods to report artificially steady earnings.

Question 310: Which interview technique involves asking about hypothetical third parties to reduce a suspect's embarrassment and encourage admission?

Theme development
Minimization
Third-party projection (Correct answer)
Direct accusation

Correct answer: Third-party projection

Third-party projection uses statements like 'some people in similar situations have done X' to distance the suspect from shame and open dialogue.

CFE - Certified Fraud Examiner

The CFE exam, administered by the ACFE, certifies professionals in fraud prevention, detection, and investigation across three sections covering fraud schemes, investigations, and deterrence.

310

Questions

390 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds