Conducting Investigations Flashcards
7 cards from real CFE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Conducting Investigations flashcards as text
During a fraud investigation, an examiner discovers that a key witness is also a potential suspect. What is the BEST initial approach?
Answer: Interview the witness as a neutral party while preserving the ability to re-interview later
Interviewing a potential witness/suspect neutrally preserves investigative flexibility and avoids tipping off the subject prematurely.
Which type of evidence is considered MOST reliable in a fraud investigation because it is created contemporaneously with the events?
Answer: Documentary evidence
Documentary evidence created at the time of the events is generally considered most reliable because it reflects real-time records rather than after-the-fact recollections.
A fraud examiner is conducting surveillance on a suspect. Which activity would MOST likely require prior legal authorization?
Answer: Recording conversations in a private office without consent
Recording private conversations without consent typically requires legal authorization under federal and state wiretapping laws.
When an investigation reveals evidence of criminal activity, the fraud examiner should PRIMARILY:
Answer: Report findings to the appropriate level of management or legal counsel
The fraud examiner should report criminal evidence to management or legal counsel, who will determine whether to involve law enforcement.
Which technique is MOST effective for detecting fictitious vendor fraud in a company's accounts payable system?
Answer: Matching vendor addresses against employee addresses
Fictitious vendor fraud often involves vendors using the same address as an employee, making address matching a key detection technique.
During a computer forensic examination, the FIRST step an examiner should take upon receiving digital evidence is to:
Answer: Create a forensic image/bit-for-bit copy of the media
Creating a forensic bit-for-bit copy preserves the integrity of the original evidence while allowing analysis to proceed on the copy.
An employee reports potential fraud to the fraud examiner but requests anonymity. The examiner should FIRST:
Answer: Accept the tip and assess its credibility before taking further action
Anonymous tips should be accepted and evaluated for credibility; many valid fraud investigations begin with anonymous reports.