Certified Fraud Specialist (CFS) Exam — Questions and Answers

Question 1: Which of the following BEST describes the relationship between fraud risk assessments and internal controls?

Internal controls are designed before fraud risks are identified
Internal controls replace the need for fraud risk assessments
Fraud risk assessments are performed only after internal controls fail
Fraud risk assessments identify where controls are needed; controls are the response (Correct answer)

Correct answer: Fraud risk assessments identify where controls are needed; controls are the response

The fraud risk assessment identifies vulnerabilities and schemes, while internal controls are the mechanisms designed and implemented in response to address those identified risks.

Question 2: Which of the following best describes the concept of 'chain of custody' in fraud investigations?

The hierarchy of supervisors who approved the investigation
The chain of command for reporting findings
The order in which witnesses are interviewed
The documented sequence of possession and control of evidence (Correct answer)

Correct answer: The documented sequence of possession and control of evidence

Chain of custody documents who collected, handled, transferred, and stored evidence to ensure its integrity and admissibility.

Question 3: What is 'strategic use of evidence' (SUE) in the context of investigative interviewing?

Presenting all evidence at the start to overwhelm the subject
Destroying irrelevant evidence before the interview
Using forged evidence to test witness reactions
Withholding evidence and revealing it strategically to maximize diagnostic value (Correct answer)

Correct answer: Withholding evidence and revealing it strategically to maximize diagnostic value

SUE involves withholding known evidence and revealing it at strategic points to assess whether the subject's account is consistent with it.

Question 4: An investigator is conducting a net worth analysis on a fraud suspect. What does a significant unexplained increase in net worth suggest?

Legitimate investment success
Inheritance from family members
Normal salary progression
Possible undisclosed income from fraud proceeds (Correct answer)

Correct answer: Possible undisclosed income from fraud proceeds

Unexplained net worth increases that exceed known income sources are a classic indicator of concealed fraud proceeds.

Question 5: How does digital forensics & cyber fraud contribute to professional excellence in CFS certification?

It only matters during certification exams
It benefits organizations but not individual practitioners
It has no measurable impact on practice
It enhances competency, improves outcomes, and supports continuous professional growth (Correct answer)

Correct answer: It enhances competency, improves outcomes, and supports continuous professional growth

Digital Forensics & Cyber Fraud is integral to CFS professional excellence, directly enhancing competency and driving measurable improvement in practice outcomes.

Question 6: A company conducts physical inventory counts without advance notice to the warehouse team. This is an example of:

A detective surprise procedure (Correct answer)
A corrective control
An IT general control
A preventive access control

Correct answer: A detective surprise procedure

Unannounced inventory counts detect inventory theft or misrepresentation that employees cannot conceal without prior warning.

Question 7: Which of the following best describes whistleblower protection laws?

They protect employees reporting wrongdoing. (Correct answer)
They restrict employee speech.
They only apply to government employees.
They protect employers from lawsuits.

Correct answer: They protect employees reporting wrongdoing.

Whistleblower protection laws are designed to safeguard employees who report illegal or unethical activities within an organization. These laws prevent retaliation, such as demotion, termination, or harassment, ensuring individuals can expose wrongdoing without fear of adverse consequences. This encourages transparency and accountability by protecting those who act in the public interest.

Question 8: A civil lawsuit filed under the False Claims Act that is initiated by a private citizen on behalf of the government is called a:

Writ of mandamus
Qui tam action (Correct answer)
Declaratory judgment action
Class action

Correct answer: Qui tam action

Qui tam actions allow private citizens (relators) to sue on the government's behalf under the False Claims Act and share in any recovery.

Question 9: Which type of fraud involves an executive manipulating stock prices by misrepresenting the company's financial health?

Asset misappropriation
Healthcare fraud
Insider trading combined with financial statement fraud (Correct answer)
Payroll fraud

Correct answer: Insider trading combined with financial statement fraud

Executives who manipulate financial statements to inflate stock prices and then trade on that misinformation commit both financial statement fraud and insider trading.

Question 10: What is a common method used by fraudsters to conceal asset misappropriation?

Reporting extra hours worked.
Refusing to sign expense reports.
Recording fake sales to inflate revenue.
Creating fictitious vendors or invoices. (Correct answer)

Correct answer: Creating fictitious vendors or invoices.

Creating fictitious vendors or invoices is a common method fraudsters use to conceal asset misappropriation, particularly in schemes like false billing or procurement fraud. By generating fake documentation for goods or services never received, they can authorize payments that are then diverted for personal gain. This method makes it appear as though legitimate business expenses are being paid, masking the theft of company funds.

Question 11: Under the Corporate Transparency Act (CTA), most small US corporations and LLCs are required to report beneficial ownership information to:

The SEC
State banking regulators
The IRS
FinCEN (Correct answer)

Correct answer: FinCEN

The Corporate Transparency Act requires covered companies to file beneficial ownership information reports directly with FinCEN to combat shell company abuse.

Question 12: Under FACTA, consumers are entitled to place an initial fraud alert on their credit file, which remains active for:

1 year (Correct answer)
90 days
30 days
7 years

Correct answer: 1 year

FACTA as amended by the Economic Growth Act provides that an initial fraud alert remains on a consumer's credit file for one year.

Question 13: A company implements mandatory job rotation for employees who handle cash. This control primarily addresses which fraud risk factor?

Pressure
Opportunity (Correct answer)
Rationalization
Concealment

Correct answer: Opportunity

Job rotation limits continuous access to assets and records, reducing the opportunity for sustained fraud.

Question 14: In the context of fraud risk assessments, 'inherent risk' refers to:

The risk of internal auditors failing to detect fraud
The risk level after all controls are applied
The risk inherited from a predecessor organization
The fraud risk that exists in the absence of any controls (Correct answer)

Correct answer: The fraud risk that exists in the absence of any controls

Inherent risk is the raw exposure to fraud that exists in a process or area before considering the effect of any preventive or detective controls.

Question 15: A business email compromise (BEC) scheme typically involves which initial step before executing a fraudulent wire transfer?

Conducting a DDoS attack to distract IT personnel
Deploying keyloggers on accounting department workstations
Installing ransomware on the target's servers
Gaining unauthorized access to or spoofing a trusted executive's email account (Correct answer)

Correct answer: Gaining unauthorized access to or spoofing a trusted executive's email account

BEC schemes typically begin with compromising or impersonating a high-level executive's email to issue fraudulent payment instructions that appear legitimate to employees.

Question 16: Which regulatory body oversees securities markets in the U.S.?

Securities and Exchange Commission (SEC). (Correct answer)
Occupational Safety and Health Administration.
Federal Trade Commission.
Environmental Protection Agency.

Correct answer: Securities and Exchange Commission (SEC).

The Securities and Exchange Commission (SEC) is the primary regulatory body that oversees securities markets in the U.S. Its mission is to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation. The SEC achieves this by enforcing federal securities laws, requiring public companies to disclose financial information, and regulating market participants.

Question 17: In the COSO ERM framework, which component specifically addresses the identification of potential events that could affect an organization's objectives?

Objective Setting
Control Activities
Event Identification (Correct answer)
Risk Response

Correct answer: Event Identification

Event Identification is the COSO ERM component where management identifies internal and external events that may affect the organization, distinguishing between risks and opportunities.

Question 18: In the context of fraud interviews, what is 'statement validity analysis' (SVA) primarily used to assess?

The credibility of a witness's verbal statement using linguistic and content criteria (Correct answer)
The validity of documentary evidence supporting a claim
Whether financial statements are GAAP-compliant
Whether an interview was conducted within legal guidelines

Correct answer: The credibility of a witness's verbal statement using linguistic and content criteria

SVA, including Criteria-Based Content Analysis (CBCA), evaluates linguistic features of statements to assess their credibility.

Question 19: Which of the following is an example of integration, the final stage of money laundering?

Wiring funds through a series of shell companies in offshore jurisdictions
Depositing drug cash in $8,000 increments at multiple bank branches
Purchasing a luxury hotel with laundered funds and collecting legitimate rental income (Correct answer)
Exchanging US dollars for foreign currency at unregulated exchange houses

Correct answer: Purchasing a luxury hotel with laundered funds and collecting legitimate rental income

Integration involves reinvesting laundered funds into legitimate economic activities — such as real estate — so that proceeds appear to be lawful business income.

Question 20: The legal principle that prevents prosecutors from trying a defendant twice for the same offense is known as:

Statute of limitations
Collateral estoppel
Res judicata
Double jeopardy (Correct answer)

Correct answer: Double jeopardy

The Double Jeopardy Clause of the Fifth Amendment prohibits a second prosecution for the same offense after acquittal or conviction.

Question 21: Under the Bank Secrecy Act, financial institutions must file a Currency Transaction Report (CTR) for cash transactions exceeding:

$5,000
$25,000
$7,500
$10,000 (Correct answer)

Correct answer: $10,000

The BSA requires filing a CTR for any cash transaction exceeding $10,000 in a single business day.

Question 22: Which fraud detection method involves comparing employee addresses against vendor addresses in the system?

Benford's Law
Horizontal analysis
Data matching (Correct answer)
Net worth analysis

Correct answer: Data matching

Data matching cross-references records to identify conflicts of interest, such as employees operating undisclosed vendor companies.

Question 23: Which red flag is MOST associated with a staged slip-and-fall claim at a retail store?

Claimant has no prior injury history
Incident occurs near closing time with few witnesses (Correct answer)
Medical treatment begins within 24 hours
Claimant reports the incident immediately

Correct answer: Incident occurs near closing time with few witnesses

Staged slip-and-fall incidents often occur when witness presence is minimal, such as near closing time.

Question 24: During a fraud interview, the examiner presents a document that contradicts the witness's statement. The witness immediately changes their story entirely. What should the examiner do?

Accept the new story since it now matches the evidence
Destroy the original statement to avoid confusion
Note the inconsistency, probe why the account changed, and assess credibility (Correct answer)
End the interview and refer the matter to law enforcement

Correct answer: Note the inconsistency, probe why the account changed, and assess credibility

Sudden account changes when confronted with evidence require probing to understand whether the change reflects new recollection or evasion.

Question 25: In the context of cyber fraud, 'credential stuffing' attacks rely on which fundamental vulnerability?

Lack of HTTPS encryption on login pages
Weak encryption algorithms used by websites to store passwords
SQL injection vulnerabilities in web application login forms
Users reusing the same username/password combinations across multiple websites (Correct answer)

Correct answer: Users reusing the same username/password combinations across multiple websites

Credential stuffing automates testing of previously breached username/password pairs against other services, exploiting the widespread practice of password reuse across multiple accounts.

Question 26: Which analytical technique flags transactions that fall just below an approval threshold repeatedly?

Benford's Law analysis
Regression analysis
Threshold circumvention detection (Correct answer)
Ratio analysis

Correct answer: Threshold circumvention detection

Threshold circumvention detection identifies patterns where amounts cluster just below approval limits, a common fraud indicator.

Question 27: What does the term 'round-tripping' refer to in the context of financial fraud?

Cycling cash through multiple shell companies
Reversing journal entries at period end
Wire transfers sent and returned to the same account
A company selling assets to a counterparty and buying them back to inflate revenue (Correct answer)

Correct answer: A company selling assets to a counterparty and buying them back to inflate revenue

Round-tripping involves two companies exchanging assets or cash with no economic substance, artificially inflating each other's revenue.

Question 28: An employee who reports suspected fraud internally but is then terminated may have a retaliation claim under which SOX provision?

Section 302
Section 404
Section 806 (Correct answer)
Section 1107

Correct answer: Section 806

SOX Section 806 protects employees of publicly traded companies who report suspected securities fraud from retaliation.

Question 29: What is the 'funnel technique' in witness interviewing?

Recording the interview without the witness's knowledge
Using multiple interviewers to question one witness simultaneously
Starting with broad open-ended questions and progressively narrowing to specific topics (Correct answer)
Beginning with specific accusations before establishing rapport

Correct answer: Starting with broad open-ended questions and progressively narrowing to specific topics

The funnel technique moves from broad open questions to progressively specific probes to gather comprehensive information efficiently.

Question 30: Which of the following best describes a 'skimming' attack used for identity theft?

Creating fake charity websites to collect donation information
Intercepting mail to obtain financial statements
Capturing card data via a hidden device placed on legitimate payment terminals (Correct answer)
Sending bulk spam emails to harvest credentials

Correct answer: Capturing card data via a hidden device placed on legitimate payment terminals

Skimming involves attaching a covert device to ATMs, gas pumps, or point-of-sale terminals that captures magnetic stripe data and PINs from unsuspecting cardholders.

Question 31: Which scheme involves an employee stealing incoming customer payments before they are recorded?

Teeming
Skimming (Correct answer)
Kiting
Lapping

Correct answer: Skimming

Skimming is the theft of cash before it is entered into the accounting system, making it one of the hardest schemes to detect.

Question 32: When assessing the impact of a potential fraud scheme, which factor should be considered BEYOND direct financial loss?

Reputational damage, regulatory penalties, and operational disruption (Correct answer)
The geographic location of the organization's headquarters
The educational background of potential perpetrators
The number of years the organization has been in business

Correct answer: Reputational damage, regulatory penalties, and operational disruption

Comprehensive impact assessment must consider reputational harm, regulatory sanctions, and business disruption in addition to the direct monetary loss from fraud.

Question 33: Which law primarily governs financial fraud and securities violations in the U.S.?

The Clean Air Act.
The Patriot Act.
Sarbanes-Oxley Act. (Correct answer)
The Fair Labor Standards Act.

Correct answer: Sarbanes-Oxley Act.

The Sarbanes-Oxley Act (SOX) of 2002 was enacted in response to major corporate accounting scandals to protect investors. It primarily governs financial fraud and securities violations in the U.S. by imposing stringent requirements on public companies for financial reporting, corporate governance, and auditor independence, aiming to improve the accuracy and reliability of financial disclosures.

Question 34: A fraud examiner conducting an asset search discovers property held in a spouse's name. The examiner should:

Document the asset and investigate whether it represents concealed fraud proceeds (Correct answer)
Report the spouse as a co-conspirator without further investigation
Immediately freeze the asset pending investigation
Disregard assets not directly in the suspect's name

Correct answer: Document the asset and investigate whether it represents concealed fraud proceeds

Assets held by family members may represent attempts to conceal fraud proceeds; the examiner must document and investigate the connection.

Question 35: Which federal statute prohibits wire fraud and requires use of wire, radio, or television communications in furtherance of a scheme to defraud?

18 U.S.C. § 1346
18 U.S.C. § 1341
18 U.S.C. § 1348
18 U.S.C. § 1343 (Correct answer)

Correct answer: 18 U.S.C. § 1343

18 U.S.C. § 1343 is the wire fraud statute, which parallels mail fraud but applies to electronic and wire communications.

Question 36: A customer wires $50,000 to a high-risk jurisdiction, then immediately wires equivalent funds back to a different account in the US. This pattern most likely indicates:

Round-tripping to create the appearance of foreign-source income (Correct answer)
Normal correspondent banking activity
A currency arbitrage strategy
Legitimate foreign investment activity

Correct answer: Round-tripping to create the appearance of foreign-source income

Round-tripping involves sending funds abroad and returning them to disguise domestic illicit proceeds as foreign investment income.

Question 37: Under the Dodd-Frank Act, the SEC Whistleblower Program awards qualifying whistleblowers what percentage of sanctions collected?

1–5%
10–30% (Correct answer)
31–50%
51–75%

Correct answer: 10–30%

The SEC Whistleblower Program awards qualifying individuals between 10% and 30% of monetary sanctions exceeding $1 million collected in enforcement actions.

Question 38: Under professional ethics standards, when should a fraud investigator withdraw from an engagement?

When a conflict of interest is discovered that cannot be mitigated (Correct answer)
When the client disagrees with preliminary findings
When the investigation becomes complex and time-consuming
When the estimated fraud loss exceeds the investigator's experience level

Correct answer: When a conflict of interest is discovered that cannot be mitigated

An investigator must withdraw when an unresolvable conflict of interest exists that would impair independence or objectivity.

Question 39: Which financial document summarizes a company’s financial position at a specific point in time?

Annual report.
Income statement.
Balance sheet. (Correct answer)
Cash flow statement.

Correct answer: Balance sheet.

The balance sheet is a fundamental financial document that provides a snapshot of a company's financial position at a specific point in time. It details the company's assets (what it owns), liabilities (what it owes), and owner's equity (the residual value belonging to its owners). This statement offers a clear picture of the company's financial health and solvency on a particular date.

Question 40: What is a key principle of fraud risk assessment frameworks in Certified Fraud Specialist practice?

Avoiding all standardized approaches
Relying solely on personal experience
Applying structured methodologies based on evidence and best practices (Correct answer)
Minimizing documentation requirements

Correct answer: Applying structured methodologies based on evidence and best practices

Fraud Risk Assessment Frameworks in Certified Fraud Specialist practice requires applying structured, evidence-based methodologies while adapting to specific professional contexts.

Question 41: Which document best supports detection of fictitious employees in a payroll fraud scheme?

HR personnel files with verified I-9 forms (Correct answer)
Vendor invoices
Fixed asset register
Bank reconciliations

Correct answer: HR personnel files with verified I-9 forms

Verifying personnel files and I-9 documentation confirms that all employees on payroll are legitimate, real individuals.

Question 42: A key risk indicator (KRI) for accounts payable fraud would most likely be:

Rising inventory turnover ratios
Growing number of customer returns
Declining days sales outstanding
Increasing number of new vendors with P.O. box addresses only (Correct answer)

Correct answer: Increasing number of new vendors with P.O. box addresses only

Vendors with only P.O. box addresses and no physical location are a red flag for fictitious vendor schemes in accounts payable.

Question 43: In the PEACE model of interviewing, what does the letter 'E' (second E) stand for?

Explanation
Engagement
Evaluation (Correct answer)
Evidence

Correct answer: Evaluation

In the PEACE model, the second E stands for Evaluation, where the interviewer assesses the account obtained against known facts.

Question 44: Which ethical principle requires a fraud investigator to maintain competence in the methods and tools used during an investigation?

Confidentiality
Due professional care (Correct answer)
Independence
Objectivity

Correct answer: Due professional care

Due professional care requires investigators to possess the knowledge, skills, and diligence necessary to perform their work competently.

Question 45: During an investigation, an employee volunteers information implicating a supervisor in fraud. The investigator should FIRST:

Discontinue the investigation pending legal review
Inform the supervisor that they are under investigation
Document the information and evaluate its credibility before taking further action (Correct answer)
Immediately report the supervisor to law enforcement

Correct answer: Document the information and evaluate its credibility before taking further action

Volunteered information must be documented and assessed for reliability and corroboration before it influences investigative decisions or actions.

Question 46: The term 'trier of fact' in the context of expert testimony refers to:

The appellate court that reviews the trial record
The judge in all cases, whether bench or jury trial
The lead attorney who evaluates the expert's report
The jury in a jury trial, or the judge in a bench trial (Correct answer)

Correct answer: The jury in a jury trial, or the judge in a bench trial

The trier of fact is whoever determines the facts of the case — the jury in a jury trial or the judge in a bench trial.

Question 47: What is the relationship between internal controls & auditing and overall Certified Fraud Specialist professional competency?

It is an essential component that strengthens the overall competency framework (Correct answer)
It is a minor supplementary skill
It only applies to senior practitioners
They are completely unrelated areas

Correct answer: It is an essential component that strengthens the overall competency framework

Internal Controls & Auditing is an essential component of the CFS competency framework, strengthening overall professional capability and credibility.

Question 48: In fraud risk assessment, 'collusion' is significant because it:

Reduces the likelihood that fraud will be material in amount
Requires involvement of external parties to be classified as fraud
Defeats segregation of duties controls that would otherwise prevent fraud (Correct answer)
Is always detectable through standard data analytics procedures

Correct answer: Defeats segregation of duties controls that would otherwise prevent fraud

Collusion between two or more individuals allows them to circumvent segregation of duties, which is one of the most fundamental preventive controls against fraud.

Question 49: A fraud examiner reviewing IT general controls would focus on all of the following EXCEPT:

Access controls to systems and data
Gross profit margin trends (Correct answer)
Change management procedures
Physical security of data centers

Correct answer: Gross profit margin trends

Gross profit margin trends are a financial analytical procedure, not an IT general control; IT general controls cover access, change management, operations, and physical security.

Question 50: Which control best mitigates the risk of a system administrator granting themselves unauthorized access rights?

Encryption of data at rest
Password complexity requirements
Automatic session timeouts
User access reviews conducted by business process owners (Correct answer)

Correct answer: User access reviews conducted by business process owners

Having business process owners (not IT) periodically review and certify user access ensures that IT staff cannot grant themselves inappropriate permissions undetected.

Question 51: Which FCPA provision prohibits U.S. companies from bribing foreign government officials to obtain or retain business?

Disclosure provisions
Anti-bribery provisions (Correct answer)
Accounting provisions
Internal controls provisions

Correct answer: Anti-bribery provisions

The FCPA's anti-bribery provisions explicitly prohibit offering, paying, or authorizing payments to foreign officials to obtain or retain business.

Question 52: When implementing expert testimony & court presentation practices, what should CFS professionals prioritize?

Alignment with professional standards, stakeholder needs, and organizational goals (Correct answer)
Personal preferences and comfort level
Cost reduction as the sole objective
Speed of implementation above all else

Correct answer: Alignment with professional standards, stakeholder needs, and organizational goals

Effective implementation of expert testimony & court presentation requires balancing professional standards, stakeholder needs, and organizational objectives for optimal results.

Question 53: Which IRS form must U.S. persons file to report a financial interest in or signature authority over foreign financial accounts exceeding $10,000?

Form 1099-INT
Form 5471
FinCEN Form 114 (FBAR) (Correct answer)
Form 8938

Correct answer: FinCEN Form 114 (FBAR)

FinCEN Form 114, known as the FBAR, must be filed annually by U.S. persons with foreign financial account balances exceeding $10,000 at any point during the year.

Question 54: What is the key objective of anti-money laundering (AML) regulations?

To detect and prevent money laundering activities. (Correct answer)
To enforce labor laws.
To increase tax revenue.
To regulate stock markets.

Correct answer: To detect and prevent money laundering activities.

Anti-money laundering (AML) regulations are a set of laws, regulations, and procedures aimed at preventing criminals from disguising illegally obtained funds as legitimate income. Their primary objective is to detect and report suspicious financial transactions. By doing so, AML regulations help combat financial crimes, terrorism financing, and other illicit activities.

Question 55: When assessing fraud risks in a decentralized organization with multiple subsidiaries, which approach is MOST comprehensive?

Relying on each subsidiary's external auditor to assess fraud risk
Performing the assessment only at the parent company headquarters
Applying the same risk profile from the parent to all subsidiaries
Conducting separate assessments at each subsidiary and aggregating results (Correct answer)

Correct answer: Conducting separate assessments at each subsidiary and aggregating results

Each subsidiary may face unique fraud risks based on its geography, operations, and control environment, so separate assessments that are then aggregated provide the most complete picture.

Question 56: The legal concept that evidence obtained through an unlawful search cannot be used in criminal proceedings is known as the:

Plain view doctrine
Exclusionary rule (Correct answer)
Good faith exception
Fruit of the poisonous tree doctrine

Correct answer: Exclusionary rule

The exclusionary rule bars the use of evidence obtained in violation of the Fourth Amendment in criminal prosecutions.

Question 57: Under the Sarbanes-Oxley Act (SOX), which section requires CEOs and CFOs to personally certify the accuracy of financial reports?

Section 404
Section 302 (Correct answer)
Section 1107
Section 806

Correct answer: Section 302

SOX Section 302 requires the CEO and CFO to personally certify that financial statements fairly represent the company's financial condition, creating personal accountability for fraud.

Question 58: Which of the following is a red flag of financial statement fraud?

Regular cash flow reports.
Sudden unexplained spikes in revenue. (Correct answer)
Decreasing expenses.
Consistent financial growth.

Correct answer: Sudden unexplained spikes in revenue.

Sudden unexplained spikes in revenue are a significant red flag for financial statement fraud. Such increases, especially when not supported by corresponding business activity, market growth, or economic conditions, often indicate aggressive or fraudulent revenue recognition practices. Fraudsters might record fictitious sales, prematurely recognize revenue, or manipulate sales figures to artificially inflate the company's financial performance.

Question 59: Management override of internal controls is considered particularly dangerous because:

Controls cannot detect or prevent actions by those who designed them (Correct answer)
External auditors are required to report it immediately to the SEC
It only occurs in small companies without audit committees
It is always illegal under Sarbanes-Oxley

Correct answer: Controls cannot detect or prevent actions by those who designed them

Controls are typically designed by management, so management has the authority and knowledge to circumvent them, making management override a significant inherent limitation.

Question 60: When interviewing a victim of payroll fraud, what is the MOST important initial step?

Confront the witness with documentary evidence of the fraud
Immediately ask about specific dollar amounts lost
Establish the witness's credibility before proceeding
Allow the witness to provide a free narrative account first (Correct answer)

Correct answer: Allow the witness to provide a free narrative account first

Allowing a free narrative account first captures the witness's uncontaminated recollection before focused questioning.

Question 61: What challenge is most commonly encountered in fraud risk assessment frameworks within Certified Fraud Specialist practice?

Unlimited budget allocation
Resistance to change and difficulty maintaining consistency across stakeholders (Correct answer)
Lack of available training materials
Excessive regulatory support

Correct answer: Resistance to change and difficulty maintaining consistency across stakeholders

The most common challenge in fraud risk assessment frameworks is overcoming resistance to change while maintaining consistent implementation across diverse stakeholders.

Question 62: Under Dodd-Frank, a whistleblower who voluntarily provides original information leading to an SEC enforcement action yielding over $1 million may receive:

30–50% of the sanction
10–30% of the sanction (Correct answer)
20–40% of the sanction
5–10% of the sanction

Correct answer: 10–30% of the sanction

Dodd-Frank's SEC whistleblower program awards between 10% and 30% of sanctions collected in qualifying enforcement actions exceeding $1 million.

Question 63: A court order that temporarily prohibits a party from transferring or dissipating assets during litigation to preserve them for potential judgment is called a:

Writ of attachment
Asset freeze injunction (Correct answer)
Temporary restraining order (TRO)
Garnishment order

Correct answer: Asset freeze injunction

An asset freeze injunction prohibits defendants from moving or dissipating assets pending resolution of the case, preserving funds for potential recovery.

Question 64: A consumer discovers their medical records contain treatments they never received. This is an example of:

Medical identity theft (Correct answer)
Prescription drug diversion
Insurance premium fraud
Healthcare billing fraud

Correct answer: Medical identity theft

Medical identity theft occurs when someone uses another person's identity to obtain healthcare services, prescriptions, or medical devices, corrupting the victim's medical records.

Question 65: When the judge asks an expert witness to clarify a technical term 'in plain English,' the witness should:

Provide a clear analogy or everyday comparison without sacrificing accuracy (Correct answer)
Politely explain that simplification would distort the meaning
Refer the judge to the written report for the definition
Ask the retaining attorney to answer on their behalf

Correct answer: Provide a clear analogy or everyday comparison without sacrificing accuracy

Judges and juries are lay audiences; clear analogies that preserve accuracy are both professional and effective.

Question 66: What is the primary ethical obligation of a CFS examiner when a witness provides information implicating themselves in criminal activity?

Report the confession to law enforcement without completing the interview
Advise the witness they may wish to consult an attorney before continuing (Correct answer)
Continue the interview without any disclosure
Immediately arrest the witness

Correct answer: Advise the witness they may wish to consult an attorney before continuing

Ethical practice requires informing self-incriminating witnesses of their right to counsel to protect their rights and the integrity of evidence.

Question 67: A senior executive invokes attorney-client privilege during a fraud interview. The MOST appropriate response by the CFS examiner is to:

Cease questioning on that specific topic and note the privilege assertion (Correct answer)
Immediately terminate the entire interview session
Demand the executive waive the privilege to cooperate
Override the privilege because fraud investigations supersede it

Correct answer: Cease questioning on that specific topic and note the privilege assertion

Attorney-client privilege must be respected; the examiner should stop on that topic and document the assertion for legal counsel to address.

Question 68: Which internal control is MOST effective at preventing unauthorized journal entries used to conceal embezzlement?

Annual external audit of financial statements
Requiring dual signatures on checks over $5,000
Segregation of duties between journal entry preparers and approvers (Correct answer)
Monthly bank reconciliations prepared by the bookkeeper

Correct answer: Segregation of duties between journal entry preparers and approvers

Requiring a separate, independent approver for journal entries prevents a single employee from both creating and posting entries that hide theft.

Question 69: A fraud examiner is asked to render an opinion on the 'ultimate issue' — specifically, whether the defendant committed fraud. Under FRE 704, this is:

Prohibited in all civil and criminal cases
Permitted only if the expert has a law degree
Permitted in civil cases but never in criminal cases
Generally permitted, though courts may still exclude opinions that merely state a legal conclusion (Correct answer)

Correct answer: Generally permitted, though courts may still exclude opinions that merely state a legal conclusion

FRE 704 abolished the ultimate issue rule, but courts still exclude testimony that simply recites a legal standard without factual analysis.

Question 70: Which law mandates organizations to safeguard consumer financial information?

Freedom of Information Act.
Federal Arbitration Act.
Fair Labor Standards Act.
Gramm-Leach-Bliley Act. (Correct answer)

Correct answer: Gramm-Leach-Bliley Act.

The Gramm-Leach-Bliley Act (GLBA) is a U.S. federal law that requires financial institutions to explain their information-sharing practices to customers and to safeguard sensitive data. It mandates that these institutions protect the privacy of consumer financial information. This includes implementing security measures to prevent unauthorized access to or use of such data.

Question 71: Which financial red flag is MOST indicative of an arson-for-profit motive in a commercial property fire investigation?

The business recently renewed its insurance policy
The insured reported the fire within one hour of discovery
The fire caused total destruction rather than partial damage
The business had declining revenues, delinquent loans, and excess inventory prior to the fire (Correct answer)

Correct answer: The business had declining revenues, delinquent loans, and excess inventory prior to the fire

Financial distress indicators such as declining revenues, unpaid debts, and excess inventory are classic arson-for-profit motivators.

Question 72: When investigating identity theft, a fraud examiner should obtain which document as a foundational step in the victim's recovery?

A court order vacating fraudulent accounts
An Identity Theft Report combining an FTC affidavit and police report (Correct answer)
A restraining order against the suspect
A credit bureau suppression notice

Correct answer: An Identity Theft Report combining an FTC affidavit and police report

An Identity Theft Report, combining an FTC Identity Theft Affidavit with a police report, is the key document creditors and credit bureaus require to investigate and remove fraudulent information.

Question 73: When implementing witness interviewing techniques practices, what should CFS professionals prioritize?

Cost reduction as the sole objective
Speed of implementation above all else
Personal preferences and comfort level
Alignment with professional standards, stakeholder needs, and organizational goals (Correct answer)

Correct answer: Alignment with professional standards, stakeholder needs, and organizational goals

Effective implementation of witness interviewing techniques requires balancing professional standards, stakeholder needs, and organizational objectives for optimal results.

Question 74: Which statute makes it a federal crime to conduct a financial transaction involving proceeds from specified unlawful activity with intent to promote that activity?

Patriot Act
Bank Secrecy Act
Currency and Foreign Transactions Reporting Act
Money Laundering Control Act (18 U.S.C. § 1956) (Correct answer)

Correct answer: Money Laundering Control Act (18 U.S.C. § 1956)

18 U.S.C. § 1956 criminalizes conducting financial transactions with proceeds of specified unlawful activity when done to promote, conceal, or evade reporting.

Question 75: According to ACFE guidance, which combination of proactive controls most significantly reduces both fraud losses and detection time in organizations?

Employee awareness training and zero-tolerance written policies alone
Fidelity bond insurance and pre-employment background screening only
Annual external financial statement audits and physical security upgrades
Surprise audits, proactive data monitoring and analytics, and segregation of duties (Correct answer)

Correct answer: Surprise audits, proactive data monitoring and analytics, and segregation of duties

ACFE research demonstrates that organizations employing proactive controls—surprise audits, continuous data analytics monitoring, and duty segregation—suffer materially lower fraud losses and detect schemes significantly faster.

Question 76: When an attorney instructs an expert witness 'don't volunteer information' before testimony, this instruction is:

A standard and legitimate preparation instruction (Correct answer)
A form of witness tampering under federal law
Irrelevant since experts must answer all questions fully
Unethical and should be reported to the bar

Correct answer: A standard and legitimate preparation instruction

Advising a witness to answer only what is asked, without volunteering extra information, is standard and permissible trial preparation.

Question 77: What is the best description of the 'fraud triangle'?

A legal framework for prosecuting fraud.
A method to calculate fraud losses.
An audit procedure.
A model illustrating pressure, opportunity, and rationalization behind fraud. (Correct answer)

Correct answer: A model illustrating pressure, opportunity, and rationalization behind fraud.

The 'fraud triangle' is a widely recognized model that explains the three conditions typically present when an individual commits fraud. These elements are perceived financial pressure (a motive), perceived opportunity (the means to commit and conceal), and rationalization (justifying the dishonest act). Understanding this model helps organizations develop more effective fraud prevention and detection strategies by addressing these underlying factors.

Question 78: A significant deficiency in internal controls differs from a material weakness in that:

A significant deficiency involves more employees than a material weakness
A material weakness represents a higher probability of material misstatement than a significant deficiency (Correct answer)
Material weaknesses only apply to IT controls while significant deficiencies apply to financial controls
A significant deficiency must be reported to external regulators immediately

Correct answer: A material weakness represents a higher probability of material misstatement than a significant deficiency

A material weakness indicates a reasonable possibility of material misstatement, while a significant deficiency is a lesser but still noteworthy control gap that warrants attention.

Question 79: Which practice best demonstrates a strong anti-fraud culture within an organization?

Reducing audit frequency to build employee trust
Publicizing every fraud case investigation outcome internally
Consistently applying disciplinary consequences for all levels of fraud, including executives (Correct answer)
Restricting access to fraud reporting channels to management only

Correct answer: Consistently applying disciplinary consequences for all levels of fraud, including executives

Consistent and transparent enforcement of consequences for fraud at all organizational levels, including senior management, demonstrates that no one is above the code of conduct.

Question 80: In a corporate investigation, documents created by outside counsel while conducting an internal investigation are typically protected from disclosure under:

Work product doctrine (Correct answer)
The business records exception
The common interest privilege
Spousal privilege

Correct answer: Work product doctrine

The work product doctrine protects documents prepared by or for an attorney in anticipation of litigation, including internal investigation materials.

Question 81: In a criminal fraud trial, the standard of proof required to convict is:

Clear and convincing evidence
Substantial evidence
Preponderance of the evidence (more likely than not)
Beyond a reasonable doubt (Correct answer)

Correct answer: Beyond a reasonable doubt

Criminal convictions require proof beyond a reasonable doubt, the highest standard in law, which is significantly higher than the civil preponderance standard.

Question 82: Cryptocurrency exchanges operating in the United States are classified under the BSA as:

Money services businesses subject to AML program requirements (Correct answer)
Exempt from BSA requirements as technology companies
Foreign financial institutions
Securities dealers regulated solely by the SEC

Correct answer: Money services businesses subject to AML program requirements

FinCEN has classified cryptocurrency exchangers and administrators as money services businesses, requiring them to register, implement AML programs, and file SARs and CTRs.

Question 83: Which of the following is a PRIMARY responsibility of the board of directors in the fraud risk management framework?

Overseeing management's fraud risk assessment process (Correct answer)
Performing investigative procedures when fraud is suspected
Conducting day-to-day transaction monitoring
Designing specific internal controls for each business unit

Correct answer: Overseeing management's fraud risk assessment process

The board provides oversight of management's fraud risk management activities, ensuring the program is adequate and functioning effectively.

Question 84: Which regulatory requirement focuses on protecting personal health information?

Consumer Protection Act.
Health Insurance Portability and Accountability Act (HIPAA). (Correct answer)
Fair Credit Reporting Act.
Sarbanes-Oxley Act.

Correct answer: Health Insurance Portability and Accountability Act (HIPAA).

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes national standards to protect sensitive patient health information. It mandates strict rules for healthcare providers, health plans, and other entities regarding the privacy and security of Protected Health Information (PHI). HIPAA ensures individuals' medical records and personal health data are kept confidential and secure.

Question 85: How does internal controls & auditing contribute to professional excellence in CFS certification?

It has no measurable impact on practice
It only matters during certification exams
It benefits organizations but not individual practitioners
It enhances competency, improves outcomes, and supports continuous professional growth (Correct answer)

Correct answer: It enhances competency, improves outcomes, and supports continuous professional growth

Internal Controls & Auditing is integral to CFS professional excellence, directly enhancing competency and driving measurable improvement in practice outcomes.

Question 86: A fraud examiner is cross-examined about their compensation and how many times they have testified for the same law firm. The purpose of this line of questioning is to:

Verify the expert's independence from the retaining party
Establish the expert's qualifications through prior court experience
Suggest financial bias and that the expert is a 'professional witness' for hire (Correct answer)
Determine whether the expert filed proper tax returns

Correct answer: Suggest financial bias and that the expert is a 'professional witness' for hire

Repeated engagements by the same firm and high compensation are used to imply financial bias — that the expert tailors opinions to generate repeat business.

Question 87: Which legal doctrine allows prosecutors to hold a corporation criminally liable for crimes committed by its employees acting within the scope of their employment?

Vicarious estoppel
Alter ego doctrine
Respondeat superior (Correct answer)
Piercing the corporate veil

Correct answer: Respondeat superior

Respondeat superior ('let the master answer') is the doctrine under which corporations face criminal liability for employees' acts within the scope of employment.

Question 88: Which element is essential for a whistleblower program to be effective?

Financial rewards for every report regardless of merit
Guaranteed confidentiality and non-retaliation protections (Correct answer)
Public disclosure of all reports received
Mandatory reporting quotas for each department

Correct answer: Guaranteed confidentiality and non-retaliation protections

Effective whistleblower programs must guarantee confidentiality and clearly communicate non-retaliation policies to encourage good-faith reporting without fear of consequences.

Question 89: Which documentation method is considered BEST practice for recording a fraud witness interview?

Only documenting information that supports the investigation theory
Verbatim notes or audio/video recording with proper consent (Correct answer)
Mental notes taken after the interview ends
Paraphrased summaries written during the interview

Correct answer: Verbatim notes or audio/video recording with proper consent

Verbatim notes or recordings provide the most accurate, defensible record and prevent later disputes about what was said.

Question 90: A fraudster calls a victim pretending to be an IRS agent and demands immediate payment using gift cards to avoid arrest. This is known as:

Vishing (Correct answer)
Phishing
Pharming
Smishing

Correct answer: Vishing

Vishing (voice phishing) uses telephone calls to deceive victims into revealing personal information or making fraudulent payments, often impersonating government agencies.

Question 91: How does expert testimony & court presentation contribute to professional excellence in CFS certification?

It only matters during certification exams
It benefits organizations but not individual practitioners
It has no measurable impact on practice
It enhances competency, improves outcomes, and supports continuous professional growth (Correct answer)

Correct answer: It enhances competency, improves outcomes, and supports continuous professional growth

Expert Testimony & Court Presentation is integral to CFS professional excellence, directly enhancing competency and driving measurable improvement in practice outcomes.

Question 92: Which database tool is used by U.S. life and health insurers to detect whether a deceased claimant had other life insurance policies in force?

NICB VINCheck
ISO ClaimSearch
MIB Group database (Correct answer)
CLUE Report

Correct answer: MIB Group database

MIB Group (formerly Medical Information Bureau) maintains an industry database of underwriting information, including prior life and health applications.

Question 93: When the fraud risk assessment identifies a gap between inherent risk and existing controls, management should:

Reclassify the risk as immaterial
Transfer the assessment responsibility to external auditors
Immediately report the gap to law enforcement
Develop a risk response plan to close the gap (Correct answer)

Correct answer: Develop a risk response plan to close the gap

A control gap requires management to design and implement additional or improved controls as part of a structured risk response plan.

Question 94: What is the purpose of a journal entry in financial reporting?

To provide a chronological record of financial transactions. (Correct answer)
To hide fraudulent transactions.
To approve transactions.
To generate cash.

Correct answer: To provide a chronological record of financial transactions.

A journal entry is the foundational step in the accounting cycle, serving as a chronological record of every financial transaction. It details the accounts affected (debits and credits), the amounts, and the date of the transaction. This systematic recording provides the essential raw data from which all other financial reports are generated, ensuring an accurate and auditable history of financial activity.

Question 95: A suspect arrested for a crime gives police another person's identity. The innocent person then has arrest records attached to their identity. This is called:

Impersonation of a law enforcement officer
Criminal identity theft (Correct answer)
Obstruction identity fraud
Warrant fraud

Correct answer: Criminal identity theft

Criminal identity theft occurs when a person arrested for a crime uses someone else's identifying information, causing the innocent person to have a criminal record they cannot easily clear.

Question 96: Which type of audit opinion is issued when financial statements are free of material misstatement but the auditor has a scope limitation?

Adverse opinion
Qualified opinion (Correct answer)
Disclaimer of opinion
Unmodified opinion

Correct answer: Qualified opinion

A qualified opinion is issued when the financial statements are fairly presented except for a specific matter, including certain scope limitations.

Question 97: Which interview technique involves asking a witness to mentally reinstate the context of an event before recalling details?

Cognitive Interview (Correct answer)
Behavioral Analysis Interview
Motivational Interviewing
Structured Interview

Correct answer: Cognitive Interview

The Cognitive Interview uses mental reinstatement of context as one of its core mnemonics to enhance witness recall.

Question 98: Which federal agency has primary enforcement authority over anti-money laundering compliance in US depository institutions?

The Department of Justice
The prudential regulator (OCC, FDIC, or Federal Reserve) (Correct answer)
OFAC
FinCEN

Correct answer: The prudential regulator (OCC, FDIC, or Federal Reserve)

Prudential regulators such as the OCC, FDIC, and Federal Reserve conduct AML examinations and have authority to take enforcement action against banks for BSA violations.

Question 99: An investigator conducting surveillance must ensure that all surveillance activities:

Are approved by the subject's employer before beginning
Are conducted only during normal business hours
Comply with applicable laws regarding privacy and public versus private spaces (Correct answer)
Include audio recording to capture conversations as evidence

Correct answer: Comply with applicable laws regarding privacy and public versus private spaces

Surveillance must operate within legal privacy frameworks; what is permissible in public may not be in private spaces, and recording laws vary by jurisdiction.

Question 100: A Ponzi scheme is best characterized as:

Using new investor funds to pay returns to earlier investors (Correct answer)
Inflating asset values on the balance sheet
Bribing government officials for contracts
Stealing physical inventory from a warehouse

Correct answer: Using new investor funds to pay returns to earlier investors

A Ponzi scheme pays returns to earlier investors using capital from newer investors rather than from legitimate profit, eventually collapsing when new investment slows.

Question 101: A Deferred Prosecution Agreement (DPA) differs from a Non-Prosecution Agreement (NPA) primarily in that a DPA:

Grants full immunity from prosecution
Is only available to individuals, not corporations
Requires no admission of wrongdoing
Files charges that are held in abeyance pending compliance (Correct answer)

Correct answer: Files charges that are held in abeyance pending compliance

In a DPA, the government files criminal charges but agrees to defer prosecution if the company meets compliance conditions, whereas an NPA involves no filed charges.

Question 102: A company processes thousands of small vendor payments daily. Which fraud risk assessment approach would be MOST efficient for identifying anomalies?

Interviewing all accounts payable staff
Data analytics to examine 100% of transactions (Correct answer)
Manual review of a random 10% sample
Observation of the payment authorization process

Correct answer: Data analytics to examine 100% of transactions

Data analytics enables examination of entire populations of transactions to detect anomalies, duplicate payments, and patterns indicative of fraud at a scale manual testing cannot match.

Question 103: The 'dark web' differs from the 'deep web' in that the dark web:

Is only accessible to government agencies and law enforcement
Requires specialized software like Tor to access and is intentionally hidden, often hosting illicit marketplaces (Correct answer)
Contains content that search engines have not yet indexed
Consists of private corporate intranets and password-protected websites

Correct answer: Requires specialized software like Tor to access and is intentionally hidden, often hosting illicit marketplaces

The dark web is an intentionally hidden overlay network requiring special software (Tor) and configurations to access, distinct from the deep web which is simply unindexed legitimate content.

Question 104: Which COSO component addresses the organization's risk appetite and tolerance levels?

Information & Communication
Control Activities
Risk Assessment (Correct answer)
Monitoring Activities

Correct answer: Risk Assessment

Risk Assessment is the COSO component where management identifies and analyzes risks, including setting acceptable risk appetite and tolerance thresholds.

Question 105: What is a key principle of internal controls & auditing in Certified Fraud Specialist practice?

Minimizing documentation requirements
Relying solely on personal experience
Applying structured methodologies based on evidence and best practices (Correct answer)
Avoiding all standardized approaches

Correct answer: Applying structured methodologies based on evidence and best practices

Internal Controls & Auditing in Certified Fraud Specialist practice requires applying structured, evidence-based methodologies while adapting to specific professional contexts.

Question 106: According to ACFE research, what is the most common initial detection method for occupational fraud, including asset misappropriation?

Internal audit review
External audit
A tip from an employee or other informant (Correct answer)
Automated fraud detection software

Correct answer: A tip from an employee or other informant

ACFE research consistently shows that tips are the most frequent initial detection method for occupational fraud, underscoring the critical importance of anonymous reporting hotlines.

Question 107: A vendor master file that is rarely reviewed creates the greatest risk of which scheme?

Kiting
Ghost vendor fraud (Correct answer)
Skimming
Payroll padding

Correct answer: Ghost vendor fraud

Unreviewed vendor master files allow fictitious vendors to remain active and receive fraudulent payments.

Question 108: Which of the following best defines a 'skimming' scheme?

Taking cash before it is entered into the accounting system (Correct answer)
Stealing cash after it has been recorded in the accounting system
Altering checks to redirect payments to a fraudster
Creating fictitious vendors to receive payments

Correct answer: Taking cash before it is entered into the accounting system

Skimming is an off-book scheme where cash is stolen before any record of the receipt is created, making detection through records alone nearly impossible.

Question 109: Under SOX Section 404, management is required to:

Rotate external auditors every five years
Submit quarterly fraud risk assessments to the SEC
Assess and report on the effectiveness of internal controls over financial reporting (Correct answer)
Hire an external forensic accountant annually

Correct answer: Assess and report on the effectiveness of internal controls over financial reporting

SOX Section 404 requires management to evaluate and report on the effectiveness of internal controls over financial reporting, with the external auditor attesting to that assessment.

Question 110: Which factor would most INCREASE the assessed likelihood of a fraud scheme occurring?

A zero-tolerance fraud policy communicated to all staff
Strong segregation of duties in the affected process
Mandatory vacation policies for key employees
Recent turnover in the internal audit function (Correct answer)

Correct answer: Recent turnover in the internal audit function

Turnover in internal audit reduces the organization's monitoring capacity, which is a control weakness that increases the likelihood of undetected fraud.

Question 111: Which act requires publicly traded companies to establish internal controls over financial reporting?

Sarbanes-Oxley Act. (Correct answer)
Gramm-Leach-Bliley Act.
Dodd-Frank Act.
Health Insurance Portability and Accountability Act.

Correct answer: Sarbanes-Oxley Act.

The Sarbanes-Oxley Act (SOX) of 2002 specifically requires publicly traded companies to establish and maintain adequate internal controls over financial reporting. Section 404 of SOX mandates that management assess the effectiveness of these controls annually, and external auditors must attest to management's assessment. This provision aims to enhance the accuracy and reliability of financial statements and protect investors.

Question 112: A staged auto accident ring recruits participants to deliberately cause collisions with innocent drivers. The BEST term for the innocent driver in this scheme is:

Swoop-and-squat victim (Correct answer)
Straw driver
Capper
Padding participant

Correct answer: Swoop-and-squat victim

In a swoop-and-squat scheme, one car cuts off another and brakes suddenly, making the innocent rear driver appear at fault.

Question 113: Which sampling method gives every transaction in a population an equal chance of being selected?

Judgmental sampling
Haphazard sampling
Simple random sampling (Correct answer)
Stratified random sampling

Correct answer: Simple random sampling

Simple random sampling ensures each item in the population has an equal and independent probability of selection, eliminating bias.

Question 114: An organization's identity theft prevention program should include which of the following as a core element?

Reasonable policies to detect, prevent, and mitigate identity theft Red Flags (Correct answer)
Quarterly audits by external law enforcement
Mandatory credit freezes for all customers
Annual FBI background checks on all employees

Correct answer: Reasonable policies to detect, prevent, and mitigate identity theft Red Flags

The Red Flags Rule requires covered entities' programs to include policies and procedures to identify, detect, and respond appropriately to Red Flags of identity theft.

Question 115: What is the first step in conducting a fraud investigation?

Collect and preserve relevant evidence. (Correct answer)
Terminate the employee.
Interview the suspect immediately.
Notify the media.

Correct answer: Collect and preserve relevant evidence.

The first critical step in a fraud investigation is to collect and meticulously preserve all relevant evidence. This ensures that potential evidence is not lost, altered, or contaminated, maintaining its integrity and admissibility. Proper preservation is foundational for building a strong case and accurately determining the facts of the alleged fraud.

Question 116: Which scheme involves a fraudster using a company's trade secrets or intellectual property for personal gain?

Embezzlement
False invoicing
Economic espionage / IP theft (Correct answer)
Conversion of assets

Correct answer: Economic espionage / IP theft

Economic espionage or IP theft involves stealing proprietary information, trade secrets, or intellectual property for competitive or personal financial advantage.

Question 117: Which board governance failure was a primary contributing factor in major corporate scandals such as Enron?

Lack of board oversight and failure to challenge management (Correct answer)
Overly strict application of accounting standards
Excessive reliance on internal audit reports
Too many independent directors on the board

Correct answer: Lack of board oversight and failure to challenge management

In Enron and similar scandals, boards failed to exercise adequate oversight and ask tough questions of management, allowing fraudulent schemes to persist for years.

Question 118: What challenge is most commonly encountered in internal controls & auditing within Certified Fraud Specialist practice?

Unlimited budget allocation
Lack of available training materials
Excessive regulatory support
Resistance to change and difficulty maintaining consistency across stakeholders (Correct answer)

Correct answer: Resistance to change and difficulty maintaining consistency across stakeholders

The most common challenge in internal controls & auditing is overcoming resistance to change while maintaining consistent implementation across diverse stakeholders.

Question 119: An employee uses a company credit card to purchase a personal laptop and codes the charge as 'office equipment supplies.' This is known as:

Equipment larceny
Fictitious expense scheme
Personal purchases scheme (Correct answer)
Mischaracterized expense scheme

Correct answer: Personal purchases scheme

A personal purchases scheme involves using company payment mechanisms—credit cards, purchase orders—to acquire personal items while misrepresenting them as legitimate business expenditures.

Question 120: Under RICO, what is the minimum number of predicate acts required to establish a 'pattern of racketeering activity'?

Two acts (Correct answer)
One act
Three acts
Five acts

Correct answer: Two acts

RICO requires at least two predicate acts of racketeering within a 10-year period to establish a pattern of racketeering activity.

Question 121: The 'conscious avoidance' or 'willful blindness' doctrine in fraud cases allows courts to infer knowledge when a defendant:

Reported concerns to management
Relied on advice of counsel
Actively participated in the scheme
Deliberately avoided learning facts that would confirm wrongdoing (Correct answer)

Correct answer: Deliberately avoided learning facts that would confirm wrongdoing

Willful blindness applies when a defendant deliberately avoided learning the truth, allowing courts to infer knowledge equivalent to actual knowledge.

Question 122: During a fraud investigation, an investigator discovers evidence of wrongdoing by a colleague. What is the ethical obligation?

Document it but take no action unless directly asked
Ignore it to preserve team cohesion
Report it through appropriate channels regardless of relationships (Correct answer)
Confront the colleague privately and allow them to self-report

Correct answer: Report it through appropriate channels regardless of relationships

Investigators have a professional duty to report discovered wrongdoing through proper channels, even when it involves colleagues.

Question 123: When an internal auditor discovers evidence of fraud during a routine audit, the recommended next step is to:

Report findings directly to law enforcement
Expand audit procedures and notify appropriate management or legal counsel (Correct answer)
Immediately confront the suspect employee
Terminate the audit and wait for instructions

Correct answer: Expand audit procedures and notify appropriate management or legal counsel

Upon discovering fraud indicators, the auditor should expand testing to understand the scope and promptly inform appropriate management or legal counsel rather than self-investigate.

Question 124: Which technique is MOST appropriate when an investigator wants to assess the truthfulness of a subject's statement without a formal interview?

Covert surveillance
Statement analysis of written accounts (Correct answer)
Social media monitoring
Polygraph examination

Correct answer: Statement analysis of written accounts

Statement analysis examines the linguistic structure of written or verbal accounts to identify deception indicators without formal interrogation.

Question 125: A 'lapping' scheme is most likely to be detected by:

Reviewing fixed asset additions
Comparing customer account balances to statements and confirming directly with customers (Correct answer)
Analyzing vendor payment trends
Counting petty cash

Correct answer: Comparing customer account balances to statements and confirming directly with customers

Lapping involves misapplying one customer's payment to another's account; direct customer confirmations reveal discrepancies the perpetrator has hidden.

Question 126: Which control is essential to ensure the integrity of financial reporting?

Hiring more accountants.
Regular account reconciliations. (Correct answer)
Segregation of duties.
Ignoring small discrepancies.

Correct answer: Regular account reconciliations.

Regular account reconciliations are essential for ensuring the integrity and accuracy of financial reporting. This process involves comparing internal financial records (e.g., general ledger balances) with external statements (e.g., bank statements, vendor invoices). By identifying and investigating any discrepancies, organizations can detect errors, omissions, or potential fraudulent activities, thereby maintaining reliable financial data.

Question 127: A drug trafficking organization uses a chain of legitimate restaurants to mix drug proceeds with lawful restaurant revenues before reporting it as business income. This technique primarily exploits which money laundering stage?

Extraction through wire transfers
Placement through commingling (Correct answer)
Integration through trade finance
Layering through correspondent banking

Correct answer: Placement through commingling

Commingling illegal proceeds with legitimate business revenues is a placement technique that makes the illicit funds appear to be lawful income.

Question 128: Under GAAP, a contingent liability must be recorded when it is probable and the amount can be reasonably estimated. Intentionally failing to record a known lawsuit settlement is an example of:

Aggressive but acceptable accounting
Liability understatement fraud (Correct answer)
Immaterial misstatement
Conservative accounting

Correct answer: Liability understatement fraud

Omitting a known, estimable contingent liability to inflate net income or assets constitutes liability understatement fraud.

Question 129: Under the Health Insurance Portability and Accountability Act (HIPAA), an insurer investigating a fraud claim may access a claimant's protected health information (PHI) under which exception?

Routine insurance operations exception
Fraud and abuse exception for health oversight activities (Correct answer)
Minimum necessary standard exception
Public interest and benefit exception

Correct answer: Fraud and abuse exception for health oversight activities

HIPAA's health oversight exception permits PHI disclosure for fraud investigations conducted by entities with lawful authority over the health system.

Question 130: Data analytics applied to journal entry testing most commonly looks for which fraud indicator?

Journal entries posted on weekends or holidays by senior management (Correct answer)
Entries posted by the external auditor
Entries that exactly match budgeted amounts
Entries recorded during normal business hours

Correct answer: Journal entries posted on weekends or holidays by senior management

Journal entries posted outside normal business hours—especially by management—are a red flag for fraudulent manual adjustments used to manipulate financial results.

Question 131: How does insurance fraud investigation contribute to professional excellence in CFS certification?

It only matters during certification exams
It enhances competency, improves outcomes, and supports continuous professional growth (Correct answer)
It benefits organizations but not individual practitioners
It has no measurable impact on practice

Correct answer: It enhances competency, improves outcomes, and supports continuous professional growth

Insurance Fraud Investigation is integral to CFS professional excellence, directly enhancing competency and driving measurable improvement in practice outcomes.

Question 132: Under the Sarbanes-Oxley Act, what is the maximum criminal penalty for knowingly destroying documents to obstruct a federal investigation?

5 years imprisonment
25 years imprisonment
10 years imprisonment
20 years imprisonment (Correct answer)

Correct answer: 20 years imprisonment

SOX Section 1102 imposes up to 20 years imprisonment for knowingly destroying or falsifying records to obstruct a federal investigation.

Question 133: Under the Uniform Commercial Code (UCC), which Article governs the sale of goods and is most relevant to commercial fraud schemes?

Article 3
Article 4
Article 2 (Correct answer)
Article 9

Correct answer: Article 2

UCC Article 2 governs contracts for the sale of goods and is central to commercial fraud claims involving misrepresentation in product transactions.

Question 134: Under SEC Rule 10b-5, insider trading liability requires proof that the defendant traded while in possession of material, nonpublic information obtained through a:

Regulatory filing error
Public disclosure violation
Breach of fiduciary duty or similar duty of trust and confidence (Correct answer)
Negligent misrepresentation

Correct answer: Breach of fiduciary duty or similar duty of trust and confidence

Under the misappropriation theory, insider trading liability requires a breach of a duty of trust and confidence owed to the source of the information.

Question 135: How should CFS professionals measure success in witness interviewing techniques?

By comparing only to minimum requirements
Using defined metrics, benchmarks, and regular evaluation against established goals (Correct answer)
Success measurement is not applicable
Through subjective self-assessment only

Correct answer: Using defined metrics, benchmarks, and regular evaluation against established goals

Success in witness interviewing techniques is measured through defined metrics and benchmarks, with regular evaluation against established professional goals.

Question 136: In a civil fraud case, the standard of proof required to prevail is:

Beyond a reasonable doubt
Clear and convincing evidence
Probable cause
Preponderance of the evidence (Correct answer)

Correct answer: Preponderance of the evidence

Civil fraud claims require proof by a preponderance of the evidence (more likely than not), though some jurisdictions require clear and convincing evidence.

Question 137: Under the attorney-client privilege, communications are protected only when they are made:

In writing and marked confidential
With in-house counsel in all circumstances
Between a client and attorney for the purpose of seeking legal advice (Correct answer)
Between any employees discussing legal matters

Correct answer: Between a client and attorney for the purpose of seeking legal advice

Attorney-client privilege protects confidential communications between a client and their attorney made for the purpose of obtaining legal advice.

Question 138: An SIU analyst notices that multiple unrelated auto claims share the same body shop, the same attorney, and the same medical clinic. This network analysis finding MOST suggests:

An organized fraud ring (Correct answer)
Coincidental vendor popularity
Legitimate referral relationships
Geographic clustering

Correct answer: An organized fraud ring

Repeated linkage of the same vendors and professionals across unrelated claims is a strong indicator of an organized fraud network.

Question 139: The 'reasonable assurance' concept in internal controls means that:

All fraud will be detected by an effective control system
Controls eliminate all material risks if properly designed
External auditors guarantee the accuracy of financial statements
The cost of controls should not exceed the expected benefit (Correct answer)

Correct answer: The cost of controls should not exceed the expected benefit

Reasonable assurance acknowledges that controls involve cost-benefit tradeoffs and that no system can eliminate all risk, but costs of controls should not exceed their benefits.

Question 140: A fraud witness is interviewed in a language other than English. Which of the following is MOST critical to ensure interview integrity?

Employing a certified professional interpreter and documenting translation decisions (Correct answer)
Having the witness write their statement in English
Using a bilingual colleague from the same company as interpreter
Conducting the interview in English regardless of witness preference

Correct answer: Employing a certified professional interpreter and documenting translation decisions

A certified professional interpreter ensures accuracy and avoids conflicts of interest that could compromise the witness's statement.

Question 141: What is the primary purpose of a corporate code of conduct?

To satisfy IRS reporting requirements
To establish employee compensation scales
To set behavioral standards and ethical expectations for all employees (Correct answer)
To define the company's marketing strategy

Correct answer: To set behavioral standards and ethical expectations for all employees

A corporate code of conduct establishes the ethical standards, behaviors, and values expected of all employees, forming the foundation of an anti-fraud culture.

Question 142: A lawyer receives $200,000 in cash from a client to hold in escrow for a real estate purchase. Which AML concern is most immediately relevant?

The lawyer must file a CTR since the amount exceeds $10,000
The lawyer should assess whether this triggers client due diligence and potential SAR filing obligations (Correct answer)
No obligation exists because real estate escrow is exempt under the BSA
Legal professional privilege fully exempts lawyers from all AML obligations

Correct answer: The lawyer should assess whether this triggers client due diligence and potential SAR filing obligations

While lawyers have limited BSA obligations, receiving large unexplained cash sums raises significant AML concerns requiring due diligence and potentially SAR filing under state bar rules or voluntary programs.

Question 143: What is the primary goal of regulatory compliance programs?

To increase sales.
To avoid audits.
To ensure adherence to laws and regulations. (Correct answer)
To delay reporting.

Correct answer: To ensure adherence to laws and regulations.

The primary goal of regulatory compliance programs is to ensure that an organization adheres to all applicable laws, regulations, industry standards, and internal policies. These programs help mitigate legal and reputational risks, avoid penalties, and foster a culture of ethical conduct. By proactively managing compliance, organizations demonstrate their commitment to operating responsibly and lawfully.

Question 144: A control environment weakness exists when:

The company uses manual rather than automated controls
Management's actions are inconsistent with stated ethical standards (Correct answer)
The internal audit function lacks forensic expertise
External auditors rotate partners every five years

Correct answer: Management's actions are inconsistent with stated ethical standards

When management acts contrary to the ethical standards it espouses, it undermines the entire control environment by signaling that controls are not genuinely enforced.

Question 145: What is the main purpose of the Foreign Corrupt Practices Act (FCPA)?

To regulate environmental practices.
To prevent bribery of foreign officials. (Correct answer)
To establish labor laws.
To manage tax reporting.

Correct answer: To prevent bribery of foreign officials.

The main purpose of the Foreign Corrupt Practices Act (FCPA) is to prevent the bribery of foreign officials by U.S. companies and individuals. This law prohibits offering or giving anything of value to foreign government officials to obtain or retain business. The FCPA aims to combat corruption on an international scale and promote fair and transparent business practices globally.

Question 146: Under the Federal Sentencing Guidelines, what term describes a formal program designed to prevent and detect criminal conduct within an organization?

Internal control framework
Risk management plan
Effective compliance and ethics program (Correct answer)
Whistleblower protection policy

Correct answer: Effective compliance and ethics program

The Federal Sentencing Guidelines use the term 'effective compliance and ethics program' to describe the formal structure organizations must have to earn culpability score reductions.

Question 147: An insured files a claim for a vehicle stolen from a mall parking lot, but surveillance footage shows the vehicle leaving with the insured driving. This is BEST classified as:

Hard fraud (Correct answer)
Phantom fraud
Soft fraud
Premium fraud

Correct answer: Hard fraud

Hard fraud involves deliberately staging or fabricating a loss, such as a false stolen vehicle report.

Question 148: In the context of premium fraud, 'fronting' refers to:

Submitting claims before the premium payment clears
Using a low-risk driver as the listed primary driver to reduce auto premiums for a high-risk actual driver (Correct answer)
Creating a fictitious business to obtain commercial coverage
Falsifying a company's payroll to reduce workers' comp premiums

Correct answer: Using a low-risk driver as the listed primary driver to reduce auto premiums for a high-risk actual driver

Fronting places a lower-risk driver as the named insured on an auto policy to obtain cheaper premiums for a higher-risk primary driver.

Question 149: An investigator discovers that a key witness has a financial incentive to provide favorable testimony. This situation represents a risk to which investigative principle?

Witness reliability and credibility (Correct answer)
Due professional care
Chain of custody
Confidentiality

Correct answer: Witness reliability and credibility

A witness with a financial incentive has a bias that undermines their credibility and the reliability of their testimony in the investigation.

Question 150: What challenge is most commonly encountered in insurance fraud investigation within Certified Fraud Specialist practice?

Resistance to change and difficulty maintaining consistency across stakeholders (Correct answer)
Excessive regulatory support
Unlimited budget allocation
Lack of available training materials

Correct answer: Resistance to change and difficulty maintaining consistency across stakeholders

The most common challenge in insurance fraud investigation is overcoming resistance to change while maintaining consistent implementation across diverse stakeholders.

Question 151: When implementing fraud risk assessment frameworks practices, what should CFS professionals prioritize?

Alignment with professional standards, stakeholder needs, and organizational goals (Correct answer)
Cost reduction as the sole objective
Personal preferences and comfort level
Speed of implementation above all else

Correct answer: Alignment with professional standards, stakeholder needs, and organizational goals

Effective implementation of fraud risk assessment frameworks requires balancing professional standards, stakeholder needs, and organizational objectives for optimal results.

Certified Fraud Specialist (CFS) Exam

The Certified Fraud Specialist (CFS) certification validates expertise in fraud prevention, detection, investigation, and resolution across various sectors.

150

Questions

180 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds