CFE-Fraud-Investigations-and-Legal-Issues ACFE Certified Fraud Examiner (CFE) - Fraud Investigations and Legal Issues Free Practice Exam Questions (2026 Updated)

Tree maps are a data visualization technique that display hierarchical data using rectangles divided into smaller regions. The size, color, or placement of each rectangle can help communicate relative volume, grouping, or importance within the hierarchy. Option A is incorrect because keyword size and frequency are associated more closely with word clouds, not geospatial analysis. Geospatial analysis concerns location-based data. Option C is incorrect because color-coding and compatibility may improve visual communication, but they are not the core objectives of data visualization. Option D confuses link analysis with geospatial mapping; link analysis is used to show relationships among people, entities, transactions, accounts, or events. Therefore, the statement about tree maps is the accurate description.

Fraud examiners should generally avoid allowing unnecessary observers in interviews. Additional observers can affect the interviewee’s responses, create confidentiality concerns, increase the chance of later disputes, and potentially expose the organization or examiner to legal claims. The Fraud Examiners Manual emphasizes that interviews should be controlled and that the interviewer should avoid unnecessary third-party participation unless the law, a collective bargaining agreement, language needs, or similar requirements make an observer necessary. The HR manager’s desire to observe is not, by itself, a sufficient reason to permit attendance. Option D is still risky because silent presence can influence the interview. Option A is based on comfort rather than investigative control. Therefore, if the law permits, Ana should not allow the HR manager to witness the interview.

This question tests your knowledge of Domain 11.

In the context of Testifying, specifically relating to expert witness, testimony, cross-examination, the question asks about MOST LIKELY.

The correct answer is B: Direct exam Ml mi.

This question relates to expert witness testimony. The correct answer accurately describes the role, qualifications, or techniques for effective expert testimony. Fraud examiners often serve as expert witnesses and must understand these principles. In adversarial systems, opposing parties present their cases before a neutral judge or jury, while in inquisitorial systems, judges take a more active role in investigating cases. Expert witnesses provide specialized knowledge to help the fact finder understand complex issues. Their testimony must be relevant, reliable, and based on sufficient facts or data.

This question tests your knowledge of Domain 3.

In the context of Bankruptcy Fraud, specifically relating to bankruptcy, trustee, bustout, the question asks about the core concepts in this area.

The correct answer is D: Purchases large quantities of goods on credit.

This question focuses on bankruptcy fraud concepts. The correct answer correctly identifies the relevant bankruptcy process, filing type, or fraud scheme. Understanding bankruptcy proceedings and the roles of various parties is essential for fraud examiners investigating these cases.

Both the CFE Prep Guide and the Fraud Examiners Manual state that every fraud examination must be conducted under the assumption that litigation will result. This ensures that evidence is collected and preserved properly, in compliance with legal standards:

“Each fraud examination should begin with the proposition that the case will end in litigation… If the fraud examiner assumes that litigation will occur, he will conduct the examination in accordance with the proper rules of evidence”.

This principle protects the integrity of the examination and ensures admissibility of evidence if the matter proceeds to court.

This question tests your knowledge of Domain 9.

In the context of Civil Actions, specifically relating to trial, the question asks about CFE.

The correct answer is C: Establish a clear chain of custody to show that the evidence has not been altered..

This question focuses on civil action processes. The correct answer accurately describes civil litigation procedures, evidence preservation, or remedies available to fraud victims. Civil recovery is often an important component of fraud resolution.

This question tests your knowledge of Domain 11.

In the context of Testifying, specifically relating to expert witness, testimony, the question asks about examinations of expert witnesses in most inquisitorial jurisdictions is accurate.

The correct answer is D: The parties are often allowed to question the expert ' s methods and analysis.

This question relates to expert witness testimony. The correct answer accurately describes the role, qualifications, or techniques for effective expert testimony. Fraud examiners often serve as expert witnesses and must understand these principles. In adversarial systems, opposing parties present their cases before a neutral judge or jury, while in inquisitorial systems, judges take a more active role in investigating cases. Expert witnesses provide specialized knowledge to help the fact finder understand complex issues. Their testimony must be relevant, reliable, and based on sufficient facts or data.

The employee could raise an entrapment defense. Entrapment occurs when law enforcement officers or government agents induce a person to commit a crime that the person was not previously predisposed to commit. The facts state that Mari, a law enforcement officer, posed as a salesperson, offered a kickback, and eventually persuaded the employee to accept after an initial rejection. Those facts support an argument that the criminal act was induced by government conduct. Collusion involves agreement among parties to commit wrongdoing, but it is not the defense described here. Coercion involves compulsion or threats, which are not stated. Fraudulent misrepresentation concerns false material statements, not inducement by law enforcement. Therefore, option C is correct.

This question tests your knowledge of Domain 10.

In the context of Basic Principles of Evidence, specifically relating to privilege, the question asks about NOT.

The correct answer is B: A lawsuit has been filed.

This question tests knowledge of evidence principles. The correct answer correctly distinguishes between types of evidence, admissibility requirements, or evidentiary privileges. Proper handling of evidence is crucial for successful fraud investigations and prosecutions.

The biggest challenge listed is the organization’s data retention policy limiting the amount of historical data available for analysis. Fraud examiners often need historical transactions, emails, logs, vendor records, payroll details, or other data to identify patterns and compare activity across time. If older records have been deleted under a retention schedule, Wagner’s analysis might be incomplete. Option A is less challenging because one jurisdiction with limited data privacy restrictions usually simplifies collection. Option C is also less challenging because structured internal data is easier to obtain and analyze than unstructured data from multiple sources. Option D suggests standardized automated systems, which usually help rather than hinder collection. Therefore, option B is the most likely practical obstacle.

From the 2014 International Fraud Examiners Manual, under the section related to tracing financial transactions, specifically tracing the disposition of loan proceeds, the following objectives of tracing activities are explicitly outlined:

“Tracing the disposition of loan proceeds can help fraud examiners:

Determine whether loan proceeds were deposited into hidden or unknown accounts

Determine whether loan proceeds were used to pay off other loans

Identify the involvement of previously unknown individuals (potential witnesses)

Determine whether payments were made from hidden accounts

Identify undisclosed related-party transactions”

There is no mention that tracing loan proceeds can uncover previous civil offenses committed by the subject. Civil offenses refer to non-criminal violations (e.g., breach of contract, torts), which tracing of financial transactions like loan proceeds is not directly designed to uncover.

This is not a recognized purpose of tracing as taught in the CFE Investigation section. The core objectives revolve around uncovering hidden assets, hidden accounts, payments, and potential witnesses — not prior legal infractions.

Therefore, the correct answer is A, as it is the only option that is NOT true according to official CFE investigation materials.

Before pursuing litigation, fraud examiners are advised to consider whether nonlegal remedies (e.g., restitution agreements, settlements, insurance recovery) are possible, since legal actions can be costly, slow, and uncertain. Statutes of limitation and guilt are legal issues for attorneys and courts, but examiners must weigh recovery options first.

The correct answer is A. A fraudulent conveyance. The CFE Manual states that debtors often attempt to conceal assets by transferring them to another person or company, and a transfer is considered a fraudulent conveyance if its purpose is to hinder, delay, or defraud a creditor. In this question, Bob transferred one of the company’s luxury vehicles to his wife just one week before the business filed for bankruptcy. That timing strongly suggests an attempt to move valuable property out of the reach of creditors before the bankruptcy estate is formed.

Option B is too broad because “fraudulent bankruptcy” is not the specific scheme described. Option C is not the standard label used in the Manual for this kind of transfer. Option D, a planned bustout, refers to a different scheme involving building up credit with suppliers and then collapsing the business without payment. The facts here center on the transfer of an asset to a related party to keep it away from creditors, which is the classic definition of a fraudulent conveyance under the CFE Law materials. Accordingly, A is the most accurate answer.

The Fraud Examiners Manual lists required steps before seizing evidence:

Obtain legal authority.

Review privacy issues.

Ensure software/hardware are validated.

Document surroundings, inspect for traps, image drives, etc.

There is no requirement to assemble a team exclusively of outside experts.

Before seizing evidence in a digital forensic investigation, the 2014 International Fraud Examiners Manual outlines several critical steps:

Obtain legal authority / review orders:

“Before obtaining evidence, ensure that there is legal authority to seize evidence and review the data associated with the evidence. This might require obtaining a warrant in a criminal matter or ensuring that internal policies authorise seizure for an internal investigation.”

Determine privacy issues:

“Before the fraud examiner can seize evidence, he must take certain steps to help ensure that the evidence will be admissible: He must determine whether there are any privacy interests in the item(s) to be searched… In every case where it becomes necessary to seize a computer or other device capable of storing digital evidence, the investigator should consult with legal counsel.”

Use only trained professionals/software:

“It is important to allow a trained examiner to conduct a proper seizure and examination of digital evidence to help ensure that the information can be used in a legal proceeding.”

✅ These are all valid required steps.

In contrast, the idea that the team must be composed only of outside digital forensic experts is NOT a required step. The Manual stresses flexibility in team composition:

“Some organisations have their own in-house personnel… while others might prefer the use of an outside examiner. Sometimes retrieving digital data is as easy as searching the target computer’s hard drive, but other times retrieval requires a thorough knowledge of computers.”

Thus, requiring only outside experts is not a standard step, since investigations may use internal, external, or a mix of specialists depending on the situation.

This question tests your knowledge of Domain 7.

In the context of Individual Rights During Examinations, specifically relating to employee, the question asks about TRUE, ABC.

The correct answer is B: Marcia must have failed to disclose that she had a personal or economic interest in a matter that could influence her professional role..

This question relates to individual rights during examinations. The correct answer accurately describes the legal protections, obligations, or privacy considerations that apply in workplace investigations. Fraud examiners must balance investigative needs with legal protections for individuals.

This question tests your knowledge of Domain 6.

In the context of Tax Fraud, specifically relating to tax evasion, wealth tax, the question asks about MOST LIKELY.

The correct answer is D: An income and wealth tax evasion scheme.

This question focuses on tax fraud concepts. The correct answer distinguishes between legal tax avoidance and illegal tax evasion, or identifies specific tax evasion schemes. Tax fraud investigations require specialized knowledge of tax laws and common evasion techniques.

Both the Manual and CFE Prep guides emphasize that forensic imaging is essential because:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging… allows a fraud examiner to view and analyse… without altering the original data in any way”.

A forensic image is an exact, sector-by-sector copy of the drive. Thus, imaging preserves evidence integrity.

The correct answer is B. Mail fraud. Mail fraud generally involves using the postal system in furtherance of a scheme to defraud. In this question, Cindi used the U.S. mail system to send fraudulent advertisements to potential victims. That use of the mail is the key jurisdictional hook that would most likely support federal prosecution. The fact that the victims are located in China does not change the central point that the U.S. mail system was used as part of the fraudulent scheme.

Option A, wire fraud, would apply more naturally if the scheme were carried out by electronic communications such as telephone calls, emails, internet transmissions, or other interstate or international wire communications. Option C, communications fraud, is not the standard offense name typically used in this context. Option D, interstate fraud, is also not the most precise legal label for prosecution under these facts. In fraud law, prosecutors often rely on statutes such as mail fraud and wire fraud because they are broad and effective tools for prosecuting deceptive schemes. Since the question specifically states that Cindi used the U.S. mail system, the most likely basis for the charges would be mail fraud, making B the correct answer.

This question tests your knowledge of Domain 10.

In the context of Basic Principles of Evidence, specifically relating to privilege, the question asks about MOST ACCURATE.

The correct answer is B: The privilege might have been waived because Katrina transmitted the protected information to a third party who has no need to know the information..

This question tests knowledge of evidence principles. The correct answer correctly distinguishes between types of evidence, admissibility requirements, or evidentiary privileges. Proper handling of evidence is crucial for successful fraud investigations and prosecutions.