CFE-Investigation ACFE Certified Fraud Examiner (CFE) - Investigation Free Practice Exam Questions (2026 Updated)

“Records obtained from financial institutions are perhaps the single most important financial source available to a fraud examiner for tracing purposes. They can be used as evidence for fraud, uncover criminal profits, identify criminal assets, and locate assets”.

The 2014 International Fraud Examiners Manual provides:

“Fraud examiners can use a correlation analysis to determine the relationships between different variables in raw data… For example, there should be a strong correlation between the independent and dependent variables because there is a direct relationship between them. Hotel costs should increase as the number of days travelled increases.”

CFE Prep – Investigations echoes this:

“Using the correlation analysis function, fraud examiners can determine the relationships between different variables in the raw data. For example… Hotel costs should increase as the number of days travelled increases.”

Thus, the most useful analysis is Correlation analysis.

The Fraud Examiners Manual stresses confidentiality:

“To preserve confidentiality, investigators should avoid transmitting confidential information by email or other electronic means whenever possible, as these are susceptible to interception or unauthorized access.”

Suspending employees or blanket bans on discussion are not best practices. Confidentiality is preserved primarily by secure communication and controlled access to information.

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

Detailed Explanation with Extracts = The Fraud Examiners Manual states:

“When reporting the results of a fraud examination, it is best to include copies (not originals) of important documents in the formal report”.

Originals should be safeguarded separately for evidence; reports should use copies.

Therefore, the statement is true.

The Fraud Examiners Manual specifies that admission-seeking interviews should only be conducted when:

“There is a reasonable probability that the respondent has committed the act in question.

All other reasonable investigative steps have been completed.

The interviewer can reasonably control the place, time, and subject matter of the interview.”

There is no requirement that the examiner must be sure no one else was involved. Therefore, C is correct.

The Fraud Examiners Manual notes that when witnesses become hostile or argumentative, the interviewer should generally remain calm and avoid reacting to hostility. Reacting, reasoning, or arguing often escalates the situation. Instead, the interviewer should maintain control and neutrality .

The manual and CFE Prep list the main limitations:

Coverage varies by jurisdiction.

Searches are limited in area.

Records are often abstracts.

Information may be inaccurate or outdated.

Searches can be erratic.

Nowhere is “difficulty in finding database companies” mentioned.

CFE investigative guidance recognizes online databases as valuable tools for locating public records quickly, but it also highlights practical limitations. The most significant limitation is that availability and coverage differ widely by jurisdiction. Some jurisdictions provide extensive online access to court files, property records, corporate registrations, and liens, while others provide limited access, partial indexing, or require in-person requests. This variability affects completeness and can create false negatives (records exist but are not available electronically). The guidance also cautions that online results may be abstracts, may not include supporting documentation, and can lag behind official updates—so investigators should verify key records with the originating agency when accuracy and completeness matter. Option A is not the primary limitation described; the more common problem is incomplete access rather than excessive detail. Option C is too absolute; errors can occur, but CFE methodology emphasizes validation, not the claim that records are “rarely correct.” Option D is also overstated; while source credibility matters, the fundamental limitation is uneven jurisdictional availability and completeness.

The Fraud Examiners Manual explains:

“Benford’s Law applies to data that is not assigned (such as IDs or phone numbers) but that occurs naturally in transactions. For example, payment amounts, invoice values, and expense reimbursements are well suited.”

Thus, payment amounts are best suited for Benford’s Law.

Guidance on reports:

“A fraud examination report should be accurate, clear, and impartial. The fraud examiner should avoid technical jargon where possible and write in plain language so that readers without specialized knowledge can understand”.

Reports should only include relevant, factual findings—not every detail or opinion.

So, the most accurate statement is that jargon should be avoided.

The Fraud Examiners Manual notes:

“Fraud examiners are often tasked with tracing illicit transactions… For example, a victim of fraud might want a tracing search to facilitate the recovery of criminal proceeds”.

“Alibis generally can be diffused by displaying physical evidence… evidence should be displayed one piece at a time, in reverse order of importance”【16:2014 International Fraud Examiners Manual.pdf†L11-L14】.

The Prep Guide warns: “The proper technique is not to lay it all out at once” .

Thus, showing everything at once is the least effective.

Benford’s Law applies to naturally occurring sets of numbers such as invoice amounts, expense reports, and transaction data. The Fraud Examiners Manual shows Benford’s Law tests applied to vendor payments to detect anomalies like duplicate or inflated invoices. Telephone numbers, employee IDs, and bank account numbers are assigned numbers and do not follow Benford’s distribution, so they are unsuitable for this test.

The calibration (or norming) process in interviews is meant to establish a baseline of the subject’s normal verbal and nonverbal behavior. This is done by asking noncritical background questions so that later deviations can be more reliably identified.

From the CFE Prep guide:

“The proper way an interviewer should start the calibration (norming) of a witness is through the use of: Noncritical questions on background information. … Examples of noncritical questions include ‘When did you start with the company?’ and ‘How long is your commute?’”.

Thus, the correct answer is D. “How many jobs have you had before this one?” since it is a nonthreatening background question.

The recommended questioning order is:

“As a general rule, questioning should proceed from the general to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

The Manual says admission-seeking interviews should be conducted only when:

There is reasonable probability the subject committed the act,

All other reasonable investigative steps are complete, and

“The interviewer can reasonably control the place, time, and subject matter of the interview.”.Therefore, Erica must ensure control of time, place, and content before scheduling.

“Documentary evidence, including digital evidence, will not be admitted… unless it is established as authentic… fraud examiners must capture, download, and preserve any useful information as soon as they discover it, and memorialize each step of the collection process”.

Websites ending in “.onion” are only accessible via specialized browsers (e.g., Tor). The Fraud Examiner prep materials note:

“.onion sites are part of the dark web, which is distinct from the surface web and deep web. Accessing requires specialized browsers” (CFE Prep – Investigations).Thus, Jade must use a dark web browser.