CFE-Investigation ACFE Certified Fraud Examiner (CFE) - Investigation Free Practice Exam Questions (2025 Updated)

The manuals explain that in verbal confessions, subjects oftenunderestimatethe amounts to minimize guilt, not overestimate. The process involves moving from accusation to benchmark admission, handling lies tactfully, and obtaining details by chronology, transaction, or event. Thus, optionBis NOT true.

TheFraud Examiners ManualandCFE Prep Guideboth state:

“In an admission-seeking interview, the interviewer should transition to the verbal confessionwhen the accused furnishes the first detailed information about the offence. There are three approaches to obtaining the confession: chronologically, by transaction, or by event”.

Thus,Bis the true statement.

Court records are frequently used in fraud investigations. Both the Prep Guide and the Manual agree thatthe court clerk’s office (court authorities) is the original and most reliable sourceof certified and accurate records.

Although commercial services and online databases exist, the manuals emphasize that reliability and certification are best ensured by going directly to the court where the case was filed.

Thus, the statement isTrue.

“The interviewer generally should indicate his name and company, but he should avoid stating his title. In general, the more informal the interview, the more relaxed the respondent”.

Introducing oneself only by name and company (not title like CFE or auditor) avoids intimidation and builds cooperation.

The best practices for signed statements include:

Adding omitted facts as anaddendum.

Preparingseparate statements for unrelated offenses.

Havingwitnesses to the signing.

But:

“The signed statement should be reduced to a short and concise written statement. The interviewer should prepare the statement and present it to the confessor for his signature” .

Thus, requiring the suspect to handwrite the entire statement isnot a best practice.

TheFraud Examiners Manualstresses confidentiality:

“To preserve confidentiality, investigators should avoid transmitting confidential information by email or other electronic means whenever possible, as these are susceptible to interception or unauthorized access.”

Suspending employees or blanket bans on discussion are not best practices. Confidentiality is preserved primarily by secure communication and controlled access to information.

Limitations of online public record searches include:

Need to search multiple jurisdictions.

Records are often only abstracts.

Information must be verified for accuracy.There isno mentionthat online record vendors are “difficult to find.” In fact, many such vendors exist.

TheFraud Examiners Manualnotes:

“Management of an organisation should ensure that the organisation has a proper and effective document retention policy in place… An effective policy requires clear retention protocols… and should be immobilised due to a pending investigation or foreseeable litigation.”

Thus, the existence of a document retention policy is a critical factor in deciding how to dispose of evidence.

“Before commencing a formal investigation (and especially before starting the evidence collection process), it might be necessary to prepare the subject organisation… such as preparing the managers of the employees who will be involved in the investigation, notifying key decision makers, and notifying the organisation’s legal counsel”.

It is not good practice to notify the entire workforce or inform the suspect.

According toCFE Prep – Investigations:

“In most jurisdictions, income tax records are not public records and cannot be accessed for pre-employment purposes”.

Common public sources include court, property, licensing, and utility records.Thus, searching income tax filings isnota common use of public sources.

According to CFE guidance, when planning interviews, fraud examiners should:

“Consider what the interview is intended to accomplish and state an objective.

Review the case file to ensure that important information has not been overlooked.

Prepare a list of topics and general questions.

Choose a neutral and nonthreatening environment so the subject does not feel intimidated.”

Holding the interview in a venue intended to make the subject feel uncomfortableviolates proper CFE interview practice. Hence,Dis correct.

“In jurisdictions that regulate credit information and personal data, a fraud examiner will generally need a legally acceptable reason for accessing such information from third parties… some common circumstances include when: the individual has given consent”.

Thus, with the individual’s consent, Leslie could obtain the report.

“Internal sources will sometimes be the only resource for certain types of documents—such as… employee personnel files—unless the fraud examiner has the subject’s consent or a legal order”.

External searches may reveal addresses, assets, or competitor ownership, butpersonnel files require internal/non-public access.

“To locate people using online records… First, when searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

This aligns with the Prep guide: “Obtaining a past address of the subject should be the first step in trying to locate a subject using online records”.

Thus, B is correct.

When introducing themselves, fraud examiners should avoid titles likeinvestigatororCertified Fraud Examinerthat might raise suspicion or defensiveness. TheManualrecommends using neutral titles such asauditorbecause it is less threatening and more acceptable in an organizational setting.

“Once a denial is uttered, it becomes extremely difficult for the accused to change his response, because doing so would be an admission that he lied. Therefore, the interviewer must prevent an outright denial, thereby making it easier for the subject to confess”.

“One of the most effective techniques to stop or interrupt a denial is through a delaying tactic… the interviewer should attempt to delay the outright denial; he should not argue with the accused”.

Thus, Charles should interrupt with a delaying tactic.

The2014 International Fraud Examiners ManualandCFE Prep - Investigationsexplicitly state:

“Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. … when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.”

Thus, the correct answer isC.

The Fraud Examiners Manual states that admission-seeking interviews should avoid yes/no questions like“Did you steal the money?”because they encourage denials. Instead, the question should be phrased as if guilt has already been established. The Manual explicitly warns:

“The accusation should be made in the form of a statement; it should not be made in the form of a question… Avoid emotive words such as steal, fraud, and crime… Example:‘It is not so much a question of what you did, but why you did it.’”

Thus, the most effective admission-seeking phrasing is:“Why did you take the money?”because it presumes involvement and encourages explanation rather than denial.

The manual explains:

“Link analysis is very effective for identifying indirect relationships… and is particularly useful when conducting a money laundering investigation because it can track the placement, layering, and integration of money” .

Therefore, statementA is false, making it the correct choice.