CFE-Investigation Sample Questions Answers

The Fraud Examiners Manual explains:

“A Certified Fraud Examiner should not promise confidentiality or leniency to an informant to obtain testimony… the confidentiality relationship runs first to the client or employer”.

Thus, Lisa cannot guarantee full confidentiality but may state she will do her best.

The recommended questioning order is:

“As a general rule, questioning should proceed from the general to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

Fraud examination reports are not written only for internal use. The 2014 International Fraud Examiners Manual clearly emphasizes:

“When drafting a report, fraud examiners must consider who might end up reading it. Fraud examiners should keep in mind that the fraud examination report will be read by the general public and adverse parties. Under no circumstances should the fraud examiner prepare a communication with the idea that the information will not be disclosed to adverse third parties. Fraud examiners should draft their reports with this caveat in mind.”

The manual further specifies the wide range of potential readers:

*“There are many individuals and groups that might end up reading a fraud examination report, including the following parties:

Company insiders (managers, board of directors, owners, investors, etc.)

Attorneys (legal counsel, prosecutors, regulators, and defense counsel)

Defendants and witnesses

Press and media outlets

Judges or juries”*

This aligns with the CFE Prep - Investigations study guide, which also confirms:

“There are many parties that might read a fraud examination report, including company insiders, attorneys, defendants and witnesses, press and media outlets, and judges or juries.”

???? Interpretation:

The media may access the report through litigation disclosures or leaks.

Opposing legal counsel will review the report during discovery or trial.

Investors and owners (company insiders) are primary stakeholders.

Thus, the only correct choice is D. All of the above, because fraud examination reports must be written with all possible audiences in mind, ensuring accuracy, clarity, impartiality, and professionalism to withstand scrutiny from multiple directions.

“Once a suspect utters a denial, it becomes extremely difficult… therefore, the interviewer must prevent an outright denial. Fraud examiners can use several techniques to stop or interrupt denials, including delays, repeated interruptions, and reasoning”.

Thus, the correct answer is D.

The CFE Prep – Investigations states:

“If a fraud examiner gets a verbal confession from the fraudster, it does not matter whether the fraudster claims his conduct was an accident. The following items of information should be obtained … admission that the accused knew the conduct was wrong, facts known only to the confessor, the accused’s motive, approximate dates, involvement of others, physical evidence, and disposition of illicit income.”

Thus, the examiner does not need a statement about accident.

Observing signs of wealth (sports car, home remodeling) may raise suspicion, but by itself it does not provide sufficient predication to accuse or notify management of fraud. The proper next step is to conduct discreet inquiries to determine if further evidence exists before escalating.

When dealing with potentially hostile or volatile interviewees, fraud examiners are advised not to give much advance notice. This reduces the chance that the subject will prepare evasive or combative responses. The Fraud Examiners Manual emphasizes minimizing preparation time for resistant interviewees to ensure more candid responses.

CFE interview guidance identifies verbal behaviors that often appear when an interviewee is being deceptive. A strong indicator is answering with a question rather than providing a direct denial. When asked directly about misconduct, truthful respondents commonly give a straightforward “no” and may add clarifying facts. Deceptive respondents sometimes deflect, buy time, or attempt to regain control by replying with a question such as, “Why would I do something like that?” This response avoids the substance of the allegation and shifts the burden back to the interviewer, potentially probing how much evidence the interviewer has. While Options A, B, and D are denials (and any denial could be untrue), the CFE materials specifically flag “answering with a question” as a frequent deceptive tactic because it functions as diversion and can indicate discomfort with issuing a clear denial. Therefore, among the choices presented, Option C is most consistent with a deceptive verbal response pattern described in CFE interview methodology.

Websites ending in “.onion” are only accessible via specialized browsers (e.g., Tor). The Fraud Examiner prep materials note:

“.onion sites are part of the dark web, which is distinct from the surface web and deep web. Accessing requires specialized browsers” (CFE Prep – Investigations).Thus, Jade must use a dark web browser.

The Fraud Examiners Manual notes that when witnesses become hostile or argumentative, the interviewer should generally remain calm and avoid reacting to hostility. Reacting, reasoning, or arguing often escalates the situation. Instead, the interviewer should maintain control and neutrality .

The manual and CFE Prep list the main limitations:

Coverage varies by jurisdiction.

Searches are limited in area.

Records are often abstracts.

Information may be inaccurate or outdated.

Searches can be erratic.

Nowhere is “difficulty in finding database companies” mentioned.

The manual defines:

“Open questions are those worded in a way that makes it difficult for the respondent to answer ‘yes’ or ‘no.’ The typical open question calls for a monologue response and can be answered in several different ways.”

Example given: “Please tell me about your job.”

Allison’s question (“Why did you choose to do business with that vendor?”) invites explanation, not a yes/no response — making it an open question.

The Fraud Examiners Manual explains that recommendations in a report are optional, not mandatory. When included, they should cover remedial measures such as control reviews or increased security.

“Finally, the fraud examiner might decide to include a section for recommendations. The recommendations section should contain remedial measures or specific recommendations for follow-up actions … This section is optional”.

Therefore, C is correct. Options A and D are incorrect because recommendations are not required in every report, and B misstates its purpose.

The Fraud Examiners Manual explains that before obtaining or cleansing data, the first step in using data analysis is the planning phase. This includes understanding the data, articulating objectives, and building a profile of potential frauds. Without this, examiners risk inefficient analysis and overlooking key fraud risks.

✅ Answer: C. Build a profile of potential frauds

The CFE Prep – Investigations warns against relying solely on eye contact:

“Behavioural clues are harder to read … Additionally, racial, ethnic, and economic factors should be carefully considered when observing a respondent’s behaviour. Some cultures, for example, discourage looking directly at someone. Other cultures use certain body language that might be misinterpreted.”

Therefore, lack of eye contact cannot safely be taken as proof of dishonesty.

Fraud examiners must not opine on guilt, innocence, intent, or disposition. Reports should focus on facts and expert conclusions within their field. The Manual stresses:

“The fraud examiner should refrain from expressing opinions as to the guilt or innocence of any person or entity. Such conclusions are reserved for the trier of fact” (Fraud Examiners Manual, Reporting section).

Options A, B, and D relate to accounting and internal control assessments, which fall within an accounting expert’s scope. Only C is improper because it speculates about the suspect’s character or intent, which is outside the CFE’s role.

“The interviewer must not express disgust, outrage, or moral condemnation… the basic logic of obtaining confessions can be summed up as maximize sympathy and minimize the perception of moral wrongdoing”.

Sympathy creates an environment conducive to confession, while other options (third-party presence, emphasizing immorality, or pressuring with time) are explicitly discouraged.

Explanation with Extracts = The Fraud Examiners Manual explains:

“Conducting digital forensic investigations in the cloud environment (i.e., cloud forensics) presents challenges not faced in traditional forensic practices… Some of the important challenges… Lack of frameworks and specialist tools, Lack of information accessibility, Lack of data control, Jurisdiction of storage…” .

Specifically: “With cloud computing, clients of cloud service providers do not have physical control of the media or the network on which their data resides, and this lack of data control can complicate efforts to collect data stored on the cloud” .

Thus, lack of data control is a unique challenge.

Before pursuing litigation, fraud examiners are advised to consider whether nonlegal remedies (e.g., restitution agreements, settlements, insurance recovery) are possible, since legal actions can be costly, slow, and uncertain. Statutes of limitation and guilt are legal issues for attorneys and courts, but examiners must weigh recovery options first.

The Fraud Examiners Manual explains that rather than drafting an exhaustive list of questions, the interviewer should:

“formulate a brief outline of key points to discuss during the interview”.

This helps organize thoughts while allowing flexibility.

Nonverbal deception cues include feigned unconcern, slouching, chewing objects, and manipulating clothing. Michelle’s conduct (chewing pen cap, picking at fabric, appearing unconcerned) matches these signs of deception.

According to the Fraud Examiners Manual:

“Credit card records are important in tracing assets… information on credit card charges might provide leads to identifying hidden assets. For example, if a fraud examiner notices that the subject used his credit card to purchase items at a marina, the fraud examiner should investigate further to determine if the subject owns a boat”.

Therefore, A is correct.

CFE interviewing guidance distinguishes among open, closed, and leading questions used during the fact-gathering portion of an interview. Closed questions require a precise, specific answer—commonly “yes/no,” but also specifics such as dates, amounts, and times. The question “What year did you start working in the accounting department?” seeks a specific date-like fact (a particular year) rather than inviting a narrative explanation. That is the hallmark of a closed question: it restricts the response to a narrow factual point and does not encourage expansive detail. By contrast, open questions (e.g., “Please describe the procedures to me”) are designed to elicit a broader, more descriptive answer. Leading questions are framed to suggest the answer and are often used to confirm information already known, whereas Quincy’s question does not embed a suggested response—he is simply requesting a specific historical fact. Therefore, under CFE definitions, this question is most accurately classified as closed.

“The failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding, or, even if admitted, it might not be given much weight because evidence of questionable authenticity does not provide reliable proof.”

Therefore, D is the most accurate statement.

Both the Manual and CFE Prep guides emphasize that forensic imaging is essential because:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging… allows a fraud examiner to view and analyse… without altering the original data in any way”.

A forensic image is an exact, sector-by-sector copy of the drive. Thus, imaging preserves evidence integrity.

“Internal sources will sometimes be the only resource for certain types of documents—such as… employee personnel files—unless the fraud examiner has the subject’s consent or a legal order”.

External searches may reveal addresses, assets, or competitor ownership, but personnel files require internal/non-public access.

“To locate people using online records… First, when searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

This aligns with the Prep guide: “Obtaining a past address of the subject should be the first step in trying to locate a subject using online records”.

Thus, B is correct.

The Fraud Examiners Manual notes that EU privacy laws (e.g., EU Data Protection Directive, precursor to GDPR) restrict or prohibit the transfer of personal data to non-EU countries without compliance:

“Many foreign countries—and those in the European Union (EU) in particular—restrict or prohibit processing and transferring personal data… The EU’s directive… places limits on transmitting personal data to non-EU countries”.

Thus, since the fraud examiner is handling data about an EU-based employee, GDPR compliance is required, even if the examiner is outside the EU.

According to CFE Prep – Investigations:

“In most jurisdictions, income tax records are not public records and cannot be accessed for pre-employment purposes”.

Common public sources include court, property, licensing, and utility records.Thus, searching income tax filings is not a common use of public sources.

The Fraud Examiners Manual defines double-negative questions as those containing two forms of negation in a single clause. They are confusing and “often suggest an answer opposite to the correct one.” The example given is almost identical to the question here:

“Didn’t you suspect that something wasn’t right?”.

Thus, Sylvia’s question is a double-negative question, which should be avoided.

The organizational filings with the government of the jurisdiction in which the company is incorporated

Organizational filings (e.g., articles of incorporation) are generally public records and include ownership information, initial shareholders, and the location of the principal office.

Phone records are classified as nonpublic records. The Fraud Examiners Manual explains that personal telephone and mobile records usually require consent, subpoena, or warrant to access. Public records, by contrast, include real property ownership and corporate filings. Therefore, B is correct.

“Signs of stress do not always mean that a subject is lying… While lying and deception do cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

The Prep guide confirms: “While lying and deception do indeed cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying”.

Therefore, Carlos should not automatically conclude deception from stress behaviors.

The Fraud Examiners Manual states:

“The primary concern when analysing digital evidence is to maintain the integrity of the data at all times. Fraud examiners must be careful with computer equipment because a careless investigator might inadvertently alter important evidence”.

Examiners must look for both inculpatory and exculpatory evidence.

“Alibis generally can be diffused by displaying physical evidence… evidence should be displayed one piece at a time, in reverse order of importance”【16:2014 International Fraud Examiners Manual.pdf†L11-L14】.

The Prep Guide warns: “The proper technique is not to lay it all out at once” .

Thus, showing everything at once is the least effective.

Nonpublic records include banking, tax, credit, phone, credit card, and health care records.

Business entity organisational filings (corporate constitutions, articles of incorporation) are generally public records and can be obtained from the government.

Therefore, reviewing a company’s business filings does not require access to nonpublic records.

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

The Internet archives (e.g., the Wayback Machine at archive.org) allow fraud examiners to retrieve prior versions of web pages, including deleted content such as company statements.

✅ Answer: C. The internet archives

“Metadata information can help determine who wrote a document, who received, opened, copied, edited, moved, or printed the document, and when these events occurred”.

Thus, metadata is the best source for creation date.

“Fraud examinations should proceed from the general to the specific. That is, they should begin with general information that is known, starting at the periphery, and then move to the more specific details”.

This method avoids premature assumptions and ensures systematic evidence development.

The CFE Prep Guide clarifies:

“A fraud response plan outlines the actions… when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success”.

Thus, statement D is false.

CFE investigative guidance recognizes online databases as valuable tools for locating public records quickly, but it also highlights practical limitations. The most significant limitation is that availability and coverage differ widely by jurisdiction. Some jurisdictions provide extensive online access to court files, property records, corporate registrations, and liens, while others provide limited access, partial indexing, or require in-person requests. This variability affects completeness and can create false negatives (records exist but are not available electronically). The guidance also cautions that online results may be abstracts, may not include supporting documentation, and can lag behind official updates—so investigators should verify key records with the originating agency when accuracy and completeness matter. Option A is not the primary limitation described; the more common problem is incomplete access rather than excessive detail. Option C is too absolute; errors can occur, but CFE methodology emphasizes validation, not the claim that records are “rarely correct.” Option D is also overstated; while source credibility matters, the fundamental limitation is uneven jurisdictional availability and completeness.

After alibis are diffused, suspects may become quiet, withdrawn, or even cry. This often indicates they are considering confession. At this point, the interviewer should present an alternative question, forcing a choice between two answers that both imply guilt, thus leading toward a benchmark admission.

Best practices for admission-seeking interviews emphasize building rapport, presenting a morally acceptable reason, and maintaining empathy to encourage a confession. The manual states examiners should “present a morally acceptable reason for the suspect’s behavior” and avoid creating hostility . Minimizing empathy is counterproductive and not recommended.

Credit reports can sometimes be obtained legally if proper consent or a recognized legal basis (such as employment background checks, extension of credit, or legal proceedings) exists. The Manual notes:

“Access to personal credit data may be permitted when the individual has given consent or when required for employment, credit, or legal reasons”.

Thus, it is not true that credit data can never be obtained—circumstances exist where it can be done lawfully.

The Fraud Examiners Manual states that admission-seeking interviews should avoid yes/no questions like “Did you steal the money?” because they encourage denials. Instead, the question should be phrased as if guilt has already been established. The Manual explicitly warns:

“The accusation should be made in the form of a statement; it should not be made in the form of a question… Avoid emotive words such as steal, fraud, and crime… Example: ‘It is not so much a question of what you did, but why you did it.’”

Thus, the most effective admission-seeking phrasing is: “Why did you take the money?” because it presumes involvement and encourages explanation rather than denial.

Within CFE investigation guidance on data analysis, predictive approaches are framed as using analytical techniques (including statistical processes and machine learning) to identify patterns and outliers that can indicate fraud risk and, importantly, help detect a fraudulent situation earlier than traditional methods. Predictive analytics is not limited to one specific technology such as layered neural networks (A); neural networks can be one possible technique, but predictive analytics is broader than that. Option B describes robotic process automation (RPA)—software that imitates human actions to automate routine tasks—rather than predictive analytics. Option D describes artificial intelligence in a general sense (systems performing “human tasks” like perception and decision-making), which is also broader and not specific to predictive modeling. The most accurate description is therefore C: predictive analytics uses historical data along with statistical analysis and machine learning methods to build models that reflect patterns/trends and generate projections about likely future outcomes (e.g., predicting which transactions, vendors, employees, or accounts are higher-risk).

The Fraud Examiners Manual defines compliance verification as:

“Compliance verification determines whether company policies are met by employee transactions. For example, when employees are out of town, do they adhere to the company policy of not spending more than $30 a day for meals?” .

Thus, the correct function is compliance verification.

Body language alone (e.g., avoiding eye contact) cannot be taken as proof of deception. The Manual warns against drawing conclusions from a single behavioral cue:

“Avoiding eye contact is not directly linked to deception. Such behavior could stem from cultural norms, nervousness, or personality traits. Examiners should consider clusters of behavior, context, and corroborating evidence before concluding deception”.

Therefore, C is correct.

The Fraud Examiners Manual and CFE Prep emphasize:

“Generally, documentary evidence, including digital evidence, will not be admitted in a legal proceeding unless it is established as authentic… Consequently, fraud examiners who collect evidence from social media must capture, download, and preserve any useful information as soon as they discover it, and they must memorialize each step of the collection process”.

Thus, preservation for authenticity is the key.

The manual emphasizes that interviews—especially with subjects in other jurisdictions—pose legal and cultural considerations. Fraud examiners must consider cultural norms (such as personal space, body language, and eye contact) and jurisdiction-specific laws governing the use of information from interviews. In particular, some jurisdictions limit how interview information can later be used. Therefore, the most accurate statement is that the examiner should verify such limitations before proceeding.