Invest Flashcards

1
Q

Which of the following functions does a Benford’s Law analysis help to achieve?
A. Measuring the relationship between items on financial statements by expressing accounts as percentages
B. Extracting usable information from unstructured text data
C. Identifying fictitious numbers
D. Identifying duplicate payments

A

Identifying fictitious numbers
The goal of a Benford’s Law analysis is to identify fictitious numbers. Benford’s Law provides that the distribution of the digits in multi-digit natural numbers is not random; instead, it follows a predictable pattern. That is, Benford’s Law maintains that certain digits show up more than others do when dealing with natural numbers. A “1” appears as the first non-zero digit roughly 30 percent of the time; “2” is the leading digit almost 18 percent of the time; and “9” leads off only 4.6 percent of the time. Moreover, “0” is most likely to be the second digit, appearing 12 percent of the time.

Many fraudsters fail to consider the Benford’s Law pattern when creating false documentation or transactions to cover their tracks. Consequently, testing data sets for the occurrence or non-occurrence of the predictable digit distribution can help identify included numbers that are not legitimate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Generally, the rules of admissibility for digital evidence are stricter than such rules for tangible evidence.
A. True
B. False

A

False
Although digital evidence is different from—and more volatile than—tangible evidence, the rules regarding the admissibility of digital evidence in court are really no different from the rules regarding the admissibility of any other type of evidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

To protect privacy interests, courts generally find that audit clauses within business partner contracts are void, and most jurisdictions have laws that prohibit businesses from making threats to terminate a business relationship over a contracting party’s refusal to turn over nonpublic information.
A. True
B. False

A

False
There are several ways to obtain nonpublic information. An organization may demand that a supplier, vendor, or agent turn over relevant documents as a condition of continued business. Taking this action is legal, in appropriate circumstances. Of course, management and counsel should be consulted before such demands are made, particularly if the other party has a contractual relationship with the demanding organization.

An audit clause allows parties to a contract the right to access another party’s books. Often, audit clauses are too narrow to provide useful information. However, if properly constructed, an audit clause can be a powerful method by which on-book information can be obtained.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

If a fraud examiner working in the United States needs information on registration and disciplinary information regarding firms and individuals in the U.S. futures industry, he should contact the Financial Industry Regulatory Authority (FINRA).
A. True
B. False

A

False
The National Futures Association (NFA) is an industry-wide, self-regulatory organization authorized by the U.S. Commodity Exchange Act; it operates under the supervision of the Commodity Futures Trading Commission (CFTC). The NFA oversees the commodities markets, and it is a one-stop information source for all types of registration and disciplinary information regarding firms and individuals in the futures industry. This information includes registration status and employment history; disciplinary actions filed by the NFA, the CFTC, and the commodity exchanges; and customer complaints filed under the CFTC’s Reparations Program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A Uniform Commercial Code (UCC) filings search can help identify:
A. A list of companies that an individual is an officer or registered agent of
B. Personal property that an individual or business has financed
C. Real estate ownership information
D. All of the above

A

Personal property that an individual or business has financed
A search of Uniform Commercial Code (UCC) filings can help fraud examiners identify personal property that an individual or business has financed. These filings identify:
•Name of the debtor or joint debtors
•Current address of the debtors
•Name of the financial lender
•Type of collateral pledged as security
•Date of filing and continuations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

When a fraud examiner prepares a memorandum reflecting the information furnished by a confidential source, how should the fraud examiner identify the source?
A. The fraud examiner should use symbols to denote the source’s identity.
B. The fraud examiner should not write confidential source information in a memorandum.
C. The fraud examiner should identify the source by the source’s full name.
D. The fraud examiner should identify the source using the source’s initials.

A

The fraud examiner should use symbols to denote the source’s identity.
It is recommended that all contact with informants and sources be reported on a memorandum, although the confidential source or informant’s identity should not be included in the report. Instead of including the source or informant’s identity, the fraud examiner should use symbols to denote the source’s identity. It is further recommended that sources be preceded with an “S,” followed by a unique identifier (i.e., source #1 would be “S-1”; source #2 would be “S-2”). The symbols for informants would then be “I-1” and “I-2.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q
In interview situations, a(n)\_\_\_\_\_\_\_\_\_\_\_\_\_\_ is any social-psychological barrier that impedes the flow of relevant information by making the respondent unwilling or unable to provide information to the interviewer.
 A. Inhibitor   
 B. Facilitator    
 C. Repressor   
 D. Antecedent
A

Inhibitor
To be an effective interviewer, one must understand that certain matters inhibit communication, while others facilitate it. It is the interviewer’s task to minimize inhibitors and maximize facilitators. An inhibitor is any social-psychological barrier that impedes the flow of relevant information by making the respondent unable or unwilling to provide the information to the interviewer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
Which of the following is the LEAST appropriate participant on a team assembled to investigate fraud?
 A. Security personnel   
 B. Suspect's supervisor  
 C. Legal counsel  
 D. Auditors
A

Suspect’s supervisor
Fraud examinations usually require a cooperative effort among different areas of expertise; therefore, if members of management decide to investigate suspicions of fraud, they must determine who should lead and be involved in the investigation.

Typically, participants on a fraud investigation team should not include individuals with vested personal or corporate interest in the matter or individuals with a close personal or professional relationship with the subject or the complainant. Thus, in most situations, the suspect’s supervisor should not be included on a fraud investigation team.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following situations would the U.S. Privacy Act of 1974 regulate?
A. A financial institution gathering credit data on consumers and businesses
B. A federal agency distributing the medical and employment history of various individuals
C. A private individual collecting and maintaining information about other individuals
D. A consumer reporting agency selling information to a background researcher

A

A federal agency distributing the medical and employment history of various individuals
The U.S. Privacy Act of 1974 establishes a code of information practices that regulates the collection, maintenance, consumption, and distribution of personally identifiable information that is maintained by federal agencies. It restricts information about individuals, both employees and nonemployees, and it applies to governmental agencies and government contractors running a system of records on behalf of the government. The Privacy Act prohibits an agency from disclosing such information without the written consent of the subject individual.

Under the Act, an agency may maintain records about a person containing information that is relevant and necessary to accomplish a purpose of the agency. This information may include a person’s education, finances, medical history, criminal history, employment history, and identifying information (fingerprint, voiceprint, or photograph).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
Bill wants to search the Internet for articles about money laundering using a search engine. Which of the following search strings will yield the best results?
 A. inanchor:"money laundering"   
 B. site:"money laundering"  
 C. intitle:"money laundering"   
 D. filetype:“money laundering”
A

intitle:”money laundering”
Users can employ advanced search operators (or Boolean operators) to gain more control over the search results. Advanced search operators are query words or symbols used in search engine queries to instruct search engines to perform special actions when executing a search. They help search engines better understand exactly what the user is looking for, and they improve a search and return relevant links faster.

The intitle:term search operator restricts results to those containing all the search terms specified in the title. So, entering [intitle: money laundering] in a search engine will return only documents that contain the words money and laundering in the title. Since Bill is searching specifically for articles on money laundering, this would be his best choice.

Placing quotation marks around a phrase will indicate to the search engine that it is to search only for pages that have the exact phrase. Thus, performing a search for “money laundering” will yield pages containing that exact phrase. In Bill’s case, this search would also yield good results.

The site:URL search operator will return pages in which the URL contains any specified keyword(s).

In some search engines, using the inanchor:term search operator returns pages that contain the specified terms in the link anchors of Web pages.

In some search engines, the filetype: search operator will return items of a particular file type that match the keyword.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of the following is NOT considered good practice when selecting the participants on a team assembled to investigate fraud?
A. Select team members who can bring both conventional and untraditional knowledge to the investigation.
B. Select team members who are likely to have compatible personalities.
C. Select team members who have demonstrated restraint and a sense of discretion.
D. Select team members who possess a vested personal or corporate interest in the matter.

A

Select team members who possess a vested personal or corporate interest in the matter.

The following are considered good practice when selecting the participants on a team assembled to investigate fraud:
•Consider the team’s size.
•Check for conflicts of interest between internal and external team members.
•Ensure that there are no reporting issues (e.g., team members feel pressure to report all details of the investigation to their direct manager, even though their manager does not have a need to know). Reporting issues can be prevented by establishing confidentiality rules in the beginning of the investigation.
•Select team members who fit the investigation’s demands and objectives.
•Recruit team members with the skills needed to conduct the investigation.
•Recognize the unique knowledge, experience, and skills that each team member can contribute.
•Contemplate the ways that each potential member will fit into the team.
•Select people who will work well with other team members.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which of the following would be an example of a narrative question that an attorney might ask an expert witness during direct examination in an adversarial system?
A. “Weren’t there three inaccuracies on the financial statement?”
B. “At what point did you begin to suspect that the subject was lying?”
C. “Could you please describe the steps you took during your examination?”
D. “You couldn’t find any direct evidence implicating the suspect, could you?”

A

“Could you please describe the steps you took during your examination?”

Direct examination is the initial questioning of a witness by the party that called the witness (in adversarial jurisdictions) or the judge (in inquisitorial jurisdictions). Most of the time, direct examination is a nonconfrontational questioning aimed at exposing the facts and issues of the case. During direct examination in adversarial systems, expert witnesses present their findings in various ways, such as narrative questions, hypotheticals, specialized materials, and special exhibits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CalaCala Foods, a private meat processing company in the United States, hired Able, a private investigator, to investigate allegations of internal fraud. During the investigation, Able questions Baker, a suspect in the alleged fraud, at Baker’s home. During the interview, Baker seeks to invoke his right to counsel. Able legally MUST:
A. Discontinue questioning and terminate the interview
B. Discontinue questioning until Baker contacts his attorney
C. Give Baker a Miranda warning before proceeding any further
D. None of the above

A

None of the above
As with other U.S. constitutional rights, the Sixth Amendment does not apply if there is no state action. Thus, in most cases, a private employer can interview an employee without the presence of the employee’s attorney. An individual always has the right to consult an attorney, but there is typically no legal obligation to consult the employee’s lawyer prior to the interview or allow the employee’s lawyer to be present during an interview.

In addition, Miranda warnings are only required when the suspect is in custody and is being questioned by public authorities.

The following are factors to consider in determining whether to advise a suspect that he may seek counsel: the degree of evidence of the employee’s culpability, whether the evidence is such that one would draw a conclusion concerning a violation of the law, the likelihood of criminal prosecution if the results of the investigation are disclosed, the existence of a conflict of interest between the employee and the company, and the state ethical codes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
In U.S. criminal trials, the reading of the indictment or information in open court where the defendant pleads to the charges is called:
 A. The arraignment  
 B. The pleadings   
 C. The pretrial hearing  
 D. Discovery
A

The arraignment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the purpose of post-judgment discovery in a civil case?
A. To identify assets that can be used to satisfy a judgment
B. To help the judge decide the sentence of the defendant
C. To help the judge identify the amount of the monetary award
D. None of the above

A

To identify assets that can be used to satisfy a judgment
In many instances, particularly in fraud litigation, a judgment might go uncollected because the defendant has already spent, hidden, or otherwise disposed of the assets. In such circumstances, a plaintiff may conduct post-judgment discovery, including a deposition of the defendant, in an attempt to determine the amount and location of the debtor’s assets to satisfy a judgment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The Internal Revenue Service may file a civil action against U.S. taxpayers accused of tax fraud, but it must refer criminal prosecutions to the Department of Justice.
A. True
B. False

A

True
In the United States, individuals with tax deficiencies may be subject to either civil or criminal penalties. The Internal Revenue Service (IRS) pursues civil violations, and it refers criminal tax cases to the Department of Justice (DOJ) for prosecution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

White, a Certified Fraud Examiner, believes that Blue, a fraud suspect, is guilty of embezzlement. White shares his theory with his supervisor. Blue later turns out to be innocent. Blue can sue and probably recover from White on a theory of defamation.
A. True
B. False

A

False
Defamation is an unprivileged publication of a false statement about a person that causes harm to that person’s reputation. To recover for defamation, the plaintiff must prove all of the following elements:
•The defendant made an untrue statement of fact.
•The statement was communicated (published) to third parties.
•The statement was made on an unprivileged occasion.
•The statement damaged the subject’s reputation.

For a statement to qualify as defamatory, the occasion in which the statement is made must be an unprivileged one. If the statement is made on a privileged occasion, then no liability can attach to the speaker. Basically, the law recognizes that there are some circumstances in which the need to share information is so important that people will be allowed to make mistakes from time to time without having to worry about being sued for defamation. Statements that are made in these circumstances are said to be privileged.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

An attorney’s client can waive any protection the U.S. attorney-client privilege provides over confidential attorney-client communications if the client discloses the privileged information to unrelated third parties who have no need to know the information.
A. True
B. False

A

True
The U.S. attorney-client privilege is not absolute; it is subject to waiver. Because the attorney-client privilege does not protect communications disclosed to outside parties, the privilege will be waived if confidential communications are disclosed to a third party whose role has little to do with the client’s pursuit of legal representation.

Generally, waiver occurs when the client, who holds the privilege, voluntarily discloses (or consents to or encourages someone else disclosing) any significant part of the privileged communications. Although the client holds the privilege, the privilege can also be waived by the client’s attorney or a third party (someone who is neither the attorney nor the client).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A government employer in the United States is questioning one of its employees about a fraud. When asked if he committed the fraud, the employee refuses to answer the question, asserting his rights under the Fifth Amendment. Which of the following statements is MOST CORRECT?
A. The employer can fire the employee for refusing to cooperate.
B. The employer can use a threat of termination to force the employee to answer the question.
C. If the employer uses a threat of termination to coerce the employee to confess, the confession can be used against the employee at a criminal trial.
D. The employer cannot fire the employee for refusing to answer questions that might incriminate him.

A

The employer cannot fire the employee for refusing to answer questions that might incriminate him.
In the United States, constitutional protections generally only apply to public employees. This means that employees of federal, state, and local governments must be afforded protection under the Fifth Amendment.

Under the Fifth Amendment, a public employer cannot fire employees for refusing to answer questions that might incriminate them. The leading case on this issue is Garrity v. New Jersey, 385 U.S. 493 (1967). In Garrity, several New Jersey police officers were threatened with dismissal from their jobs if they refused to answer questions relating to a conspiracy to obstruct traffic laws. The officers, faced with termination, answered the questions and were subsequently prosecuted. The U.S. Supreme Court found that the statements had been improperly coerced, and were therefore not admissible at trial.

The Fifth Amendment only protects persons against compelled testimony. Thus, if an employee voluntarily confesses to a crime, he can be fired without violating his constitutional rights. The confession, however, must be truly voluntary; the employee cannot be coerced in any way to give self-incriminating evidence during an interview.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

During an admission-seeking interview, Cynthia has just accused a suspect of committing a crime. The suspect begins to deny the accusation. The best practice would be for Cynthia to interrupt the suspect’s denial at this point.
A. True
B. False

A

True
Once the accused utters a denial in an admission-seeking interview, it becomes extremely difficult for him to change his response because doing so would be an admission that he lied. Therefore, the interviewer must prevent an outright denial, thereby making it easier for the subject to confess at a later time. An innocent person is unlikely to allow the interviewer to prevail in stopping the denial.

Cynthia should not allow the suspect to continue with his denial of the accusations. She can use several techniques to stop or interrupt the denial, including delays, repeated interruptions, and reasoning.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q
In interview situations, a(n)\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ is an orderly, continuous account of an event or incident given by a respondent with minimal or no prompting.
 A. Unprompted script  
 B. Free narrative  
 C. Informational response   
 D. None of the above
A

Free narrative
The free narrative is an orderly, continuous account of an event or incident, given with minimal or no prompting. It is used to get a quick synopsis of what is known about a matter. But when seeking to obtain a free narrative, be sure to designate specifically the occurrence that you wish to discuss.

Sometimes the respondent must be controlled to prevent unnecessary digression. Otherwise, avoid interrupting the respondent, and do not stop the narrative without good reason. The respondent will sometimes provide valuable clues when talking about things that are only partially related to the matter under inquiry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The proper method for developing latent fingerprints that have been absorbed into porous materials, such as paper, is to dust them with fingerprint powder.
A. True
B. False

A

False
Fraud examiners should never try to develop latent fingerprints that have been absorbed into paper or other porous materials by dusting with fingerprint powder or any other means. Such efforts will not only be unsuccessful, but they will prevent additional examinations. Instead, fraud examiners should preserve evidentiary documents that contain latent fingerprints by placing them into labeled protective containers, such as sealable, acid-free paper envelopes. Also, fraud examiners should label the item’s container with their initials, the current date, where the document was obtained, and an identifying exhibit number (if any).

Experts use various methods to examine fingerprints on porous surfaces, including iodine fuming and brushing or spraying silver nitrate solution or ninhydrin spray, which reacts with the body chemicals and other substances in the latent prints that have soaked into the absorbent surface. Some of these methods will permanently discolor a document.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Able, a fraud examiner, is investigating a suspected embezzlement by one of XYZ Corporation’s employees. As part of the investigation, he is assembling a financial profile of the suspect. Among other things, he wants to see if the suspect has made any significant real estate purchases since the embezzlement scheme began. Information on real estate transactions such as deeds, grants, transfers, and mortgages is usually located:
A. With the jurisdiction’s commercial filing registrar
B. With the jurisdiction’s land registry office
C. With the jurisdiction’s organizational filing agency
D. With the local court clerk or judicial records agency

A

With the jurisdiction’s land registry office

Most jurisdictions have a land registry office that maintains various information on real property and its owner(s).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is mutual legal assistance (MLA)?
A. A formal request by the courts of one country seeking judicial assistance from the courts of another country
B. A formal request by the government of a country seeking information from a defendant residing in another country
C. A letter whereby a criminal defendant requests that the government release exculpatory information
D. A process by which countries request and provide assistance in law enforcement matters

A

A process by which countries request and provide assistance in law enforcement matters
Mutual legal assistance (MLA) is a process by which countries request and provide assistance in law enforcement matters, such as gathering information, obtaining provisional remedies, and enforcing foreign orders and judgments. To obtain assistance from a foreign government, the government seeking assistance makes an MLA request. An MLA request is a written request to the government of a foreign country that is used to obtain assistance in law enforcement matters. Generally, MLA can be used to obtain assistance in matters such as conducting searches, gathering evidence, compelling sworn testimony and the production of documents, issuing search warrants, issuing subpoenas, serving process, exchanging affidavits, obtaining provisional remedies, and providing assistance in forfeiture proceedings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

To properly prepare an organization for a formal fraud investigation, all employees should be notified of the investigation’s existence and purpose.
A. True
B. False

A

False
It is not good practice to alert all of an organization’s employees that an investigation will be taking place, nor is it a good idea to explain the investigation’s purpose to those employees. However, it might be necessary to take some steps to prepare the subject organization for the formal investigation before it officially commences (and especially before starting the evidence-collection process).

Preparing an organization for an investigation involves such things as preparing the managers of the employees who will be involved in the investigation, notifying key decision makers that the investigation is about to begin, and notifying the organization’s in-house or outside counsel when the investigation is about to commence. Note that while it might be necessary to prepare the managers of the employees who will be involved in the investigation, those responsible should not do so by explaining the investigation’s purpose, why the investigation is happening, when it is happening, or who is involved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

All of the following are advantages to using data analysis software EXCEPT:
A. Fraud examiners can use data analysis software to ensure that an investigation is accurate and complete.
B. Fraud examiners can use data analysis software to centralize fraud investigations.
C. Fraud examiners can use data analysis software to produce accurate results from bad data.
D. Fraud examiners can use data analysis software to search for red flags of possible fraud.

A

Fraud examiners can use data analysis software to produce accurate results from bad data.
There are five significant advantages to using data analysis software. First, data analysis software allows the fraud examiner to centralize an investigation, relying less on others to gather data. Second, data analysis software allows the fraud examiner to ensure that an investigation is accurate and complete. Third, data analysis allows the fraud examiner to base predictions about the probability of a fraudulent situation on reliable statistical information. Fourth, data analysis allows the fraud examiner to search entire data files for red flags of possible fraud. Finally, data analysis can assist the fraud examiner in developing reference files for ongoing fraud detection and investigation work.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q
A \_\_\_\_\_\_\_\_\_\_\_\_\_\_ interview is one that has the potential to bring about strong emotional reactions in the respondent.
 A. Volatile  
 B. Chronemic   
 C. Evasive  
 D. None of the above
A

A volatile interview is one that has the potential to bring about strong emotional reactions in the respondent. Typical volatile interviews involve close friends and relatives of a subject, co-conspirators, and similar individuals. The personality characteristics of those involved in the volatile interview vary. Some individuals are resentful of authority figures, such as fraud examiners and law enforcement officers, by nature. A target’s friends, relatives, and romantic interests often make for a difficult interview. They perceive that the fraud examiner is deliberately targeting someone close to them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q
Which of the following is a category of informational interview questions?
 A. Closed   
 B. Leading   
 C. Open 
 D. All of the above
A

All of the above
Once the proper format for the interview is set, the interviewer then turns to informational questions to gather unbiased factual information. Typically, the interviewer will ask three types of questions during the fact-gathering portion of an interview: open, closed, and leading.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Able, a fraud examiner, is investigating a suspected embezzlement by one of XYZ Corporation’s employees. As part of the investigation, he is assembling a financial profile of the suspect. Among other things, he wants to see if the suspect has made any significant real estate purchases since the embezzlement scheme began. Information on real estate transactions such as deeds, grants, transfers, and mortgages is usually located:
A. With the jurisdiction’s commercial filing registrar
B. With the jurisdiction’s land registry office
C. With the jurisdiction’s organizational filing agency
D. With the local court clerk or judicial records agency

A

With the jurisdiction’s land registry office

Most jurisdictions have a land registry office that maintains various information on real property and its owner(s).

30
Q
Which of the following is the type of covert operation in which a fraud examiner uses disguise and deceit to actively seek out evidence from people involved in the offense?
 A. An undercover operation  
 B. A surveillance operation    
 C. An entrapment operation   
 D. An informant operation
A

An undercover operation
The two main forms of covert operations are undercover operations and surveillance operations. Undercover operations often use deception and disguise to obtain evidence directly from those involved in the illicit activity. Agents engaged in undercover operations actively attempt to elicit the desired information. In contrast, surveillance operations use observation to gather information about individuals suspected of misconduct.

For example, a surveillance operation might involve observing a suspect from afar while he meets with a potential co-conspirator. Alternatively, the investigator might pose as the co-conspirator’s agent and engage the suspect in conversation in an attempt to gather information; this would be an example of an undercover operation.

31
Q

When reporting the results of a fraud examination, the Certified Fraud Examiner generally should include his opinion regarding the credibility of the witnesses.
A. True
B. False

A

False

Keyword “opinion”

32
Q
\_\_\_\_\_\_\_\_ are digital files created under the computer user's direction, such as text-based documents, spreadsheets, databases, emails, audio/video files, and image files.
 A. Generated project files   
 B. Computer-created files   
 C. User-protected files    
 D. User-created files
A

User-created files
User-created files are digital files created under the user’s direction, and include text-based documents, spreadsheets, databases, email, address books, presentation slides, audio/video files, image files, and Internet bookmarks.

33
Q

Gamma, a Certified Fraud Examiner, is interviewing Beta, a fraud suspect. Gamma asks Beta, “Who in the company could be responsible for this situation?” If Beta is guilty, he is more likely to say:
A. “It wasn’t me, that’s for sure.”
B. “It could have been anybody.”
C. “It wasn’t anyone I work with.”
D. “It could be Green, but I’m not sure.”

A

“It could have been anybody.”
Both the honest respondent and the liar have a natural reluctance to name others involved in misdeeds. However, the liar frequently refuses to implicate possible suspects, no matter how much pressure the interviewer applies. This is because the culpable person does not want the circle of suspicion to be narrowed.

Additionally, both honest and dishonest people normally object to and deny a direct accusation. But when compared to an innocent person, a culpable person is more likely to avoid an outright denial (“I didn’t do it.”) and is more apt to provide the interviewer with explanations as to why he is not the responsible party. An innocent person is unlikely to allow the interviewer to prevail in stopping the denial.

34
Q

When a forensic investigator is seizing a running computer for examination, he can retrieve data from the computer directly via its normal interface if the evidence needed exists only in the form of volatile data.
A. True
B. False

A

True
When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence. But in some situations, it might be appropriate to perform live evidence collection (i.e., collect evidence from a suspect system while the system is up and running via its normal interface). Generally, live evidence collection is appropriate when a formally trained computer investigator is seizing the system, and the evidence that the investigator needs to collect exists only in the form of volatile data

35
Q

When seizing a computer that is running, the seizing party should generally not search the computer for evidence because doing so might damage and taint relevant evidence.
A. True
B. False

A

True
When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence. But in some situations, it might be appropriate to perform live evidence collection (i.e., collect evidence from a suspect system while the system is up and running via its normal interface). Generally, live evidence collection is appropriate when a formally trained computer investigator is seizing the system, and the evidence that the investigator needs to collect exists only in the form of volatile data.

36
Q

The use of trickery and deceit to obtain a confession will always render the confession inadmissible in a court of law.
A. True
B. False

A

False
The use of deception to gain information can sometimes be employed legally, but fraud examiners should check with counsel regarding the applicable laws and regulations before engaging in such activity. In cases where deception is legal, the theory is that information can be obtained by nearly any means, with the exception of force or threats. The interviewer, however, may not employ any deception likely to cause the innocent person to confess. The use of deception is generally not justified regarding promises of leniency or confidentiality, nor is it usually justified to obtain a monetary or business advantage.

37
Q

The primary purpose of an expert report is to document the results of a fraud examination.
A. True
B. False

A

False
A fraud examination report documents the results of a fraud examination and is generally created by one or more critical members of the fraud examination team. Documenting results is a particularly important function in fraud examinations. The fraud examination report conveys all evidence necessary to evaluate the case, and it can be used to corroborate previously known facts. An accurate report will add credibility to the fraud examination and to the fraud examiner’s work.

Fraud examiners who serve as expert witnesses in litigation are tasked with providing an expert report, which requires them to provide particular information about their qualifications, their opinions, the bases of those opinions, and various other pieces of information. The purpose of an expert report is to inform the parties, the judge, and the jury (if applicable) about the expert’s opinion of the case, as well as his credibility for commenting on such issues.

38
Q

To preserve the confidentiality of a fraud investigation, management should implement a blanket policy prohibiting employees from discussing employee investigations.
A. True
B. False

A

False
In a 2015 decision by the U.S. National Labor Relations Board (NLRB), the entity that enforces the National Labor Relations Act (NLRA), the NLRB ruled that an employer’s routine policy or practice of asking employees not to discuss matters that are under investigation violates the NLRA, even where the employer did not threaten to take disciplinary action if employees breach confidentiality. Based on the NLRB’s 2015 decision, U.S. employers should not have a blanket policy prohibiting employees from discussing employee investigations. Instead, when conducting an investigation into employee misconduct, U.S. employers must assess whether there is a need for confidentiality on a case-by-case basis

39
Q

Liam, a Certified Fraud Examiner, is attempting to get a fraud suspect to admit guilt. Liam should:
A. Directly accuse the suspect
B. Show the suspect incriminating evidence
C. Give the suspect an excuse for his behavior
D. All of the above

A

All of the above
People rarely confess voluntarily unless they perceive that the benefits of confession outweigh the penalties. A good interviewer, through the application of sophisticated techniques, is able to convince the respondent that the confession is in his best interest.

The admission-seeking interview begins with a direct accusation. The accusation should be made in the form of a statement, not a question.

40
Q

Which of the following is the most appropriate example of an alternative question?
A. “Did you, or did you not, commit this crime?”
B. “Will you repay the money now or later?”
C. “Did you deliberately plan this, or did it just happen?”
D. “How else might this situation be explained?”

A

“Did you deliberately plan this, or did it just happen?”

The alternative question forces the accused to make one of two choices, both of which imply guilt. One alternative provides the accused with a morally acceptable reason for the misdeed; the other portrays the accused negatively. Regardless of which answer the accused chooses, he is acknowledging guilt

41
Q

Green, a Certified Fraud Examiner, is conducting an admission-seeking interview of Brown, a fraud suspect. Brown has confessed to having committed the fraud, but he is denying anyone else was involved. However, Green knows this is untrue. What should Green do next?
A. Proceed as if the falsehood has been accepted as truth and return to it later.
B. Mention the penalties involved in perjury.
C. Proceed directly to present his evidence against Brown’s co-conspirators.
D. Get Brown’s written admission before continuing the interview.

A

Proceed as if the falsehood has been accepted as truth and return to it later.
Because of the psychology of confessions, most confessors lie about one or more aspects of the offense, even though they confirm overall guilt. When this happens during the verbal confession, the interviewer should make a mental note of the discrepancy and proceed as if the falsehood had been accepted as truth.

Such discrepancies should be saved until the accused provides all other relevant facts. If the discrepancies are material to the offense, the interviewer should either resolve them at the end of the verbal confession or wait and correct them in the written confession. If not material, such information can be omitted from the written confession.

42
Q

Understanding the structure and availability of existing data during a data analysis engagement helps to ensure that the fraud examiner can build workable tests to run on it.
A. True
B. False

A

True
Although the purpose of data analysis involves running targeted tests on data to identify anomalies, the ability of such tests to help detect fraud depends greatly on what the fraud examiner does before and after actually performing the data analysis techniques. Without sufficient time and attention devoted to planning early on, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, running into avoidable technical difficulties, and possibly overlooking key areas for exploration.

As a first step in the planning process—long before determining which tests to run—the fraud examiner must know what data is available to be analyzed and how that data is structured. Understanding the structure of the existing data will not only help ensure that the fraud examiner builds workable tests to be run on the data, but might also help identify additional areas for exploration that might otherwise have been overlooked

43
Q
Text-based data is typically considered:
 A. Documentary data   
 B. Structured data   
 C. Unstructured data  
 D. Narrative data
A

Unstructured data
Data are either structured or unstructured. Structured data is the type of data found in a database, consisting of recognizable and predictable structures. Examples of structured data include sales records, payment or expense details, and financial reports. Unstructured data, by contrast, is data that would not be found in a traditional spreadsheet or database. It is typically text based.

44
Q

During which phase of the data analysis process does the fraud examiner identify, obtain, and verify the relevant or requested data?
A. The preparation phase
B. The planning phase
C. The testing and interpretation phase INCORRECT

D. The post-analysis phase

A
The preparation phase
The second phase of the data analysis process is the preparation phase. The results of a data analysis test will only be as good as the data used for the analysis. Thus, before running tests on the data, the fraud examiner must make certain the data being analyzed are relevant and reliable for the objective of the engagement. During the preparation phase of the data analysis process, the fraud examiner must complete several important steps, including:
•Identifying the relevant data
•Obtaining the requested data
•Verifying the data
•Cleansing and normalizing the data
45
Q

Forensic accounting differs from fraud examination in that forensic accounting is the use of professional accounting skills in matters involving potential or actual civil or criminal litigation and may or may not involve fraud.

A

True
Forensic accounting is the use of professional accounting skills in matters involving potential or actual civil or criminal litigation. The word forensic is defined by Black’s Law Dictionary as “used in or suitable to courts of law or public debate.” Therefore, forensic accounting is actually litigation support involving accounting. Accordingly, many fraud examinations can be considered forensic accounting, but not all forensic accounting is fraud examination. For example, an individual hired to appraise the property in a minority shareholder derivative suit would engage in forensic accounting even if the engagement does not involve fraud.

46
Q
Which of the following is an example of an indirect method of locating assets or tracing illicit funds?
 A. Net-worth analysis  
 B. The specific-items method    
 C. Financial condition analysis    
 D. Correlation analysis
A

Net-worth analysis
Often, when a fraud examiner must locate a subject’s assets or trace illicit funds, the subject’s books and records are not made available. In such cases, the fraud examiner must use an indirect approach, such as net-worth analysis or the bank deposit analysis method, to prove income.

47
Q

Which of the following is the most accurate description of the net-worth (or comparative net-worth) method of analysis?
A. The net-worth method refers to the process of assigning forecasted income and expenses to accounts, which will be compared to actual income and expenses for analysis of variances.
B. The net-worth method is an indirect method of proving illicit income circumstantially by measuring and recording income as earned and recording expenses as incurred.
C. The net-worth method is an indirect method of proving illicit income circumstantially by showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or admitted legitimate sources of income.
D. The net-worth method refers to the process of using a subject’s books and records to determine the subject’s financial condition and identify the receipt or disposition of funds or assets.

A

The net-worth method is an indirect method of proving illicit income circumstantially by showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or admitted legitimate sources of income.
The net-worth method (or comparative net-worth analysis) is used to prove illicit income circumstantially by showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or admitted legitimate sources of income. Fraud examiners should use the net-worth method when several of the subject’s assets or liabilities have changed during the period under examination and when the target’s financial records are not available.

48
Q
Which of the following is a data analysis tool that is effective in identifying indirect relationships and relationships with several degrees of separation?
 A. Word maps   
 B. Geospatial analysis  
 C. Tree maps   
 D. Link analysis
A

Link analysis
Link analysis software is used by fraud examiners to create visual representations (e.g., charts with lines showing connections) of data from multiple data sources to track the movement of money; demonstrate complex networks; and discover communications, patterns, trends, and relationships.

Link analysis is very effective for identifying indirect relationships and relationships with several degrees of separation. For this reason, link analysis is particularly useful when conducting a money laundering investigation, since it can track the placement, layering, and integration of money as it moves around unexpected sources. It could also be used to detect a fictitious vendor (shell company) scheme. For instance, the investigator could map visual connections between a variety of entities that share an address and bank account number to reveal a fictitious vendor created to embezzle funds from a company.

49
Q
\_\_\_\_\_\_\_\_ is a data analysis software function that allows users to relate several files by defining relationships in collected data, without the use of the join command.
 A. Multi-file processing 
 B. Correlation analysis  
 C. Record selection   
 D. Verifying multiples of a number
A

Multi-file processing
Multi-file processing allows the user to relate several files by defining relationships between multiple files, without the use of the join command. A common data relationship would be to relate an outstanding invoice master file to an accounts receivable file based on the customer number. The relationship can be further extended to include an invoice detail file based on invoice number. This relationship will allow the user to see which customers have outstanding invoices sorted by date.

50
Q
Which of the following is NOT a characteristic asset hiders generally look for in the financial vehicles they use to conceal assets?
 A. Liquidity  
 B. Security   
 C. Transparency  
 D. Accessibility
A

Transparency
Generally, asset hiders look to conceal their assets with financial vehicles that have certain characteristics. For one thing, asset hiders want products that are liquid (i.e., items that can be purchased and sold in a short period of time). Moreover, asset hiders want products that are difficult to trace or are untraceable. With such instruments, asset hiders can break or obscure many links between the initial receipt of the assets and their final disposition. Asset hiders also look for products that are secure and accessible.

51
Q

Which of the following is LEAST likely to be revealed by analyzing a subject’s electronic payment records?
A. Loans the subject has obtained
B. Assets the subject has purchased
C. The funds the subject has tied up in real property
D. The locations of the subject’s residences and businesses

A

The funds the subject has tied up in real property
Electronic payments (or e-payments) refer to any type of noncash payment that does not involve a paper check. Electronic payment records can reveal, among other things:
•Assets the subject has purchased
•The locations of the subject’s assets (e.g., through the payment of real estate taxes, broker’s fees, or utility payments)
•The locations of the subject’s residences and businesses (e.g., through analyzing the payments of utility bills)
•Loans the subject has obtained (e.g., through analyzing loan payments)
•Payments made to nonexistent employees with direct deposit
•The cities and countries in which the subject conducts business (e.g., through analyzing the payments for carrier services to deliver packages)
•Assets ostensibly owned by family members or close associates but effectively controlled, held, or gifted by the subject
•Hotel payments
•The true owner of a property (e.g., through analyzing the mortgage payments and payments for home owner insurance)

52
Q

Spencer, a fraud examiner, plans to use a confidential informant. The informant agrees to aid Spencer in exchange for cash. Spencer prepares a receipt for the transfer of cash to the informant and asks the informant to sign it, but the informant refuses. What should Spencer do?
A. Give the informant the cash, but make no record of the transaction
B. Refuse to pay the cash without a receipt, even if it means the informant will not aid Spencer
C. Have a witness observe the transfer of cash and sign a statement attesting to the transaction
D. None of the above

A

Refuse to pay the cash without a receipt, even if it means the informant will not aid Spencer
If the fraud examiner decides to pay an informant or source, he should make the payment in cash and obtain a receipt. If the source will not sign a receipt, the fraud examiner should not pay him. There have been numerous instances where a receipt was not obtained and the informant subsequently denied receiving funds or challenged the amount paid. If this happens, the fraud examiner will have to defend himself without proof; indeed, some investigators have been accused of having embezzled the payments. Payments should only be made on a cash-on-delivery-of-information basis.

53
Q

As a general rule, the more intelligent the witness, the less reliable that individual’s verbal and nonverbal clues of deception will be.

A

False
Conclusions concerning behavior must be tempered by a number of factors. As a general rule, the more intelligent the respondent, the more reliable verbal and nonverbal clues will be.

A higher level of intelligence breeds more consistency in responses from which deviations are more clearly recognizable. People of lower intelligence tend to be more erratic in their behavior, and thus meaningful deviations are more difficult to discern.

54
Q
In interview situations, \_\_\_\_\_\_\_\_\_\_\_ are questions that often suggest an answer opposite to the correct one.
 A. Reverse   
 B. Double-negative
 C. Complex    
 D. Inverted
A

Double-negative.
Double-negative questions are questions that have two forms of negation within a single clause. Double-negative questions, or statements containing double negatives, are confusing and often suggest an answer opposite to the correct one. Therefore, they should not be used. For example: “Didn’t you suspect that something wasn’t right?”

55
Q

Harold, a fraud examiner, collects a computer hard drive as potential evidence in an investigation. He creates a memorandum to record the chain of custody and documents what item was received, when it was received, and from whom it was received. To meet the minimum standard for a chain of custody memorandum, what else would Harold need to include?
A. An explanation of why the item was collected
B. The value of the noncash item received
C. Where the item is maintained
D. The name of the judge who signed the seizure order, if applicable

A

Where the item is maintained
From the moment evidence is received, its chain of custody must be maintained for it to be accepted by the court. The chain of custody is both a process and a document that memorializes who has had possession of an object and what they have done with it. Essentially, the chain of custody is a recordkeeping procedure similar to physical inventory procedures.

In general, to establish the chain of custody, fraud examiners must make a record of when they receive an item or when it leaves their care, custody, or control. This is best handled by a memorandum with the custodian of the records when the evidence is received. The memorandum should state:
•What items were received
•When they were received
•From whom they were received
•Where they are maintained
56
Q

Undercover covert operations often use disguise and deceit to obtain evidence directly from people involved in the offense, whereas surveillance operations use the skill of observation to gather information about individuals’ activity.

A

True
The two main forms of covert operations are undercover operations and surveillance operations. Undercover operations often use deception and disguise to obtain evidence directly from those involved in the illicit activity. Agents engaged in undercover operations actively attempt to elicit the desired information. In contrast, surveillance operations use observation to gather information about individuals suspected of misconduct.

57
Q
Suppose you need to prove a suspect’s illicit income circumstantially. Which of the following methods of tracing assets would yield the best result when the suspect is using his illicit funds to accumulate wealth and acquire assets, thus causing his net worth to increase?
 A. The income correlation method   
 B. The asset method 
 C. The expenditures method   
 D. The bank deposits method
A

The asset method, the expenditures method, and the bank deposits method can all be used to establish a subject’s sources of income using circumstantial proof.

The asset method allows the fraud examiner to prove income circumstantially by showing that the subject’s assets for a given period exceed those that can be accounted for from known or admitted sources of income. Fraud examiners should use the asset method when it is suspected that the subject has accumulated wealth and acquired assets with illicit proceeds, which causes the subject’s net worth—the difference between a person’s assets and liabilities at a particular point in time—to increase.

The expenditures method (also known as the sources and application of funds method) compares the suspect’s known expenditures and known sources of funds during a given period of time. That is, this analysis seeks to quantify the cost of the subject’s lifestyle and determine whether the subject’s reported income is sufficient to support his lifestyle. The expenditures method is best used when the subject spends illicit income on consumables (such as travel and entertainment) that would not cause an increase in net worth.

The bank deposits method of tracing illicit funds is recommended as a primary method of proof when most of the subject’s income is deposited and the subject’s books and records are unavailable, withheld, incomplete, or maintained on a cash basis.

The income correlation method is not a method of tracing illicit funds

58
Q
“Aren’t you responsible for reviewing and approving your employees’ timesheets?” is an example of which of the following types of questions?
 A. Double-negative   
 B. Assessment  
 C. Leading  
 D. Open
A

Leading
Leading questions are questions that are framed in a way that evokes a specific reply from the respondent; they are questions that contain a suggested answer. Most commonly, leading questions are used to confirm facts already known. This type of question gives the subject much less room to maneuver than an open or closed question because these questions direct the subject to answer in a particular way. Leading questions imply that the interviewer already knows the answer, asking the subject to confirm what is already known. They can be particularly effective in interview situations.

Examples of leading questions include: “So there have been no changes in the operation since last year?”; “Are you still employed by the Westbrook Furnishings Corporation?”; “You got promoted, right?”; “Don’t you get your income from various sources?”

59
Q

Which of the following statements about U.S. bankruptcy court records is CORRECT?
A. Bankruptcy documents are usually located in the state bankruptcy court for the jurisdiction where the debtor resided
B. A bankruptcy file typically contains the bankruptcy petition
C. The documents filed with a bankruptcy court are not open, public records
D. All of the above

A

A bankruptcy file typically contains the bankruptcy petition
U.S. Bankruptcy proceedings are conducted in federal bankruptcy courts. In these courts, all documents filed with the court are public record and can be examined by anyone without charge. These on-site federal court records might include the case number, debtor’s name(s), Social Security number, address, filing date, chapter designation, and closure date. The search is available for all federal jurisdictions, usually covering a seven-year span that starts from the present and moves backward.

Bankruptcy documents are usually located in the federal bankruptcy court for the district where the debtor resided or had his principal place of business.

A bankruptcy file typically contains a number of files, including the bankruptcy petition.

60
Q

When asked a “yes” or “no” question, it is generally easier for an individual to answer “yes” than it is to answer “no.”

A

True
Throughout the interview process—from the introduction to the close—the interviewer should seek continual agreement by attempting to phrase the questions so that they can be answered “yes.” It is generally easier for people to reply in the affirmative than in the negative.

61
Q

During the analysis phase in digital forensic investigations, the fraud examiner’s primary concern is to protect the collected information from seizure.

A

False
The primary concern when analyzing digital evidence is to maintain the integrity of the data at all times. Fraud examiners must be especially careful with computer equipment because a careless investigator might inadvertently alter important evidence. Therefore, it is helpful to develop procedures to prevent the opposing party from raising allegations that the methodology used to collect or analyze data was improper and could have damaged or altered the evidence.

62
Q
During the introductory phase of the interview, the interviewer should avoid terms such as:
 A. Inquiry   
 B. Review   
 C. Investigation  
 D. All of the above
A

Investigation
Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction from the respondent, and emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive, making them more reluctant to answer and cooperate. Words such as investigation and audit should be avoided. It is better to use words with a softer meaning, such as inquiry or examination.

63
Q
A fraud examiner in an organized crime investigation believes a particular commercial restaurant is being used as a place of operation for the suspects. Which of the following types of records would be the LEAST likely to help the fraud examiner discover who owns the building in which the restaurant operates? 
 A. Fire department records  
 B. Building permit records   
 C. Health department records   
 D. Voter registration records
A

Voter registration
Voter registration records are not public in all jurisdictions, but if they are available, they might contain useful information. Usually, much of the information contained in such records is withheld from the public for privacy purposes, but voter registration records might contain a person’s date of birth, mailing address, and political affiliation. However, this information is less likely than the other sources listed to identify the owner of a commercial building.

64
Q
Suppose you suspect there is a ghost employee scheme taking place in your organization and you want to compare the payroll records to the employee master file. Which data analysis technique would you use to match these two data records?
 A. Gap testing   
 B. Compliance verification   
 C. Correlation analysis  
 D. The join function
A

The join function gathers the specified parts of different data files. Joining files combines fields from two sorted input files into a third file. Join is used to match data in a transaction file with records in a master file, such as matching invoice data in an accounts receivable file to a master cluster. For example, you might need to compare two different files to find differing records between them

65
Q

Patricia, a Certified Fraud Examiner, is interviewing a person whose truthfulness is unknown. Which of the following responses to questions posed by Patricia might indicate a deceptive answer? A. “What was that again?”
B. “I just can’t seem to remember.” C. “Why would I do that?”
D. All of the above

A

All of the above
Repeating the question is a means for a deceptive respondent to gain more time to think of what to say. The respondent might repeat the question verbatim or might frame the answer with a request to repeat the question (e.g., “What was that again?” or similar language). Conversely, a truthful subject usually does not have to contemplate an answer.

Dishonest people will frequently make excuses about things that look bad for them, such as: “I’m always nervous; don’t pay any attention to that.”

In some cases, the deceptive person will have a fine memory for insignificant events, but when it comes to the important facts, will say something like: “I just can’t seem to remember.”

Rather than deny the allegations outright, the dishonest person is more likely to answer with a question, such as: “Why would I do something like that?” As a variation, the deceptive person will sometimes question the interview procedure by asking: “Why are you tormenting me?”

66
Q

Which of the following is the most accurate statement about trying to locate a subject using online records?
A. If an individual has moved, obtaining a past address is usually of no help.
B. Online records are generally not useful in locating subjects whose address is unknown.
C. Efforts to locate a subject using online records should begin with a search of the suspect’s vehicle records.
D. Obtaining a past address of the subject should be the first step in trying to locate a subject using online records.

A

Obtaining a past address of the subject should be the first step in trying to locate a subject using online records.
To locate people using online records, fraud examiners should adhere to three principles. First, when searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information. Second, the fraud examiner should consider the cost effectiveness of the search activity and avoid ordering online searches that yield unnecessary or impractical information. Third, the fraud examiner should know the most powerful and useful types of searches.

67
Q
Which of the following would be the most successful method of proving illicit income when several of the subject’s assets or liabilities have changed during the period under examination and the subject’s financial records are not available?
 A. Benford's method of analysis 
 B. Net-worth method of analysis
 C. Attribute method of analysis   
 D. Sampling sources method of analysis
A

The net-worth method (or comparative net-worth analysis) is used to prove illicit income circumstantially by showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or admitted legitimate sources of income. Fraud examiners should use the net-worth method when several of the subject’s assets or liabilities have changed during the period under examination and when the target’s financial records are not available.

68
Q

Which of the following is NOT a recommended approach to dealing with a hostile or argumentative respondent during an interview?
A. Attempt to reason with the respondent.
B. Disarm the respondent by agreeing with his points whenever possible.
C. Avoid showing any kind of reaction to the respondent’s hostile behavior.
D. Make it difficult for the respondent to say “no” to any points raised.

A

Attempt to reason with the respondent.
The interviewer will invariably encounter a few difficult people. There are five common-sense steps to take with such people:
•Don’t react. There are three natural reactions for an interviewer who is verbally assailed by the respondent: to strike back, to give in, or to terminate the interview. None of these tactics is satisfactory because none of these responses lead to a productive interview.
•Disarm nonreceptive respondents. A common mistake interviewers make is to try to reason with an unreceptive person. To disarm the person, listen, acknowledge the point, and agree wherever possible.
•In some situations, changing tactics to reduce hostility might be the only viable option.
•Make it easy to say “yes” by agreeing with one of the respondent’s statements and go from there.
•Make it hard for the respondent to say “no.”

69
Q
Which of the following is an appropriate moral excuse clause to include in a signed confession?
 A. “I didn’t do it on purpose."   
 B. “I didn’t mean to hurt anyone."  
 C. "I didn't know it was illegal."   
 D. “I didn’t mean to do it."
A

“I didn’t mean to hurt anyone.”

The signed statement should include the confessor’s moral excuse, but the fraud examiner should ensure that the wording of the excuse clause does not diminish legal responsibility. Instead of using language like “I didn’t mean to do it,” which implies lack of intent, the interviewer should focus on an excuse that provides only a moral explanation for the misconduct.

70
Q

Which of the following is the most accurate definition of a Trojan horse?
A. A type of software that collects and reports information about a computer user without the user’s knowledge or consent
B. A virus that changes its structure to avoid detection
C. A software program that contains various instructions that are carried out every time a computer is turned on
D. A program or command procedure that gives the appearance that it is useful but in fact contains hidden malicious code that causes damage

A

A program or command procedure that gives the appearance that it is useful but in fact contains hidden malicious code that causes damage

A Trojan horse is a program or command procedure that gives the appearance that it is useful but in fact contains hidden malicious code that causes damage. When the hidden code in a Trojan horse is activated, it performs some unwanted or harmful function. Often, viruses and worms attach themselves to other legitimate programs, becoming Trojan horses and spreading to other systems.