Investigation

Question 1

Definition of “Fraud Examination”

Answer 1

a process of resolving allegations of fraud from inception to disposition

Question 2

Forensic Accounting

Answer 2

the use of professional accounting skills in matters involving litigation

Question 3

Predication

Answer 3

the totality of circumstances that would lead a professional to believe fraud has/is/will occur

Question 4

The Fraud Theory Approach

Answer 4

1- Analyze Data
2- Create Hypothesis
3-Test Hypothesis
4- Refine Hypothesis

Question 5

An Indemnity Clause

Answer 5

clauses in contracts that set out to protect one party from liability if a third-party or third entity is harmed in any way

It’s a clause that contractually obligates one party to compensate another party for losses or damages that have occurred or could occur in the future.

Question 6

A Case Plan

Answer 6

Outlines the course of action the investigation team will take (scope/goals/timing/assignments/documents needed/ etc)

Question 7

Trash Marks

Answer 7

uniquely identifiable markings on copies that allow one to identify the particular machine used

Question 8

Anachronisms

Answer 8

items located at a time when they could not have existed or occurred

Question 9

Indented writing

Answer 9

the impression a writing instrument leaves on sheets of paper below the sheet that had the original writing

Question 10

Latent fingerprints

Answer 10

Invisible fingerprints left on surfaces by the persons skin

Question 11

Patent finerprints

Answer 11

Visible fingerprints that are either left by the skin or through the transfer of materials (blood, soil, etc)

Question 12

Kinesic Interviews

Answer 12

Rather than looking for a confession, attempt to allow the interviewer to assess whether the subject is telling the truth via body language

Question 13

Once the accused makes the benchmark admission, the interviewer should….

Answer 13

positively affirm confessor’s decision by returning to the theme for their rationalization

(eg, I’m glad you had a good reason. That reinforces what I thought all along—that you were caught up in extraordinary circumstances. When was the first time you did it?”)

Question 14

A Link-network diagram

Answer 14

shows the relationships between people, organizations, and events.

Question 15

What are the two preferred means of organizing/presenting information in a fraud examination report?

Answer 15

Chronologically

By transaction

Question 16

Characteristics of an admission seeking interview

Answer 16

• sufficient privacy
• time is not a factor
• maximizing sympathy
• minimizing the perception of moral wrongdoing

Question 17

Internet archives

Answer 17

archived versions of web pages that have since been updated or are no longer available online

Question 18

The US Privacy Act of 1974

Answer 18

regulates the collection, maintenance, consumption, and distribution of personally identifiable information that is maintained by federal agencies.

Question 19

The US Right to Privacy act

Answer 19

prohibits financial institutions from disclosing financial information about individual customers to governmental agencies without the customer’s consent, a court order, etc.

Question 20

Deleted files are recoverable until….

Answer 20

they are overwritten

-data are not erased from a computer’s hard drive until the operating system overwrites all or some of the files

Question 21

Why shouldn’t management implement a blanket policy prohibiting employees from discussing employee investigations?

Answer 21

doing so could violate certain employee rights, especially if the jurisdiction guarantee private-sector employees the right to organize

Question 22

Under what circumstances does a covert examination make sense?

Answer 22

when there is reliable information about criminal activity or asset losses, but insufficient detail for prevention or apprehension.

Question 23

Structured Data

Answer 23

the type of data found in a spreadsheet or database

-includes sales records, payment/expense details, financial reports

Question 24

Unstructured Data

Answer 24

data that would not be found in a traditional spreadsheet or database

-writing

Question 25

If you're seizing a computer for forensic analysis, why should you also seize printers attached to it?

Answer 25

Because they have a hard drive that stores images of documents the machines have copied, scanned, or emailed

Question 26

Why shouldn't anyone other than the suspect and fraud examiners be in an admission seeking interview?

Answer 26

- The presence of third parties could have liability consequences - it is very difficult to obtain a confession with witnesses present

Question 27

When drafting a fraud examination report, fraud examiners should write with the expectation that opposing legal counsel will.....

Answer 27

have access to the information it contains.

Question 28

When accused of wrongdoing, the typical guilty person reacts with....

Answer 28

silence If the accused does deny culpability, those denials are usually weak.

Question 29

The Freedom of Information act

Answer 29

the primary legislation that governs the availability of U.S. governmental records to the general public The FOIA sets very specific guidelines regarding which governmental records are and are not open to the public.

Question 30

For a fraud examiner in the private/government sector, any promises made to an informant or source should..

Answer 30

be qualified with the caveat that no absolute assurances of confidentiality can be given.

Question 31

A signed statement should include a moral excuse that....

Answer 31

is worded in a way that doesn't diminish legal responsibility (eg, "I didn't mean to hurt anybody" is better than " I didn't mean to do it"

Question 32

A net worth analysis

Answer 32

used to prove illicit income circumstantially by showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or admitted legitimate sources of income

Question 33

A letter rogatory

Answer 33

A formal request by the courts of one country seeking judicial assistance from the courts of another country

Question 34

What is the most critical aspect to defend against allegations of entrapment in covert operations?

Answer 34

That adequate predication based on more than mere suspicion exists before the operation is commenced. e.g, if the officer received a reliable tip that a suspect committed fraud,

Question 35

illustrators

Answer 35

hand motions made when talking to demonstrate a point

Question 36

Inspector General Offices +relevance to a fraud investigation

Answer 36

The law enforcement function set up within a government admin agency to combat government fraud, waste, and abuse in federal departments and agencies will have centralized and case file info on businesses that have been investigated and audited

Question 37

Calibrating

Answer 37

The process of observing behavior to nonthreatening questions before critical questions are asked

Question 38

Double-negative questions

Answer 38

questions that often suggest an answer opposite to the correct one shouldn't be used in an interview

Question 39

The four phases in the data analysis process

Answer 39

1- planning (understand data available, build fraud profile, determine if predication exists) 2- preparation (identify relevant data, obtain it, verify it, cleanse it) 3- testing and interpretation (analyze it) 4- post analysis (respond to findings, monitor data)

Question 40

The four goals of introductory questions in an interview

Answer 40

provide intro establish rapport establish interview theme [purpose of interview] observe respondent reactions

Question 41

An alternative question

Answer 41

forces the accused to make one of two choices, both of which imply guilt. One alternative provides the accused with a morally acceptable reason for the misdeed; the other portrays the accused negatively. Regardless of which answer the accused chooses, they are acknowledging guilt. eg, "did you deliberately plan this or did it just happen?"

Question 42

A signature card

Answer 42

evidence of a contract between the bank and a customer that opens a personal account includes name, address, id#, etc.

Question 43

The Join Function

Answer 43

Combines two sorted input files so you can find differing records between them eg, comparing payroll records to the employee master file to look for a ghost employee

Question 44

Under what circumstances can an employed suspects credit report be pulled without their consent?

Answer 44

The investigation involves suspected misconduct, violation of laws or regulations, or violation of any preexisting policy of the employer. The employer uses a third party to conduct a workplace investigation AND the report from the third party is not communicated to anyone other than the employer, an agent of the employer, or the government.

Question 45

The two categories of inferential confusion

Answer 45

induction - asking respondent to convert actual experiences into higher level of generalization deduction - asking respondent to give concrete examples of certain categories of experience

Question 46

What should be the first step in trying to locate a subject using online records?

Answer 46

obtaining a post address of the subject

Question 47

Textual analytics

Answer 47

a method of using software to extract usable information from unstructured data eg, searching for fraud keywords in emails

Question 48

If a suspect is still lying about an aspect of the fraud during a verbal confession, the interviewer should....

Answer 48

Proceed as if the falsehood has been accepted as truth and return to it later.

Question 49

If a company incorporated in one state decides to expand to doing business in another state then...

Answer 49

depending on the state, they may need to register as a foreign corporation to do business there.

Question 50

When taking a signed confession, if the suspect admits to more the crime and additional unrelated crimes, then...

Answer 50

The examiner should take separate statements for each of the unrelated crimes, since the suspect may be tried for each offense

Question 51

Benford's Law

Answer 51

A technique to identify fictitious numbers States that for natural numbers (those not ordered in some way or human generated, such as payments), there is a non-random chance that a certain number will appear first eg, the chance of #1 appearing first in a three digit number is 30%, not 12.5%

Question 52

Steganography

Answer 52

The process of hiding one piece of information within an apparently innocent file

Question 53

What does "establishing the interview theme" mean?

Answer 53

Stating the interview's purpose in a general way that will ensure that the respondent isn't confused, threatened, or overly cautious

Question 54

Gap testing

Answer 54

a data analysis function used to identify missing items in a sequence or series e.g, missing checks or invoice numbers; hidden journal entries

Question 55

To properly inventory documents, if it is not practical to mark the document, or if marking it would damage the document, then...

Answer 55

it should be placed in an acid-free envelope that has been marked and sealed

Question 56

In an admission-seeking interview, the interviewer should transition to the verbal confession when ...

Answer 56

the accused provides the first detailed information about the offense

Question 57

The Asset Method +when to use

Answer 57

- used to prove a suspect’s illicit income circumstantially - shows that the subject’s assets for a given period exceed those that can be accounted for from known or admitted sources of income - should be used when it is suspected that the subject has accumulated wealth and acquired assets with illicit proceeds

Question 58

The Expenditures Method +when to use

Answer 58

AKA- the sources and application of funds method - used to prove a suspect’s illicit income circumstantially - quantifies the cost of the subject’s lifestyle and determine whether the subject’s reported income is sufficient to support their lifestyle - should be used used when the subject spends illicit income on consumables (e.g., travel and entertainment) that would not cause an increase in net worth

Question 59

The bank deposits method +when to use

Answer 59

- used to prove a suspect’s illicit income circumstantially - computes income by showing what happened to a suspects funds once deposited at a bank - should be used when most of the subject’s income is deposited in a financial institution and the subject’s books and records are unavailable, withheld, incomplete, or maintained on a cash basis.

Question 60

Once the accused utters a denial in an admission-seeking interview, the interviewer should....

Answer 60

Interrupt them prevent an outright denial, thereby making it easier for the subject to confess at a later time it becomes extremely difficult for them to change their response because doing so would be an admission that they lied

Question 61

A credit header

Answer 61

the information in a credit report that gives basic information about the person includes identifying information such as name, name variations, current and former addresses, telephone number, date of birth, and Social Security number.

Question 62

the Deep Web

Answer 62

refers to Web content that is not indexed by standard search engines because a web crawler (search engine) can't enter, there's no link there, its in a password protected website, etc

Question 63

Internet Archive

Answer 63

refers to archived versions of Web pages that have since been updated or are no longer available online

Question 64

Assessment Questions

Answer 64

seek to establish the respondent's credibility Used only when the interviewer considers previous statements by the respondent to be inconsistent because of possible deception.

Question 65

The three objectives of closing questions in an interview

Answer 65

- reconfirm facts - gather additional facts - conclude interview in a way that maintains goodwill

Question 66

What is "imaging" in examinations involving digital evidence? Why is it done?

Answer 66

A process that creates an exact duplicate of the hard drive/digital media on original storage media Forensic analysis should not be performed directly on suspect devices because doing so can alter or damage digital evidence

Question 67

An audit clause

Answer 67

allows parties to a contract the right to access another party's books Generally allows an organization to demand that a supplier, vendor, or agent turn over relevant documents as a condition of continued business.

Question 68

The five general types of questions an interviewer can ask

Answer 68

- introductory - informational - assessment - admission seeking - closing

Question 69

Complex questions

Answer 69

consist of a series of interrelated questions

Question 70

Five ways to use data analysis software on asset accounts to help detect fraud

Answer 70

Depreciation to cost reports. Compare book and tax depreciation and indicate variances. Sort asset values by asset type or monetary amount. Select samples for asset existence verification. Recalculate expense and reserve/provision amounts using replacement costs.

Question 71

Leading questions

Answer 71

Framed in a way that evokes a specific reply from the respondent

Question 72

Open questions

Answer 72

Those worded in a way that makes it difficult for the respondent to answer “yes” or “no.” calls for a monologue response

Question 73

The Altruism technique

Answer 73

Used in an admission seeking interview Reducing the moral seriousness of a fraud by claiming that the action was for the benefit of others eg "A lot of people depend on you for their jobs. I just know you did this because you thought you were doing the right thing for the company, didn't you?"

Question 74

Under what circumstances is it ok for a digital forensic examiner to perform live evidence collection from a seized running computer?

Answer 74

if the evidence needed exists only in the form of volatile data

Question 75

Where are birth certificates generally filed?

Answer 75

At the state bureau of vital statistics

Question 76

Controlled Answer Questions

Answer 76

Questions used to stimulate a desired answer or direct the interview toward a specific point

Question 77

A fictitious business name

Answer 77

AKA - DBA (doing business as) when a business owner operates a company under a name that is different from their legal name, which is not illegal

Question 78

The purpose of a fraud examination report vs an expert opinion

Answer 78

Fraud exam report - to document results of the exam and provide all evidence necessary to evaluate the case Expert Report - to provide the fraud examiner’s opinions of a case, as well as the fraud examiner’s qualifications and bases for providing those opinions.

Question 79

What are the six basic fraud examination reporting documents?

Answer 79

Transmittal letter [confirms sending/ provides context] Indexes [alphabetized listing with page references] Memorandum [documents interviews/ discoveries] Exhibits/documents [supporting source info] Cover page of letter [summary of key points] Forms [documentation of info gathering process steps]

Question 80

Three basic methods for preventing outright denials in admission seeking interviews

Answer 80

Repeated interruptions Delays Reasoning

Question 81

Mutual legal assistance

Answer 81

A process by which countries request and provide assistance in law enforcement matters