Investigation Procedures

Question 1

When evidence of fraud arises, management generally should respond by:

A. Conducting an initial assessment
B. Preserving relevant documents
C. Identifying who should be informed
D. All of the above

Answer 1

D. All of the above

See pages 3.117 in the Fraud Examiner’s Manual

When evidence of fraud arises, management generally should respond by engaging in the following actions:

• Activating the response team
• Engaging legal counsel, if necessary
• Contacting the insurance providers, if it makes sense to do so
• Addressing immediate concerns (e.g., preserving relevant documents and identifying who should be informed)
• Conducting an initial assessment to determine the appropriate response
• Documenting the initial response

Question 2

Unlike a fraud examination report, an expert report should include specific information detailing the fraud examiner’s opinions of a case, as well as the fraud examiner’s qualifications and bases for providing those opinions.

A. True
B. False

Answer 2

A. True

See pages 3.1001 in the Fraud Examiner’s Manual

Fraud examiners who serve as expert witnesses in litigation are tasked with providing an expert report, which requires them to provide information about their qualifications, their opinions, the bases of those opinions, and various other pieces of information. The purpose of an expert report is to inform the parties, the judge, and the jury (if applicable) about the expert’s opinion of the case, as well as the expert’s credibility for commenting on such issues.

A fraud examination report documents the results of a fraud examination and is generally created by one or more critical members of the fraud examination team. Documenting results is a particularly important function in fraud examinations. The fraud examination report conveys all evidence necessary to evaluate the case, and it can be used to support previously known facts. An accurate report will add credibility to the fraud examination and the fraud examiner’s work.

Question 3

When drafting a fraud examination report, fraud examiners should write with the expectation that the report’s information might be made accessible to various third parties, including opposing legal counsel, media outlets, and company stakeholders.

A. True
B. False

Answer 3

A. True

See pages 3.1010-3.1012 in the Fraud Examiner’s Manual

When drafting a report, fraud examiners must consider who might end up reading it. Fraud examiners should remain under the assumption that the fraud examination report will likely be read by the general public and adverse parties. Under no circumstances should the fraud examiner prepare a communication with the idea that the information will not be disclosed to adverse third parties. Therefore, fraud examiners should draft their reports with the expectation that they will likely be read by third parties.

There are many parties that might read a fraud examination report, including:

• Company insiders (e.g., managers, board of directors, owners, and investors)
• Attorneys (i.e., legal counsel, prosecutors, regulators, and defense counsel)
• Defendants and witnesses
• Media outlets
• Judges or juries

Question 4

To preserve the confidentiality of a fraud investigation by ensuring that it is afforded protection under a legal professional privilege, a government official should direct or supervise the investigation.

A. True
B. False

Answer 4

B. False

See pages 3.148 in the Fraud Examiner’s Manual

To prevent third parties, including the subject of the investigation, from having access to the investigative materials, management should consider conducting the investigation under any applicable evidentiary privilege that provides the right to keep certain information from being disclosed without permission. If an evidentiary privilege applies to information, the general rule is that the court and the party seeking the information will be denied access to it, and the triers of fact must disregard any evidence they do actually hear if it is deemed privileged afterward; however, legal jurisdictions vary on which communications are protected by such privileges.

Typically, the most relevant types of evidentiary privileges for keeping investigations confidential are legal professional privileges. These privileges protect the communications between professional legal advisors (e.g., solicitor, barrister, or attorney) and their clients, and in some situations, fraud investigations can be structured so that they are afforded protection under such privileges. Generally, to receive protection under a legal professional privilege, a legal professional must direct or supervise an investigation, not a government official.

Question 5

A fraud examiner is preparing the fraud examination report at the conclusion of a fraud investigation. When including information regarding the interviews conducted during the examination, the fraud examiner should:

A. Include all information provided by all the witnesses, regardless of the relevance.
B. Report the details of each witness interview in a separate memorandum.
C. Include only the facts provided by the witnesses that directly support the fraud allegation.
D. Use signed copies of notes from the interviews as the primary recording document.

Answer 5

B. Report the details of each witness interview in a separate memorandum.

See pages 3.1003-3.1004 in the Fraud Examiner’s Manual

Written fraud examination reports must be accurate. Inaccuracies will affect the credibility of the report and the report’s author. Each contact a fraud examiner makes during a fraud examination should be recorded on a timely basis in a separate memorandum that documents the details of the interview. Ordinarily, there is no need to recapitulate testimony word for word in the report, but the fraud examiner should include all facts of possible relevance for accuracy’s sake.

Also, relevant facts should be included regardless of which side they favor or what they prove or disprove. The written report conveys all evidence necessary to evaluate the case, and it can be used to support previously known facts. An accurate report will add credibility to the fraud examination and the fraud examiner’s work. Additionally, requiring a written report will force the fraud examiner to consider their actions during an investigation by ensuring that they document their process. A well-written report will also omit irrelevant information, thereby allowing pertinent facts to stand out.

Question 6

Which of the following is the LEAST APPROPRIATE participant on a team assembled to investigate fraud?

A. Legal counsel
B. Industry specialist
C. Auditor
D. Suspect’s supervisor

Answer 6

D. Suspect’s supervisor

See pages 3.128, 3.134 in the Fraud Examiner’s Manual

Fraud examinations usually require a cooperative effort among different areas of expertise; therefore, if members of management decide to investigate suspicions of fraud, they must determine who should lead and be involved in the investigation.

Typically, participants on a fraud investigation team should not include individuals with vested personal or corporate interest in the matter or individuals with a close personal or professional relationship with the subject or the complainant. Thus, in most situations, the suspect’s supervisor should not be included on a fraud investigation team.

The don’ts for selecting the participants on a team assembled to investigate fraud include:

• Don’t select team members based on friendship.
• Don’t select team members to repay a favor.
• Don’t select team members with negative attitudes.
• Don’t overlook team members with untraditional knowledge that can contribute to the investigation (e.g., people with experience in a particular industry).
• Don’t select members who might have personality conflicts with other members.
• Don’t select members with a vested personal or corporate interest in the matter.
• Don’t select members with a close personal or professional relationship with the subject or the complainant.
• Don’t select members who lack restraint and a sense of discretion.

Question 7

If qualified as an expert on such matters, the Certified Fraud Examiner (CFE) may issue an opinion on which of the following when reporting the results of fraud examination matters?

A. The adequacy of the entity’s internal controls
B. The effectiveness of the entity’s operations
C. Whether the entity’s financial statements conform to generally accepted accounting principles
D. All of the above

Answer 7

D. All of the above

See pages 3.1005-3.1006, 3.1020 in the Fraud Examiner’s Manual

Fraud examiners must be cautious about providing conclusions and stating their opinions. Opinions regarding technical matters, however, are permitted if the fraud examiner is qualified as an expert in the matter being considered. For example, a permissible expert opinion might address the relative adequacy of an entity’s internal controls; another opinion might discuss whether financial statements conform to generally accepted accounting principles (GAAP). Also, recommended remedial measures to prevent future occurrences of similar frauds are essentially opinions but are acceptable in fraud examination reports; however, it is better for the fraud examiner to convey recommendations related to flawed internal controls and other organizational failings to management in person or in a separate document. If included in the primary report, this information could potentially be seized upon by defense attorneys at a trial or by representatives at an unemployment hearing to push blame away from the suspect’s actions and toward the organization’s shortcomings.

Question 8

Carter, a Certified Fraud Examiner (CFE) for Universal Design, learns that Wendi, a shrewd salesperson with a reputation for bending or ignoring rules, has close relationships with several Universal Design customers. Carter also knows that Wendi has excessive gambling habits. Carter has sufficient predication to:

A. Conduct discreet inquiries about Wendi’s work as a salesperson.
B. Check Wendi’s phone, computer, and messages for evidence of wrongdoing.
C. Accuse Wendi directly of having committed fraud.
D. Alert management that Wendi might have committed fraud.

Answer 8

A. Conduct discreet inquiries about Wendi’s work as a salesperson.

See pages 3.105 in the Fraud Examiner’s Manual

Fraud examinations must adhere to the law; therefore, fraud examiners should not conduct or continue fraud examinations without proper predication. Predication is the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe that a fraud has occurred, is occurring, or will occur.

Fraud examiners should begin a fraud examination only when there are circumstances that suggest fraud has occurred, is occurring, or will occur, and they should not investigate beyond the available predication. If fraud examiners cannot articulate a factual basis or good reason for an investigative step, they should not do it. Therefore, fraud examiners should reevaluate the predication as the fraud examination proceeds. That is, as a fraud examination progresses and new information emerges, fraud examiners should continually reevaluate whether there is adequate predication to take each additional step in the examination.

Carter’s actions should match the predication. There is insufficient predication to confront Wendi or to make any direct allegations about fraud, but Carter does have adequate predication to make discreet inquiries about Wendi’s work as a salesperson.

Question 9

Which of the following statements about how fraud examiners should approach fraud examinations is CORRECT?

A. In most examinations, fraud examiners should interview the suspect before any other possible interview candidates
B. Fraud examinations should begin with general information that is known and then transition to details that are more specific
C. Individuals who appear to be more involved in the fraud scheme should be interviewed at the beginning of the investigation
D. All of the above

Answer 9

B. Fraud examinations should begin with general information that is known and then transition to details that are more specific

See pages 3.106 in the Fraud Examiner’s Manual

Fraud examinations should begin with general information that is known and then transition to details that are more specific. In most examinations, fraud examiners should start interviewing people who are less involved in the issues related to the examination before interviewing witnesses who appear to be more involved.

Question 10

Characteristics of a well-written fraud examination report include which of the following?

A. Impartiality
B. Accuracy
C. Clarity
D. All of the above

Answer 10

D. All of the above

See pages 3.1003, 3.1006 in the Fraud Examiner’s Manual

A well-written report contains the following four characteristics:

• Accuracy
• Clarity
• Impartiality and relevance
• Timeliness

The facts in a report should only be those relevant to the case, filtering out unnecessary details. Moreover, fraud examiners should not make determinations of guilt or innocence in their reports.

Question 11

A fraud examiner is planning how to organize and present information in the report-writing stage of a fraud examination. Which of the following statements is MOST ACCURATE?

A. The fraud examiner should present the information either by transaction or by party.
B. The fraud examiner should present the information either by transaction or chronologically.
C. The fraud examiner should only present the information chronologically.
D. The fraud examiner should present the information alphabetically in relation to parties and document titles.

Answer 11

B. The fraud examiner should present the information either by transaction or chronologically.

See pages 3.1009-3.1010 in the Fraud Examiner’s Manual

Because of the amount of information and the number of documents that might be collected during a fraud examination, it is imperative that the fraud examiner properly organize the information. If circumstances permit, an information database should be established in the early phases of the case. Information can be presented either in chronological order or by transaction when writing the fraud examination report.

In contrast, during the evidence-gathering stage of an investigation, chronologically organizing the documents that will later be used in drafting the report is not recommended because it will make searching for relevant information more difficult. It is generally better to organize documents by transaction or by party while evidence gathering is still occurring.

Question 12

Which of the following is a measure that can be taken to avoid alerting suspects that they are being investigated?

A. Inform only those who need to know
B. Know what information the suspect can access
C. Investigate during nonbusiness hours
D. All of the above

Answer 12

D. All of the above

See pages 3.145 in the Fraud Examiner’s Manual

When responding to a sign or allegation of fraud, those responsible must work to avoid alerting those suspected of fraud. The following are some basic measures that organizations and fraud examiners can take to avoid notifying suspects that they are being investigated:

• Know who is being investigated and what they can access.
• Limit the extent of any discussions.
• Inform only those who need to know.
• Inform employees of the consequences of a confidentiality breach.
• Work discreetly without disrupting the office’s normal course of business so that employees do not know that an investigation is being performed.
• Work fast.
• Investigate during nonbusiness hours.

Question 13

Because the laws of evidence generally protect written fraud examination reports from being disclosed to adverse third parties, fraud examiners can prepare written reports with the understanding that the information will NOT be disclosed to anyone outside the company.

A. True
B. False

Answer 13

B. False

See pages 3.1010-3.1012 in the Fraud Examiner’s Manual

When drafting a report, fraud examiners must consider who might end up reading it. Fraud examiners should remain under the assumption that the fraud examination report will likely be read by the general public and adverse parties. Under no circumstances should the fraud examiner prepare a communication with the idea that the information will not be disclosed to adverse third parties. Therefore, fraud examiners should draft their reports with the expectation that they will likely be read by third parties.

There are many parties that might read a fraud examination report, including:

• Company insiders (e.g., managers, board of directors, owners, and investors)
• Attorneys (i.e., legal counsel, prosecutors, regulators, and defense counsel)
• Defendants and witnesses
• Media outlets
• Judges or juries

Question 14

Which of the following would NOT be an acceptable section to include in a written fraud examination report?

A. A findings section that summarizes the facts and findings of the examination
B. A follow-up or recommendations section for recommendations related to procedures and controls
C. A scope section that describes the range of issues reviewed in the examination
D. A conclusion section that evaluates the guilt or innocence of the suspect(s)

Answer 14

D. A conclusion section that evaluates the guilt or innocence of the suspect(s)

See pages 3.1006, 3.1018-3.1020 in the Fraud Examiner’s Manual

While there are many report forms and each might serve its own purpose, the following sections generally should be included in written fraud examination reports:

• Background: Generally, a written report should contain a background section. The background section should state why the fraud examination was conducted (e.g., an anonymous tip was received, an anomaly was discovered during an audit, money or property was missing).
• Executive summary: A written report should also include an executive summary, which should provide the reader with an overview of what was done during the examination process.
• Scope: Generally, a written report should include a section that identifies the examination’s scope.
• Approach: A written report should include a section about the approach used.
• Findings: A written report should include a section that summarizes the investigation findings.
• Summary: A written report should include a summary of the results of the fraud examination.
• Impact: A written report should also include a section addressing the impact of any misconduct identified during the investigation.
• Follow-up/recommendations: If requested, a written report might include a section for recommendations related to procedures and controls; however, it is better for the fraud examiner to convey recommendations related to flawed internal controls and other organizational failings to management in person or in a separate document.

Opinions or conclusions concerning the guilt or innocence of a fraud suspect are outside the scope of a fraud examination and should never be included in a report.

Question 15

The primary purpose of an expert report is to document the results of a fraud examination.

A. True
B. False

Answer 15

B. False

See pages 3.1001 in the Fraud Examiner’s Manual

A fraud examination report documents the results of a fraud examination and is generally created by one or more critical members of the fraud examination team. Documenting results is a particularly important function in fraud examinations. The fraud examination report conveys all evidence necessary to evaluate the case, and it can be used to support previously known facts. An accurate report will add credibility to the fraud examination and the fraud examiner’s work.

Fraud examiners who serve as expert witnesses in litigation are tasked with providing an expert report, which requires them to provide information about their qualifications, their opinions, the bases of those opinions, and various other pieces of information. The purpose of an expert report is to inform the parties, the judge, and the jury (if applicable) about the expert’s opinion of the case, as well as the expert’s credibility for commenting on such issues.

Question 16

When reporting the results of a fraud examination, the Certified Fraud Examiner (CFE) generally should include their opinion regarding the credibility of the witnesses.

A. True
B. False

Answer 16

B. False

See pages 3.1006 in the Fraud Examiner’s Manual

The fraud examiner should be careful not to include any statement of opinion as to the integrity or veracity of any witness even if the fraud examiner is convinced that the witness is being untruthful. Truthfulness, or a lack of truthfulness, can be demonstrated through conflicting statements by the witness or suspect.

Question 17

Which of the following statements concerning documentation in a formal fraud examination report is MOST ACCURATE?

A. The originals of important documents should be included in the report.
B. Copies of important documents should be included in the report or in the attached appendices.
C. A reference to the current location where the original documents can be found is sufficient.
D. A reference to any important documents is sufficient.

Answer 17

B. Copies of important documents should be included in the report or in the attached appendices.

See pages 3.1008 in the Fraud Examiner’s Manual

Most evidence in fraud cases will be in document form, and when reporting the results of a fraud examination, it is best to include copies (not originals) of important documents in the formal report or in the attached appendices. Also, when operating under a lawful court order that compels a custodian to furnish original documents, the fraud examiner should copy those documents (preferably in the presence of the custodian). Then the fraud examiner should furnish the custodian with a receipt describing the documents copied or taken.

Question 18

When preparing a fraud examination report, which of the following opinions is permissible to include in the report?

A. Expert opinions regarding technical matters
B. Opinions on the veracity of witnesses
C. Opinions on a party’s guilt
D. None of the above

Answer 18

A. Expert opinions regarding technical matters

See pages 3.1005-3.1006 in the Fraud Examiner’s Manual

Fraud examiners must be cautious about stating their opinions. The fraud examiner must avoid stating opinions regarding the guilt or innocence of any person or party involved. The ACFE Code of Professional Ethics specifically prohibits statements of opinions regarding guilt or innocence, as this is the job of the judge or jury.

Similarly, the fraud examiner should be careful not to include any statement of opinion as to the integrity or veracity of any witness even if the fraud examiner is convinced that the witness is being untruthful. Truthfulness, or a lack of truthfulness, can be demonstrated through conflicting statements by the witness or suspect.

Opinions regarding technical matters, however, are permitted if the fraud examiner is qualified as an expert in the matter being considered. For example, a permissible expert opinion might address the relative adequacy of an entity’s internal controls; another opinion might discuss whether financial statements conform to generally accepted accounting principles (GAAP).

Question 19

Which of the following is NOT a purpose of the follow-up/recommendations section of a written fraud examination report?

A. To calculate the amount of loss caused by any misconduct identified during the investigation
B. To state necessary remedial measures for the organization to undertake
C. To identify any aspect of the investigation that remains outstanding
D. To make recommendations related to procedures and controls

Answer 19

A. To calculate the amount of loss caused by any misconduct identified during the investigation

See pages 3.1020 in the Fraud Examiner’s Manual

A follow-up or recommendations section is generally an optional part of a written fraud examination report. This section identifies any aspect of the investigation that remains outstanding, usually because it is outside the mandate of the investigator. This could include the recovery of property that is in the possession of third parties or the collection of information held by vendors or suppliers.

If requested, the fraud examiner might make recommendations related to procedures and controls; however, it is better for the fraud examiner to convey recommendations related to flawed internal controls and other organizational failings to management in person or in a separate document. If included in the primary report, this information could potentially be seized upon by defense attorneys at a trial or by representatives at an unemployment hearing to push blame away from the suspect’s actions and toward the organization’s shortcomings.

Follow-ups or recommendations should state what action is necessary or recommended, including remedial measures such as a review of internal controls, the introduction of a fraud reporting system, or an increase in security.

Question 20

Which of the following is a recommended method for organizing and presenting information in a fraud examination report?

A. By party
B. Chronologically
C. By the order in which the information was discovered
D. All of the above

Answer 20

B. Chronologically

See pages 3.1009-3.1010 in the Fraud Examiner’s Manual

Because of the amount of information and the number of documents that might be collected during a fraud examination, it is imperative that the fraud examiner properly organize the information. If circumstances permit, an information database should be established in the early phases of the case. Information can be presented either in chronological order or by transaction when writing the fraud examination report.

In contrast, during the evidence-gathering stage of an investigation, chronologically organizing the documents that will later be used in drafting the report is not recommended because it will make searching for relevant information more difficult. It is generally better to organize documents by transaction or by party while evidence gathering is still occurring.

Question 21

Each fraud examination should be conducted with the assumption that the case will result in legal proceedings.

A. True
B. False

Answer 21

A. True

See pages 3.105 in the Fraud Examiner’s Manual

Each fraud examination should be conducted with the assumption that the case will result in legal proceedings. This will ensure that the fraud examiner maintains compliance with the proper rules of evidence and remains well within the guidelines established by the legal systems.

Question 22

In general, the subject of an investigation should be interviewed first.

A. True
B. False

Answer 22

B. False

See pages 3.106-3.107 in the Fraud Examiner’s Manual

Fraud examinations should begin with general information that is known and then transition to details that are more specific. In most examinations, fraud examiners should start interviewing people who are less involved in the issues related to the examination before interviewing witnesses who appear to be more involved. Thus, neutral third-party witnesses should generally be interviewed first, followed by parties suspected of complicity, starting with the least culpable and moving to the most culpable. The primary suspect should be interviewed last.

Question 23

To preserve the confidentiality of a fraud investigation, management should always implement a policy prohibiting all employees from discussing anything related to employee investigations.

A. True
B. False

Answer 23

B. False

See pages 3.146 in the Fraud Examiner’s Manual

To preserve the confidentiality of an investigation, management might (if legally permissible) remind participants to refrain from discussing investigation information with anyone or require participants to sign a confidentiality oath vowing not to divulge any information regarding the investigation.

Generally, an employer can ask employees to keep an investigation confidential when there are legitimate business justifications for making such requests.

However, it is usually not wise for management to implement a policy prohibiting all employees from discussing employee investigations because doing so could violate certain employee rights. Some jurisdictions guarantee private-sector employees the right to organize and engage in other concerted activities for the purpose of collective bargaining or other mutual aid or protection. If an employer in such a jurisdiction has a routine policy or practice of asking employees not to discuss matters that are being investigated, the policy or practice might violate the employees’ right to organize and engage in other concerted activities. Therefore, it is best to tailor confidentiality requests to the specific case at hand and not use automatic, absolute policies.

Question 24

Which of the following is a recommended procedure for protecting a fraud investigation’s case information?

A. Avoid talking about the investigation in public or in any place where other employees can hear the communications
B. Avoid using email or other electronic means to transmit confidential case information
C. Store all confidential documents in locked file cabinets or rooms accessible only to those who have a need to know
D. All of the above

Answer 24

D. All of the above

See pages 3.147-3.148 in the Fraud Examiner’s Manual

To help preserve confidentiality, the investigation team members should closely guard case information. The following are some recommended procedures for protecting case information:

• Store all confidential documents in locked file cabinets or rooms accessible only to those who have a need to know.
• Protect all electronic information via firewalls, encryption, and passwords.
• Clear desks of any case information before stepping away.
• Lock computers when leaving workstations.
• Mark all case information, whether tangible or electronic, as confidential.
• Avoid talking about the investigation in public or in any place where other employees can hear the communications.
• Avoid using email or other electronic means (e.g., text messages or instant messages) to transmit confidential case information.

Question 25

Which of the following is INCORRECT regarding fraud response plans?

A. A fraud response plan should take both previous fraud cases and industry-related risks into consideration.
B. A fraud response plan should be flexible and allow appropriate responses based on the particular event.
C. A fraud response plan should create an environment that minimizes risk and maximizes the potential for success.
D. A fraud response plan should be complex and extremely detailed to ensure its effectiveness.

Answer 25

D. A fraud response plan should be complex and extremely detailed to ensure its effectiveness.

See pages 3.112 in the Fraud Examiner’s Manual

A fraud response plan details the actions that members of an organization will take when suspicions of fraud arise. Because every fraud is different, the response plan should not specify how all fraud examinations should be conducted. Instead, it should help organizations manage their responses and create environments that minimize risk and maximize the potential for success.

A response plan allows management to respond to suspected and detected incidents of fraud in a consistent and comprehensive manner. Having a response plan in place sends a message that management takes fraud seriously.

Also, a response plan should not be unduly complicated; for a response plan to work in high-pressure and time-sensitive situations, it must be simple to understand and apply.

While the appropriate response will vary based on the event, management should include a range of scenarios in the response plan, taking into consideration previous frauds within the organization and fraud risks specific to the industry or business sector in which it operates.

Organizations without a fraud response plan might not be able to respond to issues properly and will likely expend more resources and suffer greater harm than those that have such a plan in place. Conversely, having a response plan puts an organization in the best position to respond promptly and effectively.

Question 26

All written fraud examination reports MUST include a follow-up/recommendations section.

A. True
B. False

Answer 26

B. False

See pages 3.1020 in the Fraud Examiner’s Manual

A follow-up or recommendations section is generally an optional part of a written fraud examination report. This section identifies any aspect of the investigation that remains outstanding, usually because it is outside the mandate of the investigator. This could include the recovery of property that is in the possession of third parties or the collection of information held by vendors or suppliers.

Question 27

Which of the following steps should be taken to prepare an organization for a formal fraud investigation?

A. Notify the organization’s legal counsel when the investigation is about to commence
B. Prepare the managers of the employees who will be involved in the investigation
C. Notify key decision-makers when the investigation is about to begin
D. All of the above

Answer 27

D. All of the above

See pages 3.144 in the Fraud Examiner’s Manual

Before commencing a formal investigation (and especially before starting the evidence-collection process), it might be necessary to prepare the subject organization for the investigation. Preparing an organization for an investigation involves preparing the managers of the employees who will be involved in the investigation, notifying key decision-makers when the investigation is about to begin, and notifying the organization’s in-house or outside counsel when the investigation is about to commence.

Question 28

Which of the following BEST describes predication?

A. The initial phase of an interview
B. The initial phase of the investigative process
C. The means by which individuals justify their unethical actions
D. The basis upon which a fraud examination is undertaken

Answer 28

D. The basis upon which a fraud examination is undertaken

See pages 3.105-3.106 in the Fraud Examiner’s Manual

Fraud examinations must adhere to the law; therefore, fraud examiners should not conduct or continue fraud examinations without proper predication. Predication is the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe that a fraud has occurred, is occurring, or will occur. In other words, predication is the basis upon which a fraud examination, and each step taken during the examination, is commenced.

A fraud examiner acts on predication when there is a sufficient basis and legitimate reason to take each step in an examination.

Accordingly, fraud examiners should begin a fraud examination only when there are circumstances that suggest fraud has occurred, is occurring, or will occur, and they should not investigate beyond the available predication. If fraud examiners cannot articulate a factual basis or good reason for an investigative step, they should not do it. Therefore, fraud examiners should reevaluate the predication as the fraud examination proceeds. That is, as a fraud examination progresses and new information emerges, fraud examiners should continually reevaluate whether there is adequate predication to take each additional step in the examination.

If fraud examiners act without predication, they might expose themselves and their clients or employers to liability.

Question 29

To properly prepare an organization for a formal fraud investigation, all employees should be notified of the investigation’s existence and purpose.

A. True
B. False

Answer 29

B. False

See pages 3.144 in the Fraud Examiner’s Manual

Generally, it is not good practice to alert all of an organization’s employees that an investigation will be taking place, nor should the investigation’s purpose be explained to all employees. However, it might be necessary to take some steps to prepare the subject organization for the formal investigation before it officially commences (and especially before starting the evidence-collection process).

Preparing an organization for an investigation involves preparing the managers of the employees who will be involved in the investigation, notifying key decision-makers when the investigation is about to begin, and notifying the organization’s in-house or outside counsel when the investigation is about to commence. Note that while it might be necessary to prepare the managers of the employees who will be involved in the investigation, those responsible should not do so by explaining the investigation’s purpose, why the investigation is happening, when it is happening, or who is involved.

Question 30

Which of the following corrective measures might be suggested in the follow-up/recommendations section of a fraud examination report?

A. The introduction of a fraud reporting system
B. A review of internal controls
C. An increase in security
D. All of the above

Answer 30

D. All of the above

See pages 3.1020 in the Fraud Examiner’s Manual

A follow-up or recommendations section is generally an optional part of a written fraud examination report. This section identifies any aspect of the investigation that remains outstanding, usually because it is outside the mandate of the investigator. This could include the recovery of property that is in the possession of third parties or the collection of information held by vendors or suppliers.

If requested, the fraud examiner might make recommendations related to procedures and controls; however, it is better for the fraud examiner to convey recommendations related to flawed internal controls and other organizational failings to management in person or in a separate document. If included in the primary report, this information could potentially be seized upon by defense attorneys at a trial or by representatives at an unemployment hearing to push blame away from the suspect’s actions and toward the organization’s shortcomings.

Follow-ups or recommendations should state what action is necessary or recommended, including remedial measures such as a review of internal controls, the introduction of a fraud reporting system, or an increase in security.

Question 31

When conducting fraud examinations, fraud examiners should follow the fraud theory approach.

A. True
B. False

Answer 31

A. True

See pages 3.107 in the Fraud Examiner’s Manual

When conducting fraud examinations, fraud examiners should follow the fraud theory approach. The fraud theory approach is an investigative framework designed to help fraud examiners organize and direct examinations based on the information available at the time. According to the fraud theory approach, when conducting investigations into allegations or signs of fraud, the fraud examiner should:

• Analyze the available data.
• Create a hypothesis.
• Test the hypothesis.
• Refine and amend the hypothesis.

Question 32

Which of the following is NOT part of the fraud examination process?

A. Determining whether the subject is guilty or innocent
B. Testifying to findings
C. Assisting in the detection and prevention of fraud
D. Writing reports

Answer 32

A. Determining whether the subject is guilty or innocent

See pages 3.102 in the Fraud Examiner’s Manual

The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional. The fraud examination process encompasses a variety of tasks that might include:

• Obtaining evidence
• Reporting
• Testifying to findings
• Assisting in fraud detection and prevention

Question 33

An organization’s fraud response plan should detail how the organization will conduct fraud examinations in all situations, regardless of the type of fraud that took place.

A. True
B. False

Answer 33

B. False

See pages 3.112 in the Fraud Examiner’s Manual

When evidence of misconduct arises, management must respond in an appropriate and timely manner. During the initial response, time is critical. To help ensure that an organization responds to suspicious fraud-related activity efficiently and effectively, management should have a response plan in place.

A fraud response plan details the actions that members of an organization will take when suspicions of fraud arise. Because every fraud is different, the response plan should not specify how all fraud examinations should be conducted. Instead, it should help organizations manage their responses and create environments that minimize risk and maximize the potential for success.

While the appropriate response will vary based on the event, management should include a range of scenarios in the response plan, taking into consideration previous frauds within the organization and fraud risks specific to the industry or business sector in which it operates.

Question 34

When drafting a written fraud examination report, fraud examiners should, whenever possible, include technical jargon to demonstrate expertise in the accurate detection of fraud.

A. True
B. False

Answer 34

B. False

See pages 3.1004 in the Fraud Examiner’s Manual

Fraud examination reports must show clarity. Thus, fraud examiners should try to avoid using jargon because the report might be read by people who are not familiar with esoteric or technical terminology. Use complex or technical terms in their proper contexts, and where necessary, explain their meaning.

Question 35

Management of the ABC Company hired Michael, a fraud examiner, to investigate Deborah, an employee in ABC’s accounting department, for embezzlement. According to the fraud examination methodology, which of the following individuals should Michael interview first?

A. Roger, an employee for the ABC Company, who is suspected of being an accomplice to Deborah’s scheme
B. John, Deborah’s spouse
C. Deborah
D. Amanda, a neutral employee, who is the director of ABC’s accounting department

Answer 35

D. Amanda, a neutral employee, who is the director of ABC’s accounting department

See pages 3.106-3.107 in the Fraud Examiner’s Manual

Fraud examinations should begin with general information that is known and then transition to details that are more specific. In most examinations, fraud examiners should start interviewing people who are less involved in the issues related to the examination before interviewing witnesses who appear to be more involved. Thus, neutral third-party witnesses should generally be interviewed first, followed by parties suspected of complicity, starting with the least culpable and moving to the most culpable. The primary suspect should be interviewed last.

Question 36

Which of the following is a function of a fraud examination report?

A. To convey all the evidence necessary for parties to evaluate the case
B. To add credibility to the fraud examination and the fraud examiner’s work
C. To document the results of the fraud examination
D. All of the above

Answer 36

D. All of the above

See pages 3.1001 in the Fraud Examiner’s Manual

A fraud examination report documents the results of a fraud examination and is generally created by one or more critical members of the fraud examination team. Documenting results is a particularly important function in fraud examinations. The fraud examination report conveys all evidence necessary to evaluate the case, and it can be used to support previously known facts. An accurate report will add credibility to the fraud examination and the fraud examiner’s work.

Question 37

A fraud response plan details the actions an organization will take when suspicions of fraud arise.

A. True
B. False

Answer 37

A. True

See pages 3.112 in the Fraud Examiner’s Manual

When evidence of misconduct arises, management must respond in an appropriate and timely manner. During the initial response, time is critical. To help ensure that an organization responds to suspicious fraud-related activity efficiently and effectively, management should have a response plan in place. A fraud response plan details the actions an organization will take when suspicions of fraud arise.

Question 38

The fraud examiner should document the details of an interview as soon as possible after the interview date.

A. True
B. False

Answer 38

A. True

See pages 3.1005 in the Fraud Examiner’s Manual

Written reports must be timely. The timeliness of reports is extremely important because it enhances the accuracy of witness testimony and preserves the fraud examiner’s memory of the interview(s). Thus, all interviews should be transcribed and documented in a memorandum of interview as soon as possible after the questioning takes place—preferably on the same day of the interview.

Question 39

Fraud examination is BEST described as which of the following?

A. A method for finding evidence of guilt
B. A method for proving the culpability of a suspect
C. A methodology for resolving fraud allegations from inception to disposition
D. The science of detecting fraud

Answer 39

C. A methodology for resolving fraud allegations from inception to disposition

See pages 3.102 in the Fraud Examiner’s Manual

The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional. The fraud examination process encompasses a variety of tasks that might include:

• Obtaining evidence
• Reporting
• Testifying to findings
• Assisting in fraud detection and prevention

Question 40

Which of the following terms is defined as the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe a fraud has occurred, is occurring, or will occur?

A. Fraud theory
B. Predication
C. Suspicion
D. Declaration

Answer 40

B. Predication

See pages 3.105-3.106 in the Fraud Examiner’s Manual

Fraud examinations must adhere to the law; therefore, fraud examiners should not conduct or continue fraud examinations without proper predication. Predication is the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe that a fraud has occurred, is occurring, or will occur. In other words, predication is the basis upon which a fraud examination, and each step taken during the examination, is commenced.

A fraud examiner acts on predication when there is a sufficient basis and legitimate reason to take each step in an examination.

Accordingly, fraud examiners should begin a fraud examination only when there are circumstances that suggest fraud has occurred, is occurring, or will occur, and they should not investigate beyond the available predication. If fraud examiners cannot articulate a factual basis or good reason for an investigative step, they should not do it. Therefore, fraud examiners should reevaluate the predication as the fraud examination proceeds. That is, as a fraud examination progresses and new information emerges, fraud examiners should continually reevaluate whether there is adequate predication to take each additional step in the examination.

If fraud examiners act without predication, they might expose themselves and their clients or employers to liability.