The Certified Fraud Examiner (CFE) - Investigation (CFE-Investigation)

The 2014 International Fraud Examiners Manual provides examples of data analysis for accounts payable:

“Examples of data analysis queries that can be performed to help detect fraud through examination of accounts payable include:

• Audit paid invoices for manual comparison with actual invoices.

• Summarise large invoices by amount, vendor, etc.

• Identify debits to expense accounts outside of set default accounts.

• Reconcile cheque registers to disbursements by vendor invoice.”

While other functions apply to payroll or asset management, the most effective function for accounts payable fraud detection is to summarize large invoices by amount and vendor.

Social media content is dynamic—posts can be edited, deleted, or moved—so fraud examiners must preserve relevant information promptly and in a manner that supports authenticity and admissibility. CFE investigative guidance emphasizes that documentary (including digital) evidence carries limited value in legal proceedings unless it can be shown to be authentic and in substantially the same condition as when collected. Simply saving a link (Option A) is weak because the underlying content can change, and a link does not preserve what was actually observed. Requesting a copy from the platform (Option B) is often impractical as a routine step and may require legal process; it also does not replace contemporaneous preservation by the examiner. A “forensic shutdown” (Option C) is not an appropriate method for preserving web-based social media content because the key evidence exists on external servers, not solely on the examiner’s machine. Proper practice is to download/capture and preserve what was observed while documenting the collection steps and maintaining a defensible chain of custody so authenticity can be established if needed in court.

The Fraud Examiners Manual defines double-negative questions as those containing two forms of negation in a single clause. They are confusing and “often suggest an answer opposite to the correct one.” The example given is almost identical to the question here:

“Didn’t you suspect that something wasn’t right?”.

Thus, Sylvia’s question is a double-negative question, which should be avoided.

The 2014 International Fraud Examiners Manual provides:

“Fraud examiners can use a correlation analysis to determine the relationships between different variables in raw data… For example, there should be a strong correlation between the independent and dependent variables because there is a direct relationship between them. Hotel costs should increase as the number of days travelled increases.”

CFE Prep – Investigations echoes this:

“Using the correlation analysis function, fraud examiners can determine the relationships between different variables in the raw data. For example… Hotel costs should increase as the number of days travelled increases.”

Thus, the most useful analysis is Correlation analysis.

Phone records are classified as nonpublic records. The Fraud Examiners Manual explains that personal telephone and mobile records usually require consent, subpoena, or warrant to access. Public records, by contrast, include real property ownership and corporate filings. Therefore, B is correct.

CFE admission-seeking guidance explains that once a suspect begins providing detailed information about the offense, the interviewer should transition to obtaining a verbal confession and then “probe gently” for additional details—preferably details only the subject would know. As part of confirming the general details of the offense during the verbal confession, the interviewer should obtain key baseline facts such as estimates of amounts involved, identification of other parties involved, and the location of physical evidence. Among the choices, a general estimate of the amount of money involved (A) is explicitly aligned with what the CFE guidance expects the interviewer to gather during the verbal admission stage because it helps establish scope and supports later corroboration and restitution analysis. Option B is less fitting because the emphasis is on what the suspect can reliably provide (their own actions and knowledge), not “facts known to others.” Option C attempts to build a defense narrative rather than obtain factual admission details. Option D may be useful for remediation later, but it is not a primary objective during the verbal confession stage.

Credit reports can sometimes be obtained legally if proper consent or a recognized legal basis (such as employment background checks, extension of credit, or legal proceedings) exists. The Manual notes:

“Access to personal credit data may be permitted when the individual has given consent or when required for employment, credit, or legal reasons”.

Thus, it is not true that credit data can never be obtained—circumstances exist where it can be done lawfully.

Detailed Explanation with Extracts = The Fraud Examiners Manual states:

“When reporting the results of a fraud examination, it is best to include copies (not originals) of important documents in the formal report”.

Originals should be safeguarded separately for evidence; reports should use copies.

Therefore, the statement is true.

Best practices emphasize separation:

“Interviews should be conducted one-on-one to reduce the possibility of collusion, contamination, or intimidation of witnesses” (Fraud Examiners Manual – Interviewing Guidelines).This ensures independent and uncontaminated statements.