CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Questions and Answers

Interview Dierdre and Matthew separately.

Interview Dierdre and Matthew at the same time, but bring in a second interviewer

Interview Dierdre and Matthew at the same time by himself

Allow Matthew to be present as a silent observer.

Covertly record all interviews with potential suspects.

Note impressions regarding the subject's guilt or innocence.

Err on the side of taking too few notes rather than too many.

Write down verbatim all the information that the subject provides

A victim of fraud wants to facilitate the recovery of criminal proceeds.

An employer wants to know if an employee is falsifying regulatory reports

An attorney wants to evaluate an expert's financial report

An entity needs to find hidden relationships in big data that otherwise would not be discovered.

"The company's internal controls were wholly inadequate to prevent this type of violation and should be remediated at the earliest possible time."

"The evidence shows that expenses in excess of $5 million were omitted from the company's financial statements "

"Based on statements the suspect made to me. it is my assessment that the suspect has a dishonest disposition."

"From my examination, it appears that the company's financial statements were not presented in accordance with generally accepted accounting principles "

Local court records

Commercial filings

Building permit records

Voter registration records

Double-negative

Free narrative

Controlled answer

Complex

"Did you steal the money?"

'What did you do with the money?"

"Why did you take the money?"

"How much of the money do you have left?"

To access any user-posted information on social media sites, fraud examiners must obtain some type of legal order from the jurisdiction in which the user resides.

A fraud examiner cannot be held liable for violating a user's privacy rights if they hack or break into areas of a social networking site designated as private because all social media information is public.

The Privacy of Social Networks Treaty is a binding international treaty that makes it illegal for law enforcement to seek social media log-in credentials from users.

Hacking or breaking into information on social media sites that is restricted as private could result in liability for fraud examiners due to violation of users' privacy rights.

"Did you commit any misconduct against the company?"

"Do you know what the punishment is for violations like this'5"

"Do you know who might have defrauded the company?"

"How many jobs have you had before this one?’

True

False

Document notes for each interview separately, nduding those for electronic recordings.

Write down verbatim all of (he information that the subject provides during the interview

Err on the side of taking too many notes rather than too few.

Note impressions regarding the subject's guilt or innocence.

The market value of any real property Lottie owns

The assets that Lottie has purchased

The division and distribution of Lottie's assets

If Lottie is skimming her employer's funds

If Lucas's computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data

If Lucas's computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interlace.

If Lucas's computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

If Lucas's computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process

Reducing Delta's stress about possibly being fired

Claiming Delta's action was for altruistic reasons

Reducing Delta's perception of the legal seriousness of the matter

Establishing that Delta's family was being treated unfairly

Telephone numbers

Vendor invoice amounts

Employee identification numbers

Bank account numbers

Discourage Plum from showing any emotion.

Remain silent until Plum makes a confession.

Insist that Plum sit up straight in her chair

Continue to display evidence that implicates Plum

Time and date information about files

Websites visited

Files that have been overwritten

Communications sent via instant messenger

Duplicate search

Benford's Law analysis

Correlation analysis

Linear regression

Tara should preserve the information by saving the links of the postings as bookmarks in her browser.

Tara should preserve the metadata by printing out the web pages of each of the postings.

Tara should conduct a forensic shutdown of the computer to preserve the metadata m the social networking sites.

Tara should preserve the information from the sites so that it can be established as authentic if used in court.

That Justine will confess to the accusation when prompted

That Justine's employer will take disciplinary action against Justine if she confesses

That the interview's time, place, and content can De controlled

That no other person was involved in the fraud n question

"Has the defendant been previously arrested for allegedly committing a white-collar crime?"

"Does the defendant have sufficient property or money to satisfy a money judgment?"

"Is there a relevant statute of limitations?"

"Is the suspect guilty of the fraudulent act?"

Compare book and tax depreciation and indicate variances

Identify paycheck amounts over a certain limit

Review recurring monthly expenses and compare to posted/paid invoices

All of the above