CFE-Investigation Exam Dumps - Certified Fraud Examiner (CFE) - Investigation

“Electronic payment records can be valuable in tracing investigations… they can reveal, among other things, assets the subject has purchased”.

They can also reveal loans, real estate taxes, and business locations, but not directly whether Lottie is “skimming” funds.

Benford’s Law applies to naturally occurring sets of numbers such as invoice amounts, expense reports, and transaction data. The Fraud Examiners Manual shows Benford’s Law tests applied to vendor payments to detect anomalies like duplicate or inflated invoices. Telephone numbers, employee IDs, and bank account numbers are assigned numbers and do not follow Benford’s distribution, so they are unsuitable for this test.

The best practices for signed statements include:

Adding omitted facts as an addendum.

Preparing separate statements for unrelated offenses.

Having witnesses to the signing.

But:

“The signed statement should be reduced to a short and concise written statement. The interviewer should prepare the statement and present it to the confessor for his signature” .

Thus, requiring the suspect to handwrite the entire statement is not a best practice.

The Fraud Examiners Manual lists required steps before seizing evidence:

Obtain legal authority.

Review privacy issues.

Ensure software/hardware are validated.

Document surroundings, inspect for traps, image drives, etc.

There is no requirement to assemble a team exclusively of outside experts.

Before seizing evidence in a digital forensic investigation, the 2014 International Fraud Examiners Manual outlines several critical steps:

Obtain legal authority / review orders:

“Before obtaining evidence, ensure that there is legal authority to seize evidence and review the data associated with the evidence. This might require obtaining a warrant in a criminal matter or ensuring that internal policies authorise seizure for an internal investigation.”

Determine privacy issues:

“Before the fraud examiner can seize evidence, he must take certain steps to help ensure that the evidence will be admissible: He must determine whether there are any privacy interests in the item(s) to be searched… In every case where it becomes necessary to seize a computer or other device capable of storing digital evidence, the investigator should consult with legal counsel.”

Use only trained professionals/software:

“It is important to allow a trained examiner to conduct a proper seizure and examination of digital evidence to help ensure that the information can be used in a legal proceeding.”

✅ These are all valid required steps.

In contrast, the idea that the team must be composed only of outside digital forensic experts is NOT a required step. The Manual stresses flexibility in team composition:

“Some organisations have their own in-house personnel… while others might prefer the use of an outside examiner. Sometimes retrieving digital data is as easy as searching the target computer’s hard drive, but other times retrieval requires a thorough knowledge of computers.”

Thus, requiring only outside experts is not a standard step, since investigations may use internal, external, or a mix of specialists depending on the situation.

Fraud examination reports are not written only for internal use. The 2014 International Fraud Examiners Manual clearly emphasizes:

“When drafting a report, fraud examiners must consider who might end up reading it. Fraud examiners should keep in mind that the fraud examination report will be read by the general public and adverse parties. Under no circumstances should the fraud examiner prepare a communication with the idea that the information will not be disclosed to adverse third parties. Fraud examiners should draft their reports with this caveat in mind.”

The manual further specifies the wide range of potential readers:

*“There are many individuals and groups that might end up reading a fraud examination report, including the following parties:

Company insiders (managers, board of directors, owners, investors, etc.)

Attorneys (legal counsel, prosecutors, regulators, and defense counsel)

Defendants and witnesses

Press and media outlets

Judges or juries”*

This aligns with the CFE Prep - Investigations study guide, which also confirms:

“There are many parties that might read a fraud examination report, including company insiders, attorneys, defendants and witnesses, press and media outlets, and judges or juries.”

📌 Interpretation:

The media may access the report through litigation disclosures or leaks.

Opposing legal counsel will review the report during discovery or trial.

Investors and owners (company insiders) are primary stakeholders.

Thus, the only correct choice is D. All of the above, because fraud examination reports must be written with all possible audiences in mind, ensuring accuracy, clarity, impartiality, and professionalism to withstand scrutiny from multiple directions.

The Fraud Examiners Manual advises avoiding prematurely alerting perpetrators. Recommended methods include:

“Conducting investigations at times when the suspect is not present (such as nonbusiness hours)”.

This avoids tipping off suspects.

When a respondent says “I’m too busy,” it can be diffused by stressing “the interview will be short, the interviewer is already there, the project is important, [and] the interview will not be difficult”.

Thus, stressing brevity is the recommended reaction.

The Fraud Examiners Manual stresses that fraud examiners must never promise unconditional confidentiality, because findings often must be disclosed to management, auditors, or authorities. They can only offer “qualified confidentiality” (best efforts to protect identity, but with necessary limits). Therefore, option A is the most appropriate response.