Pass the ACFE Certified Fraud Examiner CFE-Investigation Questions and answers with CertsForce

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

“To locate people using online records… First, when searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

This aligns with the Prep guide: “Obtaining a past address of the subject should be the first step in trying to locate a subject using online records”.

Thus, B is correct.

During admission-seeking interviews, fraud examiners often employ rationalization techniques to help the suspect justify their misconduct and make it easier to confess. One of these rationalizations is the altruistic appeal.

From the 2014 International Fraud Examiners Manual:

“Facilitators of communication are those socio-psychological forces that make conversations, including interviews, easier to accomplish. These facilitators require a basic understanding of what motivates people. The facilitators are: fulfilling expectations, recognition, altruistic appeals, sympathetic understanding, new experience, catharsis, need for meaning, and extrinsic rewards.”

From the CFE Prep - Investigations study guide:

“Facilitators of communication… include fulfilling expectations, recognition, altruistic appeals, sympathetic understanding, new experience, catharsis, need for meaning, and extrinsic rewards.”

???? Application to Scenario:

Beta says: “I know you didn’t do this for yourself; it was for your family.”

This is a classic altruistic appeal — reframing the suspect’s motive as selfless or for the benefit of others, rather than selfish wrongdoing.

The purpose is to reduce internal resistance to confessing by allowing the suspect to rationalize the act as being for a noble reason.

The Fraud Examiners Manual and CFE Prep Guide explain that tracing loan proceeds is a key investigative tool, but its scope is limited. Specifically, it helps determine:

if proceeds were deposited into hidden accounts,

if hidden accounts were used for loan payments, and

if loans were secured by hidden assets or unknown witnesses.

However, the manuals do not state that tracing loan proceeds can identify internal control weaknesses. That is a different aspect of fraud examination, often addressed through audit procedures or control assessments.

Thus, option D is NOT true.

The Fraud Examiners Manual lists required steps before seizing evidence:

Obtain legal authority.

Review privacy issues.

Ensure software/hardware are validated.

Document surroundings, inspect for traps, image drives, etc.

There is no requirement to assemble a team exclusively of outside experts.

Before seizing evidence in a digital forensic investigation, the 2014 International Fraud Examiners Manual outlines several critical steps:

Obtain legal authority / review orders:

“Before obtaining evidence, ensure that there is legal authority to seize evidence and review the data associated with the evidence. This might require obtaining a warrant in a criminal matter or ensuring that internal policies authorise seizure for an internal investigation.”

Determine privacy issues:

“Before the fraud examiner can seize evidence, he must take certain steps to help ensure that the evidence will be admissible: He must determine whether there are any privacy interests in the item(s) to be searched… In every case where it becomes necessary to seize a computer or other device capable of storing digital evidence, the investigator should consult with legal counsel.”

Use only trained professionals/software:

“It is important to allow a trained examiner to conduct a proper seizure and examination of digital evidence to help ensure that the information can be used in a legal proceeding.”

✅ These are all valid required steps.

In contrast, the idea that the team must be composed only of outside digital forensic experts is NOT a required step. The Manual stresses flexibility in team composition:

“Some organisations have their own in-house personnel… while others might prefer the use of an outside examiner. Sometimes retrieving digital data is as easy as searching the target computer’s hard drive, but other times retrieval requires a thorough knowledge of computers.”

Thus, requiring only outside experts is not a standard step, since investigations may use internal, external, or a mix of specialists depending on the situation.

Explanation with Extracts = The Fraud Examiners Manual explains:

“Conducting digital forensic investigations in the cloud environment (i.e., cloud forensics) presents challenges not faced in traditional forensic practices… Some of the important challenges… Lack of frameworks and specialist tools, Lack of information accessibility, Lack of data control, Jurisdiction of storage…” .

Specifically: “With cloud computing, clients of cloud service providers do not have physical control of the media or the network on which their data resides, and this lack of data control can complicate efforts to collect data stored on the cloud” .

Thus, lack of data control is a unique challenge.

The CFE Prep – Investigations explains:

“Metadata is a type of computer-generated data that can be helpful in a fraud investigation. Metadata information can help determine who wrote a document; who received, opened, copied, edited, moved, or printed the document; and when these events occurred” .

Thus, metadata is the most useful for identifying who created a document.

Body language alone (e.g., avoiding eye contact) cannot be taken as proof of deception. The Manual warns against drawing conclusions from a single behavioral cue:

“Avoiding eye contact is not directly linked to deception. Such behavior could stem from cultural norms, nervousness, or personality traits. Examiners should consider clusters of behavior, context, and corroborating evidence before concluding deception”.

Therefore, C is correct.

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

The Fraud Examiners Manual states that admission-seeking interviews should avoid yes/no questions like “Did you steal the money?” because they encourage denials. Instead, the question should be phrased as if guilt has already been established. The Manual explicitly warns:

“The accusation should be made in the form of a statement; it should not be made in the form of a question… Avoid emotive words such as steal, fraud, and crime… Example: ‘It is not so much a question of what you did, but why you did it.’”

Thus, the most effective admission-seeking phrasing is: “Why did you take the money?” because it presumes involvement and encourages explanation rather than denial.