Question 1000
The case file describes the following: A fraud network cultivates a victim over weeks, displays fictitious trading profits and then blocks withdrawals unless new fees are paid. Which classification best explains the events?
- Online romance investment grooming
- Pig-butchering investment scam
- Advance-fee lottery fraud
- Ponzi payout financing
Explanation
Correct Answer
B:Pig-butchering investment scam fits the facts because long-form social engineering combines relationship grooming with fabricated investment performance; the distinguishing observation is that platform balances rise without verifiable custody and withdrawal attempts trigger extra demands. To test this interpretation, a reviewer should verify platform licensing and wallet flows instead of trusting account screenshots.
Incorrect Answers
A:Online romance investment grooming would involve a different sequence from Pig-butchering investment scam: the fraud uses emotional trust to induce transfers, often without the promised investment existing. Unlike the rejected Online romance investment grooming label, the evidence concerns Pig-butchering investment scam, since platform balances rise without verifiable custody and withdrawal attempts trigger extra demands; reviewers should verify platform licensing and wallet flows instead of trusting account screenshots.
C:Advance-fee lottery fraud would involve a different sequence from Pig-butchering investment scam: the promise of future value is used to extract an immediate fee without a real award. Unlike the rejected Advance-fee lottery fraud label, the evidence concerns Pig-butchering investment scam, since platform balances rise without verifiable custody and withdrawal attempts trigger extra demands; reviewers should verify platform licensing and wallet flows instead of trusting account screenshots.
D:Ponzi payout financing would involve a different sequence from Pig-butchering investment scam: a Ponzi structure pays old investors with new funds while misrepresenting actual returns. Unlike the rejected Ponzi payout financing label, the evidence concerns Pig-butchering investment scam, since platform balances rise without verifiable custody and withdrawal attempts trigger extra demands; reviewers should verify platform licensing and wallet flows instead of trusting account screenshots.
Question 1001
A process owner is assessing safeguards for inflated year-end inventory. The mechanism is: Overstated ending inventory usually understates cost of goods sold and inflates earnings. Which control addresses it most directly?
- Segregate count teams and reconcile physical results with perpetual records.
- Maintain conflict declarations and review related-party transactions for required disclosure.
- Independently review goods and services received near the cutoff date.
- Apply reviewed capitalization thresholds and expense nonqualifying costs.
Explanation
Correct Answer
A:The control directly addresses the failure point in Inflated year-end inventory, since overstated ending inventory usually understates cost of goods sold and inflates earnings. A subsequent independent review could perform independent counts and test ownership and valuation of selected stock to identify exceptions that bypassed the safeguard.
Incorrect Answers
B:This safeguard is directed primarily at Omitted related-party disclosure rather than Inflated year-end inventory, because even when amounts are recorded, withholding material relationship information can mislead statement users. Unlike the control for Omitted related-party disclosure, the more direct design for Inflated year-end inventory is to segregate count teams and reconcile physical results with perpetual records; a different safeguard cannot substitute for it.
C:This safeguard is directed primarily at Unrecorded accrued liabilities rather than Inflated year-end inventory, because omitting obligations understates liabilities and costs rather than creating new cash resources. Unlike the control for Unrecorded accrued liabilities, the more direct design for Inflated year-end inventory is to segregate count teams and reconcile physical results with perpetual records; a different safeguard cannot substitute for it.
D:This safeguard is directed primarily at Capitalized routine operating costs rather than Inflated year-end inventory, because moving a period expense into assets understates expenses and overstates profit and assets. Unlike the control for Capitalized routine operating costs, the more direct design for Inflated year-end inventory is to segregate count teams and reconcile physical results with perpetual records; a different safeguard cannot substitute for it.
Question 1002
A reviewer wants to distinguish unrecorded accrued liabilities from adjacent risk patterns. Which observation is the most diagnostic indicator?
- Unusual new assets have expense-like vendor descriptions and no future qualifying benefit.
- Post-close payments relate to services delivered before the balance-sheet date.
- Warehouse counts and ownership terms disagree with inventory listings.
- Customer correspondence conflicts with the written contract and booked revenue.
Explanation
Correct Answer
B:This observation is a pertinent indicator of Unrecorded accrued liabilities because omitting obligations understates liabilities and costs rather than creating new cash resources. The practical corroborating procedure is to search subsequent disbursements for missing accruals and compare receiving logs with liabilities; the indicator by itself does not establish intent or error.
Incorrect Answers
A:The proposed observation fits Capitalized routine operating costs, where moving a period expense into assets understates expenses and overstates profit and assets, rather than the particular mechanism in Unrecorded accrued liabilities. Unlike the clue for Capitalized routine operating costs, the more directly related indicator for Unrecorded accrued liabilities is this: Post-close payments relate to services delivered before the balance-sheet date.
C:The proposed observation fits Inflated year-end inventory, where overstated ending inventory usually understates cost of goods sold and inflates earnings, rather than the particular mechanism in Unrecorded accrued liabilities. Unlike the clue for Inflated year-end inventory, the more directly related indicator for Unrecorded accrued liabilities is this: Post-close payments relate to services delivered before the balance-sheet date.
D:The proposed observation fits Concealed sales-side agreement, where undisclosed contractual rights may defeat the assertion that a recorded sale is final or earned, rather than the particular mechanism in Unrecorded accrued liabilities. Unlike the clue for Concealed sales-side agreement, the more directly related indicator for Unrecorded accrued liabilities is this: Post-close payments relate to services delivered before the balance-sheet date.
Question 1003
Two separate review files raise different issues. File A: A company has verified total assets and obligations and must explain the residual claim belonging to owners. File B: A distributor reports product sales and their direct acquisition costs but excludes payroll and office rent from its initial margin measure. Which pairing accurately classifies both files?
- File A: Equity reconciliation; File B: Financing cash-flow classification.
- File A: Accounting-framework selection; File B: Gross-profit calculation.
- File A: Equity reconciliation; File B: Gross-profit calculation.
- File A: Gross-profit calculation; File B: Equity reconciliation.
Explanation
Correct Answer
C:File A is Equity reconciliation because equity is the residual interest in assets after deducting liabilities, not a bank balance or revenue figure, while File B is Gross-profit calculation because gross profit isolates direct goods margin rather than the final earnings after all operating and other costs. The evidence chains differ: for File A, reviewers should recalculate the accounting equation and trace changes to equity transactions and results; for File B, they should match recorded sales and corresponding inventory costs before analyzing gross margin.
Incorrect Answers
A:File B is misidentified as Financing cash-flow classification instead of Gross-profit calculation. With the proposed pairing Equity reconciliation / Financing cash-flow classification, the distinction is substantive: File A shows that the reported owners' interest does not equal assets less liabilities, whereas File B shows that the margin calculation changes unexpectedly when cost of goods sold is misstated. For these Equity reconciliation and Gross-profit calculation files, choosing the pair Equity reconciliation / Financing cash-flow classification would misdirect the review away from at least one of these mechanisms.
B:File A is misidentified as Accounting-framework selection instead of Equity reconciliation. With the proposed pairing Accounting-framework selection / Gross-profit calculation, the distinction is substantive: File A shows that the reported owners' interest does not equal assets less liabilities, whereas File B shows that the margin calculation changes unexpectedly when cost of goods sold is misstated. For these Equity reconciliation and Gross-profit calculation files, choosing the pair Accounting-framework selection / Gross-profit calculation would misdirect the review away from at least one of these mechanisms.
D:File A is misidentified as Gross-profit calculation instead of Equity reconciliation; File B is misidentified as Equity reconciliation instead of Gross-profit calculation. With the proposed pairing Gross-profit calculation / Equity reconciliation, the distinction is substantive: File A shows that the reported owners' interest does not equal assets less liabilities, whereas File B shows that the margin calculation changes unexpectedly when cost of goods sold is misstated. For these Equity reconciliation and Gross-profit calculation files, choosing the pair Gross-profit calculation / Equity reconciliation would misdirect the review away from at least one of these mechanisms.
Question 1004
Control designers are focusing on the mechanism behind chip-card shimming: A shim targets information in the chip-card interface; chip transaction data alone does not necessarily permit cloning a valid chip. Which measure best limits that opportunity?
- Use risk-based customer authentication and fulfillment fraud screening.
- Inspect terminals, secure card readers and promote chip-based authentication.
- Monitor repeated reciprocal check deposits and enforce funds-availability controls.
- Use tamper inspections and properly implemented EMV transaction validation.
Explanation
Correct Answer
D:The control directly addresses the failure point in Chip-card shimming, since a shim targets information in the chip-card interface; chip transaction data alone does not necessarily permit cloning a valid chip. A subsequent independent review could inspect card-reader slots and correlate card compromise with device servicing logs to identify exceptions that bypassed the safeguard.
Incorrect Answers
A:This safeguard is directed primarily at Card-not-present shopping fraud rather than Chip-card shimming, because remote payment misuse exploits card credentials without requiring face-to-face card presentation. Unlike the control for Card-not-present shopping fraud, the more direct design for Chip-card shimming is to use tamper inspections and properly implemented EMV transaction validation; a different safeguard cannot substitute for it.
B:This safeguard is directed primarily at Magnetic-stripe card skimming rather than Chip-card shimming, because skimmers capture card data at a physical payment interface for later unauthorized use. Unlike the control for Magnetic-stripe card skimming, the more direct design for Chip-card shimming is to use tamper inspections and properly implemented EMV transaction validation; a different safeguard cannot substitute for it.
C:This safeguard is directed primarily at Check-kiting float abuse rather than Chip-card shimming, because kiting exploits settlement timing to inflate apparent funds without a genuine source of money. Unlike the control for Check-kiting float abuse, the more direct design for Chip-card shimming is to use tamper inspections and properly implemented EMV transaction validation; a different safeguard cannot substitute for it.
Question 1005
The case file describes the following: A nonprofit volunteer diverts envelopes at a collection point before donations are opened and entered. Which classification best explains the events?
- Cash-safe theft
- Concealment through false refunds
- Cash-sale understatement
- Charity donation skimming
Explanation
Correct Answer
D:Charity donation skimming fits the facts because a donation stolen before entry may leave no accounting shortage unless outside records are used; the distinguishing observation is that donor acknowledgment totals exceed the logged and deposited contributions. To test this interpretation, a reviewer should match donor confirmations and sealed-envelope counts against bank deposits.
Incorrect Answers
A:Cash-safe theft would involve a different sequence from Charity donation skimming: theft of cash on hand depletes a recorded fund without necessarily involving a sales transaction. Unlike the rejected Cash-safe theft label, the evidence concerns Charity donation skimming, since donor acknowledgment totals exceed the logged and deposited contributions; reviewers should match donor confirmations and sealed-envelope counts against bank deposits.
B:Concealment through false refunds would involve a different sequence from Charity donation skimming: a false refund creates an apparently authorized cash outflow, unlike an off-record cash receipt theft. Unlike the rejected Concealment through false refunds label, the evidence concerns Charity donation skimming, since donor acknowledgment totals exceed the logged and deposited contributions; reviewers should match donor confirmations and sealed-envelope counts against bank deposits.
C:Cash-sale understatement would involve a different sequence from Charity donation skimming: the portion never entered in the till is skimmed even though a partial sale appears in the books. Unlike the rejected Cash-sale understatement label, the evidence concerns Charity donation skimming, since donor acknowledgment totals exceed the logged and deposited contributions; reviewers should match donor confirmations and sealed-envelope counts against bank deposits.
Question 1006
A process owner is assessing safeguards for invented procurement need. The mechanism is: Procurement fraud can begin before bids when a false organizational need is created. Which control addresses it most directly?
- Require independent technical and commercial approval of material change orders.
- Control confidential estimate access and log pre-award communications.
- Require independent challenge of need recognition and capital requests.
- Apply aggregation rules to linked purchases and independently review threshold exceptions.
Explanation
Correct Answer
C:The control directly addresses the failure point in Invented procurement need, since procurement fraud can begin before bids when a false organizational need is created. A subsequent independent review could compare proposed purchase needs with inventory, utilization and operational plans to identify exceptions that bypassed the safeguard.
Incorrect Answers
A:This safeguard is directed primarily at Post-award change-order inflation rather than Invented procurement need, because post-award modifications can recoup an artificially low bid or extract excessive payments. Unlike the control for Post-award change-order inflation, the more direct design for Invented procurement need is to require independent challenge of need recognition and capital requests; a different safeguard cannot substitute for it.
B:This safeguard is directed primarily at Leaked confidential price estimate rather than Invented procurement need, because insider disclosure removes the information parity necessary for a fair tender. Unlike the control for Leaked confidential price estimate, the more direct design for Invented procurement need is to require independent challenge of need recognition and capital requests; a different safeguard cannot substitute for it.
D:This safeguard is directed primarily at Split purchases to evade tender threshold rather than Invented procurement need, because fragmentation bypasses a competitive procedure that would apply to the full requirement. Unlike the control for Split purchases to evade tender threshold, the more direct design for Invented procurement need is to require independent challenge of need recognition and capital requests; a different safeguard cannot substitute for it.
Question 1007
Two separate review files raise different issues. File A: A licensing official threatens to withhold a valid permit unless the applicant makes a personal payment. File B: A sales contractor repeatedly finances luxury trips for employees who decide tender awards. Which pairing accurately classifies both files?
- File A: Economic extortion demand; File B: Lavish hospitality influence.
- File A: Economic extortion demand; File B: Undisclosed supplier ownership.
- File A: Inflated charitable donation conduit; File B: Lavish hospitality influence.
- File A: Lavish hospitality influence; File B: Economic extortion demand.
Explanation
Correct Answer
A:File A is Economic extortion demand because extortion relies on coercive leverage over a decision or entitlement rather than a voluntary gratuity, while File B is Lavish hospitality influence because material personal entertainment can influence purchasing discretion even without cash transfer. The evidence chains differ: for File A, reviewers should preserve the demand trail and compare application status to statutory requirements; for File B, they should compare gift registers, travel records and award dates for decision makers.
Incorrect Answers
B:File B is misidentified as Undisclosed supplier ownership instead of Lavish hospitality influence. With the proposed pairing Economic extortion demand / Undisclosed supplier ownership, the distinction is substantive: File A shows that the demanded benefit follows an explicit threat to deny a lawful service, whereas File B shows that benefits rise immediately before procurement decisions involving the sponsor. For these Economic extortion demand and Lavish hospitality influence files, choosing the pair Economic extortion demand / Undisclosed supplier ownership would misdirect the review away from at least one of these mechanisms.
C:File A is misidentified as Inflated charitable donation conduit instead of Economic extortion demand. With the proposed pairing Inflated charitable donation conduit / Lavish hospitality influence, the distinction is substantive: File A shows that the demanded benefit follows an explicit threat to deny a lawful service, whereas File B shows that benefits rise immediately before procurement decisions involving the sponsor. For these Economic extortion demand and Lavish hospitality influence files, choosing the pair Inflated charitable donation conduit / Lavish hospitality influence would misdirect the review away from at least one of these mechanisms.
D:File A is misidentified as Lavish hospitality influence instead of Economic extortion demand; File B is misidentified as Economic extortion demand instead of Lavish hospitality influence. With the proposed pairing Lavish hospitality influence / Economic extortion demand, the distinction is substantive: File A shows that the demanded benefit follows an explicit threat to deny a lawful service, whereas File B shows that benefits rise immediately before procurement decisions involving the sponsor. For these Economic extortion demand and Lavish hospitality influence files, choosing the pair Lavish hospitality influence / Economic extortion demand would misdirect the review away from at least one of these mechanisms.
Question 1008
An examination of magnetic-stripe card skimming begins with this observation: Unrelated card fraud clusters around customers who used the same terminal. Which follow-up procedure gives the most direct evidence?
- Inspect card-reader slots and correlate card compromise with device servicing logs.
- Reconstruct check presentment and availability timelines across related accounts.
- Compare compromised-card common points of purchase and inspect terminals for overlays.
- Correlate order devices, fulfillment addresses, authorization results and cardholder complaints.
Explanation
Correct Answer
C:For the Magnetic-stripe card skimming concern, the procedure tests source evidence behind this observation: Unrelated card fraud clusters around customers who used the same terminal. This matters because skimmers capture card data at a physical payment interface for later unauthorized use; independent corroboration is necessary before accepting any conclusion.
Incorrect Answers
A:This comparison primarily addresses Chip-card shimming, in which a shim targets information in the chip-card interface; chip transaction data alone does not necessarily permit cloning a valid chip; because the present question instead concerns Magnetic-stripe card skimming, reviewers should compare compromised-card common points of purchase and inspect terminals for overlays rather than apply a check designed for Chip-card shimming.
B:This comparison primarily addresses Check-kiting float abuse, in which kiting exploits settlement timing to inflate apparent funds without a genuine source of money; because the present question instead concerns Magnetic-stripe card skimming, reviewers should compare compromised-card common points of purchase and inspect terminals for overlays rather than apply a check designed for Check-kiting float abuse.
D:This comparison primarily addresses Card-not-present shopping fraud, in which remote payment misuse exploits card credentials without requiring face-to-face card presentation; because the present question instead concerns Magnetic-stripe card skimming, reviewers should compare compromised-card common points of purchase and inspect terminals for overlays rather than apply a check designed for Card-not-present shopping fraud.
Question 1009
Two separate review files raise different issues. File A: An exporter sells valuable goods to an overseas associate at an artificially low declared price. File B: A small service business records large volumes of invented cash sales to commingle illicit funds. Which pairing accurately classifies both files?
- File A: Trade under-invoicing; File B: Trade over-invoicing.
- File A: Cash-intensive front business; File B: Trade under-invoicing.
- File A: Bulk currency courier; File B: Cash-intensive front business.
- File A: Trade under-invoicing; File B: Cash-intensive front business.
Explanation
Correct Answer
D:File A is Trade under-invoicing because underpricing can move economic value to an offshore counterparty through an ostensibly normal sale, while File B is Cash-intensive front business because fictitious sales provide a plausible bookkeeping story for introducing criminal cash. The evidence chains differ: for File A, reviewers should reconcile trade invoices with shipping detail, customs declarations and market benchmarks; for File B, they should compare reported cash sales with independent capacity, procurement and customer evidence.
Incorrect Answers
A:File B is misidentified as Trade over-invoicing instead of Cash-intensive front business. With the proposed pairing Trade under-invoicing / Trade over-invoicing, the distinction is substantive: File A shows that export records and comparable sale prices indicate substantial underpricing, whereas File B shows that deposits and claimed revenue greatly exceed footfall, staffing and operating capacity. For these Trade under-invoicing and Cash-intensive front business files, choosing the pair Trade under-invoicing / Trade over-invoicing would misdirect the review away from at least one of these mechanisms.
B:File A is misidentified as Cash-intensive front business instead of Trade under-invoicing; File B is misidentified as Trade under-invoicing instead of Cash-intensive front business. With the proposed pairing Cash-intensive front business / Trade under-invoicing, the distinction is substantive: File A shows that export records and comparable sale prices indicate substantial underpricing, whereas File B shows that deposits and claimed revenue greatly exceed footfall, staffing and operating capacity. For these Trade under-invoicing and Cash-intensive front business files, choosing the pair Cash-intensive front business / Trade under-invoicing would misdirect the review away from at least one of these mechanisms.
C:File A is misidentified as Bulk currency courier instead of Trade under-invoicing. With the proposed pairing Bulk currency courier / Cash-intensive front business, the distinction is substantive: File A shows that export records and comparable sale prices indicate substantial underpricing, whereas File B shows that deposits and claimed revenue greatly exceed footfall, staffing and operating capacity. For these Trade under-invoicing and Cash-intensive front business files, choosing the pair Bulk currency courier / Cash-intensive front business would misdirect the review away from at least one of these mechanisms.
Question 1010
Two separate review files raise different issues. File A: An applicant invents a business and submits fabricated turnover records for emergency assistance. File B: A program officer maintains benefit accounts for deceased or ineligible individuals and diverts payments. Which pairing accurately classifies both files?
- File A: Ghost public-assistance beneficiaries; File B: Fictitious disaster relief business.
- File A: Double-charged public grant costs; File B: Ghost public-assistance beneficiaries.
- File A: Fictitious disaster relief business; File B: Ghost public-assistance beneficiaries.
- File A: Fictitious disaster relief business; File B: False government grant deliverables.
Explanation
Correct Answer
C:File A is Fictitious disaster relief business because crisis support can be abused through fictitious claimants and fabricated losses, while File B is Ghost public-assistance beneficiaries because public funds continue flowing to people who should not receive benefits. The evidence chains differ: for File A, reviewers should verify existence and pre-disaster activity using independent authoritative records; for File B, they should cross-match beneficiary status with authorized registries and payment destinations.
Incorrect Answers
A:File A is misidentified as Ghost public-assistance beneficiaries instead of Fictitious disaster relief business; File B is misidentified as Fictitious disaster relief business instead of Ghost public-assistance beneficiaries. With the proposed pairing Ghost public-assistance beneficiaries / Fictitious disaster relief business, the distinction is substantive: File A shows that business registration, tax and payroll records fail to support the claimed operation, whereas File B shows that benefit rolls conflict with independent vital records and eligibility updates. For these Fictitious disaster relief business and Ghost public-assistance beneficiaries files, choosing the pair Ghost public-assistance beneficiaries / Fictitious disaster relief business would misdirect the review away from at least one of these mechanisms.
B:File A is misidentified as Double-charged public grant costs instead of Fictitious disaster relief business. With the proposed pairing Double-charged public grant costs / Ghost public-assistance beneficiaries, the distinction is substantive: File A shows that business registration, tax and payroll records fail to support the claimed operation, whereas File B shows that benefit rolls conflict with independent vital records and eligibility updates. For these Fictitious disaster relief business and Ghost public-assistance beneficiaries files, choosing the pair Double-charged public grant costs / Ghost public-assistance beneficiaries would misdirect the review away from at least one of these mechanisms.
D:File B is misidentified as False government grant deliverables instead of Ghost public-assistance beneficiaries. With the proposed pairing Fictitious disaster relief business / False government grant deliverables, the distinction is substantive: File A shows that business registration, tax and payroll records fail to support the claimed operation, whereas File B shows that benefit rolls conflict with independent vital records and eligibility updates. For these Fictitious disaster relief business and Ghost public-assistance beneficiaries files, choosing the pair Fictitious disaster relief business / False government grant deliverables would misdirect the review away from at least one of these mechanisms.