ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 28

Question 270

A subject invokes a legal or contractual protection that may apply to a sensitive question. What would be the most defensible approach to respond to a valid refusal to answer a particular question?

  1. Ask for specific actions, communications, and independently checkable details
  2. Maintain boundaries and consider suspending the interview
  3. Postpone substantive admission questioning until comprehension is reliable
  4. Pause for appropriate advice rather than threaten punishment
  5. Disengage and follow the established security response
  6. Activate emergency welfare and safety procedures

Explanation

Correct Answer

D:

The effect of refusal depends on law and employment context. Investigators should not invent consequences or treat silence as proof.

Incorrect Answers

A:

Naming an associate is not enough to establish their involvement; this concerns the distinct task of deciding how to identify additional participants without suggestive questioning. The team needs separate corroboration and fairness to other subjects; the examiner still needs to respond to a valid refusal to answer a particular question.

B:

Escalation does not improve reliability; that is why it can help to respond to repeated abusive language. The factual inquiry can continue through documents and later authorized interviews; it is not a substitute for a step that would respond to a valid refusal to answer a particular question.

C:

Exhaustion raises suggestibility and memory-error risks; that principle applies when the team needs to avoid exploiting severe fatigue in a late-night session. Procedural fairness is more important than an immediate statement; it serves another purpose, not the immediate need to respond to a valid refusal to answer a particular question.

E:

No evidentiary goal justifies physical danger; that principle applies when the team needs to handle a participant who becomes physically aggressive. Staff should not attempt to use private detention powers they do not have; the facts presented call first for a way to respond to a valid refusal to answer a particular question.

F:

A credible safety emergency overrides the investigative agenda; this concerns the distinct task of deciding how to manage a person making credible self-harm threats. Appropriate professionals should respond rather than attempting more accusations; it does not address the specific requirement to respond to a valid refusal to answer a particular question.

Question 271

A subject admits redirecting supplier refunds into a personal account. Which option best supports the objective to corroborate a claim of diverted vendor payments?

  1. Reconstruct events from till logs, deposits, and roster records
  2. Ask for specific actions, communications, and independently checkable details
  3. Finish necessary corroboration and preservation before closure
  4. Match bank credits, approval logs, and source invoices

Explanation

Correct Answer

D:

An admission gives investigative leads; external records establish amounts, recipients, and timing. Other participants should not be inferred without proof.

Incorrect Answers

A:

A subjective estimate of duration may be inaccurate; it describes an action suited to verify the duration of an admitted scheme. Transaction-level testing supports loss calculations and scope; it is not a substitute for a step that would corroborate a claim of diverted vendor payments.

B:

Naming an associate is not enough to establish their involvement; that principle applies when the team needs to identify additional participants without suggestive questioning. The team needs separate corroboration and fairness to other subjects; the investigative step being tested here is how to corroborate a claim of diverted vendor payments.

C:

Statements can be incomplete, disputed, or wrong; this concerns the distinct task of deciding how to complete an investigation without overreliance on confession. Objective records and documented limitations remain essential for a defensible outcome; it serves another purpose, not the immediate need to corroborate a claim of diverted vendor payments.

Question 272

An admitting employee refers vaguely to a colleague who helped with invoice changes. Which technique best fits the need to identify additional participants without suggestive questioning?

  1. Reconstruct events from till logs, deposits, and roster records
  2. Match bank credits, approval logs, and source invoices
  3. Include the qualification and test it against source records
  4. Finish necessary corroboration and preservation before closure
  5. Ask for specific actions, communications, and independently checkable details

Explanation

Correct Answer

E:

Naming an associate is not enough to establish their involvement. The team needs separate corroboration and fairness to other subjects.

Incorrect Answers

A:

A subjective estimate of duration may be inaccurate; its purpose in an investigation is to verify the duration of an admitted scheme. Transaction-level testing supports loss calculations and scope; that would leave unresolved the present need to identify additional participants without suggestive questioning.

B:

An admission gives investigative leads; external records establish amounts, recipients, and timing; that principle applies when the team needs to corroborate a claim of diverted vendor payments. Other participants should not be inferred without proof; the record instead calls for an action that would identify additional participants without suggestive questioning.

C:

Removing qualifying facts could transform an authorized act into an apparent crime; this addresses a different question: how to report an admission with its important qualifications. The report must accurately reflect what was and was not acknowledged; the examiner still needs to identify additional participants without suggestive questioning.

D:

Statements can be incomplete, disputed, or wrong; that principle applies when the team needs to complete an investigation without overreliance on confession. Objective records and documented limitations remain essential for a defensible outcome; the examiner still needs to identify additional participants without suggestive questioning.

Question 273

A cashier admits taking cash over several months but cannot remember exact dates. What is the strongest investigative approach to verify the duration of an admitted scheme?

  1. Match bank credits, approval logs, and source invoices
  2. Ask for specific actions, communications, and independently checkable details
  3. Include the qualification and test it against source records
  4. Reconstruct events from till logs, deposits, and roster records

Explanation

Correct Answer

D:

A subjective estimate of duration may be inaccurate. Transaction-level testing supports loss calculations and scope.

Incorrect Answers

A:

An admission gives investigative leads; external records establish amounts, recipients, and timing; this is primarily relevant when the objective is to corroborate a claim of diverted vendor payments. Other participants should not be inferred without proof; that would leave unresolved the present need to verify the duration of an admitted scheme.

B:

Naming an associate is not enough to establish their involvement; this is primarily relevant when the objective is to identify additional participants without suggestive questioning. The team needs separate corroboration and fairness to other subjects; it does not settle how to verify the duration of an admitted scheme in this situation.

C:

Removing qualifying facts could transform an authorized act into an apparent crime; it supports the separate objective to report an admission with its important qualifications. The report must accurately reflect what was and was not acknowledged; the priority under these facts is to verify the duration of an admitted scheme.

Question 274

A worker admits changing a payment instruction but says they acted on written authorization. Which step is most appropriate to report an admission with its important qualifications?

  1. Include the qualification and test it against source records
  2. Reconstruct events from till logs, deposits, and roster records
  3. Ask for specific actions, communications, and independently checkable details
  4. Compare bank credits, approval logs, and source invoices

Explanation

Correct Answer

A:

Removing qualifying facts could transform an authorized act into an apparent crime. The report must accurately reflect what was and was not acknowledged.

Incorrect Answers

B:

A subjective estimate of duration may be inaccurate; this distinction matters when investigators must verify the duration of an admitted scheme. Transaction-level testing supports loss calculations and scope; the priority under these facts is to report an admission with its important qualifications.

C:

Naming an associate is not enough to establish their involvement; it can be useful for efforts to identify additional participants without suggestive questioning. The team needs separate corroboration and fairness to other subjects; it would not by itself meet the stated need to report an admission with its important qualifications.

D:

An admission gives investigative leads; external records establish amounts, recipients, and timing; it can be useful for efforts to corroborate a claim of diverted vendor payments. Other participants should not be inferred without proof; it does not address the specific requirement to report an admission with its important qualifications.

Question 275

Management wants to close the case as soon as a suspect signs a brief admission. Which next step best helps the team to complete an investigation without overreliance on confession?

  1. Compare bank credits, approval logs, and source invoices
  2. Ask for specific actions, communications, and independently checkable details
  3. Reconstruct events from till logs, deposits, and roster records
  4. Finish necessary corroboration and preservation before closure

Explanation

Correct Answer

D:

Statements can be incomplete, disputed, or wrong. Objective records and documented limitations remain essential for a defensible outcome.

Incorrect Answers

A:

An admission gives investigative leads; external records establish amounts, recipients, and timing; this addresses a different question: how to corroborate a claim of diverted vendor payments. Other participants should not be inferred without proof; it would not by itself meet the stated need to complete an investigation without overreliance on confession.

B:

Naming an associate is not enough to establish their involvement; this addresses a different question: how to identify additional participants without suggestive questioning. The team needs separate corroboration and fairness to other subjects; that would leave unresolved the present need to complete an investigation without overreliance on confession.

C:

A subjective estimate of duration may be inaccurate; that is why it can help to verify the duration of an admitted scheme. Transaction-level testing supports loss calculations and scope; the facts presented call first for a way to complete an investigation without overreliance on confession.

Question 276

A recurring warehouse theft has resisted ordinary record reconciliation, and a specific active risk remains. What would be the most defensible approach to recognize when covert methods may be proportionate?

  1. Require a factual investigative basis before covert activity
  2. Specify observable events, limits, and stopping conditions
  3. Route authorization through an unconflicted control function
  4. Assess a narrowly scoped covert plan with independent approval
  5. Analyze existing authenticated records before placing undercover staff

Explanation

Correct Answer

D:

Covert methods carry elevated privacy and safety risks. Specific predication, necessity, and authorization should justify their use over less intrusive alternatives.

Incorrect Answers

A:

Personal dislike does not justify surveillance; its purpose in an investigation is to avoid using covert methods for a vague suspicion. A defined allegation and lawful authority are required to support intrusive collection; it serves another purpose, not the immediate need to recognize when covert methods may be proportionate.

B:

Clear objectives make covert activity manageable and auditable; that is why it can help to define clear objectives for an undercover assignment. An open-ended mission can drift into irrelevant collection or unsafe exposure; it does not settle how to recognize when covert methods may be proportionate in this situation.

C:

A conflicted subject must not control investigative methods; this responds to a different operational need to plan independent oversight of a covert operation. Independent authorization helps ensure lawful scope and trustworthy decisions; it does not settle how to recognize when covert methods may be proportionate in this situation.

E:

Necessity and proportionality favor less intrusive evidence when it meets the objective; it protects the separate goal to choose less intrusive alternatives when adequate. Covert deployment adds risks without necessarily improving proof; the record instead calls for an action that would recognize when covert methods may be proportionate.

Question 277

A manager wants undercover monitoring because an employee seems unpopular. Which response is most appropriate to avoid using covert methods for a vague suspicion?

  1. Specify observable events, limits, and stopping conditions
  2. Assess a narrowly scoped covert plan with independent approval
  3. Route authorization through an unconflicted control function
  4. Require a factual investigative basis before covert activity

Explanation

Correct Answer

D:

Personal dislike does not justify surveillance. A defined allegation and lawful authority are required to support intrusive collection.

Incorrect Answers

A:

Clear objectives make covert activity manageable and auditable; it belongs to a different stage of work: trying to define clear objectives for an undercover assignment. An open-ended mission can drift into irrelevant collection or unsafe exposure; the priority under these facts is to avoid using covert methods for a vague suspicion.

B:

Covert methods carry elevated privacy and safety risks; that principle applies when the team needs to recognize when covert methods may be proportionate. Specific predication, necessity, and authorization should justify their use over less intrusive alternatives; the priority under these facts is to avoid using covert methods for a vague suspicion.

C:

A conflicted subject must not control investigative methods; it protects the separate goal to plan independent oversight of a covert operation. Independent authorization helps ensure lawful scope and trustworthy decisions; it is not a substitute for a step that would avoid using covert methods for a vague suspicion.

Question 278

An investigator proposes a six-week covert placement in a supplier's office without specifying the conduct to document. The procurement executive implicated in the allegation offers to authorize and supervise the assignment. Which TWO planning decisions establish testable objectives and independent oversight? Choose TWO.

  1. Analyze existing authenticated records before placing undercover staff
  2. Start the covert assignment on an untested suspicion and document the grounds afterward
  3. Accept the implicated executive’s approval if a written scope is attached
  4. Place covert-operation approval and continuing oversight with an authority independent of the implicated executive
  5. Specify observable events, limits, and stopping conditions

Explanation

Correct Answers

D:

The implicated procurement executive cannot serve as the independent approver of a covert assignment aimed at that executive's own network. That separates authorization from the executive whose network is the intended object of covert fact-finding.

E:

Clear objectives make covert activity manageable and auditable. An open-ended mission can drift into irrelevant collection or unsafe exposure.

Incorrect Answers

A:

Necessity and proportionality favor less intrusive evidence when it meets the objective; this concerns the distinct task of deciding how to choose less intrusive alternatives when adequate. Covert deployment adds risks without necessarily improving proof; the immediate evidentiary task here is to define clear objectives for an undercover assignment.

B:

Predication and approved limits must exist before covert action begins, not be retroactively supplied. Otherwise privacy, safety, and legal authorizations may be undermined.

C:

Documented scope does not remove an authorizer’s conflict of interest. Approval and supervision should be assigned to an independent authority with an actual ability to stop the operation.

Question 279

The manager suspected of steering contracts is also asked to approve secret monitoring of procurement staff. How should the examiner proceed to plan independent oversight of a covert operation?

  1. Route authorization through an unconflicted control function
  2. Require a factual investigative basis before covert activity
  3. Assess a narrowly scoped covert plan with independent approval
  4. Define observable events, limits, and stopping conditions

Explanation

Correct Answer

A:

A conflicted subject must not control investigative methods. Independent authorization helps ensure lawful scope and trustworthy decisions.

Incorrect Answers

B:

Personal dislike does not justify surveillance; that is why it can help to avoid using covert methods for a vague suspicion. A defined allegation and lawful authority are required to support intrusive collection; the current question is about how to plan independent oversight of a covert operation.

C:

Covert methods carry elevated privacy and safety risks; it can be useful for efforts to recognize when covert methods may be proportionate. Specific predication, necessity, and authorization should justify their use over less intrusive alternatives; the required investigative decision is to plan independent oversight of a covert operation.

D:

Clear objectives make covert activity manageable and auditable; this responds to a different operational need to define clear objectives for an undercover assignment. An open-ended mission can drift into irrelevant collection or unsafe exposure; the current question is about how to plan independent oversight of a covert operation.

Question 280

Access logs and camera footage already show who entered the locked stockroom. Which response most directly enables the examiner to choose less intrusive alternatives when adequate?

  1. Require a factual investigative basis before covert activity
  2. Define observable events, limits, and stopping conditions
  3. Analyze existing authenticated records before placing undercover staff
  4. Assess a narrowly scoped covert plan with independent approval
  5. Route authorization through an unconflicted control function

Explanation

Correct Answer

C:

Necessity and proportionality favor less intrusive evidence when it meets the objective. Covert deployment adds risks without necessarily improving proof.

Incorrect Answers

A:

Personal dislike does not justify surveillance; it belongs to a different stage of work: trying to avoid using covert methods for a vague suspicion. A defined allegation and lawful authority are required to support intrusive collection; the facts presented call first for a way to choose less intrusive alternatives when adequate.

B:

Clear objectives make covert activity manageable and auditable; it protects the separate goal to define clear objectives for an undercover assignment. An open-ended mission can drift into irrelevant collection or unsafe exposure; it does not settle how to choose less intrusive alternatives when adequate in this situation.

D:

Covert methods carry elevated privacy and safety risks; this addresses a different question: how to recognize when covert methods may be proportionate. Specific predication, necessity, and authorization should justify their use over less intrusive alternatives; this case asks for a means to choose less intrusive alternatives when adequate instead.

E:

A conflicted subject must not control investigative methods; this concerns the distinct task of deciding how to plan independent oversight of a covert operation. Independent authorization helps ensure lawful scope and trustworthy decisions; the priority under these facts is to choose less intrusive alternatives when adequate.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests