ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 4

Question 30

Only one analyst knows the current evidence inventory and outstanding tasks. What would be the most defensible approach to maintain continuity when a lead examiner becomes unavailable?

  1. Arrange a suitable venue, trained support, and an exit protocol
  2. Keep a controlled case log and handover record
  3. Check lawful transfer and privacy requirements before disclosure
  4. Conduct a safety assessment and establish check-in procedures

Explanation

Correct Answer

B:

A shared, restricted case record preserves decisions, custody details, and next steps. This reduces single-person dependency without exposing the investigation broadly.

Incorrect Answers

A:

Safety controls should precede a difficult interview; it describes an action suited to reduce risk of confronting a volatile person alone. A planned response to escalation protects participants without implying that threatening behavior proves fraud; it does not address the specific requirement to maintain continuity when a lead examiner becomes unavailable.

C:

Data-protection obligations may govern collection and international access; that principle applies when the team needs to manage a cross-border evidence transfer. A transfer mechanism and data minimization can be necessary even for a legitimate investigation; it does not address the specific requirement to maintain continuity when a lead examiner becomes unavailable.

D:

Field safety requires evaluating personnel, travel, local conditions, and communication; this is a sensible safeguard where the issue is to plan a safe visit to a remote operating site. Evidence needs do not override basic protection of investigators or witnesses; it does not settle how to maintain continuity when a lead examiner becomes unavailable in this situation.

Question 31

The suspected cashier is likely to deny misconduct and the team has not reviewed register records. Which option best supports the objective to start with available sources rather than a confession?

  1. Look for independent receiving logs and carrier delivery proof
  2. Describe the access event distinctly from any hypothesis about motive
  3. Reevaluate relevance, necessity, and authorizations
  4. Examine objective transaction documents before confronting the subject

Explanation

Correct Answer

D:

Documentary testing can establish dates, amounts, and contradictions. A defensible sequence uses independently verifiable material before an admission-seeking discussion.

Incorrect Answers

A:

External or independently generated records can corroborate or contradict a statement; that principle applies when the team needs to seek evidence that would falsify a claim. Actively testing alternatives strengthens the validity of the resulting conclusion; it would not by itself meet the stated need to start with available sources rather than a confession.

B:

A log entry establishes an observed event, not fraudulent intent by itself; this responds to a different operational need to separate observation from inference. Clear separation prevents speculation being written as fact; this case asks for a means to start with available sources rather than a confession instead.

C:

Scope grows only when new evidence supports it; it supports the separate objective to review whether a lead remains proportionate. Periodic review protects privacy, resources, and the defensibility of the inquiry; the immediate evidentiary task here is to start with available sources rather than a confession.

Question 32

A financial controller accessed a supplier master record late at night. Which technique best fits the need to separate observation from inference?

  1. Examine objective transaction documents before confronting the subject
  2. Construct a dated event timeline with source references
  3. Describe the access event distinctly from any hypothesis about motive
  4. Look for independent receiving logs and carrier delivery proof
  5. Reevaluate relevance, necessity, and authorizations

Explanation

Correct Answer

C:

A log entry establishes an observed event, not fraudulent intent by itself. Clear separation prevents speculation being written as fact.

Incorrect Answers

A:

Documentary testing can establish dates, amounts, and contradictions; that is the consideration when a team tries to start with available sources rather than a confession. A defensible sequence uses independently verifiable material before an admission-seeking discussion; it serves another purpose, not the immediate need to separate observation from inference.

B:

Chronologies reveal order, overlap, and missing records; this concerns the distinct task of deciding how to use a chronology to connect events. Each entry should link to its original source so chronology errors can be checked; that would leave unresolved the present need to separate observation from inference.

D:

External or independently generated records can corroborate or contradict a statement; this is primarily relevant when the objective is to seek evidence that would falsify a claim. Actively testing alternatives strengthens the validity of the resulting conclusion; the facts presented call first for a way to separate observation from inference.

E:

Scope grows only when new evidence supports it; that is the consideration when a team tries to review whether a lead remains proportionate. Periodic review protects privacy, resources, and the defensibility of the inquiry; it serves another purpose, not the immediate need to separate observation from inference.

Question 33

A witness says no goods ever reached a warehouse under a paid purchase order. What is the strongest investigative approach to seek evidence that would falsify a claim?

  1. Construct a dated event timeline with source references
  2. Look for independent receiving logs and carrier delivery proof
  3. Examine objective transaction documents before confronting the subject
  4. Describe the access event distinctly from any hypothesis about motive

Explanation

Correct Answer

B:

External or independently generated records can corroborate or contradict a statement. Actively testing alternatives strengthens the validity of the resulting conclusion.

Incorrect Answers

A:

Chronologies reveal order, overlap, and missing records; that principle applies when the team needs to use a chronology to connect events. Each entry should link to its original source so chronology errors can be checked; it does not address the specific requirement to seek evidence that would falsify a claim.

C:

Documentary testing can establish dates, amounts, and contradictions; this is a sensible safeguard where the issue is to start with available sources rather than a confession. A defensible sequence uses independently verifiable material before an admission-seeking discussion; the current question is about how to seek evidence that would falsify a claim.

D:

A log entry establishes an observed event, not fraudulent intent by itself; it protects the separate goal to separate observation from inference. Clear separation prevents speculation being written as fact; the examiner still needs to seek evidence that would falsify a claim.

Question 34

Payment approvals, vendor creation, and employee leave dates are scattered across systems. Which step is most appropriate to use a chronology to connect events?

  1. Construct a dated event timeline with source references
  2. Examine objective transaction documents before confronting the subject
  3. Explain the access event distinctly from any hypothesis about motive
  4. Look for independent receiving logs and carrier delivery proof

Explanation

Correct Answer

A:

Chronologies reveal order, overlap, and missing records. Each entry should link to its original source so chronology errors can be checked.

Incorrect Answers

B:

Documentary testing can establish dates, amounts, and contradictions; it describes an action suited to start with available sources rather than a confession. A defensible sequence uses independently verifiable material before an admission-seeking discussion; the investigative step being tested here is how to use a chronology to connect events.

C:

A log entry establishes an observed event, not fraudulent intent by itself; this concerns the distinct task of deciding how to separate observation from inference. Clear separation prevents speculation being written as fact; the facts presented call first for a way to use a chronology to connect events.

D:

External or independently generated records can corroborate or contradict a statement; it can be useful for efforts to seek evidence that would falsify a claim. Actively testing alternatives strengthens the validity of the resulting conclusion; this case asks for a means to use a chronology to connect events instead.

Question 35

An initial concern of a small duplicate payment has expanded to unrelated years of employee messages. Which next step best helps the team to review whether a lead remains proportionate?

  1. Examine objective transaction documents before confronting the subject
  2. Look for independent receiving logs and carrier delivery proof
  3. Explain the access event distinctly from any hypothesis about motive
  4. Reevaluate relevance, necessity, and authorizations

Explanation

Correct Answer

D:

Scope grows only when new evidence supports it. Periodic review protects privacy, resources, and the defensibility of the inquiry.

Incorrect Answers

A:

Documentary testing can establish dates, amounts, and contradictions; its purpose in an investigation is to start with available sources rather than a confession. A defensible sequence uses independently verifiable material before an admission-seeking discussion; it serves another purpose, not the immediate need to review whether a lead remains proportionate.

B:

External or independently generated records can corroborate or contradict a statement; this addresses a different question: how to seek evidence that would falsify a claim. Actively testing alternatives strengthens the validity of the resulting conclusion; it does not address the specific requirement to review whether a lead remains proportionate.

C:

A log entry establishes an observed event, not fraudulent intent by itself; that principle applies when the team needs to separate observation from inference. Clear separation prevents speculation being written as fact; that would leave unresolved the present need to review whether a lead remains proportionate.

Question 36

An examiner expects internal resolution and proposes deleting rough contemporaneous notes. What would be the most defensible approach to prepare case notes for possible litigation?

  1. Explain the fact-finding role and avoid outcome guarantees
  2. Interview witnesses separately without distributing others' accounts
  3. Use a valid consent, legal process, or other applicable lawful basis
  4. Record outcome, outstanding uncertainty, approvals, and retention basis
  5. Retain accurate working records under applicable policies and holds
  6. Obtain counsel's guidance on necessary recipients and protected material

Explanation

Correct Answer

E:

Courts or regulators may scrutinize how findings were developed. Preserving reliable notes and version history helps explain decisions and source provenance.

Incorrect Answers

A:

A witness can be told how information will be handled but not promised an adjudicative result; it belongs to a different stage of work: trying to ensure investigators do not promise an outcome to witnesses. Unsupported assurances create credibility and fairness problems; this case asks for a means to prepare case notes for possible litigation instead.

B:

Independent recollections have greater evidentiary value; it belongs to a different stage of work: trying to prevent witness contamination before formal proceedings. Sharing a narrative first may shape what witnesses say they remember; the priority under these facts is to prepare case notes for possible litigation.

C:

Sensitive third-party records generally cannot be demanded merely because an internal case exists; that is the consideration when a team tries to obtain authority before requesting restricted material. Legal mechanisms depend on jurisdiction and holder of the data; the immediate evidentiary task here is to prepare case notes for possible litigation.

D:

A documented closure supports accountability and later review; this distinction matters when investigators must create an auditable disposition decision. It distinguishes findings from disciplinary choices and preserves obligations affecting retained evidence; it does not settle how to prepare case notes for possible litigation in this situation.

F:

Privilege depends on legal criteria and context, not the sender's label alone; this addresses a different question: how to avoid a privilege mistake in a consultant briefing. Broad dissemination can create disclosure and waiver problems; it does not address the specific requirement to prepare case notes for possible litigation.

Question 37

Outside counsel is involved but a general investigation status email is going to a broad mailing list. Which response is most appropriate to avoid a privilege mistake in a consultant briefing?

  1. Use a valid consent, legal process, or other applicable lawful basis
  2. Retain accurate working records under applicable policies and holds
  3. Interview witnesses separately without distributing others' accounts
  4. Obtain counsel's guidance on necessary recipients and protected material

Explanation

Correct Answer

D:

Privilege depends on legal criteria and context, not the sender's label alone. Broad dissemination can create disclosure and waiver problems.

Incorrect Answers

A:

Sensitive third-party records generally cannot be demanded merely because an internal case exists; this is a sensible safeguard where the issue is to obtain authority before requesting restricted material. Legal mechanisms depend on jurisdiction and holder of the data; the current question is about how to avoid a privilege mistake in a consultant briefing.

B:

Courts or regulators may scrutinize how findings were developed; this is a sensible safeguard where the issue is to prepare case notes for possible litigation. Preserving reliable notes and version history helps explain decisions and source provenance; it does not settle how to avoid a privilege mistake in a consultant briefing in this situation.

C:

Independent recollections have greater evidentiary value; this responds to a different operational need to prevent witness contamination before formal proceedings. Sharing a narrative first may shape what witnesses say they remember; the current question is about how to avoid a privilege mistake in a consultant briefing.

Question 38

In a suspected payment-diversion case, the examiner needs a former employee's private banking information. Three colleagues who may be witnesses have already discussed the allegation. Which TWO safeguards address both lawful record access and independent witness accounts? Choose TWO.

  1. Record outcome, outstanding uncertainty, approvals, and retention basis
  2. Document who discussed the allegation, then obtain each colleague’s independent recollection without circulating other accounts
  3. Use a valid consent, legal process, or other applicable lawful basis
  4. Retain accurate working records under applicable policies and holds
  5. Obtain counsel's guidance on necessary recipients and protected material

Explanation

Correct Answers

B:

Because the three colleagues discussed the allegations earlier, the examiner should capture that exposure and interview each person independently. Earlier shared discussion can affect direct recollection without proving that a witness is dishonest.

C:

Sensitive third-party records generally cannot be demanded merely because an internal case exists. Legal mechanisms depend on jurisdiction and holder of the data.

Incorrect Answers

A:

A documented closure supports accountability and later review; that is why it can help to create an auditable disposition decision. It distinguishes findings from disciplinary choices and preserves obligations affecting retained evidence; the current question is about how to obtain authority before requesting restricted material.

D:

Courts or regulators may scrutinize how findings were developed; it describes an action suited to prepare case notes for possible litigation. Preserving reliable notes and version history helps explain decisions and source provenance; the immediate evidentiary task here is to obtain authority before requesting restricted material.

E:

Privilege depends on legal criteria and context, not the sender's label alone; it supports the separate objective to avoid a privilege mistake in a consultant briefing. Broad dissemination can create disclosure and waiver problems; the examiner still needs to obtain authority before requesting restricted material.

Question 39

An examiner wants to circulate one employee's allegation to all potential witnesses. How should the examiner proceed to prevent witness contamination before formal proceedings?

  1. Record outcome, outstanding uncertainty, approvals, and retention basis
  2. Interview witnesses separately without distributing others' accounts
  3. Use a valid consent, legal process, or other applicable lawful basis
  4. Retain accurate working records under applicable policies and holds

Explanation

Correct Answer

B:

Independent recollections have greater evidentiary value. Sharing a narrative first may shape what witnesses say they remember.

Incorrect Answers

A:

A documented closure supports accountability and later review; it belongs to a different stage of work: trying to create an auditable disposition decision. It distinguishes findings from disciplinary choices and preserves obligations affecting retained evidence; the examiner still needs to prevent witness contamination before formal proceedings.

C:

Sensitive third-party records generally cannot be demanded merely because an internal case exists; it describes an action suited to obtain authority before requesting restricted material. Legal mechanisms depend on jurisdiction and holder of the data; this case asks for a means to prevent witness contamination before formal proceedings instead.

D:

Courts or regulators may scrutinize how findings were developed; its purpose in an investigation is to prepare case notes for possible litigation. Preserving reliable notes and version history helps explain decisions and source provenance; the facts presented call first for a way to prevent witness contamination before formal proceedings.

Question 40

After a substantiated control incident, managers want the file marked closed with no record of rationale. Which response most directly enables the examiner to create an auditable disposition decision?

  1. Keep accurate working records under applicable policies and holds
  2. Interview witnesses separately without distributing others' accounts
  3. Obtain counsel's guidance on necessary recipients and protected material
  4. Record outcome, outstanding uncertainty, approvals, and retention basis
  5. Use a valid consent, legal process, or other applicable lawful basis

Explanation

Correct Answer

D:

A documented closure supports accountability and later review. It distinguishes findings from disciplinary choices and preserves obligations affecting retained evidence.

Incorrect Answers

A:

Courts or regulators may scrutinize how findings were developed; this distinction matters when investigators must prepare case notes for possible litigation. Preserving reliable notes and version history helps explain decisions and source provenance; it does not address the specific requirement to create an auditable disposition decision.

B:

Independent recollections have greater evidentiary value; it protects the separate goal to prevent witness contamination before formal proceedings. Sharing a narrative first may shape what witnesses say they remember; the facts presented call first for a way to create an auditable disposition decision.

C:

Privilege depends on legal criteria and context, not the sender's label alone; that is the consideration when a team tries to avoid a privilege mistake in a consultant briefing. Broad dissemination can create disclosure and waiver problems; the facts presented call first for a way to create an auditable disposition decision.

E:

Sensitive third-party records generally cannot be demanded merely because an internal case exists; its purpose in an investigation is to obtain authority before requesting restricted material. Legal mechanisms depend on jurisdiction and holder of the data; the current question is about how to create an auditable disposition decision.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests