ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 47

Question 460

After removing invalid rows, a data extract's disbursement total no longer matches the general ledger. Which investigative method is best suited to reconcile cleaned totals against the system of record?

  1. Produce a reconciliation explaining filters, timing, and exclusions
  2. Check relationship cardinality and deduplicate at the intended grain
  3. Distinguish null, unavailable, and actual zero or empty values
  4. Create normalized comparison fields alongside original values
  5. Verify unit and currency definitions before aggregation

Explanation

Correct Answer

A:

Reconciliation validates the transformation pipeline. An unexplained difference undermines subsequent detection metrics.

Incorrect Answers

B:

One-to-many joins can inflate rows and values; this concerns the distinct task of deciding how to control duplicate rows introduced during extraction. The query must reflect whether approvals are separate facts or transaction attributes; the facts presented call first for a way to reconcile cleaned totals against the system of record.

C:

Missing data may reflect system history, not a negative result; this concerns the distinct task of deciding how to handle missing values without treating them as zeros. Documenting gaps prevents false conclusions about absent information; the facts presented call first for a way to reconcile cleaned totals against the system of record.

D:

Standardization can reveal matches that strict text equality misses; this is a sensible safeguard where the issue is to standardize supplier names for comparisons without losing originals. Retaining raw strings supports auditability and false-match review; the required investigative decision is to reconcile cleaned totals against the system of record.

E:

Magnitude errors can create dramatic but false anomalies; that is the consideration when a team tries to resolve inconsistent currency formats. Validate the native currency units and applicable exchange-rate date before calculating a common amount; this case asks for a means to reconcile cleaned totals against the system of record instead.

Question 461

An inquiry concerns vendors possibly linked to staff through shared payment details. Which procedure would best allow investigators to compare employee bank accounts against supplier accounts?

  1. Sequence change logs and disbursement events by supplier ID
  2. Join approval events to authorized leave schedules with matched dates
  3. Join normalized bank identifiers between payroll and vendor masters
  4. Filter and group related payments around the threshold by vendor and period

Explanation

Correct Answer

C:

Cross-file joins can surface relationships not obvious in either source. Each match needs investigation because family or shared-service arrangements can be legitimate.

Incorrect Answers

A:

A temporal join can expose how a changed account preceded cash release; it supports the separate objective to find changes to vendor banking instructions before payment. The person and authority behind the edit need separate confirmation; this case asks for a means to compare employee bank accounts against supplier accounts instead.

B:

Temporal cross-checking can test access and delegation claims; it describes an action suited to compare payment dates to employee absence. Leave records are not conclusive proof someone could not access a system remotely; it is not a substitute for a step that would compare employee bank accounts against supplier accounts.

D:

Threshold testing can highlight fragmentation; its purpose in an investigation is to identify transactions near approval thresholds. The pattern requires corroboration rather than proving deliberate splitting; the current question is about how to compare employee bank accounts against supplier accounts.

Question 462

An expense approver may be splitting invoices just below a delegated limit. How should the examiner proceed to identify transactions near approval thresholds?

  1. Cross-reference payment approval dates with the approver’s authorized leave calendar
  2. Join normalized bank identifiers between payroll and vendor masters
  3. Filter and group related payments around the threshold by vendor and period
  4. Sequence change logs and disbursement events by supplier ID

Explanation

Correct Answer

C:

Threshold testing can highlight fragmentation. The pattern requires corroboration rather than proving deliberate splitting.

Incorrect Answers

A:

Leave comparisons can reveal an authorization anomaly, but do not show whether invoices were intentionally fragmented beneath a delegated threshold. Grouping vendor payments over time is the relevant test.

B:

Cross-file joins can surface relationships not obvious in either source; this is a sensible safeguard where the issue is to compare employee bank accounts against supplier accounts. Each match needs investigation because family or shared-service arrangements can be legitimate; it does not address the specific requirement to identify transactions near approval thresholds.

D:

A temporal join can expose how a changed account preceded cash release; that is the consideration when a team tries to find changes to vendor banking instructions before payment. The person and authority behind the edit need separate confirmation; this case asks for a means to identify transactions near approval thresholds instead.

Question 463

A high-value supplier payment follows a last-minute master-data edit. Which response most directly enables the examiner to find changes to vendor banking instructions before payment?

  1. Join normalized bank identifiers between payroll and vendor masters
  2. Filter and group related payments around the threshold by vendor and period
  3. Compare payment approver activity with authorized absence records for those dates
  4. Sequence change logs and disbursement events by supplier ID

Explanation

Correct Answer

D:

A temporal join can expose how a changed account preceded cash release. The person and authority behind the edit need separate confirmation.

Incorrect Answers

A:

Cross-file joins can surface relationships not obvious in either source; it describes an action suited to compare employee bank accounts against supplier accounts. Each match needs investigation because family or shared-service arrangements can be legitimate; it is not a substitute for a step that would find changes to vendor banking instructions before payment.

B:

Threshold testing can highlight fragmentation; this distinction matters when investigators must identify transactions near approval thresholds. The pattern requires corroboration rather than proving deliberate splitting; the immediate evidentiary task here is to find changes to vendor banking instructions before payment.

C:

Attendance or leave correlations address potentially improper approvals. To identify a bank-detail change preceding disbursement, the examiner must sequence the supplier change log and payment event.

Question 464

Several cash disbursements were allegedly approved by an employee on leave. Which action addresses the primary investigative need to compare payment dates to employee absence?

  1. Filter and group related payments around the threshold by vendor and period
  2. Join approval events to authorized leave schedules with matched dates
  3. Join credits to original invoice keys and settlement records
  4. Sequence change logs and disbursement events by supplier ID
  5. Join normalized bank identifiers between payroll and vendor masters

Explanation

Correct Answer

B:

Temporal cross-checking can test access and delegation claims. Leave records are not conclusive proof someone could not access a system remotely.

Incorrect Answers

A:

Threshold testing can highlight fragmentation; that is why it can help to identify transactions near approval thresholds. The pattern requires corroboration rather than proving deliberate splitting; the priority under these facts is to compare payment dates to employee absence.

C:

Relational reconstruction shows whether a refund has an underlying sale and whether it was paid; this is primarily relevant when the objective is to link multiple refunds to the original sale. It prevents treating unrelated matching amounts as duplicates; the record instead calls for an action that would compare payment dates to employee absence.

D:

A temporal join can expose how a changed account preceded cash release; this is a sensible safeguard where the issue is to find changes to vendor banking instructions before payment. The person and authority behind the edit need separate confirmation; the investigative step being tested here is how to compare payment dates to employee absence.

E:

Cross-file joins can surface relationships not obvious in either source; its purpose in an investigation is to compare employee bank accounts against supplier accounts. Each match needs investigation because family or shared-service arrangements can be legitimate; the record instead calls for an action that would compare payment dates to employee absence.

Question 465

A retailer has repeated credit notes but sale references are stored in another table. Which option best supports the objective to link multiple refunds to the original sale?

  1. Join normalized bank identifiers between payroll and vendor masters
  2. Join approval events to authorized leave schedules with matched dates
  3. Filter and group related payments around the threshold by vendor and period
  4. Join credits to original invoice keys and settlement records

Explanation

Correct Answer

D:

Relational reconstruction shows whether a refund has an underlying sale and whether it was paid. It prevents treating unrelated matching amounts as duplicates.

Incorrect Answers

A:

Cross-file joins can surface relationships not obvious in either source; this distinction matters when investigators must compare employee bank accounts against supplier accounts. Each match needs investigation because family or shared-service arrangements can be legitimate; the investigative step being tested here is how to link multiple refunds to the original sale.

B:

Temporal cross-checking can test access and delegation claims; that is why it can help to compare payment dates to employee absence. Leave records are not conclusive proof someone could not access a system remotely; it does not address the specific requirement to link multiple refunds to the original sale.

C:

Threshold testing can highlight fragmentation; it belongs to a different stage of work: trying to identify transactions near approval thresholds. The pattern requires corroboration rather than proving deliberate splitting; it serves another purpose, not the immediate need to link multiple refunds to the original sale.

Question 466

A billing scheme may involve the same vendor, invoice number, and amount being paid twice. Which investigative method is best suited to identify exact repeated supplier invoices?

  1. Match receipt identifiers, dates, images, and employee records
  2. Apply normalized and fuzzy matching with review thresholds
  3. Flag exact-key duplicates and review legitimate cancellations
  4. Compare cross-system references, amounts, dates, and settlement state

Explanation

Correct Answer

C:

Exact-match tests detect a useful subset of duplicates. They can miss altered identifiers and may flag valid reissues.

Incorrect Answers

A:

A shared receipt may indicate duplicate claims; this responds to a different operational need to identify split expense claims against one receipt. Check whether a shared invoice legitimately covered multiple travelers or was reimbursed more than once; it does not address the specific requirement to identify exact repeated supplier invoices.

B:

Approximate comparison can surface disguised repeats; this distinction matters when investigators must identify near-duplicate invoices with altered notation. It creates false positives and should retain original strings and matching logic; the required investigative decision is to identify exact repeated supplier invoices.

D:

Duplicate disbursement can arise from integration failure or fraud; it supports the separate objective to detect payment duplication across systems. A cross-platform test checks the shared obligation rather than one ledger alone; it does not settle how to identify exact repeated supplier invoices in this situation.

Question 467

A suspected biller adds leading zeros or punctuation to repeated invoice numbers. What should the examiner select to identify near-duplicate invoices with altered notation?

  1. Compare cross-system references, amounts, dates, and settlement state
  2. Mark exact-key duplicates and review legitimate cancellations
  3. Apply normalized and fuzzy matching with review thresholds
  4. Match receipt identifiers, dates, images, and employee records

Explanation

Correct Answer

C:

Approximate comparison can surface disguised repeats. It creates false positives and should retain original strings and matching logic.

Incorrect Answers

A:

Duplicate disbursement can arise from integration failure or fraud; that is the consideration when a team tries to detect payment duplication across systems. A cross-platform test checks the shared obligation rather than one ledger alone; this case asks for a means to identify near-duplicate invoices with altered notation instead.

B:

Exact-match tests detect a useful subset of duplicates; this distinction matters when investigators must identify exact repeated supplier invoices. They can miss altered identifiers and may flag valid reissues; it would not by itself meet the stated need to identify near-duplicate invoices with altered notation.

D:

A shared receipt may indicate duplicate claims; it protects the separate goal to identify split expense claims against one receipt. Check whether a shared invoice legitimately covered multiple travelers or was reimbursed more than once; this case asks for a means to identify near-duplicate invoices with altered notation instead.

Question 468

Two accounts-payable platforms may both pay the same supplier obligation. What should be done to detect payment duplication across systems?

  1. Match receipt identifiers, dates, images, and employee records
  2. Reconcile missing numbers to voids, controlled stationery, and source copies
  3. Apply normalized and fuzzy matching with review thresholds
  4. Flag exact-key duplicates and review legitimate cancellations
  5. Compare cross-system references, amounts, dates, and settlement state
  6. Reassess suitability using unrounded source values if available

Explanation

Correct Answer

E:

Duplicate disbursement can arise from integration failure or fraud. A cross-platform test checks the shared obligation rather than one ledger alone.

Incorrect Answers

A:

A shared receipt may indicate duplicate claims; this concerns the distinct task of deciding how to identify split expense claims against one receipt. Check whether a shared invoice legitimately covered multiple travelers or was reimbursed more than once; the examiner still needs to detect payment duplication across systems.

B:

Sequence gaps may indicate omitted or canceled documents; it can be useful for efforts to find unexplained gaps in a sequential document series. Account for voided, spoiled, unused, and issued numbers before treating the gap as unrecorded revenue; the investigative step being tested here is how to detect payment duplication across systems.

C:

Approximate comparison can surface disguised repeats; that is why it can help to identify near-duplicate invoices with altered notation. It creates false positives and should retain original strings and matching logic; the priority under these facts is to detect payment duplication across systems.

D:

Exact-match tests detect a useful subset of duplicates; that is why it can help to identify exact repeated supplier invoices. They can miss altered identifiers and may flag valid reissues; the investigative step being tested here is how to detect payment duplication across systems.

F:

Rounding changes digit frequencies and can manufacture anomalies; this is a sensible safeguard where the issue is to check whether data transformations distort a digit test. The input's generation process matters as much as sample size; it serves another purpose, not the immediate need to detect payment duplication across systems.

Question 469

A cashier's receipt-book sequence jumps from 1384 to 1391. Which action would most reliably help the team to find unexplained gaps in a sequential document series?

  1. Reconcile missing numbers to voids, controlled stationery, and source copies
  2. Flag exact-key duplicates and review legitimate cancellations
  3. Apply normalized and fuzzy matching with review thresholds
  4. Match receipt identifiers, dates, images, and employee records

Explanation

Correct Answer

A:

Sequence gaps may indicate omitted or canceled documents. They do not automatically establish theft. Account for voided, spoiled, unused, and issued numbers before treating the gap as unrecorded revenue.

Incorrect Answers

B:

Exact-match tests detect a useful subset of duplicates; it belongs to a different stage of work: trying to identify exact repeated supplier invoices. They can miss altered identifiers and may flag valid reissues; the priority under these facts is to find unexplained gaps in a sequential document series.

C:

Approximate comparison can surface disguised repeats; it belongs to a different stage of work: trying to identify near-duplicate invoices with altered notation. It creates false positives and should retain original strings and matching logic; it does not address the specific requirement to find unexplained gaps in a sequential document series.

D:

A shared receipt may indicate duplicate claims; that principle applies when the team needs to identify split expense claims against one receipt. Check whether a shared invoice legitimately covered multiple travelers or was reimbursed more than once; the facts presented call first for a way to find unexplained gaps in a sequential document series.

Question 470

Several staff members claim reimbursements for the same hotel bill. What would be the most defensible approach to identify split expense claims against one receipt?

  1. Use normalized and fuzzy matching with review thresholds
  2. Compare cross-system references, amounts, dates, and settlement state
  3. Flag exact-key duplicates and review legitimate cancellations
  4. Match receipt identifiers, dates, images, and employee records

Explanation

Correct Answer

D:

A shared receipt may indicate duplicate claims. Review business context before concluding intentional abuse. Check whether a shared invoice legitimately covered multiple travelers or was reimbursed more than once.

Incorrect Answers

A:

Approximate comparison can surface disguised repeats; this responds to a different operational need to identify near-duplicate invoices with altered notation. It creates false positives and should retain original strings and matching logic; it does not settle how to identify split expense claims against one receipt in this situation.

B:

Duplicate disbursement can arise from integration failure or fraud; this is a sensible safeguard where the issue is to detect payment duplication across systems. A cross-platform test checks the shared obligation rather than one ledger alone; the examiner still needs to identify split expense claims against one receipt.

C:

Exact-match tests detect a useful subset of duplicates; this responds to a different operational need to identify exact repeated supplier invoices. They can miss altered identifiers and may flag valid reissues; the priority under these facts is to identify split expense claims against one receipt.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests