ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 49

Question 480

A large branch has more suspicious transactions than a small branch. Which response most directly enables the examiner to select a suitable denominator for a branch comparison?

  1. Calculate rates using comparable transaction volumes
  2. Assess changed detection sensitivity before alleging increased fraud
  3. Cross-check pre- and post-change process rules and denominators
  4. Compare claims within relevant roles and expense categories
  5. Flag the claim for context-based review and supporting receipts

Explanation

Correct Answer

A:

Raw counts can mislead when activity levels differ. Rate comparisons support fairer prioritization but still need data-quality review.

Incorrect Answers

B:

More alerts can reflect better monitoring rather than more misconduct; it supports the separate objective to avoid confusing correlation with causation. Alert counts are not necessarily incident counts; the record instead calls for an action that would select a suitable denominator for a branch comparison.

C:

System changes can alter recorded behavior; it belongs to a different stage of work: trying to interpret a sudden change in approval behavior. A rate shift requires understanding both numerator and population size; it serves another purpose, not the immediate need to select a suitable denominator for a branch comparison.

D:

Different populations have different normal ranges; this distinction matters when investigators must use peer groups to avoid misleading anomaly scores. Proper segmentation reduces false alarms from legitimate heterogeneity; the current question is about how to select a suitable denominator for a branch comparison.

E:

An outlier is a prompt for investigation; it protects the separate goal to identify unusually high claims without treating outliers as guilt. Role, destination, and business purpose can explain legitimate exceptions; the record instead calls for an action that would select a suitable denominator for a branch comparison.

Question 481

Investigators need to identify messages discussing off-book rebates using multiple synonyms. Which next step best helps the team to locate recurring contract terms in emails?

  1. Apply documented keyword and phrase searches with manual review
  2. Use thematic coding or text clustering with human validation
  3. Compare context, participants, and contemporaneous project records
  4. Verify critical extracted fields against source images

Explanation

Correct Answer

A:

Structured queries help find likely documents in unstructured text. Search terms and exclusions must be retained for repeatability.

Incorrect Answers

B:

Clustering can group concepts beyond exact keywords; this is primarily relevant when the objective is to identify clusters of related complaints. Reviewers should check false groupings and privacy constraints; the facts presented call first for a way to locate recurring contract terms in emails.

C:

A suspicious keyword does not fix meaning; it supports the separate objective to resolve ambiguous coded language in chat records. Internal terminology and conversation history are needed before inferring concealment; the facts presented call first for a way to locate recurring contract terms in emails.

D:

OCR errors can change names, amounts, and dates; this concerns the distinct task of deciding how to handle scanned documents with poor text recognition. Human validation prevents machine transcription from becoming false evidence; it serves another purpose, not the immediate need to locate recurring contract terms in emails.

Question 482

A hotline archive contains thousands of narratives describing similar tactics with different wording. What action should the investigation team take to identify clusters of related complaints?

  1. Use thematic coding or text clustering with human validation
  2. Apply documented keyword and phrase searches with manual review
  3. Compare context, participants, and contemporaneous project records
  4. Use the score only as context and inspect the actual communication

Explanation

Correct Answer

A:

Clustering can group concepts beyond exact keywords. Reviewers should check false groupings and privacy constraints.

Incorrect Answers

B:

Structured queries help find likely documents in unstructured text; this concerns the distinct task of deciding how to locate recurring contract terms in emails. Search terms and exclusions must be retained for repeatability; this case asks for a means to identify clusters of related complaints instead.

C:

A suspicious keyword does not fix meaning; that is the consideration when a team tries to resolve ambiguous coded language in chat records. Internal terminology and conversation history are needed before inferring concealment; it does not address the specific requirement to identify clusters of related complaints.

D:

Sentiment models infer tone imperfectly and cannot establish fraudulent intent; this addresses a different question: how to avoid assuming sentiment analysis proves bad intent. Transaction evidence must support conclusions; the required investigative decision is to identify clusters of related complaints.

Question 483

An automated tool marks a manager's email tone as hostile. Which investigative method is best suited to avoid assuming sentiment analysis proves bad intent?

  1. Apply documented keyword and phrase searches with manual review
  2. Employ thematic coding or text clustering with human validation
  3. Use the score only as context and inspect the actual communication
  4. Compare context, participants, and contemporaneous project records

Explanation

Correct Answer

C:

Sentiment models infer tone imperfectly and cannot establish fraudulent intent. Transaction evidence must support conclusions.

Incorrect Answers

A:

Structured queries help find likely documents in unstructured text; that principle applies when the team needs to locate recurring contract terms in emails. Search terms and exclusions must be retained for repeatability; the examiner still needs to avoid assuming sentiment analysis proves bad intent.

B:

Clustering can group concepts beyond exact keywords; it can be useful for efforts to identify clusters of related complaints. Reviewers should check false groupings and privacy constraints; the priority under these facts is to avoid assuming sentiment analysis proves bad intent.

D:

A suspicious keyword does not fix meaning; this is a sensible safeguard where the issue is to resolve ambiguous coded language in chat records. Internal terminology and conversation history are needed before inferring concealment; the facts presented call first for a way to avoid assuming sentiment analysis proves bad intent.

Question 484

The investigation uses OCR on handwritten invoices with irregular formatting. What should the examiner select to handle scanned documents with poor text recognition?

  1. Verify critical extracted fields against source images
  2. Compare context, participants, and contemporaneous project records
  3. Apply documented keyword and phrase searches with manual review
  4. Use the score only as context and inspect the actual communication
  5. Use thematic coding or text clustering with human validation

Explanation

Correct Answer

A:

OCR errors can change names, amounts, and dates. Human validation prevents machine transcription from becoming false evidence.

Incorrect Answers

B:

A suspicious keyword does not fix meaning; it describes an action suited to resolve ambiguous coded language in chat records. Internal terminology and conversation history are needed before inferring concealment; that would leave unresolved the present need to handle scanned documents with poor text recognition.

C:

Structured queries help find likely documents in unstructured text; this is primarily relevant when the objective is to locate recurring contract terms in emails. Search terms and exclusions must be retained for repeatability; the investigative step being tested here is how to handle scanned documents with poor text recognition.

D:

Sentiment models infer tone imperfectly and cannot establish fraudulent intent; it supports the separate objective to avoid assuming sentiment analysis proves bad intent. Transaction evidence must support conclusions; it does not address the specific requirement to handle scanned documents with poor text recognition.

E:

Clustering can group concepts beyond exact keywords; this addresses a different question: how to identify clusters of related complaints. Reviewers should check false groupings and privacy constraints; the examiner still needs to handle scanned documents with poor text recognition.

Question 485

Several staff messages refer to project blue but the term may be ordinary internal jargon. What should be done to resolve ambiguous coded language in chat records?

  1. Employ thematic coding or text clustering with human validation
  2. Compare context, participants, and contemporaneous project records
  3. Use documented keyword and phrase searches with manual review
  4. Use the score only as context and inspect the actual communication

Explanation

Correct Answer

B:

A suspicious keyword does not fix meaning. Internal terminology and conversation history are needed before inferring concealment.

Incorrect Answers

A:

Clustering can group concepts beyond exact keywords; it supports the separate objective to identify clusters of related complaints. Reviewers should check false groupings and privacy constraints; the priority under these facts is to resolve ambiguous coded language in chat records.

C:

Structured queries help find likely documents in unstructured text; it can be useful for efforts to locate recurring contract terms in emails. Search terms and exclusions must be retained for repeatability; the examiner still needs to resolve ambiguous coded language in chat records.

D:

Sentiment models infer tone imperfectly and cannot establish fraudulent intent; that is the consideration when a team tries to avoid assuming sentiment analysis proves bad intent. Transaction evidence must support conclusions; it would not by itself meet the stated need to resolve ambiguous coded language in chat records.

Question 486

A vendor-classification model labels a supplier likely fraudulent without showing supporting transactions. Which response most directly enables the examiner to avoid treating an AI risk score as a factual finding?

  1. Separate training features from future outcome information
  2. Validate against role, workflow, and representative comparison groups
  3. Revalidate and recalibrate against current data
  4. Describe available features, thresholds, limits, and corroboration
  5. Use denominators or standardized rates alongside counts
  6. Use the score to prioritize verifiable underlying evidence

Explanation

Correct Answer

F:

Models can rank anomalies but cannot adjudicate fraud. Decisions need explainable and independently confirmed facts.

Incorrect Answers

A:

Leakage inflates reported accuracy and creates an unusable detector; this distinction matters when investigators must manage model training leakage in fraud detection. Evaluation should mimic information available at decision time; it is not a substitute for a step that would avoid treating an AI risk score as a factual finding.

B:

A model can confuse group characteristics with wrongdoing; it supports the separate objective to reduce bias in automated employee screening. Review false-positive rates across comparable roles before escalating allegations about specific staff; it would not by itself meet the stated need to avoid treating an AI risk score as a factual finding.

C:

Concept drift changes the relationship between features and outcomes; this is primarily relevant when the objective is to monitor model performance when business rules change. Old performance metrics may not transfer to a new process; the investigative step being tested here is how to avoid treating an AI risk score as a factual finding.

D:

Traceability matters when decisions affect people; it belongs to a different stage of work: trying to explain a black-box model alert to a reviewer. A score should lead to reviewable facts rather than substitute for them; that would leave unresolved the present need to avoid treating an AI risk score as a factual finding.

E:

Unadjusted volume may dominate alerts; it supports the separate objective to compare vendor risks without hiding base rates. Compare alerts per transaction, payment amount, or vendor exposure to avoid size-driven rankings; the current question is about how to avoid treating an AI risk score as a factual finding.

Question 487

A predictive model performs perfectly because later investigation outcomes were included in its input features. Which action addresses the primary investigative need to manage model training leakage in fraud detection?

  1. Separate training features from future outcome information
  2. Use the score to prioritize verifiable underlying evidence
  3. Describe available features, thresholds, limits, and corroboration
  4. Validate against role, workflow, and representative comparison groups

Explanation

Correct Answer

A:

Leakage inflates reported accuracy and creates an unusable detector. Evaluation should mimic information available at decision time.

Incorrect Answers

B:

Models can rank anomalies but cannot adjudicate fraud; this is a sensible safeguard where the issue is to avoid treating an AI risk score as a factual finding. Decisions need explainable and independently confirmed facts; the examiner still needs to manage model training leakage in fraud detection.

C:

Traceability matters when decisions affect people; this responds to a different operational need to explain a black-box model alert to a reviewer. A score should lead to reviewable facts rather than substitute for them; the immediate evidentiary task here is to manage model training leakage in fraud detection.

D:

A model can confuse group characteristics with wrongdoing; that is the consideration when a team tries to reduce bias in automated employee screening. Review false-positive rates across comparable roles before escalating allegations about specific staff; it does not settle how to manage model training leakage in fraud detection in this situation.

Question 488

An anomaly tool disproportionately flags a department due to its unusual operating model. Which option best supports the objective to reduce bias in automated employee screening?

  1. Validate against role, workflow, and representative comparison groups
  2. Separate training features from future outcome information
  3. Use the score to prioritize verifiable underlying evidence
  4. Revalidate and recalibrate against current data
  5. Describe available features, thresholds, limits, and corroboration

Explanation

Correct Answer

A:

A model can confuse group characteristics with wrongdoing. Human review and fairness checks are necessary. Review false-positive rates across comparable roles before escalating allegations about specific staff.

Incorrect Answers

B:

Leakage inflates reported accuracy and creates an unusable detector; that is why it can help to manage model training leakage in fraud detection. Evaluation should mimic information available at decision time; the required investigative decision is to reduce bias in automated employee screening.

C:

Models can rank anomalies but cannot adjudicate fraud; it describes an action suited to avoid treating an AI risk score as a factual finding. Decisions need explainable and independently confirmed facts; the immediate evidentiary task here is to reduce bias in automated employee screening.

D:

Concept drift changes the relationship between features and outcomes; it can be useful for efforts to monitor model performance when business rules change. Old performance metrics may not transfer to a new process; the current question is about how to reduce bias in automated employee screening.

E:

Traceability matters when decisions affect people; it protects the separate goal to explain a black-box model alert to a reviewer. A score should lead to reviewable facts rather than substitute for them; the facts presented call first for a way to reduce bias in automated employee screening.

Question 489

A case report cites a high machine-learning score but no meaningful transaction evidence. Which technique best fits the need to explain a black-box model alert to a reviewer?

  1. Describe available features, thresholds, limits, and corroboration
  2. Employ the score to prioritize verifiable underlying evidence
  3. Separate training features from future outcome information
  4. Validate against role, workflow, and representative comparison groups

Explanation

Correct Answer

A:

Traceability matters when decisions affect people. A score should lead to reviewable facts rather than substitute for them.

Incorrect Answers

B:

Models can rank anomalies but cannot adjudicate fraud; its purpose in an investigation is to avoid treating an AI risk score as a factual finding. Decisions need explainable and independently confirmed facts; the examiner still needs to explain a black-box model alert to a reviewer.

C:

Leakage inflates reported accuracy and creates an unusable detector; it belongs to a different stage of work: trying to manage model training leakage in fraud detection. Evaluation should mimic information available at decision time; this case asks for a means to explain a black-box model alert to a reviewer instead.

D:

A model can confuse group characteristics with wrongdoing; this is a sensible safeguard where the issue is to reduce bias in automated employee screening. Review false-positive rates across comparable roles before escalating allegations about specific staff; it is not a substitute for a step that would explain a black-box model alert to a reviewer.

Question 490

A fraud-screening model trained before a new payment platform produces many false alerts afterward. What is the strongest investigative approach to monitor model performance when business rules change?

  1. Revalidate and recalibrate against current data
  2. Validate against role, workflow, and representative comparison groups
  3. Describe available features, thresholds, limits, and corroboration
  4. Use the score to prioritize verifiable underlying evidence

Explanation

Correct Answer

A:

Concept drift changes the relationship between features and outcomes. Old performance metrics may not transfer to a new process.

Incorrect Answers

B:

A model can confuse group characteristics with wrongdoing; it describes an action suited to reduce bias in automated employee screening. Review false-positive rates across comparable roles before escalating allegations about specific staff; this case asks for a means to monitor model performance when business rules change instead.

C:

Traceability matters when decisions affect people; this concerns the distinct task of deciding how to explain a black-box model alert to a reviewer. A score should lead to reviewable facts rather than substitute for them; the immediate evidentiary task here is to monitor model performance when business rules change.

D:

Models can rank anomalies but cannot adjudicate fraud; this distinction matters when investigators must avoid treating an AI risk score as a factual finding. Decisions need explainable and independently confirmed facts; the immediate evidentiary task here is to monitor model performance when business rules change.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests