ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 50

Question 490

A fraud-screening model trained before a new payment platform produces many false alerts afterward. What is the strongest investigative approach to monitor model performance when business rules change?

  1. Revalidate and recalibrate against current data
  2. Validate against role, workflow, and representative comparison groups
  3. Describe available features, thresholds, limits, and corroboration
  4. Use the score to prioritize verifiable underlying evidence

Explanation

Correct Answer

A:

Concept drift changes the relationship between features and outcomes. Old performance metrics may not transfer to a new process.

Incorrect Answers

B:

A model can confuse group characteristics with wrongdoing; it describes an action suited to reduce bias in automated employee screening. Review false-positive rates across comparable roles before escalating allegations about specific staff; this case asks for a means to monitor model performance when business rules change instead.

C:

Traceability matters when decisions affect people; this concerns the distinct task of deciding how to explain a black-box model alert to a reviewer. A score should lead to reviewable facts rather than substitute for them; the immediate evidentiary task here is to monitor model performance when business rules change.

D:

Models can rank anomalies but cannot adjudicate fraud; this distinction matters when investigators must avoid treating an AI risk score as a factual finding. Decisions need explainable and independently confirmed facts; the immediate evidentiary task here is to monitor model performance when business rules change.

Question 491

A case involves many transfers through related entities and dates. What should be done to show a flow of suspicious money between accounts?

  1. Use denominators or standardized rates alongside counts
  2. Build a sourced directed transaction network
  3. Use a time-series display with comparable baselines
  4. Map events with suitable geographic and activity context

Explanation

Correct Answer

B:

A flow diagram can expose sequences and intermediary accounts. Every edge should reflect an actual transaction or be labeled as an inference.

Incorrect Answers

A:

Unadjusted volume may dominate alerts; that is the consideration when a team tries to compare vendor risks without hiding base rates. Compare alerts per transaction, payment amount, or vendor exposure to avoid size-driven rankings; the facts presented call first for a way to show a flow of suspicious money between accounts.

C:

Temporal charts reveal patterns and outliers; this addresses a different question: how to visualize suspicious payment timing. Include historical quarters and known payroll or settlement cycles when interpreting peaks; it does not address the specific requirement to show a flow of suspicious money between accounts.

D:

A map can show concentration but may exaggerate dense locations; this distinction matters when investigators must present location patterns accurately. Normalization and privacy should be considered; it does not settle how to show a flow of suspicious money between accounts in this situation.

Question 492

Investigators suspect transfers cluster just before quarter-end close. Which action would most reliably help the team to visualize suspicious payment timing?

  1. Build a sourced directed transaction network
  2. Use an honest scale and clear labels
  3. Map events with suitable geographic and activity context
  4. Use a time-series display with comparable baselines
  5. Use denominators or standardized rates alongside counts

Explanation

Correct Answer

D:

Temporal charts reveal patterns and outliers. Seasonality and legitimate reporting cycles need evaluation. Include historical quarters and known payroll or settlement cycles when interpreting peaks.

Incorrect Answers

A:

A flow diagram can expose sequences and intermediary accounts; that is why it can help to show a flow of suspicious money between accounts. Every edge should reflect an actual transaction or be labeled as an inference; the current question is about how to visualize suspicious payment timing.

B:

Visual choices can exaggerate effect sizes; this addresses a different question: how to avoid misleading truncated axes in financial charts. Disclose the numerical range and data source so readers can judge the actual change; the investigative step being tested here is how to visualize suspicious payment timing.

C:

A map can show concentration but may exaggerate dense locations; that is why it can help to present location patterns accurately. Normalization and privacy should be considered; the record instead calls for an action that would visualize suspicious payment timing.

E:

Unadjusted volume may dominate alerts; this is a sensible safeguard where the issue is to compare vendor risks without hiding base rates. Compare alerts per transaction, payment amount, or vendor exposure to avoid size-driven rankings; the required investigative decision is to visualize suspicious payment timing.

Question 493

A dashboard shows large counts of red flags for the largest suppliers. What would be the most defensible approach to compare vendor risks without hiding base rates?

  1. Use an honest scale and clear labels
  2. Use denominators or standardized rates alongside counts
  3. Use a time-series display with comparable baselines
  4. Build a sourced directed transaction network

Explanation

Correct Answer

B:

Unadjusted volume may dominate alerts. Contextual rates can guide prioritization without proving wrongdoing. Compare alerts per transaction, payment amount, or vendor exposure to avoid size-driven rankings.

Incorrect Answers

A:

Visual choices can exaggerate effect sizes; it supports the separate objective to avoid misleading truncated axes in financial charts. Disclose the numerical range and data source so readers can judge the actual change; the current question is about how to compare vendor risks without hiding base rates.

C:

Temporal charts reveal patterns and outliers; it supports the separate objective to visualize suspicious payment timing. Include historical quarters and known payroll or settlement cycles when interpreting peaks; it does not settle how to compare vendor risks without hiding base rates in this situation.

D:

A flow diagram can expose sequences and intermediary accounts; it belongs to a different stage of work: trying to show a flow of suspicious money between accounts. Every edge should reflect an actual transaction or be labeled as an inference; the priority under these facts is to compare vendor risks without hiding base rates.

Question 494

Loss reports cluster around several branches with widely different customer volumes. Which response is most appropriate to present location patterns accurately?

  1. Use an honest scale and clear labels
  2. Use a time-series display with comparable baselines
  3. Map events with suitable geographic and activity context
  4. Build a sourced directed transaction network

Explanation

Correct Answer

C:

A map can show concentration but may exaggerate dense locations. Normalization and privacy should be considered.

Incorrect Answers

A:

Visual choices can exaggerate effect sizes; that is the consideration when a team tries to avoid misleading truncated axes in financial charts. Disclose the numerical range and data source so readers can judge the actual change; the immediate evidentiary task here is to present location patterns accurately.

B:

Temporal charts reveal patterns and outliers; that is the consideration when a team tries to visualize suspicious payment timing. Include historical quarters and known payroll or settlement cycles when interpreting peaks; the current question is about how to present location patterns accurately.

D:

A flow diagram can expose sequences and intermediary accounts; this responds to a different operational need to show a flow of suspicious money between accounts. Every edge should reflect an actual transaction or be labeled as an inference; the record instead calls for an action that would present location patterns accurately.

Question 495

A chart magnifies a small change in confirmed recovery rate by cropping the baseline. Which procedure would best allow investigators to avoid misleading truncated axes in financial charts?

  1. Use an honest scale and clear labels
  2. Use a time-series display with comparable baselines
  3. Construct a sourced directed transaction network
  4. Map events with suitable geographic and activity context

Explanation

Correct Answer

A:

Visual choices can exaggerate effect sizes. Accurate charts communicate findings without overstating changes. Disclose the numerical range and data source so readers can judge the actual change.

Incorrect Answers

B:

Temporal charts reveal patterns and outliers; this is a sensible safeguard where the issue is to visualize suspicious payment timing. Include historical quarters and known payroll or settlement cycles when interpreting peaks; the facts presented call first for a way to avoid misleading truncated axes in financial charts.

C:

A flow diagram can expose sequences and intermediary accounts; it protects the separate goal to show a flow of suspicious money between accounts. Every edge should reflect an actual transaction or be labeled as an inference; it is not a substitute for a step that would avoid misleading truncated axes in financial charts.

D:

A map can show concentration but may exaggerate dense locations; it belongs to a different stage of work: trying to present location patterns accurately. Normalization and privacy should be considered; it does not address the specific requirement to avoid misleading truncated axes in financial charts.

Question 496

An analytics report lists staff and vendor records sharing a payout account. What is the strongest investigative approach to explain why matching bank accounts are not proof of collusion?

  1. Explain confidence limits, validation, and data coverage
  2. Retain source extracts, scripts, filters, and reconciliation notes
  3. Separate alert exposure from verified unauthorized disbursements
  4. Disclose date and entity coverage in the analysis
  5. Label matches as leads and document possible legitimate explanations

Explanation

Correct Answer

E:

A shared account warrants follow-up but may reflect family ties or data-entry mistakes. Anomaly detection is not adjudication.

Incorrect Answers

A:

Prediction does not establish misconduct; this distinction matters when investigators must communicate uncertainty around predictive results. Stating uncertainty prevents recipients from treating an approximate score as a definitive fact; the immediate evidentiary task here is to explain why matching bank accounts are not proof of collusion.

B:

A reviewer must be able to trace how the number was calculated; this distinction matters when investigators must reproduce a material numerical result for review. Reproducibility helps detect duplicate rows and omitted adjustments; this case asks for a means to explain why matching bank accounts are not proof of collusion instead.

C:

A flagged amount may be legitimate, reversed, or uncollected; it describes an action suited to distinguish flagged transactions from established loss. Loss estimation needs transaction-level support and offsets; it does not address the specific requirement to explain why matching bank accounts are not proof of collusion.

D:

Missing records constrain both positive and negative conclusions; this addresses a different question: how to report that a dataset is not complete. The report should not imply a universe larger than the data examined; this case asks for a means to explain why matching bank accounts are not proof of collusion instead.

Question 497

An overseas subsidiary failed to provide earlier years of transaction logs. Which step is most appropriate to report that a dataset is not complete?

  1. Explain confidence limits, validation, and data coverage
  2. Label matches as leads and document possible legitimate explanations
  3. Separate alert exposure from verified unauthorized disbursements
  4. Disclose date and entity coverage in the analysis

Explanation

Correct Answer

D:

Missing records constrain both positive and negative conclusions. The report should not imply a universe larger than the data examined.

Incorrect Answers

A:

Prediction does not establish misconduct; that is why it can help to communicate uncertainty around predictive results. Stating uncertainty prevents recipients from treating an approximate score as a definitive fact; the examiner still needs to report that a dataset is not complete.

B:

A shared account warrants follow-up but may reflect family ties or data-entry mistakes; it supports the separate objective to explain why matching bank accounts are not proof of collusion. Anomaly detection is not adjudication; it does not address the specific requirement to report that a dataset is not complete.

C:

A flagged amount may be legitimate, reversed, or uncollected; its purpose in an investigation is to distinguish flagged transactions from established loss. Loss estimation needs transaction-level support and offsets; this case asks for a means to report that a dataset is not complete instead.

Question 498

A review dashboard labels all flagged supplier payments as confirmed fraud loss. Its model was trained on incomplete observations, and a reviewer cannot reproduce the reported total. Which THREE report corrections address the model's uncertainty, distinguish alerts from actual loss, and preserve reproducibility? Choose THREE.

  1. Keep the entire flagged amount as confirmed loss and add a footnote calling alerts preliminary
  2. Assume full date and entity coverage because the dashboard displays a single loss total
  3. Apply scope, lawful basis, and field minimization at extraction
  4. Describe the model’s validation gaps, unobserved outcomes, and confidence limits instead of equating alerts with proof
  5. Separate alert exposure from verified unauthorized disbursements
  6. Retain the dashboard’s source-extract criteria, transformation code, reconciliation steps, and version history

Explanation

Correct Answers

D:

The risk model was trained on incomplete observations; its score cannot be equated with a verified unauthorized payment. A responsible report states validation limits, available fields, and uncertainty before using predicted risk in findings.

E:

A flagged amount may be legitimate, reversed, or uncollected. Loss estimation needs transaction-level support and offsets.

F:

Keep model versions, extraction criteria, joins, and loss reconciliations so another analyst can reproduce the dashboard's figures. Without the extraction and reconciliation history, nobody can reliably test for duplicate payments or omitted adjustments.

Incorrect Answers

A:

A footnote does not turn unverified alerts into realized unauthorized payments. The reported loss must be reconciled to supported transactions and adjustments.

B:

An aggregate does not prove the model examined all relevant records. Scope, features, exclusions, and the difference between alerts and confirmed loss require independent disclosure.

C:

Analytical capability does not override privacy or authorization limits; this distinction matters when investigators must ensure data use is authorized from the outset. Restricting data early reduces needless exposure; it is not a substitute for a step that would distinguish flagged transactions from established loss.

Question 499

A report asserts $2.4 million in suspect payments but provides no query criteria. What action should the investigation team take to reproduce a material numerical result for review?

  1. Explain confidence limits, validation, and data coverage
  2. Retain source extracts, scripts, filters, and reconciliation notes
  3. Disclose date and entity coverage in the analysis
  4. Label matches as leads and document possible legitimate explanations

Explanation

Correct Answer

B:

A reviewer must be able to trace how the number was calculated. Reproducibility helps detect duplicate rows and omitted adjustments.

Incorrect Answers

A:

Prediction does not establish misconduct; it belongs to a different stage of work: trying to communicate uncertainty around predictive results. Stating uncertainty prevents recipients from treating an approximate score as a definitive fact; it would not by itself meet the stated need to reproduce a material numerical result for review.

C:

Missing records constrain both positive and negative conclusions; that is the consideration when a team tries to report that a dataset is not complete. The report should not imply a universe larger than the data examined; the required investigative decision is to reproduce a material numerical result for review.

D:

A shared account warrants follow-up but may reflect family ties or data-entry mistakes; this is a sensible safeguard where the issue is to explain why matching bank accounts are not proof of collusion. Anomaly detection is not adjudication; the investigative step being tested here is how to reproduce a material numerical result for review.

Question 500

A model suggests an employee may be high risk on a sparse dataset. Which investigative method is best suited to communicate uncertainty around predictive results?

  1. Label matches as leads and document possible legitimate explanations
  2. Separate alert exposure from verified unauthorized disbursements
  3. State date and entity coverage in the analysis
  4. Explain confidence limits, validation, and data coverage
  5. Retain source extracts, scripts, filters, and reconciliation notes

Explanation

Correct Answer

D:

Prediction does not establish misconduct. Stating uncertainty prevents recipients from treating an approximate score as a definitive fact.

Incorrect Answers

A:

A shared account warrants follow-up but may reflect family ties or data-entry mistakes; it describes an action suited to explain why matching bank accounts are not proof of collusion. Anomaly detection is not adjudication; the required investigative decision is to communicate uncertainty around predictive results.

B:

A flagged amount may be legitimate, reversed, or uncollected; this distinction matters when investigators must distinguish flagged transactions from established loss. Loss estimation needs transaction-level support and offsets; this case asks for a means to communicate uncertainty around predictive results instead.

C:

Missing records constrain both positive and negative conclusions; this is a sensible safeguard where the issue is to report that a dataset is not complete. The report should not imply a universe larger than the data examined; the required investigative decision is to communicate uncertainty around predictive results.

E:

A reviewer must be able to trace how the number was calculated; that is why it can help to reproduce a material numerical result for review. Reproducibility helps detect duplicate rows and omitted adjustments; the immediate evidentiary task here is to communicate uncertainty around predictive results.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests