ACFE CFE - Investigation (Certified Fraud Examiner - Investigation) Practice Test 6

Question 50

The audit committee wants to strengthen fraud response after a confidential case. What is the strongest investigative approach to record lessons learned without exposing sensitive case details?

  1. Conduct a restricted after-action review of process gaps
  2. Confirm legal holds, retention schedules, and disposal authorization
  3. Report an unsubstantiated fraud allegation with the supported facts
  4. Reconcile actual payments, credits, reversals, and recoveries

Explanation

Correct Answer

A:

A lessons-learned review can improve escalation, evidence handling, and reporting. Findings should be generalized where necessary to protect witnesses and personal information.

Incorrect Answers

B:

Closing a case does not necessarily end preservation duties; it describes an action suited to apply retention rules after a case closes. Verified retention and approved destruction prevent accidental loss of potentially discoverable material; the current question is about how to record lessons learned without exposing sensitive case details.

C:

Not substantiated is different from proving the allegation false; it protects the separate goal to recognize when the evidence does not establish misconduct. Balanced reporting states the work done and the limits of the evidence; the priority under these facts is to record lessons learned without exposing sensitive case details.

D:

A case's gross exposure and net realized loss are different measures; it supports the separate objective to separate loss calculations from recovery assumptions. A defensible calculation makes exclusions and timing transparent; the examiner still needs to record lessons learned without exposing sensitive case details.

Question 51

A signed agreement moved among four offices before reaching the examiner. What should be done to establish who handled an original contract?

  1. Locate and compare the source or independently authenticated record
  2. Create and reconcile a contemporaneous chain-of-custody log
  3. Store the original safely and seek qualified document examination
  4. Work from labeled copies while preserving the original exhibits

Explanation

Correct Answer

B:

A custody record identifies each transfer, holder, date, and purpose. It does not itself prove authenticity, but it helps show an exhibit was not silently substituted.

Incorrect Answers

A:

A copy may omit physical attributes and reveal reproduction artifacts; that principle applies when the team needs to distinguish a copy from the source record. Comparing a reliable original can test whether the purported signature or alteration is genuine; the required investigative decision is to establish who handled an original contract.

C:

Original paper may retain ink, pressure, and sequence clues that a scan cannot capture; this is primarily relevant when the objective is to preserve fragile marks on an altered invoice. Handling should minimize changes before examination; the priority under these facts is to establish who handled an original contract.

D:

Separating analysis from source material avoids obscuring impressions, ink, and other physical characteristics; that principle applies when the team needs to keep originals intact during analytical annotation. Notes should identify the evidence without altering it; it is not a substitute for a step that would establish who handled an original contract.

Question 52

A paper invoice contains faint indentation and suspected overwriting. Which action would most reliably help the team to preserve fragile marks on an altered invoice?

  1. Assign exhibit identifiers and preserve source, export time, and custodian details
  2. Create and reconcile a contemporaneous chain-of-custody log
  3. Locate and compare the source or independently authenticated record
  4. Store the original safely and seek qualified document examination
  5. Work from labeled copies while preserving the original exhibits

Explanation

Correct Answer

D:

Original paper may retain ink, pressure, and sequence clues that a scan cannot capture. Handling should minimize changes before examination.

Incorrect Answers

A:

Provenance permits reviewers to trace a figure back to its originating system; this distinction matters when investigators must attribute each page of an exhibit to its source. Exhibit control prevents an untracked export from being mistaken for the original business record; the record instead calls for an action that would preserve fragile marks on an altered invoice.

B:

A custody record identifies each transfer, holder, date, and purpose; this concerns the distinct task of deciding how to establish who handled an original contract. It does not itself prove authenticity, but it helps show an exhibit was not silently substituted; that would leave unresolved the present need to preserve fragile marks on an altered invoice.

C:

A copy may omit physical attributes and reveal reproduction artifacts; this is primarily relevant when the objective is to distinguish a copy from the source record. Comparing a reliable original can test whether the purported signature or alteration is genuine; the examiner still needs to preserve fragile marks on an altered invoice.

E:

Separating analysis from source material avoids obscuring impressions, ink, and other physical characteristics; this is primarily relevant when the objective is to keep originals intact during analytical annotation. Notes should identify the evidence without altering it; the immediate evidentiary task here is to preserve fragile marks on an altered invoice.

Question 53

A payroll manager sends a photocopy whose signature looks unusually dark. What would be the most defensible approach to distinguish a copy from the source record?

  1. Store the original safely and seek qualified document examination
  2. Develop and reconcile a contemporaneous chain-of-custody log
  3. Work from labeled copies while preserving the original exhibits
  4. Locate and compare the source or independently authenticated record

Explanation

Correct Answer

D:

A copy may omit physical attributes and reveal reproduction artifacts. Comparing a reliable original can test whether the purported signature or alteration is genuine.

Incorrect Answers

A:

Original paper may retain ink, pressure, and sequence clues that a scan cannot capture; it can be useful for efforts to preserve fragile marks on an altered invoice. Handling should minimize changes before examination; the required investigative decision is to distinguish a copy from the source record.

B:

A custody record identifies each transfer, holder, date, and purpose; that principle applies when the team needs to establish who handled an original contract. It does not itself prove authenticity, but it helps show an exhibit was not silently substituted; it is not a substitute for a step that would distinguish a copy from the source record.

C:

Separating analysis from source material avoids obscuring impressions, ink, and other physical characteristics; it can be useful for efforts to keep originals intact during analytical annotation. Notes should identify the evidence without altering it; it does not address the specific requirement to distinguish a copy from the source record.

Question 54

A report will rely on three spreadsheets exported from unrelated databases. Which response is most appropriate to attribute each page of an exhibit to its source?

  1. Locate and compare the source or independently authenticated record
  2. Assign exhibit identifiers and preserve source, export time, and custodian details
  3. Work from labeled copies while preserving the original exhibits
  4. Record provenance, consent, contents, and initial handling of the device
  5. Store the original safely and seek qualified document examination
  6. Create and reconcile a contemporaneous chain-of-custody log

Explanation

Correct Answer

B:

Provenance permits reviewers to trace a figure back to its originating system. Exhibit control prevents an untracked export from being mistaken for the original business record.

Incorrect Answers

A:

A copy may omit physical attributes and reveal reproduction artifacts; it can be useful for efforts to distinguish a copy from the source record. Comparing a reliable original can test whether the purported signature or alteration is genuine; it does not settle how to attribute each page of an exhibit to its source in this situation.

C:

Separating analysis from source material avoids obscuring impressions, ink, and other physical characteristics; this addresses a different question: how to keep originals intact during analytical annotation. Notes should identify the evidence without altering it; it is not a substitute for a step that would attribute each page of an exhibit to its source.

D:

A written intake record describes the transfer and what is claimed about the source; this concerns the distinct task of deciding how to document evidence obtained during a consensual interview. The drive still requires appropriate preservation before analysis; the facts presented call first for a way to attribute each page of an exhibit to its source.

E:

Original paper may retain ink, pressure, and sequence clues that a scan cannot capture; this addresses a different question: how to preserve fragile marks on an altered invoice. Handling should minimize changes before examination; the priority under these facts is to attribute each page of an exhibit to its source.

F:

A custody record identifies each transfer, holder, date, and purpose; this is primarily relevant when the objective is to establish who handled an original contract. It does not itself prove authenticity, but it helps show an exhibit was not silently substituted; the current question is about how to attribute each page of an exhibit to its source.

Question 55

An examiner intends to highlight and write conclusions directly on seized paper receipts. Which procedure would best allow investigators to keep originals intact during analytical annotation?

  1. Store the original safely and seek qualified document examination
  2. Create and reconcile a contemporaneous chain-of-custody log
  3. Work from labeled copies while preserving the original exhibits
  4. Assign exhibit identifiers and preserve source, export time, and custodian details

Explanation

Correct Answer

C:

Separating analysis from source material avoids obscuring impressions, ink, and other physical characteristics. Notes should identify the evidence without altering it.

Incorrect Answers

A:

Original paper may retain ink, pressure, and sequence clues that a scan cannot capture; it supports the separate objective to preserve fragile marks on an altered invoice. Handling should minimize changes before examination; it serves another purpose, not the immediate need to keep originals intact during analytical annotation.

B:

A custody record identifies each transfer, holder, date, and purpose; it can be useful for efforts to establish who handled an original contract. It does not itself prove authenticity, but it helps show an exhibit was not silently substituted; this case asks for a means to keep originals intact during analytical annotation instead.

D:

Provenance permits reviewers to trace a figure back to its originating system; that is why it can help to attribute each page of an exhibit to its source. Exhibit control prevents an untracked export from being mistaken for the original business record; it does not address the specific requirement to keep originals intact during analytical annotation.

Question 56

A supplier offers invoices related to a suspected false-billing arrangement. What is the strongest investigative approach to obtain access to a witness's voluntarily supplied records?

  1. Seek an appropriate legal process or other lawful authorization
  2. Confirm local authority, transfer rules, and custodial assistance
  3. Use approved custodian-assisted exports within the authorized scope
  4. Record provenance, consent, contents, and initial handling of the device
  5. Document voluntary provision and the supplier's authority over the records

Explanation

Correct Answer

E:

Voluntary cooperation can provide relevant documents, but the team should record who supplied them and any conditions or confidentiality limitations.

Incorrect Answers

A:

A private examiner cannot compel protected bank information without legal authority; this addresses a different question: how to obtain a third-party record not available voluntarily. Counsel can identify the applicable order, consent, or statutory route; it would not by itself meet the stated need to obtain access to a witness's voluntarily supplied records.

B:

Group affiliation does not automatically authorize global access; it supports the separate objective to obtain data from an overseas affiliate. Jurisdiction, contractual controls, and data protection can determine how records may lawfully be obtained; the immediate evidentiary task here is to obtain access to a witness's voluntarily supplied records.

C:

Corporate authority can permit targeted collection of its records, subject to employment and privacy rules; this concerns the distinct task of deciding how to collect internal business records without exceeding permissions. Self-help access beyond assigned permissions may undermine defensibility; the priority under these facts is to obtain access to a witness's voluntarily supplied records.

D:

A written intake record describes the transfer and what is claimed about the source; that principle applies when the team needs to document evidence obtained during a consensual interview. The drive still requires appropriate preservation before analysis; it does not address the specific requirement to obtain access to a witness's voluntarily supplied records.

Question 57

The team needs detailed customer bank transactions that the bank will not release on request. Which step is most appropriate to obtain a third-party record not available voluntarily?

  1. Confirm local authority, transfer rules, and custodial assistance
  2. Use approved custodian-assisted exports within the authorized scope
  3. Document voluntary provision and the supplier's authority over the records
  4. Seek an appropriate legal process or other lawful authorization

Explanation

Correct Answer

D:

A private examiner cannot compel protected bank information without legal authority. Counsel can identify the applicable order, consent, or statutory route.

Incorrect Answers

A:

Group affiliation does not automatically authorize global access; that is the consideration when a team tries to obtain data from an overseas affiliate. Jurisdiction, contractual controls, and data protection can determine how records may lawfully be obtained; the current question is about how to obtain a third-party record not available voluntarily.

B:

Corporate authority can permit targeted collection of its records, subject to employment and privacy rules; that principle applies when the team needs to collect internal business records without exceeding permissions. Self-help access beyond assigned permissions may undermine defensibility; that would leave unresolved the present need to obtain a third-party record not available voluntarily.

C:

Voluntary cooperation can provide relevant documents, but the team should record who supplied them and any conditions or confidentiality limitations; it supports the separate objective to obtain access to a witness's voluntarily supplied records. The limitation of that technique must be assessed against the actual evidence; the required investigative decision is to obtain a third-party record not available voluntarily.

Question 58

In an authorized expense-claim inquiry, IT is preparing an export of internal transactions. During a voluntary interview, an employee also hands the examiner a USB drive said to contain expense records. Which TWO actions keep these collection steps within authority and preserve provenance? Choose TWO.

  1. Pursue an appropriate legal process or other lawful authorization
  2. Record who provided the USB drive, their authority and consent, its condition, and each intake transfer
  3. Use approved custodian-assisted exports within the authorized scope
  4. Confirm local authority, transfer rules, and custodial assistance
  5. Document voluntary provision and the supplier's authority over the records

Explanation

Correct Answers

B:

The USB handover needs its own dated intake record; it is not covered automatically by the custodian's separate business-system export. Document the giver, asserted source, time, and condition so every later transfer can be reconstructed.

C:

Corporate authority can permit targeted collection of its records, subject to employment and privacy rules. Self-help access beyond assigned permissions may undermine defensibility.

Incorrect Answers

A:

A private examiner cannot compel protected bank information without legal authority; it supports the separate objective to obtain a third-party record not available voluntarily. Counsel can identify the applicable order, consent, or statutory route; it is not a substitute for a step that would collect internal business records without exceeding permissions.

D:

Group affiliation does not automatically authorize global access; this is a sensible safeguard where the issue is to obtain data from an overseas affiliate. Jurisdiction, contractual controls, and data protection can determine how records may lawfully be obtained; the current question is about how to collect internal business records without exceeding permissions.

E:

Voluntary cooperation can provide relevant documents, but the team should record who supplied them and any conditions or confidentiality limitations; that is the consideration when a team tries to obtain access to a witness's voluntarily supplied records. The limitation of that technique must be assessed against the actual evidence; it is not a substitute for a step that would collect internal business records without exceeding permissions.

Question 59

A witness hands over a USB drive containing meeting notes at the end of an interview. What action should the investigation team take to document evidence obtained during a consensual interview?

  1. Seek an appropriate legal process or other lawful authorization
  2. Document voluntary provision and the supplier's authority over the records
  3. Record provenance, consent, contents, and initial handling of the device
  4. Confirm local authority, transfer rules, and custodial assistance

Explanation

Correct Answer

C:

A written intake record describes the transfer and what is claimed about the source. The drive still requires appropriate preservation before analysis.

Incorrect Answers

A:

A private examiner cannot compel protected bank information without legal authority; that is the consideration when a team tries to obtain a third-party record not available voluntarily. Counsel can identify the applicable order, consent, or statutory route; the required investigative decision is to document evidence obtained during a consensual interview.

B:

Voluntary cooperation can provide relevant documents, but the team should record who supplied them and any conditions or confidentiality limitations; this is a sensible safeguard where the issue is to obtain access to a witness's voluntarily supplied records. The limitation of that technique must be assessed against the actual evidence; it is not a substitute for a step that would document evidence obtained during a consensual interview.

D:

Group affiliation does not automatically authorize global access; it describes an action suited to obtain data from an overseas affiliate. Jurisdiction, contractual controls, and data protection can determine how records may lawfully be obtained; the examiner still needs to document evidence obtained during a consensual interview.

Question 60

Investigators need records from a separate foreign legal entity. Which investigative method is best suited to obtain data from an overseas affiliate?

  1. Record provenance, consent, contents, and initial handling of the device
  2. Employ approved custodian-assisted exports within the authorized scope
  3. Pursue an appropriate legal process or other lawful authorization
  4. Confirm local authority, transfer rules, and custodial assistance
  5. Document voluntary provision and the supplier's authority over the records

Explanation

Correct Answer

D:

Group affiliation does not automatically authorize global access. Jurisdiction, contractual controls, and data protection can determine how records may lawfully be obtained.

Incorrect Answers

A:

A written intake record describes the transfer and what is claimed about the source; this is primarily relevant when the objective is to document evidence obtained during a consensual interview. The drive still requires appropriate preservation before analysis; the priority under these facts is to obtain data from an overseas affiliate.

B:

Corporate authority can permit targeted collection of its records, subject to employment and privacy rules; this is primarily relevant when the objective is to collect internal business records without exceeding permissions. Self-help access beyond assigned permissions may undermine defensibility; it would not by itself meet the stated need to obtain data from an overseas affiliate.

C:

A private examiner cannot compel protected bank information without legal authority; this is a sensible safeguard where the issue is to obtain a third-party record not available voluntarily. Counsel can identify the applicable order, consent, or statutory route; the immediate evidentiary task here is to obtain data from an overseas affiliate.

E:

Voluntary cooperation can provide relevant documents, but the team should record who supplied them and any conditions or confidentiality limitations; it describes an action suited to obtain access to a witness's voluntarily supplied records. The limitation of that technique must be assessed against the actual evidence; that would leave unresolved the present need to obtain data from an overseas affiliate.

Certified Fraud Examiner - Investigation (CFE - Investigation) Practice Tests