CFE Financial Transactions and Fraud Schemes: Following the Evidence

An unexplained accounting entry is not automatically fraud, and a clean-looking trial balance is not evidence that a scheme cannot exist. Fraud examiners must reconcile the story presented by financial records with the transactions, people, assets, and approvals that produced those records. The former CFE examination section called Financial Transactions and Fraud Schemes focused on this interplay between accounting principles, financial statement manipulation, asset misappropriation, and other methods of concealment. The underlying knowledge remains useful, but its examination context changed substantially in 2026.

The Association of Certified Fraud Examiners (ACFE) replaced its former four-section structure with a three-section CFE exam effective June 2, 2026. The current section closest to this historical URL is Fraud Schemes and Financial Crimes, which incorporates a revised range of accounting, occupational fraud, and financial-crime topics. Candidates should use the new official outline rather than assume that this old section title identifies a current, independently scheduled exam. The updated CFE credential still also assesses investigations and legal issues, and fraud prevention and deterrence.

Treat accounting statements as assertions to test

A balance sheet expresses positions at a point in time, an income statement measures activity over a period, and a cash-flow statement records cash movements across operating, investing, and financing activities. A fraud examiner should understand how these statements relate before testing for manipulation. Reported revenue can rise without a comparable increase in cash if receivables grow, and an apparently profitable organization can face liquidity problems. Neither fact proves misconduct, but each can direct further inquiry.

Financial reporting frameworks affect recognition, measurement, presentation, and disclosures. Accrual accounting recognizes economic activity according to applicable principles rather than only when cash changes hands. That creates legitimate estimates and judgments, but it also creates opportunities for premature revenue recognition, capitalization of expenses, or failure to record obligations. The examiner should ask which accounting treatment was required, what evidence supported the entry, and who had authority to approve it.

Analytical procedures provide a starting point. Horizontal analysis compares results over time; vertical analysis expresses components as proportions; ratios can reveal relationships among revenue, margins, receivables, inventory, and liabilities. Unexpected improvement in gross margin, for example, may arise from a change in product mix, acquisition, or legitimate efficiency. It may also result from understated cost of sales. The indicator is a reason to select transactions for testing, not a shortcut to accusing management of fraud.

A useful working paper links each anomaly to evidence. The examiner might compare general-ledger entries, journal approvals, contract terms, shipping records, bank statements, and communications. If a revenue entry lacks evidence that performance obligations were satisfied, the next step is to verify the underlying transaction and the applicable recognition rule. A ratio alone cannot establish falsification, just as a management explanation cannot replace independent supporting records.

Identify financial statement manipulation techniques

Manipulated statements can overstate assets or revenue, understate liabilities or expenses, conceal related-party transactions, or omit material disclosures. These tactics sometimes involve fabricated sales, side agreements, intentional misclassification, unsupported estimates, or inappropriate timing. Understanding the accounting effect is essential. A fictitious sale may increase revenue and accounts receivable simultaneously, while an improper expense deferral can overstate profit and an asset account.

Fraud risk rises when management can override ordinary accounting controls. Late journal entries, unusual adjustments near period end, manual postings to restricted accounts, or inconsistent approval evidence deserve targeted review. Many such entries have legitimate explanations, especially in complex organizations. The examiner should compare them with policies, accounting standards, source documents, and patterns across employees or periods rather than simply treating all manual entries as suspect.

A side agreement offers a practical example. A recorded sale may appear supported by an invoice and customer acceptance, while an undisclosed return right or cancellation arrangement changes the economic substance. The investigative question is whether the reported transaction met the applicable recognition requirements when it was booked. Interviews, contracts, subsequent credit notes, and correspondence can provide a more reliable answer than the invoice alone.

Detection methods also have limitations. Benford analysis, anomaly models, and rule-based journal testing can identify unusual distributions or activity, but they are sensitive to data structure and context. A small, deliberately priced dataset may naturally fail a digit-distribution test. Examiners should explain why a method is appropriate, preserve the source data, and corroborate findings. Computer-assisted procedures augment professional judgment; they do not determine intent by themselves.

Trace cash receipts and fraudulent disbursements

Cash misappropriation can occur before a receipt is recorded, after it is recorded, or through manipulated returns, credits, and deposits. Skimming conceals receipts before recording; cash larceny takes funds after they have entered the accounting records. The distinction guides the evidence sought. Reconciliation of recorded balances may detect a post-recording theft but not necessarily an unrecorded sale that never reached the ledger.

Revenue and receipt controls include sequential documents, separation of cash-handling and reconciliation duties, independent bank verification, exception reporting, and periodic review of voids or refunds. Fraud examiners should assess whether these controls actually operate. A written requirement that different employees receive and reconcile cash is ineffective if one person routinely performs both tasks. Control testing should examine access logs, reconciliations, approval trails, and supporting transactions.

Fraudulent disbursement can involve shell-company invoices, duplicate payments, false expense reimbursements, check tampering, payroll manipulation, or purchasing abuses. A payment to an unfamiliar supplier is not sufficient evidence of a shell entity. The examiner can compare address and bank-account similarities, vendor creation dates, authorized approvals, supporting delivery evidence, and employee relationships. A series of small payments made just below an internal approval threshold might warrant more scrutiny when coupled with repeated beneficiary details.

Payroll fraud illustrates how operational and financial evidence intersect. Ghost employees, altered hours, improper commissions, and diverted direct-deposit details can create legitimate-looking payroll expenses. Compare personnel records, work authorization, time approvals, payroll changes, and bank-account information while respecting privacy and applicable employment laws. The key is to test that a real person performed authorized work and received appropriate payment, not simply to search for names on an employee list.

Investigate inventory and noncash asset schemes

Inventory fraud may involve theft, fabricated stock counts, unauthorized write-offs, false receiving records, or manipulation of valuation. A financial ledger showing adequate inventory does not prove that physical goods exist. Conversely, inventory shrinkage may arise from spoilage, measurement error, or operational issues rather than intentional diversion. Reconcile quantity records with independent physical counts, receiving reports, shipping documents, and system audit logs before drawing conclusions.

Access and custody are central. Employees who can create vendors, approve purchases, receive goods, and reconcile accounts may be able to conceal a misappropriation through multiple steps. Even if the organization has formal separation-of-duties rules, shared passwords or emergency privileges can undermine them. Fraud examiners should understand the system transactions that enable inventory adjustments, transfers between locations, and changes in asset records.

Fixed assets, intellectual property, and sensitive commercial information also carry fraud risks. Unauthorized disposal of equipment or diversion of company-owned assets may leave a trail in repair invoices, asset registers, vehicle movements, or access-control logs. Misappropriation of intangible information may not appear in a warehouse count. Investigation should match the suspected asset to appropriate records and avoid assuming one audit technique detects every kind of loss.

When losses are discovered, quantification should be transparent about assumptions. Replacement cost, historical cost, fair value, and amounts actually recovered can differ substantially. Examiners should document the basis for their calculation and distinguish proven transactions from estimates. An overstated loss figure can compromise the credibility of an otherwise well-supported case; an understated scope can lead to poor remediation choices.

Follow payments through corruption and financial crime

Corruption schemes can involve conflicts of interest, bribery, kickbacks, bid rigging, or improper benefits exchanged for business decisions. They may be concealed in consulting invoices, commission agreements, intermediary payments, discounts, or charitable donations. The examiner should examine the commercial purpose and decision process in addition to payment details. A transaction that has a valid invoice might still raise questions if the vendor performed no service or influenced an undisclosed procurement decision.

Common indicators include unexplained sole-source awards, relationships between employees and contractors, repeated contract modifications, unusual agent commissions, or resistance to ordinary due diligence. None of these establishes bribery on its own. Evidence may require procurement records, approval history, beneficial ownership information, interviews, communications, and forensic examination within legal and ethical limits. The focus is on the interaction between improper influence and a financial consequence.

Money laundering and other financial crimes can follow occupational fraud. An insider may divert funds and then attempt to disguise their ownership through a business account or multiple transfers. That creates a link between the fraudulent disbursement and the subsequent movement of proceeds. The analysis should keep distinct the underlying wrongdoing, the method of concealment, and any separate offense alleged by a competent authority. Examiners gather and preserve evidence rather than pronounce legal guilt.

Financial-crime investigations often cross accounting systems and jurisdictional boundaries. Transaction formats, reporting thresholds, data privacy requirements, and legal processes differ. The same evidence can be relevant to internal discipline, civil recovery, regulatory response, or criminal referral, with different disclosure and admissibility considerations. Understanding the limits of a financial analysis makes it more useful to investigators and legal counsel.

Keep records reproducible and controls actionable

Every substantive conclusion should be traceable to a source, analytical method, and explanation. Working papers must establish where records came from, when they were collected, what transformations were applied, and how calculations can be reproduced. Exporting only a screenshot of a suspicious total can lose the underlying transaction details and filters. Where evidence may later be used in litigation, appropriate preservation and chain-of-custody procedures become important.

Interviews and witness statements should be treated carefully. Financial discrepancies may identify questions to ask, but an interview is not a substitute for independent corroboration. A witness may misunderstand accounting processes, recall an event incorrectly, or be influenced by how a question is framed. Examiners should avoid leading prompts, document the account accurately, and distinguish observations from interpretations. Legal or human resources specialists may need to define the appropriate investigation process.

Prevention follows directly from the tested scheme. If false vendors caused loss, strengthen vendor creation approvals, beneficial-owner checks, and payment reconciliation; if management override hid improper revenue, examine posting rights and independent close review. Generic ethics training cannot replace a control that prevents one employee from initiating, approving, and disguising a disbursement. Control recommendations should address the demonstrated failure path, preserve legitimate business efficiency, and have measurable owners.

Candidates working from the historical Financial Transactions and Fraud Schemes URL should now map their learning to ACFE's current Fraud Schemes and Financial Crimes outline. The former CFE Investigation and CFE Law subjects are now treated together in the updated Fraud Investigations and Legal Issues section, and fraud prevention and deterrence remains a separate examination area. The examination transition changes how content is assessed, but it does not reduce the need for precise accounting, sound evidence, and professional judgment.