CFE- Investigation

Which of the following is the most appropriate example of an alternative question? A. "Did you deliberately plan this, or did it just happen?" CORRECT B. "Did you, or did you not, commit this crime?" C. "How else might this situation be explained?" INCORRECT D. "Will you repay the money now or later?"

A. "Did you deliberately plan this, or did it just happen?" The alternative question forces the accused to make one of two choices, both of which imply guilt. One alternative provides the accused with a morally acceptable reason for the misdeed; the other portrays the accused negatively. Regardless of which answer the accused chooses, he is acknowledging guilt.

Which of the following is the MOST ACCURATE statement about the types of information that digital forensic experts typically can recover from computer systems? A. Deleted files that have been overwritten usually cannot be recovered. B. Hidden files can never be recovered. C. Data that is corrupted cannot be uncorrupted. D. Communications sent via chat or instant messenger cannot be recovered.

A. Deleted files that have been overwritten usually cannot be recovered.

Which of the following is TRUE regarding textual analytics?

A. Textual analytics can be used to categorize data to reveal patterns, sentiments, and relationships indicative of fraud.

Lucas, a Certified Fraud Examiner, is conducting an admission-seeking interview of William, a fraud suspect. Lucas asked William: "Did you just want extra money, or did you do this because you had financial problems?" This is called a(n):

Alternative question

indirect method of tracing financial transactions?

Using circumstantial evidence to analyze the relationship between a suspect's receipt and subsequent disposition of funds or assets An indirect method employs circumstantial evidence to analyze the relationship between a suspect's receipt and subsequent disposition of funds or assets

Which of the following statements about U.S. bankruptcy court records is CORRECT? A. The documents filed with a bankruptcy court are not open, public records B. A bankruptcy file typically contains the bankruptcy petition C. Bankruptcy documents are usually located in the state bankruptcy court for the jurisdiction where the debtor resided D. All of the above

B. A bankruptcy file typically contains the bankruptcy petition In these courts, all documents filed with the court are public record and can be examined by anyone without charge.

Which of the following best describes the image acquisition process used in examinations involving digital evidence? A. Acquiring the digital evidence from the suspect B. Creating an exact duplicate of the data on original storage media C. Taking photos of the digital equipment's physical layout and connections D. Analyzing the systems data in order to identify evidence

B. Creating an exact duplicate of the data on original storage media Imaging refers to the process whereby a forensic image of a hard drive or other digital media is made and imaged to another hard disk drive or other media for forensic analysis. A forensic image (also called a forensic copy, mirror image, or ghost image) is a duplicate or exact copy of a hard drive or other digital media.

If a fraud examiner was gathering information about a fraud suspect, which of the following types of information would likely require access to nonpublic sources of information to obtain? A. The subject's habits and lifestyle B. The subject's phone records C. Where the subject currently resides D. All of the above

B. The subject's phone records non-public: Banking records Tax records Credit records of individuals Phone records Credit card account records Personal health care records

Baker, a Certified Fraud Examiner, has obtained an oral confession from Gamma, a fraud suspect. Gamma confessed to committing fraud, and he admitted to smuggling drugs in an unrelated case. How should Baker handle these admissions in Gamma's written confession?

Baker should take separate statements for each of the unrelated crimes When taking a signed statement from a suspect, there should not be more than one written statement for each offense. If facts are inadvertently omitted, the fraud examiner can add them later to the original statement as an addendum.

Which of the following is a method of tracing illicit funds in which deposits to financial institutions are compared to legitimate income?

Bank deposit analysis method The bank deposits method is a method of tracing illicit funds in which deposits to financial institutions are compared to legitimate income.

Information NOT deemed to be public under the U.S. FOIA includes:

Banking records Trust records Telephone records Passenger lists Stock ownership

Which of the following is a verbal clue of deception when displayed by a respondent being interviewed?

Verbal clues are those relating to wordings, expressions, and responses to specific questions. Some examples of verbal clues include: Changes in speech patterns (e.g., changes in voice pitch) Comments regarding the interview Oaths

A ______________ interview is one that has the potential to bring about strong emotional reactions in the respondent.

Volatile

A fraud examiner in an organized crime investigation believes a particular commercial restaurant is being used as a place of operation for the suspects. Which of the following types of records would be the LEAST likely to help the fraud examiner discover who owns the building in which the restaurant operates?

Voter registration records

To meet the minimum standard for a chain of custody memorandum, The memorandum should state:

What items were received When they were received From whom they were received Where they are maintained

Which of the following are query words or symbols used in search engine queries to instruct search engines to perform special actions when executing a search?

Boolean operators Boolean operators (or advanced search operators) are query words or symbols used in search engine queries to instruct search engines to perform special actions when executing a search.

Karen is undertaking a data analysis engagement to identify potential fraud at XYZ Corporation. Which of the following lists the most appropriate order in which she should conduct the steps involved in the data analysis process?

Build a profile of potential frauds. Obtain the data. Cleanse and normalize the data. Analyze the data. Monitor the data.

Javier, a forensic document examiner, determines that a document that purports to be the original writing of a famous author created fifty years ago is actually made from paper created no more than two years ago. Which of the following best describes the document? A. An indented writing B. An autoforgery C. An anachronism D. None of the above

C. An anachronism Anachronisms are items located at a time when they could not have existed or occurred

Able, a Certified Fraud Examiner, conducted an interview of Baker, the controller of the ABC Company. Able asked the following question: "Since you were here when the controls were developed, can you tell me how they came about?" This kind of question is called a ____________________.

Controlled answer technique Controlled answer techniques may be used to stimulate a desired answer or impression. These techniques direct the interview toward a specific point. For example, it might be possible to get a person to admit knowledge of a matter by phrasing the question: "I understand you were present when the internal controls were developed; would you please describe how they were constructed?"

Which of the following statements concerning documentation in a formal fraud examination report is most accurate?

Copies of important documents should be included in the report. Most evidence in fraud cases will be in document form, and when reporting the results of a fraud examination, it is best to include copies (not originals) of important documents in the formal report or in the attached appendices. Also, when operating under a lawful court order that compels a custodian to furnish original documents, the fraud examiner should copy those documents (preferably in the presence of the custodian). Then the fraud examiner should furnish the custodian with a receipt describing the documents copied or taken.

Which of the following data analysis functions can be used to determine the relationship between two variables in raw data?

Correlation analysis

Which of the following is NOT correct with regard to fraud response plans? A. A fraud response plan enables management to respond to suspected incidents of fraud in a consistent manner. B. A fraud response plan should be flexible and allow appropriate responses based on the particular event. C. A fraud response plan can send a message that management takes fraud seriously. D. A fraud response plan should be complex and extremely detailed to ensure its effectiveness.

D. A fraud response plan should be complex and extremely detailed to ensure its effectiveness.

Jane is a Certified Fraud Examiner working on an investigation at Mill Corp. During an interview, Colin, an employee at Mill Corp., confesses to Jane that he has been embezzling money from the company. Which of the following pieces of information does Jane NOT have to obtain from Colin? A. The approximate date Colin started embezzling the money B. Information about the involvement of other Mill Corp. employees C. An estimate of the amount of money Colin embezzled D. A statement from Colin that his conduct was an accident

D. A statement from Colin that his conduct was an accident

Which of the following types of records is/are commonly available from local governments? A. Health and fire department records B. Utility records C. Voter registration records D. All of the above

D. All of the above

Which of the following is a recommended tactic for interrupting an accused's denials during an admission-seeking interview? A. Repeated interruptions B. Delays C. Reasoning D. All of the above

D. All of the above Repeated interruptions, delays, reasoning

Suppose you suspect there is a ghost employee scheme taking place in your organization and you want to compare the payroll records to the employee master file. Which data analysis technique would you use to match these two data records? A. Compliance verification B. Correlation analysis C. Gap testing D. The join function

D. The join function The join function gathers the specified parts of different data files. Joining files combines fields from two sorted input files into a third file. Join is used to match data in a transaction file with records in a master file, such as matching invoice data in an accounts receivable file to a master cluster. For example, you might need to compare two different files to find differing records between them.

Jeff, an employee at a retail store, is accused of skimming money from the register. During an admission-seeking interview with Jeff, the investigator states: "This is a huge corporation with more than a hundred stores, so it's not like a few dollars here and there is going to affect anyone personally. Is that how you saw it?" This technique is known as:

Depersonalizing the victim

Black, a fraud examiner, is conducting textual analytics on emails sent to and from specific employees that his client has identified as fraud suspects. He is using the Fraud Triangle to come up with a list of fraud keywords to use in his search. Which of the following words found in email text might indicate a fraudster is rationalizing his actions?

Deserve

The interviewer will invariably encounter a few difficult people. There are five common-sense steps to take with such people:

Don't react. Disarm nonreceptive respondents. DO not Attempt to reason with the respondent. Make it easy to say "yes" by agreeing with one of the respondent's statements and go from there. Make it hard for the respondent to say "no."

In interview situations, ___________ are questions that often suggest an answer opposite to the correct one.

Double-negative Double-negative questions are questions that have two forms of negation within a single clause. Double-negative questions, or statements containing double negatives, are confusing and often suggest an answer opposite to the correct one. Therefore, they should not be used. For example: "Didn't you suspect that something wasn't right?"

Which of the following statements about how fraud examiners should approach fraud examinations is CORRECT?

Fraud examinations should begin with general information that is known, starting at the periphery, and then move to the more specific details

nonverbal clues to deception?

Full-body motions away from the interviewer Physical responses such as sweating or labored breathing Changes in the use of illustrators Interruptions to the flow of speech Hands over the mouth Manipulation of objects such as a pencil Body positioned in a fleeing position Crossing of the arms Unnatural or casual reaction to evidence

Which of the following data analysis functions is most useful in testing for hidden journal entries?

Gap testing Gap testing is used to identify missing items in a sequence or series, such as missing checks or invoice numbers.

The goal of establishing an interview theme should be to:

Get the respondent to make a commitment to assist before commencing serious questioning.

Which of the following is the facilitator of communication that refers to rewards that are not directly related to the interview experience but that cause the respondent to see the interview as a means to an end?

Extrinsic rewards Extrinsic rewards for interviewees can include money, job advancement, and retention of privileges.

Facilitators of communication

Facilitators of communication are those social-psychological forces that make conversations, including interviews, easier to accomplish. These facilitators require a basic understanding of what motivates people. The facilitators are: fulfilling expectations, recognition, altruistic appeals, sympathetic understanding, new experience, catharsis, need for meaning, and extrinsic rewards.

The primary purpose of an expert report is to document the results of a fraud examination. (T/F)

False

To properly prepare an organization for a formal fraud investigation, all employees should be notified of the investigation's existence and purpose. (T/F)

False

Generally, the rules of admissibility for digital evidence are stricter than such rules for tangible evidence. (T/F)

False Although digital evidence is different from—and more volatile than—tangible evidence, the rules regarding the admissibility of digital evidence in court are really no different from the rules regarding the admissibility of any other type of evidence.

To protect the security of a covert investigation, reports or memoranda of the covert operation should not be committed to paper. (T/F)

False Before conducting a covert operation, it is essential that the basis for the operation be committed to writing, preferably in a memo. The memorandum should clearly state: The information upon which the covert operation will be based The information that is expected to be gained from the operation The identities of suspects, if known Operatives under the fraud examiner's care, custody, or control (confidential sources' identities should not be disclosed, but such sources should be referred to with a symbol)

Asset hiders generally prefer the financial vehicles they use to conceal assets to be traceable, inaccessible, illiquid, and exclusive. (T/F)

False Generally, asset hiders look to conceal their assets with financial vehicles that have certain characteristics. For one thing, asset hiders want products that are liquid (i.e., items that can be purchased and sold in a short period of time).

When a fraud examiner is conducting an examination and is in the process of collecting documents, he should leave the original document where it was discovered and take only a copy of the document for examination. (T/F)

False Obtain original documents where feasible. Make working copies for review, and keep the originals segregated. Do not touch originals any more than necessary; they might later have to undergo forensic analysis. Maintain a dependable filing system for the documents.

Gamma, a Certified Fraud Examiner, is conducting an investigation involving ABC Company, a company whose stock trades on a U.S. stock exchange. If Gamma requests ABC's annual financial report from the Securities and Exchange Commission (SEC), the information will be contained on which of the following SEC forms?

Form 10-K

During the preparation phase of the data analysis process, the fraud examiner must complete several important steps, including:

Identifying the relevant data Obtaining the requested data Verifying the data Cleansing and normalizing the data

Which of the following is LEAST likely to be revealed by analyzing a subject's electronic payment records?

If the subject is skimming employer funds

Which of the following statements concerning court records is most accurate?

In most countries, reliable court records are best obtained from the court in which the case was heard or filed.

In admission-seeking interviews, an innocent person often reacts differently to the initial accusation than a culpable person. Which of the following reactions to the initial accusation is common to an innocent person?

Strong denials-- innocent people sometimes react with genuine shock at being accused. It is not at all unusual for an innocent person, wrongfully accused, to react with anger. In contrast to the guilty person, the typical innocent person will strongly deny committing the act or acts in question.

Which of the following is the LEAST appropriate participant on a team assembled to investigate fraud?

Suspect's supervisor

System log

System logs record events executed on an operating system, including miscellaneous events and those generated during system startup, like hardware and controller failures. Common types of system events include starting up and shutting down, configuration updates, and system crashes

The FOIA provides for public access to the following information:

Tax rolls Voter registration (with some redactions) Assumed names Real property records Divorce/probate suits

Which of the following types of information are NOT deemed to be public under the U.S. Freedom of Information Act (FOIA)?

Telephone records, stock ownership records, trust records

Freedom of Information Act (FOIA)

The Freedom of Information Act (FOIA) is the primary legislation that governs the availability of U.S. governmental records to the general public. The Act sets very specific guidelines regarding which governmental records are and are not open to the public. Generally speaking, governmental records about an individual are prohibited from release. The disclosure of these records constitutes an invasion of privacy.

asset method

The asset method is another method of tracing illicit funds, but it involves identifying assets previously acquired, identifying current liabilities, and taking the difference between the two.

Which of the following best describes predication?

The basis upon which a fraud examination is undertaken

Carlos is conducting a background investigation of a corporation and its management. Which of the following can Carlos obtain without a legal order or subpoena?

The company's business filings Basic business organization—whether for businesses with a single owner or large corporations—is generally governed under the laws of the country in which the entity is organized. Most jurisdictions require business entities to file various types of records that contain information that might be useful in a fraud examination, and generally, such filings are available to the public.

A bank credit department generally maintains which of the following types of basic loan records?

The credit or loan file Loan records can provide important information regarding a subject. When a bank makes a commercial loan to an individual, it requires detailed statements of assets and liabilities from the borrower, and these records will be contained in the loan records.

When tracing financial transactions, the method that involves using the subject's books and records to analyze the relationship between the subject's receipt and subsequent disposition of funds or assets is called which of the following?

The direct method A direct method uses the subject's books and records (or financial transaction records belonging to third parties) to analyze the relationship between a suspect's receipt and subsequent disposition of funds or assets.

When tracing financial transactions, the method that involves using the subject's books and records to analyze the relationship between the subject's receipt and subsequent disposition of funds or assets is called which of the following?

The direct method---A direct method uses the subject's books and records (or financial transaction records belonging to third parties) to analyze the relationship between a suspect's receipt and subsequent disposition of funds or assets.

expenditures method

The expenditures method (also known as the sources and application of funds method) compares the suspect's known expenditures and known sources of funds during a given period of time. That is, this analysis seeks to quantify the cost of the subject's lifestyle and determine whether the subject's reported income is sufficient to support his lifestyle. The expenditures method is best used when the subject spends illicit income on consumables (such as travel and entertainment) that would not cause an increase in net worth.

Which of the following is a valid legal defense to allegations of entrapment against a fraud examiner who is a federal law enforcement officer?

The fraud examiner acted with adequate predication.

A fraud examiner is deciding whether to conduct a traditional or a covert examination for a suspected fraud. Which of the following factors would be most favorable to conducting a covert examination?

The fraud examiner would like to determine who is responsible for known losses occurring in a certain area. Covert operations should be used when there is no other practical way to obtain necessary information.

Which of the following is LEAST likely to be revealed by analyzing a subject's electronic payment records? A. The funds the subject has tied up in real property B. The locations of the subject's residences and businesses C. Loans the subject has obtained D. Assets the subject has purchased

The funds the subject has tied up in real property

installment transaction analysis method

The installment transaction analysis method and the income correlation method are not methods of tracing illicit funds.

Suppose you suspect there is a ghost employee scheme taking place in your organization and you want to compare the payroll records to the employee master file. Which data analysis technique would you use to match these two data records?

The join function--The join function gathers the specified parts of different data files. Joining files combines fields from two sorted input files into a third file. Join is used to match data in a transaction file with records in a master file, such as matching invoice data in an accounts receivable file to a master cluster. For example, you might need to compare two different files to find differing records between them.

Which of the following facts would best support the defense of a law enforcement officer against an allegation of entrapment?

The officer acted based on a tip from a reliable source it is imperative that the operation be properly predicated. The law enforcement officer or government agent must act based on more than mere suspicion.

During which phase of the data analysis process does the fraud examiner identify, obtain, and verify the relevant or requested data?

The preparation phase

When circumstantial evidence is offered to prove that a subject has more income available than can be accounted for from legitimate sources, the subject often responds with which of the following defenses?

The subject's excess funds were received as gifts. If a party uses an indirect method to prove the defendant's illicit assets circumstantially, the defendant will try to rebut such evidence. Often, the defendant will claim that the excess income came from legitimate sources. The defendant might claim that the funds are cash that he accumulated earlier or cash from other legitimate sources, such as loans or gifts from relatives.

If a fraud examiner was gathering information about a fraud suspect, which of the following types of information would likely require access to nonpublic sources of information to obtain?

The subject's phone records Some of the most valuable types of personal records include: Banking records Tax records Credit records of individuals Phone records Credit card account records Personal health care records

Which of the following pieces of information is NOT usually contained on the signature card of a personal bank account?

The thumbprint of the person opening the account

three general approaches for obtaining a verbal confession?

There are three general approaches to obtaining the verbal confession: chronologically, by transaction, or by event.

For a signed, written confession to be admissible in court, the statement must be:

There is no legal requirement that a statement must be in the handwriting or wording of the declarant. A statement's wording should be precise, and because the fraud examiner usually knows how to draft a valid statement, it is generally not a good idea to let a confessor draft the statement.

The following situations are those in which covert operations have traditionally worked well:

There is reliable information about criminal activity or asset losses, but insufficient detail for prevention or apprehension. Losses are known to be occurring in an area, but there is no information as to how they are occurring or who is responsible. It is desirable to gather information concerning personal relationships or to identify the contacts made with or by certain people. It is desirable to compare actual practices with supposed or required practices. It is important to obtain information in an indirect manner from people believed to possess it.

Uniform Commercial Code (UCC) filings can help fraud examiners identify

These filings identify: Name of the debtor or joint debtors Current address of the debtors Name of the financial lender Type of collateral pledged as security Date of filing and continuations

The planning phase

This phase consists of several important steps, including: Understanding the data Defining examination objectives Building a profile of potential frauds Determining whether predication exists

In interview situations, it is sometimes recommended that the interviewer shake hands with the respondent. What is the purpose of this?

To break down psychological barriers

Which of the following is NOT a purpose of the follow-up/recommendations section of a written fraud examination report?

To calculate the amount of loss caused by any misconduct identified during the investigation

Why would a fraud examiner perform duplicate testing on data?

To identify transactions with matching values in the same field: This technique can quickly review the file, or several files joined together, to highlight duplicate values of key fields. In many systems, the key fields should contain only unique values (no duplicate records).

Locating a subject when using online records

To locate people using online records, fraud examiners should adhere to three principles. First, when searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information. Second, the fraud examiner should consider the cost effectiveness of the search activity and avoid ordering online searches that yield unnecessary or impractical information. Third, the fraud examiner should know the most powerful and useful types of searches.

Which of the following best describes the primary purpose of the U.S. Right to Financial Privacy Act?

To prohibit financial institutions from disclosing financial information about individual customers to governmental agencies without consent or a judicial order

Why do fraud examiners perform textual analytics?

To uncover warning signs of potentially fraudulent employee behavior To reveal patterns, sentiments, and relationships indicative of fraud To gauge the pressures/incentives, opportunities, and rationalizations to commit fraud

A fraud examiner can request a business's bank records even if the business is not legally obligated to comply.

True The simplest way to obtain relevant documents, such as bank records, is to request them. This usually works for fraud examiners representing large organizations that are important customers to the party with the information. Vendors and other customers of the company conducting the investigation might cooperate voluntarily if they have nothing to hide (or think that incriminating evidence cannot be found) and are anxious to maintain good relations with the company.

Unlike a fraud examination report, an expert report should include specific information detailing the fraud examiner's opinions of a case, as well as the fraud examiner's qualifications and bases for providing those opinions. (T/F)

True Fraud examiners who serve as expert witnesses in litigation are tasked with providing an expert report, which requires them to provide particular information about their qualifications, their opinions, the bases of those opinions, and various other pieces of information. The purpose of an expert report is to inform the parties, the judge, and the jury (if applicable) about the expert's opinion of the case, as well as his credibility for commenting on such issues.

Forensic accounting differs from fraud examination in that forensic accounting is the use of professional accounting skills in matters involving potential or actual civil or criminal litigation and may or may not involve fraud. (T/F)

True he word forensic is defined by Black's Law Dictionary as "used in or suitable to courts of law or public debate." Therefore, forensic accounting is actually litigation support involving accounting.

Forensic analysis should not be performed directly on suspect devices because doing so can alter or damage digital evidence. (T/F)

True: Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence.

Two people are having a conversation in a public park, but they are not near any other people. Sandy, a private investigator in the United States, hid an audio recorder nearby without their knowledge and captures the conversation. Sandy's action is likely prohibited by law. (T/F)?

True; Generally, recording private conversations to which one is not a party is illegal unless the recording party has obtained the consent of those involved in the conversation.

The first phase of the data analysis process is the planning phase. This phase consists of several important steps, including:

Understanding the data Defining examination objectives Building a profile of potential frauds Determining whether predication exists

Text-based data is typically considered:

Unstructured data Unstructured data, by contrast, is data that would not be found in a traditional spreadsheet or database. It is typically text based.

________ are digital files created under the computer user's direction, such as text-based documents, spreadsheets, databases, emails, audio/video files, and image files.

User-created files

direct method of tracing financial transactions?

a direct method uses the subject's books and records (or financial transaction records belonging to third parties) to analyze the relationship between a suspect's receipt and subsequent disposition of funds or assets.

The ______________ method of tracing illicit funds is recommended as a primary method of proof when most of the subject's income is deposited in a financial institution and the subject's books and records are unavailable, withheld, incomplete, or maintained on a cash basis.

bank deposits method

The indirect method

indirect method employs circumstantial evidence to analyze the relationship between a suspect's receipt and subsequent disposition of funds or assets.

Multi-file processing

is a data analysis software function that allows users to relate several files by defining relationships in collected data, without the use of the join command.

Textual analytics

is a method of using software to extract usable information from unstructured data.

Encryption

refers to procedures used to convert information using an algorithm (called a cipher) that makes the information unreadable.

What is a letter rogatory?

A formal request by the courts of one country seeking judicial assistance from the courts of another country

Gamma, a Certified Fraud Examiner, is interviewing Beta, a fraud suspect. Gamma asks Beta, "Who in the company could be responsible for this situation?" If Beta is guilty, he is more likely to say:

"It could have been anybody." Both the honest respondent and the liar have a natural reluctance to name others involved in misdeeds. However, the liar frequently refuses to implicate possible suspects, no matter how much pressure the interviewer applies. This is because the culpable person does not want the circle of suspicion to be narrowed.

A Uniform Commercial Code (UCC) filings search can help identify:

(UCC) filings can help fraud examiners identify personal property that an individual or business has financed. These filings identify: Name of the debtor or joint debtors Current address of the debtors Name of the financial lender Type of collateral pledged as security Date of filing and continuation

The following are typical examples of data analysis queries that can be performed by data analysis software on accounts payable:

*Audit paid invoices for manual comparison with actual invoices. *Summarize large invoices by amount, vendor, etc. *Identify debits to expense accounts outside of set default accounts. *Reconcile check registers to disbursements by vendor invoice. *Verify vendor tax forms (e.g., U.S. Form 1099 or Value Added Tax (VAT) forms). *Create vendor detail and summary analysis reports. *Review recurring monthly expenses and compare to posted/paid invoices. *Generate a report on specified vouchers for manual audit or investigation.

What is mutual legal assistance (MLA)?

. A process by which countries request and provide assistance in law enforcement matters

When computing a subject's net worth, these issues should be considered:

1.) All assets should be valued at cost, not fair market value. Subsequent appreciation or depreciation of assets should be ignored. 2.) The amount of funds available to the subject from legitimate sources should be estimated or computed generously. 3.) The subject should be interviewed to identify all alleged sources of funds and to negate defenses that he might raise later.

Liam, a Certified Fraud Examiner, is attempting to get a fraud suspect to admit guilt. Liam should:

1.)Show the suspect incriminating evidence 2.)Give the suspect an excuse for his behavior 3.) Directly accuse the suspect

Which of the following situations would the U.S. Privacy Act of 1974 regulate?

A federal agency distributing the medical and employment history of various individuals. The U.S. Privacy Act of 1974 establishes a code of information practices that regulates the collection, maintenance, consumption, and distribution of personally identifiable information that is maintained by federal agencies. It restricts information about individuals, both employees and nonemployees, and it applies to governmental agencies and government contractors running a system of records on behalf of the government.

Simone, a manager at a major company, is suspected of financial statement fraud. During an admission-seeking interview with Simone, the investigator states: "A lot of employees count on the company doing well. I know you only did this to help the company succeed. Isn't that right?" This technique is known as:

Altruism--In many cases, the moral seriousness of the matter can be reduced by claiming the action was for the benefit of others. This is especially true if the accused views himself as a caring person. This is known as "altruism." In establishing this rationalization, the interviewer might say something similar to the following examples: "I know you didn't do this for yourself. I have looked into this matter carefully, and I think you did this to help your husband, didn't you?" "You have a big responsibility in this company.

Form 10-K

Annual Report of Publicly Traded Company (Form 10-K): Form 10-K is the title of the annual report that issuer companies must file; it contains the company's income statement and balance sheet, information on its debt structure, foreign ownership, properties owned, subsidiaries, industry descriptions, depreciation, dilution, and other key business information.

Electronic payments (or e-payments) refer to any type of noncash payment that does not involve a paper check. Electronic payment records can reveal, among other things:

Assets the subject has purchased The locations of the subject's assets (e.g., through the payment of real estate taxes, broker's fees, or utility payments) The locations of the subject's residences and businesses (e.g., through analyzing the payments of utility bills) Loans the subject has obtained (e.g., through analyzing loan payments) Payments made to nonexistent employees with direct deposit The cities and countries in which the subject conducts business (e.g., through analyzing the payments for carrier services to deliver packages) Assets ostensibly owned by family members or close associates but effectively controlled, held, or gifted by the subject Hotel payments The true owner of a property (e.g., through analyzing the mortgage payments and payments for home owner insurance)

Which of the following is a step in the general process for tracing illicit transactions? A. Establishing reporting protocols B. Implementing litigation hold procedures C. Building a financial profile D. Selecting a response team

C. Building a financial profile generally should involve the following elements: Collect information. Profile the subject (i.e., assemble the personal—financial and behavioral—profile). Review information for leads and prioritize leads. Trace the illicit transactions.

Which of the following is a type of information that can be obtained from the Internet archives? A. Content on websites without any links pointing to them B. Content on a website that is protected by passwords C. Content posted on a website that has been removed D. Content on websites not indexed by standard search engines

C. Content posted on a website that has been removed

Which of the following types of searches, if available in the jurisdiction, is best suited for locating people using online records? A. On-site court records searches B. Media database searches C. Credit bureau header searches D. Medical facility commitment records

C. Credit bureau header searches

In interview situations, a(n)_______________ is an orderly, continuous account of an event or incident given by a respondent with minimal or no prompting. A. Informational response B. Unprompted script C. Free narrative D. None of the above

C. Free narrative

Baker, a fraud examiner for the U.S. government, is attempting to obtain information about a fraud suspect from a local bank. The bank's records are covered by which U.S. federal law? A. Freedom of Information Act B. Fair and Accurate Credit Transactions Act C. Right to Financial Privacy Act D. Financial Institutions Records Act

C. Right to Financial Privacy Act

Martin, a Certified Fraud Examiner, is conducting an admission-seeking interview of Doris, a fraud suspect. Although Martin has already interviewed several witnesses, he should not tell Doris under any circumstances that he has interviewed other individuals. (T/F)

False One technique for diffusing alibis is to discuss the testimony of witnesses. The objective is to give enough information about what other people might say without providing too much. Ideally, the interviewer's statement will create the impression in the accused's mind that many people are in a position to contradict his story.

In interview situations, admission-seeking questions should be phrased "Did you do it?" rather than "Why did you do it?" (T/F)

False People generally do not confess if they believe that there is doubt in the accuser's mind regarding their guilt. Thus, the interviewer must convey absolute confidence in the admission-seeking interview—even if not fully convinced. The interviewer must make the accusation in the form of an implied statement of fact. Accusatory questions do not ask, "Did you do it?" They ask, "Why did you do it?"

The records of a wire transfer identify the amount of the wire, where it was sent, and the date it was sent, but they do not identify who sent the wire. (T/F)

False The records of a wire transfer identify who sent the wire, where it was sent, the date it was sent, and its amount.

To protect privacy interests, courts generally find that audit clauses within business partner contracts are void, and most jurisdictions have laws that prohibit businesses from making threats to terminate a business relationship over a contracting party's refusal to turn over nonpublic information. (T/F)

False There are several ways to obtain nonpublic information. An organization may demand that a supplier, vendor, or agent turn over relevant documents as a condition of continued business. Taking this action is legal, in appropriate circumstances. Of course, management and counsel should be consulted before such demands are made, particularly if the other party has a contractual relationship with the demanding organization.

For the purpose of a Benford's Law analysis, an employee identification number would be considered a "natural number." (T/F)

False non-natural numbers (e.g., employee identification numbers and telephone numbers) are designed systematically to convey information that restricts the natural nature of the number. Any number that is arbitrarily determined, such as the price of inventory held for sale, is considered a non-natural number.

All written fraud examination reports must include a follow-up/recommendations section. (T/F)

False A follow-up/recommendations section is generally an optional part of a written fraud examination report.

Sullivan is conducting an interview with Marsha, a potential co-conspirator in a fraud scheme. Throughout the interview, Marsha continuously moves around in her chair and touches her hair, indicating that she is nervous and under stress. Based on these signs, Sullivan should conclude that Marsha is lying to him. (T/F)`

False In detecting deception during an interview, the interviewer must remember that the interviewee or target might already be under stress because of the situation. While lying and deception do indeed cause stress, it is not necessarily true that all stress exhibited during an interview is caused by lying.

If a fraud examiner working in the United States needs information on registration and disciplinary information regarding firms and individuals in the U.S. futures industry, he should contact the Financial Industry Regulatory Authority (FINRA). (T/F)

False The NFA, NOT FIRNA. This information includes registration status and employment history; disciplinary actions filed by the NFA, the CFTC, and the commodity exchanges; and customer complaints filed under the CFTC's Reparations Program.

Tobias, a Certified Fraud Examiner, is conducting an admission-seeking interview of Frederik, a fraud suspect. Tobias has a great deal of documentary evidence that he plans on using to diffuse Frederik's alibis. The proper technique for using the evidence is for Tobias to display it all at once so that Frederik will be demoralized by the overwhelming amount of evidence. (T/F)

False The physical evidence—usually documents in fraud matters—generally should be displayed one piece at a time, in reverse order of importance. In this way, the accused does not immediately know the full extent of the evidence. When the accused no longer denies culpability, the interviewer should stop displaying evidence.

The proper method for developing latent fingerprints that have been absorbed into porous materials, such as paper, is to dust them with fingerprint powder. (T/F)

False, Fraud examiners should never try to develop latent fingerprints that have been absorbed into paper or other porous materials by dusting with fingerprint powder or any other means. Such efforts will not only be unsuccessful, but they will prevent additional examinations. Instead, fraud examiners should preserve evidentiary documents that contain latent fingerprints by placing them into labeled protective containers, such as sealable, acid-free paper envelopes.

If the accused becomes withdrawn after his alibis have been diffused, the interviewer's best course of action is to remain silent until the accused makes a confession. (T/F)

False- The interviewer should not remain silent or discourage the accused from showing emotion. Generally, such reactions indicate that the accused is considering whether to confess. At this point in the interview, the interviewer should present an alternative question. The alternative question forces the accused to make one of two choices, both of which constitute a benchmark admission (i.e., an answer that implies guilt). Regardless of whether the accused answers yes or no, he will make a culpable statement, or benchmark admission. Once the benchmark admission is made, the subject has made a subconscious decision to confess.

During the analysis phase in digital forensic investigations, the fraud examiner's primary concern is to protect the collected information from seizure. (T/F)

False-The primary concern when analyzing digital evidence is to maintain the integrity of the data at all times. Fraud examiners must be especially careful with computer equipment because a careless investigator might inadvertently alter important evidence

The fraud examiner should document the details of an interview within a month of the interview date (T/F) ?

False... Written reports must be timely. The timeliness of reports is extremely important because it tends to enhance the accuracy of witness testimony, as well as preserve the fraud examiner's memory of the interview(s). Thus, all interviews should be transcribed and documented in a memorandum of interview as soon as possible after the questioning takes place—preferably on the same day of the interview. (#117)

Because digital evidence is different from tangible evidence, the rules regarding its admissibility in court are very different from the rules governing the admissibility of tangible evidence. (T/F)

False; Although digital evidence is different from tangible evidence, the rules regarding the admissibility of digital evidence in court are really no different from the rules regarding the admissibility of any other type of evidence.

In most jurisdictions, criminal conviction records are generally not available to the general public unless a judicial order has been issued. (T/F)?

False; In most jurisdictions, most of the papers filed in civil suits are accessible as public records; however, criminal and juvenile actions might not be as open to review. In addition, criminal conviction records are generally available to the public.

Keeping track of the amount of paper generated is one of the biggest challenges in fraud cases. Which of the following is generally NOT a recommended practice when organizing evidence?

File all papers chronologically.

"Aren't you responsible for reviewing and approving your employees' timesheets?" is an example of which of the following types of questions?

Leading Leading questions are questions that are framed in a way that evokes a specific reply from the respondent; they are questions that contain a suggested answer. Most commonly, leading questions are used to confirm facts already known. This type of question gives the subject much less room to maneuver than an open or closed question because these questions direct the subject to answer in a particular way. Leading questions imply that the interviewer already knows the answer, asking the subject to confirm what is already known. They can be particularly effective in interview situations. Examples of leading questions include: "So there have been no changes in the operation since last year?"; "Are you still employed by the Westbrook Furnishings Corporation?"; "You got promoted, right?"; "Don't you get your income from various sources?"

In interviews involving anxiety and uncertainty, individuals might perform displacement activities that reduce nervousness. These types of displacement activities are known as:

Manipulators Manipulators are motions like picking lint from clothing, playing with objects such as pencils, or holding one's hands while talking. Manipulators are displacement activities that reduce nervousness.

A(n) _____________ is a type of visual aid, in the form of a grid, that shows the relationship (or points of contacts) between a number of entities. A. Matrix B. Time-flow diagram C. Decision chart D. Organization chart

Matrix Reporting the results of fraud examinations is often facilitated through the use of visual aids. A matrix is a type of visual aid, in the form of a grid, that shows the relationship (or points of contacts) between a number of entities.

Which of the following statements best describes the function of metasearch engines?

Metasearch engines send user requests to several other search engines and aggregate the results for display

The __________ method of tracing assets would yield the best result when several of the subject's assets or liabilities have changed during the period under examination and the subject's financial records are not available.

Net worth

Which of the following is an example of an indirect method of locating assets or tracing illicit funds?

Net-worth analysis Often, when a fraud examiner must locate a subject's assets or trace illicit funds, the subject's books and records are not made available. In such cases, the fraud examiner must use an indirect approach, such as net-worth analysis or the bank deposit analysis method, to prove income.

When evaluating a respondent's behavior for signs of deception during an interview, it is important that the interviewer remember that:

No single behavior should be isolated and no single conclusion should be drawn from it Because it is easy to draw the wrong conclusions when evaluating signs of deception, no single behavior should be isolated and no single conclusion should be drawn from it. Behaviors should be considered together. For example, a subject's failure to make eye contact during an interview is not necessarily proof of deception.

An admission-seeking interview is specifically designed to:

Obtain a legal admission of wrongdoing The admission-seeking interview is designed to obtain a legal admission of wrongdoing. It also serves various other purposes. For example, it seeks to clear an innocent person and encourage a culpable person to confess

An admission-seeking interview is specifically designed to:

Obtain a legal admission of wrongdoing; The admission-seeking interview is designed to obtain a legal admission of wrongdoing. It also serves various other purposes. For example, it seeks to clear an innocent person and encourage a culpable person to confess. A culpable individual usually confesses during the admission-seeking phase of an interview, while an innocent person does not do so unless threats or coercion are used. Also, the interviewer will seek to obtain a valid confession. And finally, admission-seeking interviews are designed to convince the confessor to sign a written statement acknowledging the facts.

few general rules regarding the collection of documents:

Obtain original documents where feasible. Make working copies for review, and keep the originals segregated. Do not touch originals any more than necessary; they might later have to undergo forensic analysis. Maintain a dependable filing system for the documents. This is especially critical when large numbers of documents are obtained. Losing a key document is very problematic and can damage the case. Documents can be stamped sequentially for easy reference.

Which of the following is the most accurate statement about trying to locate a subject using online records?

Obtaining a past address of the subject should be the first step in trying to locate a subject using online records.

Open questions

Open questions are those worded in a way that makes it difficult for the respondent to answer "yes" or "no." Also, the answer to an open question is not dependent on the question. The typical open question calls for a monologue response, and it can be answered in several different ways.

A fraud examiner is conducting textual analytics on journal entry data and runs a keyword search using the terms override, write off, and reserve/provision. With which leg of the Fraud Triangle are these fraud keywords typically associated?

Opportunity In conducting a textual analytics examination, the fraud examiner should come up with a list of fraud keywords that are likely to point to suspicious activity. This list will depend on the industry, the suspected fraud schemes or types of fraud risk present, and the data set the fraud examiner has available.

Green, a Certified Fraud Examiner, is conducting an admission-seeking interview of Brown, a fraud suspect. Brown has confessed to having committed the fraud, but he is denying anyone else was involved. However, Green knows this is untrue. What should Green do next?

Proceed as if the falsehood has been accepted as truth and return to it later. If the discrepancies are material to the offense, the interviewer should either resolve them at the end of the verbal confession or wait and correct them in the written confession. If not material, such information can be omitted from the written confession.

In interview situations, ______________ is defined as a "relation marked by harmony, conformity, accord, or affinity."

Rapport

Spencer, a fraud examiner, plans to use a confidential informant. The informant agrees to aid Spencer in exchange for cash. Spencer prepares a receipt for the transfer of cash to the informant and asks the informant to sign it, but the informant refuses. What should Spencer do?

Refuse to pay the cash without a receipt, even if it means the informant will not aid Spencer

When people engage in conversations, including interviews, they respond automatically with expressions that have little real meaning, such as "Good morning" and "How are you today?" These kinds of expressions are called:

Ritualistic

Which of the following types of records for a personal bank account would most likely contain the account holder's name, address, telephone number, and government identification number?

Signature card--The signature card is a source of valuable information. Although its form varies, the card usually contains the person's name, address, telephone number, identification number, amount of opening deposit (and possibly the source of opening deposit), and security data (e.g., mother's maiden name).

A(n) ___________ is a writing, usually a signature, prepared by carefully copying or tracing a model example of another person's writings.

Simulated forgery

Which of the following is NOT an example of a data analysis function that can be performed to detect fraud through examination of accounts payable?

Sort asset values by asset type or monetary amount.