CERTIFIED FORENSIC FRAUD EXAMINER (CFFE) MODULE TWO
PLANNING AND CONDUCTING FORMAL INVESTIGATIONS
FRIDAY: 25 April 2025. Morning Paper. Time Allowed: 3 hours.
Answer ALL questions. This paper has two sections. SECTION I consists of fifty (50) Multiple Choice Questions carrying fifty (50) marks. SECTION II has four (4) structured questions carrying (50) marks. Marks allocated to each question are indicated at the end of the question.
SECTION I (50 MARKS)
1. Which one of the following statements is ACCURATE in regard to closed questions?
A. Closed questions and leading questions are the same because that they are aimed at confirming facts
B. Closed questions deal with specifics, like amounts and time
C. Closed questions should be asked extensively during information gathering
D. Closed questions are asked in a way that the answer can only be yes (1 mark)
2. Which one of the following statements is NOT accurate in regard to forensic audit and forensic accounting?
A. Forensic accounting engagements requires team members with advanced accounting knowledge and skills
B. Forensic audits are conducted with assumption that it will end up in court
C. Not all forensic accounting engagements are conducted for court purposes
D. Some forensic accounting engagements are conducted for court purposes (1 mark)
3. Which one of the following statements is NOT accurate in regard to forensic fraud audit interviews?
A. Forensic audit interview is a method of collecting information and evidence
B. Forensic audit interviews should be conducted on the basis of sufficient predication
C. Forensic audit interviews should start interviewing neutral witnesses
D. The purpose of a forensic audit interview is to conclude if fraud occurred or not (1 mark)
4. Which one of the following questions BEST describes a question that stimulates communication?
A. Open ended question
B. Narrative questions
C. Leading question
D. Closed questions (1 mark)
5. Which one of the following statements is ACCURATE in regard to the functions of a fraud investigation or a forensic audit?
A. Producing documents in court
B. Primary responsibility for fraud detection and prevention of fraud
C. Determining the suspect’s liability
D. Determining the suspect’s responsibility for the alleged offence (1 mark)
6. Which one of the following statements is ACCURATE in regard to the conclusion of forensic audit report?
A. The forensic auditor must conclude if fraud occurred or not
B. The forensic auditor should avoid mentioning individual’s names in the report
C. The forensic auditor should support their conclusion sufficient information
D. The forensic auditor must conclude that that fraud occurred (1 mark)
7. Which one of the following statements is ACCURATE in regard to when an interviewer should ask an open question during the closing of an interview?
A. The interviewer should ask open questions to request for additional information
B. The interviewer should ask open questions to maintain goodwill
C. The interviewer should ask open questions to confirm acts
D. The interviewer should ask open questions to get commitment for assistance (1 mark)
8. Which one of the following questions is the BEST to ask for purposes of maintaining goodwill with the interviewee?
A. “I believe the interview was fair,” “is that so?”
B. “I believe the interview was not hard,” “is that so?”
C. “I believe you enjoyed the interview,” “is that so?”
D. “I believe you are fine now,” “is that ok?” (1 mark)
9. Which one of the following statements BEST describes the method of tracing illicit funds examining the suspects books and records?
A. Direct method
B. Bank deposit analysis method
C. Indirect method
D. Asset method (1 mark)
10. Which one of the following statements is ACCURATE in regard to the interviewer taking written down questions to an interview of a witness?
A. The interviewer will display bad attitude because of the past pacing of questioning
B. The interviewer will look organised
C. The interview will be successful because the interviewer will not forget important points
D. The interviewer will display good attitude because he will be asking predetermined relevant questions
(1 mark)
11. Which one of the following statements BEST describes information exchange an interviewer during an admission seeking interview?
A. “I have evidence that you committed the offence”
B. “I can try to imagine how bad you are feeling about what happened”
C. “What reason did you have for engaging in such a misconduct”
D. “I hope you are remorseful about what you did” (1 mark)
12. Which one of the following statements is ACCURATE in regard to how management should respond to suspicion of fraudulent activities?
A. Conducting an inquiry
B. Assemble an investigation team
C. Identify who is responsible
D. Commission an investigation immediately (1 mark)
13. Which one of the following statements is NOT one of the primary types of evidence that fraud examiners might collect during an investigation?
A. Testimonial evidence
B. Exhibits evidence
C. Digital evidence
D. Incriminating evidence (1 mark)
14. Which one of the following statements is ACCURATE in regard to the interview of a professional suspect of fraud?
A. It is very hard for a professional suspect to make an admission
B. It is not possible for a professional suspect to make an admission even if the interviewer is skilled in conducting admission seeking interviews
C. Professional suspects feel very vulnerable when caught and are likely to make an admission to a skilled interviewer
D. A professional who is guilty is likely to make very strong denials when directly accused (1 mark)
15. Which one of the following terminologies BEST describes the interviewing technique that appeals to the suspect to admit to fraudulent activity for a bigger reason than self-interest?
A. Rationalisation
B. Altruism
C. Extrinsic rewards
D. Depersonalisation (1 mark)
16. Which one of the following statements is ACCURATE in regard to public online database as a source of information?
A. Information from online databases can fully be relied on in terms of accuracy and currency
B. Online public records searches are not limited in the area they cover, therefore the fraud examiners do not need to search multiple jurisdictions
C. Online coverage of public records is similar in all jurisdictions
D. They contain a wide range of resources such as scholarly articles, research papers and e-books (1 mark)
17. Which one of the following questions should an interviewer NOT ask during admission seeking interview until the suspect has made a confession?
A. Accusatory question
B. Open question
C. Alternative question
D. None of the above (1 mark)
18. Which one of the following statements is NOT accurate in regard to digital evidence?
A. Digital evidence must be properly authenticated to be admissible in a court of law
B. Unlike tangible evidence, there is no requirement for the digital evidence to be authenticated
C. Imaging the hard drive and obtaining a copy of the data helps to preserve the integrity of the data
D. Printing a digital file may affect the integrity of the data (1 mark)
19. Which one of the following statements is NOT accurate in regard to presumption of audit and forensic audit?
A. Presumption of audit is to assume that something is wrong
B. Presumption of forensic audit is proof
C. Presumption of an audit is to collect audit evidence to relax the skepticism
D. Presumption of an audit is final to all parties (1 mark)
20. Data analysis tools that can be effective in demonstrating evidence of shell companies is known an .
A. link analysis
B. benford law
C. textual analysis
D. link diagram (1 mark)
21. Which one of the following statements BEST describes the statement that should follow after the introduction of an admission seeking interview?
A. Accusatory statement
B. Benchmark statement
C. Controlled answer statement
D. Open ended question (1 mark)
22. A fraud examiner’s greatest concern in digital forensics is to .
A. protect disclosure of the evidence
B. protect the availability of evidence
C. protect the confidentiality of the evidence
D. protect unavailability of evidence (1 mark)
23. Which one of the following is a good example of a question that should be asked immediately after the introduction of a suspect interview?
A. “You are the receivable accountant right?”
B. “Did you take the money because you wanted extra money or you had an emergency?”
C. “Didn’t you know that what you were doing is not right?”
D. “You took the money; why did you do that?” (1 mark)
24. Which one of the following statements BEST describes the conclusion section of a forensic audit or investigation report?
A. I conclude that Mr. Jones made fraudulent disbursements and the basis of my conclusion is the following evidence, exhibits, circumstantial evidence and testimonial evidence
B. I conclude that the organisation take disciplinary measures against Jones based on the evidence I collected
C. I conclude that there is a likelihood that Mr. Jones made fraudulent disbursements based on the evidence I collected
D. I found and conclude that the finance department made fraudulent disbursements (1 mark)
25. Which one of the following statements is NOT accurate in regard to the difference between data analysis and textual analytics in fraud investigation?
A. Textual analytics use unstructured data
B. Textual analytics use structured data
C. Textual analytics identify words that are indicative of fraud
D. None of the above (1 mark)
26. Which one of the following statements is NOT accurate in regard to the interviewer’s responsibility during the introductory phase?
A. The interviewer has the responsibility of setting the right tone of the interview
B. The interviewer should be formal and firm to ensure the success of the interview
C. The interviewer should make sure that they get commitment for assistance from the suspect
D. The interviewer should not give the specific reason for the interview (1 mark)
27. Which one of the following statements is ACCURATE in regard to forensic audits perspective approach?
A. A forensic audit should be approached from two perspectives, that fraud occurred or did not occur
B. A forensic audit should be approached from the perspective that fraud occurred
C. A forensic audit should be approached from the perspective that fraud did not occur
D. A forensic audit should be prepared any professional (1 mark)
28. Which one of the following statements describes diffusing alibis during an interview?
A. Diffusing alibis involves interrupting denials
B. Diffusing alibis involves rationalising the suspects misconduct
C. Diffusing alibis involves making altruistic appeals to the suspect
D. Diffusing alibis involves trying to reason with the suspect (1 mark)
29. Which one of the following statements is a common method fraudsters use to hide assets acquired with proceeds of corruption?
A. Placing assets in probate
B. Selling the assets
C. Transferring assets
D. None of the above (1 mark)
30. Which one of the following statements is NOT accurate in regard to what an interviewer can do to obtain an admission?
A. The interviewer can allow the suspect to make excuses why they engaged in the misconduct
B. The interviewer should show compassion when interviewing a suspect
C. The interviewer should avoid condemnation not making direct accusation
D. The interviewer should not allow the suspect to say that they did not know what they did was wrong
(1 mark)
31. Which one of the following statements is NOT accurate in regard to common mistakes that investigators make when writing reports?
A. Expressing opinions trying to interpret the facts
B. Including facts that are not relevant to the facts in issue
C. Including facts from unreliable sources
D. Concluding that fraud occurred or did not occur (1 mark)
32. Which one of the following loan amounts should be used in developing a financial profile?
A. Loan proceeds
B. Book loan amount
C. Principal loan
D. Principal and interest amount (1 mark)
33. Which one of the following statements is NOT a step in the preparation phase of the data analysis process?
A. Normalising and cleansing data
B. Identifying relevant data
C. Verifying data
D. None of the above (1 mark)
34. Which one of the following terminologies is NOT a psychological barrier of communication?
A. Competing
B. Repression
C. Persuasion
D. Deduction (1 mark)
35. Which one of the following statements BEST describes “Trying to reason with the suspect” which an interviewer should avoid doing?
A. Responding to the suspects questions
B. Showing the suspect incriminating evidence
C. Discussing other witnesses
D. Discussing previous inconsistent statements (1 mark)
36. Which one of the following logs is NOT a computer-generated file that can be used as evidence?
A. Application logs
B. Events logs
C. System logs
D. Word logs (1 mark)
37. Which one of the following statements is ACCURATE in regard to the conclusion of an investigation report?
A. The conclusion part of the report should include the summary of the evidence
B. The conclusion part of the report should include the recommendations on actions to be taken based on the evidence collected
C. The conclusion part of the report should document other areas that require further investigation
D. None of the above (1 mark)
38. Which one of the following statements is ACCURATE in regard to the circumstances that a fraud examiner can collect evidence from a running computer?
A. A fraud examiner should not collect evidence from a running machine but rather do a hard shut down
B. A fraud examiner can collect evidence of temporary files directly from a running machine
C. A fraud examiner should do graceful shut down of temporary files that might be sources of evidence
D. None of the above (1 mark)
39. Which one of the following questions does NOT describe a weak denial in response to an accusatory question?
A. Why do you think I would do that?
B. Do you have evidence?
C. Who told you?
D. Must it be me? (1 mark)
40. When an examiner is using textual analysis to look for words indicative of fraud, which one of the following words would be indicative of situational pressure to commit fraud?
A. Deadline
B. Deserve
C. Targets
D. All the above (1 mark)
41. Which one of the following statements is an example of numbers that can be applied on the Benford analysis?
A. Telephone numbers
B. Vendors invoice amounts
C. Sales invoice numbers
D. All the above (1 mark)
42. Which one of the following statements is ACCURATE in regard to conducting an interview in the presence of the interviewee’s advocate?
A. The interviewer should not conduct the interview
B. The interviewer should conduct the interview
C. The interviewer should not allow the advocate into the interview
D. None of the above (1 mark)
43. Which one of the following statements is ACCURATE in regard to closed questions in closing questions?
A. They are worded in a way that the respondent can answer “yes” or “no”
B. They are worded in a way that the respondent can only answer “yes”
C. They are worded in a way that the respondent can only answer “No”
D. They are worded in a way that will help elicit more information (1 mark)
44. Which one of the following statements is ACCURATE in regard to fraud investigation?
A. A method for collecting evidence to prove allegations
B. It is a methodology for resolving fraud allegation from inception to disposition proving the alleged facts
C. It is a methodology for resolving fraud issues from inception to disposition
D. None of the above (1 mark)
45. Which one of the following statements is ACCURATE in regard to the basis upon which a fraud examination is undertaken?
A. Fraud examination is undertaken on the basis of sufficient suspicion that fraud has occurred
B. Fraud examination is undertaken on the basis of sufficient evidence that fraud has occurred
C. Fraud examination is undertaken on the basis of sufficient evidence that fraud did not occur
D. Fraud examination is undertaken on the basis of sufficient evidence that fraud could have occurred or not occurred (1 mark)
46. Which one of the following statements is NOT accurate in regard to how management should respond to tips of fraudulent activities?
A. Conduct an initial inquiry
B. Preserve relevant documents
C. Identify who should be informed
D. Conduct an investigation as fast as possible (1 mark)
47. Which one of the following statements is NOT accurate in regard to considerations to take into account about the disposal of evidence following the conclusion of a forensic audit?
A. The requirements in an organisation’s document retention policy
B. The personal information about suspects or witnesses documented in the evidence
C. Legal issues related to litigation
D. None of the above (1 mark)
48. Which one of the following statements is NOT a reason for observing signs of deception in interviewees?
A. To warn the interviewee not to be deceitful
B. To quickly conclude the interview
C. To discard the information
D. None of the above (1 mark)
49. Which one of the following types of evidence BEST describe a written statement provided a witness?
A. Testimonial evidence
B. Exhibit evidence
C. Real evidence
D. Documentary evidence (1 mark)
50. Which one of the following statements is NOT accurate in regard to forensic audits engagements?
A. A forensic auditor must have good understanding of the laws related to fraud and corruption to be able to identify what law has been violated
B. A forensic auditor must have good knowledge of the rules of evidence
C. A forensic auditor must have good interviewing skills
D. A forensic auditor must have good knowledge of accounting and audit (1 mark)
SECTION II (50 MARKS)
51. Explain the following in the context of forensic audit:
(a) Expert report. (5 marks)
(b) Objective of a forensic audit report. (5 marks)
(c) Contents of a recommendation in a report. (5 marks)
(d) Contents of a conclusion in a report. (5 marks)
(Total: 20 marks)
52. Explain the following statements in regard to interviewing a suspect:
(a) Two questions used in admission interviews. (6 marks)
(b) Three techniques used during admission seeking interview. (9 marks)
(Total: 15 marks)
53. Describe FIVE stages of digital forensic investigations. (Total: 10 marks)
54. Identify FIVE characteristics of a good forensic interviewer. (Total: 5 marks)
……………………………………………………………………..