CERTIFIED FORENSIC FRAUD EXAMINER (CFFE)
MODULE TWO
PLANNING AND CONDUCTING FORMAL INVESTIGATIONS
THURSDAY: 25 April 2024. Morning Paper. Time Allowed: 3 hours.
Answer ALL questions indicating the letter (A, B, C or D) that represents the correct answer. This paper is made up of one hundred (100) Multiple Choice Questions. Each question is allocated one (1) mark.
1. Which one of the following statements is NOT accurate in regard to the five standards of fraud investigations or forensic audit report writing?
A. The defence counsel will take advantage of even immaterial inaccuracies to discredit the forensic audit report
B. A forensic audit report which is inaccurate, in regard to dates and amounts, would affect the credibility of the report
C. The defence counsel would discover such inaccuracies during pre-trial and use them against the prosecution in cross examination
D. Immaterial inaccuracies would not affect the credibility of the forensic audit report (1 mark)
2. Which one of the following statements is NOT accurate in regard to forensic audit, fraud investigations and fraud examination engagements?
A. Forensic audit or fraud investigations are the same, because the purpose of both assignments is to collect evidence to prove or disapprove an allegation
B. The terms forensic audit, fraud investigations or examinations can be used inter-changeably because the objectives of the assignments are the same
C. Forensic audit differs from fraud investigations because, forensic audit is a type of a special audit conducted to collect more information and details while fraud investigations are conducted to collect evidence that can be used in a court of law
D. An auditor cannot conduct a good fraud forensic audit without a formal training and experience in fraud investigation (1 mark)
3. Forensic auditors and investigators must have good interviewing skills because interviewing is one of the most effective investigation method of fraud and corruption allegations. Which one of the following statements is NOT accurate in regard to fraud and corruption investigations interviews?
A. Most of the fraud and corruption activities are off the book, therefore the investigator must have good interpersonal skills
B. In most fraud and corruption cases information and evidence is not in the books, so the investigator has to get the information from witnesses
C. In fraud and corruption cases the investigator may have to get physical evidence from the suspect
D. Fraud and corruption investigation interviews involves asking witnesses and suspects questions (1 mark)
4. Double-negative question should be avoided in fraud investigations interviews. Which one of the following statements is ACCURATE in regard to response to double negative questions?
A. The response to a double-negative question, usually is: “I did not Know,” which removes intent
B. The response to a double-negative question is usually useful
C. A double-negative question is usually effective in obtaining a benchmark admission
D. None of the above (1 mark)
5. Report writing is a very important function of a fraud forensic audit. Which one of the following statements is
ACCURATE in regard to the contents of the introduction/background section of a forensic audit report?
A. The introduction/background section should include all the purposes of the forensic audit
B. The introduction/background section should include the main objective of the audit, which is to prove or disapprove the allegations
C. The introduction/background section should include a summary of the findings of the forensic audit
D. The introduction/background section should include the scope of the audit (1 mark)
6. Which one of the following statements is ACCURATE in regard to the right time to ask closing questions?
A. The interviewer should ask closed questions extensively, in closing questions
B. The interviewer should ask open-ended questions extensively, in closing questions
C. The interviewer should ask narrative questions extensively, in closing questions
D. The interviewer should ask accusatory questions extensively, in closing questions (1 mark)
7. Which one of the following statements is MOST accurate in regard to a professional fraud investigation interview?
A. The interviewer should be formal and firm
B. The interviewer should record the interview to ensure that he does not forget any important information provided during the interview
C. The interviewer should be informal but firm
D. The interviewer should be formal and friendly (1 mark)
8. Which one of the following BEST describes the method of tracing illicit funds comparing a suspect’s major expenditures, and assets acquired with the suspect’s unknown legitimate sources of funds?
A. Expenditures method
B. Bank deposit analysis method
C. Net worth analysis method
D. Asset method (1 mark)
9. In regard to mechanics of an interview, which one of the following statements is NOT accurate?
A. The interviewer should avoid having a colleague in the interview
B. The interviewer should not record the interviewee without his/her consent
C. The interviewer should document the interview as soon as possible after the interview
D. The interviewer should bring a colleague to the interview to take notes, and make sure the interview captures all important points (1 mark)
10. A professional interview is a structured conversation and not just a question and answer session. Which one of the following is an element of conversation that the interviewer must apply during a structured conversation interview?
A. Sympathetic understanding
B. Recognition
C. Persuasion
D. Rationalisation (1 mark)
11. Which one of the following statements is ACCURATE in regard to seizing a computer for digital forensic investigations?
A. When a forensic investigator is seizing a running computer, he should be concerned about the integrity of the data which might be affected the way the computer is shut down
B. When a forensic investigator is seizing a running computer, he should be concerned about the confidentiality of the data which might be affected the way the computer is shut down
C. When a forensic investigator is seizing a running computer, he should be concerned about the security of the data which might be affected the way the computer is shut down
D. All the above (1 mark)
12. A procurement manager was a suspect of an alleged corruption. During the investigation, the interviewer asked him to explain the sources of the extra funds that could not be accounted for, from the legitimate known sources of his funds. Which one of the following statements is NOT an explanation that the suspect is likely to give?
A. The procurement manager can explain that the extra funds are gifts from his wealthy relatives
B. The procurement manager can explain that the extra funds are from inheritance
C. The procurement manager can explain that the extra funds are from the sale of a family property
D. The procurement manager can explain that the extra funds are an appreciation rewards suppliers and contractors (1 mark)
13. Which one of the following statements is NOT accurate in regard to the investigator’s ability, to accurately observe behavioral clues of an intelligent suspect?
A. It is very hard for an interviewer to accurately observe behavioral clues of an intelligent suspect like an accountant.
B. It is easy for an interviewer to accurately observe behavioral clues of an intelligent suspect like an accountant because he/she would experience a lot of inner tension when caught in their fraudulent activities
C. It is not hard for an interviewer to accurately observe behavioral clues of an intelligent suspect who have experience in engaging in fraudulent activities because they will still experience stress
D. All the above (1 mark)
14. Circumstantial evidence that would yield the best results when the suspect is using his illicit funds to accumulate wealth acquiring assets and therefore causing his net worth to increase is BEST described as which one of the following methods?
A. The expenditures method
B. The assets method
C. Net worth analysis method
D. Asset method (1 mark)
15. Smith is the managing director of InterTech Company. Smith was suspected of engaging in fraudulent financial reporting. During an admission-seeking interview of Smith, the investigator states: “I know the employees’ job security depends on the company’s good performance. I am sure you did this to help the employees retain their jobs, Isn’t that right?” Which one of the following BEST describes the interviewing technique?
A. Sympathetic understanding
B. Altruism appeals
C. Recognition
D. None of the above (1 mark)
16. Which one of the following statements is ACCURATE in regard to limitation of conducting a public database search online?
A. Information from online databases cannot be completely relied on in terms of accuracy and currency
B. Online public records searches are not limited in the area they cover, therefore the fraud examiners do not need to search multiple jurisdictions
C. Online coverage of public records is similar in all jurisdiction
D. None of the above (1 mark)
17. Julie, a Certified Fraud Examiner, is conducting an admission-seeking interview of Joan, a fraud suspect. Julie, asks Joan: “Didn’t you know that taking the organisation’s money without permission is wrong?” Which one of the following BEST describes this type of question?
A. Complex question
B. Alternative question
C. Accusatory question
D. Double negative question (1 mark)
18. Which one of the following statements is ACCURATE in regard to data mining?
A. Data mining is an effective method of collecting digital evidence
B. Data mining is the art of searching large volumes of data for patterns
C. Data mining can be used to modify raw data into understandable patterns
D. Data mining is the science of searching large volumes of data for patterns (1 mark)
19. Which one of the following statements is ACCURATE in regard to the volatility of digital evidence?
A. Digital evidence is not as volatile as tangible evidence because data cannot be altered or destroyed easily like tangible documents
B. Once the integrity of digital evidence has been violated through alteration or destruction, it can be easily restored using special forensic tools
C. Admissibility of digital evidence is more stringent than that of tangible evidence
D. Once the integrity of digital evidence has been violated through alteration or destruction, it cannot be restored using special forensic tools (1 mark)
20. Which one of the following statements is NOT accurate in regard to audit versus investigations or forensic audit?
A. Audits are conducted on a regular basis while forensic audits or fraud investigations are conducted on the basis of sufficient predication
B. Audits are general examination of financial data, while forensic audits and fraud investigations are conducted to resolve specific allegations
C. The objective of a forensic audit or fraud investigation is to affix blame, while the objective of an audit is to express an opinion
D. The presumption of a forensic audit or fraud investigation is proof, to prove the allegations of fraud, while that of an audit is professional skepticism (1 mark)
21. Which one of the following is a data analysis tool that can be effective in conducting money laundering investigations?
A. Link Analysis
B. Benford Law
C. Textual Analysis
D. Link Net Diagram (1 mark)
22. Jeff is planning to a conduct an admission-seeking interview of Jones. After providing introduction, which one of the following BEST describes the first question that Jeff should ask Jones?
A. “Jones, can you please tell me what you know about this matter?”
B. “Jones, who do you think could have embezzled the funds?”
C. “Jones, you took the organization’s money without your employer’s consent, why did you do that?”
D. “Jones, you misappropriated the organisation’s money, why did you do that?” (1 mark)
23. During the analysis phase in digital forensic investigations, which one of the following is the fraud examiner’s greatest concern?
A. To protect the availability of evidence
B. To protect the confidentiality of the evidence
C. To protect the integrity of the data
D. All of the above (1 mark)
24. When conducting interviews, fraud examiners can ask several type of questions depending on what information they need. Fraud examiners would ask accusatory questions during admission seeking interviews. Which one of the following is a good example of an accusatory question?
A. “You are the payables accountant, right?”
B. “Did you take the money because you wanted extra money or you had an emergency?”
C. “Didn’t you know that what you were doing is not right?”
D. “You took the money without permission, why did you do that?” (1 mark)
25. Fraud Examiners should not use double negative questions at all when conducting interviews. Which one of the following is a good example of a double-negative question?
A. “You advanced yourself with the company’s money, why did you do that?”
B. “How many times has this happened?”
C. “Didn’t you know, what you were doing was wrong?”
D. “Did you take the money because you wanted extra money or you had a big problem?” (1 mark)
26. When a fraud examiner is documenting the findings of a fraud investigation, the fraud examiner CANNOT express an opinion on which one of the following areas?
A. Whether the entity’s financial transactions were recorded in accordance with accounting standards
B. The effectiveness of the organisation’s internal controls
C. The responsibility for the suspect in relation to the alleged matters
D. The liability of the suspect in relation to the alleged matters (1 mark)
27. Which one of the following is NOT an objective of conducting textual analytics in fraud investigation?
A. To identify red flags of employees through their communications
B. To reveal patterns, sentiments and red flags of fraud
C. To use unstructured data to identify red flags of fraud
D. To detect any deficiencies in the internal control system (1 mark)
28. Which one of the following statements is NOT accurate in regard to the introductory phase of a forensic audit interview?
A. In a forensic audit interview, it is the responsibility of the interviewer to establish rapport
B. In a forensic audit interview, it is the responsibility of the interviewer to establish the specific purpose of the interview
C. In a forensic audit interview, it is the responsibility of the interviewer to establish the purpose of the interview in general but not the specifics
D. In a forensic audit interview, it is the responsibility of the interviewer to make sure that they get commitment for assistance from the suspect (1 mark)
29. Which one of the following statements is NOT accurate in regard to forensic audits?
A. Every forensic audit should begin with the assumption that the case will end in court
B. Forensic audit is a methodology of resolving fraud issues from inception to disposition
C. A forensic audit should be approached from one perspective, that fraud has occurred and to collect evidence to prove the allegations
D. The conclusion of a forensic audit, should be clear as to whether the suspect committed the offence or not
(1 mark)
30. Fred, is a public officer. He is accused of engaging in bribery in the course of his duty. During an admission-seeking interview of Fred, the investigator states: “This is a big organisation with a lot of resources. The funds you took are not significant and would not affect the finances of the organisation. Is that right?” This interviewing technique is aimed at:
A. Diffusing Alibi and interrupt the suspect’s excuses
B. Reducing the moral seriousness of the suspect’ conduct
C. Making altruistic appeals to the suspect, to get an admission
D. None of the above (1 mark)
31. Purity is a Certified Fraud Examiner. She conducted an admission-seeking interview of Peace a fraud suspect. Purity helps Peace to justify her fraudulent activities establishing a theme that she did not get a promotion that she well deserved and that is why she engaged in the fraudulent activity out of frustration. The suspect refused to accept this theory. How should purity proceed?
A. Ask another question
B. Ask an open-ended question
C. Ask an alternative question
D. Introduce another reason (1 mark)
32. Which one of the following is the BEST method of acquiring digital evidence for investigation purposes?
A. Imaging the hard drive to acquire the data in its original form, that is, date stamps
B. Printing the evidence record
C. Acquiring the digital evidence from the suspect
D. All the above (1 mark)
33. Lorna, a Certified Forensic Fraud Examiner, has obtained an oral admission from James, a fraud suspect. Lorna reduced the confession into a short, concise written statement for James to sign. After James signed the statement, he remembered a significant detail that he should have been included. Which one of the following is a proper way of recording the omitted information?
A. Omit the information
B. Destroy the old statement and write another one to include the information omitted
C. Add another statement to the earlier statement
D. Add the information on the old statement (1 mark)
34. Which one of the following is a common method fraudsters use to conceal illegally acquired assets?
A. Placing assets in probate
B. Selling the assets
C. Transferring assets
D. All the above (1 mark)
35. Kate a Certified Forensic Fraud Examiner, conducted an investigation at XYZ Corp on alleged bribery. During an admission seeking interview of Stacie, an employee at the XYZ Corp, Stacie admits to Kate, that she received a loan from a bank, that was guaranteed and paid off XYZ contractor. Which one of the following pieces of information does Kate need NOT to obtain from the suspect?
A. The approximate date when Stacie received the loan
B. Any items acquired with proceeds of the loan
C. Excuses that she did not know that the loan was a bribe
D. Moral excuses why she received the offer (1 mark)
36. Which one of the following statements is ACCURATE in regard to a well-written fraud investigation report?
A. The report should include technical professional language to demonstrate the investigator’s expertise on the subject matter
B. The report must be partial to ensure emphasis of the evidence to prove the allegations
C. The report should not mention individuals
D. The report must be impartial, based on the facts, whether they prove or disapprove the allegations
(1 mark)
37. Link Analysis is particularly useful when investigating which type of fraud scheme?
A. Bribery
B. Cash Skimming
C. Fraudulent payments to shell companies
D. Embezzlement (1 mark)
38. One of the methods of tracing illicit funds owned a suspect is to develop his financial profile. Which one of the following loan amounts should the investigator use to establish the amount of loan received?
A. Loan proceeds
B. Book loan amount
C. Principal and interest amount
D. Principal loan (1 mark)
39. Which one of the following is, a step in the planning phase of the data analysis process?
A. Normalising and cleansing data
B. Identifying relevant data
C. Verifying data
D. Determining predication (1 mark)
40. It is general knowledge that when fraud suspects decide to confess, they tend to do one of the following, as a way of releasing inner tension of their guilt and dishonest actions. Which one of the following statements is ACCURATE in regard to the information the suspect is likely to give?
A. Provide a lower estimate of the amount of funds defrauded
B. Provide accurate number of incidences
C. Provide exact number of other individuals involved
D. Provide an accurate estimate of the amount of funds defrauded (1 mark)
41. During an admission-seeking interview, Terry accuses a suspect of committing fraud. The suspect denies the accusation. Which one of the following methods should Terry NOT do to interrupt the denials?
A. Reason with the suspect
B. Discuss the inconsistent statements made the suspect
C. Try to reason with the suspect
D. Make an accusatory statement followed an accusatory question (1 mark)
42. An experienced digital forensic expert is aware of where to looking for evidence in the computer. Computer created files are good sources of digital evidence. Which one of the following is NOT one of those computer-generated files?
A. Application logs
B. Events logs
C. System logs
D. Word documents (1 mark)
43. Which one of the following statements is ACCURATE in regard to fraud investigation reports?
A. The conclusion part of the report should include the summary of the evidence
B. The conclusion part of the report should include the recommendations on actions to be taken, based on the evidence collected
C. The recommendation part of the report should include recommendation on the actions to be taken, based on the evidence collected
D. The scope section of the investigation should include all the terms of reference (1 mark)
44. Which one of the following is NOT a step a fraud examiner should consider before starting to conduct a computer investigation?
A. Whether there is a need to notify law enforcement
B. Running through the data to look for evidence
C. If there is need to engage an outside digital forensic expert
D. All the above (1 mark)
45. Which one of the following statements is ACCURATE in regard to volatility of digital evidence?
A. Integrity of digital evidence if violated through manipulation or destruction can be restored using forensic tools
B. Digital evidence is more volatile than tangible evidence because data can be easily altered and destroyed
C. Tangible evidence is more volatile than digital evidence because data cannot be easily altered and destroyed
D. All the above (1 mark)
46. In admission-seeking interviews, when an innocent person is directly accused, they react differently to the initial accusation than a culpable person. Which one of the following is NOT a reaction expected from a culpable person?
A. Weak denials
B. Responding to questions with a question
C. Over respectful
D. Be very angry when directly accused (1 mark)
47. When an examiner is using textual analysis to look for words indicative of fraud, which one of the following words would be indicative of pressure to commit fraud?
A. Deadline
B. Deserve
C. Write off
D. All the above (1 mark)
48. Benford Law can only work with natural numbers to look for patterns indicative of fraud. Which one of the following is an example of natural number?
A. Telephone numbers
B. Vendors invoice numbers
C. Sales invoice numbers
D. All the above (1 mark)
49. Textual analytics can identify which one of the following words as indicative of rationalisation to commit fraud.
A. Override
B. Write off
C. Entitled
D. All the above (1 mark)
50. Vincent is an accountant at ABC Corp. He is a fraud suspect, and is scheduled for an admission-seeking interview. He arrived at the interview with his manager and insisted that he wants the manager be present in the interview. What should the interviewer do under the circumstances?
A. The interviewer should not conduct the interview
B. The interviewer should conduct the interview
C. The interviewer should not allow the manager into the interview
D. The interviewer should allow the manager into the interview (1 mark)
51. Which one of the following, is a type of question that should be used extensively in information gathering interviews?
A. Narrative questions
B. Alternative questions
C. Open ended questions
D. Closed question (1 mark)
52. Which one of the following is an appropriate moral excuse to include in a signed admission?
A. “I did not mean to do it.”
B. “I didn’t do it.”
C. “I didn’t mean to cause any inconveniences.”
D. “I didn’t know it was wrong.” (1 mark)
53. Which one of the following is ACCURATE in regard to digital forensic investigations?
A. During the analysis phase in digital forensic investigations, the fraud examiner should look for inculpatory evidence only
B. During the analysis phase in digital forensic investigations, the fraud examiner should look for exculpatory evidence only
C. During the analysis phase in digital forensic investigations, the fraud examiner’s primary concern is to protect the confidentiality of the digital evidence
D. None of the above (1 mark)
54. Which one of the following is NOT a characteristic of a financial vehicle that a fraudster would be looking for to conceal assets?
A. Accessibility
B. Security
C. Liquidity
D. Transparency (1 mark)
55. Which one of the following BEST describe letter rogatory?
A. A letter in which a judge in one country orders the government in another country to release a defendant from jail
B. A formal request the government of a country seeking information from a defendant residing in another country
C. A formal request the courts of one country seeking judicial assistance from the courts of another country
D. A letter wherea criminal defendant requests that the government release exculpatory information
(1 mark)
56. Luke, a Certified Forensic Fraud Examiner, is conducting an admission-seeking interview of Rogers, a fraud suspect. Luke asked Rogers: “Did you just want extra money or did you do this because you had an emergency?” Which one of the following BEST describe this type of question?
A. Accusatory question
B. Narrative question
C. Double negative question
D. Alternative question (1 mark)
57. In taking a verbal confession, which one of the following items of information should the interviewer NOT obtain?
A. The accused’s motive for the offence
B. Estimates of the number of instances, dates and amounts involved
C. That the accused did not know that the conduct was wrong
D. All of the above (1 mark)
58. Which one of the following is NOT a challenge of cloud forensics not faced in traditional forensic practices?
A. Lack of frameworks and specialist tools
B. Accessibility of information
C. Lack of data control
D. None of the above (1 mark)
59. Maureen, is conducting a fraud examination of Smith, an employee at his organisation, a government entity. Maureen has a strong reason to believe that Smith has incriminating evidence on his personal smart phone that he brings to work. Which one of the following statements is ACCURATE?
A. Maureen may search Smith’s phone, if his organisation has a search policy and employees are aware that personal smart phones are subject to search
B. Maureen may search of Smith’s smart phone because Smith’s privacy rights do not attach to the contents of smart phones
C. Smith has a right to privacy for information on his personal smart phone and Maureen must obtain a search warrant to search the device
D. Generally, employees have no expectation of privacy for information on personal devices they bring to work, so Maureen may search the phone (1 mark)
60. Which one of the following is NOT accurate in regard to the types of information that computer forensics experts typically can recover from computer systems?
A. Computer forensics specialists can recover time and date information about files
B. Computer forensics specialists can recover deleted documents
C. Computer forensics specialists can recover information about websites visited
D. Computer forensics specialists can recover overwritten documents (1 mark)
61. A fraud examiner is conducting textual analytics on journal entry data and runs a keyword search using the terms like override and provision. These words are indicative of which one of the following fraud risks?
A. Pressure
B. Capability
C. Opportunity
D. Rationalisation (1 mark)
62. Which one of the following is NOT an example of a data analysis function that can be performed to detect fraud through an examination of the general ledger?
A. Create disbursement per vendor reports
B. Analyse and confirm specific ledger accounts for legitimate transaction activity
C. Calculate financial ratios
D. Calculate budget and actual variances (1 mark)
63. Which one of the following BEST describes the limitation of Benford Law?
A. Benford Law can only be applied to data sets listed in currency amounts
B. Benford Law applies best to data sets with four digit numbers
C. Benford Law cannot be applied to data sets with non-natural numbers, such as checks or telephone numbers
D. Benford Law only works on data sets with assigned numbers, such as bank account or telephone numbers (1 mark)
64. ABC is a real estate company. The director notice that the paint expenses have increased drastically from the previous year. The company had much less business during the year. Which one of the following data analysis functions would be most useful in helping the director determine if cost of the paint is proportionate to the houses painted?
A. Link analysis
B. Data Analysis
C. Correlation analysis
D. Compliance verification (1 mark)
65. Text-based data can be BEST categorised as .
A. Structured data
B. Unstructured data
C. Documentary data
D. Natural data (1 mark)
66. Which one of the following steps is included in the preparation phase of the data analysis process?
A. Determining examination objectives
B. Verifying data
C. Determining whether predication exists
D. All the above (1 mark)
67. Which one of the following is NOT a best practice of dealing with a volatile witness during an interview?
A. Make it difficult for the witness to say “no”
B. Make it difficult for the witness to say “yes”
C. Disarm the witness agreeing with his/her points where possible
D. Avoid reacting to the witness hostile behavior (1 mark)
68. Which one of the following BEST describes the inhibitor to communication where the respondent is unable to generalise a concrete experience?
A. Inferential confusion
B. Deduction confusion
C. Repression confusion
D. Trauma confusion (1 mark)
69. Which one of the following is NOT an appropriate time to ask admission-seeking questions?
A. When the interviewer believes there is a reasonable possibility that the suspect committed the offence
B. When all investigative steps and sources have not been exhausted
C. When the time, place and subject matter discussed can be controlled the suspect
D. All the above (1 mark)
70. Which one of the following is a mistake, that an investigator should avoid in report writing?
A. Being wordy and vague
B. Being impartial
C. Ensuring accuracy
D. Avoid being prejudicial (1 mark)
71. Which one of the following statements is NOT accurate, in regard to Link Analysis?
A. Link analysis can be presented in court as additional evidence to put more weight to the existing evidence
B. Link analysis can be presented in court as demonstrative evidence
C. Link analysis cannot be presented in court as real evidence
D. Link analysis cannot be presented in court as direct evidence (1 mark)
72. Which one of the following steps is, NOT included in the planning phase of the data analysis process?
A. Building a profile of potential frauds
B. Establishing predication
C. Obtaining data
D. Understanding the data (1 mark)
73. Once a suspect has confessed in an interview, it is important to get copies of as much physical evidence as possible. For example, bank records are important. Which one of the following is a recommended method for obtaining bank records after a confession?
A. Obtain an oral authorisation for the release of the bank records
B. Request the subject to bring the bank records to the investigator’s office
C. Obtain a written authorisation from the suspect, to obtain the bank records
D. None of the above (1 mark)
74. In most jurisdictions, all the following sources of information can be available for developing background information for pre-employment purposes, EXCEPT .
A. Criminal court records searches
B. Bankruptcy records searches
C. Tax records
D. None of the above (1 mark)
75. Aggie, a Certified Fraud Examiner, is conducting an admission-seeking interview. Which one of the following is
NOT a best practice for obtaining an admission?
A. Avoid condemnation while conducting the interview of the suspect
B. Maximise sympathy and avoid condemnation
C. Conducting the interview in a firm manner, and not showing compassion, because the interviewer may loss objectivity
D. Conduct the interview in a firm but showing compassion (1 mark)
76. Organising the amount of paper generated during an investigation is one of the biggest tasks in fraud cases. Which one of the following is generally NOT a recommended practice when organising evidence?
A. Segregating documents transaction
B. Filing all the documents chronologically
C. Filling the documents per event or transaction
D. None of the above (1 mark)
77. At what point should a fraud examiner, submit a fraud case for prosecution?
A. After all investigative steps have been exhausted and collected evidence that can be used in a court of law
B. Immediately after obtaining an oral confession from the suspect
C. After the fraud examiner has finished collecting documentary evidence
D. None of the above (1 mark)
78. When a Certified Fraud Examiner is conducting interview of a suspect, in the course of the interview, the suspect becomes uncomfortable with the sensitive nature of the questions. Which one of the following BEST describes what the interviewer should do under the circumstances?
A. Ask double positive questions
B. Stop asking sensitive question for the time being, but return the sensitive questions later
C. Ask alternative questions
D. Stop asking accusatory questions altogether (1 mark)
79. Which one of the following is ACCURATE in regard to closed questions?”
A. They are worded in a way that makes it difficult for the respondent to answer “yes” or “no”
B. They are worded in a way that the witness will confirm already known facts
C. They are worded in a way that the witness will be provide more information
D. They are worded in a way that the witness will be willing to be interviewed again in future (1 mark)
80. The terms induction and deduction are most often associated with which inhibitor to communication?
A. Chronological confusion
B. Inferential confusion
C. Trauma confusion
D. None of the above (1 mark)
81. In interviews, introductory questions are designed to meet which of the following objectives?
A. To establish the veracity of the witness, before proceeding with the interview
B. To establish the credibility of the witness, before proceeding with the interview
C. To establish that that interviewer needs help and the interviewer believes that the witness is able to assist
D. All of the above (1 mark)
82. Join is a data analysis function that can be useful in conducting which of the following data analysis?
A. Joining a primary file with the suspect file
B. Looking for gaps in the secondary file
C. Looking for gaps in the primary file
D. Looking for gaps in the subject file (1 mark)
83. Edward, calls Dorine’s bank claiming to be Dorine, with the intention of stealing Dorine’s identity. Edward, tells the bank representative that he needs to make sure that the bank has the correct government identification number on her account, because he had noticed a mistake on her statement. Which one of the following is an example of the attempted offence Edward?
A. Accounts takeover
B. Embezzlement
C. Identity theft
D. None of the above (1 mark)
84. When planning for an interview, which one of the following statements in regard to interviews is NOT accurate?
A. The interviewer should establish the objective of the interview
B. The interviewer should ensure that he is able to control the interview
C. The interviewer should prepare a list of questions, to ensure smooth running of the interview
D. The interviewer should be informal (1 mark)
85. Which one of the following is NOT accurate in regard to Meta Data?
A. Metadata information can help determine who edited the document
B. Metadata information can help determine when a document was created
C. Metadata is a user created file which can be a good source of digital evidence
D. Metadata is a computer-generated file which can be a good source of digital evidence (1 mark)
86. Which one of the following is ACCURATE in regard to mutual legal assistance (MLA)?
A. A formal request the government of a country seeking information from a defendant residing in another country
B. Mutual legal assistance can only be requested for criminal trials
C. Mutual legal assistance is a legal requirement for countries that have entered into the mutual legal assistance, therefore legal assistance must be granted
D. None of the above (1 mark)
87. Which one of the following is a method of using software to search for key words from unstructured data?
A. Imaging the data
B. Data analytics
C. Textual analytics
D. Data mining (1 mark)
88. Which one of the following witness should be interviewed second last?
A. A person with information of the alleged offence, but is not a beneficiary of the offence.
B. A person who is directly or indirectly involved in the offence
C. A person who has more detailed information about the alleged offence and is not a beneficiary of the offence
D. The main subject of the alleged offence (1 mark)
89. Which one of the following is ACCURATE in regard to closing questions in an interview?
A. The purpose of closing questions is to observe any deceptive clues, before the closing of the interview
B. The purpose of closing questions is to ensure that the interviewer captured all the points correctly
C. Closing questions are type of closed questions
D. All the above (1 mark)
90. Which one of the following is NOT a recommended procedure for protecting a corruption investigation’s case information?
A. Store all confidential documents in locked file cabinets or rooms.
B. Avoid discussing about the investigation in public or in any place where other employees could hear the communications
C. Use of email or other electronic means to transmit confidential case information
D. Avoid sharing investigation results with the subjects (1 mark)
91. Which one of the following is ACCURATE in regard to closing questions?”
A. They are worded in a way that makes it difficult for the respondent to answer “yes” or “no”
B. They are worded in a way that, the witness can only answer “yes” or “no”
C. They are worded in a way that makes it difficult for the respondent to answer “yes”
D. They are worded in a way that makes it difficult for the respondent to answer “no” (1 mark)
92. Which one of the following witness should be interviewed last?
A. A person with information of the alleged offence, but is not a beneficiary of the offence.
B. A person who is directly or indirectly involved in the offence
C. A person who has more detailed information about the alleged offence and is not a beneficiary of the offence
D. The main subject of the alleged offence (1 mark)
93. Which one of the following describes the function of using software to join two files with same information, to look for exceptional, in the subject file?
A. Multi-file processing function
B. Data analysis
C. Textual analytics
D. None of the above (1 mark)
94. Which one of the following statements in regard to court records is ACCURATE?
A. There are multiple databases that contain a comprehensive database of court documents from all court cases in every country
B. In most countries, court records are not public records and require judicial authorization to access
C. When searching for records for a particular court case, a fraud examiner need only to search the central/federal court records as they serve as a repository for all cases heard at all court levels
D. In most countries, reliable court records are best obtained from the court where the case was heard or filed
(1 mark)
95. Which one of the following is a social physiological force that facilitates communication and makes the interviewee identify with, a higher value beyond immediate self-interest is referred to as .
A. Rationalisation
B. Sympathetic understanding
C. Altruism appeals
D. Recognition (1 mark)
96. Which one of the following is method of tracing illicit funds comparing bank deposits with the suspect’s known legitimate income?
A. Expenditures method
B. Net worth analysis method
C. Asset method
D. None of the above (1 mark)
97. Which one of the following is NOT a recommended mechanic of interviewing?
A. The interviewer should avoid recording the interview to ensure the success of the interview
B. The interviewer should record the interview, to ensure the success of the interview
C. The interviewer should accord the interviewee privacy
D. The interviewer should conduct one on one interview, to ensure the success of the interview (1 mark)
98. Which one of the following is NOT an element of conversation, that keeps communication ongoing for a good length of time and enable the interviewer to elicit sufficient information?
A. Therapy
B. Expression of ideas and moods
C. Information exchange
D. Fulfilling expectations (1 mark)
99. Which one of the following statements is ACCURATE seizing computers for investigation?
A. When a forensic investigator is seizing a running computer for examination, he should not retrieve data from the computer, regardless of the circumstances
B. When a forensic investigator is seizing a running computer, he should use the normal shut down process to protect the integrity of the data
C. When a forensic investigator is seizing a running computer, he should use the hard shut down process to protect the integrity of the data
D. None of the above (1 mark)
100. James, a Certified Fraud Examiner, is conducting an admission-seeking interview of Jean. Which one of the following statements is ACCURATE in regard to response to an alternative question?
A. Jean is likely to make a benchmark admission in response to an alternative question
B. Jean is unlikely to make a benchmark admission in response to an alternative question
C. Jean is unlikely to respond to the question that has reduced the moral seriousness
D. None of the above (1 mark)
………………………………………………………………………………….