CERTIFIED FORENSIC FRAUD EXAMINER (CFFE) MODULE TWO
PLANNING AND CONDUCTING FORMAL INVESTIGATIONS
THURSDAY: 21 August 2025. Morning Paper. Time Allowed: 3 hours.
Answer ALL questions. This paper has two sections. SECTION I consists of fifty (50) Multiple Choice Questions carrying fifty (50) marks. SECTION II has four (4) structured questions carrying (50) marks. Marks allocated to each question are indicated at the end of the question.
SECTION I (50 MARKS)
1. Which one of the following statements is NOT ACCURATE in regard to handling a potential interviewee’s resistance?
A. Emphasise that his assistance is needed
B. Explain that the interview will not be difficult
C. Explain that the interview will not be too long
D. Insist that that the interview must be conducted because it is very important (1 mark)
2. Which one of the following statements in regard to recording interviews is MOST ACCURATE?
A. There is no jurisdiction that prohibit the electronic recording of employee interviews.
B. Fraud examiners are always permitted to record interviews undercover
C. Fraud examiners should document all the individual interview recordings
D. Electronic recording can inhibit effective flow of communication (1 mark)
3. Which one of the following statements is ACCURATE in regard to obtaining additional information at the close of an interview? Interviewer should ask .
A. open questions at the closing of the interview
B. closed questions at the closing of the interview
C. leading questions at the closing of the interview
D. alternative questions (1 mark)
4. Which one of the following statements is NOT accurate in regard to evaluating witness’s deception during an interview?
A. The interviewer should not accuse the witness of deception even when it is obvious that they are lying
B. An interviewer can draw a conclusion from a single obvious sign of deception
C. An interviewer should not draw a conclusion from a single behavior even if it is obvious that they are lying
D. An interviewer should not document an interview of a deceitful witness (1 mark)
5. In an interview, helps to establish good interpersonal relationship that enhance sense of security.
A. demonstrating interest
B. maintaining good attitude
C. rapport
D. being impartial (1 mark)
6. Which one of the following questions should be asked extensively during information gathering phase of an interviewer?
A. Closed questions designed to give a specific answer
B. Leading questions that aim to get a positive response
C. Assessment questions aimed at evaluating the interviewee’s response
D. None of the above (1 mark)
7. Which one of the following statements is ACCURATE in regard to questions in a fraud investigation interview? Interviewer should .
A. not ask sensitive questions because it demonstrate bad attitude
B. ask soft questions throughout the interview to avoid condemnation
C. not ask direct accusatory question to avoid condemnation
D. not ask open questions during an admission seeking interview until they obtain an admission (1 mark)
8. Which one of the following statements is ACCURATE in regard to planning an interview?
A. Obtain sufficient evidence to establish a subject’s culpability before conducting an interview
B. Gather all available evidentiary documents and bring them to the interview
C. Obtain enough information to establish a subject’s involvement before conducting an interview
D. Select unfamiliar and uncomfortable venue to demonstrate seriousness of the interview (1 mark)
9. Which one of the following conditions does NOT affect the behavioral clues that might show signs of deception?
A. Mental illness
B. Drugs and alcohol
C. Cultural differences
D. Interviewee’s intelligence (1 mark)
10. In interview situations, questions consist of unrelated matters and should be avoided in interviews.
A. complex
B. closed
C. alternative questions
D. double negative questions (1 mark)
11. The objective of introductory questions in a fraud investigation is to establish .
A. the detailed purpose of the interview
B. the general purpose of the interview
C. credibility of the interviewee
D. the specific purpose of the interview (1 mark)
12. Which one of the following statements is NOT a responsibility for forensic auditor or a fraud examiner in fraud examination or forensic audit?
A. Testifying in court
B. Assisting in the detection and prevention of fraud
C. Assisting the organisation in responding to evidence of fraud
D. Report writing (1 mark)
13. Almond Jonson, a fraud examiner collects a computer hard drive as potential evidence in an investigation. He creates a record to memorise the chain of custody. Which one of the following items is not a standard requirement of chain of custody?
A. Documenting the value of the item
B. Where the item is maintained
C. When the item was received
D. From whom the item was received (1 mark)
14. The following are primary types of evidence that forensic auditors may collect when conducting a forensic audit,
EXCEPT .
A. testimonial evidence
B. documentary evidence
C. digital evidence
D. inculpatory evidence (1 mark)
15. The first process of fraud investigation involves .
A. developing a fraud theory
B. establishing predication
C. assembling investigation team
D. developing a response plan (1 mark)
16. Which one of the following statements is NOT accurate in regard to how management generally should respond to discovery of fraudulent activity?
A. Conduct an assessment
B. Preserve relevant documents
C. Conduct an investigation
D. Identify who should be notified (1 mark)
17. The LEAST effective method of obtaining consent to examine a suspect’s bank records is to obtain .
A. a court order
B. the suspect’s consent
C. the suspects’ written consent
D. a search warrant (1 mark)
18. Which one of the following defenses would BEST support a law enforcement officer against an allegation of entrapment?
A. The officer acted on the basis of suspicion of fraud
B. The officer acted on the basis of a reliable information
C. The officer acted on the basis of routine procedure
D. The officer action was not on malice (1 mark
19. The following statements are accurate in regard to an admission seeking interview, EXCEPT, the interviewer should .
A. be informal
B. be firm
C. avoid repression threat
D. be very sympathetic and avoid condemnation (1 mark)
20. Which one of the following statements is NOT accurate in regard to writing of forensic audit reports? The forensic auditor should .
A. not affix blame and presume the suspect is innocent until proven guilty
B. affix blame as they still presume innocence until proven guilty
C. conclude that suspect committed the offence if the facts can support the conclusion
D. not express an opinion of guilt or innocence (1 mark)
21. Which one of the following statements is ACCURATE in regard to a loan as a source of funds of a suspect? Investigator should include .
A. loan disbursement amount as a source of funds
B. loan ledger amount as a source of funds
C. the principal loan proceeds as a source of funds
D. loan application amount as a source of funds (1 mark)
22. Which one of the following activities describes the phases associated with obtaining data for analysis?
A. Preparation phase
B. Planning phase
C. Testing and analysis
D. Response phase (1 mark)
23. The following are psychological forces of communication, EXCEPT .
A. Competing demand for time
B. Expression
C. Fulfilling expectation
D. Persuasion (1 mark)
24. Which one of the following statements is NOT a method of diffusing alibis?
A. Responding to the suspects questions
B. Showing the suspect incriminating evidence
C. Discussing other witnesses
D. None of the above (1 mark)
25. Which one of the following digital components can be a good source of digital evidence?
A. Databases
B. Events logs
C. Hardrive
D. Word documents (1 mark)
26. Which one of the following statements is ACCURATE in regard to the recommendation section of an investigation report? The recommendation section should include .
A. the summary of the evidence
B. advise on actions to be taken based on the evidence collected
C. other areas that require further investigation
D. what legal action should be taken (1 mark)
27. Which one of the following statements is ACCURATE in regard to preparing a machine for analysis? A fraud examiner .
A. should not collect evidence from a running machine but rather do a hard shut down
B. cannot collect evidence of temporary files directly from a running machine
C. should do graceful shut down of temporary files that might be sources of evidence
D. should always do graceful shut of the computer to protect the integrity of the data (1 mark)
28. Which one of the following statements BEST describe the methods of interrupting denials?
A. Warning the suspects about the deception
B. Reasoning with the suspect
C. Trying to reason with the suspect
D. Asking an alternative question (1 mark)
29. Which one of the following analytics methods is used to look for words that are indicative of rationalisation to commit fraud?
A. Vertical analysis
B. Benford analysis
C. Horizontal analysis
D. None of the above (1 mark)
30. Which one of the following numbers is an example of natural numbers?
A. Telephone numbers
B. Customers bank deposit amounts
C. Sales invoice numbers
D. Bank account numbers (1 mark)
31. Which one of the following statements is ACCURATE in regard to conducting an interview in the presence of a third party? The interviewer should .
A. not conduct the interview in the presence of a third party
B. conduct the interview only with presence of a colleague
C. not allow an interviewee’s representative in the interview
D. not conduct the interview in the presence of a third party under any circumstances (1 mark)
32. Which one of the following statements BEST describe why an interviewer should ask a question where the answer can either be yes or no?
A. To confirm already known facts
B. To confirm specific facts
C. To stimulate a conversation
D. To control the desired answer (1 mark)
33. Which one of the following statements is ACCURATE in regard to fraud issues and fraud allegations?
A. Fraud allegations are predications that fraud has occurred
B. Fraud issues are the facts in issue being investigated
C. Fraud allegations and issues are the facts in issue being investigated
D. Fraud issues involve discovery of evidence and fraud evidence collected (1 mark)
34. Which one of the following statements is ACCURATE in regard to the methodology of forensic audit? Forensic audit is a methodology of resolving fraud .
A. allegations from inception to disposition
B. issues from inception to disposition
C. allegations from inception
D. evidence from inception to disposition (1 mark)
35. Which one of the following statements is ACCURATE in regard to how management should respond to evidence of fraud?
A. Ask the investigator’s opinion on what action should be taken
B. Preserve relevant documents
C. Identify who should be informed
D. Respond in accordance with the fraud response plan policy (1 mark)
36. Which one of the following statements is ACCURATE in regard to forensic audits and fraud examination?
A. The objective of forensic audit and fraud examination in not the same
B. Forensic audit is a special audit conducted to determine if fraud has occurred
C. One of the functions of a forensic audit is to establish compliance with organisation’s policies
D. The objective of forensic audit and fraud examination is collect evidence to prove or disapprove an allegation (1 mark)
37. Which one of the following types of evidence describes a written statement provided an expert witness?
A. Testimonial evidence
B. Exhibit evidence
C. Expert opinion
D. circumstantial evidence (1 mark)
38. Which one of the following statements is ACCURATE in regard to forensic audits engagements?
A. A forensic audit should be conducted only on the basis of any suspicion
B. The objective of a forensic audit is only one, to collect evidence to prove or disapprove the alleged offence
C. A forensic audit has several objectives based on the terms of reference
D. The objective of a forensic audit is to collect evidence to prove an allegation of fraud (1 mark)
39. Which one of the following statements is ACCURATE in regard to objective of forensic audit and forensic accounting?
A. The objective of all forensic audits is to collect evidence that can be used in a court of law
B. The objective of all forensic accounting is to collect evidence that can be used in a court of law
C. The objective of all forensic audits is to collect evidence to prove that an offence was committed
D. The objective of all forensic accounting is to collect evidence that can be used to express an opinion
(1 mark)
40. The following engagement objectives is used to collect evidence to prove or disapprove an allegation, EXCEPT
.
A. Forensic fraud audit
B. Special audit
C. Fraud examination
D. Fraud investigation (1 mark)
41. Which one of the following statements is NOT functions of forensic accounting for court purposes?
A. Assisting in fraud prevention
B. Testifying in court as an expert witness
C. Collecting evidence to prove an alleged accounting related fraud
D. Collecting evidence to prove or disapprove an alleged accounting related fraud (1 mark)
42. Which one of the following statements is INCORRECT with regard to forensic accountants?
A. Do not need to have good knowledge of laws related to fraud but rather good knowledge of company law
B. Must have good knowledge of anti- fraud controls
C. Have good investigation reporting skills
D. Must have good interviewing skills (1 mark)
43. Which one of the following audits BEST describes the assignment an organisation should conduct after determining that fraud has occurred?
A. Fraud audit
B. Forensic audit
C. Special audit
D. Surprise audit (1 mark)
44. An appropriate assignment that should be conducted a major potential investor is known as .
A. forensic accounting
B. forensic audit
C. external audit
D. financial accounting (1 mark)
45. Which one of the following assessments BEST describes the assignment an organisation should conduct after identifying red flags of fraud?
A. Fraud audit
B. Forensic audit
C. Special audit
D. Internal controls review (1 mark)
46. Which one of the following tasks BEST describes an assignment an organisation should conduct on area evaluated as a high fraud risk?
A. Fraud audit
B. Forensic audit
C. Special audit
D. Process review (1 mark)
47. The following are functions of a forensic audit, EXCEPT .
A. resolving fraud issues
B. resolving fraud allegations
C. documenting findings
D. litigation support (1 mark)
48. Which one of the following techniques should an interviewer NOT apply when trying to obtain an admission?
A. Give the suspect a justification for their misconduct
B. Directly accuse the suspect for fraud
C. Directly accusing the suspect of engaging in an illegal offence
D. Directly accusing the suspect of engaging in an immoral behaviour (1 mark)
49. Which one of the following statements is NOT ACCURATE in regard to integrity of digital evidence?
A. Digital evidence can be altered or destroyed more easily than tangible information
B. If integrity of digital evidence has been violated, it can be restored with digital forensic tools
C. If integrity of digital evidence has been violated it cannot be restored with digital forensic tools
D. Digital evidence must be properly authenticated to conform the integrity of the evidence (1 mark)
50. Which one of the following search strings will yield the BEST result using a basic search engine to search for mortgage fraud?
A. Mortgage–fraud
B. “Mortgage fraud”
C. *Mortgage fraud
D. Mortgage OR fraud (1 mark)
SECTION II (50 MARKS)
51. Explain the following in regard to forensic audit/fraud examination:
(a) FIVE objectives of a forensic audit/fraud examination engagement. (5 marks)
(b) FIVE functions of a forensic audit/fraud examination. (5 marks)
(c) Forensic audit engagement. (5 marks)
(d) FIVE differences between a forensic audit report and an expert witness report/statement. (5 marks)
(Total: 20 marks)
52. Explain the following admission seeking interview techniques:
(a) How to distinguish an innocent and a guilty person in an admission seeking interview. (5 marks)
(b) How to reason with a suspect during admission seeking interview. (5 marks)
(c) How to avoid trying to reason with a suspect during an admission seeking interview. (5 marks)
(Total: 15 marks)
53. (a) Explain THREE social psychological barriers of communication that must be avoided in interviews.
(6 marks)
(b) Explain TWO social psychological forces of communication that need to be applied in interviews.
(4 marks)
(Total: 10 marks)
54. Identify FIVE characteristics of a suspect’s signs of deception during an admission seeking interview.
(Total: 5 marks)
……………………………………………………………………..