CERTIFIED FORENSIC FRAUD EXAMINER (CFFE)
MODULE TWO
PLANNING AND CONDUCTING FORMAL INVESTIGATIONS
THURSDAY: 5 December 2024. Morning Paper. Time Allowed: 3 hours.
This paper consists of one hundred (100) Multiple Choice Questions. Answer ALL questions indicating the letter (A, B, C or D) that represents the correct answer. Each question is allocated one (1) mark.
1. Which one of the following statements is NOT accurate in regard to fraud investigations report writing standards?
A. The report must be free of material inaccuracies
B. The report must be free of any inaccuracies
C. The investigator must know that defence side will discover the report and make note of any inaccuracies
D. Immaterial inaccuracies would affect the credibility of the investigation report (1 mark)
2. Which one of the following statement is NOT accurate in regard to forensic audit and fraud investigations assignments?
A. Forensic audit and fraud investigations are the same because, the purpose of both assignments is to collect evidence to prove or disapprove an allegation
B. The terms forensic audit and fraud investigations can be used inter-changeably because the objectives of the assignments are the same
C. Forensic audit is a type of a specialised audit conducted to collect more information and details, while fraud investigations are conducted to collect evidence that can be used in a court of law
D. An auditor cannot conduct a good fraud forensic audit without a formal training and experience in fraud investigation (1 mark)
3. Which one of the following statements is NOT accurate in regard to fraud and corruption professional interviews?
A. Most of the fraud and corrupt activities are off the book, therefore the investigator must have good interpersonal skill to elicit information
B. In most fraud and corruption cases information and evidence is not in the books, so the investigator has to get the information from witnesses
C. In fraud and corruption cases the investigator may have to get exhibits from the suspect
D. Professional interviewing is a question answer session (1 mark)
4. Which one of the following statements is ACCURATE in regard to response to double negative questions?
A. The response to a double-negative question usually is, “I did not know”
B. The response to a double-negative question is usually, “I had an emergency”
C. A double-negative question is usually effective in obtaining a benchmark admission
D. The response to a double-negative question is usually, “do you have evidence” (1 mark)
5. The background section of a forensic audit report should include .
A. all the purposes of the forensic audit
B. the main objective of the audit, which is to prove or disapprove the allegations
C. a summary of the findings of the forensic audit
D. the scope of the audit (1 mark)
6. Which one of the following statements is ACCURATE in regard to closing questions?
A. The interviewer should ask closed questions more in closing questions
B. The interviewer should ask open-ended questions extensively in closing questions
C. The interviewer should ask narrative questions extensively in closing questions
D. The interviewer should ask accusatory questions in closing questions (1 mark)
7. Which one of the following statements is NOT accurate in regard to the characteristics of a professional interviewer in fraud investigations?
A. The interviewer should be formal but firm
B. The interviewer should be a good listener
C. The interviewer should be compassionate
D. The interviewer should display good attitude (1 mark)
8. Which one of the following techniques is an effective method of tracing illicit funds comparing a suspect’s major expenditures and assets acquired with the suspect’s unknown sources of funds?
A. Expenditures method
B. Bank deposit analysis method
C. Net worth analysis method
D. Asset method (1 mark)
9. Which one of the following statements is NOT accurate in regard to mechanics of a professional interview?
A. The Interviewer should avoid having a colleague in the interview
B. The interviewer should not record the interviewee without his/her consent
C. The interviewer should document the interview as soon as possible after the interview
D. The Interviewer should bring an assistant to the interview to take notes (1 mark)
10. Which one of the following actions is an element of conversation that the makes the interview a structured conversation?
A. Persuasion
B. Recognition
C. Information exchange
D. Rationalisation (1 mark)
11. Which of the following statements is ACCURATE to the main concern of digital forensic investigations?
A. When a forensic investigator is seizing a running computer, he should be concerned about the integrity
B. When a forensic investigator is seizing a running computer, he should be concerned about the confidentiality of the data
C. When a forensic investigator is seizing a running computer, he should be concerned about the security of the data
D. When a forensic investigator is seizing a running computer, he should be concerned about the availability of the data (1 mark)
12. Which one of the following statements is NOT accurate in regard to a suspect’s response when confronted with questions about unexplained income?
A. The extra funds are gifts from his wealthy relatives
B. The extra funds are from inheritance
C. The extra funds are from the sale of a property
D. The extra funds are gifts from suppliers and contractors (1 mark)
13. Which one of the following statements is NOT accurate in regard to ability to observe behavioral clues of professional suspect?
A. It is very hard for an interviewer to accurately observe behavioral clues of an intelligent suspect like a finance officer
B. It is easy for an interviewer to accurately observe behavioral clues of an intelligent suspect like an accountant because he/she would experience a lot of inner tension when caught in their fraudulent activities
C. It is not hard for an interviewer to accurately, observe behavioral clues of an intelligent suspect who have experience in engaging in fraudulent activities, because they will still experience stress
D. The ability to observe behavioral clues of an intelligent and non-intelligent individuals is not the same
(1 mark)
14. Which one of the following methods is NOT used in tracing illicit funds indirectly?
A. The expenditures method
B. The Assets method
C. Net worth analysis method
D. Analysis of books and records (1 mark)
15. Which one of the following BEST describes the interviewing technique of making the suspect feel they did not act with selfish motives?
A. Sympathetic understanding
B. Altruism appeals
C. Recognition
D. Interrogation (1 mark)
16. Which one of the following statements is ACCURATE in relation to public database search online?
A. Information from online databases cannot be completely relied on in terms of accuracy and currency
B. Online public records searches are not limited in the area they cover therefore, the fraud examiners do not need to search multiple jurisdictions
C. Online coverage of public records is similar in all jurisdiction
D. None of the above (1 mark)
17. The following questions should be used on suspects, EXCEPT .
A. leading questions
B. alternative question
C. accusatory question
D. double negative question (1 mark)
18. Which one of the following terms describes the science of searching large volumes of data for patterns?
A. Data mining
B. Data analysis
C. Data classification
D. Data management (1 mark)
19. Which one of the following statements is ACCURATE in regard to digital evidence?
A. Digital evidence is not as volatile as tangible evidence because data cannot be altered or destroyed easily like tangible documents
B. Once the integrity of digital evidence has been violated through alteration or destruction, it can be easily restored using special forensic tools
C. Admissibility of digital evidence is more stringent than that of tangible evidence
D. Once the integrity of digital evidence has been violated through alteration or destruction, it cannot be restored using special forensic tools (1 mark)
20. Which one of the following statements is NOT accurate in regard to audit and forensic audit?
A. Audits are recurring
B. Audits are general examination of financial data
C. The objective of a forensic audit or fraud investigation is to affix blame
D. The presumption of a forensic audit is to establish the guilt of the suspect (1 mark)
21. Which one of the following is a data analysis tool that be effective in creating visual aid of complex transactions?
A. Link Analysis
B. Benford Law
C. Textual Analysis
D. Link Net Diagram (1 mark)
22. Which one of the following BEST describes the first type of question to be asked in the introductory phase of suspect?
A. Ritualistic questions
B. Open questions
C. Accusatory questions
D. Leading questions (1 mark)
23. Which one of the following statements is MOST accurate in regard to data analysis?
A. To protect the availability of evidence
B. To protect the confidentiality of the evidence
C. To protect the integrity of the data
D. To protect data against modification (1 mark)
24. Which one of the following questions is a good example of a closed question?
A. “You are the payroll accountant, is that right?”
B. Did you take the money because you wanted extra money or you had an emergency?
C. Didn’t you know that what you were doing is not right?
D. You took the money without permission, why did you do that? (1 mark)
25. Which one of the following statements is an example of a leading question?
A. “You advanced yourself with the company’s money, why did you do that?”
B. Did you detect misappropriation of funds scheme?
C. Didn’t you know what you were doing was wrong?
D. Did you take the money because you wanted extra money or you had big problem? (1 mark)
26. A fraud examiner CANNOT express an opinion on .
A. whether the entity’s financial transactions were recorded in accordance with accounting standards
B. the effectiveness of the organisation’s internal controls
C. the responsibility for the suspect in relation to the alleged matters
D. the liability of the suspect in relation to the alleged matters (1 mark)
27. Which one of the statements following is NOT an objective of textual analytics?
A. To identify red flags
B. To reveal patterns
C. To use unstructured data to identify red flags of fraud
D. To use structured data to identify red flags of fraud (1 mark)
28. Which one of the following statements is NOT accurate in regard to the first phase of a forensic audit interview?
A. In a forensic audit interview, it is the responsibility of the interviewer to establish rapport
B. In a forensic audit interview, it is the responsibility for the interviewer to establish the specific purpose of the interview
C. In a forensic audit interview, it is the responsibility for the interviewer to establish the purpose of the interview
D. In a forensic audit interview, it is the responsibility for the interviewer to make sure that they get commitment (1 mark)
29. Which one of the following statements is NOT accurate in regard to forensic audits assignments?
A. Every forensic audit should begin with the assumption that the case will end in court
B. Forensic audit is a methodology of resolving fraud issues from inception to disposition
C. A forensic audit should be approached from the perspective that fraud has occurred
D. The forensic audit should be conclusive if fraud has occurred or not (1 mark)
30. “This is a big organisation with a lot of resources” This interviewing technique helps to achieve which one of the following?
A. Diffusing Alibi and interrupt the suspect’s excuses
B. Reducing condemnation of the suspect
C. Making altruistic appeals
D. Give the suspect recognition (1 mark)
31. Which one of the following statements is the BEST method of acquiring digital evidence to maintain the integrity of the data?
A. Imaging the hard drive
B. Printing the evidence record
C. Acquiring the digital evidence using forensic tools
D. Imaging the files (1 mark)
32. Which one of the following statements is the BEST method of handling the additional information?
A. Omit the information
B. Destroy the old statement and write another one to include the information omitted
C. Add another statement to the earlier statement
D. Add the information on the old statement (1 mark)
33. Which one of the following statements is the most common method of hiding illegally acquired assets?
A. Placing assets in a trust
B. Selling the assets
C. Transferring assets
D. Under valuation of assets (1 mark)
34. Which one of the following pieces of information does a fraud examiner need NOT to obtain from the suspect in regard to a loan?
A. The approximate date when the suspect received the loan
B. Any items acquired with proceeds of the loan
C. Excuses that she did not know that the loan was a bribe
D. Excuses of why she accepted the offer (1 mark)
35. Which one of the following statements is ACCURATE in regard to a good fraud investigation report?
A. The report should include expertise language
B. The report must be partial to ensure emphasis of the evidence
C. The report should not affix blame
D. The report must be impartial (1 mark)
36. Link analysis is particularly useful when investigating which type of fraud scheme?
A. Conflict of interest
B. Cash skimming
C. Money laundering
D. Embezzlement (1 mark)
37. Which one of the following loan amounts should be included in the suspects financial profile?
A. Loan proceeds
B. Book loan amount
C. Principal and interest amount
D. Principal loan (1 mark)
38. Which one of the following steps is NOT part of the preparation phase of data analysis?
A. Normalising and cleansing data
B. Identifying relevant data
C. Verifying data
D. Identifying potential frauds (1 mark)
39. Which one of the following statements is ACCURATE in regard to information usually provided an investigation subject?
A. Provides very understated amount of funds misappropriated
B. Provides accurate number of incidences
C. Provides information about the other accomplices
D. Provides an approximate amount of funds misappropriated (1 mark)
40. Which one of the following methods of interrupt the denials is NOT recommended in admission seeking interview?
A. Reason with the suspect
B. Discuss other witnesses
C. Respond to the suspect questions
D. Make a direct accusation (1 mark)
41. Which one of the following files is not generated the user and can be good source of digital evidence?
A. Application logs
B. Database files
C. Emails
D. Word document (1 mark)
42. Which one of the following statements is ACCURATE in regard to contents of fraud investigation reports?
A. The scope of the investigation should be specific to the allegations
B. The conclusion part of the report should include the recommendations on actions to be taken
C. The recommendation part of the report should include the response to the evidence collected
D. The scope of the investigation should include all the fraudulent activities (1 mark)
43. Which one of the following statements is NOT a recommended step for preparing to conduct digital forensics?
A. Consider if it necessary to notify law enforcement
B. Acquire the digital evidence live to ensure data is not deleted
C. Consider if there is need to engage an outside digital forensic expert
D. Consider the digital forensic expert required for the engagement (1 mark)
44. Which one of the following statements is NOT accurate in regard to the nature of digital evidence as opposed to tangible?
A. Integrity of digital evidence should be handled carefully because once destroyed cannot be restored and therefore not admissible in a court of law
B. Digital evidence is more volatile than tangible evidence because data can be easily altered and destroyed
C. Tangible evidence is more volatile than digital evidence because data cannot be easily altered and destroyed
D. The integrity of the data will be questioned even because of the date stamp (1 mark)
45. Which one of the following statements is a reaction of an innocent person?
A. Weak denials
B. Responding to questions with a question
C. Over respectful
D. Gets very angry when directly accused (1 mark)
46. Which one of the following words retrieved through textual analytics is a red flag of pressure to commit fraud?
A. Deadline
B. Deserve
C. Write off
D. Entitled (1 mark)
47. Which one of the following statements is of natural number that can be analysed using the Benford law?
A. Telephone numbers
B. Customers deposit amounts
C. Sales invoice numbers
D. Check numbers (1 mark)
48. Textual analytics can be applied to identify words that are indicative of justification to commit fraud. Which one of the following is an example of such words?
A. Override
B. Write off
C. Deserve
D. Deadlines (1 mark)
49. Which one of the following statements is the BEST course of action if a suspect insists on having a representative during an interview?
A. The interviewer should not conduct the interview
B. The interviewer should conduct the interview
C. The interviewer should not allow the representative into the interview
D. The interviewer should allow the representative into the interview (1 mark)
50. Which one of the following types of questions should be used extensively to elicit information from witnesses?
A. Narrative questions
B. Leading questions
C. Open ended questions
D. Closed question (1 mark)
51. Which one of the following is NOT an excuse that should be included in a signed admission statement?
A. “I did not mean to do it”
B. “I didn’t do it”
C. “I didn’t mean to cause any inconveniences”
D. “I didn’t know it was wrong” (1 mark)
52. Which one of the following terms is NOT a characteristic of the means that a fraudster would be used to conceal assets?
A. Accessibility
B. Security
C. Liquidity
D. Transparency (1 mark)
53. Which one of the following statements BEST describes international cooperation in prosecution?
A. A letter in which a judge in one country orders the government in another country to release a defendant from jail
B. A formal request the government of a country seeking information from a defendant residing in another country
C. A formal request the courts of one country seeking judicial assistance from the courts of another country
D. A letter wherea criminal defendant requests that the government release exculpatory information
(1 mark)
54. A Certified Forensic Fraud Examiner is conducting an interview of an employee. The fraud examiner asks: ” Why did you take the organisation funds without permission?” At what phase should this question be asked?
A. Introduction phase
B. Information gathering phase
C. Admission seeking phase
D. Assessment phase (1 mark)
55. Which one of the following pieces of information can an interviewer document in a suspect’s written statement?
A. Excuse that the conduct was a mistake
B. Only the exact number of instances, dates and amounts involved
C. That the suspect did not know that the conduct was wrong
D. That the suspect had a good reason for engaging in the wrong conduct (1 mark)
56. Which one of the following statements is NOT a challenge of cloud digital forensics?
A. Lack of frameworks and specialist tools
B. Accessibility of information
C. Lack of data control
D. Security of the data (1 mark)
57. Which one of the following statements is NOT accurate in regard to employees’ rights during investigations?
A. Employees should be issued with a search policy before the organisation can conduct searches on employees’ personal smart phones
B. Employees have a right of privacy to information on their personal smart phones brought to workplace
C. Generally, employees have reasonable expectation of privacy if they have not been informed of searches
D. Employees have no right of privacy to information on their personal smart phones brought to workplace
(1 mark)
58. Which one of the following statements is NOT accurate in regard to the types of files that a computer forensics expert typically can recover from computer systems?
A. Computer forensics specialists can recover time and date information about files
B. Computer forensics specialists can recover deleted documents
C. Computer forensics specialists can recover information about websites visited
D. Computer forensics specialists can recover overwritten documents (1 mark)
59. A forensic auditor is conducting textual analytics on an email message and runs a keyword search using the terms like override. These words are indicative of which one of the following fraud risk?
A. Pressure
B. Capability
C. Opportunity
D. Rationalisation (1 mark)
60. Which one of the following statements is NOT an example of a data analysis function that can be performed to detect fraud through an examination of the general ledger?
A. Identify overstated salaries
B. Analyse and confirm specific ledger accounts for legitimate transaction activity
C. Calculate financial ratios
D. Calculate budget and actual variances (1 mark)
61. Njenga Ltd. is a real estate company. The director noticed that the paint expenses have increased drastically from the previous year. The company had less business during the year. Which one of the following data analysis functions would be MOST useful in helping the director determine if cost of the paint is proportionate to the houses painted?
A. Comparison analysis
B. Data Analysis
C. Correlation analysis
D. Compliance verification (1 mark)
62. An email message can be BEST categorised as .
A. structured data
B. unstructured data
C. documentary data
D. natural data (1 mark)
63. Which one of the following steps is included in the preparation phase of the data analysis process?
A. Determining examination objectives
B. Obtaining data
C. Determining whether predication exists
D. Analysing data (1 mark)
64. Which one of the following statements is a recommended method of dealing with difficult interviewees?
A. Make it difficult for the witness to say “no”
B. Make it difficult for the witness to say “yes”
C. Disarm the witness agreeing with his/her points where possible
D. Reacting firmly to the witness hostile behavior (1 mark)
65. Which one of the following statements BEST describes the social psychological inhibitor to communication where the respondent is unable to generalise a concrete experience?
A. Inferential confusion
B. Induction confusion
C. Repression confusion
D. Trauma confusion (1 mark)
66. Which one of the following statements is an ideal time to ask admission-seeking questions?
A. When the interviewer believes there is a reasonable possibility that the suspect committed the offence
B. When all investigative steps and sources have not been exhausted
C. When the time, place and subject matter discussed can be controlled the suspect
D. When all investigative steps and sources of information have been exhausted (1 mark)
67. Which one of the following terms should an investigator avoid in fraud forensic reports?
A. Clear and precise
B. Being impartial
C. Clear conclusions
D. Opinions (1 mark)
68. Which one of the following statements is NOT accurate in regard to Link Analysis tool and investigations?
A. Link analysis summary can be presented in court as additional evidence
B. Link analysis can be presented in court as demonstrative evidence
C. Link analysis cannot be presented in court as real evidence
D. Link analysis cannot be presented in court as direct evidence (1 mark)
69. Which one of the following statements is NOT a step of data analysis in the planning phase?
A. Building a profile of potential frauds
B. Establishing predication
C. Verifying data
D. Understanding the data (1 mark)
70. Which one of the following is a recommended method for obtaining bank records from a suspect after a confession?
A. Obtain an oral authorisation for the release of the bank records
B. Request the subject to bring the bank records to the investigator’s office
C. Obtain a written authorisation from the suspect to obtain the bank records
D. Convince the suspect to surrender the banks statements (1 mark)
71. Which one of the following information is generally NOT available in developing background information for hiring purposes?
A. Criminal court records searches
B. Bankruptcy records searches
C. Tax records
D. Public records (1 mark)
72. Which one of the following statements is NOT a best practice for obtaining an admission?
A. Avoid condemnation while conducting the interview of the suspect
B. Maximise sympathy and avoid condemnation
C. Minimise compassion and be objective
D. Conduct the interview in an informal and firm manner (1 mark)
73. Which one of the following methods is NOT a recommended practice for organising evidence?
A. Segregating documents transaction
B. Filing all the documents chronologically
C. Filling the documents per event or transaction
D. None of the above (1 mark)
74. A fraud examiner should forward a fraud case file to the prosecution when the investigator has collected
.
A. relevant and admissible evidence
B. good amount of evidence
C. all the documents related to the facts in issue
D. sufficient information from the witnesses (1 mark)
75. If a Certified Fraud Examiner is conducting an interview of a suspect and he becomes uncomfortable with the sensitive nature of the questions, which one of the following statements BEST describe what the interviewer should do to make sure the conversation goes on?
A. Ask double positive questions
B. Ask alternative questions
C. Ask hypothetical questions
D. Ask general questions at that point (1 mark)
76. Which one of the following statements is ACCURATE in regard to closed questions in professional interviews?
A. They are worded in a way that the respondent can answer “yes” or “no”
B. They are worded in a way that the witness be able to make an admission
C. They are worded in a way that the witness will be able to provide more information
D. They are worded in a way that will maintain goodwill (1 mark)
77. The terms induction and deduction are associated with which social psychological barrier that impede communication?
A. Chronological confusion
B. Inferential confusion
C. Trauma confusion
D. Hypothetical confusion (1 mark)
78. Which one of the following is NOT an objective of introductory questions of a structured interview conversation?
A. To establish the purpose of the interview
B. To establish the credibility of the witness before proceeding with the interview
C. To request for assistance
D. To establish rapport (1 mark)
79. Which one of the following files BEST describes the suspect file that is subject to investigation?
A. Secondary file
B. Primary file
C. Subject file
D. Suspect file (1 mark)
80. Which one of the following statements is NOT accurate in regard to interviews practices?
A. The interviewer should establish the objective of the interview
B. The interviewer should ensure that he is able to control the interview
C. The interviewer should not prepare a list of questions to be able to conduct the interview quickly without wasting time
D. The interviewer should be informal (1 mark)
81. Which one of the following statements is NOT accurate in regard to computer generated meta data?
A. Metadata information can help determine who edited the document
B. Metadata information can help determine when a document was created
C. Metadata is a user created file which can be a good source of digital evidence
D. Metadata is a computer-generated file which can be a good source of digital evidence (1 mark)
82. Which one of the following statements is ACCURATE in regard to mutual legal assistance (MLA)?
A. A formal request the government of a country seeking information from a defendant residing in another country
B. Mutual legal assistance can only be requested for criminal trials
C. Mutual legal assistance is a legal requirement for countries that have entered into the mutual legal assistance therefore, legal assistance must be granted
D. Mutual legal assistance can only be requested for both criminal and civil trials (1 mark)
83. Which one of the following is a method of using software to search for key words from unstructured data?
A. Imaging the data
B. Data analytics
C. Textual analytics
D. Data mining (1 mark)
84. Which one of the following witness should be interviewed just before the suspect?
A. A person with information of the alleged offence, but is not a beneficiary of the offence
B. A person who is directly or indirectly involved in the offence
C. A person who has more detailed information about the alleged offence, and is not a beneficiary of the offence
D. The main subject of the alleged offence (1 mark)
85. Which one of the following statements is NOT accurate in regard to closing questions in an interview?
A. The purpose of closing questions is to observe any deceptive clues
B. The purpose of closing questions is to confirm facts
C. Closing questions are also designed to maintain goodwill
D. The purpose of closing questions is to gather more information (1 mark)
86. Which one of the following statements is NOT a recommended procedure for protecting a fraud investigation’s case information?
A. Store all confidential documents in locked file cabinets or rooms
B. Avoid discussing about the investigation in public or in any place where other employees could hear the communications
C. Use of electronic means to transmit confidential case information
D. Avoid sharing investigation results with the subjects (1 mark)
87. Which one of the following statements is ACCURATE in regard to the wording of leading closing questions?
A. They are worded in a way that makes it difficult for the respondent to answer “yes” or “no”
B. They are worded in a way that, the witness can only answer“yes” or “no”
C. They are worded in a way that the respondent can only answer“yes”
D. They are worded in a way that makes it difficult for the respondent to answer“no” (1 mark)
88. Which one of the following witness should be interviewed after all the other witnesses?
A. A person with information of the alleged offence but is not a beneficiary of the offence
B. A person who is directly or indirectly involved in the offence
C. A person who has more detailed information about the alleged offence and is not a beneficiary of the offence
D. The main suspect of the alleged offence (1 mark)
89. Which one of the following roles describes the function in data analysis software to join two files with same information to look for any exceptions?
A. Multi-file processing function
B. Data analysis
C. Join function
D. Textual analytics (1 mark)
90. Which one of the following statements is ACCURATE in regard to sources of information that can be obtained from court records?
A. There are multiple databases that contain a comprehensive database of court documents from all court cases in every country
B. In most countries, court records are not public records and require judicial authorisation to access
C. When searching for records for a particular court case, a fraud examiner need only to search the central/federal court records as they serve as a repository for all cases heard at all court levels
D. In most countries, reliable court records are best obtained from the court where the case was heard or filed
(1 mark)
91. Which one of the following is a facilitator of communication that makes the interviewee not to perceive condemnation?
A. Rationalisation
B. Sympathetic understanding
C. Altruism appeals
D. Recognition (1 mark)
92. Which one of the following statements is a method of tracing illicit funds comparing bank deposits with the suspect’s known legitimate income when records and books are not available?
A. Expenditures method
B. Net worth analysis method
C. Indirect bank analysis method
D. Direct bank analysis method (1 mark)
93. Which one of the following statements is NOT a recommended mechanic of conducting an interview to ensure the accurate recording?
A. The interviewer should avoid recording the interview to ensure the success of the interview
B. The interviewer should record the interview to ensure the information accurately captured
C. The interviewer should accord the interviewee privacy
D. The interviewer should conduct one on one interview, to ensure the success of the interview (1 mark)
94. Which one of the following actions is NOT an element that must be observed during professional interviews?
A. Therapy
B. Expression of ideas and moods
C. Information exchange
D. Recognition (1 mark)
95. Which one of the following statements is ACCURATE in preserving computers for investigation?
A. When a forensic investigator is seizing a running computer for investigations, he should not retrieve data from the computer under any circumstances
B. When a forensic investigator is seizing a running computer, he should not use the graceful shut down process to protect the integrity of the data
C. When a forensic investigator is seizing a running computer, he should use the hard shut down process to protect the integrity of the data
D. When a forensic investigator is seizing a running computer for investigations, he should not retrieve any data at all (1 mark)
96. Which one of the following statements is ACCURATE in regard to response an interviewee to an alternative question?
A. The interviewee is likely to make an unconscious admission in response to an alternative question
B. An interviewee is unlikely to make a benchmark admission in response to an alternative question
C. An Interviewee is unlikely to respond to the alternative question
D. An Interviewee is unlikely to respond to any of the questions (1 mark)
97. Which one of the following words should an interviewer avoid during a fraud investigation interview of a suspect?
A. Investigations
B. Review
C. Enquiry
D. Evaluation (1 mark)
98. Which one of the following individual would be more suitable to be the lead investigator in a financial statement fraud investigation?
A. The head of the investigation
B. The chief executive officer
C. The financial accountant
D. The internal auditor (1 mark)
99. Which one of the following statements is NOT accurate in regard to accusatory questions?
A. Accusatory question should be asked after confirming facts with the suspect
B. Accusatory question should be asked after the introduction phase
C. Accusatory question should be asked to separate an innocent person from a guilty one
D. Accusatory question should be asked after exhausting all other investigative steps (1 mark)
100. Which one of the following statements is ACCURATE in regard to the approach of a forensic audit?
A. Forensic audits should be approached from two perspectives to prove or disapprove the alleged facts in issue
B. Forensic audits should be approached from one perspective to prove the alleged facts in issue
C. Forensic audit is aimed at detailed information of the alleged facts in issue
D. Forensic audit is a methodology of resolving fraud issues of inception to litigation (1 mark)
………………………………………………………………………………….