CERTIFIED FORENSIC FRAUD EXAMINER (CFFE) MODULE TWO
PLANNING AND CONDUCTING FORMAL INVESTIGATIONS
THURSDAY: 4 December 2025. Morning Paper. Time Allowed: 3 hours.
This paper has two sections. SECTION I consists of fifty (50) Multiple Choice Questions carrying fifty (50) marks. SECTION II has four (4) structured questions carrying (50) marks. Answer ALL questions. Marks allocated to each question are indicated at the end of the question.
SECTION I (50 MARKS)
1. Which of the following statements is the BEST response when an interviewee says ‘I do not remember’ when dealing with resistance in an interview?
A. End the interview immediately since the interviewee is non-cooperative
B. Repeat the question in a louder tone to show the seriousness of the interview
C. It is okay, it has been a while
D. Warn the employee that failure to remember will be taken as admission (1 mark)
2. Which one of the following statements is NOT ACCURATE in regards to note taking during an interview?
A. Interview notes should always be taken verbatim
B. Interviewer should maintain eye contact instead of taking too many notes
C. Taking key points notes is more effective than electronic recording of interview
D. Notes should focus on the pertinent information (1 mark)
3. Which of the following statements is an ACCURATE statement regarding the conduct of interviewers during a fraud examination interview?
A. An interviewer should prepare a predetermined list of questions to ask during the interview
B. To ensure consistency, interviewers may place two subjects in separate rooms and ask the same questions at the same time
C. The interview location should be somewhere the subject feels comfortable and secure
D. If there is concern the interviewee may leave, the room should be locked to prevent them from exiting before the interview end (1 mark)
4. Which of the following statements is ACCURATE in regards to using deception during interviewing?
A. It is acceptable for interviewers to use deception assuring confidentiality to encourage cooperation
B. Deception should never be used in a manner that might cause an innocent person to confess
C. The use of deception during interviews is always unlawful and categorically forbidden
D. It is acceptable for interviewers to use deception suggesting that leniency will be granted if the subject confesses (1 mark)
5. The purpose of the interview is established at what phase of the interview?
A. Introduction phase
B. Information gathering phase
C. Assessment phase
D. Admission seeking phase (1 mark)
6. Which of the following types of questions should NOT be asked during the information-gathering phase of a fraud examination interview?
A. Assessment questions aimed at judging credibility of the respondent
B. Closed questions intended to obtain specific factual details
C. Leading questions that aim to get a positive response
D. Open questions aimed at eliciting a narrative response (1 mark)
7. Which of the following words should a fraud examiner AVOID during the introductory phase of interviewing?
A. Inquiry
B. Investigation
C. Review
D. Shortage (1 mark)
8. Which one of the following statements is NOT a recommended practice during the introductory phase of a fraud examination interview?
A. Avoid beginning the interview with confrontational or accusatory questions
B. State only the general purpose of the interview rather than disclosing specific allegations
C. The interviewer may begin with a few minutes of ritualistic conversation to put the interviewee at ease
D. Nodding or shaking the head is acceptable when getting commitment from respondent (1 mark)
9. Which of the following statements BEST explains the major reason for conducting a forensic audit?
A. To prevent further losses
B. To recover losses
C. To collect evidence to prove or disapprove an allegation
D. To improve internal controls (1 mark)
10. Internal fraud is MOSTLY discovered through .
A. internal audit
B. management reviews
C. automated transaction monitoring
D. tips (1 mark)
11. Which one of the following questions should be avoided during the information gathering phase of a fraud examination?
A. Please tell me about your role in the accounting department
B. Didn’t you know that you weren’t supposed to transfer the funds
C. What date were the transactions completed?
D. Was there any formal communication on effecting these changes (1 mark)
12. Which one of the following statements is NOT an objective of closing questions in a fraud investigation?
A. To determine the trustworthiness of the witness
B. To leave the interview on a positive note
C. To verify the accuracy of the information provided
D. To obtain any final details or clarifications (1 mark)
13. Which one of the following statements describe the function of a fraud examination in relation to the results of the investigation?
A. Testifying to the findings
B. Documenting the evidence
C. Supporting fraud detection and prevention efforts
D. Making a presentation (1 mark)
14. Which one of the following statements is ACCURATE in regard to how the fraud examiner should respond to an engagement without predication?
A. The fraud examiner should investigate
B. The fraud examiner should inform the party that commissioned the investigation, that there is no need to investigate
C. Conduct a fraud risk assessment
D. Assume fraud has occurred and begin gathering evidence (1 mark)
15. The type of witness that should generally be interviewed first during a fraud examination is .
A. primary suspect
B. an accomplice
C. neutral witness
D. corroborative witnesses (1 mark)
16. While using the fraud theory approach, which one of the following statements is recommended when creating a fraud hypothesis?
A. Assume the least damaging explanation to the organisation
B. Avoid making assumptions until evidence collection is completed
C. Interview the suspect before creating a hypothesis
D. Base the hypothesis on the worst-case scenario (1 mark)
17. Which one of the following conclusions is appropriate if a fraud examiner cannot confirm a hypothesis?
A. Amend and retest the hypothesis based on known facts
B. Conclude that there is no fraud
C. Shift responsibility to management for decision-making
D. Re-open the case with a new fraud examiner (1 mark)
18. Which one of the following statements is ACCURATE regarding court records?
A. Criminal filings are generally accessible to the public
B. Juvenile records are generally open for public searching
C. Court records are usually kept a single national database administrator
D. Criminal convictions are generally accessible for public search (1 mark)
19. Which one of the following statements is NOT accurate in regard to conditions that must be satisfied before moving from assessment questions to an admission-seeking interview?
A. The fraud examiner should have sufficient evidence that reasonably indicates the subject’s involvement in wrongdoing
B. The fraud examiner has reasonably completed other investigative steps and gathered evidence from other sources
C. The fraud examiner has suspicion that the respondent is being deceptive
D. The interviewer feels he/she can reasonably control place, time and subject matter of the interview
(1 mark)
20. The following are purposes of admission seeking interview, EXCEPT to .
A. convince a confessor to sign a written statement
B. determine who is innocent and who is guilty
C. differentiate culpable and innocent suspects
D. obtain a valid confession (1 mark)
21. Which one of the following statements is NOT a legally acceptable basis for obtaining an individual’s credit record from a third-party credit reporting agency without the individual’s consent?
A. When the information is required to evaluate the individual’s application for credit
B. When the information is needed as part of entering into a contractual relationship with the individual
C. When such information is necessary to serve public interest
D. When the individual is under investigation for suspicion for fraud (1 mark)
22. Which one of the following factors requires particular attention when performing data analysis in the course of a fraud examination?
A. Identification of unusual trends or recurring patterns
B. Understanding how concealment may distort the data
C. Reviewing totals within groups of similar transactions
D. Addressing data entry errors such as unreadable or corrupted characters (1 mark)
23. Which one of the following statements is the BEST response when an interviewee says ‘I am too busy’ when dealing with resistance in an interview?
A. Explain that the interview will be short and you need their help
B. Ignore the comment and proceed to with the interview
C. Apologise for the inconvenience and end the interview
D. Remind them that the interview is mandatory (1 mark)
24. Which one of the following data testing techniques is MOST appropriate in fraud risk areas?
A. Random sampling
B. Repetitive testing
C. Adhoc testing
D. Continuous monitoring (1 mark)
25. Under which of the following circumstances can a fraud examiner accuse an innocent person of fraud without falling into legal pitfalls?
A. When the accusation is made in front of colleagues to demonstrate the organisation’s commitment to fighting fraud
B. When the examiner has sufficient information evidence and raises the accusation is not raised in the presence of a third party
C. When the suspect exhibits behavioural indicators of dishonesty or refuse to answer questions
D. When management directs the examiner to confront the employee based on its belief that the individual is responsible (1 mark)
26. Which one of the following methods is NOT recommended for making a direct accusation in admission seeking interviews?
A. Making the accusation in form of a statement followed a question
B. Using words that show the legal seriousness of the offence
C. Phrasing the accusation as if guilt has already been established
D. Using words that reduce the moral seriousness of the offence (1 mark)
27. Which one of the following statements is NOT a rationalisation technique in an admission-seeking interview?
A. Portraying the misconduct as morally acceptable
B. Attributing the conduct to family genuine financial difficulties
C. Making an appeal, that the conduct was for greater need than self
D. Showing the conduct had immaterial impact on the organisation (1 mark)
28. The primary purpose of preparing a chain of custody memorandum is to .
A. document relevant evidence
B. provide senior management with a summary of the investigation’s key findings regarding evidence
C. maintain the authenticity of the document
D. establish the chain of events (1 mark)
29. An assignment designed to collect evidence that could be used in court of law is known as .
A. forensic fraud audit
B. fraud audit
C. special audit
D. internal audit (1 mark)
30. Which one of the following statements is NOT accurate regarding the type of information that should be included in the recommendations section of a fraud investigation report?
A. Recommendation on what action should be taken against the suspect
B. Recommendation on areas that require further investigations
C. Recommendation on the preventive controls to be put in place
D. Recommendation on the detective controls to be put in place (1 mark)
31. Which one of the following documents is NOT a computer-generated files that can be good sources of digital evidence?
A. Metadata
B. Files hidden through stenography
C. An email
D. Event logs (1 mark)
32. Which one of the following reasons would make an organisation stop destruction of documents as per the document retention policy?
A. Litigation purposes
B. Audit requirements
C. Industry requirements
D. Document management schedule (1 mark)
33. Which one of the following terms BEST refers to the use of historical data, combined with advanced techniques such as machine learning, to identify patterns and build models that help forecast future outcomes?
A. Deep learning
B. Descriptive analytics
C. Robotic process automation
D. Predictive analytics (1 mark)
34. Which one of the following statements is NOT a recommended method of diffusing alibis in an admission seeking interview?
A. Referring to a witness’s inconsistent statements
B. Discussing other witnesses
C. Displaying incriminating evidence
D. Discussing the consequences if the interviewee refuses to cooperate (1 mark)
35. Which one of the following elements of conversation insist that interviewer needs help?
A. Persuasion
B. Ritual
C. Therapy
D. Expression (1 mark)
36. Which one of the following inhibitors of communication can BEST be avoided assuring the interviewee that information will be kept confidential as possible?
A. Repression
B. Loss of status
C. Trauma
D. Disapproval (1 mark)
37. Which one of the following statements refers to the BEST method of avoiding ego threat in an admission seeking interview?
A. Reducing moral seriousness of the conduct
B. Being polite when conducting the interview
C. Applying therapy
D. Depersonalising the victim (1 mark)
38. Which one of the following is NOT forensic accounting assignment?
A. A workplace asset misappropriation investigation
B. A business valuation
C. Calculation of economic losses
D. Bankruptcy accounting (1 mark)
39. Which one of the following statements is ACCURATE in regard to a fraud response plan?
A. It describes offenses and sanctions for employee conduct related to fraud
B. It outlines procedures for detecting and preventing fraud after it has occurred
C. It sets out policies and procedures of handling suspicions or allegations of fraud in a consistent and organised manner
D. It is designed to ensure that evidence is collected and preserved in a legally sound manner (1 mark)
40. Which one of the following statements BEST explains what should be recorded in the fraud incident log?
A. All suspicions of fraud that are currently under investigation
B. All suspicions of fraud where investigations have been completed
C. All suspicions of fraud that have not been investigated
D. All suspicions of fraud, regardless of whether they are under investigation, completed, or not pursued
(1 mark)
41. Which one of the following statements should a fraud examiner look at when creating the behavioral profile of a suspect for the purposes of tracing illicit transactions?
A. The subjects spending habits
B. The subject’s income
C. The subject’s major expenditure
D. The subjects acquired assets (1 mark)
42. Which one of the following statements BEST describes the primary objective of a forensic audit?
A. To provide reasonable assurance that financial statements are free from material misstatement
B. To collect evidence to prove or disapprove an allegation
C. To identify weaknesses in internal controls and recommend corrective measures
D. To collect evidence to prove an allegation (1 mark)
43. Which one of the following statements would NOT be a typical responsibility of a forensic accountant involved in litigation?
A. Preparation of management accounts reports
B. Testifying in court as an expert witness
C. Gathering evidence for court purposes
D. Assisting in fraud detection and prevention (1 mark)
44. Which one of the following engagements is MOST suitable for an organisation undergoing bankruptcy restructuring?
A. External audit
B. Fraud examination
C. Forensic audit
D. Forensic accounting (1 mark)
45. Which one of the following engagements should an organisation conduct when unusual financial transactions indicate possible fraud?
A. Compliance audit
B. Forensic audit
C. Fraud audit
D. Internal controls review (1 mark)
46. Which one of the following statements is NOT an example of closing question in an interview?
A. Is there something else you would like to let me know
B. I hope the interview was fair
C. I believe you would not mind helping with more information later
D. I believe you had a good reason for taking the money (1 mark)
47. Which one of the following data analysis phase is associated with determining predication?
A. Preparation phase
B. Planning phase
C. Testing and analysis
D. Response phase (1 mark)
48. Which one of the following methods is used to identify words indicative of fraud in employee’s communications?
A. Data analysis
B. Benford analysis
C. Horizontal analysis
D. Textual analytics (1 mark)
49. Which one of the following data can Benford law be applied to identify unusual patterns?
A. Telephone numbers
B. Vendors invoice amounts
C. Sales invoice numbers
D. Bank account numbers (1 mark)
50. Which one of the following statements is NOT accurate in regard to electronic evidence?
A. Electronic evidence can be altered or destroyed more easily than physical items
B. If integrity of electronic evidence has been violated it can be restored with digital advanced forensic tools
C. If electronic evidence has been overwritten it cannot be recovered even with forensic tools
D. If electronic evidence has deleted it can be recovered using forensic tools (1 mark)
SECTION II (50 MARKS)
51. (a) In regard to interviewing suspects, explain TWO objectives of each of the following questions:
(i) Introductory questions. (4 marks)
(ii) Closing questions. (4 marks)
(b) Explain THREE methods of reduce the moral seriousness of an offence during an interview. (6 marks)
(c) Analyse THREE examples of a weak denial in an admission seeking interview. (6 marks)
(Total: 20 marks)
52. Describe THREE phases of data analysis, including the steps in each phase. (Total: 15 marks)
53. Examine FIVE standards of an investigation report. (Total: 10 marks)
54. Identify FIVE pieces of information that must be obtained from a suspect after an admission of the offence.
(Total: 5 marks)
……………………………………………………………………..