CERTIFIED FORENSIC FRAUD EXAMINER (CFFE) MODULE TWO
PLANNING AND CONDUCTING FORMAL INVESTIGATIONS
PILOT PAPER
MARCH 2025. Time Allowed: 3 hours.
Answer ALL questions. This paper has two Sections. SECTION I consists of fifty (50) Multiple Choice Questions carrying fifty (50) marks. SECTION II has four (4) structured questions carrying fifty (50) marks. Marks allocated to each question are indicated at the end of the question.
SECTION I (50 MARKS)
1. Which one of the following statements is ACCURATE in regard to accuracy in forensic audit report writing?
A. The credibility of a forensic audit report can only be affected material inaccuracies
B. The credibility of an examination report cannot be affected immaterial inaccuracies
C. The credibility of an examination report can be affected both material and immaterial inaccuracies
D. The credibility of an examination report cannot affect the admissibility of the documented evidence
(1 mark)
ANSWER: C
2. Which one of the following statements is NOT correct in regard to the difference and similarities of forensic audit and fraud investigations?
A. Forensic audit or fraud investigations are identical because the purpose of both assignments is to collect evidence to prove or disapprove an allegation
B. The terms forensic audit, fraud investigations, or examinations can be used inter-changeably because the objectives of the assignments are the same
C. Forensic audit differs from fraud investigations because forensic audit is a type of a special audit conducted to collect more information and details, while fraud investigations are conducted to collect evidence that can be used in a court of law
D. An auditor cannot conduct a good fraud forensic audit without a formal training and experience in fraud investigation (1 mark)
ANSWER: C
3. Which one of the following statement is NOT accurate in regard to fraud and corruption investigations interviews?
A. Most of the fraud and corruption activities are off the book, therefore the investigator may have to get information from people
B. In most fraud and corruption cases information and evidence is not in the books but with the people
C. Most of the fraud and corruption cases the investigator may have to get physical evidence from the suspect
D. None of the above (1 mark)
ANSWER: D
4. Which one of the following statements BEST describe the effects of a double-negative question in fraud investigations interviews?
A. The response to a double-negative question is usually the desired one
B. A double-negative question is usually effective in eliciting information
C. A double-negative question is usually effective in obtaining an admission
D. Double negative questions is always straight forward (1 mark)
5. Which one of the following statements is ACCURATE in regard to the contents of the introduction/ background section of a forensic audit report?
A. The introduction/background section should include all the objectives of the forensic audit
B. The introduction/background section should include the main objective of the audit, which is to prove or disapprove the allegations
C. The introduction/background section should include a summary of the findings of the forensic audit
D. The introduction/background section should include the scope of the audit (1 mark)
ANSWER: B
6. Which one of the following statements is ACCURATE in regard to closing questions?
A. The interviewer should ask closed questions extensively in closing questions
B. The interviewer should ask open-ended questions extensively in closing questions
C. The interviewer should ask narrative questions extensively in closing questions
D. The interviewer should ask hypothetical questions extensively in closing questions (1 mark)
ANSWER: A
7. Which one of the following statements is MOST accurate in regard to a professional fraud investigation interview?
A. The interviewer should be formal and firm
B. The interviewer should record the interview to ensure that he does not forget any important information provided during the interview
C. The interviewer should be informal but firm
D. The interviewer should be formal and friendly (1 mark)
ANSWER: C
8. Which one of the following statements BEST describes the method of tracing illicit funds comparing a suspect’s major expenditures, and assets acquired with the suspect’s known legitimate sources of funds?
A. Expenditures method
B. Bank deposit analysis method
C. Net worth analysis method
D. Asset method (1 mark)
ANSWER: C
9. Which one of the following statements is NOT accurate in regard to mechanics of an interview?
A. The Interviewer should avoid taking a lot of notes during an interview
B. The interviewer should not record the interviewee without their consent
C. The interviewer should document the interview as soon as possible after the interview
D. None of the above (1 mark)
ANSWER: D
10. Which one of the following is an element of conversation that the interviewer must apply during a structured conversation interview?
A. Sympathetic understanding
B. Recognition
C. Rationalisation
D. Information exchange (1 mark)
ANSWER: D
11. Which one of the following statements is ACCURATE in regard to seising a computer for forensic examination?
A. When a forensic investigator is seising a running computer, he should be concerned about the integrity of the data which might be affected the way the computer is shut down
B. When a forensic investigator is seising a running computer, he should be concerned about the confidentiality of the data which might be affected the way the computer is shut down
C. When a forensic investigator is seising a running computer, he should be concerned about the security of the data which might be affected the way the computer is shut down
D. None of the above (1 mark)
12. Which one of the following statements is NOT one of the explanations a suspect is likely to give in regard to questionable sources of income?
A. That the extra funds are gifts from his friends and relatives living abroad
B. That the extra funds are from an inheritance
C. That the extra funds are proceeds of sale of family property
D. That the extra funds are gifts suppliers and contractors (1 mark)
ANSWER: D
13. Which one of the following statements is ACCURATE in regard to the investigator’s ability to accurately observe behavioral clues of an intelligent suspect?
A. It is very hard for an interviewer to accurately observe behavioral clues of an intelligent suspect like an accountant because they are confident in misleading the investigator using professional jargon
B. It is easy for an interviewer to accurately observe behavioral clues of an intelligent suspect like an accountant because he/she would experience a lot of inner tension when caught in their fraudulent activities
C. It is very hard for an interviewer to accurately observe behavioral clues of an intelligent suspect who have experience in engaging in fraudulent activities, because they are familiar with such interviews and therefore they cannot experience stress during interviews
D. None of the above (1 mark)
ANSWER: B
14. Which one of the following methods BEST describe circumstantial evidence to prove illicit funds that has caused the net worth to increase?
A. The expenditures method
B. The Assets method
C. Net worth analysis method
D. None of the above (1 mark)
ANSWER: B
15. Which one of the following BEST describes the interviewing technique where the interviewer appeals to interviewee indicating that what they did was for greater good?
A. Sympathetic understanding
B. Altruism
C. Recognition
D. Relationships (1 mark)
ANSWER: B
16. Which one of the following statements is ACCURATE in regard to preparing an organisation for a formal fraud investigation?
A. Inform all the managers in the organisation that a fraud investigation has been commissioned and they are expected to cooperate with the investigators
B. Do not inform legal counsel at the beginning of the investigation, but can call upon him/her if faced with complex legal issues
C. Inform management and employees to make sure you get cooperation from everyone whose assistance may be required
D. None of the above (1 mark)
ANSWER: D
17. Which one of the following statements is ACCURATE in regard to limitation of conducting a public database search online?
A. Information from online databases can fully be relied on in terms of accuracy and currency
B. Online public records searches are not limited in the area they cover, therefore the fraud examiners do not need to search multiple jurisdictions
C. Online coverage of public records is similar in all jurisdiction
D. None of the above (1 mark)
ANSWER: D
18. Diana, a Certified Fraud Examiner, is conducting an admission-seeking interview of Don, a fraud suspect. Diana asks Don: “Didn’t you know that taking the organisation’s money without permission is wrong?” Which one of the following BEST describes this type of question?
A. Controlled ANSWER: technique
B. Alternative question
C. Accusatory question
D. None of the above (1 mark)
ANSWER: D
19. Which one of the following statements is ACCURATE in regard to data mining?
A. Data mining is an effective method of collecting digital evidence.
B. Data mining is the art of searching large volumes of data for patterns
C. Data mining can be used to modify raw data into understandable patterns
D. None of the above (1 mark)
ANSWER: D
20. Which one of the following statements is ACCURATE in regard to the volatility of digital evidence?
A. Digital evidence is not as volatile as tangible evidence because data cannot be altered or destroyed easily like tangible documents
B. Once the integrity of digital evidence has been violated through alteration or destruction, it can be easily restored using special forensic tools
C. Admissibility of digital evidence is more stringent than that of tangible evidence
D. None of the above (1 mark)
ANSWER: D
21. Which one of the following statements is NOT accurate in regard to audit, investigations or forensic audit?
A. Audits are conducted on a regular basis while forensic audits or fraud examinations are conducted on the basis of sufficient predication
B. Audits are general examination of financial data, while forensic audits and fraud investigations are conducted to resolve specific allegations
C. The objective of a forensic audit or fraud examination is to affix blame, while the objective of an audit is to express an opinion
D. The presumption of a forensic audit or fraud examination is proof, to prove the allegations of fraud, while that of an audit is professional skepticism (1 mark)
ANSWER: D
22. Which one of the following is a data analysis tool that can be effective in conducting money laundering investigations?
A. Link Analysis
B. Benford Law
C. Textual Analysis
D. Link Diagram (1 mark)
ANSWER: A
23. Which one of the following questions BEST describes the first question an interviewer should ask after the introduction of an admission seeking interview?
A. Accusatory question
B. Alternative question
C. Assessment question
D. Open ended question (1 mark)
ANSWER: A
24. Which one of the following is the fraud examiner’s primary concern data analysis phase?
A. To protect disclosure of the evidence
B. To Protect the availability of evidence
C. To Protect the confidentiality of the evidence
D. None of the above (1 mark)
ANSWER: D
25. Which one of the following statements is a good example of an accusatory question?
A. You are the payables accountant right?
B. Did you take the money because you wanted extra money or you had an emergency?
C. Didn’t you know that what you were doing is not right?
D. None of the above (1 mark)
ANSWER: D
26. When a fraud examiner is documenting the findings of a fraud investigation, the fraud examiner CANNOT express an opinion on which of the following areas?
A. Whether the entity’s financial transactions were recorded in accordance with accounting standards
B. The effectiveness of the organisation’s internal controls
C. The responsibility for the suspect on the alleged matters
D. The liability of the suspect (1 mark)
ANSWER: D
27. Which one of the following is NOT an objective of conducting textual analytics in fraud investigation?
A. To identify red flags of employees through their communications
B. To reveal patterns, sentiments, and red flags of fraud
C. To use unstructured data to identify red flags of fraud
D. To detect any deficiencies in the internal control system (1 mark)
ANSWER: D
28. Which one of the following statements is NOT accurate in regard to the introductory phase of a forensic audit interview?
A. In a forensic audit interview, it is the responsibility of the interviewer to establish rapport
B. In a forensic audit interview it is the responsibility for the interviewer to establish the specific purpose of the interview
C. In a forensic audit interview it is the responsibility for the interviewer to establish the purpose of the interview in general but not the specifics
D. In a forensic audit interview, it is the responsibility for the interviewer to make sure that they get commitment for assistance from the suspect (1 mark)
ANSWER: B
29. Which one of the following statements is NOT accurate in regard to forensic audits?
A. Every forensic audit should begin with the assumption that the case will end in court
B. Forensic audit is a methodology of resolving fraud issues from inception to disposition
C. A forensic audit should be approached from the perspective, that fraud has occurred, and collect evidence to prove the allegations
D. The conclusion of a forensic audit, should be clear as to whether the suspect committed the offence or not
(1 mark)
ANSWER: C
30. A public officer is accused of engaging in bribery in the course of his duty. During an admission-seeking interview of the officer, the investigator states: “This is a big organisation with a lot of resources. The funds you took are not significant and would not affect the finances of the organisation Is that right?” This interviewing technique is known as:
A. Diffusing Alibi
B. Depersonalisation
C. Altruistic appeals
D. Rationalisation (1 mark)
ANSWER: B
31. Pollyne is a Certified Fraud Examiner. She conducted an admission-seeking interview of Peace, a fraud suspect. Pollyne helps Peace to justify her fraudulent activities establishing a theme that she did not get a promotion that she well deserved and that is why she engaged in the fraudulent activity out of frustration. Peace refused to accept this theory. How should purity proceed?
A. Ask another question
B. Ask an open-ended question
C. Ask an alternative question
D. Introduce another reason (1 mark)
ANSWER: D
32. Which one of the following is the BEST method of acquiring digital evidence for investigation purposes?
A. Imaging the hard drive to acquire the data in its original form, i.e. date stamps
B. Printing the evidence record
C. Acquiring the digital evidence from the suspect
D. None of the above (1 mark)
ANSWER: A
33. Which one of the following statements refers to a common method used fraudsters to conceal illegally acquired assets?
A. Placing assets in probate
B. Selling the assets
C. Transferring assets
D. All the above (1 mark)
ANSWER: C
34. Which one of the following pieces of information should an interviewer not obtain from a suspect?
A. The approximate date when Stacie received the loan
B. Any items acquired with proceeds of the loan
C. Excuses that she did not know that the loan was a bribe
D. Moral excuses why she received the offer (1 mark)
ANSWER: C
35. Which one of the following statement is ACCURATE in regard to a well-written fraud investigation report?
A. The report should include technical professional language to demonstrate the investigator’s expertise on the subject matter
B. The report must be partial to ensure emphasis of the evidence to prove the allegations
C. The report should not mention individuals
D. The report must be impartial, based on the facts, whether they prove or disapprove the allegations
(1 mark)
ANSWER: D
36. Link Analysis is particularly useful when investigating which type of fraud scheme?
A. Bribery
B. Cash Skimming
C. Fraudulent payments to shell companies
D. Embezzlement (1 mark)
ANSWER: C
37. Which one of the following loan amounts should an investigator use to establish the amount of loan received?
A. Loan proceeds
B. Book loan amount
C. Principal and interest amount
D. Principal loan (1 mark)
ANSWER: A
38. Which one of the following statements is a step in the planning phase of the data analysis process?
A. Normalising and cleansing data
B. Identifying relevant data
C. Verifying data
D. Determining predication (1 mark)
ANSWER: D
39. It is general knowledge that when fraud suspects decide to confess, they tend to do one of the following as a way of releasing inner tension of their guilt and dishonest actions. Which one of the following statements BEST describe that tendancy
A. Provide a lower estimate of the amount of funds defrauded
B. Provide accurate number of incidences
C. Provide exact number of other individuals involved
D. Provide an accurate estimate of the amount of funds defrauded (1 mark)
ANSWER: A
40. During an admission-seeking interview Ted accuses a suspect of committing fraud. The suspect denies the accusation. Which one of the following methods should Ted NOT do to interrupt the denials?
A. Reason with the suspect
B. Discuss the inconsistent statements made the suspect
C. Try to reason with the suspect
D. Make an accusatory statement followed an accusatory question (1 mark)
ANSWER: C
41. Which one of the following is NOT one of those computer-generated files?
A. Application logs
B. Events logs
C. System logs
D. Word documents (1 mark)
ANSWER: D
42. Which one of the following statements is ACCURATE in regard to fraud investigation reports?
A. The conclusion part of the report should include the summary of the evidence
B. The conclusion part of the report should include the recommendations on actions to be taken based on the evidence collected
C. The recommendation part of the report should include recommendation on the actions to be taken based on the evidence collected
D. The scope section of the investigation should include all the terms of reference (1 mark)
ANSWER: A
43. Which one of the following is NOT a step a fraud examiner should consider before starting to conduct a computer investigation?
A. Whether there is a need to notify law enforcement
B. Running through the data to look for evidence
C. If there is need to engage an outside digital forensic expert
D. None of the above (1 mark)
ANSWER: B
44. Which one of the following statements is ACCURATE in regard to volatility of digital evidence?
A. Integrity of digital evidence if violated through manipulation or destruction can be restored using forensic tools
B. Digital evidence is more volatile than tangible evidence because data can be easily altered and destroyed
C. Failure to preserve the integrity of the digital evidence could result to evidence being inadmissible in a court of law
D. Tangible evidence is more volatile than digital evidence because data cannot be easily altered and destroyed (1 mark)
ANSWER: B
45. Which one of the following statements is NOT a reaction expected from a culpable person when directly accused an interviewer?
A. Weak denials
B. Responding to the questions with a question
C. Over respectful
D. Be very angry when directly accused (1 mark)
ANSWER: D
46. Which one of the following terminologies would be indicative of pressure to commit fraud?
A. Deadline
B. Deserve
C. Write off
D. None of the above (1 mark)
ANSWER: A
47. Which one of the following statements is an example of natural number that can be used Benford law?
A. Telephone numbers
B. Vendors invoice numbers
C. Sales invoice numbers
D. All the above (1 mark)
ANSWER: B
48. Which one of the following terminologies is indicative of rationalisation to commit fraud that can be identified textual analytics?
A. Override
B. Write off
C. Entitled
D. All the above (1 mark)
ANSWER: C
49. Violet is an accountant at ABC Corp. She is a fraud suspect, and is scheduled for an admission-seeking interview. She arrived at the interview with his manager, and insisted that she wants the manager to be present in the interview. What should the interviewer do under the circumstances?
A. The interviewer should not conduct the interview
B. The interviewer should conduct the interview
C. The interviewer should not allow the manager into the interview
D. The interviewer should allow the manager into the interview (1 mark)
ANSWER: A
50. Which one of the following statements is ACCURATE in regard to closed questions in investigations professional interviews?
A. They are worded in a way that the respondent can ANSWER: “yes” or “no”.
B. They are worded in a way that the witness be able to make an admission
C. They are worded in a way that the witness will be able to provide more information
D. They are worded in a way that will maintain goodwill (1 mark)
ANSWER: A
SECTION II (50 MARKS)
51. Explain contents of the following sections of a fraud investigation report:
(a) Introduction. (5 marks)
(b) Scope. (5 marks)
(c) Recommendation. (5 marks)
(d) Conclusion. (5 marks)
(Total: 20 marks)
52. Citing relevant example in each case, identify FIVE questions that are used during information gathering interview.
(Total: 15 marks)
53. Explain FIVE differences between a “forensic audit” and “an audit”. (Total: 10 marks)
54. Identify FIVE characteristics of a good interview. (Total: 5 marks)
………………………………………………………………………………….