Fraud Examination 101

Review Questions
Lesson 1: Introduction

1. __________ are adversarial because they involve efforts to affix blame.

A. Audits
B. Methodologies
C. Fraud examinations
D. Presumptions

A. Incorrect. The audit process is not adversarial by nature.

B. Incorrect. A methodology is the way by which a process is conducted; it is not necessarily adversarial.
C. Correct. Fraud examinations are inherently adversarial because they seek to affix blame.
D. Incorrect. A presumption is an idea or attitude that a prescribed scenario is true, whether it actually
is or not, from the outset of a particular chain of events.

2. Audits are conducted primarily by examining which of the following?

A. Public records
B. Financial data
C. Interviews
D. Documents

A. Incorrect. Public records are examined in the course of fraud examinations.

B. Correct. While other information is sometimes necessary, audits chiefly involve the examination of
financial data.
C. Incorrect. Interviews are conducted and reviewed as a part of the fraud examination process.
D. Incorrect. Documents of various kinds are used during the fraud examination process, while financial
data are primarily used during the audit process.

Lesson 2: Axioms of Fraud Examination

3. The existence of fraud is solely within the purview of which of the following?
A. Courts and investigators
B. Law enforcement and courts
C. Investigators and law enforcement
D. Courts and juries
A. Incorrect. While the courts are very much involved in determining the guilt or innocence of a person
or party, the investigator must remain neutral to the formal determination of fraud.
B. Incorrect. While the determination of guilt is within the purview of the courts, law enforcement’s role
is different.
C. Incorrect. Investigators and law enforcement are both meant to remain indifferent to the
determination of guilt.
D. Correct. Courts and juries make the determination as to the guilt of a person or party.

4. The concept that in order to establish a fraud has occurred, the proof must include attempts to
prove it has not occurred, is known as ________.
A. Predication
B. Existence of fraud
C. Reverse proof
D. Concealment

A. Incorrect. Predication is the concept that one must have a sufficient justification to begin an
investigation.
B. Incorrect. The existence of fraud relates to the determination as to whether a person or party is
guilty or innocent. The existence of fraud is determined not by the examiner, but by courts and juries.
C. Correct. Reverse proof is necessary to establish that fraud occurred because both sides of fraud must
be examined. Under law, proof of fraud must preclude any explanation other than guilt.
D. Incorrect. Concealment relates to the intentional obfuscation of the poof of fraud, not a concept
related to establish a fraud’s occurrence.

5. The totality of circumstances that would lead a reasonable, professionally trained, and prudent
individual to believe a fraud has occurred, is occurring, or will occur is known as ________.
A. Declaration
B. Fraud theory
C. Predication
D. Suspicion

A. Incorrect. Declaration is not the set of circumstances that would lead a reasonable person to believe
fraud is occurring.
B. Incorrect. The fraud theory approach is the uniform method used by a fraud examiner in
investigating the alleged wrongdoing. Fraud theory begins with an assumption, based on known
facts, of what might have occurred. Then, that assumption is tested to determine whether it is
provable.
C. Correct. Predication is the totality of circumstances that would lead a reasonable, professionally
trained, and prudent individual to believe a fraud has occurred, is occurring, or will occur.
D. Incorrect. While suspicion may be present in any alleged fraud, this is not the term used to describe
the totality of circumstances that would lead a reasonable, professionally trained, and prudent
individual to believe a fraud has occurred, is occurring, or will occur.
Lesson 3: The Purpose of the Fraud Examination

6. When a Certified Fraud Examiner begins a fraud examination, he must assume which of the
following?
A. The suspect is innocent
B. The suspect is guilty
C. The case will end in litigation
D. None of the above

A. Incorrect. The fraud examiner should not express nor assume the innocence of any individual. While
the examiner may hypothesize about what truly happened and who was involved, this hypothesis
should be based on evidence obtained and not on an unfounded assumption.
B. Incorrect. The fraud examiner should not express or assume the guilt of any individual. While the
examiner may hypothesize about what truly happened and who was involved, this hypothesis should
be based on evidence obtained and not on an unfounded assumption.
C. Correct. When a fraud examiner begins an examination, it is essential that the assumption be
maintained throughout the investigation that the case will end in litigation. If the examiner assumes
litigation as the final step, then he will conduct the examination in accordance with the proper rules
of evidence and remain well within the legal guidelines established by the civil and criminal court
systems.
D. Incorrect. One of the answers provided is correct.

7. Which of the following is a common element of a white-collar crime?

A. Intent to commit a wrongful act
B. Misrepresentation necessary to accomplish the scheme
C. Concealment of the crime
D. All of the above

A. Incorrect. The intent to commit a wrongful act must be shown in fraud matters. Intent is rarely self-
evident and must be demonstrated by showing a pattern of activity. However, this is not the best
answer for this question.
B. Incorrect. The misrepresentation used to accomplish the scheme is one of the elements of a white-
collar crime. This disguise of purpose is usually shown by the fact that a representation was made
and that it was false, either by omission or commission. However, there is a better answer to this
question.
C. Incorrect. Concealment of the offense is a cornerstone of white-collar crimes. As opposed to
traditional crimes, where there is no effort to conceal, fraud perpetrators take steps to keep the
victim ignorant. However, this is not the best answer for this question.
D. Correct. While it is not possible or necessary to list every variation of white-collar crime and fraud, all
have common elements, including intent, misrepresentations employed by the perpetrator to
accomplish the scheme, reliance by the offender on the ignorance or carelessness of the victim,
voluntary victim action, and concealment of the offense.
Lesson 4: Deciding Whether to Conduct an Investigation

8. In which of the following scenarios would the management of an organization want to conduct an
internal investigation?
A. When management wants to dismiss an employee who it believes has committed fraud
B. When federal laws require the organization to report specific instances of misconduct
C. To ensure that all relevant facts are known and reported to the SEC as part of required financial
reports
D. All of the above

A. Incorrect. When management suspects that employee wrongdoing is present, an internal

investigation should be conducted before dismissing an employee believed to have committed fraud.
However, there is a better answer to this question.
B. Incorrect. Some federal laws, such as the Sarbanes-Oxley Act and the Foreign Corrupt Practices Act,
require companies to report specific instances of misconduct, prompting companies to initiate
internal investigations into any potential wrongdoing. However, this is not the best answer to this
question.
C. Incorrect. Some regulatory agencies, such as the Securities and Exchange Commission (SEC), require
accurate financial reporting by the companies they oversee, compelling companies to conduct
internal investigations to ensure that all relevant facts are known and reported. However, there is a
better answer to this question.
D. Correct. The need for an internal investigation can arise in a number of circumstances, including
when management wishes to dismiss an employee who it believes has committed fraud; when
federal laws, such as the Sarbanes-Oxley Act and the Foreign Corrupt Practices Act, require
companies to report specific instances of misconduct; and when the company must ensure that all
relevant facts are known and reported to appropriate regulatory bodies as part of its financial
reports.

Lesson 5: Characteristics of a Fraud Examiner

9. The fraud examiner typically meets with people for a short period of time for what specific purpose?
A. Determine guilt
B. Obtain information
C. Establish rapport
D. Determine innocence
A. Incorrect. While the examiner might postulate a theory regarding a subject’s guilt or innocence, it is
not the role of the examiner to make a determination.
B. Correct. The fraud examiner must use his skills to elicit as much information as possible in the brief
time available to meet with each subject.
C. Incorrect. While establishing rapport is a critical element of the process, the specific purpose of a
meeting is to obtain information.
D. Incorrect. While the examiner might postulate a theory regarding a subject’s guilt or innocence, it is
not the role of the examiner to make a determination.

Lesson 6: Selecting the Investigative Team

10. Which of the following should NOT be included as part of the “fraud team” assembled to investigate
a possible fraud?
A. Legal counsel
B. Suspect’s supervisor
C. Auditors
D. Management representative

A. Incorrect. It is necessary to have legal counsel involved in and, in most cases, “directing” the fraud
investigation, at least as far as the legal aspects are concerned.
B. Correct. Fraud examinations usually require a cooperative effort among different disciplines. A
typical investigation team might include the following: Certified Fraud Examiners, auditors, security
personnel, human resources personnel, management representatives, outside consultants, and legal
counsel. At least in the initial stages of the investigation, there would be no need to include the
employee’s direct supervisor, especially when it is not known if the supervisor might be involved.
C. Incorrect. During a fraud examination, internal auditors are often used to review internal
documentary evidence, evaluate tips or complaints, schedule losses, and provide assistance in
technical areas of the company’s operations.
D. Incorrect. A representative of management, or in significant cases, the audit committee of the board
of directors, should be kept informed of the progress of the investigation and be available to lend the
necessary assistance. A sensitive employee investigation has little hope of success without strong
management support.

11. Auditors are frequently the people who uncover __________________ that lead to
__________________.
A. Documents from third parties; field work
B. Rights violations; lawsuits
C. Financial anomalies; fraud investigations
D. Threats of reprisals; hiring outside specialists
A. Incorrect. Security personnel, not auditors, are typically tasked with obtaining documents from third
parties and conducting field work.
B. Incorrect. The input of human resources personnel, not auditors, is often necessary to avoid lawsuits
stemming from violating the rights of employees.
C. Correct. Internal auditors are often used to review internal documentary evidence, evaluate tips or
complaints, schedule losses, and provide assistance in technical areas of the company’s operations.
They are expected to be able to identify fraud indicators and notify management if an investigation
is required.
D. Incorrect. Outside consultants are sometimes hired to avoid company politics and threats of
reprisals, particularly in cases involving powerful members of the organization.

Lesson 7: Planning the Investigation

12. In most internal fraud examinations, which of the following individuals should be primarily
responsible for directing the investigation?
A. The organization’s attorney
B. The head of the human resources (HR) department
C. The partner in charge of the external audit team
D. The suspected perpetrator’s direct supervisor

A. Correct. It is crucial to have counsel involved in and, in most cases, “directing” the investigation, at
least as far as the legal aspects are concerned. An internal investigation can be a veritable hornets’
nest of legal questions. The investigation team must have legal counsel on hand to sort out these
questions. Otherwise, the company risks exposing itself to a greater danger than the threat it is
investigating.
B. Incorrect. Although the human resources (HR) department should be consulted to ensure that the
laws governing the rights of employees in the workplace are not violated, the head of HR should
generally not be designated as the leader of internal fraud investigations.
C. Incorrect. While the company’s independent auditors may uncover and help investigate alleged
internal fraud, the partner in charge of the external audit team is generally not the best individual to
direct a fraud examination.
D. Incorrect. While an internal investigation has little hope of success without strong management
support, it is generally not appropriate to designate the perpetrator’s supervisor as the leader of the
fraud examination team. Until it is clear who is involved in the wrongdoing and how far up the chain
of command knowledge of the fraud reaches, the employee’s supervisor should be used as an
information source, rather than as the director of the investigation.
Lesson 8: Fraud Examination Methodology

13. When developing a hypothesis, the examiner should ask himself, based on the allegation, which of
the following?
A. What is the worst possible outcome?
B. What is the best possible outcome?
C. What is the least likely outcome?
D. What is the most likely outcome?

A. Correct. The hypothesis is typically a worst-case scenario that can be created to suit any allegation.
B. Incorrect. The hypothesis is not based on the best possible outcome.
C. Incorrect. The hypothesis is not based on the least likely outcome.
D. Incorrect. The hypothesis is not based on the most likely outcome.

14. In the fraud theory approach to fraud examination, it is necessary that the fraud examiner perform
all of the following tasks, EXCEPT:
A. Analyze the available data
B. Create a hypothesis
C. Report the hypothesis to management
D. Refine and amend the hypothesis

A. Incorrect. Analyzing available data is one of the necessary tasks in the fraud theory approach to
fraud examination.
B. Incorrect. Creating a hypothesis is another of the necessary tasks in the fraud theory approach to
fraud examination.
C. Correct. According to the text, reporting the hypothesis to management is not one of the steps in the
fraud theory approach.
D. Incorrect. According to the fraud theory, fraud examiners must refine and amend their hypothesis
throughout the course of the investigation.

15. After predication has been established, the specific steps of a fraud examination should unfold in
which order?
A. Collecting and analyzing documents; interviewing witnesses; writing reports; dealing with
prosecutors and the courts
B. Collecting and analyzing documents; interviewing witnesses; dealing with prosecutors and the
courts; writing reports
C. Interviewing witnesses; collecting and analyzing documents; writing reports; dealing with
prosecutors and the courts
D. Interviewing witnesses; collecting and analyzing documents; dealing with prosecutors and the
courts; writing reports
A. Correct. Fraud examination methodology requires that all fraud allegations be handled in a uniform,
legal fashion, as listed in this answer choice.
B. Incorrect. Reports should be written before dealing with prosecutors and the courts.
C. Incorrect. Collecting and analyzing documents should occur before interviewing witnesses.
D. Incorrect. Collecting and analyzing documents should occur before interviewing witnesses, and
reports should be written before dealing with prosecutors and the courts.

Lesson 9: Evidence Collection and Examination

16. Throughout the document collection and examination phase, the fraud examiner should consider
which of the following?
A. The location of any additional documents necessary to complete the examination
B. A list of witnesses who can confirm or refute the information contained in the documents
C. Other experts that might examine or analyze the documents
D. All of the above

A. Incorrect. The fraud examiner should consider the location of any additional documents needed to
complete the examination, including internal and external sources of the evidence. However, this is
not the best answer for this question.
B. Incorrect. Documents do not make a fraud examiner’s case; witnesses do. Therefore, the examiner
should consider who, if anyone, might confirm or refute the information contained in the documents.
However, there is a better answer to this question.
C. Incorrect. In some circumstances, experts—such as forensic document analysts—should be consulted
to obtain additional data from documentary evidence. Throughout the document collection phase,
the fraud examiner should consider whether the use of such experts would enhance his case.
However, this is not the best answer to this question.
D. Correct. During the document collection phase of the examination, there are many tasks that will
become apparent based on the information contained in the documents. The examiner should
consider the location of any additional documents necessary to complete the examination, a list of
additional information needed from witnesses, a list of witnesses who can confirm or refute the
information contained in the documents, and other experts who might examine or analyze the
documents.

Lesson 10: Interviewing

17. In a typical fraud examination, who should be interviewed last?

A. Co-conspirators
B. The accused
C. Neutral third-party witnesses
D. Interview order is not important
A. Incorrect. Co-conspirators should be interviewed after neutral third-party witnesses but before the
accused because they were involved in the case, but were not the most involved party in the case.
B. Correct. The last person to be interviewed should be the accused due to the fact that he had the most
involvement in the case.
C. Incorrect. Those least involved should be interviewed first. Neutral third-party witnesses should be
interviewed first due to the fact that they were not directly involved in the case.
D. Incorrect. The order of interviews should be based on the witness’s degree of involvement in the
case; therefore, the order in which interviews take place is important.

18. When conducting a fraud examination, who should generally be interviewed first?
A. Neutral third-party witnesses
B. Suspects
C. Corroborative witnesses
D. Co-conspirators

A. Correct. Once the document completion phase of the examination is completed, the next step is to
interview the neutral third-party witnesses. Since the examiner will gain information that can be
used to question subsequent witnesses, they should be approached in the order of least
knowledgeable to most knowledgeable.
B. Incorrect. The admission-seeking interview of the suspect is the last phase of the examination
process. This interview should not be attempted until all of the previous steps have been completed.
C. Incorrect. Corroborative witnesses should be interviewed after neutral third-party witnesses; this will
allow the examiner to confirm the relevant facts obtained from the document examination and the
interviews of neutral third-party witnesses.
D. Incorrect. After collecting relevant documents and interviewing neutral third-party witnesses and
corroborators, the examiner should move on to interviewing potential co-conspirators.

Lesson 11: Emerging Technological Trends

19. Difficulty determining jurisdiction of storage is a challenge faced by fraud examiners when
investigating:
A. Employee-owned devices
B. Data stored in the cloud
C. Social media
D. Memory cards
A. Incorrect. Challenges faced by examiners when investigating employee-owned devices include
convincing employees to subject personal devices to examination, identifying relevant sources of
information on a given device, determining who has control over the data on employee devices, and
preserving and collecting data from personal devices.
B. Correct. Challenges faced by examiners when investigating the cloud include lack of physical access,
lack of data control, jurisdiction of storage, preserving chain of custody, and lack of knowledge about
storage.
C. Incorrect. Challenges faced by examiners when investigating social media include determining which
social media sites are in use by individuals involved in a case, navigating or searching different types
of social media sites, the use of aliases rather than birth names on social media sites, and evolving
legalities regarding the use of employee information gleaned from social media.
D. Incorrect. Difficulty determining jurisdiction of storage is a challenge faced by fraud examiners when
investigating data stored in the cloud.