How do I distinguish skimming from cash larceny?

Ask whether the organization recorded the receipt before the money disappeared. Skimming diverts a receipt before it enters the books, so a bank-to-ledger reconciliation alone may miss it. Cash larceny takes money after recording, creating a shortage between recorded receipts and the cash deposited or counted. In either case, compare independent source records, such as orders, customer confirmations, register logs, and bank deposits.

When does an unusual transaction become a fraud finding?

An exception establishes a question, not intent or responsibility. Form a testable explanation, preserve the relevant records, compare them with independent evidence, and seek reasonable alternative explanations. For example, repeated payments just below an approval limit might reflect split purchasing, but they might also reflect separate legitimate orders. A report should distinguish confirmed facts, supported inferences, and unresolved issues.

What is the difference between inherent and residual fraud risk?

Inherent risk is the exposure before considering controls; residual risk is what remains after assessing whether controls are well designed and actually operate. A payment process may have high inherent risk because one user can propose large transfers. Dual approval can reduce that risk only if approvals are independent, cover the relevant payments, and cannot be bypassed. Residual risk then guides the decision to mitigate further, accept, transfer, or avoid the activity.

Certified Fraud Examiner (CFE) Study Guide

Start with concept 1 Choose a topic

Fraud examination connects three kinds of judgment. First, you need to understand how a scheme moves money, assets, or information and which records should reveal it. Next, you need to turn a credible concern into a fair, documented investigation that preserves evidence and respects the law that applies where the work occurs. Finally, you need to assess why controls failed and choose a response that reduces the remaining risk. This guide follows those decisions across the CFE’s three separate sections. Its examples use stated facts so you can practice classifying a transaction, reconciling figures, testing an explanation, or selecting a control. A warning sign is a reason to investigate; it is not, by itself, a finding of fraud.

Fraud Schemes and Financial Crimes

1. Read the three financial statements together

Start with the balance sheet equation: assets equal liabilities plus equity. Profit increases equity when revenue exceeds expenses, but it does not necessarily increase cash in the same period. Under accrual accounting, a qualifying credit sale creates revenue and a receivable; collecting that receivable later changes one asset into another without creating revenue again. The income statement explains performance, the balance sheet shows what remains owed or owned, and the cash flow statement explains cash movements. When profit and operating cash diverge, reconcile receivables, payables, inventory, and other working capital accounts before alleging manipulation. Apply the accounting framework used by the entity, such as IFRS or the relevant GAAP, when deciding whether a transaction meets recognition and measurement rules. The current CFE content outline includes these accounting distinctions.

Worked example: Assume a business starts with no balances, makes a qualifying credit sale of 100 currency units, and pays 60 currency units of related expenses immediately. Revenue is 100, expense is 60, and profit is 40. Cash changes by negative 60, while receivables rise by 100; net assets and equity rise by 40. Collection later adds 100 to cash and removes the 100 receivable. Check collectibility before interpreting the initial cash shortfall.

Watch the distinction: A profitable credit sale is not automatically a cash inflow. Treating revenue as cash would hide collection delays and could make an ordinary accrual look fraudulent.

Reference: [3]

2. Spot financial statement manipulation

Financial statement manipulation can overstate revenue, defer or omit expenses, misstate assets or liabilities, or conceal material information in disclosures. Classify the suspected mechanism before choosing a test: premature revenue calls for contract and cutoff evidence; understated expenses call for subsequent invoices and unpaid obligations; inflated assets call for existence and valuation work. Horizontal analysis compares amounts across periods, while vertical analysis expresses an item as a share of a base such as sales. Ratios expose relationships, but a change is only a lead. Growth, credit terms, seasonality, acquisitions, and collection trouble can produce similar patterns. Compare the accounting entry with the underlying transaction and later cash receipts. The Fraud Schemes and Financial Crimes guide provides a focused place to practice these classifications.

Worked example: Suppose hypothetical sales increase from 1,000 to 1,300 currency units: the change is 300 ÷ 1,000 = 30%. Receivables rise from 200 to 390: 190 ÷ 200 = 95%. Receivables also grow from 20% to 30% of sales. Examine year-end sales, customer acceptance, revised payment terms, and subsequent receipts. The gap suggests a recognition or collection question, but neither explanation is established by the ratios alone.

Watch the distinction: A worsening receivables ratio does not prove fictitious sales. Genuine customers may pay later after a change in terms; transaction evidence determines the cause.

Reference: [3]

3. Trace missing cash receipts

The point at which cash disappears determines the likely scheme and the useful comparison. Skimming removes a receipt before it enters the accounting records, so the ledger may appear to balance with deposits. Look outside the ledger for customer copies, order records, numbered receipts, point-of-sale data, and confirmations. Cash larceny removes money after it has been recorded. There, compare recorded receipts with tills, deposit slips, bank credits, and custody logs. A shortage can also arise from a delayed deposit, posting error, or authorized adjustment, so align dates and trace each receipt through the entire path. Separate the people who receive, record, reconcile, and deposit funds where possible. Investigators should preserve original receipt sequences and investigate gaps rather than simply matching ledger totals to bank deposits.

Worked example: A customer presents a receipt for 80 currency units. The sales ledger records 80, but the bank deposit includes only 50 from that transaction. The recorded shortage is 80 − 50 = 30, consistent with possible cash larceny. If the ledger instead records 50, compare the customer's 80 receipt and any adjustment record; the unrecorded 30 raises a skimming question. Check deposit timing and corrections in either case.

Watch the distinction: A balanced ledger and deposit do not rule out skimming. If a receipt was never fully recorded, both internal figures can agree while the customer's evidence disagrees.

Reference: [3]

4. Classify register and payment tampering

A false refund or void makes the register appear to release or cancel money without a valid customer transaction. Test it against the original sale, returned goods, customer acknowledgment, inventory movement, and the staff member who approved it. Payment tampering changes a legitimate disbursement after authorization, commonly by altering the payee, bank details, amount, or payment instrument. The purchase may be real, which makes invoice matching alone insufficient. Compare approved beneficiary details with the payment instruction and bank settlement record, and inspect who could edit those fields. Callback verification should use a contact already held independently, since a compromised message can supply its own false telephone number. For either pattern, determine where authority failed and whether an apparent exception was reversed or corrected.

Worked example: A cashier records a hypothetical 45-currency-unit refund, but there is no return, original sale reference, or restocked item. That supports testing a register disbursement. Separately, a valid supplier invoice and approval total 450 currency units, yet payment goes to a newly substituted account. The 450 debt may be genuine; the beneficiary change is the payment-tampering clue. Compare master-data history with bank instructions.

Watch the distinction: A valid invoice does not validate the destination of payment. Conversely, a suspicious register refund should be tested against the underlying sale and return, not merely its approval code.

Reference: [3]

5. Test suspicious supplier invoices

Billing schemes can involve a fictitious supplier, a real supplier that inflates charges, or a legitimate vendor used for an employee's personal purchase. Begin with the vendor master: creation date, address, bank account, ownership, tax details, and the users who entered or changed them. Then perform a three-way comparison of purchase authorization, evidence of receipt, and invoice, allowing for services where completion evidence replaces a delivery note. Repeated invoice numbers, vague descriptions, split orders, and employee-linked contact details are useful exceptions. An address match may reflect a shared office or data-entry convention; it is not proof of ownership. Verify the supplier through an independent source and ask whether goods or services were actually received, priced as agreed, and used for the organization's purpose.

Worked example: A newly added supplier submits hypothetical invoices of 900, 950, and 980 currency units. Their total is 900 + 950 + 980 = 2,830. Its address matches an employee's address, and no receiving records support the purchases. Review who created the vendor, confirm its ownership independently, and seek delivery or service evidence. The amounts and address justify inquiry but do not establish a shell company.

Watch the distinction: Three small invoices do not by themselves show deliberate splitting, and a shared address does not prove control. Link the payments to authorization, receipt, and beneficial ownership.

Reference: [3]

6. Reconcile payroll to real work

Payroll fraud can add a nonexistent worker, exaggerate a real worker's hours, or inflate commissions by manipulating qualifying sales. Join personnel records, approved schedules or time data, payroll changes, and bank payment details using stable identifiers. For a ghost employee, test hiring evidence, work output, manager knowledge, and whether multiple workers share an account or contact details. For excess hours, identify who entered, approved, and changed time records; compare site access or production data where appropriate. For commissions, reconcile credited sales to contracts, cancellations, returns, and the plan's earning rules. A mismatch may be caused by overtime, leave, delayed posting, or a lawful adjustment, so calculate the variance under the actual pay rules before assigning a loss. Review both the recipient and control path.

Worked example: Assume an hourly rate of 25 currency units with no overtime premium. Payroll pays 160 hours × 25 = 4,000, but independently approved records show 120 hours × 25 = 3,000. The difference is 40 hours and 1,000 currency units. Check whether an authorized correction exists, then trace who entered and approved the extra hours and which account received payment.

Watch the distinction: A payroll-to-timesheet difference is an exception, not automatically a ghost employee. A real worker can have falsified hours, while legitimate adjustments can also change pay.

Reference: [3]

7. Examine expense reimbursements

Expense reimbursement schemes differ by what is false. A duplicate claim repeats a genuine expense; an overstated claim raises its amount; a fictitious claim invents the transaction; a personal claim shifts a private cost to the organization. Match merchant, date, amount, receipt image, trip purpose, and payment history rather than relying on a claimant's label. A changed currency, split bill, credit, or resubmission after rejection can make records look alike without creating a second payment. Trace the reimbursement to the employee and check whether any earlier payment was reversed. For overstated charges, compare the claim with the merchant's final invoice and actual card settlement. For personal use, identify the business purpose and attendees. A useful control joins receipt matching with independent approval of purpose and exceptions.

Worked example: An employee receives 240 currency units for a hotel receipt in one month and submits the identical image in the next. A second payment of 240 makes total reimbursement 480 for one documented 240 charge. Check the merchant date, card settlement, and payment ledger for a separate stay or reversal. If neither exists, the second 240 is the unsupported amount to investigate and potentially recover.

Watch the distinction: Two copies of one receipt do not always mean two payments. A rejected claim may have been resubmitted, so confirm settlement before calculating duplicate reimbursement.

Reference: [3]

8. Reconcile inventory movement

An inventory roll-forward starts with opening units, adds receipts and returns, then subtracts shipments, consumption, and approved write-offs. Compare that expected balance with a count taken at a clearly documented cutoff. A difference may reflect theft, but also unposted goods movements, miscounts, unit-of-measure errors, damaged stock, or goods held for another party. Recount the item, inspect nearby locations, and match receiving and shipping documents around the count date. Access records and unusual adjustments help identify who could move or conceal stock, while serial numbers strengthen tracing for individually identifiable assets. Separate quantity from value: seven missing units do not establish a monetary loss until ownership, cost basis, and recoverability are known. Restrict inventory adjustments and independently review recurring variances.

Worked example: A hypothetical warehouse begins with 70 units, receives 50, and ships 90 before the count cutoff. Expected stock is 70 + 50 − 90 = 30 units. The count shows 23, so seven units remain unexplained. Recount and check late shipment postings, write-offs, and ownership records. If the seven are still missing, investigate access and movement; no currency loss can be calculated without a supported unit value.

Watch the distinction: A count shortfall is not automatically theft. Timing and counting errors can produce the same variance, and the book quantity must include every authorized movement.

Reference: [3]

9. Separate bribery, conflicts, and extortion

A conflict of interest exists when a decision maker's undisclosed private interest could affect an organizational decision. Bribery concerns an improper benefit exchanged for influence, while economic extortion involves coercive pressure to obtain a benefit. The patterns can overlap: a buyer might own part of a vendor and also receive concealed payments. Trace ownership, bids, decision records, pricing, and the flow of value rather than classifying by a single suspicious relationship. Benefits may move through relatives, consulting agreements, inflated invoices, gifts, or third-party entities, so identify both legal and beneficial recipients. A favorable bid alone is not proof of misconduct; compare objective selection criteria and departures from normal review. The relevant bribery or extortion offense and required intent depend on the governing jurisdiction.

Worked example: A buyer approves a supplier while secretly holding a 20% interest in it, establishing an apparent undisclosed conflict. If the supplier also pays the buyer 5,000 currency units contingent on winning, test a bribery exchange. If the buyer demands 5,000 under threat of blocking an otherwise qualified bid, test extortion. Preserve ownership records, messages, bid scoring, and payment trails to distinguish the conduct.

Watch the distinction: An undisclosed interest does not by itself prove a bribe. Look for a benefit linked to influence; a demand backed by a threat raises a distinct extortion issue.

Reference: [3]

10. Investigate data and intellectual property theft

Competitive intelligence uses information obtained lawfully, such as public filings, published research, or authorized market interviews. Theft of data or intellectual property involves unauthorized access, copying, disclosure, or use of protected information. For an insider, compare assigned access rights with actual downloads, unusual timing, removable media, cloud uploads, and any business task that explains the activity. For a cyberattack, preserve authentication, endpoint, and network evidence; for social engineering, inspect messages and changes in account access. A large export can be legitimate during migration, so test authorization, destination, and subsequent use. Focus on the information's sensitivity and control, not merely whether it has a file label. Limit access to needed records and preserve metadata so later analysis can reconstruct events accurately.

Worked example: An employee exports a restricted customer list to personal cloud storage at 23:00 after their project access has ended. A competitor separately purchases a public industry report. The export suggests unauthorized removal; the report purchase does not. Preserve the file hash, access logs, upload destination, and project permissions, then ask whether any approved work required that transfer. The late hour alone does not prove theft.

Watch the distinction: Information about a competitor is not automatically stolen intellectual property. Its source, access rights, and method of acquisition determine whether the conduct is authorized.

Reference: [3]

11. Recognize identity misuse

Identity misuse differs by where the false identity enters. Stolen identity uses another real person's information; synthetic identity combines real and invented attributes to create an apparently separate person; account takeover uses access to an existing account without its owner's authority. Phishing may capture credentials, and manipulated audio or images may persuade staff to bypass verification. Compare application history, identifier ownership, device patterns, contact changes, and transaction sequence. A real identification number paired with a new name warrants verification but could also be a clerical error. For account changes, confirm with the customer through a channel established before the suspicious request; the same compromised email is not independent confirmation. Use CFE practice questions to rehearse classification by the point of misuse.

Worked example: A hypothetical loan applicant gives a valid identification number belonging to someone else but invents a name, address, and contact history. That combination suggests a synthetic identity and calls for checking identifier ownership and application links. Separately, an existing customer's valid login changes a payout account shortly after a phishing message. That sequence suggests account takeover; verify the change through the customer's previously recorded telephone number.

Watch the distinction: A successful login does not prove the account owner acted. Stolen credentials can authenticate a takeover, so corroborate device, contact changes, and independent customer confirmation.

Reference: [3]

12. Assess financial institution fraud

Financial institution schemes can enter at account opening, credit assessment, or later account access. In a false loan application, the borrower or intermediary may alter income, collateral, occupancy, or identity information to obtain credit. New-account abuse can use a false or stolen identity to create an account for deposits, withdrawals, or laundering. Theft from an established customer's account instead requires examining authorization of specific withdrawals or transfers. Separate document authenticity from transaction authority: a genuine borrower may submit false earnings, while a genuine account may be accessed by someone else. Compare original source documents, employer or asset verification, device and login records, beneficiary changes, and customer instructions. Assess who supplied the false information and who benefited before attributing conduct to a borrower, employee, or outsider.

Worked example: A borrower requests a hypothetical 200,000-currency-unit loan and submits an income statement altered from 50,000 to 90,000 per year. The 40,000 difference points to application misrepresentation; verify the source statement and who changed it. Later, 8,000 leaves another customer's established account without confirmed instruction. That is a separate account-access inquiry requiring login, device, beneficiary, and customer evidence.

Watch the distinction: Not every bank loss is loan fraud. Identify whether false information affected credit approval, account opening, or authorization of a later transaction.

Reference: [3]

13. Follow the laundering process

Money laundering seeks to disguise the origin, ownership, or destination of proceeds. Placement introduces value into a financial or commercial channel; layering adds transactions that obscure the trail; integration presents the value as apparently legitimate wealth. These are analytical stages, not a required order. An asset purchase may occur early, and a front business can mingle illicit and genuine receipts while creating plausible revenue records. Transfers through nominees, trade invoices, real estate, virtual assets, or alternative remittance routes can change the form of value without changing its beneficial owner. Trace source, intermediary, beneficiary, economic purpose, and supporting trade or asset records. Reconcile amounts and timing, then investigate gaps or circular flows. A complex route can have legitimate reasons, so the stage label guides evidence collection rather than proving criminal origin.

Worked example: Assume 100,000 currency units of suspected illicit cash enter several intermediary accounts. Those accounts transfer a total of 100,000 through two companies, which then fund a property purchase. Deposits suggest placement, company transfers suggest layering, and property ownership suggests integration. Reconcile each movement and identify the people controlling the companies and property. The sequence describes a hypothesis; source-of-funds evidence must establish what the money represents.

Watch the distinction: A transaction does not become laundering simply because it crosses borders or uses several accounts. Test the source of funds, beneficial control, and economic purpose.

Reference: [3]

14. Apply anti-money-laundering controls

An anti-money-laundering program starts by identifying and understanding the customer, including beneficial owners where required, the expected activity, and the reason for the relationship. Ongoing monitoring compares actual transactions with that profile and considers counterparties, geography, speed, and transaction purpose. A mismatch triggers inquiry and documented assessment, not an automatic conclusion of crime. Suspicious activity reporting and large cash reporting are separate obligations whose forms, triggers, and confidentiality rules depend on jurisdiction. The FATF Recommendations provide an international framework, while local law sets enforceable duties. Structuring divides transactions to avoid scrutiny or reporting, but small transactions can be suspicious even without a proven threshold-avoidance purpose. Preserve the pattern and explanations, escalate through the institution's authorized process, and avoid alerting a subject where applicable law restricts disclosure.

Worked example: A customer describes modest local retail sales yet receives five hypothetical overseas payments of 8,000 currency units each from unrelated senders, then transfers 39,000 onward within a day. Incoming funds total 40,000, leaving 1,000 before fees or other activity. Review invoices, counterparties, ownership, and the reason for the rapid transfer. Assess reporting under the applicable jurisdiction; the 8,000 amounts alone establish no universal filing result.

Watch the distinction: Payments below an assumed threshold are not automatically safe. Monitoring considers the full pattern and customer profile, while actual reporting duties come from the relevant jurisdiction.

Reference: [3]

15. Evaluate securities misconduct

Securities misconduct is classified by the information or duty involved. Misleading disclosure omits or distorts facts investors need, including relevant nonfinancial claims. Insider dealing concerns trading while possessing material nonpublic information in circumstances covered by the applicable law. An unsuitable recommendation concerns whether an intermediary's advice fits the customer's objectives, risk tolerance, and other required facts. Registration concerns whether a person carrying on regulated intermediary activity has the required authorization. These issues can coexist but require different evidence. Build a timeline of information creation, access, public release, trades, recommendations, client profiles, and compensation. A losing investment is not itself proof of unsuitable advice, and trading before bad news is not enough without knowledge and legal duty. Identify the jurisdiction before applying a statutory label.

Worked example: A manager sells shares on Monday after receiving a confidential material loss report; the loss becomes public Thursday. Preserve access and trade timestamps to test an inside-information issue. Separately, an adviser recommends a volatile investment to a client whose documented goal is capital preservation. Compare the product's risks, the client's profile, and the adviser's disclosures. Neither the later price fall nor the client's dissatisfaction alone decides either case.

Watch the distinction: A bad return does not prove securities fraud. Determine whether disclosure was false, restricted information was used, advice breached a relevant duty, or registration was required.

Reference: [3]

16. Trace payment-channel fraud

Payment fraud is easier to diagnose by locating the failed authorization. Check fraud may alter the payee or amount on an instrument; card compromise may capture card data or credentials; electronic transfer fraud may substitute beneficiary instructions; prepaid-card abuse may exploit loading, activation, or redemption; account takeover may give an outsider control over a genuine payer's account. Compare the original obligation, approved payment details, final settlement, and identity of the person who changed instructions. A real invoice proves a debt may exist but does not prove the destination is authorized. Email compromise often preserves the correct amount while changing bank details, so independent callback is a strong check. Preserve message headers, master-data history, access logs, and bank records to distinguish deception from an authorized change.

Worked example: A supplier invoice requires a hypothetical payment of 6,000 currency units. After an email account is compromised, a revised message keeps the amount at 6,000 but changes the bank account. The amount difference is zero; the beneficiary difference is decisive. Call the supplier using a number held before the message, compare the original invoice with the revised instruction, and preserve headers and account-change logs before payment is released.

Watch the distinction: Matching payment amount to invoice amount does not validate a transfer. Fraudsters can leave the amount intact and redirect the beneficiary.

Reference: [3]

17. Distinguish insurance fraud patterns

Premium diversion occurs when an intermediary collects premiums but fails to remit them properly to the insurer; the policyholder may believe coverage is paid for while the insurer's ledger shows less or nothing. A false or inflated claim instead targets a payout by inventing a loss, exaggerating damage, or misrepresenting timing or eligibility. Identify each actor's role: policyholder pays for coverage, agent or broker may collect or arrange it, claimant seeks benefits, and insurer assesses and pays under the policy. Reconcile receipts, remittances, policy status, claim files, inspections, and prior loss records. Timing matters because damage that predates coverage may be outside a claim, subject to the applicable contract and law. An accounting delay or policy adjustment can also explain a premium mismatch, so confirm settlement before attributing diversion.

Worked example: A broker gives a policyholder a receipt for 1,200 currency units, while the insurer records only 900 received. The 300 difference needs reconciliation against fees, timing, and the broker's remittance records. In another file, a claimant requests 2,000 for damage documented before coverage began. Examine the policy terms, dated photographs, repair records, and inspection findings; that is a claim-validity question, separate from premium handling.

Watch the distinction: A premium discrepancy does not prove a false claim, and a questionable claim does not prove the intermediary diverted premiums. Trace the distinct money flows.

Reference: [3]

18. Analyze health care claims

Health care fraud can involve providers billing for services not delivered or misdescribing services, patients misusing identity or eligibility, and insurers or administrators improperly handling claims. Start by identifying who submitted the representation and who received the payment. Compare billed dates and codes with appointments, clinical records, access logs, patient confirmation, and remittance records. A scheduling log is incomplete evidence: walk-ins, rescheduled visits, and later chart corrections may explain a mismatch. Clinical records require careful handling because they contain sensitive information and may describe care that an examiner cannot independently judge. Investigate whether a service occurred and whether the billed description matches documentation; use qualified clinical review for medical necessity or coding judgments. Count exceptions separately from confirmed improper payments.

Worked example: A provider bills for ten hypothetical visits in one month, but appointment and facility-access records support only six. The initial exception is ten − six = four visits, or four ÷ ten = 40% of billed visits. Retrieve clinical documentation and seek appropriate patient confirmation for those four. A canceled appointment or incomplete access log could change the result, so the 40% figure is a screening measure, not a proven fraud rate.

Watch the distinction: An appointment mismatch is not proof that care never occurred. Verify clinical and patient evidence before classifying a billed visit as false.

Reference: [3]

19. Unpack consumer investment scams

Classify consumer scams by what draws in money and how promised gains are funded. An advance-fee scheme demands payment before a supposed benefit that does not arrive. Romance manipulation uses a claimed relationship to obtain transfers. A Ponzi operation pays earlier investors from later investors' contributions while representing the payments as investment returns. A pyramid rewards recruitment rather than sustainable sales to genuine customers. Crypto-based schemes may use tokens, wallets, or trading claims as the vehicle; the technology alone does not identify the fraud pattern. Trace deposits, actual investment activity, withdrawals, recruitment compensation, and promotional claims. Test whether external earnings could fund stated returns and whether participants can redeem balances. A displayed account balance is only a representation until underlying assets and payment ability are verified.

Worked example: A promoter receives a hypothetical 100 currency units from a new investor and sends 30 to an earlier investor as a stated return. Of that deposit, 100 − 30 = 70 remains before other outflows. If no investment earnings fund the 30, the flow supports a Ponzi hypothesis. If participants are chiefly paid for recruiting new contributors, examine a pyramid pattern instead. Trace all inflows and payouts before deciding.

Watch the distinction: Crypto use does not make every scam a Ponzi scheme. Determine whether returns come from later investors, recruitment rewards, genuine earnings, or a fabricated promise.

Reference: [3]

20. Find concealed insolvency assets

Insolvency fraud may conceal assets, transfer them for inadequate value, fabricate debts, or plan a business failure to defeat creditors. Liquidation generally realizes assets for distribution, while reorganization seeks to continue or restructure the business; roles and powers of trustees, liquidators, receivers, administrators, and courts differ by jurisdiction. Build an asset schedule from accounting records, title documents, bank activity, inventory, and related-party disclosures. For a suspect transfer, compare timing, market value, consideration received, business purpose, and the transferee's connection to insiders. An undervalued sale is a warning, but distressed assets can genuinely sell at a discount. Identify the applicable insolvency forum and give the officeholder the evidence needed to assess disclosure duties or recovery. Avoid assuming that an investigator personally determines whether a transfer can be unwound.

Worked example: Shortly before a hypothetical insolvency, a company sells equipment independently valued at 90 currency units to a director's relative for 10. The value gap is 90 − 10 = 80. Check valuation date, condition, sale process, payment, and disclosure of the relationship. If the equipment was damaged, 90 may overstate its realizable value. A trustee or equivalent officeholder assesses any recovery under the governing law.

Watch the distinction: A sale below estimated value is not automatically a recoverable fraudulent transfer. Condition, consideration, timing, relationship, and local insolvency law all matter.

Reference: [3]

21. Separate tax avoidance from evasion

Tax avoidance uses choices the applicable tax rules permit, such as claiming a genuine, eligible deduction with accurate disclosure. Evasion involves deliberate deception, such as concealing taxable income, inventing deductions, falsifying consumption-tax records, or filing under someone else's identity. A tax haven or shelter is not itself proof of evasion; examine who owns the income, what was disclosed, and whether the claimed treatment satisfies the governing rules. For consumption taxes, compare sales records, invoices, returns, and remittances, allowing for timing differences and lawful exemptions. For income taxes, reconcile bank receipts and customer records to reported revenue, then test any stated exclusion. The decisive sequence is to establish the correct reporting obligation in the relevant jurisdiction, identify the factual difference, and seek evidence of knowledge or intent. The current CFE content outline includes these tax-fraud distinctions.

Worked example: Assume a business's sales ledger and customer invoices establish 500 currency units of taxable sales for the reporting period, while its return reports 350. The unexplained omission is 500 − 350 = 150 currency units. Reconcile refunds and timing before deciding the return is false, then examine who prepared it and what they knew. A separately documented deduction allowed under local rules can reduce tax lawfully.

Watch the distinction: A low tax bill does not establish evasion. Lawful deductions can lower it; a deliberate false entry is the concern, even when the resulting tax difference is small.

Reference: [3]

22. Diagnose cyberfraud entry points

Classify a cyberfraud event by how trust or access was obtained, then by what happened next. Phishing uses a deceptive message to solicit credentials or induce an action; a forged voice or video can strengthen impersonation without installing software. Malware is code that performs an unauthorized function, such as stealing credentials. Ransomware typically encrypts or threatens to expose data to demand payment. These can occur together: a phishing link may deliver malware, and stolen credentials may enable a later transfer. Preserve the original message or recording, headers or call metadata, access logs, endpoint alerts, and transaction records. Their timing helps separate a person deceived into authorizing a payment from an attacker acting through a compromised session. An absence of an alert is limited evidence because logging and detection may be incomplete.

Worked example: A voice message that sounds like a director requests an urgent transfer. Available login and endpoint logs show no unusual session or malware execution. Impersonation is the leading explanation, though the logs cannot rule out every compromise. Pause the transfer, call the director using a previously verified number, and retain the audio and call details. A subsequent file-encryption demand would require a separate ransomware inquiry.

Watch the distinction: A convincing synthetic voice is not necessarily malware. The voice may persuade an authorized employee to act; malware requires evidence of code running or another software-based intrusion.

Reference: [3]

23. Examine public funding and procurement

Follow the public-money lifecycle to locate the possible scheme. Before award, a buyer may tailor specifications, leak information, manipulate bids, or create an unnecessary purchase; bidders may coordinate prices or divide contracts. After award, examine change orders, substitutions, delivery evidence, and cost allocations. Grant and disaster funding add eligibility and allowable-use questions: the recipient may qualify for an award yet charge an unrelated expense to it. Compare independent bids and bidder relationships at selection, then compare the contract with actual goods, work, invoices, and approvals at performance. Similar bid documents are a clue, not proof of collusion, because bidders may use the same template. Likewise, a large change order can reflect legitimate scope changes. Identify who benefited, who approved each change, and whether contemporaneous records support it.

Worked example: Three bids repeat the same unusual spelling error, so examine their authorship and submission history. A contract priced at 100 currency units later gains a 40-unit change order: 40 ÷ 100 = 40% of the original price. Review its scope and approval rather than treating the percentage as fraud. If grant funds also bought unrelated equipment, test that purchase against the grant's permitted uses.

Watch the distinction: A low winning bid does not establish fair competition. Tailored specifications or coordinated bidders can distort the process, while later changes can shift the real contract cost.

Reference: [3]

Fraud Investigations and Legal Issues

24. Establish predication

Predication is a reasoned basis to examine a specific concern. Begin with the allegation or anomaly, identify the records that could confirm it, and write down plausible innocent explanations. A payment appearing twice might be two legitimate instalments, a duplicate later reversed, or an actual overpayment. A narrow first check should establish what transactions occurred and whether the concern still stands. If it does, expand the scope by following the people, documents, systems, and funds involved. Record when the basis changed, so the inquiry remains proportionate and its decisions can be explained later. An anonymous tip can supply predication when it contains testable details; a named accusation can still be weak when it offers none. The fraud investigations and legal issues guide provides a useful companion for connecting this first decision to later evidence work.

Worked example: A tip names two invoice numbers and alleges both were paid twice. Retrieve the invoices, payment entries, bank confirmations, and any reversal records. If each invoice has two settled payments with no correcting entry, there is a defined duplicate-payment concern. If one entry was reversed before settlement, narrow or close that concern and document why. The tip establishes a test, not a finding of intent.

Watch the distinction: An allegation need not prove fraud before an inquiry begins. It needs enough credible, testable detail to justify proportionate steps; an unverified accusation is not itself a conclusion.

Reference: [3]

25. Build a fraud response plan

A response plan converts a concern into an authorized examination. Define the question to be answered, the systems and periods in scope, who may collect evidence, who makes employment and legal decisions, and when the team must escalate. Preserve records that could disappear, including scheduled deletions and account logs, while documenting lawful access and custody. Separate the person implicated from decisions about collection or review where practicable. Limit disclosure according to each participant's task, but do not promise absolute secrecy when legal process or fair employment procedures may require sharing. Consider possible outcomes early: internal correction, recovery, civil action, regulatory referral, or criminal referral may require different preservation and reporting choices. Revisit the plan as facts change and record why the scope expands or contracts.

Worked example: An invoice concern implicates a finance manager who controls the payment system. An independent lead preserves invoices, approval history, and access logs before the manager can alter them. The lead assigns a separate reviewer to reconcile payments and sends employment decisions to human resources and legal decisions to authorized counsel. If the records show a routine correction, the team documents it and narrows the inquiry.

Watch the distinction: A response plan is not merely an interview schedule. Without authority, preservation, decision roles, and escalation points, early steps can compromise evidence or exceed the team's mandate.

Reference: [3]

26. Respect workplace investigation rights

Workplace ownership, employee duties, and privacy rights address different questions. An employer may own a laptop and still face limits on inspecting private accounts, personal communications, or data belonging to third parties. Check employment terms, system notices, local privacy and labor law, and the authority of whoever requests a search. Surveillance and recording rules may differ across jurisdictions and locations. For interviews, establish whether representation, an interpreter, or other procedural rights apply before questioning; avoid threats or restrictions that could become coercive. Protect a reporter's identity as far as the process allows and watch for retaliation through scheduling, discipline, or access changes. Start with company records the team is authorized to obtain, preserve them carefully, and seek the proper authority for material outside that boundary.

Worked example: A company laptop contains links to an employee's private cloud storage. Device ownership supports preserving authorized device data, but does not automatically permit opening the private account. First collect company email, payment approvals, and device logs within the investigation's authority. Identify whether the cloud data is truly necessary, then have qualified local counsel determine the lawful access route before anyone signs in.

Watch the distinction: An employee's duty to cooperate does not erase privacy or contractual rights. The lawful scope of a search depends on the data, access method, employment terms, and jurisdiction.

Reference: [3]

27. Match facts to legal elements

Start with elements, not a label. Misrepresentation calls for a materially false statement or concealment and the other requirements of the applicable claim or offense. Breach of trust focuses on a duty and its misuse. Conspiracy concerns an agreement to pursue unlawful conduct, with any additional acts required by the governing law. Perjury concerns a qualifying false statement under oath or comparable legal obligation; an inaccurate office memo is not automatically perjury. Bribery requires examining a benefit and the prohibited exchange or influence. Cross-border laws can reach conduct beyond their home territory, but their covered persons, transactions, mental states, and jurisdictional links differ. Build a fact-to-element table, mark gaps, and distinguish evidence of conduct from evidence of knowledge or agreement. Legal classification belongs under the law that actually governs the case.

Worked example: A supplier submits an invoice for work never performed. That supports an inquiry into a false representation and possible loss. Messages showing two employees planned the invoice may add evidence of agreement, but the applicable conspiracy rule still needs checking. If one employee later lies in an ordinary interview, do not call it perjury without establishing that the statement met the jurisdiction's oath and proceeding requirements.

Watch the distinction: One suspicious document does not satisfy every fraud-related offense. Each legal theory has distinct elements, and a statute's title alone says nothing about its reach in a cross-border case.

Reference: [3]

28. Assess evidence and credibility

Direct evidence addresses a fact without an additional inference: a witness who saw an approval can directly describe that act. Circumstantial evidence requires a step of reasoning: a login from a manager's account suggests, but does not itself establish, who operated it. Either type can be strong or weak. Ask whether the item matters to a disputed fact, whether its source can be authenticated, and whether handling records explain its condition and transfers. Test a witness's opportunity to observe, memory, consistency, interests, and prior statements; impeachment material can alter weight without making every statement false. Compare independent sources and examine alternative explanations. Admissibility rules depend on the forum, so an examiner should preserve the underlying item and its provenance while keeping factual conclusions separate from a court's decision to admit it.

Worked example: A witness says she watched a manager approve a transfer. An access log also shows the manager's account approved it at 14:05. Ask where the witness stood, what screen she saw, whether credentials were shared, and whether the log clock was accurate. The witness directly describes an observation; the log links an account to an event. Together they support approval, subject to those checks.

Watch the distinction: Circumstantial evidence is not automatically inferior. Several independent records can support a conclusion strongly, while a direct witness may have poor visibility, memory, or a reason to misstate events.

Reference: [3]

29. Protect legally privileged material

Confidentiality controls who receives information; legal privilege can protect specified communications or materials from compelled disclosure. The two are not interchangeable. Legal-advice privilege commonly concerns confidential communications made for obtaining or giving legal advice. Litigation-related protection may cover work prepared for contemplated proceedings, with different tests across jurisdictions. Identify the purpose and circumstances when a document was created, its authors and recipients, and whether it was shared beyond those needed for that purpose. Sending an ordinary business record to counsel does not change why it originally existed. Broad circulation or selective disclosure can risk waiver, depending on the law and the privilege holder's actions. Preserve the original record and flag potentially protected material for qualified counsel rather than deciding privilege solely from a subject line or a confidentiality stamp.

Worked example: Operations staff produce a monthly audit report before any legal dispute. Counsel later receives a copy. The report remains a routine business record for this analysis; copying counsel does not transform its origin. A separate confidential request asking counsel to assess legal exposure may qualify for protection under the applicable law. Record each document's purpose and circulation, and let counsel assess disclosure.

Watch the distinction: Marking a document “privileged” does not create privilege. Its purpose, participants, confidentiality, and governing law matter, and unnecessary sharing may jeopardize an otherwise valid claim.

Reference: [3]

30. Preserve documentary and physical evidence

Evidence handling should let another person identify an item and reconstruct its path from source to examination. Record where it was found, who collected it, date and time, condition, unique identifiers, packaging, each transfer, and secure storage. Use a working copy for routine analysis when the original's marks, signatures, or physical condition may matter. Photograph relevant context before moving an object, and collect it only through an authorized route. Chain of custody supports authenticity; it does not by itself prove that the document's contents are true. If a gap appears, investigate it and disclose its limits rather than silently repairing the log. Retention or disposal must also respect holds and legal duties, since an investigation may later become a civil, regulatory, or criminal matter.

Worked example: An original signed invoice is removed from a locked cabinet at 09:10, transferred to an examiner at 09:25, and sealed in secure storage at 10:00. Log the cabinet location, collector, both transfers, condition, and seal identifier; scan a working copy. If the 09:25 handoff lacks a recipient signature, identify the recipient through other records and report the custody gap.

Watch the distinction: A missing custody entry does not automatically make an item worthless. It raises a question about identity or alteration that must be examined and disclosed.

Reference: [3]

31. Collect volatile digital evidence

Digital evidence can change simply because a device is used, disconnected, or shut down. An active session may contain volatile memory, temporary credentials, open network connections, or unsaved activity that will disappear. Before acting, assess safety, authority, encryption, network exposure, and the risk that live collection itself will alter data. A trained specialist should record the device state and use a documented acquisition method suited to those conditions. A cryptographic hash can show that a particular acquired image matches a later copy, assuming the same hash method and complete files; it does not prove the source was uncompromised before collection. Analyze a verified copy, preserve the source, and keep a log of tools, times, and unavoidable changes. Cloud and portable storage may require separate preservation steps.

Worked example: A user's laptop is unlocked with a transfer application open. A trained examiner photographs the screen and records the time before deciding whether live data must be captured. Under an authorized method, the examiner acquires an image and records its hash, then verifies a working copy against it. Matching hashes support copy integrity; they do not establish who opened the application.

Watch the distinction: Immediately powering off every device is not always protective. Shutdown can destroy volatile evidence or trigger encryption, while live acquisition can alter data; the choice needs documented specialist judgment.

Reference: [3]

32. Separate forensics from e-discovery

Digital forensics reconstructs activity from devices, accounts, logs, or storage. It may recover deleted files, establish a timeline, or test whether a user accessed particular data. Electronic discovery manages electronically stored information for a legal matter: identify custodians and sources, preserve them, collect within scope, review for relevance and privilege, and produce responsive material under applicable rules. A forensic image may feed an e-discovery review, but the two processes answer different questions. Set search dates, account boundaries, and collection methods before extraction, while allowing justified changes as new evidence appears. Keep technical findings tied to what the source can actually show; a recovered draft does not prove it was sent. The CFE candidate handbook places both digital evidence and legal considerations within the investigations section.

Worked example: A laptop image contains deleted transfer instructions. Recovering the file and examining its metadata is forensic work; the file may show drafting, but delivery needs separate evidence. For a related civil case, preserve and search relevant employee mailboxes, review responsive messages for privilege, and produce those required by the case process. Document the scope and source for each step.

Watch the distinction: A complete device image is not automatically a proper legal production. Production requires decisions about scope, responsiveness, privilege, and applicable procedure, even when the collection itself is sound.

Reference: [3]; [2]

33. Use data analysis without overclaiming

Analysis begins before a test is run. Define the question, obtain data with permission, check field meanings and date ranges, standardize formats, remove or explain duplicates, and reconcile record counts or totals to source systems. A join can multiply rows when keys are not unique, so inspect unmatched and many-to-many records. Choose a test that fits the data: sorting and joins can reveal shared identifiers; unusual-number tests require suitable naturally occurring data and are poor fits for assigned or constrained values. An alert is an exception for review, not a measured fraud probability. Consider the base rate, incomplete logs, common addresses, legitimate overrides, and how the sample was selected. Report both the initial matches and the verified subset, including any exclusions, so readers can reproduce the interpretation.

Worked example: A supplier-to-employee address join produces 12 matched payments. Eight matches use the organization's shared office address, leaving 12 − 8 = 4 payments needing targeted review. Check vendor ownership, the employee's role, and approval records for those four. The original 12 are data matches; even the remaining four are unresolved exceptions until the relationship and transaction purpose are established.

Watch the distinction: A clean-looking dashboard can hide bad joins or incomplete source data. Exception counts should be reconciled and investigated before being reported as conflicts or losses.

Reference: [3]

34. Choose lawful information sources

Choose a source by the fact it can establish and the authority needed to access it. Corporate registries, court filings, and published notices may identify entities, officers, or disputes, but entries can be stale or incomplete. Bank, credit, phone, and private account records often require consent, contractual authority, or legal process under local law. Open online material presents a different problem: a page can change, a profile can be impersonated, and a screenshot may omit context. Preserve the URL, access date and time, visible content, and any available archive or source metadata. Corroborate identity through independent records before attributing a post to a person. Avoid accessing private material through deception or credentials outside the inquiry's authority. The aim is to obtain usable facts while preserving provenance and respecting jurisdiction-specific limits.

Worked example: A public registry names a director whose name matches a supplier contact. Save the registry entry with its URL and access date, then compare identifiers such as company number and address before linking the people. A private bank statement needs a separate lawful access basis. A social-media image claiming the director owns the supplier remains a lead until account control and the claim are corroborated.

Watch the distinction: Public availability does not guarantee accuracy, and a screenshot does not prove authorship. Source date, identity, context, and lawful access still need checking.

Reference: [3]

35. Trace funds directly

Direct tracing follows an identifiable flow from an origin through accounts or assets to a recipient. Start with the source transaction and obtain dates, amounts, account identifiers, references, and supporting contracts. Reconcile each intermediary's inflows and outflows, noting fees, other deposits, reversals, and currency conversions so that a neat amount match is not mistaken for a unique trail. Then identify legal account holders and beneficial owners separately; an account may receive funds for someone else. A transfer to a dealer shows payment, not necessarily who ultimately owns the purchased vehicle. Test legitimate explanations such as debt repayment or authorized subcontracting against independent records. Where funds are mixed, state the tracing assumption and its limits. A complete ledger path narrows the inquiry, but intent and illicit origin still require separate evidence.

Worked example: A diverted payment of 50 currency units enters Account A. Records show 35 transferred to Account B and 15 paid to a vehicle dealer: 35 + 15 = 50, so these outflows reconcile to the incoming amount if there were no fees or other movements. Obtain account ownership, transfer instructions, and purchase records. The balanced flow alone cannot establish who benefited.

Watch the distinction: Following equal amounts is not enough when an account holds mixed funds. Other deposits, fees, and timing can change which money a later payment represents.

Reference: [3]

36. Estimate unexplained wealth indirectly

Indirect methods estimate a financial gap when specific illicit payments cannot be followed. Under an asset approach, compare opening and closing net worth, then account for legitimate income and living expenses during the period. Rising assets and falling liabilities both increase net worth. Under an expenditure approach, compare spending and asset purchases with documented lawful sources, taking care not to count a purchase twice. Establish reliable opening balances, ownership, borrowing, gifts, inheritances, business distributions, and currency effects before interpreting any remainder. An unexplained amount is a lead, not a finding that all of it came from fraud. Different valuation dates or omitted legitimate sources can materially change the estimate. State assumptions and sensitivity plainly so the reader sees what evidence would close or widen the gap.

Worked example: Assume all values are in the same currency and period. Assets rise by 120 units, liabilities fall by 20, and documented legitimate income remaining after living costs is 90. Net worth rose by 120 + 20 = 140 units; the unexplained portion is 140 − 90 = 50 units. Check opening balances, new loans, gifts, and valuations before drawing any inference about its source.

Watch the distinction: An unexplained wealth estimate is not a direct trace to stolen funds. Missing opening assets, legitimate gifts, or valuation errors can create an apparent gap.

Reference: [3]

37. Conduct an information-gathering interview

An information-gathering interview aims to learn what a person perceived and where corroborating records may be found. Plan the subject, interviewee's role, legal and workplace rights, language needs, and a safe recording method. Begin with an open invitation to describe events in sequence, then ask focused questions about dates, people, documents, and what the person actually saw rather than inferred. Clarify uncertainty without supplying the preferred answer. Only after obtaining the independent account should you introduce a conflicting document and ask for an explanation. Behavior can reflect stress, culture, fatigue, or fear; it is not a reliable standalone test for lying. Record exact material wording, corrections, and follow-up leads. CFE practice questions can help reinforce the distinction between a witness's observation and an investigator's inference.

Worked example: A warehouse witness says a shipment arrived Tuesday. First ask who unloaded it, what was counted, and which records were made. Then show a receipt dated Wednesday and ask what that date represents. It might be the posting date rather than delivery date. Compare gate logs and carrier records before deciding whether the account is mistaken or false.

Watch the distinction: A date discrepancy is not a lie detector. Memory, document timing, and different meanings of “arrival” can explain it; focused follow-up and independent records matter.

Reference: [3]

38. Handle an admission-seeking interview

An admission-seeking interview tests a subject's account against verified evidence and may obtain an acknowledgment of specific conduct. Plan authority, timing, rights, accommodations, interpreter needs, observer roles, and an accurate recording method under local rules. Establish the person's account first, then present authenticated documents in a sequence that allows explanation. Ask clear questions about access, action, purpose, and knowledge; distinguish an admission of a small fact from an admission of the suspected scheme. Do not promise immunity, threaten an outcome outside your authority, or turn a speculative accusation into a presumed fact. If the subject changes the account, capture the precise words and test them against records. A reliable statement includes context, voluntariness, and corrections, since pressure or inaccurate paraphrase can undermine its value.

Worked example: A subject denies approving a payment, but a verified system record shows approval through their credentials. Ask who else could use those credentials and when. The subject says they shared the password with a colleague. Record that exact admission and seek login location and colleague evidence. Password sharing explains a possible route; it does not establish that the subject approved or stole the payment.

Watch the distinction: Admitting a policy breach is not admitting fraud. Credential sharing may be relevant, but responsibility for a transfer and intent require their own evidence.

Reference: [3]

39. Record a reliable statement

Interview notes record what an interviewer understood; a witness-adopted statement records wording the witness has reviewed and accepted. Preserve the distinction. Capture who was present, when and where the interview occurred, the questions needed to understand material answers, and whether recording or interpretation was used. Use the witness's own words for key observations, separate firsthand knowledge from what others said, and avoid compressing uncertainty into certainty. Show the draft to the witness, retain substantive corrections, and record whether they signed or otherwise adopted the final version voluntarily. A refusal to sign should be documented without rewriting the answer. Language needs deserve particular care: identify the interpreter and confirm that the witness understands the final text. A later reader should be able to trace a conclusion back to what was actually stated.

Worked example: A witness corrects “I saw the transfer” to “I saw the transfer request.” Keep the revision and ask whether the witness later saw any confirmation that funds moved. If not, the adopted statement supports observation of a request only. Record the correction, have the witness review the final wording, and seek bank or system records to establish execution.

Watch the distinction: An investigator's polished summary is not automatically the witness's statement. If it broadens an observation or hides a correction, it can misstate the evidence.

Reference: [3]

40. Control covert-operation risks

Covert work can change both the evidence and the risk to people involved. Define the authorized objective before using an informant, hidden observation, or recording. Check local rules on consent, surveillance, privacy, inducement, and who may direct the operation; rules differ across borders. Assess what the source knew independently, possible motives, reliability history, and whether the proposed contact could prompt conduct that would not otherwise occur. Plan safety, communication, contemporaneous notes, secure storage, and a stop point if circumstances change. Confidentiality has limits: a source's identity or communications may later be disclosed through legal process or fairness obligations. Do not offer secrecy or protection beyond the team's authority. Keep a clear record of instructions to the source and separate the source's original information from facts created during the operation.

Worked example: An informant offers to record a supplier discussing a suspected kickback. Before recording, establish where each participant will be and which jurisdiction's consent rules apply. Document what the informant already heard, assess their relationship with the supplier, and give no instruction to propose a payment. If recording is authorized, preserve the complete file and metadata and log every transfer.

Watch the distinction: A covert recording is not automatically lawful or reliable because one participant agrees. Local consent rules, source incentives, selective editing, and investigator direction all affect its use.

Reference: [3]

41. Write a defensible investigation report

Begin with the decision the report must support, then state the mandate, period, records examined, interviews conducted, and methods used. Separate observed facts from inferences: a bank record establishes a payment, while its business purpose may remain uncertain. For each finding, identify the supporting evidence, any conflicting evidence, and the reasoning connecting them. Reconcile totals and define terms such as “questioned” so readers do not mistake an exception for a proven loss. Describe missing records, restricted access, or incomplete interviews where they affect confidence. Recommendations should name practical next steps, such as obtaining receiving records or correcting a control, without deciding legal guilt. Use neutral language and an evidence index so another examiner can trace each statement. The current CFE content outline identifies report writing as an investigation competency.

Worked example: An examiner reviews 20 supplier payments. Delivery records support 14; six lack matching evidence. The report states that six payments remain unresolved, lists their dates and amounts, and requests receiving logs and supplier confirmations. It also records the 14 supported transactions. Without the missing records, the examiner cannot treat six, much less all 20, as fraudulent.

Watch the distinction: A report that lists only suspicious items can exaggerate the case. Include tested innocent explanations and state whether each exception is unresolved, unsupported, or affirmatively contradicted.

Reference: [3]

42. Identify the governing legal forum

Start by identifying the proposed action: criminal prosecution, civil recovery, or regulatory enforcement. Subject-matter jurisdiction asks whether a court or authority may hear that kind of matter. Territorial jurisdiction connects a state or authority to people, conduct, property, or harm. Venue selects the proper place within a system; applicable law determines the rules governing the claim. These questions may have different answers. For a cross-border case, map each actor, account, transfer, server, and loss location, then identify where evidence can lawfully be obtained and used. Common-law proceedings often use opposing parties to present evidence before a relatively separate fact finder. In many civil-law systems, a judge may take a more active investigative role. Neither description establishes a universal procedure; local law controls.

Worked example: A payment begins in Country A, passes through an account in Country B, and deprives a company in Country C of funds. A may have evidence of the instruction, B of the intermediary account, and C of the loss. Investigators identify possible authorities and evidence-access routes for each; the transfer’s route alone does not choose a court or governing law.

Watch the distinction: The location of the final bank account does not automatically determine jurisdiction. The claim, conduct, parties, harm, and local jurisdictional rules all matter.

Reference: [3]

43. Follow a criminal case

A criminal matter typically moves from investigation to a prosecutor’s charging decision, a first court appearance, pretrial disclosure and motions, trial or other resolution, judgment, sentencing if convicted, and possible appeal. Names and order vary by jurisdiction. The prosecutor represents the public interest and must meet the governing criminal burden, commonly proof beyond reasonable doubt, on every required element. The defendant may challenge admissibility, reliability, identity, and intent. Disclosure can reveal evidence that weakens the accusation as well as evidence that supports it. A corporate defendant may face separate liability rules, and some systems permit negotiated or deferred resolutions. An examiner contributes authenticated records, accurate calculations, and candid limitations; the prosecutor decides what charges to bring, and the court decides the outcome. A suspicious transaction supports inquiry but does not itself identify its author.

Worked example: A bank record proves that a payment left the company, but two authorized employees plausibly used the shared account. The transaction merits examination of devices, approvals, and beneficiary links. Until those facts distinguish the users, the record may fail to establish either person’s guilt beyond reasonable doubt, even if the payment itself was unauthorized.

Watch the distinction: An indictment or other charging document is an allegation, not a finding of guilt. Keep investigative conclusions distinct from the prosecutor’s charge and the court’s judgment.

Reference: [3]

44. Compare civil remedies and proof

A civil claim seeks a remedy such as repayment, damages, an injunction, or return of property. The claimant ordinarily must establish the required elements on the balance of probabilities, meaning the fact is more likely true than false. That standard is lower than the usual criminal burden, but a plausible story without reliable evidence may still fail. Once litigation is reasonably anticipated under applicable rules, relevant records should be preserved through a documented hold, including messages and system data that routine deletion might erase. Pleadings frame the dispute; discovery or disclosure lets parties obtain relevant material, subject to limits and privilege. Trial or hearing produces a decision and potentially an appeal. Mediation helps parties negotiate; arbitration gives an agreed decision maker authority to decide. Compare each route’s cost, confidentiality, enforceability, and available remedies.

Worked example: In a hypothetical assessment, authenticated approval logs, bank records, and witness accounts favor an unauthorized-payment explanation 60% to 40% over an authorized one. That illustrates “more likely than not” for a civil fact finder. Courts do not have to assign numeric percentages. Preserve the underlying records because the opposing party may test both explanations during disclosure.

Watch the distinction: A civil claim does not become proven merely because criminal charges are absent. The civil decision maker must still assess each required element against the applicable burden.

Reference: [3]

45. Consider regulatory and administrative action

One course of conduct can trigger several decision processes. A regulator may examine compliance with licensing or industry rules; an employer may consider discipline; a public buyer may assess contract recovery, suspension, or exclusion from future procurement. A civil claimant may seek compensation, while a prosecutor considers an offense. Each decision maker has different powers, procedures, evidence rules, and standards of proof, so label the contemplated action before choosing evidence and language. Administrative action often focuses on eligibility or protection of a program rather than punishment for a crime. Preserve the original records and document how they were obtained, because evidence may be relevant in more than one process. Coordinate disclosure carefully: sharing material for one proceeding can affect confidentiality or privilege in another. Do not assume that an internal finding automatically authorizes a regulatory sanction.

Worked example: A contractor submits false delivery records for a public purchase. The buyer verifies what arrived, calculates any overpayment, and considers contract remedies. A procurement authority separately assesses eligibility for future awards, while a prosecutor evaluates possible charges. Each body needs the underlying records and must apply its own authority and proof rules under the relevant jurisdiction.

Watch the distinction: Calling a contractor “debarred” because an internal investigation found false records confuses a finding with a formal remedy. Only the authorized body can impose that status.

Reference: [3]

46. Give evidence within your role

A fact witness describes personal observations, such as receiving an invoice. A subject-matter witness explains records or practices within their work. An expert offers an opinion requiring specialized knowledge, within the scope accepted by the court. One examiner may fill different roles, but should state which basis supports each answer. Prepare by tracing figures to source documents, checking dates and units, and identifying assumptions and alternative explanations. On direct examination, answer the question clearly and explain the method; on cross-examination, listen for a changed assumption or a question outside your knowledge. A concession about a real limitation improves accuracy. Do not infer a person’s intent solely from a ledger discrepancy or pronounce legal guilt. The fact finder weighs testimony with the other evidence, under the jurisdiction’s rules.

Worked example: The ledger records a payment of 125 currency units, while the bank statement shows 150 units to the same beneficiary. The difference is 150 minus 125, or 25 units. An examiner can explain the reconciliation and ask whether fees, another entry, or an altered record accounts for 25. The discrepancy alone does not identify a thief.

Watch the distinction: Expert status does not turn every opinion into admissible evidence. Explain the method, data, assumptions, and limits; leave the ultimate legal decision to the authorized fact finder.

Reference: [3]

Fraud Prevention and Deterrence

47. Apply the fraud triangle

The fraud triangle organizes three conditions to examine: pressure, opportunity, and rationalization. Pressure may be financial or professional, but it is often private and cannot be inferred reliably from appearance. Opportunity concerns the ability to act and conceal, such as one person creating a supplier, approving an invoice, and releasing payment. Rationalization is a justification the person uses, such as claiming the money is only a temporary loan. The triangle is a way to frame questions and controls, not a test that predicts whether a particular person committed fraud. Start with transaction evidence, then ask which control allowed the event and what contextual facts are genuinely documented. Reducing opportunity through independent approval and reconciliation is usually more actionable than trying to diagnose motives. The fraud prevention and deterrence guide connects this lens to control design.

Worked example: An employee has documented debt, can create and pay vendors without another reviewer, and calls a withdrawal “temporary borrowing.” These facts illustrate pressure, opportunity, and rationalization. Investigators still need payment records, beneficiary details, and authorization evidence to determine whether company funds were diverted. The strongest immediate control change is independent review of vendor creation and payment release.

Watch the distinction: Finding all three triangle factors does not prove fraud. Many honest employees face pressure or have broad access; a conclusion requires evidence of conduct and the relevant intent.

Reference: [3]

48. Distinguish who commits the fraud

Occupational fraud is committed by someone using a role inside an organization against that organization, such as diverting its cash. Organizational misconduct is carried out for, or through, the organization, such as falsifying test results to obtain sales. The classification directs the investigation: for occupational theft, trace access, approvals, custody, and personal benefit; for organizational misconduct, examine management direction, incentives, knowledge, disclosures, and benefits to the entity. The categories can overlap when employees personally profit while advancing a company objective. Measure consequences beyond immediate loss: harmed customers, unsafe products, regulatory costs, damaged trust, and distorted competition may be substantial even when accounting entries show a modest amount. The response must address the actor’s conduct and the conditions that enabled it, including whether leaders ignored warning signs.

Worked example: A clerk takes 5,000 currency units from the employer’s receipts, so the employer is the direct victim of an occupational scheme. Separately, a manufacturer knowingly misstates product tests to win contracts, an organizational scheme that may harm buyers and users. The first inquiry follows cash custody; the second follows testing, approval, and management communications.

Watch the distinction: Treating every employee act as occupational fraud misses cases where the organization benefits from misconduct. Identify who was harmed, who benefited, and whose decisions shaped the conduct.

Reference: [3]

49. Assign governance oversight

Management owns day-to-day risk decisions and operates controls. The board oversees strategy, risk appetite, senior leadership, and the integrity of reporting. An audit committee, where established, gives focused independent challenge over financial reporting, assurance, and significant control concerns. Effective oversight asks for evidence: who approved a high-risk decision, what checks were performed, which exceptions were accepted, and whether corrective actions worked. It also provides an escalation path when management is implicated, so the person under review cannot control the inquiry. Internal audit may independently assess control design and operation, then report findings through its mandate; it does not take over management’s control ownership. Governance is weak when minutes record approval without explaining the information considered or follow-up. Roles and legal duties vary by entity and jurisdiction, so map actual authority before assigning action.

Worked example: Management approves a distributor despite missing ownership checks. The audit committee requests the rationale, transaction exposure, and a dated remediation plan, then reviews evidence that checks were completed. Management performs the verification and changes onboarding controls. If the approving executive may have a conflict, the concern is escalated through an independent route.

Watch the distinction: An audit committee’s oversight does not replace management’s execution. A committee can challenge and require evidence, but management must implement and operate the distributor checks.

Reference: [3]

50. Use the COSO control components

COSO’s five internal-control components work together. The control environment sets expectations through leadership, accountability, and competence. Risk assessment identifies what could go wrong and how changes affect exposure. Control activities are the specific approvals, reconciliations, access restrictions, and reviews that address those risks. Information and communication ensure people receive reliable data and know how to report exceptions. Monitoring checks whether the system still works and prompts correction. Analyze a scenario across all five rather than pointing to one written rule. For instance, a two-person payment requirement is ineffective if credentials are shared, exceptions are hidden, and no one reviews access logs. Test design by asking whether the rule could prevent the scheme if followed; test operation by examining actual transactions and users. The components help explain why a formally complete control system can fail in practice.

Worked example: A company requires two signatures for supplier payments, yet managers share login credentials. A sample payment displays two approvals, but the access log shows one device using both accounts. The activity exists on paper; the control environment tolerates sharing, and monitoring failed to flag it. Reset access, prohibit sharing, and verify approvals from independent users.

Watch the distinction: A documented approval rule is not evidence that independent approval occurred. Test the identities and access behind the signatures, then examine whether exceptions were detected and corrected.

Reference: [3]

51. Distinguish auditor responsibilities

Start with each auditor’s mandate. Internal audit serves the organization through independent assurance or advisory work on governance, risk, and controls, with scope set by its charter and professional standards. External financial-statement auditors seek an opinion under the applicable audit framework about whether statements are materially misstated; reasonable assurance is not a guarantee that every fraud will be found. Government auditors may examine public spending, performance, or compliance under their specific authority and standards. Materiality concerns whether a misstatement could influence users of financial statements, considering size and nature. A small theft may fall below financial-statement materiality yet expose a serious access failure or public-fund breach. Fraud-related reporting obligations differ, so identify the engagement, governing standard, and recipient before stating what an auditor must report.

Worked example: An external auditor evaluates whether a 5,000-unit theft materially affects the financial statements, considering the entity and surrounding facts. Internal audit tests the payment process that allowed the theft and reports control failures under its charter. A government auditor examining the same public funds may focus on compliance. Different mandates explain different procedures and reports.

Watch the distinction: An unmodified financial-statement audit opinion does not certify that no fraud occurred. It addresses the statements under the applicable audit scope and materiality, not every transaction.

Reference: [3]

52. Diagnose control failure

Classify a failure by asking three questions in order. Is any control assigned to the risk? If none exists, there is a gap. If a control exists, would it address the scheme when performed exactly as written? If not, its design is weak. If its design is adequate, did people actually perform it at the right time with reliable information? Failures there concern operating effectiveness. The distinction guides repair: add a missing check, redesign a self-approval step, or correct training, access, supervision, and follow-up when execution fails. Define the population and sample before quoting an exception rate; a small or targeted sample does not establish a company-wide frequency. Examine whether the failure allowed a payment to proceed and whether a compensating control independently detected it. The CFE practice questions can help rehearse these classifications.

Worked example: No approval step for vendor bank changes is a control gap. Approval by the employee who requested the change is poor design. A rule requiring independent approval is adequate in design, but reviewers skip it in three of five sampled changes. That is a 3 ÷ 5 = 60% failure rate in this sample, with broader prevalence unknown.

Watch the distinction: Calling every bad outcome an operating failure can hide a defective design. Ask whether the control, even when followed, would have stopped or detected the scheme.

Reference: [3]

53. Make prevention part of daily decisions

Prevention works when everyday incentives and decisions support the stated rules. Leadership demonstrates expectations by how it treats exceptions, not just by issuing an ethics statement. Compensation that rewards booked sales without accounting for returns can encourage premature recognition; adding quality and cancellation measures changes that pressure. Training should teach employees what suspicious actions look like, how to verify a request, and where to report it. A brief prompt at the point of submission can remind staff to check accuracy, but it cannot replace evidence review or independent approval. Connect each intervention to a specific scheme and test whether it changed behavior: compare corrected entries, late reversals, and verified exceptions over time. Invite challenge when a target conflicts with accurate reporting. Clear disciplinary and response practices make the rule credible across seniority levels.

Worked example: Sales staff earn bonuses on contracts recorded this month, while managers ignore next-month cancellations. Review cancellations before finalizing bonuses, require evidence that acceptance criteria were met, and train staff on the booking rule. A submission reminder reinforces the check. Compare cancellation and correction patterns after the change, allowing for seasonal effects before attributing improvement to the intervention.

Watch the distinction: A code of ethics alone does not counter a reward system that favors inflated results. Align incentives, verification, and leadership responses with the conduct the code requires.

Reference: [3]

54. Build a usable reporting channel

A reporting channel should be easy to find, usable by employees and outsiders where relevant, and reachable without going through the person accused. Intake should capture what happened, when, where, who may know more, and what records may disappear, while allowing uncertain reporters to distinguish observations from suspicions. Triage assesses urgency, potential evidence loss, safety, conflicts, and the right investigator. Limit access to identities and allegations, keep a secure case record, and explain confidentiality honestly because lawful investigation or disclosure may require sharing. Anti-retaliation measures include an independent escalation route and monitoring for adverse treatment after a report. Provide acknowledgment and appropriate status feedback without revealing protected details. Close the loop by documenting findings, corrective action, and whether the reporting process itself worked. Repeated vague reports may still reveal a pattern worth testing.

Worked example: A caller says a supervisor changed supplier payment details. Intake records the supplier, approximate date, and how the caller learned of the change. The matter goes outside the supervisor’s chain; access logs and prior bank details are preserved. The reporter is told their identity will be restricted to authorized people, though investigators may need to share relevant information.

Watch the distinction: Promising absolute anonymity can mislead a reporter when facts or legal duties reveal identity. Explain the actual confidentiality safeguards and their limits at intake.

Reference: [3]

55. Monitor transactions continuously

Continuous monitoring applies repeatable rules or models to incoming transactions and sends exceptions for review. Continuous auditing is an assurance approach that uses frequent testing and independent evaluation; management monitoring remains a management control. Design an alert around a specific scheme, such as payment splitting near an approval limit, and include the data needed to judge context: vendor, requestor, dates, amounts, approvals, and reversals. Validate source completeness and join keys before interpreting results. Triage alerts using confirmed outcomes, then adjust rules to reduce routine noise without suppressing meaningful cases. Track false positives, missed cases found elsewhere, review time, and the value of confirmed issues. An alert is a lead, not a finding. Keep a record of rule changes so a later reviewer understands why a transaction did or did not trigger.

Worked example: A rule flags 100 payments near a hypothetical approval limit. Review finds 85 routine recurring charges and 15 requiring further inquiry, so 15 ÷ 100 = 15% of alerts remain open. Add vendor and requestor context to reduce repeat noise, but retain the 15 records and test their approvals before deciding whether any were improper.

Watch the distinction: A high alert count does not measure fraud prevalence. It reflects the rule and data used; confirm outcomes and inspect missed cases before judging performance.

Reference: [3]

56. Run a fraud risk assessment

Define the process and objective before listing risks. In procurement, specify whether the assessment covers vendor onboarding, bidding, receipt, payment, or all four. Bring together people who know operations, controls, data, and fraud methods, while preserving enough independence to challenge assumptions. Describe realistic schemes as an actor, an action, a control weakness, and an effect: a buyer creates a related vendor and certifies nonexistent receipt, leading to payment. Record who could act, what evidence would remain, and what might expose the scheme. Assess likelihood and impact using stated qualitative criteria or clearly hypothetical scores, then identify existing preventive and detective controls. Assign an owner to test design and actual operation. Document data gaps and disagreements rather than averaging them away. Report prioritized scenarios, residual exposure, proposed action, and a date for reassessment when processes or third parties change.

Worked example: A team maps vendor creation, bid selection, goods receipt, and payment. It finds that one buyer can create a vendor and certify receipt. The concrete scenario is payment to a fictitious vendor for undelivered goods. The team checks vendor-change logs, receiving evidence, and payment approvals, then assigns procurement management to separate those powers and test the change.

Watch the distinction: “Procurement fraud” is too broad to assess or control. Specify the actor, transaction step, possible manipulation, and resulting loss so a test can target it.

Reference: [3]

57. Compare inherent and residual risk

Inherent risk describes exposure from a scheme before considering the relevant controls. Residual risk is what remains after evaluating both control design and actual operation. Neither is necessarily a measured probability; many organizations use ordinal scales to prioritize attention. Begin with the process, potential value, access, and plausible fraud path. Then identify controls that directly interrupt or reveal that path. Test whether they cover the full population and whether exceptions are reviewed promptly. A strong control on paper reduces residual risk only if it works and covers material routes. Consider concentration: five bypasses may be more consequential than 95 compliant transactions if the bypassed payments carry most of the value. State assumptions, sample limits, and uncertainty in the rating. When a bypass is found, investigate cause and exposure before deciding whether the residual rating is acceptable.

Worked example: A high-value transfer process has high inherent exposure. In a sample of 100 transfers, 95 show independent approval and five bypass it, giving 95% observed coverage and 5% observed bypasses. Review the five amounts, beneficiaries, and reasons. If they are the largest transfers, the simple coverage rate understates the remaining exposure.

Watch the distinction: Residual risk is not inherent risk multiplied by an assumed control percentage without evidence. Test whether controls work and whether uncovered transactions carry disproportionate loss.

Reference: [3]

58. Choose a response to remaining risk

Once residual risk is understood, compare it with stated risk appetite and choose a response. Mitigation changes the process through preventive controls, such as independent release approval, or detective controls, such as reconciliation and alerts. Acceptance keeps the exposure with a documented owner and rationale. Transfer shifts some financial consequence through insurance or contract, although responsibility and operational disruption may remain. Avoidance stops the activity or removes the risky route. Compare options by expected effect, cost, speed, and whether they meet a non-negotiable constraint. A detective review after payment can shorten loss duration but may not prevent an irreversible transfer. Specify the control owner, trigger, evidence retained, and how success will be tested. Reassess when transaction size, counterparties, systems, or threat patterns change.

Worked example: A company allows one employee to release payments up to a hypothetical 20,000 currency units, but its risk appetite excludes any single-person release. The route therefore conflicts with appetite even for a 1,000-unit payment. Add independent authorization before release or stop that route. Insurance may reimburse some loss, but it does not satisfy the authorization requirement.

Watch the distinction: Transferring loss through insurance does not transfer every consequence of fraud. Regulatory exposure, disruption, and weak authorization can remain with the organization.

Reference: [3]

59. Manage fraud risk across the enterprise

Enterprise fraud risk management connects governance, risk assessment, control, response, and monitoring across business units and third parties. ISO 31000 provides general risk-management principles and a process for identifying, analyzing, treating, and reviewing risk. COSO enterprise risk management connects risk to strategy and performance. The ACFE/COSO fraud risk management framework focuses that cycle on fraud through governance, assessment, preventive and detective controls, investigation and corrective action, and monitoring. Use these frameworks to assign responsibility and keep decisions current, rather than treating onboarding as a permanent clearance. Third-party ownership, payment details, subcontractors, and behavior can change after approval. Define who checks for changes, what triggers escalation, and how findings feed the next assessment. Compare information from ownership records, contracts, payment data, and actual delivery; an unexplained change is a review trigger, not itself proof of corruption.

Worked example: A distributor passes onboarding, then changes ownership and requests payment to an unfamiliar account. Periodic checks detect both changes. The relationship owner pauses the account update, verifies ownership and bank details through an established contact, reviews recent transactions, and records the outcome. The risk assessment is updated because the approved counterparty and payment route may have changed.

Watch the distinction: A clean initial screening does not establish continuing low risk. Ownership, behavior, and payment channels can change; assign an owner and monitor material changes.

Reference: [3]

60. Exercise professional ethics and skepticism

Professional skepticism means testing a claim against evidence and plausible alternatives while staying open to correction. Independence requires recognizing relationships or incentives that could bias the work; disclose a conflict early so an authorized person can reassign or supervise the matter. Competence means accepting work within one’s skills and using specialists for digital, legal, or accounting questions beyond them. Protect confidential and potentially privileged information through restricted access and careful distribution, while honoring applicable disclosure duties. The ACFE Code of Professional Ethics also calls for lawful conduct, integrity, and conclusions supported by evidence. State what records establish, what remains uncertain, and what further work could resolve it. Avoid assurances that an organization is fraud-free or opinions that a named person is legally guilty. A sound conclusion can be narrow and still useful.

Worked example: An examiner learns that a close relative works for the supplier under review. The examiner discloses the relationship and arranges independent handling. Records show an unexplained 12,000-unit payment, but no proof yet of who authorized it or why. The report states the payment, missing support, and needed checks without asserting that the relative or supplier committed fraud.

Watch the distinction: Skepticism is not automatic suspicion of everyone. It requires proportionate testing of both incriminating and innocent explanations, with conclusions limited to what reliable evidence supports.

Reference: [3]

Official references and further reading

All study guides

Choose your exam version

CFE: Fraud Schemes and Financial Crimes

CFE: Fraud Investigations and Legal Issues

CFE: Fraud Prevention and Deterrence

Fraud Schemes and Financial Crimes

1. Read the three financial statements together

2. Spot financial statement manipulation

3. Trace missing cash receipts

4. Classify register and payment tampering

5. Test suspicious supplier invoices

6. Reconcile payroll to real work

7. Examine expense reimbursements

8. Reconcile inventory movement

9. Separate bribery, conflicts, and extortion

10. Investigate data and intellectual property theft

11. Recognize identity misuse

12. Assess financial institution fraud

13. Follow the laundering process

14. Apply anti-money-laundering controls

15. Evaluate securities misconduct

16. Trace payment-channel fraud

17. Distinguish insurance fraud patterns

18. Analyze health care claims

19. Unpack consumer investment scams

20. Find concealed insolvency assets

21. Separate tax avoidance from evasion

22. Diagnose cyberfraud entry points

23. Examine public funding and procurement

Fraud Investigations and Legal Issues

24. Establish predication

25. Build a fraud response plan

26. Respect workplace investigation rights

27. Match facts to legal elements

28. Assess evidence and credibility

29. Protect legally privileged material

30. Preserve documentary and physical evidence

31. Collect volatile digital evidence

32. Separate forensics from e-discovery

33. Use data analysis without overclaiming

34. Choose lawful information sources

35. Trace funds directly

36. Estimate unexplained wealth indirectly

37. Conduct an information-gathering interview

38. Handle an admission-seeking interview

39. Record a reliable statement

40. Control covert-operation risks

41. Write a defensible investigation report

42. Identify the governing legal forum

43. Follow a criminal case

44. Compare civil remedies and proof

45. Consider regulatory and administrative action

46. Give evidence within your role

Fraud Prevention and Deterrence

47. Apply the fraud triangle

48. Distinguish who commits the fraud

49. Assign governance oversight

50. Use the COSO control components

51. Distinguish auditor responsibilities

52. Diagnose control failure

53. Make prevention part of daily decisions

54. Build a usable reporting channel

55. Monitor transactions continuously

56. Run a fraud risk assessment

57. Compare inherent and residual risk

58. Choose a response to remaining risk

59. Manage fraud risk across the enterprise

60. Exercise professional ethics and skepticism

Official references and further reading

Frequently Asked Questions

Related Study Guides

Association of Chartered Certified Accountants Qualification (ACCA)

Certified Anti-Money Laundering Specialist (CAMS)

Certified Bank Auditor (CBA)