Fraud prevention connects human behavior, governance, controls, risk decisions, and professional ethics. This guide develops those connections through 60 technical lessons and 20 original multiple-choice questions, with worked examples and explanations of plausible errors. It covers the Fraud Prevention and Deterrence section under the three-section CFE structure launched June 2, 2026, current for this guide’s October 16, 2026 scope. The actual section has 70 questions in 90 minutes, is closed book, and is passed separately; this preview is not a full mock. Supplied issuer sources establish scope and format; technical explanations teach the listed competencies rather than quote verified standards. Legal obligations remain jurisdiction-specific.
What this guide covers
Practice 20 original CFE questions and study 60 concepts for the June 2026 Fraud Prevention section.
Understanding Financial Crime
1. Opportunity and incompatible duties
Opportunity is the part of the Fraud Triangle concerned with circumstances that permit fraud to occur or remain concealed. Access to assets matters, but access to records, approvals, and exception handling can be equally important. Incompatible duties create opportunity when one person can initiate a transaction, authorize it, and hide its consequences. Separating duties reduces that concentration; independent review can compensate where staffing is limited. Opportunity identifies an exploitable pathway rather than proving dishonest intent, and collusion or management override can defeat otherwise sensible separation.
Worked example: A small distributor lets one clerk create suppliers and release payments. The owner retains bank-release authority and verifies new supplier details using independently obtained contacts. This interrupts the clerk’s ability to convert a fabricated supplier record into an unnoticed payment.
Common mistake: Assuming that a trusted employee’s long service removes opportunity confuses personal reputation with the actual permissions and checks in a process.
Official syllabus reference: [3]
2. Pressure and rationalization in the Fraud Triangle
Pressure is an incentive or perceived need that can motivate misconduct; rationalization is the explanation a person uses to make that misconduct seem acceptable. Pressure can arise from personal finances, status expectations, performance targets, or fear of losing employment. Rationalizations include temporary borrowing, deserved compensation, or claims that nobody is harmed. The Fraud Triangle is a framework for understanding contributing conditions, not a diagnostic test for identifying offenders. Prevention can address unrealistic incentives and ethical justifications while maintaining controls over opportunity; personal hardship alone is not evidence of fraud.
Worked example: A salesperson faces an unrealistic quarterly target and says that recording next month’s orders early merely corrects an unfair bonus system. The target supplies pressure, while the claim about fairness supplies rationalization. Revenue-cutoff controls address the opportunity to act.
Common mistake: Treating debt as proof of dishonesty turns a possible pressure indicator into an unsupported conclusion about an individual’s conduct.
Official syllabus reference: [3]
3. Organizational crime versus occupational crime
Organizational crime involves misconduct conducted through an organization to advance organizational interests, while occupational crime involves individuals exploiting their occupational position against the organization. The distinction helps identify beneficiaries, victims, incentives, and control responses. Corporate sales preserved through deceptive certifications illustrate organizational advantage; an employee stealing inventory illustrates personal appropriation. Actual conduct may benefit both an organization and particular executives, so categories can overlap in practice. This conceptual classification does not decide legal liability, which depends on the facts and the applicable jurisdiction’s rules for individuals and entities.
Worked example: A service company directs staff to overstate completed inspections to retain contracts. Separately, its payroll officer inserts a personal bank account for a nonexistent worker. The first scheme advances company revenue; the second diverts the company’s resources to an insider.
Common mistake: Classifying every act performed by an employee as occupational crime ignores whether the organization is being used to benefit or is being victimized.
Official syllabus reference: [3]
4. Normalization of misconduct through organizational behavior
Organizational behavior can encourage fraud when informal rewards contradict formal rules. Employees infer acceptable conduct from promotion decisions, management reactions to bad news, and treatment of successful rule breakers. Repeated minor exceptions can normalize increasingly serious departures, especially when teams redefine manipulation as routine business practice. A written code has limited preventive force if targets and rewards favor concealment. Analysis should examine actual incentives, group expectations, and escalation behavior rather than assuming a strong culture from policy language. Cultural warning signs indicate conditions requiring attention, not proof that every team member participated.
Worked example: A regional manager praises staff who record incomplete sales as final and criticizes employees who report cancellations. Other staff begin treating premature recognition as standard practice. Revising the code alone will not change the reward pattern teaching employees to manipulate results.
Common mistake: Equating frequent ethics messages with an ethical culture overlooks the behavior that leaders reward, tolerate, or punish in daily decisions.
Official syllabus reference: [3]
5. Direct, indirect, and societal fraud harm
Financial crime creates harm beyond the amount immediately stolen. Direct losses include diverted cash or assets; indirect effects can include investigation costs, disruption, lost customers, employee distress, and increased financing or insurance costs. Society can experience reduced trust, distorted competition, and diversion of public resources. Distinguishing these effects improves impact assessment and prevents narrow loss figures from understating exposure. Estimates should separate measured losses from assumptions and avoid counting the same consequence twice. A reputational concern is relevant even when it cannot be converted reliably into a precise monetary amount.
Worked example: A charity loses USD 25,000 to a false supplier. It also pays USD 8,000 for investigation and postpones a service program. Donor attrition is plausible but unmeasured, so the assessment reports known costs separately from uncertain trust and service effects.
Common mistake: Adding every possible reputational consequence to a loss estimate as a certain cash expense creates false precision and possible double counting.
Official syllabus reference: [3]
6. Interpreting occupational fraud research
Occupational fraud research, including Report to the Nations studies, can identify recurring schemes, detection sources, durations, and control associations. Interpretation begins with the population and collection method: examined and reported cases are not a random census of every fraud. Median losses describe the middle observed case, while averages can be pulled upward by unusually large cases. Associations between controls and outcomes do not alone establish causation. Use research to challenge assumptions and prioritize questions, then assess organizational exposure using local processes and evidence rather than importing headline statistics as universal predictions.
Worked example: A study reports lower observed losses in organizations with reporting channels. A company uses that finding to examine its own channel accessibility and case handling. It does not claim that installing a hotline guarantees the same loss reduction in its workforce.
Common mistake: Treating an observed study association as a guaranteed causal benefit overlooks case selection, organizational differences, and other controls operating simultaneously.
Official syllabus reference: [3]
Corporate Governance
7. Governance frameworks and accountability chains
A corporate governance framework establishes how organizational authority is exercised, supervised, and held accountable. It connects ownership interests, board oversight, management responsibilities, assurance functions, and stakeholder information. For fraud prevention, the framework should make decision rights, escalation routes, and reserved approvals clear enough that powerful executives cannot silently control every challenge. Governance provides direction and oversight rather than performing every operational control. Its effectiveness depends on actual access to information, independent challenge, and consequences for misconduct, not simply the existence of committees or an elaborate organizational chart.
Worked example: A board reserves approval of major related-party contracts, management operates purchasing controls, and internal audit assesses their performance. A direct escalation route lets the audit leader bring a concealed executive relationship to the audit committee without obtaining that executive’s permission.
Common mistake: Assuming that creating a committee transfers all fraud responsibility away from management confuses oversight arrangements with ownership of business operations.
Official syllabus reference: [3]
8. Transparency, equitable treatment, and stakeholder interests
Governance principles support reliable disclosure, fair treatment of shareholders, accountable boards, and recognition of relevant stakeholder interests. Transparency reduces information asymmetry by giving authorized decision-makers meaningful information rather than selective favorable summaries. Equitable treatment is particularly relevant when controlling owners or insiders can extract benefits unavailable to others. Stakeholder considerations can reveal fraud impacts on employees, customers, creditors, and communities. Applying these principles requires attention to the organization’s legal form and jurisdiction; transparency does not mean unrestricted publication of personal data, investigation records, or commercially sensitive information.
Worked example: A controlling shareholder proposes that the company buy services from a family business. Disclosure of the relationship, independent assessment, and appropriately authorized approval help other shareholders evaluate the transaction. Releasing unrelated employee records would add exposure without improving that governance decision.
Common mistake: Interpreting transparency as publication of every internal record overlooks legitimate confidentiality boundaries and the need for relevant, decision-useful disclosure.
Official syllabus reference: [3]
9. Board, management, and assurance role separation
The board oversees direction, accountability, and significant risk decisions; management runs operations and owns associated controls; assurance functions evaluate and report on relevant activities. Clear separation prevents a convenient but misleading transfer of management responsibility to auditors. Internal audit can advise on control improvements while preserving its ability to assess management’s work objectively. External auditors operate within their engagement objectives rather than serving as the organization’s fraud program owners. Governance arrangements should also specify who acts when an allegation implicates a senior executive, so normal reporting lines do not block independent attention.
Worked example: Management selects and operates supplier verification controls. Internal audit later tests their design and execution, while the audit committee reviews unresolved weaknesses. If the finance executive is implicated, the audit leader uses a defined direct reporting route to the committee.
Common mistake: Making internal audit approve every supplier as the permanent control owner blurs operational accountability and can compromise later independent assurance.
Official syllabus reference: [3]
10. Audit committee independence and information access
An effective audit committee needs independence of judgment, relevant financial and risk knowledge, adequate resources, and access to management and assurance providers. Private sessions with internal and external auditors can surface concerns that management-controlled meetings suppress. Direct access matters particularly when suspected misconduct involves senior leaders or financial reporting. Independence is practical as well as structural: members need time, curiosity, and willingness to challenge explanations. The committee oversees investigation arrangements and remediation without automatically becoming the investigator or assuming management’s daily control responsibilities. Specific membership requirements vary by jurisdiction and organizational setting.
Worked example: An audit committee receives an unusually favorable financial summary despite repeated reconciliation delays. In a private session, internal audit explains that the finance director restricted access to underlying records. The committee requests independent access and a focused review of the unresolved restrictions.
Common mistake: Treating a formally independent membership list as sufficient ignores whether the committee receives unfiltered information and actually challenges management explanations.
Official syllabus reference: [3]
11. OECD, SASB, Treadway, and COSO source selection
Governance sources address different problems. OECD corporate governance principles provide a broad reference for shareholder rights, disclosure, and board responsibilities. SASB Standards identify industry-based sustainability disclosure topics and metrics relevant to investors. The Treadway Commission examined fraudulent financial reporting and related organizational responsibilities; COSO developed influential internal control and risk management frameworks. Selecting a source requires matching its purpose to the decision rather than treating familiar acronyms as interchangeable. Guidance can inform good practice without itself being binding law; applicability depends on adopted reporting requirements, jurisdiction, entity type, and engagement purpose.
Worked example: A board reviews its shareholder engagement arrangements using OECD principles. Its reporting team separately evaluates industry sustainability metrics using SASB Standards, while finance maps internal controls using COSO. Each source supports a different decision within the same overall governance system.
Common mistake: Using SASB as a substitute for a complete board governance framework confuses industry disclosure metrics with allocation of authority and accountability.
Official syllabus reference: [3]
Management’s Fraud-Related Responsibilities
12. Management ownership of the anti-fraud program
Management is responsible for establishing and operating the anti-fraud program, including culture, policies, awareness, procedures, and corrective action. Ownership means assigning accountable people, allocating resources, integrating controls into workflows, and addressing identified weaknesses. Delegating specialist tasks to compliance, security, or internal audit does not remove management’s responsibility for operations. Leaders also influence conduct through targets, promotion decisions, and responses to concerns. A program should identify who can approve exceptions and who monitors them, because vague shared responsibility often leaves important controls and remediation actions without an effective owner.
Worked example: A finance director assigns a named manager to verify supplier changes, provides staff training, and requires overdue exceptions to be escalated. Internal audit evaluates the arrangement later. The director remains responsible for ensuring the control is resourced and actually performed.
Common mistake: Describing fraud prevention as the fraud examiner’s exclusive responsibility allows operational managers to avoid decisions that only they can authorize and implement.
Official syllabus reference: [3]
13. COSO objectives and reasonable assurance
Under COSO, internal control is a process effected by the board, management, and other personnel to provide reasonable assurance about achieving operations, reporting, and compliance objectives. It is embedded in organizational activity rather than limited to finance checklists. Reasonable assurance recognizes practical limitations such as judgment errors, breakdowns, collusion, and management override. Controls should therefore be proportionate to risks and supported by credible governance. A control system can reduce fraud exposure without guaranteeing that no fraud exists, and an assessment must specify the objectives and scope to which its conclusion applies.
Worked example: A distributor combines inventory access restrictions, independent counts, and exception investigation to support reliable stock records and protect assets. Colluding staff could still conceal some diversions, so management evaluates remaining exposure rather than describing the inventory system as fraud-proof.
Common mistake: Interpreting reasonable assurance as a promise of zero loss overlooks inherent control limitations and creates an unsupported expectation of perfect prevention.
Official syllabus reference: [3]
14. COSO’s five interacting control components
COSO’s five internal control components are control environment, risk assessment, control activities, information and communication, and monitoring activities. The control environment establishes expectations and accountability; risk assessment identifies threats to objectives; control activities implement responses. Information and communication supply relevant knowledge to responsible people, while monitoring evaluates whether the system continues to work. Components interact rather than functioning as interchangeable labels. A strong approval procedure can fail if employees cannot access relevant information or leaders reward bypasses. Assessment should examine both individual components and how they operate together for the specified objectives.
Worked example: For refund fraud, management identifies false-customer claims, assigns independent approval, supplies transaction histories, trains staff, and reviews override trends. If supervisors encourage bypassing approval to improve speed targets, the control environment can undermine the otherwise sensible control activity.
Common mistake: Classifying every anti-fraud action as a control activity misses the distinct contributions of culture, risk analysis, information, and monitoring.
Official syllabus reference: [3]
15. Control gaps, design deficiencies, and execution failures
A control gap exists when an identified risk has no relevant response. A design deficiency exists when the prescribed control would not adequately address the risk even if performed correctly. An operating effectiveness failure occurs when a suitable control is not implemented or performed consistently as intended. The distinction determines remediation: create coverage, redesign the mechanism, or fix execution. More training will not repair a review that lacks the information needed to detect manipulation. Conversely, rewriting a sound policy may accomplish little if staffing shortages prevent reviewers from carrying it out.
Worked example: A refund review requires comparison with original sales, but reviewers cannot access sales records. That is a design problem. If records are available and reviewers simply skip the comparison, the same process instead has an execution problem requiring different corrective action.
Common mistake: Calling every exception a training issue bypasses the necessary question of whether the prescribed control could actually detect or prevent the scheme.
Official syllabus reference: [3]
Auditors’ Fraud-Related Responsibilities
16. Internal, external, and government audit objectives
Internal audit provides independent, objective assurance and advice concerning governance, risk management, and controls within its mandate. External financial statement auditors focus on an opinion about financial statements under the applicable reporting and auditing frameworks. Government auditors may examine financial reporting, compliance, or performance under a public-sector mandate. Fraud responsibilities follow the engagement’s objectives and applicable standards, so the auditor’s title alone does not establish every required procedure. Understanding scope avoids both assuming that all auditors investigate every allegation and overlooking fraud risks relevant to the particular audit objectives.
Worked example: A public hospital has an external financial statement audit and a government performance audit of procurement. A bid-rigging concern may affect both, but each team evaluates its significance against different objectives and coordinates within authorized information-sharing and reporting arrangements.
Common mistake: Assuming that a government audit is always a financial statement audit ignores performance and compliance mandates with different evidence and reporting objectives.
Official syllabus reference: [3]
17. Quantitative and qualitative financial statement materiality
Materiality concerns whether a misstatement, individually or with others, could reasonably influence financial statement users’ decisions. Quantitative benchmarks assist planning and evaluation, but nature and circumstances also matter. A small deliberate payment involving senior management can raise concerns about integrity, concealment, or regulatory exposure disproportionate to its amount. Materiality is therefore not a universal percentage or a permission to ignore all smaller items. Auditors consider aggregate effects and qualitative significance, then determine implications for risk assessment, additional work, communication, and the eventual opinion under the applicable framework.
Worked example: A senior executive conceals USD 4,000 of personal expenses below the audit’s numerical threshold. The auditor considers what the concealment implies about management representations and override, rather than assuming that reimbursement alone resolves every issue relevant to the audit.
Common mistake: Using a planning threshold as an automatic fraud reporting exemption ignores qualitative significance and the broader implications of intentional senior-management misconduct.
Official syllabus reference: [3]
18. Internal audit competence and engagement boundaries
Internal auditors need sufficient understanding of fraud risks and controls to evaluate relevant exposure within their work. That does not mean every internal auditor possesses specialist investigative expertise. Engagement planning should match objectives, skills, resources, and methods to the risk being examined. When specialized work is necessary, appropriate expertise can be obtained without surrendering professional judgment or oversight. Advisory work should have clear boundaries so internal audit does not become the owner of controls it may later assess. The applicable internal audit standards and organizational mandate determine specific responsibilities and communication arrangements.
Worked example: An internal audit team reviewing procurement identifies suspicious links among bidders but lacks forensic data skills. It obtains a qualified analyst for authorized relationship testing while retaining responsibility for evaluating the evidence and avoiding ownership of supplier selection decisions.
Common mistake: Assuming general audit experience automatically qualifies someone to perform every digital investigation overlooks the distinct skills and methods required for reliable specialist work.
Official syllabus reference: [3]
19. Internal audit escalation of unresolved fraud exposure
Internal audit communication should make significant fraud-related findings understandable to people authorized to act. Useful reporting identifies the condition, relevant criteria, evidence, risk consequences, and management’s proposed response. Escalation is particularly important when management delays action or accepts exposure beyond its authority. Direct access to appropriate governance personnel protects against filtering by an implicated executive. Communication should distinguish allegations from substantiated findings and preserve confidentiality. Internal audit can track action completion and validate remediation, but management remains responsible for implementing controls and making authorized operational risk decisions.
Worked example: Internal audit reports that supplier changes are released before verification. Management repeatedly misses agreed corrective dates. The audit leader communicates the unresolved exposure and missed commitments to the audit committee, which asks management to explain ownership, resources, and revised deadlines.
Common mistake: Closing a finding when management promises action substitutes an intention for evidence that the relevant control weakness has actually been corrected.
Official syllabus reference: [3]
20. External audit reasonable assurance and fraud concealment
A financial statement audit seeks reasonable assurance that the statements as a whole are free from material misstatement caused by fraud or error. Fraud can be harder to detect because perpetrators may collude, forge evidence, conceal transactions, or override controls. The auditor responds through risk assessment, skeptical evaluation, and procedures appropriate to identified risks. Reasonable assurance remains high assurance, but it does not certify the absence of all fraud or cover every operational loss. Engagement scope and applicable standards determine responsibilities rather than a general expectation that auditors guarantee organizational honesty.
Worked example: A company suffers an employee theft that does not materially affect its financial statements. The external audit’s opinion does not establish that the theft never occurred. Conversely, evidence of concealment may still require consideration because it can affect audit risk and evidence reliability.
Common mistake: Reading an unmodified financial statement opinion as a fraud-free certificate extends the opinion beyond its defined subject matter and assurance boundary.
Official syllabus reference: [3]
21. Management override and external audit communication
Management override occurs when people with authority bypass established controls, making ordinary process compliance an incomplete safeguard. Relevant audit responses can include examining journal entries, significant unusual transactions, and potentially biased estimates, depending on the applicable standards and risk assessment. Suspected management involvement also affects whom the auditor communicates with and whether representations remain reliable. Communication should reach the appropriate level, including governance when warranted, rather than stopping with the implicated person. Reporting outside the organization is jurisdiction-dependent and must not be assumed to follow one universal rule.
Worked example: Routine purchase approvals operate correctly, but the finance chief posts an unusual year-end entry directly to revenue. The auditor examines its support, business purpose, and authorization, considers similar entries, and evaluates communication with governance because ordinary purchasing controls do not address that override.
Common mistake: Concluding that strong routine controls eliminate management fraud risk overlooks senior personnel’s ability to bypass the controls that constrain other employees.
Official syllabus reference: [3]
22. Government audit mandates and fraud reporting
Government audit responsibilities depend on the governing mandate and adopted standards, which may cover financial statements, compliance, or program performance. Auditors consider fraud that could significantly affect their audit objectives and adapt procedures when indications arise. A performance audit might examine procurement integrity even when financial statement misstatement is not the principal issue. Reporting channels can include oversight bodies or investigative authorities, but requirements differ across jurisdictions and engagements. A government auditor should distinguish established evidence from suspicion and avoid treating an audit finding as an automatic criminal determination.
Worked example: A government performance audit examines whether emergency supplies reached intended clinics. Delivery records suggest fabricated receipts. The team assesses the effect on its service-delivery conclusions, extends relevant testing, and uses the referral and reporting routes specified by its actual mandate.
Common mistake: Applying one country’s public-sector referral rules to every government audit replaces engagement-specific authority with an unsupported universal legal assumption.
Official syllabus reference: [3]
Fraud Prevention Programs
23. Formal anti-fraud policy architecture
A formal anti-fraud policy translates organizational expectations into usable responsibilities and procedures. It should define covered conduct, scope, reporting routes, handling responsibilities, nonretaliation expectations, investigation authority, and consequences applied through appropriate processes. Examples help employees recognize conduct that abstract definitions may obscure. The policy should address senior personnel and third parties where relevant, with alternatives when ordinary reporting lines are conflicted. Publication alone is insufficient: ownership, training, periodic review, and consistent implementation connect the document to behavior. A policy must not promise absolute confidentiality or guaranteed outcomes that cannot be delivered.
Worked example: A supplier-contact policy explains fabricated invoices, concealed conflicts, and reporting options outside the purchasing hierarchy. It identifies the function that screens reports and provides an alternate route for allegations about that function’s leader, making the policy usable during a conflict.
Common mistake: Treating a broad statement that fraud is prohibited as a complete policy leaves employees without practical reporting routes and decision responsibilities.
Official syllabus reference: [3]
24. Ethics programs and practical decision support
An ethics program helps people recognize and resolve conduct questions before misconduct becomes an investigation. It combines a code of conduct with advice channels, leadership example, training, fair enforcement, and evaluation of organizational incentives. Unlike a narrow prohibition list, useful decision support addresses conflicts, gifts, truthful reporting, and competing pressures through realistic situations. Consistency matters because selective enforcement teaches employees that influence can override stated values. An ethics program complements transaction controls; it cannot replace verification, authorization, or access restrictions when a scheme can exploit an operational weakness.
Worked example: A sales employee is unsure whether a customer’s gift is acceptable. An accessible advice channel explains the relevant policy and records the decision before acceptance. Management applies the same process to senior executives, reinforcing that rank does not create an informal exemption.
Common mistake: Assuming ethical intentions make transaction controls unnecessary overlooks how mistakes, pressure, and deliberate concealment can persist despite a well-written code.
Official syllabus reference: [3]
25. Role-based fraud awareness training
Fraud awareness training is most useful when employees can connect scheme indicators to decisions they actually make. Accounts payable staff need different examples from sales managers or board members. Training should explain relevant red flags, required control steps, reporting routes, and the difference between suspicion and proof. Practice scenarios can test whether participants recognize a beneficiary change or pressure to override approval. Completion rates show participation, not necessarily competence or changed behavior. Evaluation can examine scenario performance and subsequent process exceptions while avoiding simplistic claims that training alone caused every improvement.
Worked example: Payment staff practice responding to an urgent email requesting new bank details. They identify the need for verification through an established independent contact and escalation of unresolved exceptions. A short exercise tests the required decision rather than merely asking whether they read the policy.
Common mistake: Using attendance as the sole measure of training effectiveness confuses exposure to information with the ability to apply it under pressure.
Official syllabus reference: [3]
26. Behavioral nudges and perceived detection
A behavioral nudge changes the decision environment to make a desired action more salient or easier without necessarily imposing a new prohibition. An honesty reminder placed before certification can focus attention on truthful reporting at the relevant moment. Communicating credible detection activity can also affect perceived opportunity and the expected consequences of misconduct. Such messages should accurately describe real practices rather than invent surveillance capabilities. Nudges need evaluation because effects vary by setting and can fade. They supplement evidence checks, independent authorization, and enforcement rather than serving as equivalent substitutes.
Worked example: An expense form places a concise accuracy certification before claim submission and explains that selected supporting records are reviewed. The organization tests whether unsupported claims decrease, while retaining approval and audit procedures that make the detection message credible in practice.
Common mistake: Assuming a reminder has the same preventive strength as independent verification mistakes an influence on choices for a barrier to payment.
Official syllabus reference: [3]
27. Continuous monitoring versus continuous auditing
Continuous monitoring is generally management’s ongoing use of data or other checks to manage operations and controls. Continuous auditing uses recurring audit procedures to provide assurance about relevant risks and controls. Both can use automated exception rules, but ownership and purpose differ. A duplicate-payment alert needs reliable input data, an appropriate matching rule, and a person responsible for resolution. Producing alerts without investigation can create false comfort. Analytics identify anomalies requiring interpretation; repeated amounts, shared addresses, or unusual timing are not themselves proof of fraud or substitutes for supporting evidence.
Worked example: Finance reviews daily duplicate-payment alerts and corrects confirmed errors as part of operations. Internal audit independently tests the alert logic, completeness of the payment feed, and management’s closure evidence. The same data supports monitoring and assurance through different responsibilities.
Common mistake: Calling every automated report continuous auditing ignores whether management or an independent assurance function owns the activity and evaluates its results.
Official syllabus reference: [3]
28. Reporting channel accessibility and independent triage
A reporting program needs accessible intake and credible handling. Employees and relevant outsiders should understand available channels, what information helps assessment, and how to report outside a conflicted supervisory line. Independent triage evaluates urgency, potential conflicts, evidence-preservation needs, and the appropriate case owner. Anonymous reporting can improve access where feasible, while confidentiality means restricting information to authorized people rather than guaranteeing that identity can never become known. Multiple channels are useful only if reports converge into accountable case handling with acknowledgement and suitable feedback where circumstances permit.
Worked example: A contractor reports suspected invoice manipulation through a web channel because the purchasing manager controls the normal contact route. Triage identifies that conflict, preserves relevant records, and assigns the report outside purchasing instead of forwarding it to the implicated manager.
Common mistake: Equating an outsourced hotline with independent case handling overlooks who receives, screens, investigates, and closes the allegations after intake.
Official syllabus reference: [3]
29. Retaliation protection and post-report follow-up
Retaliation protection requires more than a written ban because adverse treatment can be subtle, delayed, or disguised as routine management action. Relevant indicators include unexplained assignment changes, exclusion, threats, or inconsistent performance treatment after reporting. A credible program provides independent routes for retaliation concerns, restricts unnecessary identity disclosure, and follows up appropriately with reporters. It must also assess legitimate employment decisions fairly rather than presuming every unfavorable event is retaliation. Specific legal protections differ by jurisdiction; organizational safeguards should clearly state their scope, ownership, and investigation process without inventing universal rights.
Worked example: After raising a concern, an employee loses preferred shifts despite unchanged performance. The protection team compares scheduling reasons and prior practice, interviews appropriate people, and examines timing. It evaluates possible retaliation without assuming that either the employee’s report or the manager’s explanation settles the matter.
Common mistake: Assuming the absence of dismissal proves effective protection overlooks intimidation, exclusion, and assignment changes that can discourage future reporting.
Official syllabus reference: [3]
30. Performance incentives and anti-fraud culture
Performance systems shape fraud incentives by determining which results and behaviors receive rewards. A target can increase pressure when employees believe failure threatens compensation or employment, especially if management ignores how results are achieved. Balanced measures can include control compliance, customer outcomes, and truthful escalation alongside financial performance. Measures should avoid rewarding superficial activity, such as closing alerts quickly without investigating them. Incentive redesign reduces contributing pressures but does not eliminate individual responsibility or the need for controls. Leaders reinforce culture when promotion and discipline decisions consistently support the stated standards.
Worked example: A collection team receives bonuses only for speed, encouraging staff to close unresolved exceptions. Management adds quality review and substantiated resolution measures, then checks whether employees are merely relabeling open issues. The revised incentives address behavior rather than relying on another ethics slogan.
Common mistake: Rewarding a low reported incident count can encourage concealment when managers interpret the measure as evidence that reporting itself harms performance.
Official syllabus reference: [3]
31. Incident response, corrective action, and lessons learned
A fraud incident response should connect fair fact-finding with containment, authorized decisions, and prevention improvement. Initial steps include assessing urgency, preserving relevant information, managing conflicts, and assigning appropriate expertise. Findings should distinguish established facts from unresolved allegations. Corrective action addresses the scheme’s enabling conditions, not merely the individual involved. Closure includes ownership and verification of remediation, with proportionate communication of verified lessons. Disclosures must respect confidentiality and applicable legal constraints. A completed investigation does not prove the entire organization is fraud-free or that the same weakness has been corrected everywhere.
Worked example: An investigation confirms diverted refunds caused by unchecked beneficiary edits. The organization preserves records, resolves personnel and recovery decisions through authorized processes, restricts edits, and tests the new approval step. Staff receive practical lessons without unnecessary disclosure of personal case information.
Common mistake: Treating termination of one employee as complete remediation leaves the exploitable process unchanged and may permit the same scheme to recur.
Official syllabus reference: [3]
Fraud Risk Assessment
32. Fraud risk assessment versus fraud investigation
A fraud risk assessment identifies how fraud could affect objectives, evaluates exposure, and supports decisions about controls and remaining risk. An investigation examines suspected conduct to establish relevant facts. Fraud risk therefore concerns the possibility of misconduct and its consequences, while fraud concerns actual intentional misconduct. Assessment workshops can discuss credible hypothetical schemes without accusing particular employees. Conversely, an assessment is not a substitute for an appropriately authorized response to a specific allegation. Keeping purposes distinct improves participation and ensures that discovered indicators receive suitable handling without turning every theoretical vulnerability into a conclusion of wrongdoing.
Worked example: A workshop identifies that one employee could create a fictitious supplier and release payment. That scenario warrants control evaluation, not an accusation. If the team then discovers unexplained payments to a newly created supplier, it routes the specific concern for separate assessment and investigation.
Common mistake: Describing every high-risk process as confirmed fraud confuses vulnerability with occurrence and can undermine both fair treatment and useful risk discussion.
Official syllabus reference: [3]
33. Assessment team composition, buy-in, and objectivity
A strong assessment team combines fraud knowledge with detailed understanding of operations, systems, finance, compliance, and relevant human behavior. Process staff explain how work actually occurs; specialists challenge assumptions and identify concealment methods. Senior sponsorship provides resources and authority, while clear communication explains the assessment’s value without presenting it as a search for blame. Objectivity requires opportunities to challenge powerful owners and discuss weaknesses outside conflicted reporting lines. A team consisting only of senior managers may miss workarounds, while a purely specialist team may construct scenarios disconnected from actual processes.
Worked example: A procurement assessment includes buyers, accounts payable, information technology, compliance, and an independent facilitator. A junior employee explains an unofficial urgent-payment route absent from policy documents. That operational knowledge reveals an opportunity that the original management-only discussion had overlooked.
Common mistake: Selecting only the most senior participants may increase authority while excluding the people who understand daily exceptions and practical control bypasses.
Official syllabus reference: [3]
34. Scope boundaries and internal–external fraud interfaces
Assessment scope should identify objectives, processes, entities, systems, locations, third parties, and the period or change being considered. Internal fraud involves insiders exploiting their position; external fraud originates outside the organization, although collusion can cross that boundary. Mapping interfaces prevents gaps where one team assumes another covers supplier onboarding, payment release, or outsourced processing. Scope limitations should be explicit because conclusions apply only to the areas examined. Boundary setting should follow actual transaction and data flows rather than organizational charts alone, especially where third parties perform critical activities.
Worked example: A payment assessment covers supplier registration, invoice approval, bank-detail changes, and the outsourced payment platform. Including the handoffs reveals that an external fraudster could persuade an employee to alter a legitimate supplier’s account, creating a combined external attack and internal process failure.
Common mistake: Excluding outsourced activities because they occur outside the organization ignores the fraud exposure created by retained responsibilities and process handoffs.
Official syllabus reference: [3]
35. Scheme-based brainstorming and process walkthroughs
Effective fraud risk identification moves from vague labels to specific schemes. A useful scenario states who could act, what asset or information could be manipulated, how access is obtained, how the conduct benefits someone, and how it could be concealed. Workshops, interviews, prior incidents, data analysis, and process walkthroughs contribute different evidence. Walkthroughs trace an example from initiation through recording and settlement to expose exception routes. Scenario generation should include management override and collusion rather than assuming every actor follows the documented procedure. Plausibility matters more than an impressive number of generic risks.
Worked example: Instead of recording “procurement fraud,” a team describes a buyer splitting orders to avoid approval and steering them to a concealed related supplier. It walks through requisition, vendor creation, invoice matching, and payment to identify where the scheme would leave observable evidence.
Common mistake: Listing broad categories without an actor, method, and concealment path makes it difficult to identify which controls actually address the proposed scheme.
Official syllabus reference: [3]
36. Inherent likelihood, impact, and expected loss
Inherent risk is exposure before considering the relevant controls. Likelihood and impact can be assessed qualitatively or quantitatively using clearly defined assumptions. Where a scenario provides a valid annual event probability and loss conditional on that event, their product gives expected annual loss for a single-event model. Ordinal labels such as low, medium, and high are rankings, not measured probabilities, so multiplying their scores does not create a precise financial estimate. Severe tail outcomes, uncertainty, and nonfinancial consequences can justify attention even when a scheme’s average expected loss is comparatively small.
Worked example: A scenario assumes a 10% annual chance of one USD 300,000 diversion, producing USD 30,000 expected annual loss. The team reports both assumptions and also considers disruption, rather than describing USD 30,000 as the amount that will definitely be lost next year.
Common mistake: Treating a heat-map score as a statistically calibrated probability gives a prioritization tool more numerical precision than its inputs support.
Official syllabus reference: [3]
37. Preventive, detective, and corrective control mapping
Control mapping links a specific fraud scenario to mechanisms that interrupt, reveal, or address it. Preventive controls aim to stop an event, detective controls identify events or anomalies, and corrective controls help contain effects and restore acceptable operation. Timing and mechanism determine classification: an exception review before payment may prevent loss, while the same review after payment is detective. Mapping should identify control owners, frequency, information used, and evidence of completion. A general policy statement may support culture without directly blocking the scheme, and several controls can share one common point of failure.
Worked example: For fictitious suppliers, independent onboarding verification is preventive, post-payment supplier analysis is detective, and disabling a confirmed false supplier is corrective. If the same buyer controls every step, the apparent layers may provide less independence than the control inventory suggests.
Common mistake: Counting controls without examining their mechanisms can overstate protection when several depend on the same person, data source, or unverified assumption.
Official syllabus reference: [3]
38. Design evaluation through control walkthroughs
Design evaluation asks whether a control, if performed as prescribed, can reduce the identified fraud risk to the intended extent. A walkthrough examines inputs, reviewer competence and authority, timing, decision criteria, exception handling, and retained evidence. A signature is not enough if the reviewer lacks supporting records or reviews only after funds are irretrievable. The assessment should consider plausible bypasses, including collusion and override. A walkthrough can establish understanding and reveal design weaknesses, but observing one transaction does not demonstrate that the control operated effectively throughout an extended period.
Worked example: A manager signs supplier-change forms but sees only the new bank details, with no independent source for comparison. A walkthrough shows that conscientious signing would still fail to verify legitimacy. The design needs an independent verification source, rather than merely a second signature.
Common mistake: Assuming an approval box establishes effective design overlooks whether the approver has the information, authority, and timing needed to challenge the transaction.
Official syllabus reference: [3]
39. Operating effectiveness evidence and sampling limits
Operating effectiveness testing examines whether a suitable control actually operated consistently during the relevant period. Evidence can include inspection, observation, reperformance, and corroborated inquiry, selected to match the control’s nature. Sampling should address the population, period, relevant risk characteristics, and reliability of the underlying data. A review mark may show that someone signed, but not necessarily that the substantive comparison occurred. Exceptions require analysis of cause, extent, and consequences. Results should reflect testing limitations; a sample with no detected deviations is evidence supporting a conclusion, not proof of perfect operation everywhere.
Worked example: An assessor selects supplier changes across several months and includes urgent exceptions. For each, the assessor checks independent contact evidence and whether approval preceded release. Two late reviews prompt examination of the urgent route rather than an unsupported conclusion that every change failed.
Common mistake: Treating a current demonstration by a knowledgeable employee as proof of past compliance ignores the period and transactions the assessment is meant to cover.
Official syllabus reference: [3]
40. Residual risk and overlapping control effects
Residual risk is the exposure remaining after considering relevant controls and their actual effectiveness. It should be reassessed using evidence about prevention, detection timing, recovery, and remaining vulnerabilities rather than reduced automatically because controls exist. Sequential control percentages apply to their stated populations; rates cannot simply be added when controls affect overlapping events. Shared dependencies can further limit combined protection. Residual estimates should preserve uncertainty and identify whether controls change likelihood, impact, or both. A planned control belongs in a future-state estimate until implementation and operation provide evidence for the current assessment.
Worked example: Of 100 simulated false claims, one control stops 60. A second stops half of the remaining 40, leaving 20. The combined result is an 80% reduction in that simulation, rather than a 110% reduction obtained by adding the two stated rates.
Common mistake: Crediting proposed controls as already effective understates current exposure and obscures the need to manage risk during implementation and testing.
Official syllabus reference: [3]
41. Assume, mitigate, avoid, or transfer residual risk
Residual risk responses should reflect appetite, authority, cost, feasibility, and consequences. Assuming risk means consciously retaining it with an accountable decision; mitigation changes likelihood or impact through additional measures. Avoidance stops or changes the activity generating the exposure. Transfer shifts specified financial consequences through arrangements such as insurance or contracts, subject to terms and counterparty capability. Transfer rarely removes every operational, reputational, or compliance consequence. Decisions should state the exposure retained, response owner, and review conditions. A manager cannot validly accept risk outside delegated authority merely because the process has operated that way for years.
Worked example: A company retains a low-value reimbursement exposure with documented approval, adds verification for higher-risk claims, stops using an unmanageable payment route, and purchases limited crime insurance. These are different responses, and the insurance exclusions still leave some losses with the company.
Common mistake: Describing insurance as elimination of fraud risk ignores deductibles, exclusions, claims conditions, and consequences that the insurance contract does not cover.
Official syllabus reference: [3]
42. Decision-useful assessment reporting
A useful assessment report connects objectives, scope, method, significant schemes, control evidence, residual exposure, and proposed responses. Readers need to understand what was assessed, what remains uncertain, and which decisions require action. Priorities should be supported by stated criteria rather than unexplained color ratings. Assigning owners, target dates, and acceptance authority turns findings into accountable decisions. Sensitive details can be restricted to appropriate recipients while governance receives sufficient information for oversight. Reporting should distinguish current exposure from expected future improvements and should not imply that identifying risks establishes misconduct by named individuals.
Worked example: An assessment report identifies supplier-change diversion as a high-priority residual risk, explains the failed verification evidence, and assigns a finance owner and implementation date. It separately states that the review did not determine whether any specific employee had intentionally diverted funds.
Common mistake: Delivering only a ranked risk list leaves decision-makers without the evidence, ownership, and action requirements needed to manage the identified exposure.
Official syllabus reference: [3]
43. Change-triggered reassessment and challenge
Fraud risk assessment needs updating when the business, systems, incentives, or threat environment changes. Acquisitions, rapid growth, staff reductions, outsourcing, new payment channels, and control failures can invalidate earlier assumptions. Defined triggers help management decide when a focused reassessment is needed between broader periodic reviews. Independent challenge from internal audit or other suitable functions can test whether owners are overlooking new exposure. Reassessment differs from daily alert monitoring: it revisits the underlying scenarios and control assumptions. The resulting changes should flow into risk ownership, control design, and governance reporting rather than remaining a separate exercise.
Worked example: A company replaces manual supplier payments with an application interface. Its prior assessment assumed a person reviewed every bank change. A focused reassessment examines interface permissions, automated validation, and exception routes because the technology change altered the original opportunity and control assumptions.
Common mistake: Reusing last year’s ratings after a major process change assumes that historical control evidence remains relevant despite a different transaction pathway.
Official syllabus reference: [3]
Fraud Risk Management
44. Fraud risk management within enterprise strategy
Fraud risk management aims to reduce the likelihood and consequences of fraud while supporting organizational objectives. Enterprise risk management connects risks with strategy, performance, and resource decisions across the organization. Integrating the two ensures that growth plans, acquisitions, and new distribution models account for foreseeable fraud exposure before commitments become difficult to reverse. Fraud analysis contributes detailed scenarios and response options, while the enterprise perspective considers trade-offs with other risks and opportunities. Integration does not require every risk to use identical numerical scoring, but it does require compatible decision authority and meaningful communication.
Worked example: Before entering a market through commission agents, a company considers fictitious services and concealed ownership alongside commercial growth forecasts. Management compares direct sales, limited pilots, and agent controls, allowing fraud exposure to influence the strategic choice rather than merely the later investigation budget.
Common mistake: Treating fraud management as exclusively reactive investigation excludes foreseeable exposure from the strategic decisions that create or amplify it.
Official syllabus reference: [3]
45. Program oversight, accountability, and compliance
Fraud risk management oversight establishes who sets expectations, who operates the program, and who independently evaluates it. Governance needs reporting on significant exposure, unresolved actions, resources, and emerging patterns rather than only investigation counts. Management translates expectations into controls and case processes, while designated compliance functions address relevant requirements within their mandates. Metrics require interpretation: more reports may reflect better trust rather than more misconduct, and rapid closure may conceal superficial work. Oversight should challenge the quality of decisions and remediation without assuming ownership of every operational task or investigation.
Worked example: A board committee receives rising hotline volumes alongside evidence of improved channel awareness and stable substantiation patterns. It asks about response quality and retaliation concerns rather than automatically declaring the program worse because the raw number of reports increased.
Common mistake: Using fewer allegations as the sole success measure can reward silence and discourage the reporting needed to identify and manage fraud.
Official syllabus reference: [3]
46. ISO 31000’s iterative risk process
ISO 31000 provides general risk management guidance organized around principles, a supporting framework, and a risk management process. The process includes communication and consultation, scope and context, risk assessment, treatment, monitoring and review, and recording and reporting. Risk assessment encompasses identification, analysis, and evaluation, which should not be collapsed into a scoring exercise. Applied to fraud, the approach links plausible schemes with decisions and feedback as circumstances change. ISO 31000 is broad guidance rather than a fraud-specific control catalogue, so organizations must supply relevant fraud expertise, scenarios, and operational mechanisms.
Worked example: A company considering an online refund service defines objectives and appetite, identifies impersonation schemes, analyzes exposure, evaluates acceptability, and selects verification controls. It then reviews exception patterns and stakeholder feedback, using the results to revise treatment rather than treating the original assessment as final.
Common mistake: Treating ISO 31000 as a prescribed list of transaction controls overlooks its role as general guidance for organizing risk decisions and improvement.
Official syllabus reference: [3]
47. COSO ERM and the risk–performance connection
COSO enterprise risk management guidance links governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting. Fraud risk can influence each connection: incentives shape culture, strategic choices create exposure, and performance information can reveal manipulation. The approach encourages considering risk when setting objectives rather than attaching a register after strategy is fixed. It differs from COSO’s five-component internal control model, although the frameworks are complementary. Effective application examines whether objectives, appetite, resources, and observed results remain aligned instead of treating the framework as a terminology exercise.
Worked example: An aggressive expansion target depends on distributors whose ownership and services are difficult to verify. Applying an enterprise risk perspective, executives reconsider the growth pace, required oversight resources, and commission structure rather than asking only whether invoice approval signatures are present.
Common mistake: Substituting the internal control component names for ERM analysis misses the broader relationship among strategy, objectives, risk appetite, and performance.
Official syllabus reference: [3]
48. The ACFE/COSO five-principle fraud program
The ACFE/COSO fraud risk management model connects fraud governance, fraud risk assessment, preventive and detective control activities, investigation and corrective action, and monitoring. Governance establishes expectations and roles; assessment identifies exposure; controls address schemes. Investigation resolves indicators and informs corrective action, while monitoring evaluates whether the overall program remains effective. The principles form a feedback system rather than a one-time implementation sequence. A company with policies and controls can still have a major program gap if allegations receive inconsistent handling or no one checks whether remediation works. Implementation should be proportionate to organizational circumstances.
Worked example: A company has a code, fraud workshops, and transaction checks, but reports disappear into separate departments. It establishes coordinated intake and investigation ownership, then monitors case handling and control remediation. These additions complete missing mechanisms rather than simply adding another policy.
Common mistake: Assuming assessment and controls constitute the entire program leaves allegation resolution, corrective action, and effectiveness monitoring without a defined mechanism.
Official syllabus reference: [3]
49. Applying the Fraud Triangle to risk responses
The Fraud Triangle can organize complementary responses to pressure, opportunity, and rationalization. Opportunity responses include access limits, independent verification, and meaningful review. Pressure responses can address unrealistic targets, perverse incentives, and barriers to raising concerns. Rationalization responses clarify expectations, demonstrate fair enforcement, and challenge claims that manipulation is harmless or deserved. These actions operate at different points in the causal pathway and should not be treated as interchangeable. The model does not require discovering every employee’s private motives, and reducing one factor does not establish that fraud is impossible or that other controls are unnecessary.
Worked example: To address premature sales recognition, management revises an unrealistic bonus threshold, introduces independent cutoff checks, and uses realistic training to challenge the claim that early recording merely borrows from next month. Each response targets a different contributing condition in the same scheme.
Common mistake: Responding to every fraud scenario only with ethics training leaves exploitable access and incentive structures unchanged even when the opportunity is well understood.
Official syllabus reference: [3]
50. Risk-based third-party onboarding and beneficial ownership
Third-party onboarding should establish who the organization is dealing with, why the relationship is needed, and whether proposed services and payments are credible. Relevant checks can include identity, beneficial ownership, conflicts, capabilities, references, commercial rationale, and applicable screening requirements. The depth should reflect risk rather than applying identical effort to every relationship. Beneficial ownership analysis looks beyond the named entity to people who ultimately own or control it, helping reveal concealed interests. Due diligence supports a decision but does not guarantee future conduct, and contractual promises need practical verification and response mechanisms.
Worked example: A proposed consultant requests a large success fee but provides little evidence of staff or services. Ownership checks reveal a connection to the buyer’s employee. The company evaluates the conflict, actual capability, and payment rationale before deciding whether the relationship is acceptable.
Common mistake: Treating a registered company name and signed declaration as complete diligence overlooks hidden ownership, inadequate capability, and unsupported commercial purpose.
Official syllabus reference: [3]
51. Third-party transaction monitoring and change detection
Ongoing third-party management checks whether relationship facts and actual transactions remain consistent with the approved purpose. Useful indicators include ownership changes, unusual beneficiaries, unsupported commissions, duplicate invoices, subcontracting changes, and activity inconsistent with capacity. Monitoring should connect alerts to accountable review and proportionate action rather than merely producing a dashboard. Verification can include service evidence, independent beneficiary confirmation, and reassessment of risk ratings. An anomaly is a reason to investigate, not a conclusion of misconduct. Periodic refresh and event-driven checks work together because significant changes may occur long before the next scheduled renewal.
Worked example: An established agent requests payment to a newly introduced company and doubles its fee without changed services. The reviewer verifies ownership and contractual entitlement, examines service evidence, and resolves the exceptions before authorizing payment. The original onboarding approval does not settle these new facts.
Common mistake: Relying indefinitely on initial due diligence assumes that ownership, incentives, services, and payment arrangements remain unchanged throughout the relationship.
Official syllabus reference: [3]
Ethics for Fraud Examiners
52. Integrity and truthful professional representations
Integrity requires honest conduct and truthful representations about evidence, qualifications, methods, and findings. A fraud examiner should not inflate credentials, imply work was performed when it was not, or present an inference as an observed fact. Accuracy applies to omissions as well as explicit statements when omission would make the communication misleading. Client loyalty does not justify deception, and pressure to achieve a preferred result does not change the evidence. Professional integrity supports confidence in both favorable and unfavorable findings because the examiner’s role is to establish and communicate supportable information rather than manufacture a desired outcome.
Worked example: An examiner reviewed selected invoices but not the full population. The report describes the selection and scope accurately instead of stating that all payments were verified. This preserves the distinction between evidence actually obtained and broader assurance that the work cannot support.
Common mistake: Calling selective testing a complete review because the client expects certainty misrepresents the work performed and overstates the support for conclusions.
Official syllabus reference: [3]
53. Responding to potentially illegal instructions
An examiner should not participate in illegal or unethical conduct merely because a client or superior requests it. When an instruction may be unlawful, the response begins with clarifying the facts, preserving appropriate records, and avoiding the questionable act while obtaining competent legal or ethical guidance. Escalation should use suitable channels that account for conflicts and confidentiality. The applicable jurisdiction determines legal duties, including any external disclosure requirement; no universal reporting rule should be assumed. Refusal, reassignment, or withdrawal may be necessary when the engagement cannot be performed lawfully and ethically.
Worked example: A client asks an examiner to obtain a competitor’s private account records through a misleading identity claim. The examiner does not make the request, documents the instruction appropriately, and seeks authorized legal guidance on lawful evidence sources and whether the engagement can continue.
Common mistake: Assuming client authorization legalizes an otherwise unlawful collection method confuses the client’s wishes with the actual legal authority required for the act.
Official syllabus reference: [3]
54. Actual, potential, and apparent conflicts of interest
A conflict arises when personal, financial, relational, or professional interests could interfere with objective work. An actual conflict exists now; a potential conflict could develop; an apparent conflict concerns how a reasonable observer might view impartiality. Disclosure should occur promptly through an appropriate channel so someone independent can evaluate safeguards, reassignment, or withdrawal. The examiner’s private belief in personal fairness is not sufficient. Confidentiality still applies during disclosure, and not every conflict can be cured by consent. Material changes during an engagement can create new conflicts even if acceptance screening was sound.
Worked example: An examiner learns that a close relative has invested in a subject company. The examiner discloses the connection to the engagement leader and pauses affected judgments while an independent assessment determines reassignment or safeguards, without sharing unnecessary case details with the relative.
Common mistake: Waiting until bias is proven defeats preventive conflict management, which addresses credible interference and appearance concerns before they distort professional decisions.
Official syllabus reference: [3]
55. Professional skepticism and alternative explanations
Professional skepticism combines a questioning mind with critical assessment of evidence. It requires testing explanations, considering contradictions, and remaining alert to both deception and innocent causes of anomalies. Skepticism is neither automatic distrust nor automatic acceptance of a plausible story. An examiner should distinguish source reliability, evidence relevance, and the strength of inference, then seek corroboration proportionate to the issue. Confirmation bias arises when favorable evidence receives attention while contrary evidence is dismissed. Maintaining skepticism therefore includes deliberately considering what evidence would weaken the current theory and updating conclusions when it appears.
Worked example: Shared supplier addresses suggest a possible concealed relationship, but one address is a large business center. The examiner checks ownership, occupancy, contact details, and transaction behavior. The additional evidence determines whether the address overlap supports a scheme or has a legitimate explanation.
Common mistake: Treating every red flag as proof is accusatory certainty rather than skepticism and can cause legitimate explanations to be overlooked.
Official syllabus reference: [3]
56. Supported findings and the prohibition on guilt opinions
A fraud examiner can report established facts, explain analyses, and draw conclusions supported by sufficient relevant evidence within the engagement scope. The examiner should distinguish transaction findings from attribution and intent, especially when credentials, authority, or records are shared. The ACFE ethical boundary against expressing opinions on guilt or innocence prevents substituting an examiner’s report for the determination reserved to an appropriate decision-making process. Limitations and alternative explanations must be communicated where material. Strong evidence can support a precise account of conduct without requiring a declaration that a person is criminally guilty.
Worked example: Records show that a user account approved fictitious invoices, but access logs show several people used the account. The examiner reports the approvals and shared-access evidence, explains unresolved attribution, and avoids declaring the named account holder guilty of the scheme.
Common mistake: Assuming proof of a transaction automatically proves the named user’s intent overlooks attribution limits and the separate ethical boundary on guilt opinions.
Official syllabus reference: [3]
57. Confidential information and need-to-know access
Confidentiality limits the use and disclosure of information obtained through professional work. Access should be restricted to people with an authorized need, and disclosure should be proportionate to the purpose. This applies to whistleblower identities, personnel information, business records, and investigation findings. Confidentiality is not identical to anonymity: a reporter’s identity may be known but protected from unnecessary sharing. Obligations can continue after an engagement ends. Exceptions depend on valid authorization or applicable legal duties, so an examiner should not promise secrecy that circumstances or law may prevent the organization from maintaining.
Worked example: A case team stores a reporter’s identity separately from a working chronology used by a wider review group. Only authorized staff who need the identity receive it. The reporter is told about practical confidentiality limits rather than receiving an unconditional promise of permanent secrecy.
Common mistake: Assuming all employees are entitled to investigation records because they work for the same organization ignores authorization, necessity, and personal information restrictions.
Official syllabus reference: [3]
58. Legal privilege versus ordinary confidentiality
Legal privilege is a jurisdiction-dependent protection for qualifying communications or materials, distinct from an organization’s ordinary confidentiality expectations. Involvement of a lawyer or a label reading privileged does not automatically protect every document. Purpose, participants, content, and applicable law can affect whether protection exists and whether disclosure waives it. Fraud examiners should follow authorized legal arrangements without making independent guarantees about privilege. Ordinary underlying business records may remain discoverable even when supplied to counsel. Understanding the distinction prevents careless circulation of sensitive legal advice and inaccurate assurances to clients or witnesses.
Worked example: Counsel requests a fraud analysis for a defined legal purpose. The examiner follows counsel’s instructions on recipients and handling, while recognizing that original invoices do not automatically become privileged merely because copies were attached to a communication addressed to a lawyer.
Common mistake: Marking every investigation file privileged cannot create a protection when the jurisdiction’s legal requirements for that protection are not satisfied.
Official syllabus reference: [3]
59. Professional competence and specialist assistance
Professional competence requires accepting and performing work with the knowledge, skills, and care needed for reliable results. An examiner should assess technical demands, available resources, and personal limitations before selecting methods or making claims. Specialist assistance can address gaps in digital forensics, valuation, accounting, or other fields, but the examiner must understand how the specialist’s work supports the engagement conclusions. Competence includes preserving evidence appropriately and avoiding methods whose limitations are not understood. Learning during an engagement is not inherently improper, but it cannot justify experimenting recklessly with unique evidence or overstating expertise.
Worked example: An examiner must analyze a damaged mobile device but lacks recovery expertise. A qualified specialist creates and documents an appropriate forensic acquisition. The examiner evaluates the resulting evidence and limitations rather than attempting an unfamiliar extraction that could alter the only available device.
Common mistake: Assuming certification in fraud examination establishes expertise in every forensic technology ignores the distinct training and methods required for specialized evidence.
Official syllabus reference: [3]
60. Material matters, contrary evidence, and report completeness
Ethical reporting includes material matters discovered during the work when omitting them would distort the facts. This encompasses evidence that weakens a favored theory, limits attribution, or changes the interpretation of a transaction. Completeness does not require publishing every working paper; it requires communicating information necessary for an accurate understanding to appropriate recipients. A client cannot make a misleading report acceptable by requesting the omission. Scope limitations, unavailable records, and unresolved contradictions should be explained when consequential. Oral caveats or hidden appendices do not repair a main conclusion that the known evidence does not support.
Worked example: An employee’s approval appears on suspicious payments, but travel records and access evidence suggest another person used the credentials. The examiner includes those material facts and qualifies attribution in the main findings, rather than allowing a client-requested narrative to imply certainty.
Common mistake: Leaving contrary evidence in working papers while issuing an unqualified accusation suppresses information that readers need to understand the findings accurately.
Official syllabus reference: [3]