THURSDAY: 27 April 2023. Morning Paper. Time Allowed: 3 hours.
Answer ALL questions by indicating the letter (A, B, C or D) that represents the correct answer. This paper is made up of one hundred (100) Multiple Choice Questions. Each question is allocated one (1) mark.
1. Which of the following statement is ACCURATE in regard to accuracy in forensic audit report writing?
A. The credibility of a forensic audit report can only be affected by material inaccuracies
B. The credibility of an examination report cannot be affected by immaterial inaccuracies
C. The credibility of an examination report can be affected by both material and immaterial inaccuracies
D. The credibility of an examination report cannot affect the admissibility of the documented evidence
2. Which of the following statement is NOT correct in regard to the difference and similarities of forensic audit and fraud investigations?
A. Forensic audit or fraud investigations are identical because the purpose of both assignments is to collect evidence to prove or disapprove an allegation
B. The terms forensic audit, fraud investigations, or examinations can be used inter-changeably because the objectives of the assignments are the same
C. Forensic audit differs from fraud investigations because forensic audit is a type of a special audit conducted to collect more information and details, while fraud investigations are conducted to collect evidence that can be used in a court of law
D. An auditor cannot conduct a good fraud forensic audit without a formal training and experience in fraud investigation
3. Forensic auditors and investigators must have good interviewing skills because interviewing is one of the most important investigation methods of fraud and corruption allegations. Which of the following statements is NOT correct in regard to fraud and corruption investigations interviews?
A. Most of the fraud and corruption activities are off the book, therefore the investigator may have to get
information from people
B. In most fraud and corruption cases information and evidence is not in the books but with the people
C. Most of the fraud and corruption cases the investigator may have to get physical evidence from the suspect
D. None of the above
4. Which of the following statements BEST describe the effects of a double-negative question in fraud investigations interviews?
A. The response to a double-negative question is usually opposite to the desired one
B. The response to a double-negative question is usually the desired one
C. A double-negative question is usually effective in eliciting information
D. A double-negative question is usually effective in obtaining an admission
5. Report writing is a very important function of a fraud forensic audit. Which of the following statements is ACCURATE in regard to the contents of the introduction/ background section of a forensic audit report?
A. The introduction/background section should include all the objectives of the forensic audit
B. The introduction/background section should include the main objective of the audit, which is to prove or disapprove the allegations
C. The introduction/background section should include a summary of the findings of the forensic audit
D. The introduction/background section should include the scope of the audit
6. For an interview to be effective, the interviewer should be able to ask the right questions at the right time and to the right respondent. Which of the following statements is ACCURATE in regard to closing questions?
A. The interviewer should ask closed questions extensively in closing questions
B. The interviewer should ask open-ended questions extensively in closing questions
C. The interviewer should ask narrative questions extensively in closing questions
D. The interviewer should ask hypothetical questions extensively in closing questions
7. Which of the following statements is MOST accurate in relation to a professional fraud investigation interview?
A. The interviewer should be formal and firm
B. The interviewer should record the interview to ensure that he does not forget any important information provided during the interview
C. The interviewer should be informal but firm
D. The interviewer should be formal and friendly
8. Which of the following BEST describes the method of tracing illicit funds by comparing a suspect’s major expenditures, and assets acquired with the suspect’s known legitimate sources of funds?
A. Expenditures method
B. Bank deposit analysis method
C. Net worth analysis method
D. Asset method
9. Which of the following is NOT accurate in regard to mechanics of an interview?
A. The Interviewer should avoid taking a lot of notes during an interview
B. The interviewer should not record the interviewee without their consent
C. The interviewer should document the interview as soon as possible after the interview
D. None of the above
10. A professional interview is a structured conversation and not just a question and answer session. Which of the following is an element of conversation that the interviewer must apply during a structured conversation interview?
A. Sympathetic understanding
B. Recognition
C. Rationalisation
D. Information exchange
11. Which of the following statements is ACCURATE in regard to seizing a computer for forensic examination?
A. When a forensic investigator is seizing a running computer, he should be concerned about the integrity of the data which might be affected by the way the computer is shut down
B. When a forensic investigator is seizing a running computer, he should be concerned about the
confidentiality of the data which might be affected by the way the computer is shut down
C. When a forensic investigator is seizing a running computer, he should be concerned about the security of the data which might be affected by the way the computer is shut down
D. All the above
12. A procurement manager was a suspect on alleged corruption. During the investigation, the interviewer asked him to explain the sources of the extra funds that could not be accounted for from the legitimate known sources of his funds. Which of the following statements is NOT one of the explanations that the suspect is likely to give?
A. The procurement manager can explain that the extra funds are from gifts from his friends and relatives living abroad
B. The procurement manager can explain that the extra funds are from an inheritance
C. The procurement manager can explain that the extra funds are from the sale of a family property
D. The procurement manager can explain that the extra funds are from gifts by suppliers and contractors
13. Which of the following Statements is ACCURATE in regard to the investigator’s ability to accurately observe behavioral clues of an intelligent suspect?
A. It is very hard for an interviewer to accurately observe behavioral clues of an intelligent suspect like an
accountant because they are confident in misleading the investigator by using professional jargon
B. It is easy for an interviewer to accurately observe behavioral clues of an intelligent suspect like an accountant because he/she would experience a lot of inner tension when caught in their fraudulent activities
C. It is very hard for an interviewer to accurately observe behavioral clues of an intelligent suspect who have experience in engaging in fraudulent activities, because they are familiar with such interviews and therefore they cannot experience stress during interviews
D. None of the above
14. Circumstantial evidence that would yield the best results when the suspect is using his illicit funds to accumulate wealth by acquiring assets, and therefore causing his net worth to increase, is BEST described as which of the following methods?
A. The expenditures method
B. The Assets method
C. Net worth analysis method
D. None of the above
15. The CEO and CFO of XYZ Company were accused of fraudulent financial reporting. During an admission-seeking interview of Nelvin, the investigator states: “I know the employees’ job security depends on the company’s good performance. I am sure you did this to help the employees retain their jobs, Isn’t that right?” Which of the following BEST describes the interviewing technique?
A. Sympathetic understanding
B. Altruism
C. Recognition
D. None of the above
16. Which of the following statement is NOT correct in regard to preparing an organisation for a formal fraud investigation?
A. Inform all the managers in the organisation that a fraud investigation has been commissioned and they are expected to cooperate with the investigators
B. Do not inform legal counsel at the beginning of the investigation, but can call upon him/her if faced with complex legal issues
C. Inform management and employees to make sure you get cooperation from everyone whose assistance may
be required
D. None of the above
17. Which of the following statements is ACCURATE in regard to limitation of conducting a public database search online?
A. Information from online databases can fully be relied on in terms of accuracy and currency
B. Online public records searches are not limited in the area they cover, therefore the fraud examiners do not need to search multiple jurisdictions
C. Online coverage of public records is similar in all jurisdiction
D. None of the above
18. Fiona, a Certified Fraud Examiner, is conducting an admission-seeking interview of Faith, a fraud suspect. Fiona asks Faith: “Didn’t you know that taking the organisation’s money without permission is wrong?” Which of the following BEST describes this type of question?
A. Controlled answer technique
B. Alternative question
C. Accusatory question
D. None of the above
19. Which of the following statements is CORRECT in regard to data mining?
A. Data mining is an effective method of collecting digital evidence.
B. Data mining is the art of searching large volumes of data for patterns
C. Data mining can be used to modify raw data into understandable patterns
D. None of the above
20. Which of the following statements is ACCURATE in regard to the volatility of digital evidence?
A. Digital evidence is not as volatile as tangible evidence because data cannot be altered or destroyed easily like tangible documents
B. Once the integrity of digital evidence has been violated through alteration or destruction, it can be easily restored using special forensic tools
C. Admissibility of digital evidence is more stringent than that of tangible evidence.
D. None of the above
21. Which of the following statement is NOT most accurate in regard to audit versus fraud examinations or forensic audit?
A. Audits are conducted on a regular basis while forensic audits or fraud examinations are conducted on the basis of sufficient predication
B. Audits are general examination of financial data, while forensic audits and fraud examinations are conducted to resolve specific allegations
C. The objective of a forensic audit or fraud examination is to affix blame, while the objective of an audit is to express an opinion
D. The presumption of a forensic audit or fraud examination is proof, to prove the allegations of fraud, while that of an audit is professional skepticism
22. Which of the following is a data analysis tool that is effective in conducting money laundering investigations?
A. Link Analysis
B. Benford’s Law
C. Textual Analysis
D. Link Diagram
23. Gregory is planning to a conduct an admission-seeking interview of Jones. After introduction, which of the following BEST describes the first question that Gregory should ask?
A. “Jones, can you please tell me what you know about this matter?”
B. “Jones, who do you think could have embezzled the funds”
C. “Jones, you advanced yourself with the organization’s money without your employer’s consent, why did you do that?”
D. “Did you embezzle the money or not?”
24. During the analysis phase in digital forensic investigations, which of the following is the fraud examiner’s primary concern?
A. To protect disclosure of the evidence
B. To Protect the availability of evidence
C. To Protect the confidentiality of the evidence
D. None of the above
25. When conducting interviews, fraud examiners can ask several type of questions based on what they want to achieve. Fraud examiners would ask accusatory questions during admission seeking interviews. Which of the following is a good example of an accusatory question?
A. “You are the payables accountant right?”
B. “Did you take the money because you wanted extra money or you had an emergency?”
C. “Didn’t you know that what you were doing is not right?
D. None of the above?
26. Fraud Examiners should not use double negative questions at all when conducting interviews. Which of the following is a good example of a double-negative question?
A. “You advanced yourself with the company’s money, why did you do that?”
B. “How many times has this happened?”
C. “Who else was involved in this matter?
D. None of the above?
27. When a fraud examiner is documenting the findings of a fraud investigation, the fraud examiner CANNOT issue an opinion on which of the following areas?
A. Whether the entity’s financial transactions were recorded in accordance with accounting standards
B. The effectiveness of the organization’s fraud prevention programs
C. The effectiveness of the entity’s operations
D. None of the above
28. Which of the following is NOT a purpose of conducting textual analytics as one of the fraud investigation techniques?
A. To identify warning signs of dishonest employee behavior
B. To reveal patterns, sentiments, and red flags of fraud
C. To use unstructured data to identify red flags of fraud
D. To measure the effectiveness of the compliance program
29. Which of the following statement is NOT correct in regard to the introductory phase of a forensic audit interview?
A. In a forensic audit interview, it is the responsibility of the interviewer to establish a common ground
B. In a forensic audit interview it is the responsibility of the interviewer to establish the theme of the interview
C. In a forensic audit interview it is the responsibility of the interviewer to set the right tone of the interview
D. In a forensic audit interview, it is the responsibility of the suspect to cooperate so that he/she is not implicated
30. Which of the following statement is MOST accurate in regard to forensic audits?
A. Every forensic audit should begin with the assumption that the case will end in a criminal trial
B. Forensic audit is the methodology of resolving fraud issues from inception to disposition
C. The major objective of a forensic audit is to collect information that can be used in a court of law
D. None of the above
31. Felix, is a public officer. He is accused of engaging in bribery in the course of his duty. During an admission-seeking interview of Felix, the investigator states: “This is a big organisation with a lot of resources. The funds you took are immaterial and would not affect the financial position of the organisation. Is that right?” This interviewing technique is known as:
A. Rationalisation
B. Depersonalisation
C. Altruistic appeals
D. Extrinsic appeals
32. Which of the following types of records are NOT available from the local government?
A. Building inspector records
B. Health and fire department records
C. Birth and death certificates
D. All of the above
33. Victoria Moraa is a Certified Fraud Examiner. Victoria is conducting an admission-seeking interview of Veronica a fraud suspect. Victoria helps Veronica to rationalise their fraudulent activities by establishing a theme that Veronica was not adequately compensated. The suspect refused to accept this theory. What should Victoria do next?
A. Ask an open question
B. Terminate the interview
C. Ask an alternative question
D. Choose another theme
34. Which of the following statement is ACCURATE in regard to the acquisition process used in investigations involving digital evidence?
A. Imaging the hard drive help in making sure that the data is acquired at is original form, i.e. date stamps
B. Printing the evidence record has no effect on the admissibility of evidence
C. Acquiring the digital evidence from the suspect
D. All the above
35. Lorna Jepkemoi, a Certified Forensic Fraud Examiner, has obtained an oral admission from James Mwalali, a fraud suspect. Lorna reduced the confession into a short, concise written statement for James to sign. After James signed the statement, he remembered a significant detail that should have been included. Which of the following is a proper way of recording the omitted information?
A. Omit the information
B. Destroy the old statement and write another one to include the information omitted
C. Add an addendum to the earlier statement
D. None of the above
36. Which of the following is a common method fraudsters use to conceal illegally acquired assets?
A. Placing assets in probate
B. Selling the assets
C. Transferring assets
D. None of the above
37. Kate a Certified Forensic Fraud Examiner conducted an investigation at ABC PLC. During an admission seeking interview of Tracy, an employee at the ABC PLC, Tracy admits to the interviewer that she received a loan from a commercial bank that was guaranteed and paid for by an ABC contractor. Which of the following pieces of information does the investigator need NOT obtain from the suspect?
A. The approximate date when Tracy received the loan
B. Any items acquired with proceeds of the loan
C. Statement with moral excuses for why she received the offer
D. None of the above
38. Which of the following statements is ACCURATE in regard to a well-written fraud investigation report?
A. The report must include technical professional language to demonstrate expertise on the subject matter
B. The report must be partial to ensure emphasis of the evidence
C. The report must not mention individuals
D. None of the above
39. Link Analysis is particularly useful when investigating which type of fraud scheme?
A. Bribery
B. Cash Skimming
C. Cash Theft
D. None of the above
40. One of the methods of tracing illicit funds owned by a suspect is to develop his financial profile. Which of the following loan amounts should the investigator use to establish the amount of loan received?
A. Loan proceeds
B. Book loan amount
C. Loan principal and interest amount
D. None of the above
41. Which of the following is a step in the planning phase of the data analysis process?
A. Normalising and cleansing data
B. Identifying relevant data
C. Verifying data
D. None of the above
42. Which of the following is NOT a step of the preparation phase of the data analysis process?
A. Normalising and cleansing data
B. Determining the predication
C. Verifying data
D. None of the above
43. Keeping track of the amount of paper generated during an investigation is one of the biggest challenges in fraud cases. Which of the following is a best practice when organising evidence?
A. File chronologically or by transaction
B. File all papers chronologically
C. Establish a database after you have collected all the documents related to the investigation
D. All the above
44. Before a fraud examiner submits a fraud case for prosecution, which of the following statements BEST describes the steps the investigator should take before handing the file to the prosecution or law enforcement?
A. The fraud examiner should interview all witnesses first.
B. The fraud examiner should collect all circumstantial evidence first
C. The fraud examiner should collect all direct evidence first
D. None of the above
45. Which of the following statements BEST describes what the investigator should do if a suspect becomes uncomfortable with the sensitive question being asked by the investigator?
A. Ask open-ended questions to allow the suspect to explain themselves
B. Ask attitude questions to calibrate the suspect
C. Ask hypothetical questions because they are non-threatening
D. None of the above
46. Which of the following statements is ACCURATE in regard to leading questions?
A. Leading questions are worded in a way that the answer can be yes or no
B. Leading questions should be used extensively during the information-gathering phase
C. Leading questions should not be used at all in the information gathering phase
D. None of the above
47. Which of the following data analysis functions is most useful in testing gaps in sales invoices and check numbers?
A. Correlation analysis
B. Identifying duplicates
C. Join function
D. None of the above
48. Henry calls Roger’s bank, claiming to be Roger, with the intention of stealing his identity. Henry tells the bank representative that he needs to make sure the bank has the correct personal information on his account because he had noticed an error on his statement. The bank representative refuses to give the number. Which of the following is an example of the attempted offence by Henry?
A. Identity theft
B. Social engineering
C. Pretexting with the bank
D. Accounts take over
49. Which of the following methods of interviewing suspects is NOT recommended?
A. Interviewing a neutral witness first
B. Interviewing a suspect last
C. Interviewing any witnesses not in any particular order but rather according to their availability to save time
D. Interview co-conspirator second to last
50. Which of the following statements is ACCURATE in regard to Meta data?
A. Meta data is a user generated file which can be a good source of digital evidence
B. Meta data cannot be used in court as digital evidence because is a computer generated file
C. Meta data can only be retrieved using specialized forensic tools
D. None of the above
51. Which of the following BEST describes a method of using software to extract usable information from unstructured data?
A. Data Analysis
B. Textual Analytics
C. Benford Law
D. All the above
52. Which of the following BEST describe the order of interviewing witnesses and suspect
I. Neutral witness
II. Co-conspirator
III. Corroborative witness
IV. Suspect
A. I, III, II, I
B. I, II, III, IV
C. II, III, IV, I
D. I, IV, III, I
53. All of the following are signs of deceptive behaviour in the interview of a suspect EXCEPT:
A. The suspect plays with an object during direct questioning
B. The suspect appears casual and unconcerned
C. The suspect drops eyes while answering questions
D. None of the above
54. Which of the following statements is MOST accurate in regard to predication in fraud forensic audits?
A. Predication is the basis of conducting an investigation based on reliable sources
B. Predication is the basis of conducting an investigation based on relevant sources
C. Predication is the basis of conducting an investigation based on suspicion that fraud has occurred
D. None of the above
55. When fraud suspects decide to confess, and give some information as way of releasing inner tension of their guilt and dishonest actions, which of the following BEST describes what kind of information they are likely to give?
A. Provide a good estimate of the amount of funds defrauded
B. Provide accurate number of incidences
C. Provide exact number of other individuals involved
D. None of the above
56. Which of the following statements BEST describe a method of interrupting a suspect’s denials when directly accused by an interviewer during an admission seeking interview?
A. Reason with the suspect
B. Mention and name other witness interviewed before, who pointed at the suspect
C. Try to reason with the suspect
D. None of the above
57. A Computer creates files on the background as the user do their work. Those files are good sources of digital evidence. Which of the following is NOT one of those computer-generated files?
A. Security log file
B. System log file
C. Encrypted files
D. Application log files
58. Which of the following statements is ACCURATE in regard to fraud investigation reports?
A. The difference between an audit report and an investigation report is that an investigation report has more and detailed information than an audit report
B. The objectives of a fraud investigation report are similar to those of an audit
C. The scope part of the investigation report should be wide enough to document all possible misconducts.
D. None of the above
59. Which of the following statements is CORRECT in regard to the issues a fraud examiner should consider before conducting a computer investigation?
A. The fraud examiner should open the hard drive first.
B. The fraud examiner should run through the data to look for evidence
C. The fraud examiner should not engage an outside digital forensic expert at the beginning of the investigation
D. None of the above
60. Which of the following statements is NOT accurate in regard to volatility of digital evidence?
A. Integrity of digital evidence if violated through manipulation or destruction cannot be restored
B. The requirement for admissibility of digital evidence is not the same as that of tangible evidence
C. Failure to preserve the integrity of the digital evidence could result to evidence being inadmissible
D. All the above
61. In admission-seeking interviews, when an innocent person is directly accused, they react differently from a guilty person. Which of the following statements is CORRECT in relation to the expected response from an innocent suspect?
A. What makes you think I would do such a thing?
B. I did not do such a thing
C. Who told you that I am the one?
D. How did you know that I am the one?
62. In admission-seeking interviews, when a guilty person is directly accused, they react differently from an innocent person. Which of the following statements is NOT correct in regard to a guilty suspect’s response?
A. A guilty person answers a question with a question
B. A guilty person neither accepts nor denies the accusation
C. A guilty person strongly denies the accusation
D. None of the above
63. When an examiner is using textual analytics to look for words that are red flags of fraud, which of the following words would indicate pressure to commit fraud?
A. Override controls
B. Deserve
C. Write-off
D. None of the above
64. Benford Law can only work with natural numbers to look for red flag patterns of fraud. Which of the following is an example of a natural number?
A. Employees numbers
B. Payment vouchers numbers
C. Sales invoice numbers
D. None of the above
65. Textual analytics is a text analysis tool that can be used to identify words that are red flags of fraud. Which of the following words is a red flag of rationalisation to commit fraud?
A. Deadline
B. Write-off
C. Deserve
D. None of the above
66. Which of the following is NOT a data analysis step of the planning phase?
A. Understanding the data
B. Building a profile of potential frauds
C. Verifying data
D. Determining predication
67. An interviewer should observe the mechanics of an interview while conducting a fraud related interview, for example one-on-one interview. If a suspect insists on having a representative, what should the investigator NOT do?
A. The interviewer should not allow the suspect to bring a representative
B. The interviewer should consider not conducting the interview in the presence of a third party
C. The interviewer can try and convince the interviewee that the interview is hard and that they already there
D. None of the above
68. Which of the following is a type of informational interview questions?
A. Complex questions
B. Alternative questions
C. Double-negative questions
D. None of the above
69. An investigator must take precaution when documenting a written confession, NOT to include, which of the following moral excuses?
A. “I didn’t mean to do it.”
B. “I didn’t mean to cause any harm.”
C. “I did know that it was wrong”
D. None of the above
70. Which of the following is NOT accurate in regard to the analysis phase of digital forensic investigations?
A. During the analysis phase in digital forensic investigations, the fraud examiner should look for inculpatory evidence only and should not reveal exculpatory evidence because it will undermine the prosecution evidence
B. During the analysis phase in digital forensic investigations, the fraud examiner should look for both
exculpatory and inculpatory evidence
C. During the analysis phase in digital forensic investigations, the fraud examiner’s primary concern is to
protect the integrity of the digital evidence
D. None of the above
71. Which of the following is a NOT a type of information gathering interview questions?
A. Leading questions
B. Open ended question
C. Narrative questions
D. None of the above
72. Lucas, a Certified Forensic Fraud Examiner, is conducting an admission-seeking interview of Alfred, a fraud suspect.
Lucas asked Alfred: “Did you just want extra money, or did you do this because you had an emergency?” Which of the following statements is NOT accurate in regard to asking such a question?
A. Lucas is trying to get a benchmark admission
B. Lucas is trying to reduce moral condemnation
C. Lucas is directly accusing the suspect
D. All the above
73. In a verbal confession, the interviewer should be careful of what information he/she should take. Which of the following information should the investigator NOT obtain?
A. The accused’s motive for the offence
B. Estimates of the number of instances, dates and amounts involved
C. That the accused knew that the conduct was wrong
D. None of the above
74. Which of the following is NOT a challenge for cloud forensics not faced in traditional forensic practices?
A. Lack of frameworks and specialist tools
B. Lack of accessibility of information
C. Lack of data control
D. None of the above
75. In jurisdictions that have privacy laws, which of the following is NOT accurate in regard to employee searches at the place of work?
A. In most countries, searching an employee’s personal phone would require that the organisation have a search policy and employees are aware that personal smart phones are subject to searches.
B. Searching an employee’s ‘personal phone where the employee is not aware that such searches can be
conducted, amounts to invasion of privacy and violation of individual rights
C. Employees do not have rights that protect them from invasion of privacy while at the workplace
D. Employees have reasonable expectation of privacy for information on personal devices if management does not have a search policy
76. Which of the following statements is NOT accurate in regard to the types of information that computer forensics experts typically can recover from computer systems?
A. Computer forensics specialists can recover user created files
B. Computer forensics specialists can recover deleted documents
C. Computer forensics specialists cannot recover computer created files
D. None of the above
77. A fraud examiner can conduct textual analytics on an email communication among employees and then runs a keyword search using the terms like targets, quota, and trouble. These words are indicative of which of the following fraud risks?
A. Capability
B. Opportunity
C. Rationalisation
D. None of the above
78. Which of the following is NOT an example of a data analysis function that can be performed to detect fraud through an examination of the general ledger?
A. Ageing receivables
B. Analysing and confirming specific ledger accounts for legitimate transaction activity
C. Calculating financial ratios
D. None of the above
79. Which of the following is a data analysis function that is NOT found in other software applications apart from data analysis softwares?
A. Sorting
B. Joining files
C. Benford Law
D. None of the above
80. Which of the following statements is ACCURATE in regard to Benford’s Law?
A. Benford’s Law can only work with natural numbers
B. Benford’s Law can only work with unnatural numbers
C. Benford’s Law can work with both natural and unnatural numbers
D. Benford’s Law can only work with structured data
81. Stephanie runs a construction development company. She noticed that the cost of paint had increased substantially from the previous year, while the number of houses painted were fewer than in the previous year. Which of the following data analysis functions would be MOST useful in helping Stephanie determine if cost of paint is proportionate to the houses painted?
A. Link analysis
B. Join analysis
C. Compliance analysis
D. None of the above
82. When conducting an interview, the investigator must be particular of several issues to ensure the success of the process. Social psychological forces that facilitate communication are one of those elements that an interviewer should be concerned about. Which of the following BEST describe a social psychological force of communication that the interviewer should apply in their conversation with the respondent?
A. Persuasion
B. Expression
C. Information exchange
D. Fulfilling expectations
83. Which of the following is a step of the preparation phase of the data analysis process?
A. Determining examination objectives
B. Develop a profile of potential frauds
C. Determining whether predication exists
D. None of the above
84. Which of the following is NOT a best practice of dealing with a hostile or argumentative respondent during an interview?
A. Reasoning with the respondent
B. Disarm the interviewee by agreeing with his/her points where possible
C. Avoid reacting to the interviewee hostile behavior
D. None of the above
85. Dorine, a Certified Forensic Fraud Examiner, is conducting an interview of an employee who does not know her. Which of the following is NOT accurate in regard to best practices in conducting the introduction phase of an interview?
A. Asking attitude questions
B. Establishing the general theme of the interview
C. Establish the specific purpose of the interview
D. Establishing a common ground
86. Which of the following statements BEST describes letter rogatory?
A. A former request in which a judge in one country seek the assistance of government in another country to release a defendant from jail
B. A formal request by the government of a country seeking information from a defendant residing in another country
C. A formal request by the law enforcement of one country seeking assistance from the law enforcement of another country to collect evidence in the foreign jurisdiction
D. None of the above
87. Which of the following statements is NOT correct in regard to clarity in fraud investigation report writing?
A. The investigator should use clear language not subject to interpretations
B. The investigator should only state facts but not express opinions, other than technical opinions
C. The investigator should make sure that they use technical terms in their proper context and where necessary explain the meaning
D. The investigator should not state whether the suspect committed the crime or not, to avoid being prejudicial
88. Which of the following statements is CORRECT in regard to why an interviewer should observe nonverbal clues of deception?
A. To establish deception, and document it in a memorandum of interview
B. To establish deception and discontinue the interview as soon as possible because the information will not be useful
C. To establish deception and confront the witness in regard to their untruthfulness
D. All the above
89. The interviewer should be able to observe inconsistence behavior from question to another for nonverbal clues. Which of the following is NOT a category of nonverbal communication to convey meaning?
A. Kinetic
B. Proxemics
C. Chronemic
D. None of the above
90. Which of the following elements of report writing would NOT affect the credibility of a forensic audit or fraud examination report?
A. Inaccuracy
B. Lack of clarity
C. Partiality
D. None of the above
91. Which of the following statements concerning court records is CORRECT?
A. There are multiple databases that contain a comprehensive database of court documents from all court cases in every country
B. In most countries, court records are not public records and require judicial authorization to access
C. When searching for records for a particular court case, a fraud examiner need only to search the national and county court records as they serve as a repository for all cases heard at all court levels
D. None of the above
92. Which of the following statements BEST describe what a fraud examiner should do when preparing a memorandum reflecting the information provided by a confidential source?
A. The fraud examiner should write confidential source information in a memorandum
B. The fraud examiner should identify the source by his or her full name
C. The fraud examiner should use symbols to identify the source’s identity
D. None of the above
93. Which of the following statements is NOT correct in regard to professionalism related to fraud investigation interviews?
A. The interviewer should arrive at the interview on time
B. The interviewer must be fair in all his dealings with suspect or witness
C. The interviewer must conduct himself in formal way
D. The interviewer must be professionally attired
94. Which of the following statements is ACCURATE in regard to collection of digital evidence?
A. The investigator should collect inculpatory evidence only
B. The investigator should collect exculpatory evidence only
C. The investigator should collect inculpatory and exculpatory evidence
D. None of the above
95. Which of the following statements is ACCURATE in regard to seizing computers for investigation?
A. When a forensic investigator is seizing a running computer for examination, he can retrieve data from the computer directly via its normal interface if the evidence needed is volatile
B. When a forensic investigator is seizing a running computer, he should do a graceful shut down
C. When a forensic investigator is seizing a computer that is shut down, they should open and review files needed
D. None of the above
96. Which of the following would NOT diminish the importance of evidence documented in an investigation report?
A. If the investigator documented irrelevant information
B. If the investigator is not prejudicial in reporting the findings
C. If the investigator documented unreliable information
D. If the investigator documented evidence that is inadmissible
97. Which of the following statements is NOT an example of a statement that an interviewer can use to help the suspect rationalise their fraudulent or corrupt activities?
A. “I can understand why you had to do this, the management has ignored your hard work and qualification for a long time, is that right”?
B. “I can see why you did this; management is also taking big bribes. Yours was only a token from the supplier”
C. “I can see what you took would not have significant effect on the organisation funds, after all this is a very big entity”
D. None of the above
98. Which of the following statements is CORRECT in regard to what the interviewer should do?
A. The interviewer should conduct the interview because the presence of a third party would not undermine the possibility of obtaining an admission.
B. The interviewer should conduct the interview because the presence of a third party would protect the
investigator from false allegations
C. The interviewer should conduct the interview because the presence of a third party would not affect the interview in anyway
D. None of the above
99. Which of the following BEST describes a word that interviewers can use in fraud investigation interviews?
A. Fraud investigation
B. Embezzlement
C. Review
D. Bribery
100. Rose, a Certified Fraud Examiner, is conducting an admission-seeking interview of Paul, a fraud suspect. Which of the following is NOT a good technique of obtaining an admission?
A. Making an accusatory statement followed by an accusatory question in the absence of a third party
B. Maximising sympathy and avoid condemnation
C. Avoiding being compassionate, because doing so might compromise the interviewer’s objectivity
D. Helping the suspect to rationalise their misconduct
