THURSDAY: 7 December 2023. Morning Paper. Time Allowed: 3 hours.
Answer ALL questions by indicating the letter (A, B, C or D) that represents the correct answer. This paper is made up of one hundred (100) Multiple Choice Questions. Each question is allocated one (1) mark.
1. Capability of conducting an effective interview for investigation purposes is a must. The introduction phase of an interview during information or admission seeking interview is very important. Which of the following statement is NOT accurate?
A. The introduction phase sets the tone of the interview which can be positive or negative
B. The investigator should establish the purpose of the interview during the introduction phase
C. During the introduction phase of an admission seeking interview, the investigator should ask open ended questions
D. None of the above (1 mark)
2. Professional interviews for purposes of investigations are useful in eliciting information as well as obtaining admissions from suspects. Which of the following is NOT accurate in regard to professional interviewing?
A. Professional interviewing is a structured conversation with answer and question session
B. The interviewer must observe the elements of conversation, avoid inhibitors of conversation and apply
facilitators of communication to enable a successful interview
C. The interviewer must observe verbal and non-verbal sign of deception from the interviewee so that she can
indicate the interviewees veracity in the memorandum of interviews
D. The interviewer must be informal to avoid intimidating the interviewee (1 mark)
3. Which of the following is a method of tracing illicit funds by comparing major expenditure with the suspect’s known legitimate income?
A. Bank deposit analysis method
B. Net worth analysis method
C. Asset method
D. None of the above (1 mark)
4. Which of the following is NOT a recommended mechanic of interviewing?
A. Conducting one on one interview
B. Recording the interview without the interviewees consent
C. Displaying interest by maintaining eye contact
D. None of the above (1 mark)
5. Which of the following is an important element of conversation that is essential in conducting interviews to ensure that the respondent appreciates that the interviewer needs his/her help?
A. Persuasion
B. Ritualistic
C. Recognition
D. Information exchange (1 mark)
6. Which of the following is a recommended method of identifying a confidential source?
A. The fraud examiner should identify the source by his or her full name
B. The fraud examiner should not identify the source using his or her initials
C. The fraud examiner should use symbols to denote the source’s identity
D. None of the above (1 mark)
7. Which of the following statement is ACCURATE in regard to seizing computers for investigation?
A. When a forensic investigator is seizing a running computer for examination, he can retrieve data from the computer directly via its normal interface if the evidence needed is volatile
B. When a forensic investigator is seizing a running computer, he should do a graceful shut down
C. When a forensic investigator is seizing a computer that is shut down, they should open and review files needed
D. All the above (1 mark)
8. When a suspect is confronted with questions of excess funds that the suspect cannot account for from legitimate known sources of funds, which of the following is NOT a defense that the suspect is likely to give?
A. The suspect claims that the extra funds are inheritance from his grandfather
B. The suspect claims that the extra funds are from an insurance compensation
C. The suspect claims that the extra funds are gifts from suppliers
D. The suspect claims that the extra funds are from his savings over a period of time (1 mark)
9. Which of the following statements is ACCURATE in regard to an intelligent suspect’s interview?
A. The intelligence level of an interview subject rarely has no effect on an investigator’s ability to accurately observe behavioral clues during an interview
B. An intelligent suspect will usually not show any stress when being deceptive
C. The intelligence level of an interview subject has an effect on an investigator’s ability to accurately observe behavioral clues during an interview
D. None of the above (1 mark)
10. Circumstantial proof that would yield the best results when the suspect is using illicit funds to accumulate wealth and acquire assets, thus causing his net worth to decrease is referred to as:
A. The expenditures method
B. The asset method
C. Net worth analysis method
D. None of the above (1 mark)
11. The CEO of ABC company is alleged to have committed financial statement fraud. During an admission-seeking interview with Alex, the interviewer states: “I know the employee’s job security depends on the company’s good performance. I am sure you did this to help the employees retain their jobs, isn’t that right?” This interviewing technique is known as:
A. Depersonalisation
B. Sympathetic understanding
C. Altruistic appeals
D. Calibration (1 mark)
12. Which of the following should NOT be done when preparing an organisation for a formal fraud investigation?
A. Inform the managers of the employees who will be involved in the investigation
B. Inform the organisation’s legal counsel when the investigation is about to commence
C. Inform management that the investigation is about to begin
D. Inform the whole organisation to ensure you get cooperation from everyone whose assistance may be
required (1 mark)
13. Which of the following is NOT accurate in regard to limitation of conducting a public database search online?
A. Information from online databases is always accurate, current and up to date
B. Online public records searches are limited in the area they cover, often requiring fraud examiners to search multiple jurisdictions
C. Online coverage of public records varies widely from jurisdiction to jurisdiction
D. All of the above (1 mark)
14. Charles, a Certified Fraud Examiner, is conducting an admission-seeking interview of Caroline, a fraud suspect. Charles asks Caroline: “Did you take the organisation’s money for luxury, or you had an emergency?” Which of the following BEST describes the response Charles is likely to get?
A. Benchmark admission
B. Alternative question
C. Double negative question
D. Complex question (1 mark)
15. Which of the following statements is NOT accurate in regard to data mining?
A. Data mining is an effective way for fraud examiners to develop fraud targets for further investigation
B. Data mining is a science of searching large volumes of data for patterns
C. Data mining can be used to streamline bad data into understandable patterns
D. None of the above (1 mark)
16. Which of the following is NOT accurate in regard to volatility of digital evidence?
A. Digital evidence is more volatile than tangible evidence because data can be altered or destroyed more
easily than tangible information
B. Once the integrity of digital evidence has been violated through alteration or destruction, it cannot be
restored
C. Failure to preserve the integrity of digital evidence could result in evidence being inadmissible in a court proceeding
D. Admissibility requirements for digital evidence is higher than that of tangible evidence (1 mark)
17. Which of the following is a data analysis tool that is effective in identifying indirect relationships and relationships with several degrees of separation?
A. Link analysis
B. Benford Law
C. Textual analysis
D. Link diagram (1 mark)
18. George is conducting an admission-seeking interview of Andrew. After diffusing alibis, Andrew becomes withdrawn. Which of the following questions should George ask?
A. An accusatory question
B. An alternative question
C. Hypothetical questions
D. None of the above (1 mark)
19. During the analysis phase in digital forensic investigation, which of the following is the fraud examiner’s primary concern?
A. To protect disclosure of the evidence
B. To protect the integrity of the evidence
C. To protect the confidentiality of the evidence
D. All the above (1 mark)
20. Fraud Examiners should know the right question to ask and the right timing as well. Which of the following is a good example of an accusatory question?
A. “You embezzled company’s money, why did you do that?”
B. “You took company’s money; why did you do that?”
C. “Didn’t you know that what you were doing was not right?”
D. “Is it that you just wanted extra money, or you had an emergency then?” (1 mark)
21. Fraud Examiners when conducting interviews should be able to ask the right questions at the right time and to the right interviewee. There are questions that an interviewer should avoid, like double negative questions. Which of the following is a good example of a double negative question?
A. “You advanced yourself the company’s money, why did you do that?”
B. “When are you planning to return the money?”
C. “You knew what you were doing was not right?”
D. None of the above (1 mark)
22. When reporting results of a fraud examination, the Certified Fraud Examiner, if qualified as an expert on such matters may NOT issue an opinion on which of the following?
A. The effectiveness of the entity’s internal controls
B. The effectiveness of the entity’s operations
C. The suspect’s involvement on the offence
D. None of the above (1 mark)
23. Which of the following is NOT a purpose of conducting textual analytics as one of the fraud investigation techniques?
A. To identify red flags of rogue employee behavior
B. To reveal patterns, sentiments, and relationships indicative of fraud
C. To measure the employee’s integrity
D. None of the above (1 mark)
24. Ronald is a fraud examiner. He is conducting investigations on suspected corruption by the procurement manager.
As part of the investigation, he is developing a financial profile of the suspect. Among other things, he wants to see if the suspect has made any significant real estate purchases since the corruption scheme was discovered.
Information on real estate transactions such as deeds, grants, transfers, and mortgages is usually found in _______.
A. The local court clerk or judicial records agency
B. The jurisdiction’s organisational filing agency
C. The ministry of health
D. None of the above (1 mark)
25. During the introductory phase of an interview, the interviewer is expected to establish rapport. Which of the following BEST describes establishing rapport?
A. Establishing the right mood of the interview
B. Establishing the purpose of the interview
C. Providing good introduction
D. None of the above (1 mark)
26. Which of the following is NOT true about fraud examination/investigation?
A. Every fraud examination/investigation should begin with the assumption that the case will be used for
disciplinary matters
B. Fraud examination/investigation is the methodology of resolving fraud issues from inception to disposition
C. The major objective of a fraud examination/investigation is to collect information to prove or disapprove allegations
D. None of the above (1 mark)
27. Donald, is a public officer. He is accused of skimming money in the course of his duty. During an admission-seeking interview of Donald, the investigator states: “This is a big corporation with a lot of money. The money you took is immaterial and would not affect the financial stability of the organisation. Is that right?” This interviewing technique is known as:
A. Rationalisation
B. Extrinsic rewards
C. Altruistic appeals
D. Depersonalisation (1 mark)
28. Which of the following types of record(s) is/are NOT available from local governments?
A. Building inspector records
B. Health and fire department records
C. Court records
D. All of the above (1 mark)
29. Vicky is a Certified Fraud Examiner. Vicky is conducting an admission-seeking interview of a fraud suspect. Vicky rationalisation theme is that the suspect is being treated unfairly. The suspect does not accept this theory. What should Vicky do?
A. Insist on the theory
B. Terminate the interview
C. Ask an alternative question
D. None of the above (1 mark)
30. Which of the following refers to the inhibitor to communication in which the respondent is unable to generalise a concrete experience?
A. Inferential confusion
B. Deduction confusion
C. Induction confusion
D. None of the above (1 mark)
31. Which of the following is ACCURATE in regard to the acquisition process used in examinations involving digital evidence?
A. Imaging the hard drive helps to ensure the integrity of the evidence
B. Printing the evidence record has no effect on the admissibility of evidence
C. Imaging the hard drive help to maintain the confidentiality of the evidence
D. None of the above (1 mark)
32. Laura, a Certified Forensic Fraud Examiner, has obtained an oral admission from John, a fraud suspect. Laura reduced the confession into a short, concise written statement for Lee to sign. After John signed the statement, he remembered a significant detail that should have been included. Which of the following is a proper way of recording the omitted information?
A. Omitting the additional information
B. Destroy the old statement
C. Prepare a new statement and include the additional information
D. None of the above (1 mark)
33. Which of the following is a common method that fraudsters use to conceal illegally acquired assets?
A. Placing assets in probate
B. Selling the assets
C. Transferring assets
D. None of the above (1 mark)
34. Zippy is a Certified Forensic Fraud Examiner conducting an ongoing investigation at ABC Corp. During an interview of Stacy, an employee at the ABC Corp., Stacy confesses to Zippy that she has been receiving gifts from the vendors. Which of the following information does Zippy need NOT to obtain from Stacy?
A. The approximate date Stacy started receiving money from vendors
B. An estimate of the amount of money received so far
C. Information about the involvement of other ABC employees
D. She was not aware that taking gifts from suppliers is wrong (1 mark)
35. Which of the following is an example of a data analysis function that can be performed to detect fraud through examination of the assets account?
A. Sort asset values by asset type or monetary amount
B. Summarise cash disbursements by bank account
C. Identify debits to expense accounts outside the set default accounts
D. All the above (1 mark)
36. Which of the following conditions is NOT appropriate time to ask admission-seeking questions?
A. When the interviewer believes there is a reasonable probability that the subject is responsible for the act in question
B. When all investigative steps and sources have not been exhausted
C. When the time, place and subject matter discussed can be controlled by the interviewer
D. None of the above (1 mark)
37. Which of the following is NOT a characteristic of a well-written fraud examination report?
A. Professional technical language
B. Impartiality
C. Accuracy
D. Clarity (1 mark)
38. Which of the following statements is ACCURATE in regard to Link Analysis?
A. Link analysis can be presented in court as demonstrative evidence
B. Link analysis can be presented in court as direct evidence
C. Link analysis can be presented in court as circumstantial evidence
D. None of the above (1 mark)
39. When developing a suspect’s financial profile, an investigator should consider funds generated from loans. Which of the following loan amounts should the investigator use to establish the amount received?
A. Loan approved amount
B. Loan principal amount
C. Loan principal and interest amount
D. None of the above (1 mark)
40. Which of the following steps is NOT included in the planning phase of the data analysis process?
A. Building a profile of potential frauds
B. Articulating examination objectives
C. Verifying data
D. None of the above (1 mark)
41. Once a suspect has confessed in an interview, it is important to get copies of as much physical evidence as possible. For example, bank records are important. Which of the following is a recommended method for obtaining bank records after a confession?
A. Obtain an oral authorisation for the release of the bank records
B. Request the subject to bring the bank records to the investigator’s office
C. Obtain a written authorisation from the suspect
D. None of the above (1 mark)
42. In most jurisdictions, searches from all of the following sources of information can be available for developing background information for pre-employment purposes, EXCEPT:
A. Criminal court records searches
B. Bankruptcy records searches
C. Civil court records searches
D. None of the above (1 mark)
43. Agnes, a Certified Fraud Examiner, is conducting an admission-seeking interview. Which of the following is NOT a good strategy for obtaining an admission?
A. Asking accusatory questions immediately after the introduction
B. Maximise sympathy and avoid condemnation
C. Conduct the interview in firm manner while showing compassion
D. None of the above (1 mark)
44. Organising the amount of paper generated during an investigation is one of the biggest challenges in fraud cases. Which of the following is generally NOT a recommended practice when organising evidence?
A. Segregating documents by transaction
B. Filing all papers chronologically
C. Making a document file
D. None of the above (1 mark)
45. If a fraud examiner wants to submit a fraud case for prosecution, at what point should he send the case to prosecution authority?
A. After all witnesses have been interviewed
B. Immediately after obtaining an oral confession from the suspect
C. After the fraud examiner has finished collecting documentary evidence
D. None of the above (1 mark)
46. If a fraud examiner, when conducting a forensic document examination, notices some very faint indented writings, which of the following would NOT be the fraud examiner’s BEST course of action in analysing these indented writings?
A. Performing the pencil scratching method
B. Performing the pencil shading method
C. Use fraud examiner to conduct the analysis
D. None of the above (1 mark)
47. When a Certified Fraud Examiner is interviewing a suspect and in the course of the interview, the suspect becomes uncomfortable with the sensitive nature of the questions. Which of the following BEST describes what the investigator should do under the circumstances?
A. Ask double negative questions
B. Stop asking sensitive question completely
C. Ask open questions
D. None of the above (1 mark)
48. Which of the following is ACCURATE in regard to closed questions?
A. They are worded in a way that makes it difficult for the respondent to answer “yes” or “no”.
B. They are worded in a way that the witness can only answer “yes” or “no”.
C. They are worded in a way that makes it difficult for the respondent to answer “yes”
D. They are worded in a way that makes it difficult for the respondent to answer “no” (1 mark)
49. The terms induction and deduction are most often associated with which inhibitor to communication?
A. Chronological confusion
B. Inferential confusion
C. Trauma
D. None of the above (1 mark)
50. In interviews, introductory questions are designed to meet which of the following objectives?
A. To establish the veracity of the witness
B. To establish the credibility of the witness
C. To get commitment for assistance
D. All of the above (1 mark)
51. Which of the following data analysis functions is most useful in testing for hidden journal entries?
A. Aging data
B. Identifying duplicates
C. Join function
D. None of the above (1 mark)
52. Edwin calls Doris’s bank, claiming to be Doris, with the intention of stealing Doris’s identity. Edwin tells the bank representative that he needs to make sure that the bank has the correct government identification number on his account because she had noticed an error on her statement. Which of the following is an example of the attempted offence by Edwin?
A. Corruption
B. Embezzlement
C. Pretexing with the bank
D. Identity theft (1 mark)
53. When planning for an interview, which of the following steps should the interviewer NOT take?
A. Contemplate what the interview is intended to accomplish and state an objective
B. Ensure that the interview is held in a venue where the subject comfortable
C. Prepare a brief list of key points to discuss during the interview
D. All of the above (1 mark)
54. Which of the following is NOT accurate in regard to Meta Data?
A. Metadata information can help determine who edited the document
B. Metadata information can help determine when a document was created
C. Metadata is a computer-generated file which can be a good source of evidence
D. Metadata is a user created file which can be a good source of evidence (1 mark)
55. Which of the following is ACCURATE in regard to mutual legal assistance (MLA)?
A. A formal request by the government of a country seeking information from a defendant residing in another country
B. Mutual legal assistance can only be requested for criminal trials
C. Mutual legal assistance cannot be requested for civil trials
D. Mutual legal assistance can be requested for both criminal and civil trials (1 mark)
56. Which of the following is a method of using software to extract usable information from unstructured data?
A. Imaging the data
B. Data analytics
C. Textual analytics
D. Data mining (1 mark)
57. Which of the following witness should be interviewed second last?
A. Neutral witnesses
B. An accomplice witness
C. Corroborative witness
D. None of the above (1 mark)
58. Which of the following is NOT ACCURATE in regard to closing questions in interview?
A. The purpose of closing questions is to maintain goodwill
B. The purpose of closing questions is to reconfirm facts
C. Closing questions are closed questions only
D. The purpose of closing questions is to request for any additional information (1 mark)
59. Which of the following is NOT a recommended procedure for protecting a fraud investigation’s case information?
A. Store all confidential documents in locked file cabinets or rooms accessible only to those who have a
business need-to-know
B. Avoid talking about the investigation in public or in any place where other employees could hear the
communications
C. Use of email or other electronic means to transmit confidential case information
D. None of the above (1 mark)
60. Which of the following is an indirect method of proving illicit income circumstantially by showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or legitimate sources of income?
A. Income method
B. Expenditure method
C. Net worth analysis
D. None of the above (1 mark)
61. All of the following are signs of deceptive behavior in an interview of a subject, EXCEPT:
A. The subject plays with an object during serious questioning
B. The subject appears casual and unconcerned
C. The subject does not maintain eye contact
D. None of the above (1 mark)
62. Which of the following is ACCURATE in regard to predication to conduct investigations?
A. The basis of conducting an investigation based on red flags of fraud
B. The basis of conducting an investigation based on suspicion that fraud has occurred
C. The basis of conducting an investigation based on an area evaluated as having very high risk
D. None of the above (1 mark)
63. When fraud suspects decide to confess, they tend to do which one of the following as a way of releasing inner tension of their guilt and dishonest actions.
A. Provide under estimate of the amount of funds defrauded
B. Provide accurate number of incidences
C. Provide exact number of other individuals involved
D. None of the above (1 mark)
64. During an admission-seeking interview, Terry accuses a suspect of committing fraud. The suspect begins to deny the accusation. Which of the following methods should Terry NOT do to interrupt the denials?
A. Reason with the suspect
B. Discuss the inconsistent statements made by the suspect
C. Try to reason with the suspect
D. All the above (1 mark)
65. An experienced digital forensic expert is aware of where to looking for evidence in the computer. Computer created files are good sources of digital evidence. Which of the following is NOT one of those computer-generated files?
A. Security logs
B. Events logs
C. Word documents
D. None of the above (1 mark)
66. Which of the following is NOT accurate in regard to fraud examination reports?
A. The conclusion part of the report should include the recommendations on actions to be taken against the suspect based on the evidence collected
B. The recommendation part of the report should make recommendations on the controls that need to be put in place to avoid future occurrences and other areas that may require investigations, that were not the facts in issue
C. The scope of the investigation report should be based on specific allegations and the period of the
investigation
D. None of the above (1 mark)
67. Which of the following is NOT one of the things a fraud examiner should consider before starting to conduct a computer investigation?
A. Whether there is a need to notify law enforcement
B. Running through the data to look for evidence
C. If there is need to engage an outside digital forensic expert
D. None of the above (1 mark)
68. Which of the following is NOT accurate in regard to volatility of digital evidence?
A. Integrity of digital evidence if violated through manipulation or destruction can be restored by use of
advanced forensic tools
B. Digital evidence is more volatile than tangible evidence because data can be easily altered
C. Failure to preserve the integrity of the digital evidence could result to evidence being inadmissible
D. None of the above (1 mark)
69. In admission-seeking interviews, when an innocent person is directly accused, they react differently to the initial accusation than a culpable person. Which of the following is NOT a reaction expected from a culpable person?
A. Weak denials
B. Strong denials
C. Silence
D. None of the above (1 mark)
70. When an examiner is using textual analysis to look for words indicative of fraud, which of the following words would be indicative of pressure to commit fraud
A. Deadline
B. Deserve
C. Write off
D. None of the above (1 mark)
71. Benford Law can only work with natural numbers to look for patterns indicative of fraud. Which of the following is an example of natural number?
A. Telephone numbers
B. Suppliers amounts
C. Sales invoice numbers
D. None of the above (1 mark)
72. Textual analytics can identify, which of the following word is indicative of rationalisation to commit fraud
A. Override
B. Write off
C. Entitled
D. Quota (1 mark)
73. Vincent, a nonunion suspect, arrived at a scheduled admission-seeking interview with his manager and insisted that the manager be allowed to be in attendance. Should this interview be allowed to continue?
A. No, because the presence of a third party would undermine the possibility of obtaining a confession
B. No, because the manager’s presence would be unlawful
C. No, because the manger is not a lawyer
D. Yes, because a third-party witness to a confession is valuable in court (1 mark)
74. Which of the following is a type of informational interview questions?
A. Narrative questions
B. Alternative questions
C. Double Negative questions
D. None above (1 mark)
75. Which of the following is an appropriate moral excuse to include in a signed confession?
A. “I didn’t mean to do it.”
B. “I didn’t do it.”
C. “I didn’t mean to hurt anyone”
D. “I didn’t know it was illegal.” (1 mark)
76. Which of the following is NOT accurate in regard to digital forensic investigations?
A. During the analysis phase in digital forensic investigations, the fraud examiner should look for inculpatory evidence
B. During the analysis phase in digital forensic investigations, the fraud examiner should look for exculpatory evidence
C. During the analysis phase in digital forensic investigations, the fraud examiner should look for inculpatory evidence only to support the prosecution side of the case
D. During the analysis phase in digital forensic investigations, the fraud examiner’s primary concern is to
protect the integrity of the digital evidence (1 mark)
77. Which of the following is NOT a characteristic of a financial vehicle that a fraudster would be looking for to conceal assets?
A. Accessibility
B. Security
C. Liquidity
D. Transparency (1 mark)
78. When tracing financial transactions, the method that involves using the subject’s books and records to analyse the relationship between the subject’s receipt and subsequent disposition of funds or assets is called which of the following?
A. The direct method
B. The asset method
C. The bank records method
D. The indirect method (1 mark)
79. Which of the following BEST describe letter rogatory?
A. A letter in which a judge in one country orders the government in another country to release a defendant from jail
B. A formal request by the government of a country seeking information from a defendant residing in another country
C. A formal request by the courts of one country seeking judicial assistance from the courts of another country
D. A letter whereby a criminal defendant requests that the government release exculpatory information
(1 mark)
80. Which of the following is a NOT a type of informational interview questions?
A. Leading questions
B. Closed questions
C. Alternative question
D. Closing Questions (1 mark)
81. Luke, a Certified Forensic Fraud Examiner, is conducting an admission-seeking interview of Willis, a fraud suspect. Luke asked Willis: “Did you just want extra money, or did you do this because you had an emergency?” Which of the following BEST describes this type of question?
A. Accusatory question
B. Alternative question
C. Double negative question
D. None of the above (1 mark)
82. In taking a verbal confession, which of the following items of information should the interviewer NOT obtain?
A. The accused’s motive for the offence
B. Estimates of the number of instances, dates and amounts involved
C. That the accused did not know that the conduct was wrong
D. All of the above (1 mark)
83. Which of the following is NOT a challenge of cloud forensics not faced in traditional forensic practices?
A. Lack of frameworks and specialist tools
B. Accessibility of information
C. Lack of data control
D. None of the above (1 mark)
84. Dorine is conducting a fraud examination of Smith, an employee at his organisation, a government entity. Dorine has strong reason to believe that Smith has incriminating evidence on a personal smart phone that he brings to work. Which of the following statements is most ACCURATE?
A. In most countries, Dorine may search the phone if his organisation has a search policy and employees are aware that personal smart phones are subject to search
B. Dorine may conduct search of Smith’s smart phone because Smith’s privacy rights do not affect smart
phones
C. Smith has an international right to privacy for information on his personal smart phone, and Dorine must obtain a search warrant to search the device
D. Employees have no expectation of privacy for information on personal devices they bring to work, so
Dorine may search the phone (1 mark)
85. Which of the following is NOT accurate in regard to the types of information that computer forensics experts typically can recover from computer systems?
A. Computer forensics specialists can recover time and date information about files
B. Computer forensics specialists can recover deleted documents that have been overwritten
C. Computer forensics specialists can recover information about websites visited
D. All of the above (1 mark)
86. A fraud examiner is conducting textual analytics on journal entry data and runs a keyword search using the terms deadline, quota, and trouble. These words are indicative of which of the following fraud risk?
A. Capability
B. Opportunity
C. Rationalisation
D. None of the above (1 mark)
87. Which of the following is NOT example of a data analysis function that can be performed to detect fraud through an examination of the general ledger?
A. Create sales and purchases comparison reports
B. Analyse and confirm specific ledger accounts for legitimate transaction activity
C. Calculate financial ratios
D. None of the above (1 mark)
88. Which of the following is a core data analysis functions that CANNOT be performed with most data analysis software applications?
A. Sorting
B. Joining files
C. Duplicate searches
D. None of the above (1 mark)
89. Which of the following BEST describes the limitation of Benford Law?
A. Benford Law can only be applied to data sets listed in currency amounts
B. Benford Law applies best to data sets with three-digit numbers
C. Benford Law cannot be applied on data sets with non-natural numbers, such as cheque or invoice numbers
D. Benford Law only works on data sets with assigned numbers, such as bank account or telephone
numbers (1 mark)
90. Bernard owns a real estate company. He notices paint expenses have increased substantially from the previous year, which is not expected because the company had much less business that year and they painted fewer houses. Which of the following data analysis functions would be most useful in helping Bernard determine if cost of paint is proportionate to the houses painted?
A. Link analysis
B. Data analysis
C. Compliance analysis
D. None of the above (1 mark)
91. Text-based data is typically what type of data:
A. Structured data
B. Unstructured data
C. Documentary data
D. Natural data (1 mark)
92. Which of the following steps is included in the preparation phase of the data analysis process?
A. Determining examination objectives
B. Develop a profile of potential frauds
C. Determining whether predication exists
D. Cleansing and normalising data (1 mark)
93. Which of the following is NOT a recommended approach of dealing with a hostile or argumentative respondent during an interview?
A. Make it impossible for the interviewee to say “no”
B. Try to reason with the interviewee
C. Disarm the interviewee by agreeing with his/her points where possible
D. Avoid reacting to the interviewee hostile behavior (1 mark)
94. Which of the following statement in regard to court records is ACCURATE?
A. There are multiple databases that contain a comprehensive database of court documents from all court cases in every country
B. In most countries, it is only criminal records that are public
C. In most jurisdictions court records can be obtained from any court database
D. None of the above (1 mark)
95. Which of the following statement is NOT accurate in regard to introduction or background contents of a forensic audit report?
A. The introduction section of the forensic audit should indicate what management will do with the results of the forensic audit
B. The introduction section of the forensic audit should indicate why the forensic audit was commissioned
C. The introduction section of the forensic audit should indicate who commissioned the forensic audit
D. The introduction section of the forensic audit should indicate the objective of the forensic audit (1 mark)
96. Which of the following statement is NOT accurate in regard to the contents of the scope of a forensic audit report?
A. The contents of the scope of a forensic audit include the facts in issue
B. The contents of the scope of a forensic audit also include the objective of the forensic audit
C. The contents of the scope of a forensic audit include the period of the forensic audit
D. None of the above (1 mark)
97. Which of the following statement is NOT accurate in regard to audit and forensic audit or investigation?
A. The Presumption of an audit is professional skepticism
B. The presumption of a forensic audit is proof
C. The presumption of a forensic audit is to affix blame
D. None of the above (1 mark)
98. Which of the following is NOT a social physiological barrier that impedes communication in an interview?
A. Repression – which the interviewer should avoid when conducting interviews of suspects
B. Competing demand for time – between the interview and respondent’s responsibilities
C. Forgetting – with time people tend to forget matter with passage of time
D. None of the above (1 mark)
99. Which of the following statements is NOT accurate in regard to facilitators of communication?
A. Being empathetic while conducting interviews
B. Expensing expectations to the interviewee
C. Persuasion while conducting interviews
D. None of the above (1 mark)
100. Which of the following words is indicative of capability to commit a crime that can be used by an investigator to identify red flags of fraud?
A. Balance off
B. Override the controls
C. Write off
D. None of the above (1 mark)
