CFE MODULE 2: FRAUD INVESTIGATION AND LEGAL ISSUES

Question bank on FRAUD INVESTIGATIONS AND LEGAL ISSUES - CFE MODULE 2

Which of the following statements about data sharing is TRUE?

Ensuring data quality is an important factor for both the inbound and outbound sides of a data transfer.

Which of the following is a legal element that must be shown to prove a claim for commercial
bribery?

The defendant gave or received a thing of value.

Bob receives a memorandum from his attorney that is protected by a legal professional privilege Bob
emails the memorandum to a third party who has no need to know the information in the
memorandum Which of the following statements is MOST ACCURATE?

Bob might have waived the privilege because he transmitted the protected information to a third party who has no need to know the information

Which of the following statements is MOST ACCURATE regarding cross-examination of witnesses in
adversarial systems?

If opposing counsel asks an overly complex question during cross-examination, witnesses should ask for the question to be rephrased

Smith, a Certified Fraud Examiner (CFE). works for the ABC Company, a private entity that operates
w\ a jurisdiction with civil laws for defamation, invasion of privacy. and conflict of interest Smith
seizes and searches the personal smartphone of Green an employee of ABC even though Green was
not suspected of any wrongdong Assuming that Green had a reasonable expectation of privacy in the
smartphone and Smith conducted the search without a legitmate interest or authority, under which
of the following claims would Green MOST LIKELY be able to recover damages against Smith?

Intrusion into Green's private matters

Which of the following statements concerning the appointment of expert witnesses at that is
accurate?

Generally, the court appoints the primary expert witnesses in inquisitorial jurisdictions.

Which of the following is NOT one of the elements that the government must prove to establish a
violation of a law criminalizing false statements to government agencies?

The government relied on the false statement

A prosecutor died criminal charges against Rosa calming that she stole Juan's personal information
and sold his identity on the dark web Juan wants to file a civil lawsuit against Rosa to recover
damages arising from the identity theft Can Juan file the civil action before the criminal action
against Rosa is completed?

Yes, the evil action can be filed if the jurisdiction permits parallel proceedings.

Which of the following situations would constitute a violation of the US Foreign Corrupt Practices Act
(FCPA)

A private U S company transfers $45,000 to a foreign official to influence the award of a public construction contract.

Which of the following scenarios is an example of the criminal sanction known as criminal forfeiture?

As part of her sentence for bribery a defendant is ordered to transfer a car she received as a bribe to the government

Which of the following is NOT an element generally required to establish a claim alleging the
common law avil wrong for intentional infliction of emotional distress?

The victim was an employee of the defendant

Nora, a health care provider b convicted of health care fraud in criminal court After her conviction,
the national health agency begins a proceeding to prohibit Nora from seeking reimbursement from
government health care programs for five years Which type of administrative penalty is the national
health agency seeking?

Debarment

Which of the following is one of the three basic options by which organizations can legitimize cross-
border transfers of personal information?

Establish a contract between the entities exchanging the information

Dodd is a Certified Fraud Examiner (CFE) who works for Weathervane, a private company Dodd
suspects that Burton a Weathervane employee has embezzled money from the company Dodd plans
to conduct an internal investigation into the missing funds Based on these facts which of the
following is the MOST ACCURATE statement?

Burton likely has a duty to cooperate with the investigation as part of the employer-employee relationship

Which of the following is a legal element that the government must show to prove a cnminal
conspiracy?

The defendant knew all the details or objectives of the conspiracy

In a particular country's judicial process, the judge oversees the investigation of a case is primarily
responsible for questioning witnesses and generally plays a larger role in the evidence-gathering
process than the parties' legal counsel Which of the following BEST describes this type of judicial
process'?

Adversarial process

The government filed a avil action against a politician for accepting real estate as a bribe. There is a
possibility that the politician could transfer the real estate to a third party before the court enters a
final judgment Which type of order should the government seek from the court to prevent the
politician from transferring the real estate?

Prejudgment attachment

Which of the following statements is TRUE regarding criminal proceedings and discovery in
adversarial jurisdictions?

The judge is the primary driver of the discovery process in criminal proceedings.

Which of the following is the MOST ACCURATE statement about the UK Bribery Act?

Even if an organization's anti-corruption program complies with the FCPA, it might not be sufficient for the purpose of complying with the UK Bribery Act

During an internal investigation Todd a Certified Fraud Examiner (CFE) interviewed Janessa a fraud
suspect Although Janessa wanted to leave in the middle of the interview, Todd blocked the exit and
prevented her from leaving Janessa subsequently confessed to committing fraud If under these facts
Janessa files a lawsuit (or false imprisonment against Todd, Todd will likely

Lose the case if a trier of fact concludes that he restrained Janessa without consent or legal justification

The________________requires that an employee act solely in the best interest of their employer,
free of any serf-dealing, conflicts of interest, or other abuse that results in a personal advantage

Duty of loyalty

Which of the following describes the purpose of an expert witness testimony at trial?

To give an opinion when the fact finder needs specialized knowledge

Which of the following statements regarding the qualifications of expert witnesses in most
inquisitorial jurisdictions is CORRECT?

The qualification of an expert is generally based on standardized requirements

Which of the following would be direct evidence that the criminal defendant a former cashier for a
home improvement store committed a cash larceny scheme that resulted in the theft of more than
$5 000 from the store?

A witness testifies that they saw the defendant take the money

Evidence that tends to make some tact at issue more or less likely than it would be without the
evidence is called:

Relevant evidence

Before her criminal trial for embezzlement Monique contacts witnesses against her and offers to pay
them if they change their stories Based on her actions the government would MOST LIKELY bring
additional charges against Monique for:

Obstruction of justice

Ethan a U S resident, is running a Ponzi scheme As part of the scheme, he uses the U S mail system to
send promotional materials to potential victims in France If the US government decides to prosecute
Ethan, which of the following would provide the MOST LIKELY basis for the charges?

Mail fraud

Allison works for a government contractor She informs the government that her employer has been
submitting false claims to the government for payment Later it is discovered that Allison has
misappropriated more than $50,000 of her employer's money Alison qualifies as a whistleblower
entitled to anti-retaliation protection under the law because of her report to the government Which
of the following statements about Allison is CORRECT?

Alison cannot be fired for informing the government of her employee’s fraud

Which of the following is NOT a legal element that must be shown to prove a claim for fraudulent
misrepresentation of material facts?

The defendant acted negligently

Greta is convicted of white-collar crime. However, her sentence is suspended in return for her
promise of good behavior. Which of the following BEST describes Greta's sentence?

Probation

Ramona is investigating Eugene for misconduct Ramona and Eugene both work for Elek-Tek, which
operates in a jurisdiction with evil laws for defamation, invasion of privacy and conflict of interest
During the investigation Ramona obtained ^formation that Eugene is cheating on his spouse Ramona
to a large group of Elek-Tek employees that Eugene was committing adultery, which turned out to be
true Which cause of action would give Eugene the BEST chance for success m a civil suit against
Ramona?

Public disclosure of private facts

ABC Heating and Cooling operates in a jurisdiction that prohibits unreasonable workplace searches and surveillance in areas or items where employees have a reasonable expectation of privacy.
In which of the following areas or items would an employee at ABC MOST LIKELY have a reasonable expectation of privacy during a workplace search?

An employee’s company-gifted backpack dial they bring to the office

For criminal cases in civil law systems, which of the following statements BEST describes the conviction intime standard for burden of proof?

The fact finder must be convinced on an inner, deep-seated level that the defendant is guilty of the charge.

Which of the following statements regarding the process for tracing assets associated with or derived from illicit transactions Is MOST ACCURATE?

The first step in the tracing process should be to profile the subject by assembling a financial and behavioral profile.

Which of the following statements concerning judgments involving parties that are in multiple jurisdictions is MOST ACCURATE?

A judgment in one jurisdiction is enforceable against assets in another country if the foreign jurisdiction has laws or agreements that recognize foreign judgments.

During an internal investigation, Sam, a Certified Fraud Examiner (CFE), interviews a fellow employee named Jordan. Although Jordan wants to leave during the interview, Sam locks the door and proceeds with the interview. Jordan subsequently confesses to lapping customer payments. If Jordan files a lawsuit for false imprisonment against Sam, then Sam will likely:

Lose the case if a trier of fact concludes that his actions restrained Jordan without consent or legal justification

Noah, a U.S. resident, runs a fraud operation that targets accountants at several U.S. companies across multiple states. Noah sends phishing emails in an effort to steal the accountants’ log-in credentials so that he can remotely access corporate accounts and transfer funds to bank accounts that he controls.
If the U.S. government prosecutes Noah, which of the following frauds would MOST LIKELY be the basis for the charges?

Wire fraud

Ana, a fraud examiner, is preparing to conduct an interview with Wilbert as part of a fraud investigation at True West Inc. The human resources (HR) manager from True West Inc. has requested to be in the room during the interview.
Which of the following statements is MOST ACCURATE regarding the presence of the HR manager during the interview?

If permitted by law, Ana should not allow the HR manager to witness the interview to avoid liability consequences.

Which of the following statements regarding data visualization is TRUE?

Tree maps provide a hierarchical structure of data using rectangular space that is divided into regions.

Suri is conducting a fraud examination in a country where courts apply laws from codified statutes to each case and their decisions are not bound by similar court decisions from previous cases. This type of judicial system is BEST known as:

Civil law system

Abigail, a fraud examiner at a private company, is investigating a coworker named Coraline who is suspected of committing an electronic payment tampering scheme. During the investigation, Abigail finds credible evidence that Coraline is having an affair with a married coworker and tells several colleagues. Coraline discovers that Abigail has revealed this true, but very unflattering, information about her and decides to file a claim of defamation against Abigail.
Which of the following explanations BEST describes why Coraline will not win her defamation case?

Abigail communicated information that turned out to be true

Which of the following factors should fraud examiners consider when determining whether evidence should be disposed of after a fraud examination has concluded?

Whether the organization has a document retention policy in place

Allie, a Certified Fraud Examiner (CFE), has completed a fraud examination and is writing a formal report.
Which one of the following options is a best practice that Allie should follow when reporting the results of her fraud examination?

Allie should avoid stating her opinions regarding the guilt or innocence of any person or party involved in the investigation.

If a plaintiff wishes to file a civil suit, which of the following factors should they consider when determining whether a court has jurisdiction to hear the case?

Whether the court has proper venue, such as by being located where the transactions that are the subject of the suit occurred

Maddie, a Certified Fraud Examiner (CFE), is investigating allegations that an employee in Pyramid Corporation’s Payroll Department is embezzling funds for personal use.
Which of the following types of information will Maddie MOST LIKELY be able to obtain from external sources without the subject’s consent or the use of a legal order?

Real property assets that tire suspect employee has acquired

Which of the following methods of documenting information obtained from social media sites would be MOST EFFECTIVE in establishing the evidence’s authenticity?

Capture the social media content using a special program that preserves its metadata.

Charles, a fraud examiner, accuses George of fraud during an admission-seeking interview. George immediately denies the charge How should Charles respond to George ' s denial?

Use a delaying tactic to interrupt the denial

Graciela, a fraud examiner, is collecting and organizing physical documents during a fraud examination.
Which of the following statements describes a best practice that Graciela should follow?

Graciela should establish a database of documents early in the investigation.

Jim is being investigated for violations resulting from fraudulent health care claims he submitted. When a government auditor arrives to review documentation supporting the claims, Jim stages a fake emergency that prevents the auditor from completing their review. After the incident, Jim continues to evade the auditor.
Jim has MOST LIKELY committed which of the following crimes?

Obstruction of justice

IBC Manufacturing is a private company in a jurisdiction in which the public has the legal right to be free from unreasonable search and seizure by government authorities. An investigator at IBC searches the desk of Denise an IBC employee and finds illegal narcotics. The investigator seizes the narcotics and turns them over to members of law enforcement. The investigator violated Denises rights by failing to obtain a search warrant before conducting the search

True

Ella is convicted of a crime, but instead of serving time in jail, her sentence is suspended for a year in exchange for a promise of good behavior and being placed under supervision within the community. Which of the following best describes Ella’s sentence?

Probation

Which of the following statements concerning access to nonpublic records is FALSE?

During the government ' s criminal investigation, a fraud examiner not employed by the government has a right to access relevant documents that the government has obtained.

Allison, a Certified Fraud Examiner (CFE). is investigating a potential procurement fraud scheme. While interviewing a subject, she asks. " Why did you choose to do business with that vendor? " This can BEST be described as a(n):

Open Question

If a plaintiff wishes to file a civil suit, which of the following factors should they consider when determining whether a court has jurisdiction to hear the case?

Whether the court has proper venue, such as by being located where the transactions that are the subject of the suit occurred.

Which of the following is a legal element that must be shown to prove a claim for official bribery?

The defendant gave or received something of value.

Which of the following is a reason why a person or organization might engage a fraud examiner to trace illicit transactions?

A victim of fraud wants to facilitate the recovery of criminal proceeds.

Which of the following statements about the process of obtaining a verbal statement of admission is MOST ACCURATE?

The interviewer should obtain a verbal admission either chronologically, by transaction, or by event, depending on the circumstances of the case.

Robert, a new investigator, asks Adam, a witness to an alleged fraud, “Didn’t you think that he wasn’t behaving appropriately?” This kind of question is called a(n):

Double-negative question

Jana. the controller of XYZ Company, notices that the company ' s hotel expenses increased substantially from the prior year She wants to check to see if this increase is reasonable by comparing hotel expenses from both years to the number of days XYZ " s employees traveled. Which of the following data analysis functions would be the MOST USEFUL in helping Jana analyze these two variables?

Correlation analysis

Which of the following examples of judicial systems would BEST be described as a civil law system?

The courts are bound by codified principles or statures but are not bound by previous court decisions

Freya, a government contractor, has been convicted of colluding with other contractors to manipulate the competitive bidding process. After her conviction, Freya’s name is added to a list of individuals who are prohibited from bidding on government contracts for a period of five years. The administrative penalty that Freya received is BEST described as:

Debarment

The Financial Action Task Force (FATF) Recommendations suggest that countries should do which of the following?

Use a risk-based approach when creating and establishing their anti-money laundering policies.

Which of the following is NOT an element generally required to establish a claim alleging the common law civil wrong for intentional infliction of emotional distress?

The victim was an employee of the defendant

Which of the following types of information would LEAST LIKELY be found when searching external sources without the subject's consent or a legal order?

A subject's employee personnel file

Which of the following data analysis functions is used to determine whether company policies are met by employee transactions, such as verifying that traveling employees book their accommodations at approved hotels?

The compliance verification function

Sam needs to obtain the most accurate court records possible in a particular jurisdiction concerning a fraud suspect. The BEST place for Sam to look is a global database that compiles court cases from various jurisdictions

FALSE

Orlando is conducting a fraud examination regarding Fast Freight, a large publicly traded corporation, and wants to find the current officers and directors of the company. Which of the following would be the best source of information for this purpose?

Regulatory securities records

Caroline, a fraud examiner, is conducting an admission-seeking interview with John, an employee suspected of stealing cash.

Which of the following is the MOST effective phrasing for Caroline to use when posing an admission-seeking question to John?

"Did you steal the money?"

Assuming that a jurisdiction has prohibited pretexting with financial institutes, which of the following actions would constitute illegal pretexting?

Falsely claiming to be the spouse of an account holder to access bank records

Which of the following data is the MOST DIFFICULT to recover during a digital forensic examination?

Files that have been overwritten

Which of the following is INCORRECT with regard to locating individuals using online records?

If an individual has moved, obtaining a past address is usually of no help

Which of the following statements is MOST ACCURATE regarding covert operations?

Fraud examiners should conduct coven operations only after attempting conventional methods of

evidence-gathering

Which of the following sources of information is usually considered to be the MOST IMPORTANT in

tracing a subject's assets?

Financial institution records

Arnold, a Certified Fraud Examiner (CFE) for Integra Wealth, learns that Elizabeth, an accounts

payable clerk, recently purchased an expensive ski boat Arnold also knows that Elizabeth recently

purchased a vacation home on a nearby lake Arnold has sufficient predication to:

Notify management of the possibility that Elizabeth has committed fraudulent acts

Which of the following is the MOST ACCURATE statement regarding the analysis phase in digital

forensic investigations?

During the analysis phase, it is best to use a combination of the various forensic tools that can assist

in identifying, extracting, and collecting digital evidence

Which of the following should be done to prepare an organization for a formal fraud investigation?

Prepare the managers of the employees who will be involved in the investigation

When planning for the interview phase of an investigation, which of the following steps should NOT

be taken by the fraud examiner?

Ensure that the interview is held in a venue where the subject will feel Uncomfortable

Eugene is conducting an admission-seeking interview of a suspect. During the interview, the suspect frequently looks away from Eugene while responding to questions. Eugene can safely conclude that the suspect is dishonest due to his failure to maintain eye contact.

FALSE

During an interview, Alex asked a fraud suspect if he could retrieve the suspect's account records from her bank. The suspect said, "yes." but she did not provide consent in writing. Although the suspect orally consented, the suspect's bank is NOT required to allow Alex to access the suspect's account records at this point.

TRUE

Elizabeth, a Certified Fraud Examiner (CFE), is conducting an admission-seeking interview with Shannon, a fraud suspect. Shannon is seated approximately five feet away from Elizabeth in an empty room. The room has several pictures and posters on the wall, and the door is closed. According to admission-seeking interview best practices, what change should Elizabeth make to the interview environment to increase the chances of the interview's success?

All of the above

Why is it necessary to image a seized computer's hard drive for forensic analysis?

To allow for the analysis of data from a suspect computer without altering or damaging the original data in any way

A fraud examiner believes that a suspect might have used illicit funds to construct a commercial building to fit a restaurant. Which of the following records would be the MOST helpful in confirming the owner of the building?

Building permit records

Cynthia is preparing to conduct a covert investigation. Prior to conducting surveillance of her subject, she creates a memorandum outlining the basis for her operation. Which of the following pieces of information should she include in her memorandum?

All of the above

Which of the following statements is MOST ACCURATE regarding how a fraud examiner should prepare for an interview with a subject from a different jurisdiction?

A fraud examiner should find out whether there are limitations on the use of information obtained

during an interview

Jackson, a digital forensic examiner for a government agency, is conducting a criminal investigation into the alleged embezzlement of funds from the government's Welfare Department (WD). Ginny. a WD employee, is the prime suspect. Jackson obtains a court order authorizing him to seize Ginny's personal computer for forensic examination. Which of the following is the MOST ACCURATE statement?

If Ginny’s computer is off and Jackson needs evidence that exists only in the form of volatile data, he

should turn the computer on and retrieve data directly via the computer's normal interface.

Which of the following is the MOST ACCURATE statement about trying to locate a subject using online records?

Obtaining a past address of the subject should be the first step in trying to locate a subject using

online records

The term_____________refers to a process of resolving allegations of fraud from inception to disposition.

Fraud examination

Which of the following can be obtained from a wire transfer record?

The sending institution accreditation type

Which of the following is TRUE of a follow-up/recommendations section in a written fraud examination

report?

A follow-up/recommendations section is not a required part of every written fraud examination report

Which of the following is a reason why a person or organization might engage a fraud examiner to

trace illicit transactions?

A victim of fraud wants to facilitate the recovery of criminal proceeds.

Susan, a Certified Fraud Examiner (CFE). is conducting an ad mission-seeking interview of Beth, a fraud suspect. After Susan gave Beth a suitable rationalization for her conduct. Beth continued her denials, giving various alibis. Which of the following would be the LEAST EFFECTIVE technique for Susan to use in this situation?

Displaying all the evidence she has against Beth at once

Charles, a fraud examiner, accuses George of fraud during an admission-seeking interview. George immediately denies the charge How should Charles respond to George's denial?

Use a delaying tactic to interrupt the denial

Nobles, a digital forensic examiner for a government agency, is conducting a criminal investigation of Lucas, a construction company executive, for alleged bribery of foreign officials Nobles obtains a court order authorizing him to seize Lucas's personal computer for forensic examination. Which of the following is the MOST ACCURATE statement?

If Lucas's computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

Which of the following BEST describes the data analytics approach known as predictive analytics?

The use of historical data, along with analyses, statistics, and machine learning components, to build a mathematical model that captures important trends and creates a quantitative forecast

Which of the following types of files is the most difficult to recover during a digital forensic

examination?

Overwritten files

Which of the following situations would MOST LIKELY require access to nonpublic records to develop

evidence?

Reviewing an individual's personal mobile phone records

Jade, a Certrfied Fraud Examiner (CFE). is conducting an internal investigation in which an employee is suspected of stealing inventory and selling it through a possible shell company called Hidden Finds.LLC. When Jade tries to check Hidden Finds' website, a message appears that redirects customers to a web address that ends with onion. To view the website's content. Jade will need to install a specialized web browser that enables her to access which of the following?

The dark web