ACCT 406 Exam 2 TF & MC

7.1 TF - The fraud triangle plus inquiry paradigm is an effective way to understand the various types of fraud investigation methods.

True

7.2 TF - One advantage of using a vulnerability chart is that it forces investigators to consider all aspects of a fraud.

True

7.3 TF - Electronic surveillance can be of limited value in the investigation of employee fraud because of concerns regarding employees’ privacy rights.

True

7.4 TF - Surveillance is a theft investigation technique that relies on the examination of documents.

False

7.5 TF - Mobile surveillance is usually much more risky than stationary surveillance.

True

7.6 TF - During invigilation, no controls are imposed on any activities.

False

7.7 TF - Surveillance logs should always be prepared before an investigation begins.

False

7.8 TF - Not only are undercover operations both legal and valid, but also inexpensive.

False

7.9 TF - Investigation should only take place when predication of fraud has first been established.

True

7.10 TF - If possible, when using theft act investigation methods, interviewing the prime suspects should happen last.

True

7.11 TF - Tailing includes the use of video, e-mail, wiretapping, and access to PCs.

False

7.12 TF - Invigilation is a theft act investigative technique that involves close supervision of suspects during an examination period.

True

7.13 TF - To get an accurate reading, it is generally agreed that the invigilation period should be at least four days in length.

False

7.14 TF - In determining which investigative method to use, it is most important that investigators focus on the costs of each possible method.

False

7.15 TF - Seizing and searching computers is illegal because it infringes on the rights guaranteed by the Fourth Amendment to the Constitution.

False

7.16 TF - Now that many companies are storing their data “in the cloud” it is easier to access the electronic data of suspected perpetrators.

False

7.17 TF - It is impossible to retrieve the data from a file that has been deleted on a computer.

False

7.18 TF - The SHA-1 checksum method is more advanced and is considered more robust than the MD5 method.

True

7.1 MC - Which of the following is not a category used in the fraud triangle plus inquiry paradigm?

c. Action investigative techniques.

7.2 MC - When beginning an investigation, it is important that fraud examiners use techniques that will:

a. Not arouse suspicion.

7.3 MC - When conducting interviews during an investigation, which of the following words should usually be avoided?

c. Investigation.

7.4 MC - When beginning a fraud investigation, which of the following methods is most useful in identifying possible suspects?

b. Preparing a vulnerability chart.

7.5 MC - Invigilation:

c. Provides evidence to help determine whether fraud is occurring.

7.6 MC - Which of the following is not a theft act investigation method?

b. Honesty testing.

7.7 MC - When deciding whether or not to investigate, which of the following factors should an organization not consider?

d. All of the above should be considered.

7.8 MC - Surveillance, when properly performed, is always done:

a. Without the perpetrator’s knowledge.

7.9 MC - Which of the following is not included in a vulnerability chart?

c. Internal controls that a company plans to institute in the future.

7.10 MC - A vulnerability chart:

a. Forces investigators to explicitly consider all aspects of a fraud.

7.11 MC - Fixed-point, or stationary, observations can be conducted by:

d. Anyone, if conducted properly

7.12 MC - Surveillance logs should include all of the following except:

b. Cost of the surveillance equipment used.

7.13 MC - Wiretapping, a form of electronic surveillance, can usually be legally used by:

d. None of the above.

7.14 MC - Which of the following investigation methods often raise concerns about employees’ privacy at work?

a. Electronic surveillance.

7.15 MC - Who should be consulted before any form of surveillance takes place?

c. Legal counsel and human resources.

7.16 MC - When seizing computers, a calculation (also called a hash) that ensures you have an exact clone and have not changed data is called a(n):

d. CRC checksum number.

7.17 MC - A snapshot of active memory should be done:

b. After seizure of the computer but before turning off the computer.

7.1 HW - Identify the best pattern/order to go about a theft investigation.

b. Check personnel records, interview former employers, search public records, interview other buyers, and interview suspect.

7.2 HW - For fraud to occur, usually three elements are necessary: pressure, opportunity, and:

c. rationalization.

7.3 HW - Undercover operations are costly and time-consuming and should be used with extreme care. In which of the following situations would it be ineffective to conduct an undercover operation?

c. When other investigation methods are available

7.4 HW - What is invigilation?

b. A theft act investigative technique that involves close supervision of the suspects during the examination period.

7.5 HW - An investigator locates the scene that should be observed, anticipates the action that is most likely to occur at the scene, and keeps detailed notes on all activities involving the suspect. Which type of surveillance is being used here?

c. Stationary surveillance

7.6 HW - What is the term for a calculation (using encryption technologies) based on the contents of a disk or file that are engineered so that even small changes in the source data will produce significantly different checksum results?

b. cyclic redundancy check number

7.7 HW - In most investigations of a fraud suspect, investigators should begin by:

b. checking personal and company records.

7.8 HW - Which of the following is NOT a method for theft investigation?

b. Electronic searches

7.9 HW - Which of the following indicates an observed symptom (red flag) of fraud?

c. An employee has bought a luxury car and some expensive jewelry.

7.10 HW - Which of the following is true about invigilation?

a. The strict controls imposed are temporary in nature.

7.11 HW - Which of the following statements regarding invigilation is accurate?

c. It is most commonly used in such high-risk areas such 'as expensive inventory.

7.12 HW - ______ means that there are symptoms or red flags that a fraud may be occurring.

a. Predication

7.13 HW - Electronic surveillance may have only limited value in the investigation of employee frauds and many other white-collar crimes. Why?

b. Concerns regarding employees' privacy

7.14 HW - What is the term for gathering and analyzing electronic evidence?

b. Computer forensics

7.15 HW - Identify the first step in any electronic evidence collection process.

a. Seizure of the device

8.1 TF - Concealment is the covering of tracks, obscuring of evidence, and removal of red flags to hide a perpetrator’s fraud.

True

8.2 TF - Checks are excellent sources of physical evidence.

False

8.3 TF - Traditional chain of custody evidence procedures are not appropriate when used with electronic evidence.

False

8.4 TF - Photocopies are always preferable to original documents as evidence.

False

8.5 TF - There is no difference between forensic document experts and graphologists.

False

8.6 TF - Evidence should be uniquely marked so it can be easily identified later.

True

8.7 TF - Concealment investigative methods sometimes involve the study of documents that have been manipulated.

True

8.8 TF - Discovery sampling is probably the most difficult of all statistical sampling variations to understand.

False

8.9 TF - As long as a sample is selected randomly, it will always be representative of the population as a whole.

False

8.10 TF - Even if photocopies of original documents are allowed to be introduced as evidence in a court of law, they are still considered secondary evidence.

True

8.11 TF - A canceled check typically shows the account number of the person who presented the check, the teller who processed the check, and the sequence number of the transaction.

True

8.12 TF - Random number tables are ineffective and should not be used when selecting random samples from a population.

False

8.13 TF - Using a computer to access records (data mining) can be a very effective approach for determining if fraud exists because the auditor can look at entire populations.

True

8.14 TF - Bates numbers are identifying numbers used by attorneys involved in litigation to track all documents.

True

8.15 TF - Programs like IBM’s i2 Analyst’s Notebook and Xanalys Link Explorer perform link analysis.

True

8.16 TF - The best way to obtain documentary evidence in a computer database is to use discovery sampling to find the appropriate records.

False

8.1 MC - In a fraud investigation, documents:

a. Usually contain extremely valuable information.

8.2 MC - Chain of custody refers to:

b. A record of when a document is received and what has happened to it since its receipt.

8.3 MC - Marking documentary evidence is important to ensure that:

c. Documents can be identified later.

8.4 MC - Discovery sampling:

d. Deals with the probability of discovering at least one error in a given sample size if the population error is a certain percentage.

8.5 MC - Documentary evidence such as private tax returns can usually be obtained only by:

d. All of the above.

8.6 MC - Which of the following is not true regarding document experts?

d. All of the above are true statements.

8.7 MC - Which of the following is not a benefit of statistical sampling?

a. It allows auditors to be certain that fraud does not exist in a population.

8.8 MC - Which of the following methods of gathering documents is based primarily on luck?

d. Documents provided by tipsters.

8.9 MC - Which of the following is true of graphologists?

c. They study handwriting as a way to interpret and identify personalities.

8.10 MC - What can a fraud examiner conclude if one or more instances of fraud are found in a sample taken from a population?

b. The population contains fraud.

8.11 MC - What can a fraud examiner conclude if his or her tests confirm that no instances of fraud are present in a sample taken from a population?

c. Only that no fraud is present in that particular sample.

8.12 MC - How are most frauds concealed?

c. By creating fictitious documents or altering source documents.

8.13 MC - Which of the following is usually the best way to obtain documentary evidence?

a. Computer-based queries of full-population accounting and other databases.

8.14 MC - Programs like CaseMap, CaseCentral, ZANTAZ, Ringtail, and DatiCon are examples of:

c. Software packages used to index and store evidence.

8.1 HW - When the document is in the custody of a public office:

a. it is permissible to obtain photocopies, which are considered secondary evidence in a court of law.

8.2 HW - Which statistical sampling allows an auditor to generalize and make inferences from the sample to the population?

c. Discovery sampling

8.3 HW - Which of the following statements regarding documents versus eyewitnesses is NOT accurate?

a. When faced with a choice between an eyewitness and a good document as evidence, most fraud experts choose the witness.

8.4 HW - Mark owns a 24-hour convenience store. Lately he has noticed that the liquor inventory purchases have gone up by huge amounts, although sales proceeds from this category haven't increased. He suspects his two night-shift employees. Which is the best investigative method to uncover such a fraud?

d. Concealment investigation

8.5 HW - Which of the following observations about discovery sampling is accurate?

d. Auditors can quantify both the risk and samples until they have sufficient evidence that fraud does not likely exist.

8.6 HW - Computer-based queries of accounting and other databases are utilized in which of the following investigation methods?

c. Concealment

8.7 HW - Which of the following does NOT appear on a check that has been cashed?

d. Time of the transaction

8.8 HW - _______ are executed only by law enforcement officials and are generally used only in criminal cases.

c. Search warrants

8.9 HW - Orders issued by a court or a grand jury to produce documents are called:

d. subpoenas.

8.10 HW - Which of the following is an example of secondary evidence?

d. Photocopies of documentary evidence

8.11 HW - Which of the following statements regarding search warrants is NOT accurate?

a. A "possible cause" condition must be met before a search warrant is issued.

8.12 HW - Which of the following items is NOT included on a subpoena?

a. The location of the documents being requested

8.13 HW - Which of the following is NOT an action by fraud perpetrators to hide/conceal their illegal act(s)?

c. Photocopying fraud-related documents

8.14 HW - During a concealment investigation, an investigator fails to recognize that an invoice had been forged. This represents a:

b. nonsampling risk.

8.15 HW - Which of the following is an alternative when original documents are too voluminous to permit careful examination?

c. A summary of its contents may be acceptable.

9.1 TF - Perpetrators usually save what they steal.

False

9.2 TF - One common investigation procedure determines how perpetrators convert or spend their time.

False

9.3 TF - Investigations of perpetrators’ net worth and lifestyles help investigators know what class of society the perpetrators are from.

False

9.4 TF - It is always necessary to involve a federal law enforcement agent when accessing federal databases.

False

9.5 TF - The secretary of state maintains many types of records relating to business and Uniform Commercial Code (UCC) filings.

True