Free ACFE CFE-Investigation Practice Exam with Questions & Answers | Set: 2

“When searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

Therefore, saying a past address is “of no help” is incorrect.

The Internet archives (e.g., the Wayback Machine at archive.org) allow fraud examiners to retrieve prior versions of web pages, including deleted content such as company statements.

✅ Answer: C. The internet archives

The CFE Prep – Investigations states:

“If a fraud examiner gets a verbal confession from the fraudster, it does not matter whether the fraudster claims his conduct was an accident. The following items of information should be obtained … admission that the accused knew the conduct was wrong, facts known only to the confessor, the accused’s motive, approximate dates, involvement of others, physical evidence, and disposition of illicit income.”

Thus, the examiner does not need a statement about accident.

In admission-seeking interviews, one rationalization technique is to depersonalize the victim (e.g., shifting the perception so the harm was against a company, not individuals). The example in the question—“It isn’t like you took something from a friend or neighbor”—is exactly this technique.

The Fraud Examiners Manual explains that rather than drafting an exhaustive list of questions, the interviewer should:

“formulate a brief outline of key points to discuss during the interview”.

This helps organize thoughts while allowing flexibility.

The 2014 International Fraud Examiners Manual provides examples of data analysis for accounts payable:

“Examples of data analysis queries that can be performed to help detect fraud through examination of accounts payable include:

• Audit paid invoices for manual comparison with actual invoices.

• Summarise large invoices by amount, vendor, etc.

• Identify debits to expense accounts outside of set default accounts.

• Reconcile cheque registers to disbursements by vendor invoice.”

While other functions apply to payroll or asset management, the most effective function for accounts payable fraud detection is to summarize large invoices by amount and vendor.

Websites ending in “.onion” are only accessible via specialized browsers (e.g., Tor). The Fraud Examiner prep materials note:

“.onion sites are part of the dark web, which is distinct from the surface web and deep web. Accessing requires specialized browsers” (CFE Prep – Investigations).Thus, Jade must use a dark web browser.

Best practice is to conduct interviews individually. The Manual states:

“When conducting interviews, witnesses should be interviewed separately. Interviewing multiple witnesses together risks contamination of testimony and reduced reliability of responses”.

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

“Internal sources will sometimes be the only resource for certain types of documents—such as… employee personnel files—unless the fraud examiner has the subject’s consent or a legal order”.

External searches may reveal addresses, assets, or competitor ownership, but personnel files require internal/non-public access.