ACFE CFE-Investigation - Certified Fraud Examiner (CFE) - Investigation

When preparing to interview subjects across jurisdictions, fraud examiners must consider bothlegal rightsandcultural differences. The Manual advises examiners to:

Researchlocal lawsgoverning the right to counsel during interviews.

Understand cultural norms (e.g., greetings, eye contact).Failing to observe these can damage credibility. Thus, it is most accurate that an examiner must determine whether the subject can legally insist on a lawyer’s presence .

“The failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding, or, even if admitted, it might not be given much weight because evidence of questionable authenticity does not provide reliable proof.”

Therefore,D is the most accurate statement.

TheFraud Examiners Manualdefines double-negative questions as those containingtwo forms of negation in a single clause. They are confusing and “often suggest an answer opposite to the correct one.” The example given is almost identical to the question here:

“Didn’t you suspect that something wasn’t right?”.

Thus, Sylvia’s question is adouble-negative question, which should be avoided.

According to CFE guidance, when planning interviews, fraud examiners should:

“Consider what the interview is intended to accomplish and state an objective.

Review the case file to ensure that important information has not been overlooked.

Prepare a list of topics and general questions.

Choose a neutral and nonthreatening environment so the subject does not feel intimidated.”

Holding the interview in a venue intended to make the subject feel uncomfortableviolates proper CFE interview practice. Hence,Dis correct.

The Manual defines leading questions as those that contain or suggest the answer:

“Leading questions… are framed in a way that evokes a specific reply… most commonly used to confirm facts already known… Example: ‘You got promoted, right?’”

Nathaniel’s question, “When were you promoted to manager?” presumes the promotion occurred. Thisleadsthe subject by suggesting a fact that may not be true. It is not open (does not invite free narration), not complex (it asks one thing), and not closed (doesn’t call for yes/no but presumes an answer).

TheFraud Examiners Manualclarifies:

“The recommendations section is optional, and there might be instances where the fraud examiner wishes to discuss remedial measures or specific recommendations in a separate document”.

The Prep guide also states: “A written report might include a section for recommendations”.Thus, it isnot requiredin every report.

Explanation with Extracts= TheFraud Examiners Manualexplains:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging the data… allows a fraud examiner to view and analyse the contents of a computer without altering the original data in any way”.

Imaging creates an exact, sector-by-sector copy of the drive.

Thus, imaging protects original data integrity.

Guidance on reports:

“A fraud examination report should be accurate, clear, and impartial. The fraud examiner should avoid technical jargon where possible and write in plain language so that readers without specialized knowledge can understand”.

Reports should only include relevant, factual findings—not every detail or opinion.

So, the most accurate statement is that jargon should be avoided.

Both the Manual and CFE Prep guides emphasize thatdeleted files are recoverable until overwritten. Once overwritten, the original data cannot be retrieved:

“Deleted files are recoverable until they are overwritten because data is not erased… until overwritten. So, deleted files that have been overwritten generally arenot recoverable.”

Other file types (deleted shortcuts, hidden files, etc.) can often be recovered, butoverwritten files are lost permanently.

TheFraud Examiners Manualnotes:

“Management of an organisation should ensure that the organisation has a proper and effective document retention policy in place… An effective policy requires clear retention protocols… and should be immobilised due to a pending investigation or foreseeable litigation.”

Thus, the existence of a document retention policy is a critical factor in deciding how to dispose of evidence.