ACFE CFE-Investigation - Certified Fraud Examiner (CFE) - Investigation

The Fraud Examiners Manual specifies that admission-seeking interviews should only be conducted when:

“There is a reasonable probability that the respondent has committed the act in question.

All other reasonable investigative steps have been completed.

The interviewer can reasonably control the place, time, and subject matter of the interview.”

There is no requirement that the examiner must be sure no one else was involved. Therefore, C is correct.

The Fraud Examiners Manual notes:

“Companies are formed by submitting some type of organisational filing… these company records are generally public records and will include: corporate name, ownership information, location of the principal office, date of incorporation”.

The Prep guide also confirms: “A company’s organisational filing with the government generally includes information about the company’s ownership, initial shareholders, and the location of its principal office”.

The 2014 International Fraud Examiners Manual explains:

“Often, the most important evidence exists only in the form of volatile data (e.g., RAM)… If the evidence that a formally trained computer investigator needs to collect exists only in the form of volatile data stored in volatile computer memory such as RAM, and the data is expected to disappear when the computer is shut down, he should collect the data live from the suspect computer.”

Also,

“If the computer is off, leave it off… Booting up a system can alter its files… Accordingly, turning a system on could damage and taint any evidence.”

Thus, the most accurate statement is D — live data collection may be performed directly if volatile data is required.

During admission-seeking interviews, fraud examiners often employ rationalization techniques to help the suspect justify their misconduct and make it easier to confess. One of these rationalizations is the altruistic appeal.

From the 2014 International Fraud Examiners Manual:

“Facilitators of communication are those socio-psychological forces that make conversations, including interviews, easier to accomplish. These facilitators require a basic understanding of what motivates people. The facilitators are: fulfilling expectations, recognition, altruistic appeals, sympathetic understanding, new experience, catharsis, need for meaning, and extrinsic rewards.”

From the CFE Prep - Investigations study guide:

“Facilitators of communication… include fulfilling expectations, recognition, altruistic appeals, sympathetic understanding, new experience, catharsis, need for meaning, and extrinsic rewards.”

📌 Application to Scenario:

Beta says: “I know you didn’t do this for yourself; it was for your family.”

This is a classic altruistic appeal — reframing the suspect’s motive as selfless or for the benefit of others, rather than selfish wrongdoing.

The purpose is to reduce internal resistance to confessing by allowing the suspect to rationalize the act as being for a noble reason.

When preparing for interviews, fraud examiners should avoid scripting detailed questions. Instead, they prepare notes of key points to cover.

From the Fraud Examiners Manual:

“Whenever possible, do not prepare a list of predetermined questions to ask the subject. The interview should flow freely. The interviewer might, however, want to develop a list of key points to cover during the interview”.

Therefore, the best preparation method is to note key points instead of detailed questions.

The Fraud Examiners Manual and CFE Prep emphasize:

“Generally, documentary evidence, including digital evidence, will not be admitted in a legal proceeding unless it is established as authentic… Consequently, fraud examiners who collect evidence from social media must capture, download, and preserve any useful information as soon as they discover it, and they must memorialize each step of the collection process”.

Thus, preservation for authenticity is the key.

The Fraud Examiners Manual stresses that fraud examiners must never promise unconditional confidentiality, because findings often must be disclosed to management, auditors, or authorities. They can only offer “qualified confidentiality” (best efforts to protect identity, but with necessary limits). Therefore, option A is the most appropriate response.

The Fraud Examiners Manual and CFE Prep Guide both state:

“In an admission-seeking interview, the interviewer should transition to the verbal confession when the accused furnishes the first detailed information about the offence. There are three approaches to obtaining the confession: chronologically, by transaction, or by event”.

Thus, B is the true statement.

Explanation with Extracts = The 2014 Fraud Examiners Manual states:

“The EU Data Protection Directive … regulates the processing, using, and transferring of personal data within the European Union, and it places limits on transmitting personal data to non-EU countries”.

Therefore, a U.S.-based examiner handling HR data of an EU employee must comply with EU GDPR requirements.

“Records obtained from financial institutions are perhaps the single most important financial source available to a fraud examiner for tracing purposes. They can be used as evidence for fraud, uncover criminal profits, identify criminal assets, and locate assets”.