ACFE CFE-Investigation - Certified Fraud Examiner (CFE) - Investigation

CFE methodology stresses that fraud examinations should be conducted with the assumption that the matter could end in litigation, which directly affects evidence-handling decisions. If litigation is reasonably anticipated, organizations often must preserve potentially relevant records through measures such as litigation holds and suspension of normal record-retention/destruction practices. Disposing of evidence while litigation is likely (or while a duty to preserve could exist) can create serious consequences, including sanctions, adverse inferences, monetary penalties, and other legal repercussions for spoliation or failure to preserve evidence. Because the central risk is future legal proceedings—civil, criminal, regulatory, or employment-related—the most important consideration when deciding whether evidence can be disposed of is whether additional litigation is likely or could reasonably arise. The physical form of evidence (A) affects preservation techniques, but it is not the key decision driver for disposal. Reporting summaries (C) do not replace original evidence. Whether evidence is direct or circumstantial (D) is not the deciding factor; both can be critical depending on the case. Thus, likelihood of future litigation is the most important factor.

Before pursuing litigation, fraud examiners are advised to consider whether nonlegal remedies (e.g., restitution agreements, settlements, insurance recovery) are possible, since legal actions can be costly, slow, and uncertain. Statutes of limitation and guilt are legal issues for attorneys and courts, but examiners must weigh recovery options first.

The Fraud Examiners Manual explains:

“Benford’s Law applies to data that is not assigned (such as IDs or phone numbers) but that occurs naturally in transactions. For example, payment amounts, invoice values, and expense reimbursements are well suited.”

Thus, payment amounts are best suited for Benford’s Law.

Best practice for signed statements:

Fraud examiners should prepare the statement, keep it concise, and ensure voluntariness and intent are clear.

While not legally required, it is recommended that two individuals witness the signing.✅ Answer: C. Have two individuals witness the signing of the document when possible

The manual explains:

“Link analysis is very effective for identifying indirect relationships… and is particularly useful when conducting a money laundering investigation because it can track the placement, layering, and integration of money” .

Therefore, statement A is false, making it the correct choice.

“When searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

Therefore, saying a past address is “of no help” is incorrect.

The Fraud Examiners Manual stresses that interview notes should be kept separately for each interview, even if the session is electronically recorded, because recordings can fail or be challenged. Verbatim transcripts are not expected, and impressions of guilt should never be included. Best practice is to keep clear, accurate, separate records for every interview .

Digital forensics guidance stresses:

If the computer is off, do not turn it on, because booting will alter files and timestamps.

If the computer is on and volatile data is needed (e.g., RAM), a formally trained examiner may collect it live. Otherwise, simply unplugging the system (hard shutdown) preserves volatile evidence better than a graceful shutdown.

Thus, if the evidence exists only in volatile data and the system is running, Nobles may collect it via the normal interface.

✅ Answer: A. If Lucas's computer is running, Nobles may retrieve data… if the evidence exists only in volatile data

Signs of stress (e.g., shallow breathing, stuttering, shifting posture) do not automatically equal deception. The Fraud Examiners Manual states:

“Signs of stress do not always mean a subject is lying. An honest subject might feel stress simply by being questioned. Conclusions must be based on clusters of behavior and corroborating evidence, not a single indicator”.

The CFE Prep – Investigations notes:

“Court records are best obtained from the jurisdiction in which they were filed… The most accurate records are maintained by the court of original jurisdiction, not global or aggregated databases.”

Thus, the best place for Sam is the local court of jurisdiction, not a global database.