Certified Fraud Examiner (CFE) Fraud Prevention and Deterrence Syllabus

Distinguish the two types of misstatements auditors consider under AU-C 240.

Fraudulent financial reporting (intentional misstatements/omissions to deceive financial statement users) and misappropriation of assets (theft of an entity's assets, often called defalcation).

Why is management override of controls a key fraud concern for auditors?

Because management is uniquely able to bypass otherwise effective controls (e.g., through fraudulent journal entries or estimates); auditors must design procedures specifically to address this risk in every audit.

What is a fraud risk assessment?

A process to proactively identify and address an organization's vulnerabilities to internal and external fraud by identifying fraud risks/schemes, assessing their likelihood and significance, and evaluating/responding to residual risk.

List the basic steps of a fraud risk assessment.

Identify relevant fraud risks/schemes; assess likelihood and significance (impact) of each; map existing controls to risks; evaluate whether controls effectively mitigate residual risk; and respond with remediation plans.

How is residual fraud risk defined relative to inherent risk?

Inherent risk is the risk before considering controls; residual risk is the risk that remains after existing anti-fraud controls are applied. Assessments focus response efforts on significant residual risks.

What are the five principles of the COSO Fraud Risk Management Guide?

1) Establish a fraud risk governance policy; 2) Perform a comprehensive fraud risk assessment; 3) Design and deploy preventive and detective fraud control activities; 4) Conduct investigations (fraud reporting/response); 5) Monitor the program and evaluate/report on effectiveness.

What is the single most effective control for detecting occupational fraud according to ACFE data, and what mechanism supports it?

Tips are the most common detection method by far; reporting hotlines (whistleblower mechanisms) substantially increase tip-based detection and reduce losses and fraud duration.

What is proactive fraud detection?

Actively searching for fraud before it surfaces through complaints or accident — using techniques such as data analysis, anomaly detection, surprise audits, continuous monitoring, and targeted procedures based on the fraud risk assessment.

Name common proactive data analysis techniques used to detect fraud.

Benford's Law analysis, duplicate/gap testing, outlier and anomaly detection, ratio analysis, trend/regression analysis, data matching (e.g., employee-to-vendor), and continuous transaction monitoring.

What does Benford's Law predict and how is it used in fraud detection?

In many natural data sets, leading digits follow a predictable distribution (1 appears as the leading digit ~30.1% of the time, decreasing to ~4.6% for 9). Deviations in financial data can flag fabricated or manipulated numbers for further review.

What is the purpose of a surprise audit as an anti-fraud control?

Conducting unannounced audits removes the perpetrator's ability to predict and prepare for scrutiny, increasing perceived detection risk (deterrence) and improving the chance of catching ongoing schemes.

What are the four broad categories within the CFE Code of Professional Ethics' subject matter?

Integrity and professionalism; legal and ethical conduct; professional competence; and confidentiality — collectively governing how CFEs must perform their duties.

Under the CFE Code of Professional Ethics, what must a CFE never express?

An opinion regarding the guilt or innocence of any person or party — that determination is reserved for the trier of fact (judge/jury).

What standard of care does the CFE Code of Professional Ethics require regarding professional services?

A CFE shall, at all times, exhibit the highest level of integrity and shall conduct all examinations with due professional care, completing only assignments for which they are qualified.

What does the CFE Code of Professional Ethics require regarding conflicts of interest?

A CFE shall not engage in any illegal or unethical conduct or in any activity that would constitute a conflict of interest; conflicts must be avoided or disclosed.

What does the CFE Code require concerning evidence and conclusions in a report?

A CFE shall obtain evidence that provides a reasonable basis for any opinion rendered; no opinion shall be expressed unless sufficient relevant and competent evidence supports it.

What does the CFE Code of Professional Ethics say about confidential information?

A CFE shall not reveal confidential information obtained during a professional engagement without proper authorization, and shall comply with all lawful orders of the courts.

What is the purpose of the ACFE Code of Professional Standards (as distinct from the Code of Ethics)?

It provides detailed, enforceable guidance and interpretive standards on how CFEs should apply the principles of the Code of Ethics in practice (e.g., standards on independence, objectivity, competence, due care, understanding with the client, and communication of results).

Under the Code of Professional Standards, what does 'objectivity' require of a CFE?

CFEs must maintain a state of mind that is impartial, intellectually honest, and free of conflicts of interest; they must not subordinate their judgment to others.

Under the Code of Professional Standards, what is required before accepting an engagement regarding competence?

CFEs must perform only services they are qualified to perform, possessing the requisite knowledge, skill, and experience; if lacking, they must obtain assistance or decline.

What is the typical framework for resolving an ethical dilemma?

Identify the relevant facts and the ethical issue/threats; identify affected stakeholders and applicable principles/standards/laws; consider alternative courses of action and their consequences; consult as needed; then select and document the course consistent with ethical principles.

What are common 'threats' to compliance with ethical principles that a CFE must guard against?

Self-interest, self-review, advocacy, familiarity, and intimidation threats — each can compromise objectivity and must be evaluated and reduced to an acceptable level with safeguards.

What is the difference between a code of conduct and a code of ethics?

A code of ethics is a broad statement of values and principles (the 'why'); a code of conduct is a more specific, rules-based document translating those values into expected behaviors and prohibited actions (the 'what/how').

What elements make an organizational code of conduct effective?

It is clearly written and accessible, endorsed and modeled by leadership, applies to all levels, addresses specific risk areas, includes reporting mechanisms and consequences, and is reinforced through regular training and acknowledgment.

What is the goal of fraud awareness/ethics training for employees?

To communicate the organization's ethical expectations and anti-fraud policies, help employees recognize fraud red flags and reporting channels, and reinforce that fraud will be detected and punished — increasing perceived detection and deterrence.

What is the purpose of pre-employment (background) screening?

To verify a candidate's identity, credentials, and history and to identify red flags (e.g., criminal history, falsified credentials, prior fraud) before hiring, reducing the risk of placing dishonest individuals in positions of trust.

What legal constraints govern background checks in the U.S.?

The Fair Credit Reporting Act (FCRA) governs use of consumer/investigative reports (requiring disclosure, written consent, and adverse-action procedures), along with EEOC anti-discrimination requirements and applicable state 'ban-the-box' laws.

What is vendor due diligence and what does it screen for?

The process of investigating prospective and existing vendors/third parties to assess legitimacy and integrity — verifying existence and ownership, checking for conflicts of interest, sanctions/watchlists, prior misconduct, and shell-company or related-party red flags.

What are common red flags of a fictitious or shell-company vendor?

Vendor address matching an employee's, P.O. box only, sequential or rounded invoice numbers, no physical presence or website, missing tax ID, invoices just under approval thresholds, and a vendor not in the approved master file.

How is the effectiveness of an anti-fraud/ethics program measured?

Through metrics and feedback such as hotline call volume and resolution, training completion and comprehension, employee surveys on ethical culture, number and type of incidents detected, audit/control test results, and benchmarking against peers and prior periods.

Why must a fraud risk management program be monitored and updated continuously rather than treated as a one-time effort?

Because fraud risks evolve with changes in the business, technology, personnel, and external environment; ongoing monitoring, periodic reassessment, and program evaluation are needed to sustain effectiveness and adapt controls to new schemes.