Certified Fraud Examiner (CFE) Investigation Syllabus

Investigation syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Investigation in Certified Fraud Examiner (CFE), not a summary of it.

1. 1

   Planning and Conducting an Investigation

   3 topics

   • Fraud Examination Methodology
     • Predication and scoping the engagement
     • The fraud theory approach
     • Investigation planning and hypothesis testing
   • Evidence Collection and Organization
     • Maintaining chain of custody
     • Documenting and indexing evidence
   • Coordination with Counsel and Law Enforcement
2. 2

   Analyzing Documents and Financial Data

   3 topics

   • Document Collection and Examination
     • Obtaining documents and preserving originals
     • Questioned-document and handwriting basics
   • Data Analysis and Fraud Analytics
     • Benford's Law and digital analysis
     • Anomaly detection and duplicate testing
     • Data mining and continuous monitoring
   • Computer and Digital Forensics Basics
     • Preserving electronic evidence
     • Email and metadata review
3. 3

   Tracing Illicit Transactions

   3 topics

   • Sources of Information
     • Public records and online sources
     • Background investigations and due diligence
     • Accessing financial and asset records
   • Net Worth and Financial Profiling Methods
     • Asset and expenditures methods
     • Sources and application of funds
   • Following the Money and Asset Tracing
     • Tracing funds through bank records
     • Identifying hidden assets and nominees
4. 4

   Interview Theory and Application

   4 topics

   • Planning and Structuring Interviews
     • Interview sequence and question typology
     • Introductory, informational, and closing questions
   • Assessment and Verbal/Non-Verbal Cues
     • Behavioral indicators of deception
     • Calibration and avoiding bias
   • The Admission-Seeking Interview
     • Themes, transitions, and obtaining a confession
     • Documenting the signed statement
   • Legal and Ethical Limits of Interviewing
5. 5

   Reporting and Case Resolution

   3 topics

   • Writing the Fraud Examination Report
     • Report structure, objectivity, and clarity
     • Avoiding opinions and conclusions of law
   • Visual Aids and Exhibits
   • Engagement Closure and Referral
     • Referral to law enforcement and regulators
     • Recovery and remediation options

Investigation flashcards for Certified Fraud Examiner (CFE)

19 of 50 cards from the Investigation deck — real questions with worked answers.

1. What is fraud examination methodology and what core principle governs how an examiner begins?

   A structured, evidence-driven process for resolving fraud allegations. It begins from a predication (a reasonable basis to believe fraud may have occurred) and moves from the general to the specific, never the reverse.

2. Define 'predication' in a fraud examination and why it is required.

   The totality of circumstances that would lead a reasonable, professionally trained person to believe a fraud has occurred, is occurring, or will occur. It is the legal/ethical basis required before any fraud examination begins; examinations should never be conducted without it.

3. What is the 'fraud theory approach' and its four sequential steps?

   A hypothesis-testing method: (1) analyze available data, (2) create a hypothesis, (3) test the hypothesis, and (4) refine and amend the hypothesis. The examiner assumes a likely scenario and tests it against evidence.

4. In a fraud examination, why does the investigative approach move 'from the general to the specific'?

   To build the case logically toward the target while protecting against tipping off the suspect; you gather background/circumstantial evidence first and interview the prime suspect last, after corroborating facts are established.

5. What are the two broad categories of evidence in a fraud examination, and give an example of each?

   (1) Testimonial evidence — obtained through interviews and statements of witnesses; (2) Documentary/physical (real) evidence — documents, records, electronic data, and tangible objects.

6. What is 'chain of custody' and what must it document?

   A chronological record establishing the continuity and integrity of evidence. It must document who collected each item, where/when it was obtained, and every person who had control of it, with dates of each transfer, so evidence is admissible and unaltered.

7. Name three best practices for marking and organizing documentary evidence.

   (1) Maintain a key/control log of all evidence; (2) mark each document discreetly (e.g., initials, date, sequential ID) without altering content; (3) keep originals secure and work from copies, organizing by witness, transaction, or chronology.

8. What is the 'best evidence rule' and how does it affect handling of documents?

   It generally requires the original document to prove its contents, rather than a copy. Therefore examiners should obtain and preserve originals when possible and document why a copy is used if the original is unavailable.

9. When should a fraud examiner coordinate with legal counsel during an engagement?

   As early as possible — ideally at the planning stage — to address attorney-client privilege, work-product protection, legal limits on evidence gathering, and to ensure the investigation withstands later litigation.

10. What is the 'work-product doctrine' and how does it protect an investigation?

    It protects materials (notes, analyses, reports) prepared in anticipation of litigation from discovery by the opposing party. Conducting an examination at the direction of counsel can extend this protection over the examiner's work.

11. What key consideration arises when referring a fraud case to law enforcement?

    Once reported, the organization loses control over the case's direction and outcome; prosecutors decide whether to charge. The examiner should provide organized evidence and reports but recognize the case becomes subject to the criminal justice process and constitutional protections.

12. How does the burden of proof differ between criminal and civil fraud cases?

    Criminal cases require proof 'beyond a reasonable doubt'; civil cases require only a 'preponderance of the evidence' (more likely than not). This affects strategy when deciding criminal referral vs. civil recovery.

13. What is a 'document examination' (forensic) focused on, versus reviewing documents for content?

    Forensic document examination focuses on the document's authenticity and physical attributes — handwriting, alterations, additions, ink/paper, indented writing — whereas content review analyzes the information/transactions the document records.

14. List four signs of a fraudulently altered or counterfeit document.

    (1) Erasures, obliterations, or whiteouts; (2) different handwriting, ink, or typeface within one document; (3) misaligned text or out-of-sequence numbers/dates; (4) photocopies submitted where originals are expected, or missing/altered signatures.

15. When organizing documents for a large fraud case, what indexing methods are commonly used?

    Chronological order, by transaction, by witness/custodian, or by relevance to specific case issues; a master key document log cross-references each item to its source and significance.

16. What is data analysis (fraud analytics) and name two common analytical techniques.

    Using software to examine large data sets for anomalies indicating fraud. Common techniques: Benford's Law analysis of digit frequency, duplicate/gap testing, outlier and ratio analysis, and correlation/trend analysis.

17. What is Benford's Law and how is it used in fraud analytics?

    A mathematical principle stating that in many naturally occurring data sets, leading digit '1' appears about 30.1% of the time, with frequency declining for higher digits. Deviations from this expected distribution can flag fabricated or manipulated numbers.

18. In data analysis, what is a 'duplicate test' and what does it detect?

    A test that identifies identical entries (same invoice number, amount, vendor, or payment) that should be unique. It detects double payments, duplicate invoices, and potential billing schemes.

19. Define 'data mining' versus 'data analysis' in a fraud context.

    Data mining is the broad exploration of large data sets to discover unknown patterns, relationships, or anomalies. Data analysis applies targeted tests/queries to confirm or quantify specific suspicions or hypotheses.

See more Investigation flashcards →

Planning Investigation for Certified Fraud Examiner (CFE)

Investigation (Certified Fraud Examiner (CFE)) FAQ