Certified Fraud Examiner (CFE) Investigation Syllabus

What is a 'bit-stream (forensic) image' and why is it preferred over a logical copy?

An exact, sector-by-sector duplicate of a storage device, capturing all data including deleted files, slack space, and unallocated space. A logical copy captures only active/visible files, so it misses recoverable evidence.

What is a hash value (e.g., MD5/SHA) used for in digital forensics?

A unique digital fingerprint of a file or drive image. Matching hash values before and after acquisition proves the evidence is an exact, unaltered copy, supporting integrity and admissibility.

What is 'slack space' and 'unallocated space' on a hard drive, and why do they matter forensically?

Slack space is the unused portion of a disk cluster between a file's end and the cluster's end; unallocated space is storage not currently assigned to a file (including deleted data). Both can contain recoverable fragments of evidence.

What are the two broad categories of information sources in a fraud examination?

Internal sources (company records, employees, accounting systems) and external sources (public records, third parties, online databases, government agencies, and informants).

Distinguish public records from nonpublic information sources, giving examples.

Public records are open to anyone — court filings, property/UCC records, business registrations, bankruptcy filings. Nonpublic sources include credit reports, bank records, and tax returns, which generally require consent, subpoena, or legal authority to access.

What is the difference between a confidential source and a confidential informant?

A confidential source furnishes information in the normal course of business and expects identity protection; a confidential informant provides information, often on a continuing basis, and may be involved in the activity being investigated. Informant reliability must be carefully evaluated.

What is the net worth method and when is it used?

An indirect method to estimate unknown/illicit income by measuring increases in a subject's net worth plus living expenses that exceed reported/known income. Used when direct records of income are unavailable or concealed.

State the net worth method formula (asset method).

Funds from Unknown Sources = (Ending Net Worth − Beginning Net Worth) + Living Expenses − Funds from Known Sources. Where Net Worth = Assets − Liabilities.

What is the difference between the 'asset method' and the 'expenditures method' of net worth analysis?

The asset method measures changes in accumulated assets/net worth over time. The expenditures (sources-and-applications) method compares total spending to known income; it works better when the subject spends illicit funds rather than accumulating assets.

In financial profiling, what does a 'sources and uses of funds' analysis show?

It compares all known sources of funds (income, loans) against all uses (expenditures, asset purchases, debt payments). If uses exceed sources, the excess indicates funds from undisclosed or illicit sources.

What does 'following the money' mean in asset tracing, and what is its goal?

Systematically tracking the movement of funds from origin through each transaction and account to its final destination. The goal is to identify hidden assets, beneficiaries, and the disposition of stolen or laundered funds for recovery and proof.

What are the three classic stages of money laundering?

(1) Placement — introducing illicit cash into the financial system; (2) Layering — moving funds through complex transactions to obscure their origin; (3) Integration — returning the 'cleaned' funds to the criminal as apparently legitimate assets.

What are common methods used to conceal or hide assets that an examiner traces?

Transferring assets to nominees/relatives, shell or offshore companies, structuring cash deposits, converting to hard-to-trace assets (cash, jewelry, crypto), and creating fictitious loans or backdated transactions.

What are the key elements of properly planning and structuring an interview?

Define the objective, research the subject and facts, sequence questions from general to specific, choose a private and appropriate location, plan the order of witnesses (neutral first, suspect last), and allow adequate uninterrupted time.

What are the five general types of interview questions and their order of use?

(1) Introductory, (2) Informational (open then closed), (3) Assessment, (4) Closing, and — only when warranted — (5) Admission-seeking. They generally proceed from non-threatening to more sensitive.

What is the difference between open-ended and closed-ended interview questions?

Open-ended questions invite a narrative response and elicit broad information (used early); closed-ended questions seek a specific, brief answer (yes/no, dates) and are used to pin down details and commit the subject to facts.

What are assessment questions designed to do in an interview?

To establish the interviewee's truthfulness by observing verbal and non-verbal reactions to non-accusatory but pointed questions, creating a behavioral baseline to detect deception before any accusation is made.

Give three verbal cues that may indicate deception during an interview.

Overly specific or rehearsed answers, repeating the question to stall, selective memory ('I don't recall'), changes in speech rate or tone, character testimony/oaths ('I swear'), and refusal to answer directly.

Give three non-verbal cues that may indicate deception.

Reduced or evasive eye contact, fidgeting or grooming gestures, crossing arms/creating barriers, covering the mouth, and changes in posture (leaning away). Such cues are only indicators and must be evaluated against a baseline.

What is the purpose of the admission-seeking interview and when is it appropriate?

To obtain a confession or admission from a subject whose guilt is reasonably certain based on the evidence. It is conducted only after other evidence has been gathered and the subject is the prime suspect.

What is a 'rationalization' theme in an admission-seeking interview?

A face-saving moral excuse offered by the interviewer (e.g., financial pressure, unfairness, 'anyone might have done it') that lowers the subject's resistance and makes it psychologically easier to admit wrongdoing — without minimizing the legal seriousness in writing.

After obtaining a verbal admission, what key elements should the examiner confirm to convert it into a valid confession?

That the subject knew the conduct was wrong (intent), the approximate dates and amounts/scheme details, the disposition of proceeds, others involved, and a voluntary acknowledgment — ideally captured in a signed written statement.

What distinguishes a legally permissible interview from coercion or false imprisonment?

The interview must be voluntary; the subject must be free to leave and not be physically restrained, threatened, or subjected to promises of leniency. Coercion can render statements inadmissible and expose the examiner to civil/criminal liability.

Why must private fraud examiners be cautious about Miranda warnings and entrapment?

Miranda applies to custodial interrogation by law enforcement, not typically private examiners — but if acting as a government agent, those protections attach. Examiners must also avoid entrapment (inducing someone to commit a crime they wouldn't otherwise commit).

What ethical/legal limits restrict how examiners obtain admissions and evidence?

No threats, physical force, or false promises; respect privacy and defamation laws; avoid unlawful searches or pretexting prohibited by law; and never fabricate or alter evidence. Violations risk inadmissibility and liability.

What are the essential characteristics of a well-written fraud examination report?

Accurate, objective, clear, complete, relevant, and timely. It states facts (not opinions or conclusions of guilt), is supported by evidence, and avoids speculation, bias, or legal conclusions.

Why should a fraud examination report avoid stating opinions about guilt or using terms like 'guilty'?

Determining guilt is the role of the court/jury, not the examiner. Stating conclusions of guilt can expose the examiner to defamation liability and undermine objectivity; the report should present facts and let the evidence speak.

What is the purpose of visual aids and exhibits in presenting a fraud case?

To simplify and clarify complex financial information for non-expert audiences (juries, management), making relationships, timelines, and money flows understandable. Common aids include link charts, timelines, flowcharts, and summary schedules.

What guidelines ensure an exhibit or visual aid is effective and credible?

It must be accurate, clearly labeled, traceable to underlying evidence, simple and uncluttered, and present one main idea. Misleading or unsupported visuals damage credibility and may be excluded.

What steps are involved in engagement closure and proper case referral?

Finalize and issue the report, return or securely retain evidence per chain-of-custody and retention policy, debrief management, recommend control improvements, and — where warranted — refer the case to law enforcement, regulators, or counsel for prosecution or recovery.