Certified Fraud Examiner CFE-Investigation Updated Exam

The Fraud Examiners Manual defines compliance verification as:

“Compliance verification determines whether company policies are met by employee transactions. For example, when employees are out of town, do they adhere to the company policy of not spending more than $30 a day for meals?” .

Thus, the correct function iscompliance verification.

Both the Manual and CFE Prep guides emphasize that forensic imaging is essential because:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging… allows a fraud examiner to view and analyse… without altering the original data in any way”.

A forensic image is anexact, sector-by-sector copyof the drive. Thus, imaging preserves evidence integrity.

“Distractions should be kept to a minimum. Ideally, there should be no photographs, windows, or other objects in the room. Chairs should be placed about four to six feet apart, and the accused should not be permitted to sit behind any physical barriers, such as chairs, tables, or desks” .

The door should be closed (but not locked), not open .

Tables or desks should not be between interviewer and suspect .

Thus, the correct adjustment is removing distractions (pictures/posters).

A memorandum recording a whistleblower tip is a written record. TheFraud Examiners Manualdefinesdocumentary evidenceas evidence “presented in the form of documents such as memoranda, contracts, emails, or other records”. Testimonial evidence comes from oral statements; here, the memorandum itself is the evidence, so it is documentary.