Use LEFT and RIGHT arrow keys to navigate between flashcards;
Use UP and DOWN arrow keys to flip the card;
H to show hint;
A reads text to speech;
101 Cards in this Set
- Front
- Back
|
Term that refers to the net amount a lender disburses to a borrower under the terms of a loan agreement. |
Loan proceeds |
|
|
Beta, a Certified Fraud Examiner, is conducting a routine interview of someone who does not know him. In such situations, it is usually best for Beta to omit his title when introducing himself. (T/F) |
True. Generally, an interviewer should indicate his name and company, but he should avoid stating his title if possible. In some instances, the interviewer cannot avoid giving his title, and in such cases, the interviewer should use a title that will not conjure up emotions or possible fear in the respondent’s mind. |
|
|
During which phase of the data analysis process does the fraud examiner identify, obtain, and verify the relevant or requested data? |
The preparation phase |
|
|
Name the most successful method of proving illicit income when several of the subject’s assets or liabilities have changed during the period under examination and the subject’s financial records are not available.
|
Net-worth method of analysis. The net-worth method (or comparative net-worth analysis) is used to prove illicit income circumstantially by showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or admitted legitimate sources of income.
|
|
|
In interview situations, ______________ communication is the use of interpersonal space to convey meaning.
|
Proxemic communication is the use of interpersonal space to convey meaning. The relationship between the interviewer and respondent is both a cause and effect of proxemic behavior. If the distance between the interviewer and the respondent is greater, there is more of a tendency for them to watch each other's eyes for clues to meaning.
|
|
|
During the analysis phase in digital forensic investigations, it is best to use just one forensic tool for identifying, extracting, and collecting digital evidence. (T/F)
|
False. No single computer forensics tool can recover everything; each tool has its own strengths and weaknesses. Therefore, it is best to use a combination of the various forensic tools during the analysis phase, allowing for the recovery of more information.
|
|
|
Which type of question is used to establish the respondent’s credibility?
|
Assessment
|
|
|
When making a direct accusation in an admission-seeking interview, it is usually best to use strong words such as steal, fraud, or crime to reinforce the seriousness of the crime to the suspect. (T/F)
|
False. The admission-seeking interview begins with a direct accusation. The accusation should be made in the form of a statement; it should not be made in the form of a question.
Also, emotive words such as steal, fraud, and crime should be avoided during the accusatory process. The accusation should be phrased as though the accused’s guilt has already been established, trapping the accused with no way out. |
|
|
Example of an alternative question?
|
C. “Did you deliberately plan this, or did it just happen?”
The alternative question forces the accused to make one of two choices, both of which imply guilt. One alternative provides the accused with a morally acceptable reason for the misdeed; the other paints the accused in a negative light. Regardless of which answer the accused chooses, he is acknowledging guilt. |
|
|
When a forensic investigator is seizing a running computer for examination, he can retrieve data from the computer directly via its normal interface if the evidence needed exists only in the form of volatile data. (T/F)
|
True. live evidence collection (i.e., collection directly from the computer via its normal interface) is appropriate when a formally trained computer investigator is seizing the computer, and the evidence that the investigator needs to collect exists only in the form of volatile data.
|
|
|
A fraud examiner discovers a paper document that he believes has both the suspect’s indented writings and latent fingerprints on it. What is the BEST preservation method for him to use when collecting the document?
|
A. Place the document into a plastic bag while handling it with protective gloves. tweezers should not be used on documents if indented writing or photocopier examinations are planned
|
|
|
Prior to conducting an interview, an investigator should prepare a thorough list of questions to ensure that the interview is well structured and that no predetermined lines of inquiry are forgotten.
(T/F) |
False. Whenever possible, do not prepare a list of predetermined questions to ask the subject. The interview should flow freely. The interviewer might, however, want to develop a list of key points to cover during the interview.
|
|
|
Under the Fair Credit Reporting Act, an employer does not need an employee's consent to access the employee’s credit report if the report is obtained as part of an investigation into suspected employee misconduct. (T/F)
|
True. The Fair Credit Reporting Act (FCRA) generally requires a party to obtain the consent of an individual before accessing that person’s consumer or credit report. However, there are some exceptions to this rule. The Fair and Accurate Credit Transactions Act of 2003 amended the FCRA to exempt certain reports involving employee misconduct investigations.
|
|
|
Description of the net-worth (or comparative net-worth) method of analysis?
|
B. The net-worth method is an indirect method of proving illicit income circumstantially by showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or admitted legitimate sources of income.
|
|
|
To protect the security of a covert investigation, no reports or memoranda of the covert operation should be committed to paper. (T/F)
|
False. Before conducting a covert operation, it is essential that the basis for the operation be committed to writing, preferably in a memo. The memorandum should clearly state: |
|
|
If a fraud examiner needs information on registration and disciplinary information regarding firms and individuals in the futures industry, he should contact the Financial Industry Regulatory Association (FINRA). (T/F) |
False. The National Futures Association oversees the commodities markets, and it is a one-stop information source for all types of registration and disciplinary information regarding firms and individuals in the futures industry. |
|
|
Definition of "protective health information" as it relates to HIPAA privacy rules. |
This covers any information relating to an individual’s past, present, or future physical or mental health, payment for services, or health care operations. |
|
|
Baker, a government fraud examiner, is attempting to obtain information about a fraud suspect from a local bank. The records of the bank are covered by which federal law? |
Right to Financial Privacy Act. Prohibits financial institutions from disclosing financial information about individual customers to governmental agencies without the customer’s consent, a court order, a subpoena, a search warrant, or other formal demand. There are, however, limited exceptions to this rule. |
|
|
What documentation should be included in a formal fraud examination report? |
Copies of important documents should be included in the report. Most evidence in fraud cases will be in document form, and when reporting the results of a fraud examination, it is best to include copies (not originals) of important documents in the formal report. Also, when operating under a lawful court order that compels a custodian to furnish original documents, the fraud examiner should copy those documents (preferably in the presence of the custodian). Then the fraud examiner should furnish the custodian with a receipt describing the documents copied or taken. |
|
|
What is the most appropriate type of question for fraud examiners to ask during interviews to confirm facts that are already known? |
Leading. Examples of leading questions include: "So there have been no changes in the operation since last year?"; "Are you still employed by the Bailey Book Corporation?"; "You got promoted, right?"; "Don't you get your income from various sources?" |
|
|
Green, a Certified Fraud Examiner, is conducting an admission-seeking interview of Brown, a fraud suspect. Brown has confessed to having committed the fraud, but he is denying anyone else was involved. However, Green knows this is untrue. What should Green do next? |
Proceed as if the falsehood has been accepted as truth and return to it later. Because of the psychology of confessions, most confessors will lie about one or more aspects of the offense, even though they confirm overall guilt. When this happens during the verbal confession, the interviewer should make a mental note of the discrepancy and proceed as if the falsehood had been accepted as true. Such discrepancies should be saved until all other relevant facts are provided by the accused. If the discrepancies are material to the offense, then the interviewer should either resolve them at the end of the verbal confession or wait and correct them in the written confession. If not material, such information can be omitted from the written confession. |
|
|
What is mutual legal assistance (MLA)? |
A process by which countries request and provide assistance in criminal law enforcement matters. Generally, MLA can be used to obtain assistance in matters such as conducting searches, gathering evidence, compelling sworn testimony and the production of documents, issuing search warrants, issuing subpoenas, serving process, exchanging affidavits, obtaining provisional remedies, and providing assistance in forfeiture proceedings. |
|
|
As a general rule, the more intelligent the witness, the less reliable his verbal and nonverbal clues of deception will be. (T/F) |
False. Conclusions concerning behavior must be tempered by a number of factors. As a general rule, the more intelligent the respondent, the more reliable verbal and nonverbal clues will be. |
|
|
Suppose you need to prove a suspect’s illicit income circumstantially. What method of tracing assets would yield the best result when the suspect is using his illicit funds to accumulate wealth and acquire assets, thus causing his net worth to increase? |
The asset method. There are two basic methods to compute a subject’s net worth: the asset method and the expenditures or sources and applications of funds method. The asset method should be used when the subject has invested illegal funds to accumulate wealth and acquire assets, causing net worth (value of assets over liabilities) to increase from year to year. |
|
|
In interview situations, it is usually advisable to err on the side of taking too many notes rather than too few. (T/F) |
False. The interviewer will frequently need to take notes during the interview. Interviews without notes are limited in their value because they leave the results of the interview open to interpretation or dispute. |
|
|
It is legal to take a video and audio recording of a suspect without his consent, as long as the suspect is in a public place when the recording is done. (T/F) |
False. Recording the conversations of others with eavesdropping devices (supersensitive microphones that listen from behind closed doors, for example) usually is illegal. People behind closed doors have a reasonable expectation of privacy. Taking a video recording or photograph of someone in a public place is legal, if the person does not have a “reasonable expectation” of privacy in such a place. |
|
|
Describe the image acquisition process used in examinations involving digital evidence. |
Creating an exact duplicate of the data on original storage media |
|
|
Carter, a Certified Fraud Examiner for Universal Design, learns that Wallace, a salesperson with a wheeler-dealer attitude, has close relationships with several Universal Design customers. Carter also knows that Wallace has excessive gambling habits, due in part to his strong desire for personal gain. Carter has sufficient predication to: |
Conduct discreet inquiries into Wallace's work as a salesperson. |
|
|
If the accused becomes withdrawn after his alibis have been diffused, the interviewer’s best course of action is to remain silent until the accused makes a confession. (T/F) |
False. After the accused’s alibis have been diffused, he normally will become quiet and withdrawn. Some people in this situation might cry. If this occurs, the interviewer must be comforting. The interviewer should not remain silent or discourage the accused from showing emotion. Generally, such reactions indicate that the accused is considering whether he should confess. At this point in the interview, the interviewer should present an alternative question. |
|
|
When determining a subject’s net worth for asset-tracing purposes, all assets should be valued at current market value to eliminate any question about estimates. (T/F) |
False. All assets should be valued at cost, not fair market value. Subsequent appreciation or depreciation of assets should be ignored. |
|
|
Alpha, a fraud suspect, was recently divorced. Where would an investigator likely find a record of Alpha's divorce? |
County court in the jurisdiction where the divorce was granted |
|
|
Text-based data is typically considered: |
Unstructured data. Structured data is the type of data that you would find in a database, consisting of recognizable and predictable structures. Examples of structured data include sales records, payment or expense details, and financial reports. Unstructured data, by contrast, is data that you would not find in a traditional spreadsheet or database. It is typically text-based. |
|
|
What fact would support the defense of a law enforcement officer against an allegation of entrapment? |
The officer acted based on a tip from a reliable source. The law enforcement officer or government agent must act based on more than mere suspicion. For example, if the officer received a reliable tip that a suspect committed fraud, then that could serve as adequate predication. Covert operations must not be used for “fishing expeditions.” |
|
|
What is a limitation of Benford’s Law? |
Benford’s Law cannot be applied to data sets with non-natural numbers, such as check or invoice numbers. Benford’s Law distinguishes between natural and non-natural numbers, and it is important to understand the difference between the two types because Benford’s Law cannot be applied to data sets with non-natural numbers. |
|
|
Understanding the data, determining whether predication exists, and building a profile of potential frauds are all steps of which phase of the data analysis process? |
The planning phase. This phase consists of several important steps, including: Understanding the data Articulating examination objectives Building a profile of potential frauds Determining whether predication exists |
|
|
John, a forensic document examiner, determines that a document that purports to be the original writing of a famous author created fifty years ago is actually made from paper created no more than two years ago. Which of the following best describes the document? |
An anachronism NOT an autoforgery. Anachronisms are items located at a time when they could not have existed or occurred. Generally, exposing anachronisms in fraudulent historical documents requires the expertise of investigators, historical experts, scientific laboratories, and forensic document examiners. |
|
|
What function does a Benford’s Law analysis help to achieve? |
Identifying fabricated numbers. The goal of a Benford’s Law analysis is to identify fabricated numbers. Benford’s Law provides that the distribution of the initial digits in natural numbers is not random; instead, it follows a predictable pattern. That is, Benford’s Law maintains that certain digits show up more than others do when dealing with natural numbers. |
|
|
Bill wants to search the Internet for articles about check fraud using a search engine. What search string will yield the best results? |
intitle:check fraud. The intitle:term search operator restricts results to those containing all the search terms specified in the title. So, entering [intitle: check fraud] in a search engine will return only documents that contain the words check and fraud in the title. |
|
|
Nonverbal indications of deception include: |
* Full-body motions away from the interviewer * Physical responses such as sweating or labored breathing * Changes in the use of illustrators * Interruptions to the flow of speech * Hands over the mouth * Manipulation of objects such as a pencil * Body positioned in a fleeing position * Crossing of the arms * Unnatural or casual reaction to evidence |
|
|
The goal of establishing an interview theme should be to: |
Get the respondent to make a commitment to assist before commencing serious questioning. After providing the introduction and establishing rapport, the interviewer must state the purpose of the interview in some way prior to the commencement of serious questioning. Otherwise, the respondent might be confused, threatened, or overly cautious. Stating the purpose of the interview is known as establishing the interview theme |
|
|
What types of records is/are available from local governments? |
* Building inspector records
* Building permit records * Health and fire department records * County coroner’s register * Voter registration records * County fire marshal records * Utility company records |
|
|
When tracing financial transactions, the method that involves using the subject’s books and records to analyze the relationship between the subject’s receipt and subsequent disposition of funds or assets is called? |
The direct method. A direct method uses the subject’s books and records (or financial transaction records belonging to third parties) to analyze the relationship between a suspect’s receipt and subsequent disposition of funds or assets. In contrast, an indirect method employs circumstantial evidence to analyze the relationship between a suspect’s receipt and subsequent disposition of funds or assets. |
|
|
When a fraud examiner prepares a memorandum reflecting the information furnished by a confidential source, how should the fraud examiner identify the source? |
The fraud examiner should use symbols to denote the source’s identity. |
|
|
During the introductory phase of the interview, the interviewer should avoid terms such as: |
Investigation. Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction from the respondent, and emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive, and they are more reluctant to answer and to cooperate. Words such as investigation and auditshould be avoided. The best terminology to use is words with a softer meaning such as inquiry or examination. |
|
|
Because digital evidence is different from tangible evidence, the rules regarding its admissibility in court are very different from the rules governing the admissibility of tangible evidence. (T/F) |
False. Although digital evidence is different from tangible evidence, the rules regarding its admissibility in court are really no different from the admissibility of any other type of evidence. To be admissible in court, digital evidence must be: Relevant, Material, Authentic, Legally obtained. |
|
|
Name an example of an indirect method of locating assets or tracing illicit funds. |
Net-worth analysis. Indirect approaches to prove income by using one of the following methods: the net-worth analysis—the asset method and the expenditures (source and application of funds) method—or the bank deposit analysis method. |
|
|
An admission-seeking interview is specifically designed to: |
Obtain a legal admission of wrongdoing NOT all of the above if available |
|
|
Blue, a nonunion suspect, arrived at a scheduled admission-seeking interview with his manager and insisted that the manager be allowed to sit in. Should this interview be allowed to continue? |
No, because the presence of a third party could have liability consequences. |
|
|
In interview situations, a(n)_______________ is an orderly, continuous account of an event or incident given by a respondent without prompting. |
Free narrative NOT an unprompted script |
|
|
What is the facilitator of communication that refers to rewards that are not directly related to the interview experience but that cause the respondent to see the interview as a means to an end? |
Extrinsic rewards. Extrinsic rewards for interviewees can include money, job advancement, and retention of privileges. What is irrelevant to the interviewer might not be to the respondent. A sensitive interviewer will be able to recognize what extrinsic rewards the respondent receives, if any, from being interviewed. |
|
|
Gray, a fraud suspect, has confessed to Blue, a Certified Fraud Examiner, that he has embezzled funds. Blue is unsure whether Gray had an accomplice. What is the most appropriate question concerning accomplices? |
"Who else knew about this besides you?" By asking who else “knew,” the interviewer is not only asking for the names of possible conspirators, but also about others who might have known what was going on and failed to report it. This question should be worded as “Who else knew?” rather than “Did someone else know?” |
|
|
What is an appropriate moral excuse clause to include in a signed confession? |
“I didn’t mean to hurt anyone." Instead of using language like “I didn’t mean to do it,” which implies lack of intent, the interviewer should focus on an excuse that provides only a moral explanation for the misconduct. |
|
|
________ is a data analysis software function that allows users to relate several files by defining relationships in collected data, without the use of the join command. |
Multi-file processing. |
|
|
What are unique challenges of cloud forensics not faced in traditional forensic practices? |
* Lack of frameworks and specialist tools
* Lack of information accessibility * Lack of data control * Jurisdiction of storage * Electronic discovery * Preserving chain of custody * Resource sharing * Lack of knowledge |
|
|
Describe the primary purpose of the Right to Financial Privacy Act. |
To prohibit financial institutions from disclosing financial information about individual customers to government agencies without consent or a judicial order |
|
|
To protect privacy interests, contractual audit clauses with business partners are generally found to be void and threats to terminate a business relationship over another party’s refusal to turn over non-public information are prohibited. (T/F) |
False |
|
|
To preserve the confidentiality of a fraud investigation, management should implement a blanket policy prohibiting employees from discussing employee investigations. (T/F) |
False |
|
|
The net-worth analysis method of tracing illicit funds is recommended as a primary method of proof when most of the subject’s income is deposited in a financial institution and the subject’s books and records are unavailable, withheld, incomplete, or maintained on a cash basis. (T/F) |
False. The bank deposits method is recommended as a primary method of proof when most of the subject’s income is deposited in a financial institution and the subject’s books and records are unavailable, withheld, incomplete, or maintained on a cash basis. The net-worth method of tracing assets would yield the best result when several of the subject’s assets or liabilities have changed during the period under examination and the subject’s financial records are not available. |
|
|
The use of trickery and deceit to obtain a confession will always render the confession inadmissible in a court of law. (T/F) |
False. The theory is that information can be obtained by nearly any means, with the exception of force or threats. The interviewer, however, may not employ any deception likely to cause the innocent person to confess. The use of deception is not justified regarding promises of leniency, promises of confidentiality, or to obtain a monetary or business advantage. |
|
|
Two people are having a conversation in a public park, but they are nowhere near any other people. Sandy, a private investigator, hid an audio recorder nearby without their knowledge and captures the conversation. Sandy’s action is likely prohibited by law. (T/F) |
True |
|
|
Statement about trying to locate a subject using online records? |
Obtaining a past address of the subject should be the first step in trying to locate a subject using online records. |
|
|
Baker, a Certified Fraud Examiner, is interviewing Green. During the interview, Baker could tell Green was becoming uncomfortable at the sensitive nature of the questions. As a general proposition, what should Baker do next? |
Ask a nonsensitive question and return later to the sensitive questions. |
|
|
Blue, a Certified Fraud Examiner, is conducting an admission-seeking interview of Green, a fraud suspect. Blue has a great deal of documentary evidence that he plans on using to diffuse Green's alibis. The proper technique for using the evidence is for Blue to lay it all out at once so that Green will be impressed with the weight of evidence. (T/F) |
False. The physical evidence—usually documents in fraud matters—generally should be displayed one piece at a time, in reverse order of importance. In this way, the full extent of the evidence is not immediately known by the accused. When the accused no longer denies culpability, the interviewer should stop displaying evidence. |
|
|
A(n) _____________ is a type of visual aid, in the form of a grid, that shows the relationship (or points of contacts) between a number of entities. |
Matrix |
|
|
Suppose you suspect there is a ghost employee scheme taking place in your organization and you want to compare the payroll records to the employee master file. Which data analysis technique would you use to match these two data records? |
The join function. The join function gathers together the specified parts of different data files. Joining files combines fields from two sorted input files into a third file. Join is used to match data in a transaction file with records in a master file, such as matching invoice data in an accounts receivable file to a master cluster. For example, you might need to compare two different files to find differing records between them. |
|
|
Which of the following is the most accurate statement about canceled (negotiated) checks? |
Canceled checks written on a subject’s account can reveal other bank accounts belonging to the subject. |
|
|
Keeping track of the amount of paper generated is one of the biggest challenges in fraud cases. How should you organize evidence? |
It is generally better to organize the documents by transaction or by party. |
|
|
When confessing to fraud, suspects tend to provide accurate details on the amount of funds involved and number of instances to relieve themselves of the guilt of their dishonest actions. (T/F) |
False. In fraud matters especially, it is common for the accused to underestimate the amount of funds involved as well as the number of instances. This is probably because of the human mind’s natural tendency to block out unpleasant matters. |
|
|
Blue, a Certified Fraud Examiner, is conducting an admission-seeking interview of Red, a fraud suspect. Blue asked Red: "Did you just want extra money, or did you do this because you had financial problems?" This is called a(n): |
Alternative question. |
|
|
Closed questions are worded in a way that makes it difficult for the respondent to answer “yes” or “no.” (T/F) |
False. |
|
|
The art of forensic document identification is called graphology. (T/F) |
False. Graphology (or graphoanalysis) has been described as a pseudoscience in which its practitioners have the purported ability to determine a person’s character, moral traits (honesty/dishonesty, etc.), personality, and mental state based upon an analysis of that person’s handwriting. Graphology is often erroneously confused with forensic document examinations, especially by the media. |
|
|
If, during an interview, the respondent replies, "I don't remember," this type of response is usually a symptom of resistance. (T/F) |
False. Usually, "I don't remember" is not an expression of resistance. Instead, it is an expression of modesty, tentativeness, or caution. One of the best ways to respond is to simply remain silent while the person is deliberating. |
|
|
three general approaches for obtaining a verbal confession? |
There are three general approaches to obtaining the verbal confession: chronologically, by transaction, or by event. |
|
|
For purposes of evaluating deception, illustrators can be defined as: |
Motions made primarily with the hands to demonstrate a point. |
|
|
In interview situations, ___________ are questions that often suggest an answer opposite to the correct one. |
Double-negative |
|
|
If, during an interview, the respondent replies, "I don't remember," this type of response is usually a symptom of resistance. (T/F) |
False. Usually, "I don't remember" is not an expression of resistance. Instead, it is an expression of modesty, tentativeness, or caution. One of the best ways to respond is to simply remain silent while the person is deliberating. He is saying, in effect, "Give me a moment to think." If this is not successful, the best way to counter is to pose an alternate, narrower question. |
|
|
Which of the following documents is likely to be included with the account-opening documents for a corporation’s business account? |
C. Copies of corporate resolutions of the board of directors authorizing the opening of the account |
|
|
When conducting an investigation, it is often advantageous to administer interviews with two or more subjects simultaneously due to the likelihood that they will turn against each other. (T/F) |
False. One of the basic rules of interviewing is to question only one person at a time. The testimony of one respondent invariably will influence the testimony of another. There are few hard and fast rules of interviewing, but this is one of them. Another basic rule is to conduct interviews under conditions of privacy. The interview is best conducted out of the sight and sound of friends, relatives, or fellow employees. People are very reluctant to furnish information within the hearing of others. |
|
|
Which of the following is an example of a data analysis function that can be performed to help detect fraud through examination of payroll accounts? A. Generate depreciation to asset cost reports. B. Identify paycheck amounts over a certain limit. C. Compare customer credit limits and current or past balances. D. Compare approved vendors to the cash disbursement payee list. |
B. Identify paycheck amounts over a certain limit. The following are examples of data analysis queries that can be performed by data analysis software on payroll accounts to help detect fraud: * Summarize payroll activity by specific criteria for review.* Identify changes to payroll or employee files. * Compare timecard and payroll rates for possible discrepancies. * Prepare check amount reports for amounts over a certain limit. * Check proper supervisory authorization on payroll disbursements. |
|
|
Which of the following is an objective of an admission-seeking interview? A. To obtain a signed written statement acknowledging the facts B. To obtain a valid confessionINCORRECT C. To distinguish innocent individuals from culpable ones D. All of the above |
D. All of the above The admission-seeking interview is designed to obtain a legal admission of wrongdoing. It also serves various other purposes. For example, it seeks to clear an innocent person and encourage a culpable person to confess. A culpable individual will frequently confess during the admission-seeking phase of an interview, while an innocent person will not do so unless threats or coercion are used. Also, the interviewer will seek to obtain a valid confession. And finally, admission-seeking interviews are designed to convince the confessor to sign a written statement acknowledging the facts. |
|
|
Smith, a Certified Fraud Examiner for the ABC Corp., is in the process of interviewing Alfred, a parts clerk, about a theft of inventory. Smith is unsure if Alfred is involved in the theft. In concluding the interview, Smith should: A. Review the key points discussed during the interview to ensure he has understood everything Alfred has said. B. Avoid revisiting any previously discussed topics to prevent Alfred from knowing what Smith considers important. C. Tell Alfred that he could be considered a suspect in the theft and observe his reaction. D. Tell Alfred that there is not enough evidence to consider him a suspect and therefore he is free to go. |
A. Review the key points discussed during the interview to ensure he has understood everything Alfred has said. It is not unusual for the interviewer to have misunderstood or misinterpreted the respondent’s statements. Therefore, to ensure that the interviewer understood the information that the witness provided, he should review the key facts during the closing phase of the interview. However, the interviewer should not attempt to revisit all the information provided by the subject, only the facts that are most relevant. |
|
|
When shifting from assessment questions to admission-seeking questions, the fraud examiner should provide a transitional theme that is designed to make the subject believe that he has been caught. (T/F) |
True. A transitional theme is necessary when proceeding from assessment-seeking questions to admission-seeking questions. In part, the theme should be designed to make the subject believe that he has been caught. Under the ideal circumstance, the interviewer should leave the room for a few minutes before proceeding to admission-seeking questions, saying that he has to leave to “check on something.” |
|
|
A Uniform Commercial Code (UCC) filings search can help identify: A. A list of companies that an individual is an officer or registered agent of B. Personal property that an individual or business has financed C. Real estate ownership information D. All of the above |
B. Personal property that an individual or business has financed A search of Uniform Commercial Code (UCC) filings can help fraud examiners identify personal property that an individual or business has financed. These filings produced as the result of the transactions will identify: * Name of the debtor or joint debtors* Current address of the debtors * Name of the financial lender * Type of collateral pledged as security * Date of filing and continuations |
|
|
Able, a Certified Fraud Examiner, conducted an interview of Baker, the controller of the ABC Company. Able asked the following question: "Since you were here when the controls were developed, can you tell me how they came about?" This kind of question is called a ____________________. A. Double-negative question B. Controlled answer technique C. Complex question D. None of the above |
B. Controlled answer technique Controlled answer techniques or statements may be used to stimulate a desired answer or impression. These techniques direct the interview toward a specific point. |
|
|
Jones, a Certified Fraud Examiner and director of security for ABC Inc., obtained several boxes of documents while conducting a fraud examination. While inventorying the boxes and marking the evidence, Jones discovers a stock certificate he feels will be damaged if he marks it with his initials and the date. In order to maintain the proper chain of custody, Jones should: A. Photograph and store the document. B. Mark the document regardless of the potential for damage. C. Place the document in a marked envelope. D. Copy the document and initial and date the copy. |
C. Place the document in a marked envelope. To preserve the chain of custody, all evidence received should be marked so that it can later be identified. The most common way to mark the evidence is with the date and initials of the person obtaining the documents. If it is not practical to mark the document, or if marking it would damage the document, then it should be placed in an envelope and the envelope should be marked and sealed. Make sure not to write on the envelope after placing the document inside to avoid indented writings. |
|
|
To properly prepare an organization for a formal fraud investigation, all employees should be notified of the investigation’s existence and purpose. (T/F) |
False. It is not good practice to alert all of an organization’s employees that an investigation will be taking place, nor is it a good idea to explain the investigation’s purpose to those employees. However, it might be necessary to take some steps to prepare the subject organization for the formal investigation before it officially commences (and especially before starting the evidence collection process). |
|
|
In interviews involving anxiety and uncertainty, individuals might perform displacement activities that reduce nervousness. These types of displacement activities are known as: A. Illustrators B. Paralinguistics C. Norming D. Manipulators |
D. Manipulators Manipulators are motions like picking lint from clothing, playing with objects such as pencils, or holding one’s hands while talking. Manipulators are displacement activities that reduce nervousness. |
|
|
Green, a Certified Fraud Examiner, has obtained an oral confession from Red, a fraud suspect. Green wants to probe Red for additional details. What question should Green ask Red to find out if there are any remaining proceeds that can be used to reduce losses? |
What do you have left? |
|
|
Gamma, a CFE, is attempting to locate the birthplace of Theta, a fraud suspect. Where is Gamma likely to find such a record if it exists? |
State's bureau of vital statistics |
|
|
A Uniform Commercial Code (UCC) filings search can help identify... |
Personal property that an individual or a business has financed. [Name of the debtor or joint debtors Current address of the debtors Name of the financial lender Type of collateral pledged as security Date of filing and continuations] |
|
|
"Did you deliberately plan this, or did it just happen?" is an example of... |
an alternative question |
|
|
Suppose you need to prove a suspect's illicit income circumstantially. Which method of tracing assets would yield the best result when the suspect is spending his illicit funds on items that would not cause an increase in net worth, such as travel and entertainment? |
The expenditures method (compares the suspect's known expenditures and known source of funds for a given period of time) |
|
|
Primary purpose of the Right to Financial Privacy Act |
To prohibit financial institutions from disclosing information about individual customers to governmental agencies without consent or a judicial order. |
|
|
Deleted files that have been overwritten usually cannot be recovered. (T/F) |
True |
|
|
Four objectives of introductory questions |
To provide an introduction To establish rapport To get the respondent to agree verbally to cooperate in the interview To observe the respondent's reactions to questions. |
|
|
Credit card records and statements pertaining to a subject can provide insight into the subject's movements and habits, but they do not reveal people with whom the subject does business. (T/F) |
False |
|
|
four objectives of an admission-seeking interview |
obtain a legal admission of wrongdoing to distinguish innocent individuals from culpable ones obtain a valid confession to obtain a signed written statement acknowledging the facts |
|
|
A(n) __________ is a writing, usually a signature, prepared by carefully copying or tracing a model example of another person's writings. |
Simulated forgery |
|
|
_________ records events executed on an operating system, such as starting up and shutting down, configuration updates, and system crashes. |
System log |
|
|
___________ is a method of using software to extract usable information from unstructured data. |
Textual analysis |
|
|
What is a good practice for taking notes during an interview? |
Avoid making notes regarding opinions or impressions about a witness. |
