CFE-Financial-Transactions-and-Fraud-Schemes Certified Fraud Examiner - Financial Transactions and Fraud Schemes Exam Questions and Answers

Detailed Explanation:

Rationale for Correct Answer: Prepaid debit and gift cards are attractive because they allow fraudsters to convert stolen credit card funds into cash or easily launder illicit funds . They are widely available and accepted both in person and online, making option A correct.

Analysis of Incorrect Options:

B. Only from financial institutions – False; cards are sold at retail stores and online.

C. Not accepted online – False; they are accepted by most online retailers.

D. All of the above – Incorrect since B and C are false.

Key Concept: Prepaid card fraud as part of asset misappropriation and identity theft schemes.

The ACFE Fraud Examiners Manual addresses Expense Reimbursement Schemes under Asset Misappropriation: Fraudulent Disbursements and separates the discussion into:

Detection of Expense Reimbursement Schemes

Prevention of Expense Reimbursement Schemes

The Manual specifically identifies “Detailed Expense Reports: Submission and Review” as the prevention approach for expense reimbursement fraud.

Why A is correct

Requiring all employees to submit receipts electronically is not, by itself, a preventive control recognized by the Manual. The ACFE’s prevention focus is on requiring detailed expense reports , adequate supporting documentation, and careful review—not merely changing the format of submission from paper to electronic. In fact, because expense reimbursement fraud often involves altered receipts , fictitious receipts , and other manipulated support, simply requiring electronic submission does not meaningfully prevent the scheme. The Manual lists schemes such as altered receipts and producing fictitious receipts , showing that the problem is the authenticity and review of documentation, not whether the receipt is submitted electronically.

Why the other options are helpful

B. Comparing current expenses to budgeted expense amounts

This is helpful because the Manual includes review and analysis of expense accounts as part of detecting these schemes. Comparing reported expenses to expected or budgeted levels can reveal unusual spikes or anomalies that may indicate fraud.

C. Requiring employees to explain the specific business purpose of each expense

This is clearly helpful and consistent with the Manual’s prevention emphasis on detailed expense reports and proper documentation. Requiring a specific business purpose makes it harder to submit personal, inflated, or fictitious expenses.

D. Comparing current expenses to historical expenditure amounts

This is also helpful because the Manual’s review and analysis of expense accounts supports analytical comparisons to identify irregularities, trends, or unexplained increases in reimbursements. Historical comparison is a classic way to spot padded or abnormal expense claims.

Conclusion

Under the ACFE Manual, prevention of expense reimbursement schemes depends on detailed reporting, documentation, and review . Merely requiring receipts to be submitted electronically does not address whether the receipts are false, altered, duplicated, or unsupported. Therefore, the choice that would NOT be helpful in preventing expense reimbursement schemes is:

A. Requiring all employees to submit receipts electronically

References

ACFE Fraud Examiners Manual, 2020 International Edition

Expense Reimbursement Schemes

Detection of Expense Reimbursement Schemes / Review and Analysis of Expense Accounts

Prevention of Expense Reimbursement Schemes / Detailed Expense Reports: Submission and Review

Altered Receipts / Producing Fictitious Receipts

Detailed Explanation:

Rationale for Correct Answer: Administrative security controls involve policies, procedures, and practices designed to manage the overall security environment—such as awareness training, audits, data classification, and enforcement of policies. These controls focus on governance rather than direct system configuration.

Analysis of Incorrect Options:

A. Technical security controls – These are automated safeguards (e.g., firewalls, encryption).

B. Logical access controls – Restrict access to systems through passwords, tokens, or biometrics.

D. Physical access controls – Restrict physical access (e.g., locks, guards, CCTV).

Key Concept: Layers of security controls (administrative, technical, physical).

Detailed Explanation:

Rationale for Correct Answer: Being prompted to install unfamiliar software is a red flag for malware or unauthorized access, often indicating that attackers are attempting to establish persistence in the system. This is a classic indicator of a compromised network.

Analysis of Incorrect Options:

A – Standard security measure, not a red flag.

C – Data from supplier countries is normal if consistent with business operations.

D – Access denial to files outside a user’s role is a normal access control, not an intrusion sign.

Key Concept: Cyberfraud detection – identifying intrusion indicators.

Detailed Explanation:

Rationale for Correct Answer: This is True . Fraudulent financial reporting often involves manipulating depreciation. By lowering or delaying depreciation expense, companies can inflate profits and overstate asset values. This is a common method of financial statement fraud related to earnings management.

Analysis of Incorrect Options:

B. False – Incorrect, as understatement of depreciation clearly inflates reported profits.

Key Concept: Depreciation Manipulation in Financial Statement Fraud .

Detailed Explanation:

Rationale for Correct Answer: Bribery prevention policies often include:

Reporting gifts (disclosure of items received from vendors),

Discounts (rules about vendor concessions),

Business meetings (clear rules on vendor-sponsored events). Resource diversions is not a standard bribery prevention policy but a form of fraud.

Analysis of Incorrect Options:

A, B, C – Legitimate examples of prevention policies.

D. Resource diversions – Not a preventive measure.

Key Concept: Anti-bribery policies — clear rules on gifts, discounts, and vendor relationships.

Detailed Explanation:

Rationale for Correct Answer: One of the strongest internal controls against fraudulent billing schemes (such as shell companies, inflated invoices, and kickbacks) is to require competitive bidding . This ensures transparency, reduces favoritism, and makes it harder for employees and vendors to collude.

Analysis of Incorrect Options:

A – Fraud tips are valuable, but routing them only through supervisors may suppress reporting; hotlines are more effective.

B – Combining purchasing and payment increases fraud risk by reducing segregation of duties.

D – Outsourcing negotiations does not directly prevent billing fraud.

Key Concept: Internal controls and segregation of duties in preventing billing schemes.

Detailed Explanation:

Rationale for Correct Answer: In fictitious revenue schemes , sales are recorded that never occurred. Because no actual customers exist, there will be no late or overdue accounts receivable. The Fraud Examiners Manual (2020) notes that unusually clean receivables aging reports—i.e., no overdue balances—can be a red flag of revenue manipulation.

Analysis of Incorrect Option:

B. False – Incorrect; the absence of overdue receivables is indeed suspicious and aligns with fictitious revenue fraud.

Key Concept: Financial statement fraud red flags — fictitious revenues.

Detailed Explanation:

Rationale for Correct Answer: Disclosure is required whenever individuals in positions of trust are indicted or otherwise compromised. Transparency ensures stakeholders are aware of potential conflicts or risks.

Analysis of Incorrect Options:

A. Conflict of interest – A scheme, not the corrective measure.

B. Turnaround sale or flip – Specific scheme, irrelevant here.

D. Resource diversion – A fraud method, not a governance requirement.

Key Concept: Importance of Disclosure in preventing or responding to conflicts of interest.

Detailed Explanation:

Rationale for Correct Answer: Option B is NOT a typical fraud-related aspect of inventory purchases. An increase in year 2 inventory being greater than year 1 is not, by itself, an indicator of fraud — it could reflect growth. However:

A describes “inventory build-up and liquidation” schemes,

C highlights mismatches between sales and purchases,

D acknowledges possible fraud schemes.

Analysis of Incorrect Options:

A – Recognized fraud indicator.

C – Suggests fictitious sales or revenue manipulation.

D – Correctly signals potential fraud.

Key Concept: Red flags in inventory purchases and mismatched patterns.

Detailed Explanation:

Rationale for Correct Answer: Cash larceny involves stealing cash after it has been recorded . Mark stole $50 directly from the register after recording sales, which is a cash larceny scheme.

Analysis of Incorrect Options:

A. Paul’s scheme – This is skimming (off-book theft), not larceny.

B. Emily’s scheme – This is a lapping scheme (concealing theft of receivables), not pure larceny.

C. Sarah/Jenna – This is an overstated refund scheme (fraudulent disbursement), not larceny.

Key Concept: Cash larceny vs. skimming vs. fraudulent disbursements.

Detailed Explanation:

Rationale for Correct Answer: The ACFE describes occupational fraud and abuse as an expense of doing business because organizations inevitably face losses from it, just as they incur other operating costs. This framing emphasizes the importance of prevention and detection to minimize this “expense.”

Analysis of Incorrect Options:

A. Equity – Residual ownership interest, not relevant here.

B. Balance sheet – A report, not a cost.

D. Financial record – Too vague.

Key Concept: Occupational Fraud as a Cost of Business .

Detailed Explanation:

Rationale for Correct Answer: Larceny by fraud (often termed “theft by deception”) occurs when someone unlawfully obtains another’s property by deception rather than by direct taking. As defined in fraud examination principles, deception can involve: (1) creating or reinforcing a false impression, (2) failing to correct a false impression, or (3) failing to disclose material facts such as liens or adverse claims. Because all three scenarios represent deceptive means to unlawfully take property, the correct answer is D. All of the above .

Analysis of Incorrect Options:

A, B, C each describe valid examples of fraud by deception but individually do not fully capture the concept.

D encompasses the totality of recognized deceptive practices under larceny by fraud.

Key Concept: Fraud by deception as an element of theft and misappropriation.

Detailed Explanation:

Rationale for Correct Answer: The full disclosure principle requires that all material facts and deviations from GAAP be disclosed to readers of financial statements so that they are not misled. Transparency is essential for informed decision-making by investors, creditors, and regulators.

Analysis of Incorrect Options:

B. SAS – Refers to auditing standards, not accounting standards.

C. Writer – Incorrect; disclosures are intended for readers/users.

D. None of above – Incorrect since option A is correct.

Key Concept: Full disclosure principle — providing users with all material information.

Detailed Explanation:

Rationale for Correct Answer: Employees involved in bribery or corruption schemes often exhibit lifestyle red flags such as gambling habits, drug/alcohol addiction, or extravagant spending . These behaviors create financial pressures that may motivate or result from corrupt activity.

Analysis of Incorrect Options:

A, B, C individually – Each is a red flag, but the most accurate answer is all of the above .

Key Concept: Behavioral red flags in corruption cases.

Detailed Explanation:

Rationale for Correct Answer: Recognized schemes for stealing inventory include:

Larceny schemes (direct theft)

Asset requisition and transfer schemes (false requisitions to divert assets)

Purchasing and receiving schemes (over-ordering or falsifying deliveries).

“ Sales & Equipment handling ” is not a defined fraud scheme, making D correct.

Analysis of Incorrect Options:

A. Larceny schemes – Valid theft method.

B. Asset requisition and transfer – Document manipulation method.

C. Purchasing and receiving schemes – Valid misappropriation scheme.

Key Concept: Inventory theft schemes under the Fraud Tree.

Detailed Explanation:

Rationale for Correct Answer: The conservatism principle in accounting means that financial statements should not overstate assets or income and should anticipate possible losses. Thus, the amounts shown should be at least as much as reflected, if not more. This ensures users are not misled by overly optimistic figures.

Analysis of Incorrect Options:

A. Fraudulent statement – Involves intentional misrepresentation, not a principle of accounting.

B. Misappropriations – Theft of assets, unrelated to valuation principles.

D. Matching – Refers to aligning expenses with related revenues, not conservatism.

Key Concept: Conservatism principle — caution in financial reporting.

Detailed Explanation:

Rationale for Correct Answer: Economic extortion occurs when someone demands payment or benefit under threat of harm (explicit or implicit). A government official demanding money in exchange for awarding a contract is classic extortion.

Analysis of Incorrect Options:

A – This is a billing scheme (fraudulent disbursement), not extortion.

C – This is a kickback scheme (corruption).

D – This is an illegal gratuity scheme (reward after action).

Key Concept: Types of corruption—extortion vs. bribery vs. gratuities.

The ACFE Fraud Examiners Manual includes Kickback Schemes in the corruption section and specifically identifies Diverting Business to Vendors as a type of kickback scheme.

This question states that Bob, a purchasing agent , directed business to Oak Company, and in return Oak’s sales manager agreed to pay Bob a percentage of the extra profits . That is a classic kickback arrangement : the employee steers company business to a favored vendor in exchange for a personal financial benefit. The Manual’s examples of corruption also discuss a vendor bribing or paying a purchasing agent to receive more business.

Why the other options are incorrect

A. Economic extortion scheme

The Manual defines economic extortion as obtaining money, property, or services through coercion or threatened adverse action. That is not what happened here; Bob was paid for steering business, not coercing payment through threats.

C. Illegal gratuity scheme

The Manual explains that illegal gratuities are items of value given to reward a decision, often after the recipient has already made the decision, and this concept is primarily discussed in the public-sector context. Here, the payment is part of an agreement to direct business and share in profits, which is more accurately a kickback .

D. Diversion scheme

The relevant Manual terminology is Diverting Business to Vendors , but that appears as a subtype under Kickback Schemes . Therefore, the best answer among the options is the broader and correct classification: kickback scheme .

References

ACFE Fraud Examiners Manual, 2020 International Edition

Corruption — Kickback Schemes

Corruption — Diverting Business to Vendors

Example involving a purchasing agent receiving improper payments to steer business to a vendor

Economic Extortion definition

Illegal Gratuities definition

Detailed Explanation:

Rationale for Correct Answer: Revenue recognition requires that delivery has occurred or services have been rendered . If installation, testing, and customer acceptance have not occurred (A), or if a written order exists but with a right of return (B), delivery is not considered complete. Both scenarios prevent proper revenue recognition. Hence, the correct answer is C. Both A & B .

Analysis of Incorrect Options:

A – Correct condition, but incomplete.

B – Correct condition, but incomplete.

D. Neither A nor B – Incorrect, as both conditions do prevent recognition.

Key Concept: Revenue recognition fraud risks — recognizing revenue prematurely.

Detailed Explanation:

Rationale for Correct Answer: The SEC’s Staff Accounting Bulletin (SAB) 104 outlines four criteria for revenue recognition:

Persuasive evidence of an arrangement exists.

Delivery has occurred or services have been rendered.

The seller’s price is fixed or determinable.

Collectability is reasonably assured.

“ Timings have been met ” is not one of the recognized criteria, making C the correct answer.

Analysis of Incorrect Options:

A, B, D – All are required conditions.

C – Not part of SAB 104.

Key Concept: Revenue recognition criteria under SAB 104.

Detailed Explanation:

Rationale for Correct Answer: Under GAAP, revenue is recognized when it is realized or realizable and earned . This requires that the earnings process be substantially complete, and payment be reasonably assured.

Analysis of Incorrect Options:

B. Fictitious and Earned – Fictitious revenues are fraud, not recognized revenue.

C. Realized and Evidenced – Evidence supports recognition, but “earned” is the proper standard.

D. All of the above – Incorrect, since only option A is correct.

Key Concept: Revenue recognition principle — realized/realizable and earned.

Detailed Explanation:

Rationale for Correct Answer: This is a tech-support scam , in which fraudsters trick victims into believing their computers are infected and then charge fees for unnecessary or fake repairs. The scam often targets elderly victims.

Analysis of Incorrect Options:

A. Pharming – Redirects users to fake websites, not fake support calls.

B. Bait and switch – Advertising deception, not fraudulent computer support.

D. Smishing – Fraud via SMS text messages, not on-screen computer popups.

Key Concept: Consumer fraud schemes — tech-support scams.

Detailed Explanation:

Rationale for Correct Answer: The balance sheet summarizes account balances from the ledger at a specific date, presenting assets, liabilities, and equity. It reflects the organization’s financial position and is derived from ledger balances.

Analysis of Incorrect Options:

B. Income statement – Summarizes revenues and expenses, not all ledger balances.

C. Financial statement – A general term, but the specific answer here is balance sheet.

D. General journal – Book of original entry, not a summary.

Key Concept: Balance sheet as a summary of ledger accounts.

Detailed Explanation:

Rationale for Correct Answer: This statement is True . Asset misappropriations reduce the organization’s assets. In double-entry accounting, a decrease in assets without a corresponding decrease in liabilities results in a reduction of owner’s equity. Therefore, fraud not only depletes assets but also indirectly reduces equity.

Analysis of Incorrect Options:

B. False – Incorrect because asset theft clearly reduces net assets and thereby equity.

Key Concept: Impact of Asset Misappropriation on the accounting equation: Assets = Liabilities + Equity.

The ACFE Fraud Examiners Manual includes a specific subsection titled “Departures from Generally Accepted Accounting Principles” within Accounting Concepts .

Under the Manual’s discussion of GAAP, the focus is on proper financial reporting so that transactions are recorded in their appropriate classifications and reported fairly in the financial statements. The Manual explains that GAAP are the standardized financial reporting practices used to ensure accurate and reliable reporting.

Based on this framework, a departure from GAAP can be justified only in limited circumstances, such as when strict compliance would make the financial statements misleading or when a different treatment is necessary to better reflect the substance of the transaction rather than only its form. Likewise, avoiding the overstatement of assets or income is consistent with fair presentation and conservative reporting principles. These are accounting-based justifications tied to faithful financial reporting.

By contrast, cost is not a valid reason to depart from GAAP. The fact that reporting a transaction in a GAAP-compliant manner would be more expensive does not justify noncompliance. Financial statements must be prepared in accordance with the applicable standards, not according to whichever treatment is cheaper or easier for management. Therefore, this option is the one that is NOT justifiable.

Why the other options are not the correct choice

A. To avoid overstating assets and/or income

This is consistent with fair presentation. The Manual’s discussion of GAAP is aimed at proper classification and reporting of transactions so that financial statements are not distorted.

C. To better reflect the substance of a transaction

This is a recognized accounting rationale. Financial reporting should reflect the economic reality of a transaction, not merely its legal form. This is consistent with the Manual’s discussion of proper reporting under GAAP.

D. Following GAAP would produce misleading results on financial statements

This is one of the classic reasons a departure can be justified, because the objective of financial reporting is fair presentation rather than mechanical compliance that misleads users.

References

ACFE Fraud Examiners Manual, 2020 International Edition

Accounting Concepts — Generally Accepted Accounting Principles

Accounting Concepts — Departures from Generally Accepted Accounting Principles (1.122)

Detailed Explanation:

Rationale for Correct Answer: A kickback scheme occurs when vendors make payments to employees of a purchasing organization in exchange for steering business their way. Here, Bob steered contracts to Oak Company and received a percentage of profits, a textbook kickback arrangement.

Analysis of Incorrect Options:

B. Illegal gratuity scheme – Involves rewards after a decision, without a prior agreement. Here, the agreement was prearranged.

C. Diversion scheme – Refers to diversion of assets, not procurement favoritism.

D. Economic extortion scheme – Involves coercion of the vendor; this was voluntary bribery.

Key Concept: Bribery and kickbacks as forms of corruption.

Detailed Explanation:

Rationale for Correct Answer: This is False . Placing restrictions in solicitation documents that limit competition is a solicitation phase corruption scheme , not “prebid solicitation.” The correct terminology is restrictive specifications or fraudulent solicitation practices .

Analysis of Incorrect Options:

A. True – Incorrect, as “prebid solicitation” is not the proper term.

Key Concept: Restrictive solicitation practices limit competition unfairly.

Detailed Explanation:

Rationale for Correct Answer: Skimming is defined as the theft of cash before it is recorded in the books . Because the stolen funds are never entered into the accounting system, this is often referred to as an “off-book” fraud. It is distinct from cash larceny , which occurs after cash has been recorded.

Analysis of Incorrect Options:

B. The addition of cash – Incorrect; skimming involves removal, not addition.

C. Removal after entry – This describes cash larceny, not skimming.

D. None of above – Incorrect since option A is correct.

Key Concept: Skimming schemes — off-book cash theft.

Detailed Explanation:

Rationale for Correct Answer: By definition, conflict of interest fraud arises when an employee has a hidden financial or ownership interest in another entity with which the employer does business. The fraudster’s loyalty is divided because their interest lies outside of their primary employer.

Analysis of Incorrect Options:

B. False – Incorrect because the essence of conflict of interest is precisely that the fraudster’s interest lies outside their company.

Key Concept: Conflict of Interest (divided loyalty).

Detailed Explanation:

Rationale for Correct Answer: The accounts receivable journal (also called the sales journal) records all sales transactions, whether on credit or cash. It provides a detailed subsidiary record of customer accounts and sales activity.

Analysis of Incorrect Options:

A. Disbursement journal – Records cash outflows, not sales.

C. Accounts payable journal – Records amounts owed to vendors, not sales.

D. General journal – Records miscellaneous entries not suited to specialized journals.

Key Concept: Special journals — sales activity recorded in the accounts receivable journal.

Detailed Explanation:

Rationale for Correct Answer: Skimming is the theft of incoming cash before it is recorded in the books . Since the payment is never recorded, no audit trail exists, making it an “off-book” scheme.

Analysis of Incorrect Options:

A – Incorrect; skimming can involve both sales and receivable payments.

C – Incorrect; skimming is off-book , not on-book.

D – Incorrect; skimming is typically harder to detect than larceny, since there is no record.

Key Concept: Skimming vs. larceny – off-book theft of cash receipts.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters often attempt to influence or bribe employees who have access to sealed bids . Access to sealed bids provides unfair knowledge of competitors’ pricing and terms, enabling collusion or bid manipulation.

Analysis of Incorrect Options:

A. Bid-splitting – A fraud scheme, not what vendors seek access to.

C. General purchasing – Too broad; not specifically tied to vendor fraud.

D. Tailor specifications – A corruption scheme, but not the specific target of vendor bribery.

Key Concept: Sealed bid access as a key target in procurement fraud.

Detailed Explanation:

Rationale for Correct Answer: Conflict of interest cases are difficult to detect because the transactions often appear legitimate on their face. However, they can be prevented more effectively through proactive controls such as disclosure requirements, vendor vetting, and employee training. The Fraud Examiners Manual (2020) emphasizes that prevention mechanisms are more effective than detection when it comes to conflicts of interest.

Analysis of Incorrect Options:

B. False – Incorrect because detection is challenging; prevention is comparatively easier.

Key Concept: Prevention vs. detection in Conflict of Interest schemes .

Detailed Explanation:

Rationale for Correct Answer: According to ACFE’s Report to the Nations and the Fraud Examiners Manual, tips are the most common method of detecting corruption cases. Employees, vendors, or customers often report suspicious activity via hotlines or whistleblowing mechanisms.

Analysis of Incorrect Options:

A. Internal audits – Helpful but less common as the initial detection method.

B. Internal controls – Preventive, not the primary detection source.

D. By accident – Can occur, but far less common than tips.

Key Concept: Tips/whistleblowing as the primary detection method for corruption.

Comprehensive and Detailed Explanation

Definition of Upcoding (ACFE Manual Reference)

The ACFE Manual identifies upcoding as a type of health care billing fraud in which the provider submits a claim for a more expensive or more complex service than what was actually provided.

Although the exact term “upcoding” appears within the health care fraud discussions, the broader category is part of Financial Transactions and Fraud Schemes concerning fraudulent billing practices . The manual describes fraud schemes in which the perpetrator:

Bills for services not provided ,

Bills for more expensive services than were actually delivered, or

Uses codes that misrepresent the level or nature of medical procedures.

Upcoding specifically involves:

Billing for a higher-cost procedure than what was actually performed, by using a code representing a more expensive service.

Why Option D Is Correct

Dr. Raul advised a patient with a small fracture to use crutches, but he submitted a claim using a code indicating that he placed a cast on the patient.

Actual service: Advice and crutches

Billed service: Application of a cast (more expensive procedure)

This is a textbook example of upcoding , as the provider is using a higher-cost CPT code to obtain greater reimbursement than the service warrants.

Why the Other Options Are Incorrect

Option A – Not Upcoding

Cindy receives a payment to undergo an unnecessary procedure , which is then billed fraudulently.

This is medically unnecessary services fraud , not upcoding.

Option B – Not Upcoding

Dr. Loomis uses three procedure codes instead of one .

This is an example of unbundling , which involves billing separate codes for procedures that should be billed as a single package.

Option C – Not Upcoding

Landon inflates the amount of a medical bill he wants reimbursed.

This is billing inflation or overstatement , but not misrepresentation via coding.

ACFE Manual Supporting Reference

The Manual’s section on fraudulent billing schemes discusses cases where perpetrators misrepresent medical procedures , including using false or inflated codes to obtain higher reimbursements.

Detailed Explanation:

Rationale for Correct Answer: One form of bid-rigging occurs when colluding vendors agree that one will submit a low bid and later withdraw it , allowing another conspirator to win the contract. This practice is sometimes referred to as “ complementary bidding ” or the withdrawal of low bids .

Analysis of Incorrect Options:

A. Bribery receipt – Refers to corrupt payments, not collusion.

B. Bid solicitation – The process of inviting bids, not collusion.

D. Contract acceptance – A legitimate procurement step, not fraud.

Key Concept: Bid-rigging through collusion — vendors withdrawing low bids to favor co-conspirators.

Detailed Explanation:

Rationale for Correct Answer: According to SAB 104 , revenue recognition requires persuasive evidence of an arrangement. This does not exist if there is no written contract, purchase order, or verbal agreement supporting the transaction.

Analysis of Incorrect Options:

A. Revenue and expenses don’t match – Violates matching principle, not persuasive evidence.

C. Timings not meet properly – Refers to delivery/performance, not evidence of arrangement.

D. Capitalized expenses and liabilities – Irrelevant to revenue recognition.

Key Concept: Revenue recognition requirement: Persuasive evidence of an arrangement.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters conceal inventory shrinkage through multiple methods, including unrecorded sales, false write-offs, or manipulating perpetual records. The ACFE manual notes that concealment is a common theme in inventory fraud. Hence, all of the above are valid.

Analysis of Incorrect Options:

A, B, C – Each is correct individually, but the most comprehensive answer is D.

Key Concept: Concealment methods for inventory theft.

Detailed Explanation:

Rationale for Correct Answer: Insider cyberfraud thrives in environments where monitoring is weak . If access logs are not reviewed , malicious activity can go undetected, enabling fraud.

Analysis of Incorrect Options:

B. Programs run during business day – Normal IT operations, not a fraud risk.

C. Restricted access – This is a preventive control, not a facilitator.

D. Separation of duties – Strong control, prevents insider fraud.

Key Concept: Conditions facilitating insider cyberfraud .

Why the correct answer is Human Intelligence

The ACFE Fraud Examiners Manual , in the section on fraud examination tools and intelligence gathering , discusses methods of obtaining information from individuals. One of the recognized methods is Human Intelligence (HUMINT) .

The Manual explains that human intelligence gathering involves:

Collecting information directly from people—often through conversation, elicitation, or interviews—sometimes while using a pretext to encourage the target to disclose information.

In this scenario:

Georgina poses as a customer (a pretext),

Contacts an employee of ERO Corp., and

Elicits sensitive information directly from that individual.

This aligns perfectly with the definition of human intelligence gathering —information obtained directly from human sources , often under false pretenses.

Why the other options are incorrect

B. Scavenging – Incorrect

The Manual describes scavenging as:

Obtaining information by searching for discarded documents or materials, such as in trash or recycling bins.

Georgina is not going through discarded materials; she is speaking directly with an employee.

C. Baiting – Incorrect

Baiting typically refers to:

Enticing someone with something of value to trick them into taking an action, often involving malware-infected media or fraudulent offers.

Georgina is not offering anything or luring the employee with incentives.

D. Open-source intelligence – Incorrect

Open-source intelligence (OSINT) refers to gathering information from:

Publicly available sources such as websites, publications, databases, or social media.

Georgina is not using public sources; she is actively eliciting confidential information from a person under false pretenses.

ACFE Manual References

The concepts used in this answer derive from the Fraud Examiners Manual (2020 International Edition), including:

Human intelligence and data collection techniques

Scavenging as an investigative method

Baiting schemes

Open-source intelligence descriptions

Detailed Explanation:

Rationale for Correct Answer: One of the most effective ways to protect proprietary information is educating employees about nondisclosure agreements (NDAs) at onboarding and again during exit. This ensures awareness of confidentiality obligations.

Analysis of Incorrect Options:

A. Changing locks/codes every 3–5 years – Reasonable security but insufficient for safeguarding proprietary information.

B. Classifying data by years of service – Not a sound security practice; access should be based on role and need-to-know.

D. Requiring notes/drafts – Increases risk of information leaks, not protection.

Key Concept: Proprietary information protection .

Detailed Explanation:

Rationale for Correct Answer: Fraudulent financial statements (or “fraudulent statement”) refer to the intentional misrepresentation of financial condition, typically through overstating revenues, understating expenses, inflating assets, or concealing liabilities. The intent is to mislead stakeholders such as investors, creditors, or regulators.

Analysis of Incorrect Options:

B. Corruption – Refers to abuses of influence and conflicts of interest, not misreporting financial information.

C. Asset misappropriations – Involve theft of assets, not misrepresentation of reports.

D. None of the above – Incorrect since option A is correct.

Key Concept: Financial Statement Fraud — misrepresentation of organizational performance and position.

Detailed Explanation:

Rationale for Correct Answer: The Fraud Examiners Manual (2020) highlights document reviews, audit tracing, financial analysis, and inside witnesses as the primary methods of proving corrupt payments. Secret infiltration is not a standard fraud examination technique; it is more aligned with law enforcement undercover operations.

Analysis of Incorrect Options:

A. Taxation inquiries – A valid method to confirm payment sources.

C. Inside witness – Valuable evidence in corruption cases.

D. Tracing payments – Fundamental audit step in proving illicit payments.

Key Concept: Proving corrupt payments — standard audit and investigative methods.

Detailed Explanation:

Rationale for Correct Answer: Corrupt payments are not always made directly in cash. According to the Fraud Examiners Manual (2020) , one common method is disguising them as loans on favorable terms , which provide value to the recipient while appearing legitimate. This is recognized as a form of bribery or illegal gratuity.

Analysis of Incorrect Options:

B. Credit cards – Corrupt payments can be made via many channels, including credit, so this is incorrect.

C. Selling property above market value – Payments are typically disguised by undervaluing sales to recipients, not overvaluing.

D. Promises of favorable treatment – Promises alone can constitute bribery; this statement is false.

Key Concept: Methods of making corrupt payments .

Detailed Explanation:

Rationale for Correct Answer: The “outside the accounting system” approach occurs when perpetrators simply fabricate financial statements without regard to actual accounting records. Fraudsters may create entirely false reports using external tools (typewriters, spreadsheets, word processors).

Analysis of Incorrect Options:

A. Organized accounting – Not a fraud classification.

B. Playing the accounting – Uses the real accounting system but manipulates entries.

C. Beating accounting – Refers to overriding controls but within the system.

D. Outside accounting system – Correct, as it involves entirely fabricated statements.

Key Concept: Outside-the-books fraud — fabricated financial reports not tied to accounting records.

The ACFE Fraud Examiners Manual addresses Nonconforming Goods or Services under Contract and Procurement Fraud . The Manual states that, to detect nonconforming schemes, the fraud examiner should examine contract specifications, contractor statements, invoices, supporting documents, the received product, and test and inspection results for discrepancies with contract specifications. It then specifically adds:

“Additionally, to detect nonconforming schemes, the fraud examiner should:

• Review correspondence and contract files for indications of noncompliance.

• Request assistance from outside technical personnel to conduct after-the-fact tests.”

This language matches Option B exactly, so it is the most appropriate detection technique.

Why the other options are incorrect

A. Interviewing complaining contractors and unsuccessful bidders about the presence of red flags

This is a detection technique the Manual associates with change order abuse , not nonconforming goods or services schemes.

C. Comparing the direct and indirect labor account totals from the prior year to the current year

This type of comparative cost analysis is more consistent with testing for cost mischarging or other accounting irregularities, not the primary detection methods for nonconforming goods/services. The Manual’s nonconforming-scheme detection guidance focuses on specifications, inspection results, product testing, and contract/correspondence review.

D. Determining if the costs of the contract have exceeded or are expected to exceed the value of the contract

That is not identified by the Manual as the most appropriate method for detecting nonconforming goods or services. Again, the Manual directs the examiner to look for noncompliance with specifications and supporting documentation.

References

ACFE Fraud Examiners Manual, 2020 International Edition

Contract and Procurement Fraud — Nonconforming Goods or Services

Detecting Nonconforming Goods or Services Schemes

Related contrast: Detecting Change Order Abuse

Detailed Explanation:

Rationale for Correct Answer: Technical security controls include software- and hardware-based measures such as application security, firewalls, and encryption . Application security protects against vulnerabilities in the programs employees use.

Analysis of Incorrect Options:

B. Human audits – Administrative control, not technical.

C. Penetration testing – A detective measure/test, not a control itself.

D. Data security – A broad goal, not a specific technical control.

Key Concept: Technical security controls for preventing cyberfraud.

Detailed Explanation:

Rationale for Correct Answer: When employees steal incoming checks and deposit them into interest-bearing accounts, they may be (1) converting the stolen checks , (2) temporarily concealing the fraud , and (3) executing a form of short-term skimming . All options apply, making D. All of the above correct.

Analysis of Incorrect Options: Each of A, B, and C alone captures part of the practice, but only D reflects the full scope.

Key Concept: Check theft and temporary placement in personal accounts as part of skimming concealment.

Detailed Explanation:

Rationale for Correct Answer: Per generally accepted accounting principles, changes in accounting principles must be disclosed in the financial statements to ensure comparability and transparency. The ACFE notes that disclosures are critical to prevent misleading users of financial statements.

Analysis of Incorrect Options:

A. Subsequent events – Material subsequent events must be disclosed; this statement is false.

B. Contingent losses – Only probable and reasonably estimable losses must be disclosed. If unlikely, no disclosure is required.

C. All information – Only material information requires disclosure.

Key Concept: Disclosure requirements in financial reporting .

Detailed Explanation:

Rationale for Correct Answer: Gross profit = Net sales – Cost of Goods Sold (COGS). This is the correct definition, as per standard accounting principles.

Analysis of Incorrect Options:

A. Gross revenue – Defined as total sales before deductions, not after.

B. Net profit – Net profit is after all expenses (operating, interest, taxes), not before.

D. Operating expenses – Appear after gross profit, not at the top.

Key Concept: Income statement structure and key definitions .

Detailed Explanation:

Rationale for Correct Answer: Prenumbering and controlling shipping documents is a strong preventive measure against inventory theft because it ensures all inventory leaving the warehouse is properly authorized and tracked.

Analysis of Incorrect Options:

A. Same person for requisition and receiving – Violates segregation of duties.

B. Purchasing supervisor counting inventory – Creates conflict; inventory should be counted by independent staff.

D. Same person for shipping and scrap – Increases fraud risk.

Key Concept: Inventory theft prevention — control over documentation.

Detailed Explanation:

Rationale for Correct Answer: Ransomware is malware that encrypts or locks an operating system and prevents access to data until a ransom is paid. This definition is correct.

Analysis of Incorrect Options:

A. Spyware – Monitors user activity, keystrokes, or data, not a startup instruction program.

B. Trojan horse – Appears legitimate but contains malicious code; adware is different.

C. Worm – Self-replicating program spreading across networks; not a keystroke logger.

Key Concept: Cyber fraud and malware types .

Detailed Explanation:

Rationale for Correct Answer: Social engineering involves manipulating or deceiving people into revealing confidential information or taking actions that aid the attacker (e.g., clicking malicious links, sharing credentials). It targets human weaknesses rather than technical vulnerabilities.

Analysis of Incorrect Options:

A. IP spoofing – Forging an IP address to disguise origin.

B. Electronic piggybacking – Unauthorized use of someone else’s access connection.

C. Packet sniffing – Monitoring data traffic across a network.

Key Concept: Cyberfraud techniques – social engineering.

Detailed Explanation:

Rationale for Correct Answer: A high percentage of coding outliers (e.g., using higher-paying diagnosis or procedure codes more often than peers) is a red flag of upcoding or fraudulent billing. This signals possible abuse of reimbursement systems.

Analysis of Incorrect Options:

A – Fewer claims would not suggest fraud.

C – Matching documentation is expected, not suspicious.

D – Low profits may indicate inefficiency, not fraud.

Key Concept: Health care fraud detection through data analytics and coding anomalies.

Detailed Explanation:

Rationale for Correct Answer: Key GAAP principles include Conservatism , Historical Cost , and Full Disclosure . Quality control is not a GAAP principle; rather, it is a concept from auditing standards related to ensuring audit quality.

Analysis of Incorrect Options:

A. Conservatism – GAAP principle requiring cautious reporting of uncertain outcomes.

B. Cost – Historical cost principle is central to GAAP.

C. Full disclosure – Requires all relevant information to be presented.

D. Quality control – Belongs to auditing, not GAAP.

Key Concept: GAAP principles — distinguishing accounting standards from auditing practices.

Detailed Explanation:

Rationale for Correct Answer: Skimming is difficult to detect because the stolen cash is never recorded (“off-book”). Therefore, it is often discovered by accident — such as customer complaints, discovery of missing deposits, or unexpected reconciliations — rather than through audits or routine controls.

Analysis of Incorrect Options:

A. Internal audits – Effective for many frauds but weak at uncovering skimming because records appear normal.

C. Internal controls – Preventive controls may deter but cannot detect unrecorded theft.

D. Occupational frauds – Too broad and not a detection method.

Key Concept: Detection of Skimming — most often accidental.

Detailed Explanation:

Rationale for Correct Answer: ACFE’s occupational fraud surveys consistently show that males are more often the primary perpetrators than females , accounting for approximately 62% of cases compared to 37% for females . This is attributed to higher representation of males in positions of authority and access. Therefore, C. 62 versus 37 is correct.

Key Concept: Demographics of Fraud Perpetrators — gender-based survey findings.

Detailed Explanation:

Rationale for Correct Answer: Employees authorized to grant discounts may exploit this by issuing false discounts . They pocket part of the customer’s payment while recording a reduced sale amount, making the books appear balanced.

Analysis of Incorrect Options:

B. Recording a discount on sale procedure – A legitimate process, not fraud.

C. Internal discount sales audits – A control, not a scheme.

D. None of the above – Incorrect since false discounts are a recognized method.

Key Concept: False discount schemes as a skimming method.

Detailed Explanation:

Rationale for Correct Answer: According to the ACFE Fraud Tree , corruption is divided into four classifications: bribery, illegal gratuities, economic extortion, and conflicts of interest . These cover the major ways employees misuse influence for personal gain.

Analysis of Incorrect Options:

B. Corruption… – Redundant; corruption is the main category, not a sub-classification.

C. Overbilling and bid-rigging – These are disbursement schemes, not corruption categories.

D. Corruption repeated – Incorrect for the same reason as option B.

Key Concept: Corruption classifications under the Fraud Tree.

Detailed Explanation:

Rationale for Correct Answer: W. Steve Albrecht’s Fraud Scale introduced the relationship between pressure, opportunity, and integrity. He and his colleagues identified 81 red flags or behavioral indicators of occupational fraud and abuse based on these three dimensions. Therefore, the correct answer is A. 81 .

Analysis of Incorrect Options:

B. 82 / C. 83 / D. 84 – Distractors; none match the number identified in the fraud scale research.

Key Concept: Fraud Scale — Red Flags of occupational fraud.

Rationale for Correct Answer: The price-level adjusted historical cost method adjusts the original purchase price of an asset for inflation, providing a more current value while still tied to historical cost principles. It addresses one of the limitations of strict historical cost accounting.

Key Concept: Inflation adjustments in asset valuation.

Detailed Explanation:

Rationale for Correct Answer: Trend analysis is one of the most effective ways to detect omitted credits. By analyzing patterns in revenue, expenses, or balances over time, discrepancies such as missing credits become apparent. Forensic examiners rely on comparative financial analysis to identify anomalies that suggest manipulation.

Analysis of Incorrect Options:

A. Forced Balance – Describes concealment, not detection.

C. Expense account – Accounts can be manipulated but are not detection methods.

D. None of all – Incorrect, since trend analysis is correct.

Key Concept: Analytical procedures (trend analysis) in fraud detection.

Detailed Explanation:

Rationale for Correct Answer: Data minimization —the practice of limiting the collection, storage, and retention of sensitive data to only what is necessary—reduces the potential harm in case of a breach. This is a widely recommended control for protecting proprietary information.

Analysis of Incorrect Options:

A – Monitoring competitors’ practices does not secure one’s own information.

C – Quiet rooms are not a standard security safeguard.

D – Restricting nonemployees is helpful, but overly broad and impractical as a primary recommendation.

Key Concept: Information security strategies to safeguard proprietary data.

Detailed Explanation:

Rationale for Correct Answer: The correct answer is A. Larceny . As defined in the Fraud Examiners Manual (2020 International Edition) , larceny is the unlawful taking of another’s property with intent to permanently deprive the owner of its use or possession. Essential elements include: (1) the wrongful taking or carrying away of property, (2) without the consent of the owner, and (3) with felonious intent (i.e., intent to steal). This aligns directly with the definition provided in the question.

Analysis of Incorrect Options (Distractors):

B. Abuse – Abuse typically refers to the improper use of authority or resources (e.g., excessive expense claims, misuse of assets), but it is not a legal term describing theft by taking.

C. Fiduciary – Fiduciary describes a relationship of trust or duty to act for another’s benefit, not the act of theft.

D. None of the above – Incorrect because “larceny” precisely matches the elements described.

Key Concept: The definition and elements of larceny , which is a foundational legal concept for distinguishing among asset misappropriation schemes such as larceny vs. skimming .

Detailed Explanation:

Rationale for Correct Answer: Skimming involves theft of cash before it is recorded in the books. Examining journal entries for false credits to inventory would detect inventory fraud, not skimming. Therefore, B is not useful for detecting skimming.

Analysis of Incorrect Options:

A – Confirming customer balances can reveal payments that were never posted because they were skimmed.

C – Physical counts may expose discrepancies caused by skimming disguised as inventory shortages.

D – Comparing register totals to actual cash can reveal missing amounts due to skimming.

Key Concept: Skimming detection focuses on reconciling recorded vs. unrecorded cash.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters may solicit bids from fictitious suppliers (phony vendors) to create the illusion of competition. This ensures that the favored vendor wins while maintaining the appearance of a legitimate competitive bidding process.

Analysis of Incorrect Options:

B. Solicit transactions from fictitious vendors – Incorrect phrasing; bids, not transactions, are solicited.

C. Solicit bid-splitting… – Bid-splitting is a different fraud scheme, not part of solicitation.

D. None of the above – Incorrect, since A is accurate.

Key Concept: Phony bid solicitation as a corruption tactic in procurement.

Detailed Explanation:

Rationale for Correct Answer: Past posting occurs when an insured reinstates or purchases insurance coverage after a loss has already occurred and then submits a false claim, backdating the loss to appear covered. Joe’s scheme fits this exactly.

Analysis of Incorrect Options:

A. Staged accident – Fraudulent accidents deliberately caused, not applicable here.

B. Inflated damages – Exaggerating actual losses, not retroactive coverage.

D. Vehicle repair – General claim fraud, but not the scheme in question.

Key Concept: Insurance fraud – past posting schemes.

Detailed Explanation:

Rationale for Correct Answer: A false balance occurs when incorrect totals are intentionally carried forward from the journal to the ledger or from the ledger to the financial statements. This is often used as a concealment technique in fraud to make the books appear balanced while hiding irregularities.

Analysis of Incorrect Options:

A. Forced Balance – Involves adding fictitious entries to force accounts into balance.

B. Out-of-balance – Results when entries don’t match, but not specifically from carried totals.

D. None of all – Incorrect since “false balance” is the precise term.

Key Concept: False balance entries as concealment techniques in fraudulent bookkeeping.