ACFE Investigation Exam (CFE-Investigation)

✅

Reasoning: Reviewing files on a live system prior to forensically sound seizure and imaging significantly risks altering evidence metadata (e.g., access times) and contaminating the scene. Minimizing interaction is paramount to maintaining evidentiary integrity. ❌ Why the other choices are incorrect:

• Option A is incorrect: Keeping an off computer off is crucial to preserve its state and prevent alteration of data, boot logs, or timestamps, making it an accurate best practice.
• Option C is incorrect: Documenting the system's setup with photographs or diagrams is a standard and vital step to accurately reconstruct the scene and configuration for analysis.
• Option D is incorrect: Searching for physical passwords near a computer is a common and often successful investigative technique to gain access to encrypted data or accounts, making it an accurate statement.

✅

Reasoning: An open question encourages a narrative response and cannot be answered with a simple "yes" or "no." Questions beginning with "Who," "What," "When," "Where," "Why," and "How" are classic open questions, inviting the subject to provide detailed information in their own words, like a specific date. ❌ Why the other choices are incorrect:

• Option A is incorrect: A leading question suggests the desired answer (e.g., "You were promoted last year, weren't you?"). Nathaniel's question does not suggest an answer.
• Option B is incorrect: A complex question combines multiple inquiries (e.g., "When were you promoted and what were your responsibilities?"). Nathaniel's question asks for one piece of information.
• Option C is incorrect: A closed question elicits a "yes/no" or a very specific, limited choice (e.g., "Were you promoted?"). While "When" seeks a specific fact, it requires the subject to articulate the answer, not just confirm.

✅

Reasoning: Fraud examination reports are high-stakes documents. They must be robust enough for potential media scrutiny, legally defensible against opposing counsel's challenges, and clear for investors and owners making critical decisions. Considering all these diverse stakeholders ensures the report meets various needs and stands up to intense examination. ❌ Why the other choices are incorrect:

• Option A is incorrect: While the media may eventually review the report, it is not the sole or primary audience to the exclusion of others. Focusing only on media might oversimplify or sensationalize findings.
• Option B is incorrect: Opposing legal counsel is a critical audience, but not the only one. Exclusively writing for them risks making the report overly legalistic and less accessible for other stakeholders like owners or management.
• Option C is incorrect: Investors and owners are crucial stakeholders who need clear information. However, solely focusing on them would neglect the legal defensibility needed for potential litigation or public scrutiny.

✅ **Credit card records can provide leads to help identify a subjects hidden assets **

Reasoning: Credit card statements reveal spending patterns and purchases. Large or unusual transactions, lifestyle expenditures inconsistent with declared income, or purchases of high-value items can indicate the existence of undeclared or hidden assets, providing crucial investigative leads. ❌ Why the other choices are incorrect:

• Option B is incorrect: Credit card records document spending, not the act of skimming funds (illegal data capture). While skimmed funds might be spent using a card, the records themselves do not directly demonstrate the skimming activity.
• Option C is incorrect: Credit card statements show that a payment was made, but they do not typically detail the specific originating source account or method of funds used to pay the bill. That information is found on bank statements or other financial records.
• Option D is incorrect: Credit card statements are financial transaction records. They do not provide direct insight into a subject's legal history or ongoing litigation; that information is found in court records or legal filings.

✅

Reasoning: Asking "How long have you been in this department?" is a neutral, factual, and non-threatening question. It allows the interviewer to observe the subject's normal verbal and non-verbal behavior, establishing a baseline without causing anxiety or defensiveness, which is crucial for later detecting deviations. ❌ Why the other choices are incorrect:

• Option A is incorrect: This question is specific to the investigation and could make the interviewee defensive, preventing a neutral baseline observation.
• Option B is incorrect: While general, inquiring about "ethics policies" can be perceived as slightly accusatory in an investigative context, potentially altering the subject's natural demeanor.
• Option C is incorrect: This is a direct accusation of misconduct, entirely inappropriate for baseline establishment. It would immediately put the interviewee on high alert or make them hostile.