Free CFE Exam Flashcards

Recording revenue before it is earned or before collection is reasonably assured (channel stuffing, bill-and-hold, round-tripping) inflates current-period income and shifts the misstatement into future periods when the deferred figures reverse.

Seller bills the customer but holds the product, recognizing revenue before delivery. Legitimate only with a fixed delivery date and a substantive buyer request; absent those, it overstates current-period revenue.

Shipping excess inventory to distributors near period-end so the seller can book the sales now. The sales reverse through returns or allowances next period, creating a cookie-jar reserve that distorts both periods.

Inflating the quantity or value of inventory understates COGS and overstates current assets and equity. Common signals include rising inventory balances that diverge from peer turnover ratios and unexplained gross-margin improvements.

Omitting or under-accruing payables, warranties, or contingencies understates expenses and overstates net income and equity. Subsequent-events testing and searches for unrecorded liabilities are the primary auditor detection techniques.

Cash is stolen before it is recorded in the books, so it leaves no audit trail on the company's records. Common at points of cash receipt (sales, receivables, refunds) and usually detected through lifestyle analysis or ratio anomalies rather than ledger review.

Cash is stolen after it is recorded but before deposit, so the books show the receipt but the deposit is short. The gap between recorded receipts and bank deposits is the detection signature, unlike skimming which is off-books.

A fraudulent disbursement created through the company's own billing system - shell company invoices, personal purchases submitted as business expenses, or inflated invoices from accomplice vendors. It is on-books and is typically caught by vendor master review, duplicate-payment analysis, or comparison of delivery addresses to employee addresses.

Three main types: ghost employees (fictitious workers on the payroll), falsified hours or overtime, and inflated commission or rate. Timecard approvals, headcount reconciliation to HR records, and duplicate direct-deposit account detection are the key controls.

Forged maker signatures, altered payee or amount, or checks written to shell vendors the fraudster controls. Positive pay, dual signatures above thresholds, secure check stock, and voided-check reconciliation are core deterrents.

Bribery is paying to influence an official decision before it is made; an illegal gratuity is paying afterward as a reward. Both are crimes, but bribery requires a quid pro quo intent, while gratuity can be charged without proving an explicit exchange existed at the time of the act.

A vendor pays a buyer a portion of the inflated invoice price back as a secret commission. The buyer steers business or overpays, the company overpays for goods or services, and the parties split the excess. Often detected through vendor pricing benchmarking or unexplained buyer lifestyle changes.

An employee has an undisclosed financial or personal interest that could improperly influence their business decisions, such as approving invoices from a vendor they own. Not always illegal on its own, but becomes fraud when concealed and used to divert business value.

The flip side of bribery - instead of offering payment to influence a decision, the person in power demands payment as a condition of acting or not acting. The coerced party pays under duress; the wrongdoer is the one demanding, not the one offering.

Bribery is generally the more serious offense because it corrupts the decision itself; a gratuity rewards past conduct. Prosecutors charge gratuity when they cannot prove an explicit quid pro quo agreement existed at the time of the act - so the distinction changes the available charge, not just the label.

First stage of money laundering where illicit cash enters the legitimate financial system through deposits, currency exchanges, or asset purchases. Highest-risk stage for the launderer because large cash movements trigger Bank Secrecy Act reporting.

Second stage where funds are moved through multiple accounts, jurisdictions, and instruments to break the audit trail and obscure origin. Wire transfers, shell companies, and trade-based layering are common; the goal is distance between the crime and the money.

Final stage where laundered funds re-enter the economy as apparently legitimate wealth - real estate, business investment, or luxury purchases. Funds appear clean and are hard to distinguish from lawful income, making this stage the hardest to detect.

Breaking large cash deposits into amounts below the $10,000 Currency Transaction Report threshold to evade BSA reporting. It is a federal crime independent of the underlying offense, and the pattern of just-under-threshold deposits is itself a red flag.

Using trade transactions - over- or under-invoicing, phantom shipments, or inflated quality descriptions - to move value across borders without cash. The paper trail looks like legitimate commerce, so it is favored for moving large sums and is hard to detect without customs and invoice reconciliation.

A material misrepresentation made by someone who knows it is false, with intent to deceive a victim who reasonably relies on it and suffers damages. All five elements must be proven; absence of reliance or materiality defeats the claim even if a lie occurred.

Both require a scheme to defraud plus use of a jurisdictional hook - the mails (18 USC 1341) or interstate wire communications (18 USC 1343). Wire fraud is the more common modern charging vehicle because nearly any electronic communication triggers it.

Requires management to assess and report on the effectiveness of internal control over financial reporting, with external auditor attestation. It links internal control failures directly to executive liability and shifted fraud-prevention responsibility upward to senior management.

Anti-bribery provisions prohibit payments to foreign officials to obtain or retain business. Books-and-records provisions separately require accurate recording of any payments, exposing disguised bribes as accounting violations even when the bribery charge fails.

Originally targeting organized crime, RICO reaches a pattern of racketeering activity through an enterprise; civil RICO also allows treble damages. Mail fraud, wire fraud, bribery, money laundering, and obstruction can all serve as predicate acts.

Hearsay is an out-of-court statement offered for the truth of the matter asserted; generally inadmissible because the speaker cannot be cross-examined. Exceptions (business records, excited utterance, present-sense impression) admit statements where circumstantial reliability substitutes for cross-examination.

Records made in the regular course of business, at or near the time of the event, by a person with knowledge, are admissible despite being hearsay. Loss of trustworthiness - such as documents prepared in anticipation of litigation - removes the exception.

Attorney-client privilege protects confidential communications for legal advice; work product protects materials prepared in anticipation of litigation. Both can be waived by voluntary disclosure to third parties and cover the communications, not the underlying facts.

The unbroken documented trail showing who handled evidence from collection to courtroom. Gaps create admissibility challenges because they raise doubts about authenticity, tampering, or substitution - and forensic digital evidence is especially sensitive to chain breaks.

Relevant evidence makes a fact of consequence more or less probable; materiality asks whether that fact actually matters to the case. Evidence can be relevant but immaterial (collateral), and immaterial evidence is excluded even if authentic and properly obtained.

A forensic technique comparing a subject's known income to accumulated assets and liabilities over time. Unexplained net-worth growth above known income implies concealed income and is a classic method for fraud and tax-evasion cases.

Estimates unreported income by analyzing total bank deposits against known income sources. Excess deposits not attributable to documented income are presumed to be hidden income, used by IRS and fraud investigators when direct tracing of transactions is impossible.

Physical, electronic, and covert observation each have distinct legal and evidentiary consequences - physical is generally broader under employer policies, electronic (audio/video) carries consent requirements, and covert operations risk privacy-law challenges. The right type depends on what evidence the investigation needs to preserve.

Alterations, missing pages, sequence breaks, toner or ink inconsistencies, and backdated timestamps are physical and metadata red flags. Originals should be preserved in native form; working copies are used for analysis to avoid spoliation claims.

Acquire a bit-for-bit image of the device before examining it, hash the image to prove integrity, and work only on the copy. This sequence preserves the original and supports admissibility under the chain-of-custody and evidence-authentication requirements.

An interview is non-accusatory fact-finding - open-ended questions to gather information. Interrogation is accusatory and admission-seeking, used after investigation has established culpability and aimed at obtaining a written confession. Confusing them risks coerced statements and lost admissibility.

A structured interrogation method that begins with direct confrontation, develops a theme justifying the act, handles denials, and moves the subject toward an admission. Critics cite false-confession risk, so it should follow investigation - not be used as the investigation.

Observing verbal and non-verbal cues (posture, hesitation, qualifying language, denials) to assess truthfulness. Indicators are probabilistic, not conclusive - they guide follow-up questions but should never be the sole basis for a conclusion.

Confronting a subject already shown by evidence to be culpable, with documents in hand, in private, starting with a behavior-provoking statement rather than an accusation. The goal is a written, signed admission; Miranda applies if the subject is in custody.

Custody plus interrogation triggers the warning requirement - voluntary statements made outside custody or spontaneous utterances do not. A fraud examiner working for a private employer is generally not a state actor and is not subject to Miranda, but law-enforcement partners always are.

Five components - control environment, risk assessment, control activities, information and communication, and monitoring. Each component must operate and be evaluated together; a weakness in one undermines the effectiveness of the entire system.

Cressey's three conditions for fraud - pressure (incentive or need), opportunity (control gap), and rationalization (self-justification). Removing any one side reduces fraud risk; opportunity is the side an organization can most directly control through internal controls.

Adds capability to the Fraud Triangle - the personal traits and skills needed to recognize and exploit the opportunity. It explains why two people facing identical pressure and opportunity commit fraud at different rates.

A confidential reporting channel for suspected misconduct, required for public companies under SOX Section 301. Tips are consistently the most common fraud detection method in ACFE Report to the Nations data - quality comes from anonymity and anti-retaliation protection, not just having the line.

Independent directors oversee financial reporting, internal controls, and external auditor relationships. SOX makes them directly responsible for whistleblower procedures and external-auditor independence - they are the board's primary anti-fraud lever.

The side most controllable by management - weak segregation of duties, override authority, or absent monitoring. Reducing opportunity does not depend on changing people; it depends on changing the system they operate in.

Financial hardship, gambling, addiction, or unreasonable performance targets driving the fraudster to act. Pressure can be real or perceived and is usually invisible to the employer, so it is the least actionable as a control lever.

Mental justification (borrowing funds, underpaid for the work, everyone does it) that lets the fraudster reconcile the act with their self-image. Tone at the top and clear ethics messaging target rationalization by making excuses harder to sustain.

Leadership's visible commitment to ethics and controls - what leaders do, not what they say. Weak tone at the top correlates with higher fraud incidence and weakens every other control because employees take cues from leadership behavior.

Identifying fraud schemes the organization is exposed to, their likelihood, and impact - then mapping controls to mitigate them. Done periodically and after major changes; skipping it leaves controls targeting the wrong risks, which is functionally equivalent to having none.