CFFE Module III
Integrated Case Study flashcards
Read the question, say the answer to yourself, then turn the card to check. The first 10 of 47 cards are free; the rest come with the subject.
Card 1 of 47
Jump to a card
Complete Flashcard Reference
Review every card in this deck. Open any card to reveal its answer. The first 10 are free; the other 37 come with the subject.
What four connected steps does a case-study answer on prevention and detection work through?
1. Diagnose the risk exposure. 2. Assess the existing control environment. 3. Identify the prevention gaps. 4. Recommend detective measures for the risks prevention cannot fully eliminate.
In what order does a well-structured response to discovered or alleged fraud run?
1. Establish predication. 2. Trigger the fraud response plan. 3. Preserve evidence immediately. 4. Select the investigative methods. 5. Determine the legal route or routes. 6. Report the findings. 7. Remediate the underlying control gap.
Which fraud triangle element does a mandatory second sign-off on loan approvals reduce, and how?
Opportunity. A single individual can no longer unilaterally convert intent into an approved, fraudulent loan, because a second person's judgement now stands between the request and the approval.
What does establishing predication mean, and when is it done?
Confirming there is a reasonable basis to act. It comes first, before a formal investigation is launched.
How should a case answer distinguish prevention from detection?
Prevention stops fraud before it happens; detection catches it after. Keep the two distinct, explicitly, in the structure of the answer.
Why might an organisation pursue the civil, criminal and regulatory routes in parallel rather than choose one?
They serve different purposes: civil recovers the actual loss, criminal holds the individual accountable, and regulatory meets a mandatory external notification obligation. They are not mutually exclusive, and pursuing only one may leave the organisation's other interests or obligations unaddressed.
Why is one person holding both system-administrator and database-administrator access a red flag, and which fraud does it point toward?
It is a segregation-of-duties failure: one person can both alter the underlying data and control the system's own record of that alteration, with no independent check. It points primarily toward fraudulent financial statements, or their concealment.
Why must evidence be preserved immediately in a fraud response?
Before it can be altered, destroyed, or simply lost to routine business activity. System logs in particular can be irretrievably changed or lost if the suspect keeps routine access.
What six requirements does the integrated case run through, in order?
1. What went wrong and why. 2. What happened. 3. What to do now. 4. What the law says. 5. What will stand up. 6. What to change. Each draws on a different paper of the diploma and needs its own artefact.
Why is remediation placed last in the response sequence?
Only once the investigation has established what happened, how the scheme worked and which control gap allowed it does the organisation know what needs fixing. Remediating earlier risks fixing the wrong thing, or a symptom rather than the root cause.
Which two frameworks are applied to diagnose an organisation's fraud risk exposure in a case?
This answer comes with Integrated Case Study. Buy the subject
When assessing an organisation's existing control environment, what is the key question?
This answer comes with Integrated Case Study. Buy the subject
How are prevention gaps identified in a case answer?
This answer comes with Integrated Case Study. Buy the subject
When should a case answer recommend detective measures, and which ones does the guide name?
This answer comes with Integrated Case Study. Buy the subject
Why does a generic list of controls score lower than the same controls in a strong answer?
This answer comes with Integrated Case Study. Buy the subject
What connection should every prevention or detection recommendation state explicitly?
This answer comes with Integrated Case Study. Buy the subject
Where a fraud risk assessment is called for, how should the answer show the effect of the recommended controls?
This answer comes with Integrated Case Study. Buy the subject
How is the prevention and detection topic best revised?
This answer comes with Integrated Case Study. Buy the subject
A SACCO branch manager can approve loans up to KES 2,000,000 with no second sign-off. Which fraud triangle element is clearly elevated, and what can the facts not show?
This answer comes with Integrated Case Study. Buy the subject
What does three years without a surprise audit tell you about a SACCO's control environment?
This answer comes with Integrated Case Study. Buy the subject
How do genuinely unannounced surprise audits work on the fraud triangle?
This answer comes with Integrated Case Study. Buy the subject
Tumaini Sacco raised the mobile loan limit a credit officer may approve alone from KES 150,000 to KES 500,000, with no second sign-off. Which fraud does this red flag point toward?
This answer comes with Integrated Case Study. Buy the subject
Loan write-offs recorded in November were reversed in December, three days before the year-end statements were finalised, with no board minute. What does this point toward?
This answer comes with Integrated Case Study. Buy the subject
How does the fraud triangle apply to Officer X's suspected scheme at Tumaini Sacco's Eastleigh branch?
This answer comes with Integrated Case Study. Buy the subject
Classify Tumaini Sacco's three control weaknesses as missing preventive or missing detective controls.
This answer comes with Integrated Case Study. Buy the subject
Which two prevention measures close Tumaini Sacco's preventive weaknesses?
This answer comes with Integrated Case Study. Buy the subject
Which two detective measures does the guide recommend for Tumaini Sacco?
This answer comes with Integrated Case Study. Buy the subject
What must triggering the fraud response plan achieve?
This answer comes with Integrated Case Study. Buy the subject
How are the investigative methods chosen, and what are the options?
This answer comes with Integrated Case Study. Buy the subject
What principle governs reporting the findings of a fraud investigation?
This answer comes with Integrated Case Study. Buy the subject
What does the internal response to fraud cover?
This answer comes with Integrated Case Study. Buy the subject
What is the civil response to fraud?
This answer comes with Integrated Case Study. Buy the subject
When is a criminal response appropriate?
This answer comes with Integrated Case Study. Buy the subject
What is the regulatory response, and when is it required?
This answer comes with Integrated Case Study. Buy the subject
On what are response case studies frequently scored, and what must an answer never recommend too early?
This answer comes with Integrated Case Study. Buy the subject
What is the risk of confronting a suspect directly to 'clear the air' before an investigation?
This answer comes with Integrated Case Study. Buy the subject
What are Tumaini Sacco's first three actions once both matters are confirmed, in order?
This answer comes with Integrated Case Study. Buy the subject
Officer X is a nephew of a sitting board Credit Committee member. How should Tumaini Sacco handle the conflict?
This answer comes with Integrated Case Study. Buy the subject
Which response routes fit Officer X's ghost-loan scheme of KES 6.1 million?
This answer comes with Integrated Case Study. Buy the subject
Which response routes fit the Head of ICT's direct editing of ledger entries?
This answer comes with Integrated Case Study. Buy the subject
What should the report of findings to an organisation's board contain?
This answer comes with Integrated Case Study. Buy the subject
What should the report of findings to SASRA focus on?
This answer comes with Integrated Case Study. Buy the subject
What should the report of findings to law enforcement focus on?
This answer comes with Integrated Case Study. Buy the subject
How should the integrated case be read before writing?
This answer comes with Integrated Case Study. Buy the subject
Which links between requirements earn the integration marks?
This answer comes with Integrated Case Study. Buy the subject
What form should the integrated case answer take?
This answer comes with Integrated Case Study. Buy the subject
What must a report of findings never do, and what tone should it take?
This answer comes with Integrated Case Study. Buy the subject
How to revise with these cards
- Answer out loud or on paper before you turn the card: recalling is what fixes it.
- Go through the deck in short sessions of ten to fifteen minutes, every day.
- Shuffle once you know the order, so you are not answering from memory of the sequence.
- When a card catches you out, read the chapter it links to, then try the topic in a past paper.