CFFE Module II

Planning and Conducting Formal Investigations flashcards

Read the question, say the answer to yourself, then turn the card to check. The first 10 of 48 cards are free; the rest come with the subject.

Card 1 of 48

Jump to a card

Complete Flashcard Reference

Review every card in this deck. Open any card to reveal its answer. The first 10 are free; the other 38 come with the subject.

What is predication, and why must it exist before an investigation opens?

A reasonable basis to believe fraud has occurred or will occur. It needs a reasonable basis to suspect, not proof. Investigating without any predication exposes the organisation to claims of harassment or defamation, and wastes effort on an unfounded suspicion.

What are the five phases of digital forensics, in order?

1. Identification: what digital evidence exists and where. 2. Preservation: securing it against alteration, typically by forensic imaging. 3. Collection: acquiring it with forensically sound tools and methods. 4. Analysis: examining it for relevant facts. 5. Presentation: reporting the findings clearly for use in proceedings.

How is unexplained income worked out under the net worth method?

Unexplained income = (ending net worth - beginning net worth) + personal living expenses - known legitimate income. Net worth = total assets - total liabilities, at the start and end of the period. Living expenses are spending that did not itself add to net worth, such as rent and food.

What are the seven sections of a standard fraud investigation report?

Executive summary; background and predication; scope and methodology; findings, organised by issue or scheme; conclusions; recommendations; supporting exhibits and appendices.

How does a suspect interview differ from an ordinary witness interview?

It uses the same interviewing theory but with heightened procedural care: the suspect's rights are respected and any confession must be voluntary. An involuntary or improperly obtained confession can be excluded from evidence and can undermine the whole case.

What is the difference between an on-book and an off-book fraud?

On-book: recorded in the accounts and then manipulated, for example financial statement fraud. Off-book: never recorded at all, for example skimming.

When is the direct method of tracing used, and when the indirect methods?

Direct: when full records are available, tracing specific identifiable funds through a documented chain of transactions. Precise and evidentially strong. Indirect (net worth, expenditure): when direct records are missing or incomplete, inferring illicit gain circumstantially from unexplained wealth or spending.

What is a fraud response plan, and when is it prepared?

A plan prepared before any specific allegation arises, setting out who is notified, who leads the investigation, how evidence is preserved, and when law enforcement or regulators are engaged. It means a real allegation is met with a rehearsed process rather than an improvised one.

What does digital evidence include, and which two properties shape how it is handled?

Files, metadata, logs, communications and system artefacts. It is fragile (easily altered, even by simply opening a file) and voluminous, which is why it is handled with forensically sound practices.

How does a fraud investigation engagement letter differ from an advisory letter?

Engagement letter: issued at the outset, setting out scope of work, terms, fees and reporting lines, protecting both investigator and client. Advisory letter: issued during the investigation to communicate preliminary findings, risks or recommendations where urgent action, such as suspending an employee or notifying a regulator, cannot wait for the final report.

What are the objectives of a fraud or corruption investigation?