CFE-Fraud-Schemes-and-Financial-Crimes Questions and Answers

Detailed Explanation:

Rationale for Correct Answer: The Asset Turnover Ratio measures how efficiently a company uses its assets to generate revenue. It is calculated as Net Sales ÷ Average Total Assets . Higher ratios indicate better efficiency.

Analysis of Incorrect Options:

A. Quick ratio – Liquidity ratio, not asset efficiency.

B. Receivable turnover ratio – Measures efficiency in collecting receivables, not overall asset use.

C. Debt-to-equity ratio – Capital structure metric, not efficiency.

Key Concept: Financial ratio analysis — asset utilization efficiency .

Detailed Explanation:

Rationale for Correct Answer: Simply holding two jobs without disclosure is not inherently a conflict of interest unless the roles compete, overlap, or present divided loyalties. The other options all describe undisclosed financial or relational interests that conflict with the employer’s best interest.

Analysis of Incorrect Options:

A. Harriet’s stock ownership – Direct financial conflict.

C. Jennifer’s board positions – Competing loyalties between competitors.

D. Ernest hiring his brother – Nepotism without disclosure is a conflict.

Key Concept: Conflict of interest schemes in corruption.

Detailed Explanation:

Rationale for Correct Answer: Accrual basis accounting requires revenues and related expenses to be recorded in the same accounting period. This is known as the matching principle , ensuring accurate measurement of income.

Analysis of Incorrect Options:

A. Equity – Not relevant to matching expenses.

C. Expense – A category of cost, not a principle.

D. Financial record – Too general.

Key Concept: Accrual Accounting & Matching Principle .

The correct answer is B. A Ponzi scheme is a fraudulent investment arrangement in which funds from new investors are used to make payments to earlier investors. The payments create an appearance that the investment is legitimate and profitable, even though little or no genuine business activity or investment return exists. This artificial success helps the promoter attract more investors and delay detection. Option A describes a characteristic more closely associated with pyramid schemes, where compensation depends heavily on recruiting participants. Option C is incomplete because Ponzi schemes usually promise high returns with low or no stated risk, not openly high-risk investments. Option D also reflects pyramid-style recruitment structures rather than the defining feature of a Ponzi scheme.

================

Shirley has most likely been victimized by a romance scheme. In romance, sweetheart, or friendship scams, the fraudster builds an emotional relationship with the victim, often through social networking or online communication, and then requests money under a sympathetic pretext. Simon befriends Shirley, creates expectations of a future meeting, claims financial hardship, receives $10,000, and then disappears. That pattern is typical of a romance scam. A grandparent scheme usually involves impersonating a grandchild or relative in distress. A bait-and-switch scheme involves advertising one product or service and substituting another. A vacation scheme would focus on fraudulent travel offers, not a fabricated romantic relationship used to obtain money. The ACFE material identifies romance and friendship sc hemes as consumer fraud schemes.

================

Detailed Explanation:

Rationale for Correct Answer: By double-entry accounting rules, every accounting entry affects at least two accounts (debit and credit). Fraudulent entries must also follow this rule, meaning manipulation will show up in at least two categories on the financial statements.

Analysis of Incorrect Options:

A. One – Impossible in double-entry accounting.

C. More than two – Possible, but not always; the minimum is two.

D. None of above – Incorrect since “at least two” is correct.

Key Concept: Double-entry accounting ensures at least two accounts are affected in every transaction, including fraudulent ones.

Detailed Explanation:

Rationale for Correct Answer: This is personal purchases with company funds , where an employee uses company resources to acquire goods or services for personal benefit. Baker used ABC’s funds to buy supplies for home improvements.

Analysis of Incorrect Options:

A. Pay and return scheme – Involves overpaying a vendor and pocketing the refund.

C. Pass-through scheme – Involves using a controlled company to bill the employer at inflated prices.

D. Theft of inventory – Involves stealing company stock, not purchasing items for personal use.

Key Concept: Fraudulent disbursement – billing fraud through unauthorized personal purchases.

Detailed Explanation:

Rationale for Correct Answer: Revenue recognition requires that delivery has occurred or services have been rendered . If installation, testing, and customer acceptance have not occurred (A), or if a written order exists but with a right of return (B), delivery is not considered complete. Both scenarios prevent proper revenue recognition. Hence, the correct answer is C. Both A & B .

Analysis of Incorrect Options:

A – Correct condition, but incomplete.

B – Correct condition, but incomplete.

D. Neither A nor B – Incorrect, as both conditions do prevent recognition.

Key Concept: Revenue recognition fraud risks — recognizing revenue prematurely.

The correct answer is C. Change order abuse occurs after a contract has been awarded, when a contractor improperly increases the price, expands the work, or modifies contract terms through change orders. A corrupt contractor might submit a low bid to win the award and later recover profits through unnecessary or inflated change orders. This defeats the benefit of competitive bidding because the procuring entity no longer receives the price or terms that justified the original award. Option A is incorrect because the scheme usually increases, not decreases, the amount paid. Option B is too narrow because change order abuse can occur in competitive contracts. Option D is incorrect because the scheme often involves collusion between contractor and procurement personnel, not necessarily several contractors.

================

Detailed Explanation:

Rationale for Correct Answer: Fraudsters often attempt to influence or bribe employees who have access to sealed bids . Access to sealed bids provides unfair knowledge of competitors’ pricing and terms, enabling collusion or bid manipulation.

Analysis of Incorrect Options:

A. Bid-splitting – A fraud scheme, not what vendors seek access to.

C. General purchasing – Too broad; not specifically tied to vendor fraud.

D. Tailor specifications – A corruption scheme, but not the specific target of vendor bribery.

Key Concept: Sealed bid access as a key target in procurement fraud.

Detailed Explanation:

Rationale for Correct Answer: Fraudulent bid solicitation practices include issuing requests for proposals or bid documents that contain false statements or misleading conditions to favor a particular vendor.

Analysis of Incorrect Options:

B. Employment discussions – A conflict of interest, not bid solicitation fraud.

C. Withdraw low bids – A submission phase scheme.

D. Falsify bid log – A separate manipulation method, not solicitation criterion.

Key Concept: Fraudulent bid solicitation — using false or misleading statements to limit competition.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters conceal inventory shrinkage through multiple methods, including unrecorded sales, false write-offs, or manipulating perpetual records. The ACFE manual notes that concealment is a common theme in inventory fraud. Hence, all of the above are valid.

Analysis of Incorrect Options:

A, B, C – Each is correct individually, but the most comprehensive answer is D.

Key Concept: Concealment methods for inventory theft.

Submitting token bids is a common collusive procurement fraud method known as complementary bidding, also called protective, shadow, or cover bidding. In this scheme, competing contractors submit bids that are not serious attempts to win the contract. These bids might be intentionally too high, technically unacceptable, or structured with unfavorable terms so the preferred contractor wins while the process still appears competitive. This undermines the purpose of competitive bidding, which is to place bidders on equal terms and obtain the best price and conditions. Option B is inconsistent with market division, where conspirators divide markets rather than seek all areas. Option C refers more generally to shell or fictitious bidding, and option D is a billing fraud issue, not the common collusive bidding method described here.

================

Detailed Explanation:

Rationale for Correct Answer: Best practice is to minimize collection of sensitive data such as government identification numbers, only obtaining them when legally required. This reduces the risk of identity theft exposure in case of a breach.

Analysis of Incorrect Options:

A. Use government IDs as employee IDs – Increases risk of exposure, not prevention.

B. Audit information practices only when required – Insufficient; audits should be regular and proactive.

C. Use encryption only for external transfers – Encryption should always be applied, not selectively.

Key Concept: Identity theft prevention for businesses .

Detailed Explanation:

Rationale for Correct Answer: The conservatism principle in accounting means that financial statements should not overstate assets or income and should anticipate possible losses. Thus, the amounts shown should be at least as much as reflected, if not more. This ensures users are not misled by overly optimistic figures.

Analysis of Incorrect Options:

A. Fraudulent statement – Involves intentional misrepresentation, not a principle of accounting.

B. Misappropriations – Theft of assets, unrelated to valuation principles.

D. Matching – Refers to aligning expenses with related revenues, not conservatism.

Key Concept: Conservatism principle — caution in financial reporting.

Detailed Explanation:

Rationale for Correct Answer: Comparing register tape totals to the actual cash on hand is a classic reconciliation test used to detect employee theft . Discrepancies suggest cash has been skimmed or stolen after recording.

Analysis of Incorrect Options:

B. Recorded sales – Register tapes already show recorded sales; comparison is for theft detection.

C. Internal audits – A process, not the purpose of the comparison.

D. Occupational frauds – Too broad a term.

Key Concept: Cash Reconciliation as a control to detect employee theft.

Detailed Explanation:

Rationale for Correct Answer: Employees authorized to grant discounts may exploit this by issuing false discounts . They pocket part of the customer’s payment while recording a reduced sale amount, making the books appear balanced.

Analysis of Incorrect Options:

B. Recording a discount on sale procedure – A legitimate process, not fraud.

C. Internal discount sales audits – A control, not a scheme.

D. None of the above – Incorrect since false discounts are a recognized method.

Key Concept: False discount schemes as a skimming method.

Detailed Explanation:

Rationale for Correct Answer: The correct answer is A. Larceny . As defined in the Fraud Examiners Manual (2020 International Edition) , larceny is the unlawful taking of another’s property with intent to permanently deprive the owner of its use or possession. Essential elements include: (1) the wrongful taking or carrying away of property, (2) without the consent of the owner, and (3) with felonious intent (i.e., intent to steal). This aligns directly with the definition provided in the question.

Analysis of Incorrect Options (Distractors):

B. Abuse – Abuse typically refers to the improper use of authority or resources (e.g., excessive expense claims, misuse of assets), but it is not a legal term describing theft by taking.

C. Fiduciary – Fiduciary describes a relationship of trust or duty to act for another’s benefit, not the act of theft.

D. None of the above – Incorrect because “larceny” precisely matches the elements described.

Key Concept: The definition and elements of larceny , which is a foundational legal concept for distinguishing among asset misappropriation schemes such as larceny vs. skimming .

Detailed Explanation:

Rationale for Correct Answer: New account fraud occurs when fraudsters open accounts with false or stolen identities to exploit financial institutions before controls detect suspicious activity. Mobile deposits are particularly vulnerable because criminals can use counterfeit or altered images to deposit fraudulent checks quickly. This aligns with the Fraud Examiners Manual (2020) discussion of high-risk delivery channels for new account fraud.

Analysis of Incorrect Options:

A. Established accounts – Incorrect; fraud risk is higher in new accounts due to limited history and weaker controls.

C. Six months definition – Not an ACFE standard; there is no fixed six-month definition.

D. ATMs rarely targeted – Incorrect; ATMs are frequently exploited in new account fraud schemes.

Key Concept: New account fraud in identity theft and corruption-related schemes.

The correct answer is B. Register disbursement schemes usually involve false refunds or false voids that cause cash to be removed from the register while the records appear to justify the disbursement. An unusually high number of refunds on the register log is a red flag because it might indicate that employees are creating fictitious refund transactions to conceal cash theft. Option A is not suspicious by itself because no gaps in transaction numbers suggests record continuity. Option C is less suspicious because supervisory approval exists, although approvals should still be reviewed. Option D is generally a positive control because supporting documents should exist for voided transactions. The ACFE materials identify refund and void activity as key areas for detecting register disbursement schemes.

================

Detailed Explanation:

Rationale for Correct Answer: According to the Fraud Examiners Manual (2020 International Edition) , offenders can be categorized into types. Absconders are individuals who commit fraud and immediately flee with the proceeds (“take the money and run”). They differ from long-term violators who maintain their frauds for extended periods while concealing them. Thus, the correct answer is A. Absconders .

Analysis of Incorrect Options:

B. Long-term violators – These offenders commit frauds over a long period and often maintain their positions of trust while continuing the scheme.

C. Offender types – Too vague; not a specific classification.

D. None of the above – Incorrect, since “Absconders” directly matches.

Key Concept: Offender Typologies — distinguishing between absconders and long-term violators in occupational fraud.

The correct answer is C. A suitability violation occurs when a broker-dealer recommends an investment or investment strategy without having a reasonable basis to believe it is suitable for the client. Suitability requires the broker-dealer to understand the customer’s financial profile, investment objectives, risk tolerance, liquidity needs, time horizon, and related circumstances before giving advice. Advising a client on a “promising” investment without first discussing the customer’s investment strategy fails this professional duty. Option A is not necessarily improper if the investment aligns with the client’s objectives and risk appetite. Option B reflects appropriate caution. Option D might raise a conflict-of-interest concern, but the facts state the investment aligns with the client’s objectives, so it is not the best suitability violation.

================

Detailed Explanation:

Rationale for Correct Answer: This scheme is known as a Turnaround Sale or Flip . The employee secretly purchases an asset their employer needs and then resells it to the employer at a markup, thereby profiting at the employer’s expense.

Analysis of Incorrect Options:

A. Conflict of interest in sale – Too general; does not describe the flipping mechanism.

C. Unauthorized sale – Not an ACFE fraud category in this context.

D. Written sale of unique assets – Not a recognized scheme.

Key Concept: Conflict of Interest scheme — Turnaround Sales/Flips .

Detailed Explanation:

Rationale for Correct Answer: The term Employee deviance refers to conduct that is harmful both to the organization and to the employee engaging in it. This encompasses a broad set of behaviors, including fraud, theft, abuse, and violations of organizational norms. While employee theft and fraud are subsets, deviance is the umbrella concept.

Analysis of Incorrect Options:

B. Employee theft – Specific to stealing from the employer, not the broader definition of detrimental conduct.

C. Employee fraud – Specific to deceptive practices, not all deviant acts.

D. All of the above – Incorrect, since the definition most accurately matches “Employee deviance.”

Key Concept: Employee Deviance — broader behavioral category that includes fraud, theft, and other misconduct.

Detailed Explanation:

Rationale for Correct Answer: One form of bid-rigging occurs when colluding vendors agree that one will submit a low bid and later withdraw it , allowing another conspirator to win the contract. This practice is sometimes referred to as “ complementary bidding ” or the withdrawal of low bids .

Analysis of Incorrect Options:

A. Bribery receipt – Refers to corrupt payments, not collusion.

B. Bid solicitation – The process of inviting bids, not collusion.

D. Contract acceptance – A legitimate procurement step, not fraud.

Key Concept: Bid-rigging through collusion — vendors withdrawing low bids to favor co-conspirators.

The correct answer is B. A conflict of interest occurs when an employee has an undisclosed personal, financial, or family interest that could influence decisions made on behalf of the employer. Cindy purchases supplies from a company owned by her aunt and does not disclose the relationship. This creates at least a potential conflict because Cindy’s family connection could cause her to favor the vendor over her employer’s best interests. Options A and D involve relationships or financial interests, but they have been disclosed to the employer, allowing the organization to evaluate and approve or manage the conflict. Option C might create employment or scheduling concerns, but it does not establish a conflict in a purchasing or transactional decision. Disclosure is central to proper conflict management.

================

Detailed Explanation:

Rationale for Correct Answer: When a single employee is responsible for opening the mail and recording payments, the risk of theft of incoming checks is greatest. This lack of segregation of duties allows one person both custody of funds and recordkeeping authority, a classic internal control weakness.

Analysis of Incorrect Options:

B & C – Involving two or more employees provides better segregation of duties, reducing the risk.

D. None of the above – Incorrect since option A directly matches.

Key Concept: Segregation of duties to prevent skimming/theft of incoming checks.

Detailed Explanation:

Rationale for Correct Answer: Technical security controls include software- and hardware-based measures such as application security, firewalls, and encryption . Application security protects against vulnerabilities in the programs employees use.

Analysis of Incorrect Options:

B. Human audits – Administrative control, not technical.

C. Penetration testing – A detective measure/test, not a control itself.

D. Data security – A broad goal, not a specific technical control.

Key Concept: Technical security controls for preventing cyberfraud.

Detailed Explanation:

Rationale for Correct Answer: This statement is True . Asset misappropriations reduce the organization’s assets. In double-entry accounting, a decrease in assets without a corresponding decrease in liabilities results in a reduction of owner’s equity. Therefore, fraud not only depletes assets but also indirectly reduces equity.

Analysis of Incorrect Options:

B. False – Incorrect because asset theft clearly reduces net assets and thereby equity.

Key Concept: Impact of Asset Misappropriation on the accounting equation: Assets = Liabilities + Equity.

The ACFE Manual includes a section titled New Account Fraud Schemes under Financial Institution Fraud . The table of contents for this section specifically lists:

False Identification

Business Accounts Using Stolen Checks

Personal Accounts Using Fraudulent Checks

Mobile Deposit Fraud

Automated Teller Machine Deposits

Prevention

The best answer is Option C because mobile deposits present elevated risk in new account fraud environments precisely because they can occur without in-person verification. The Manual’s inclusion of mobile deposit fraud as a specific new account fraud scheme supports the conclusion that remote, non-face-to-face deposit channels are vulnerable.

Why the other options are incorrect

A. Fraud is more likely to occur in established accounts than in accounts that are newly opened.

This is not supported by the Manual’s treatment of new account fraud as a distinct fraud risk category. The very existence of a separate section on new account fraud indicates that newly opened accounts pose a meaningful risk.

B. Automated teller machines (ATMs) are rarely targets of new account fraud because most ATMs have cameras installed.

This is inaccurate. The Manual expressly lists Automated Teller Machine Deposits within New Account Fraud Schemes , showing that ATMs are in fact a recognized target of this type of fraud.

D. New account fraud can be defined as any fraud that occurs on an account within the first year that it is open.

This is too broad and not the Manual’s definition. The Manual classifies new account fraud by the nature of the scheme , such as false identification, fraudulent checks, mobile deposit fraud, and ATM deposit fraud, not by an arbitrary one-year timeframe.

References

ACFE Fraud Examiners Manual, 2020 International Edition

Financial Institution Fraud — New Account Fraud Schemes

Detailed Explanation:

Rationale for Correct Answer: One of the most effective ways to protect proprietary information is educating employees about nondisclosure agreements (NDAs) at onboarding and again during exit. This ensures awareness of confidentiality obligations.

Analysis of Incorrect Options:

A. Changing locks/codes every 3–5 years – Reasonable security but insufficient for safeguarding proprietary information.

B. Classifying data by years of service – Not a sound security practice; access should be based on role and need-to-know.

D. Requiring notes/drafts – Increases risk of information leaks, not protection.

Key Concept: Proprietary information protection .

The correct answer is C. Cash larceny involves stealing cash after it has been recorded, so detection often depends on tracing recorded cash activity to source documents and bank deposits. Reviewing, analyzing, and tracing journal entries made to cash accounts helps identify unsupported adjustments, unusual entries, concealment entries, or discrepancies between accounting records and actual cash activity. Option A is weak because the person responsible for cash receipts should not perform independent comparisons; segregation of duties is important. Option B is incorrect because cash receipt listings should be prepared and controlled before they reach accounts receivable personnel. Option D is also improper because cashiers should not independently reconcile their own register activity. Independent review is essential for detecting cash larceny.

================

Detailed Explanation:

Rationale for Correct Answer: Skimming is the theft of incoming cash before it is recorded in the books . Since the payment is never recorded, no audit trail exists, making it an “off-book” scheme.

Analysis of Incorrect Options:

A – Incorrect; skimming can involve both sales and receivable payments.

C – Incorrect; skimming is off-book , not on-book.

D – Incorrect; skimming is typically harder to detect than larceny, since there is no record.

Key Concept: Skimming vs. larceny – off-book theft of cash receipts.

Valentin’s scheme is best described as property flipping. Property flipping becomes fraudulent when real estate is quickly resold at an artificially inflated price supported by false or misleading appraisals, sham transactions, or misrepresentations. The key facts are the quick resale and inflated value created through a fraudulent appraisal. A daisy chain generally involves a sequence of related transactions or parties used to inflate value or conceal the nature of the transaction, but the question asks for the best description of the basic scheme. A fraudulent sale is too general, and an air loan involves a fictitious borrower, fictitious property, or nonexistent transaction. The ACFE material discusses fraudulent appraisals, real estate fraud, and property flipping as financial institution fraud risks.

================

Detailed Explanation:

Rationale for Correct Answer: The going concern assumption means that a business will continue operating indefinitely and will not liquidate in the near future. This underpins the use of historical cost accounting and normal accrual-based reporting.

Analysis of Incorrect Options:

A. Materiality – Relates to significance of information, not continuity.

C. Cost – Refers to historical cost valuation.

D. Fair value – Refers to current market value, not continuity.

Key Concept: Going Concern Assumption in accounting.

Detailed Explanation:

Rationale for Correct Answer: Shrinkage refers to discrepancies between physical inventory counts and perpetual inventory records. Causes include theft, errors, waste, or fraud. It is one of the most common indicators of asset misappropriation.

Analysis of Incorrect Options:

A. Altered inventory – Not a recognized accounting term.

B. Account receivable – Unrelated to inventory.

D. Write-offs – A corrective accounting entry, not the variance itself.

Key Concept: Inventory shrinkage as a red flag for fraud.

The correct answer is C. Competitive intelligence is the lawful and ethical gathering and analysis of information about competitors, markets, products, customers, and industry conditions. It can support research and development, pricing decisions, strategic planning, and forecasting of competitors’ costs or business moves. Option A is incorrect because illegal or covert acquisition of commercial information describes corporate espionage, not legitimate competitive intelligence. Option B describes government intelligence activity, not business competitive intelligence. Option D is incorrect because competitive intelligence should not use the same unlawful or deceptive methods associated with espionage. The ACFE material distinguishes lawful competitive intelligence from theft of data, trade secrets, and intellectual property.

================

Rationale for Correct Answer: Sampling is a fraud examination technique that enables investigators to review a subset of documents rather than all records. Properly designed sampling provides reasonable assurance and allows focus on anomalies or red flags.

Key Concept: Sampling in fraud examination and audit testing.

The correct answer is A because the FATF Recommendations provide that financial institutions and designated nonfinancial businesses and professions should report covered cash transactions that exceed the jurisdiction’s designated threshold. Dealers in precious metals and stones, such as businesses selling gold jewelry, are commonly treated as higher-risk entities for anti-money laundering purposes. A domestic cash purchase above the threshold would therefore require reporting. Options B and C are below the designated threshold, so they do not meet the reporting requirement based on amount. Option D involves a food purchase, which is not the type of covered high-risk transaction described in the FATF large cash transaction guidance. The key issue is both the covered business type and the threshold amount.

================

The correct answer is D. The FATF Recommendations establish international standards for combating money laundering, terrorist financing, and related threats. They recommend that countries criminalize money laundering, supervise financial institutions and high-risk professions, require suspicious transaction reporting, and maintain mechanisms for analyzing and disseminating financial intelligence. A financial intelligence unit receives and analyzes suspicious transaction reports and other AML-related information. Option A is incorrect because FATF does not require a universal three-year sentence for every conviction. Option B is too extreme and does not reflect the FATF framework. Option C is not a general FATF requirement; customer due diligence and monitoring focus on risk, transactions, and beneficial ownership, not mandatory review of public social media profiles.

================

Detailed Explanation:

Rationale for Correct Answer: EFT fraud involves the unauthorized transfer of money from victims’ accounts using stolen access credentials. A hacker using stolen log-in details to redirect funds is the textbook example.

Analysis of Incorrect Options:

A – Describes identity theft/credit card fraud, not EFT fraud.

C – Describes skimming of card data, not EFT.

D – Describes payroll fraud , not EFT.

Key Concept: EFT fraud = unauthorized access to electronic banking/payment systems.

Detailed Explanation:

Rationale for Correct Answer: The key goals of information security (the CIA triad plus authentication and non-repudiation ) are confidentiality, integrity, availability, authentication, and non-repudiation . While accuracy of data is important, it is not formally one of the core security goals.

Analysis of Incorrect Options:

A. Availability – Ensures users can access data when needed.

C. Authentication – Confirms identities before granting access.

D. Non-repudiation – Prevents denial of legitimate transactions.

Key Concept: Information security objectives for fraud prevention.

The correct answer is C. An unusually close or overly friendly relationship between an employee and a third-party contractor can be a red flag of corruption. Such relationships may indicate favoritism, undisclosed conflicts of interest, kickbacks, bid manipulation, or preferential treatment in procurement decisions. The behavior is not proof of wrongdoing, but it warrants further review when combined with unusual awards, pricing, sole-source justifications, weak documentation, or repeated business with the same vendor. Option A reflects proper restraint, not suspicious conduct. Option B suggests the employee is not benefiting from bribery-prone markets. Option D is generally positive because disclosure of conflicts allows the organization to evaluate and manage ethical risks. Red flags must be assessed in context with documents, transactions, and relationships.

================

The correct answer is A. Restricting inventory access to authorized personnel is a basic preventive control against theft of inventory and other assets. Limiting physical access reduces opportunities for employees or outsiders to remove goods without authorization. Option B is weak because concentrating receiving and distribution duties in one person reduces segregation of duties and increases concealment risk. Option C is also improper because purchasing personnel should not independently perform physical inventory counts; independent counts help detect theft and manipulation. Option D is incorrect because documents should be prenumbered and controlled, not nonconsecutive, so missing or altered forms can be detected. The ACFE materials discuss inventory theft prevention through access controls, proper documentation, segregation of duties, and independent inventory counts.

================

The correct answer is B. Skimming involves stealing cash before it is recorded in the organization’s accounting system. Separating the duties of collecting cash and accessing or posting to the accounts receivable journal is an effective preventive control because it prevents one employee from both taking funds and manipulating records to conceal the theft. Job rotation can help, but it is less direct. Comparing sales records to cash received and reviewing deposit timing are more detective than preventive in nature. The strongest control is segregation of duties between custody of cash and recordkeeping authority. The ACFE cash receipts materials emphasize receipt-level controls, general controls, and separation of duties as primary measures for preventing skimming schemes.

================

Detailed Explanation:

Rationale for Correct Answer: Prepaid debit and gift cards are attractive because they allow fraudsters to convert stolen credit card funds into cash or easily launder illicit funds . They are widely available and accepted both in person and online, making option A correct.

Analysis of Incorrect Options:

B. Only from financial institutions – False; cards are sold at retail stores and online.

C. Not accepted online – False; they are accepted by most online retailers.

D. All of the above – Incorrect since B and C are false.

Key Concept: Prepaid card fraud as part of asset misappropriation and identity theft schemes.

Detailed Explanation:

Rationale for Correct Answer: Ransomware is malware that encrypts or locks an operating system and prevents access to data until a ransom is paid. This definition is correct.

Analysis of Incorrect Options:

A. Spyware – Monitors user activity, keystrokes, or data, not a startup instruction program.

B. Trojan horse – Appears legitimate but contains malicious code; adware is different.

C. Worm – Self-replicating program spreading across networks; not a keystroke logger.

Key Concept: Cyber fraud and malware types .

Detailed Explanation:

Rationale for Correct Answer: Hollinger and Clark’s research emphasized that management policy should focus on: (1) developing a clear understanding of theft behavior and its causes, and (2) enforcing sanctions consistently. Both are necessary to reduce employee deviance and occupational fraud. Thus, C. Both A & B is correct.

Key Concept: Hollinger-Clark Study — policy implications for managing employee theft.

The best practice is to identify employees leaving the company who have downloaded an unusually large number of data files. Departing employees present a heightened risk of proprietary information theft because they might take customer lists, pricing data, product designs, research, formulas, source code, or strategic plans for use with a competitor or new venture. Monitoring abnormal downloading activity is a targeted detective control that focuses on actual access and extraction of sensitive data. Options A and C rely on external competitor activity and might reveal only indirect indicators after damage occurs. Option B is too broad because permitted access alone does not show theft. The ACFE material emphasizes insider threats, safeguarding proprietary information, and monitoring unusual access or transfer of sensitive data.

================

The correct answer is C. A Trojan horse is malware that appears to be legitimate, useful, or harmless software but contains hidden malicious code. Once installed or executed, it can damage systems, steal information, create unauthorized access, or perform other harmful actions. Option A describes ransomware, not a worm; ransomware restricts access to systems or files and demands payment. A worm is self-replicating malware that spreads across networks. Option B describes adware more closely than spyware. Spyware secretly monitors and reports user activity or information. Option D also describes spyware rather than ransomware. Professionally, the key distinction is the malware’s function: concealment and deception for Trojan horses, self-replication for worms, surveillance for spyware, and restriction or encryption for ransomware.

================

The correct answer is D. Carl committed electronic payment tampering because he used stolen online banking credentials to create an unauthorized recurring electronic payment. Electronic payment tampering involves manipulating electronic disbursement systems, online banking portals, ACH transactions, wire transfers, or related payment credentials to divert funds. Although Carl uses a disguised bank account, the central misconduct is the unauthorized creation of an electronic payment, not a traditional billing scheme. A diverted revenue scheme concerns incoming receipts rather than outgoing payments. A ghost payee scheme can involve fictitious recipients, but here the best classification is electronic payment tampering because the fraud is executed through the company’s online banking system. The ACFE materials classify electronic payment tampering under fraudulent disbursement schemes.

================

The correct answer is B. ACH blocks are a preventive bank control that allows an account holder to instruct the bank not to permit ACH debits from designated accounts. This reduces the risk of unauthorized electronic withdrawals. Option A is incorrect because positive pay for ACH should not be declined; it can help verify ACH transactions before they clear. Option C violates segregation of duties because the person initiating electronic payments should not also control ACH filters or payment security settings. Option D is also weak because using separate accounts for paper checks and electronic transactions can improve monitoring and limit exposure. The ACFE materials identify ACH blocks, ACH filters, positive pay, segregation of duties, and bank security services as important controls against electronic payment tampering.

================

The correct answer is D. A kickback scheme occurs when a vendor or contractor provides something of value to an employee or decision-maker in exchange for business or favorable treatment. Here, the restaurant offers David free monthly dinners for his family and friends if he directs ALT Consulting’s catering business to the restaurant. The benefit is tied directly to David’s agreement to steer business, which is the defining feature of a kickback. An illegal gratuity typically involves a reward for an official act without the same negotiated exchange. Economic extortion involves the employee demanding payment from the vendor. A diversion scheme is not the best classification. The ACFE materials identify gifts, travel, entertainment, and other benefits as common methods of making corrupt payments.

================

The correct answer is D. A fraudulent conveyance occurs when a debtor transfers property to another party, often an insider or related party, for little or no consideration before or during insolvency to place assets beyond the reach of creditors. Brad’s transfer of valuable marble slabs to his son’s construction business at no charge shortly before bankruptcy is a strong indicator of such a scheme. Option A, concealed transfer, is less precise because the key issue is not merely hiding a transfer but transferring assets for inadequate value to impair creditors. Option B is overly broad and does not identify the scheme type. Option C, planned bustout, usually involves obtaining goods or credit with the intent to dispose of assets and then file bankruptcy.

================

Rationale for Correct Answer: The price-level adjusted historical cost method adjusts the original purchase price of an asset for inflation, providing a more current value while still tied to historical cost principles. It addresses one of the limitations of strict historical cost accounting.

Key Concept: Inflation adjustments in asset valuation.

Detailed Explanation:

Rationale for Correct Answer: Common skimming schemes include unrecorded sales , theft of incoming checks , and understating sales/receivables . “Fraud & Cost” is not a recognized skimming scheme and appears to be a distractor.

Analysis of Incorrect Options:

A. Unrecorded sales – A classic skimming method.

C. Theft of checks through the mail – Another recognized skimming approach (incoming receivables).

D. Understated sales and receivables – A concealment method within skimming schemes.

B. Fraud & Cost – Not a scheme classification.

Key Concept: Skimming schemes vs. unrelated distractors.

Detailed Explanation:

Rationale for Correct Answer: In the “playing the accounting system” approach, fraudsters manipulate legitimate accounting rules and entries to distort reported results. Examples include manipulating estimates, changing depreciation methods, or shifting expenses. They exploit the flexibility of GAAP to present misleading results while still appearing compliant.

Analysis of Incorrect Options:

A. Organized accounting – Not a recognized fraud approach.

C. Beating accounting – Refers to bypassing the system entirely, not using it as a tool.

D. All of the above – Incorrect because only option B is valid.

Key Concept: Playing the accounting system as a method of financial statement fraud.

Detailed Explanation:

Rationale for Correct Answer: Corrupt payments are not always made directly in cash. According to the Fraud Examiners Manual (2020) , one common method is disguising them as loans on favorable terms , which provide value to the recipient while appearing legitimate. This is recognized as a form of bribery or illegal gratuity.

Analysis of Incorrect Options:

B. Credit cards – Corrupt payments can be made via many channels, including credit, so this is incorrect.

C. Selling property above market value – Payments are typically disguised by undervaluing sales to recipients, not overvaluing.

D. Promises of favorable treatment – Promises alone can constitute bribery; this statement is false.

Key Concept: Methods of making corrupt payments .

Detailed Explanation:

Rationale for Correct Answer: W. Steve Albrecht’s Fraud Scale introduced the relationship between pressure, opportunity, and integrity. He and his colleagues identified 81 red flags or behavioral indicators of occupational fraud and abuse based on these three dimensions. Therefore, the correct answer is A. 81 .

Analysis of Incorrect Options:

B. 82 / C. 83 / D. 84 – Distractors; none match the number identified in the fraud scale research.

Key Concept: Fraud Scale — Red Flags of occupational fraud.

Detailed Explanation:

Rationale for Correct Answer: This statement is False . Shrinkage is a general term for unaccounted-for inventory losses, and it can indeed result from theft, errors, damage, or waste . To say shrinkage does not result from theft is misleading because theft is one of its primary causes.

Analysis of Incorrect Options:

A. True – Incorrect, as theft is often a major contributor to shrinkage.

B. False – Correct, since shrinkage can include theft.

Key Concept: Shrinkage includes theft as a cause of unexplained inventory loss.

Detailed Explanation:

Rationale for Correct Answer: Expense reimbursement schemes are a common type of fraudulent disbursement. Requiring employees to submit receipts electronically improves controls by ensuring legibility, reducing the chance of altered or duplicate submissions, and creating a digital audit trail. This measure is recommended in the Fraud Examiners Manual as part of strengthening internal controls over reimbursement processes.

Analysis of Incorrect Option:

B. False – Incorrect because electronic receipt submission is indeed a recognized anti-fraud measure.

Key Concept: Fraudulent disbursements prevention through documentation controls.

The correct answer is A. Holograms are specifically designed as anti-counterfeiting features and are among the most difficult physical card features for fraudsters to reproduce accurately. Counterfeit payment card schemes usually involve stolen account information being encoded or printed onto altered, blank, or counterfeit cards. Option B is incorrect because these schemes generally involve fraudsters, organized groups, or dishonest merchants, not collusion between card issuers and merchants. Option C is too absolute because modern technology allows counterfeit cards to be produced without traditional professional printing facilities. Option D is inaccurate because counterfeit cards usually rely on stolen or compromised active account data, not merely expired card numbers. The ACFE payment fraud materials emphasize card security features, counterfeit card production, and card-scrutiny controls.

================

Detailed Explanation:

Rationale for Correct Answer: By definition, conflict of interest fraud arises when an employee has a hidden financial or ownership interest in another entity with which the employer does business. The fraudster’s loyalty is divided because their interest lies outside of their primary employer.

Analysis of Incorrect Options:

B. False – Incorrect because the essence of conflict of interest is precisely that the fraudster’s interest lies outside their company.

Key Concept: Conflict of Interest (divided loyalty).

The correct answer is B. Misrepresentation in health care or insurance fraud occurs when an applicant or insured person provides false information to obtain coverage, reduce premiums, or receive benefits that would not otherwise be available. Marco falsely states that he is a nonsmoker to obtain full insurance coverage, making the application materially misleading. Option A is a fictitious claim because the procedure was canceled. Option C involves improper use of another person’s policy or coverage. Option D is closer to multiple-claim or duplicate reimbursement fraud. The ACFE health care fraud materials specifically identify misrepresentation on applications as an insured or beneficiary fraud scheme, making Marco’s false smoking status the best example.

================

Detailed Explanation:

Rationale for Correct Answer: The accounting cycle is the complete process of recording transactions, adjusting the books, preparing trial balances, and producing financial statements. Journal entries are part of the process, but the entire structured sequence is called the accounting cycle.

Analysis of Incorrect Options:

A. Journal Entries – Steps within the cycle, not the entire process.

C. Financial statement – Output of the cycle, not the process itself.

D. None of all – Incorrect since the accounting cycle is the correct term.

Key Concept: Accounting Cycle — structured process of recording and adjusting transactions.

Timothy is a victim of a pig butchering scheme. This scam combines long-term relationship manipulation with fraudulent investment activity, commonly involving cryptocurrency. The fraudster builds trust over weeks or months, moves the victim to a private messaging channel, and encourages investments through a fake platform. The victim often sees apparent gains, but the trading platform is controlled by the fraudster or does not exist. Once the victim attempts to withdraw funds, the fraudster disappears or demands more money. This is not a Ponzi scheme because the facts do not involve paying old investors with new investor funds. It is not a pump-and-dump because no market manipulation of a traded security is described. It is broader than a simple advance-fee scheme.

================

Detailed Explanation:

Rationale for Correct Answer: When a tangible asset is stolen (removed from the books), a debit entry would be missing its corresponding credit, leaving the books out-of-balance . Fraudsters often conceal this imbalance by falsifying entries (e.g., creating fictitious expenses or adjusting asset accounts).

Analysis of Incorrect Options:

A. Journal Entries – Too general; not the condition of the books.

C. False debits – A concealment method, but not the direct result.

D. None of all – Incorrect because “out-of-balance” is accurate.

Key Concept: Concealment of asset theft and impact on accounting records.

The correct answer is D. Users being denied access to files they normally use is a significant indicator of possible network intrusion. Such denial might result from unauthorized permission changes, malware, ransomware encryption, account compromise, or malicious alteration of access controls. In a professional fraud examination context, this condition should trigger immediate incident-response procedures, including review of system logs, firewall records, router logs, and affected files. Options A and C describe routine security and system maintenance activities. Option B is not inherently suspicious because the country has a legitimate client connection. The ACFE computer and internet fraud materials emphasize that compromised systems should be treated as suspect and reviewed for irregularities and abnormal activity.

================

Detailed Explanation:

Rationale for Correct Answer: Deliberate writing of vague specifications is a type of corruption scheme where an employee intentionally drafts unclear requirements. This forces later amendments, which can be manipulated to favor a particular vendor.

Analysis of Incorrect Options:

B. Need recognition – Involves unnecessary purchases, not vague specifications.

C. False specification – General but not precise; “vague specifications” is the correct technical term.

D. Bid-splitting – Breaking contracts into smaller amounts to avoid approval controls, not related to vague specs.

Key Concept: Specification schemes in procurement corruption.

Detailed Explanation:

Rationale for Correct Answer: Address similarity reports are used to identify fraudulent disbursements by flagging payments sent to multiple vendors or payees at the same address. This helps detect fictitious payees or shell companies set up by fraudsters.

Analysis of Incorrect Options:

A. Duplicate payment lists – Detects duplicate disbursements, not necessarily fictitious payees.

C. Exception reports – Flag unusual transactions, but not specifically address similarities.

D. Electronic confirmations – Used to verify balances or transactions, not detect fictitious vendors.

Key Concept: Detection of fraudulent disbursements .

The best answer is B. A consumer approached by a contractor should independently verify the contractor’s license or registration with the proper licensing agency before agreeing to work. Home repair and contractor scams often involve unsolicited offers, false claims of urgent repairs, inflated prices, poor workmanship, or unlicensed contractors. Oral agreements are risky because they provide little evidence of the work, price, warranties, or rights of cancellation. References can be useful, but a phone number supplied by the contractor might be fake or controlled by an accomplice. Asking about experience is also insufficient because the contractor can misrepresent it. Independent verification with the licensing authority is stronger because it confirms whether the contractor meets professional and regulatory requirements.

================

Detailed Explanation:

Rationale for Correct Answer: One of the key red flags of fictitious revenues is sales to related parties, shell companies, or entities with unknown substance and ownership . Such transactions are often used to inflate revenue artificially.

Analysis of Incorrect Options:

A. Slow growth/unusual profitability – Incorrect, fictitious revenue often results in rapid or unrealistic growth.

B. Growth in days’ purchases in receivables – Misstated phrase; correct indicator would be growth in days’ sales in receivables .

D. Surge in purchases – Relates more to inventory fraud than fictitious revenues.

Key Concept: Red flags of fictitious revenue — questionable counterparties and unrealistic sales growth.

The correct answer is A. Financial statement disclosures are required when information is necessary for users to understand the entity’s financial position and risks. Potential losses from ongoing litigation generally must be disclosed when the likelihood of loss is reasonably possible, even if the amount is not yet certain. Option B is incorrect because significant subsequent events after the reporting period might require disclosure. Option C is incorrect because changes in accounting principles must generally be disclosed to preserve comparability and transparency. Option D is too narrow because related-party transactions require disclosure when material or relevant, not only when they financially harm stakeholders. The ACFE financial statement fraud materials identify improper disclosures, concealed liabilities, subsequent events, and related-party transactions as important fraud risk areas.

Detailed Explanation:

Rationale for Correct Answer: The Fraud Examiners Manual (2020) highlights document reviews, audit tracing, financial analysis, and inside witnesses as the primary methods of proving corrupt payments. Secret infiltration is not a standard fraud examination technique; it is more aligned with law enforcement undercover operations.

Analysis of Incorrect Options:

A. Taxation inquiries – A valid method to confirm payment sources.

C. Inside witness – Valuable evidence in corruption cases.

D. Tracing payments – Fundamental audit step in proving illicit payments.

Key Concept: Proving corrupt payments — standard audit and investigative methods.

The correct answer is C. Multifactor authentication is an effective preventive control for electronic funds transfer fraud because it requires users to verify their identity through more than one authentication factor before initiating or approving payments. This reduces the risk that stolen usernames, passwords, or account credentials alone will allow unauthorized transfers through EBPP or P2P systems. Option A is unsafe because sending PINs, usernames, and passwords together increases exposure if the communication is intercepted. Option B is also poor practice because sensitive credentials should be encrypted. Option D weakens segregation of duties by allowing one employee to control both PIN issuance and access device information. The ACFE materials emphasize authentication, access controls, and segregation of duties in preventing EFT fraud.

================

Detailed Explanation:

Rationale for Correct Answer: The statement is false . Cressey’s fraud triangle and Albrecht’s fraud scale both emphasize that fraud is more likely when pressures are high, opportunities are present, and integrity is low . Conversely, when pressure and opportunity are low and integrity is high, the likelihood of fraud is greatly reduced.

Analysis of Incorrect Options:

A. True – Incorrect, it directly contradicts the fraud triangle and fraud scale models.

B. False – Correct, because under the conditions stated, fraud occurrence is less likely.

Key Concept: Fraud Scale Variables — Pressure, Opportunity, Integrity.

Detailed Explanation:

Rationale for Correct Answer: Donald Cressey’s fraud triangle identifies three conditions that lead to occupational fraud: (1) Pressure (financial or other), (2) Opportunity (ability to commit without detection), and (3) Rationalization (justification by the perpetrator to make the act acceptable in their own mind). Thus, the third leg is Rationalization .

Analysis of Incorrect Options:

A. Violation – Not part of the fraud triangle.

B. Isolation – Not a recognized component of the model.

D. None of the above – Incorrect because rationalization is explicitly the correct answer.

Key Concept: Fraud Triangle — Opportunity, Pressure, Rationalization .

Detailed Explanation:

Rationale for Correct Answer: Loan fraud often involves suspicious or unusual documentation patterns. A change order submitted at the same time as a draw request is a red flag, because it suggests manipulation of project costs to justify larger draws from lenders.

Analysis of Incorrect Options:

A. Missing documents – Could indicate sloppy recordkeeping, not necessarily fraud.

B. Low turnover – Not a fraud indicator.

D. Increasing change orders – Could be suspicious, but not as strong a fraud red flag as simultaneous change order and draw request.

Key Concept: Loan fraud indicators .

Detailed Explanation:

Rationale for Correct Answer: Fraudulent schemes involving returns and allowances can be detected by analyzing accounts for unusually high transactions in these categories. This is a common red flag for concealment of theft or manipulation of sales.

Analysis of Incorrect Options:

A. Allowances by vendors – Too narrow, not a standard analytic test.

B. Disposals of allowances than reorders – Not a recognized search method.

D. None of the above – Incorrect, since option C is valid.

Key Concept: Returns and allowances analysis for fraud detection.

The correct answer is A. Electronic funds transfer fraud involves the misuse of electronic payment systems to move money improperly. A vendor submitting an electronic bill through a client’s online payment system for services not provided is a fraudulent use of electronic bill presentment or payment processes. Option B is payroll fraud, specifically falsified hours or salary. Option C involves theft and misuse of prepaid cards, not EFT manipulation by the payee. Option D describes payment card skimming, where card information is captured for later unauthorized use. The ACFE materials discuss electronic funds transfers, wire transfer fraud, electronic bill presentment and payment, and detection of EFT fraud as part of payment fraud risk.

================

Detailed Explanation:

Rationale for Correct Answer: For fraud to exist, several legal elements must be established. These include: (1) a material false statement made by the perpetrator, (2) knowledge of the falsity of that statement (scienter or intent to deceive), and (3) reliance on the false statement by the victim, resulting in harm or damages. The Fraud Examiners Manual (2020 International Edition) explains that all elements must be present for a fraud case to be sustained. Thus, the correct answer is D. All of the above .

Analysis of Incorrect Options (Distractors):

A. A material false statement – A false statement alone is insufficient unless there is intent to deceive and victim reliance.

B. Knowledge that the statement was false when it was uttered – Intent is critical, but without the victim’s reliance and damages, fraud is incomplete.

C. Reliance on the false statement by the victim – Victim reliance is necessary, but without a knowingly false statement and intent, fraud cannot be proven.

Key Concept: The essential legal elements of fraud.

Detailed Explanation:

Rationale for Correct Answer: The word delude means to mislead the mind or judgment so completely that the truth is obscured. In fraud examination, this aligns with the ACFE definition of fraud as a “deliberate misrepresentation that causes another to act to their detriment.” Fraud is not merely a false statement; it involves concealment or suppression of the truth with the intent to induce reliance. Thus, delude most accurately represents the deeper essence of fraud.

Analysis of Incorrect Options (Distractors):

A. Deceive: While fraud does involve deception, this word does not fully convey the thoroughness of obscuring the truth that fraud entails.

C. Mislead: This implies causing error or leading astray but lacks the complete concealment aspect central to fraud.

D. Beguile: Often connotes charm or trickery rather than the intentional concealment that characterizes fraud.

Key Concept: This question tests the definition and essence of fraud — specifically that fraud is not only about deceiving but about deluding , or thoroughly misleading, in a way that obscures the truth.

The correct answer is A. Creating answers to security questions using unique, nonpublic details helps prevent identity thieves from bypassing account protections. Many security-question answers, such as a mother’s maiden name, school name, pet name, or birthplace, can be discovered through social media, public records, or data breaches. Using answers that cannot be easily verified through public sources makes account recovery processes harder to exploit. Option B is weak because passwords and passphrases should not be reused across accounts at all. Option C is unsafe because email can be intercepted or misdirected, even when contacting reputable organizations. Option D is inadequate because moving files to the recycle bin does not securely erase data from a device before disposal.

================

The correct answer is D. Assigning the duties of an employee who is on vacation to other employees supports mandatory vacation and job rotation controls. These controls help prevent and detect cash larceny by interrupting the fraudster’s control over cash handling and concealment procedures. If a dishonest employee must be absent and another employee performs the same duties, irregularities such as missing cash, altered records, delayed deposits, or unsupported adjustments are more likely to surface. Option A relates more to surprise cash counts, which are useful, but the stronger preventive control in this list is rotation through vacation coverage. Option B weakens accountability because employees should use separate registers or identifiers. Option C violates segregation of duties by combining custody and disbursement authority.

================

The correct answer is D. Smishing is phishing conducted through SMS or text messages. Margarette sends a fraudulent text that appears to come from Arlo’s doctor’s office and includes a payment link to a fake portal she controls. The purpose is to trick Arlo into entering payment card information, which she then steals. Quishing uses QR codes to direct victims to fraudulent sites. Pharming redirects users from legitimate websites to fraudulent ones, often through technical manipulation of domain name resolution or device settings. Vishing uses voice calls or voicemail to obtain sensitive information. Because the fraudulent communication is a text message and the goal is to steal payment information, the scheme is smishing.

Detailed Explanation:

Rationale for Correct Answer: Under anti-bribery laws and fraud examination principles, the offer of a payment itself may constitute a bribe, regardless of whether money changes hands. Intent to improperly influence is enough to establish bribery.

Analysis of Incorrect Options:

B. Corruption in payment – Too vague, not a legal element.

C. Kickback payment – Requires an actual payment; not just an offer.

D. Overbilling in payment – A disbursement scheme, not a bribe.

Key Concept: Bribery offense can occur upon the offer alone.

The ACFE Fraud Examiners Manual addresses Nonconforming Goods or Services under Contract and Procurement Fraud . The Manual states that, to detect nonconforming schemes, the fraud examiner should examine contract specifications, contractor statements, invoices, supporting documents, the received product, and test and inspection results for discrepancies with contract specifications. It then specifically adds:

“Additionally, to detect nonconforming schemes, the fraud examiner should:

• Review correspondence and contract files for indications of noncompliance.

• Request assistance from outside technical personnel to conduct after-the-fact tests.”

This language matches Option B exactly, so it is the most appropriate detection technique.

Why the other options are incorrect

A. Interviewing complaining contractors and unsuccessful bidders about the presence of red flags

This is a detection technique the Manual associates with change order abuse , not nonconforming goods or services schemes.

C. Comparing the direct and indirect labor account totals from the prior year to the current year

This type of comparative cost analysis is more consistent with testing for cost mischarging or other accounting irregularities, not the primary detection methods for nonconforming goods/services. The Manual’s nonconforming-scheme detection guidance focuses on specifications, inspection results, product testing, and contract/correspondence review.

D. Determining if the costs of the contract have exceeded or are expected to exceed the value of the contract

That is not identified by the Manual as the most appropriate method for detecting nonconforming goods or services. Again, the Manual directs the examiner to look for noncompliance with specifications and supporting documentation.

References

ACFE Fraud Examiners Manual, 2020 International Edition

Contract and Procurement Fraud — Nonconforming Goods or Services

Detecting Nonconforming Goods or Services Schemes

Related contrast: Detecting Change Order Abuse

The correct answer is B. Under cash-basis accounting, revenues and expenses are recorded based on the movement of cash. Revenue is recorded when cash is received, and expenses are recorded when cash is paid, regardless of when goods are delivered, services are performed, or obligations are incurred. Options A and C describe accrual-basis concepts. Accrual accounting records revenue when earned and matches related expenses to the same accounting period. Option D is incorrect because cash-basis accounting is generally simpler than accrual-basis accounting, although it can provide a less complete picture of financial performance. The ACFE materials emphasize that accrual accounting gives a truer financial picture and is required under GAAP.

================

Detailed Explanation:

Rationale for Correct Answer: In a legitimate competitive bidding process , all bidders must be treated equally, with the same access to information, terms, and conditions. This ensures fairness and prevents procurement fraud.

Analysis of Incorrect Options:

A. Bid-rigging – The manipulation of competitive bidding, not the fair process.

B. Kickbacks – Involve secret payments, not equal bidding.

D. Bid solicitation – The stage of inviting bids, not the equal treatment requirement.

Key Concept: Competitive bidding — foundation of fairness in procurement.

Detailed Explanation:

Rationale for Correct Answer: A need recognition scheme occurs when an employee uses their influence to convince their employer to purchase unnecessary goods or services. This benefits the supplier (often paying kickbacks) but harms the employer.

Analysis of Incorrect Options:

A. Presolicitation scheme – General stage of procurement, not specific.

C. False sole-source scheme – Involves eliminating competition by claiming only one vendor can supply the good/service.

D. Submission scheme – Related to bid-rigging, not need recognition.

Key Concept: Need recognition schemes — corruption through unnecessary purchases.

Rationale for Correct Answer: Rationalization is the cognitive process by which fraud perpetrators justify their unethical conduct so they can commit fraud without feeling like criminals. A common way is to “invent a good reason” for their actions (e.g., “I deserve it,” “I’ll pay it back,” “Everyone else is doing it”). Thus, the correct completion is “one’s actions” or more precisely, Rationalization .

Analysis of Incorrect Options: Since this is a fill-in-the-blank, the distractors are implied. The only correct concept here is rationalization of one’s actions .

Key Concept: Rationalization — one leg of the fraud triangle.

The correct answer is B. A fictitious payee scheme occurs when an insurance insider directs payments to a fabricated or unauthorized recipient and then misappropriates the funds. In this scenario, the agent changes the beneficiary to a made-up person and authorizes distribution of policy proceeds, enabling the agent to abscond with the money. The fraudulent feature is the creation or use of a false payee, not a false death. A false information scheme is broader and does not specifically describe the payment diversion. A fictitious death scheme would involve falsely claiming that the insured died. “False heir scheme” is not the best ACFE category. The ACFE insurance fraud materials identify fictitious payees as an agent or broker fraud method.

Henrietta is engaging in a need recognition scheme. Procurement begins when the organization identifies a need for goods or services. In a fraudulent need recognition scheme, an employee creates, exaggerates, or falsely justifies a need so the organization will purchase unnecessary goods or services from a favored vendor. Henrietta fabricates beetle sightings to convince management that specialized pest control services are required. Her receipt of money from the contractor shows corrupt motivation and vendor collusion. This is not bid tailoring because the facts do not involve drafting specifications to favor a bidder. It is not nonconforming services because the issue is the false need, not defective performance. It is not bid manipulation because the bidding process itself is not the main misconduct.

================

Detailed Explanation:

Rationale for Correct Answer: The matching principle under GAAP requires that revenues and the corresponding expenses incurred to generate those revenues be recorded in the same period. Failing to do so misstates income and violates accrual accounting.

Analysis of Incorrect Options:

B. Revenue and Income statement – The income statement is a report, not an item to be matched.

C. Income statement and Long-term contracts – Long-term contracts follow special rules (percentage of completion, completed contract), not the general matching principle.

D. Capitalized expenses and Liabilities – Not part of the matching principle.

Key Concept: Matching Principle — recording related revenues and expenses in the same period.

The correct answer is B. Cash register disbursement schemes commonly involve false voids, false refunds, or unauthorized register activity. Secure access codes help establish individual accountability and prevent one employee from processing fraudulent transactions under another employee’s credentials. Training employees not to share access codes strengthens this control. Option A is weak because announced cash counts reduce deterrence; surprise counts are more effective. Option C does not provide meaningful control because another non-supervising employee might not detect or challenge improper activity. Option D is inappropriate because employees should not independently reconcile their own register activity; independent review is necessary. The professional control principle is to restrict access, preserve accountability, and require supervisory or independent review of register disbursements.

================

Detailed Explanation:

Rationale for Correct Answer: Key GAAP principles include Conservatism , Historical Cost , and Full Disclosure . Quality control is not a GAAP principle; rather, it is a concept from auditing standards related to ensuring audit quality.

Analysis of Incorrect Options:

A. Conservatism – GAAP principle requiring cautious reporting of uncertain outcomes.

B. Cost – Historical cost principle is central to GAAP.

C. Full disclosure – Requires all relevant information to be presented.

D. Quality control – Belongs to auditing, not GAAP.

Key Concept: GAAP principles — distinguishing accounting standards from auditing practices.

Tammy is most likely committing a structuring scheme. Structuring occurs when a person deliberately breaks transactions into smaller amounts to avoid mandatory reporting thresholds. Here, Tammy repeatedly deposits cash in amounts between $9,000 and $9,900, just below the $10,000 reporting requirement. That pattern strongly indicates an attempt to avoid currency transaction reporting. A reverse deposit scheme and remote deposit capture scheme do not describe the deliberate splitting of cash deposits to evade reporting. Integration is a later stage of money laundering in which illicit funds are reintroduced into the economy as apparently legitimate funds, but Tammy’s activity is focused on avoiding detection during placement. The ACFE material identifies repeated deposits just under the reporting threshold as a classic red flag of smurfing or structuring.

================

Detailed Explanation:

Rationale for Correct Answer: Credits decrease assets and expenses while increasing liabilities and equity. They are recorded on the right-hand side of ledger accounts, forming the counterbalance to debits.

Analysis of Incorrect Options:

A. Journal Entries – Too general; not a directional effect.

B. Debit – Opposite effect of credits.

D. None of all – Incorrect because “credit” is the precise answer.

Key Concept: Credit rules in double-entry accounting.

Detailed Explanation:

Rationale for Correct Answer: Misrepresenting income, employment, or creditworthiness on a mortgage application is a classic example of residential loan fraud . This type of fraud occurs when borrowers provide false information to qualify for loans they would not otherwise receive.

Analysis of Incorrect Options:

B. Credit data blocking – Refers to suppressing negative credit information with fraudulent disputes.

C. Double-pledging collateral – Involves using the same collateral for multiple loans.

D. Linked financing – Occurs when loans are structured with related transactions to disguise financial exposure.

Key Concept: Loan and mortgage fraud – misrepresentation of borrower information.

Detailed Explanation:

Rationale for Correct Answer: Bid manipulation schemes occur in the procurement process and involve altering the bidding environment (e.g., extending deadlines, prematurely opening competitor bids, or changing submitted bids). Using low-quality materials is a post-award performance fraud , not bid manipulation.

Analysis of Incorrect Options:

A, C, D – All are recognized bid manipulation tactics.

Key Concept: Procurement fraud schemes – bid manipulation vs. contract performance fraud.