I85PREP
⌘ K
CAFS study materials
CAFS study resources

CAFS practice questions

One question at a time. Build your CAFS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fraud Risk Management and Prevention

Which three conditions make up the fraud triangle?

  1. Incentive, collusion, and concealment
  2. Incentive, opportunity, and rationalization Correct answer.
  3. Rationalization, conversion, and concealment
  4. Opportunity, materiality, and intent

Explanation

The fraud triangle explains that fraud occurs when a person has a pressure or incentive to commit it, an opportunity created by weak controls, and a rationalization that allows the act to be justified. Removing any one of the three conditions reduces the likelihood of fraud occurring.

Question 2Fraud Risk Management and Prevention

In the three lines of defense model, which group owns and manages fraud risk on a day-to-day basis?

  1. The board of directors acting as a whole
  2. Business unit managers who run the processes Correct answer.
  3. The internal audit function
  4. The external auditor appointed by the shareholders

Explanation

The first line consists of operational management, who own and manage risk and operate the controls built into business processes. The second line provides oversight frameworks and compliance, the third line (internal audit) gives independent assurance, and external audit sits outside the model.

Question 3Fraud Risk Management and Prevention

Which of the following is a preventive anti-fraud control?

  1. Surprise cash counts at branch offices
  2. Monthly reconciliation of the bank account
  3. Segregation of duties for vendor payments Correct answer.
  4. Post-payment analytics for duplicate invoices

Explanation

Preventive controls stop the fraudulent act from occurring or being concealed in the first place, and segregation of duties does this by ensuring no single person can initiate and complete a transaction. Reconciliations, surprise counts and analytics detect wrongdoing after the fact.

Question 4Fraud Risk Management and Prevention

Which term describes the ethical climate established by an organization's leadership that signals fraud will not be tolerated?

  1. Tone at the top Correct answer.
  2. Control environment benchmarking
  3. Risk appetite calibration
  4. Fraud risk tolerance

Explanation

Tone at the top refers to the values, conduct and messages demonstrated by senior leadership, which form the core of the entity's control environment. An inconsistent or permissive tone undermines otherwise sound anti-fraud procedures.

Question 5Fraud Risk Management and Prevention

An organization scores each identified fraud scheme by multiplying estimated likelihood by estimated financial impact. What does this exercise produce?

  1. The board's documented fraud risk appetite
  2. The fraud risk universe of the organization
  3. A residual risk measure after controls
  4. An inherent risk score for prioritization Correct answer.

Explanation

Combining likelihood and impact produces a risk score that ranks fraud exposures so that limited resources are applied where exposure is greatest. The score relates to inherent risk because control effectiveness has not yet been factored in.

Question 6Fraud Risk Management and Prevention

A fraud risk register lists a scheme as high likelihood but low financial impact. What is the most appropriate management response?

  1. Escalate it as the top priority for immediate process redesign
  2. Transfer it fully to the insurer and close the entry
  3. Ignore it because the financial impact is low
  4. Apply low-cost detective controls and keep tracking it Correct answer.

Explanation

Priority follows the combined likelihood and impact score, so a frequent but low-value scheme warrants economical monitoring and detection rather than costly redesign or dismissal. The entry should remain on the register because exposure persists.

Question 7Fraud Risk Management and Prevention

Which feature best supports the effectiveness of a fraud reporting hotline?

  1. It is staffed by the reporting employee's direct supervisor
  2. It accepts only written reports signed by the reporter
  3. It sends each report to the employees named in it
  4. Independent operation, 24/7 availability, anonymous intake Correct answer.

Explanation

An effective reporting channel is independent of line management, always accessible, and allows anonymity, because fear of retaliation is the main reason employees stay silent. Operating the line independently protects both the reporter and the integrity of the information received.

Question 8Fraud Risk Management and Prevention

Why do mandatory vacation and job rotation policies help deter and detect fraud?

  1. Another person performs the task, exposing concealed manipulations Correct answer.
  2. They satisfy the segregation of duties requirement in every process
  3. They reduce the number of staff with general ledger access
  4. They let internal audit reduce the scope of its testing

Explanation

Schemes such as lapping or fictitious vendors usually depend on the perpetrator being continuously present to keep records consistent. Mandatory absence or rotation forces someone else to perform the work, which brings irregularities to light.

Question 9Fraud Risk Management and Prevention

The board of an organization formally states the level of fraud risk it is willing to accept in pursuit of its objectives. This statement is best described as:

  1. A fraud vulnerability assessment report
  2. A control self-assessment summary
  3. A fraud risk appetite statement Correct answer.
  4. A fraud risk register summary

Explanation

A fraud risk appetite statement records the amount and type of fraud risk the organization is prepared to tolerate, providing criteria against which exposures are judged. It guides which risks must be treated and which can be accepted.

Question 10Fraud Risk Management and Prevention

After approval controls are strengthened, the risk of duplicate payments falls from high to low. The remaining exposure is best described as:

  1. Residual fraud risk Correct answer.
  2. Control risk appetite
  3. Inherent fraud risk
  4. Detection risk tolerance

Explanation

Residual risk is what remains after the mitigating effect of controls has been taken into account. Inherent risk is the exposure before controls are considered, so the reduction illustrates the move from inherent to residual risk.

Question 11Fraud Risk Management and Prevention

Before onboarding a new supplier, a company verifies beneficial ownership and screens the entity against sanctions and adverse media lists. This activity is best described as:

  1. A continuous monitoring activity over vendors
  2. An inherent risk assessment
  3. A detective analytics procedure
  4. A third-party due diligence control Correct answer.

Explanation

Due diligence performed before a business relationship begins is a preventive control that establishes who the counterparty really is and whether it presents integrity concerns. It addresses risks such as fictitious vendors, conflicts of interest and prohibited parties.

Question 12Fraud Risk Management and Prevention

Which of the following is the strongest key risk indicator for procurement fraud?

  1. Purchase orders split below the bidding threshold Correct answer.
  2. Number of purchase orders raised each month
  3. Total procurement spend by category
  4. Average cycle time from requisition to payment

Explanation

A useful key risk indicator is measurable, linked to a specific fraud scheme, and reveals behavior consistent with that scheme. Orders repeatedly falling just under the competitive bidding threshold indicate deliberate splitting to avoid scrutiny.

Question 13Fraud Risk Management and Prevention

Surprise audits are valuable as an anti-fraud control primarily because they:

  1. they remove the need for an annual organization-wide fraud risk assessment
  2. they guarantee that every material fraud will be detected
  3. they occur unpredictably, so misconduct cannot be scheduled around them Correct answer.
  4. they transfer the cost of fraud losses to a third party

Explanation

Unpredictability raises perceived detection risk, which is a core deterrent, and prevents employees from arranging their activities around known review dates. Surprise testing also catches manipulations that routine procedures may miss.

Question 14Fraud Risk Management and Prevention

A procurement manager's spouse owns a company bidding on a contract. Under an effective conflict of interest program, the most appropriate action is to:

  1. wait until after the contract is awarded to inform compliance
  2. allow the bid if the price is the most competitive
  3. record the relationship in the vendor master file only
  4. require disclosure and remove the manager from the decision Correct answer.

Explanation

Conflicts of interest are managed through timely disclosure combined with recusal so the conflicted individual cannot influence the outcome. Documentation alone does not neutralize the risk of improper influence.

Question 15Fraud Risk Management and Prevention

Which analytics test would best identify possible ghost employees in a payroll?

  1. Reviewing the distribution of overtime hours by shift
  2. Comparing payroll headcount to budgeted headcount by department
  3. Recomputing tax withholdings for a sample of pay periods
  4. Matching payroll records to ID data and checking for duplicate bank accounts Correct answer.

Explanation

Ghost employees are fictitious or departed workers still on the payroll, often paid into accounts controlled by the perpetrator. Matching payroll records against independent identity data and looking for shared bank accounts targets precisely that scheme.

Question 16Fraud Risk Management and Prevention

The primary purpose of a gifts and hospitality policy in fraud risk management is to:

  1. maximize employee morale through permitted benefits
  2. ensure that every gift received is donated to charity
  3. prohibit all contact between staff and suppliers
  4. set thresholds and disclosure rules that limit improper influence Correct answer.

Explanation

A gifts and hospitality policy sets limits and disclosure requirements so that benefits received or given cannot improperly influence business decisions. It also creates a record that enables monitoring for unusual patterns.

Question 17Fraud Risk Management and Prevention

Which approach to a fraud risk assessment best identifies entity-specific exposures?

  1. Brainstorming schemes by process with owners and rating likelihood and impact Correct answer.
  2. Reviewing last year's internal audit findings only
  3. Interviewing only the finance director about previously reported issues
  4. Copying a generic industry fraud list without adapting it to the business

Explanation

A robust fraud risk assessment works scheme by scheme across the full risk universe, using facilitated workshops with the people who own the processes, then scores likelihood and impact. Engagement of process owners surfaces entity-specific vulnerabilities that generic lists or a single viewpoint will miss.

Question 18Fraud Risk Management and Prevention

Two employees who each hold separate approval rights collude to approve and pay a fictitious vendor. Which statement best describes the implication for the control framework?

  1. The fraud would have been prevented by annual ethics training
  2. Dual control should be removed because it gives false assurance
  3. Segregation of duties was adequate, so no control failure occurred
  4. Collusion can defeat segregation of duties, so supplementary analytics are needed Correct answer.

Explanation

Collusion allows individuals to overcome controls that rely on the separation of incompatible duties, so additional controls such as vendor master change monitoring, data analytics and independent review of the vendor list are required. This is why anti-fraud programs blend preventive controls with detection.

Question 19Fraud Risk Management and Prevention

Which control most directly addresses the risk of management override of internal controls?

  1. Dual signature requirements on payments above a fixed threshold
  2. Audit committee review of top-side journal entries Correct answer.
  3. Annual ethics acknowledgments signed by all employees
  4. Segregation of duties between the payment requestor and approver

Explanation

Management override typically operates through top-side entries, adjustments and estimates that sit above the process-level controls, so oversight by those charged with governance is required. Audit committee challenge of manual and period-end entries provides that independent layer.

Question 20Fraud Risk Management and Prevention

A small entity cannot afford full segregation of duties in its accounts payable function. What is the most appropriate risk-based response?

  1. Add compensating controls such as owner review and independent reconciliation Correct answer.
  2. Rely on employee honesty and document a rationale
  3. Accept the risk without documentation because the entity is small
  4. Outsource the entire payments function to an external provider

Explanation

Where full segregation is impractical, management implements compensating controls, such as owner review of payments and periodic independent reconciliation, and documents the rationale so residual risk stays within appetite. Controls are selected in proportion to risk and cost.

Question 21Fraud Risk Management and Prevention

What is the primary role of an anti-fraud code of conduct?

  1. Serving as the organization's fraud risk assessment methodology
  2. Replacing the need for controls over cash handling
  3. Setting expected behavior and a basis for reporting improper requests Correct answer.
  4. Guaranteeing prosecution of employees who commit fraud

Explanation

A code of conduct communicates the standards expected of employees and gives them a legitimate basis to refuse and report improper requests and pressures. It shapes culture but operates alongside, not instead of, control activities.

Question 22Fraud Risk Management and Prevention

Pre-employment background screening reduces fraud risk because it:

  1. acts as a substitute for segregation of duties
  2. helps screen out candidates with falsified credentials or fraud history Correct answer.
  3. detects fraud that has already been committed inside the organization
  4. removes the need for probationary performance reviews

Explanation

Screening verifies identity, qualifications and relevant history before access is granted, which is a preventive control applied at the hiring stage. It reduces the chance that a person with a demonstrated pattern of dishonesty is placed in a position of trust.

Question 23Fraud Risk Management and Prevention

Which statement best describes the purpose of organization-wide fraud awareness training?

  1. It replaces the need for a whistleblower hotline
  2. It is limited to the finance and procurement departments
  3. It teaches staff to recognize red flags and how to report concerns Correct answer.
  4. It is delivered once to new hires only

Explanation

Fraud awareness training equips employees to notice warning signs in their own areas and to use the reporting channels available to them. Coverage should extend across the organization, not only to functions that handle money.

Question 24Fraud Risk Management and Prevention

Requiring two authorized signatures on payments above a set amount is an example of:

  1. a two-person preventive control Correct answer.
  2. a corrective control
  3. a key risk indicator
  4. a detective analytics control

Explanation

Dual control requires two people to act together before a transaction can proceed, making it a preventive control because it stops unauthorized payments from being made. It reduces the opportunity element of the fraud triangle at the point of transaction.

Question 25Fraud Risk Management and Prevention

Which reporting arrangement best supports board oversight of fraud risk?

  1. A periodic fraud risk report to the audit committee on exposures and incidents Correct answer.
  2. An annual verbal update to the full board from the chief executive
  3. Routine circulation of open investigation case files to all department heads
  4. Reporting to the board only when an individual loss exceeds the deductible

Explanation

Oversight requires regular, structured reporting to those charged with governance covering risk assessments, control gaps, loss trends and investigation outcomes. This allows the audit committee to challenge management and direct remediation.

Question 26Fraud Risk Management and Prevention

The fraud triangle describes the conditions that are typically present when an occupational fraud occurs. Which set of conditions does it identify?

  1. Incentive, detection, and remediation
  2. Collusion, concealment, and conversion
  3. Opportunity, collusion, and conversion
  4. Pressure, opportunity, and rationalization Correct answer.

Explanation

The fraud triangle consists of a non-shareable financial pressure or incentive, an opportunity created by weak controls, and a rationalization that lets the person justify the act. All three are generally needed before a person commits fraud.

Question 27Fraud Risk Management and Prevention

How does a fraud prevention control differ from a fraud detection control?

  1. Prevention controls are applied only after an incident is confirmed.
  2. Prevention controls are performed by internal audit; detection controls by management.
  3. Prevention stops fraud before it occurs; detection finds it afterwards. Correct answer.
  4. Prevention controls rely on data analytics; detection controls rely on policy.

Explanation

The distinction between prevention and detection is one of timing. Prevention controls, such as segregation of duties or approval limits, are designed to stop a fraudulent act from happening, while detection controls, such as reconciliations and analytics, identify activity that has already occurred.

Question 28Fraud Risk Management and Prevention

Which observation is the clearest employee-level red flag for fraud?

  1. The employee submits timesheets on schedule.
  2. The employee's spending exceeds their salary. Correct answer.
  3. The employee regularly volunteers for optional training courses.
  4. The employee asks to move to another department.

Explanation

Living beyond one's means is a classic behavioral red flag because it suggests income from an unexplained source. A red flag does not prove fraud, but it indicates where closer examination is justified.

Question 29Fraud Risk Management and Prevention

An organization wants a pre-approved, documented approach for how it will investigate and resolve a suspected fraud. Which document serves this purpose?

  1. The gifts and hospitality policy
  2. The external audit engagement letter
  3. The fraud incident response plan Correct answer.
  4. The enterprise risk register

Explanation

A fraud incident response plan sets out in advance who investigates, how evidence is preserved, when legal counsel or law enforcement is involved, and how findings are communicated. Preparing it before an event avoids improvised decisions during a crisis.

Question 30Fraud Risk Management and Prevention

In the three lines of defense model, which group provides independent assurance over the effectiveness of an organization's fraud controls?

  1. The external auditor engaged for the financial statement audit
  2. Internal audit Correct answer.
  3. The compliance function embedded in operations
  4. The business units that own and operate the controls

Explanation

Operational management forms the first line, risk and compliance functions form the second line, and internal audit forms the third line, reporting independently to the board or audit committee. Internal audit assesses the design and operation of the fraud controls owned by the first and second lines.

Question 31Fraud Risk Management and Prevention

A supplier emails accounts payable asking to change its bank details and requests urgent payment to the new account. Which control is most effective at preventing loss?

  1. Matching the email domain in the request to the supplier's website address
  2. Requiring the request to be countersigned by the supplier's account manager
  3. Requiring the invoice to be approved by the buyer who placed the order
  4. Calling the supplier back on a previously verified number Correct answer.

Explanation

Independent, out-of-band verification uses contact details the organization already holds, so an attacker who has taken over the supplier's email cannot intercept the check. Any verification using information supplied in the suspicious request can be manipulated.

Question 32Fraud Risk Management and Prevention

Which advantage does continuous data monitoring provide over an annual fraud-focused audit?

  1. It can flag unusual transactions soon after they occur. Correct answer.
  2. It removes the need for management to assess fraud risk at all.
  3. It guarantees that fraudulent payments can never occur.
  4. It replaces the need for a whistleblowing channel.

Explanation

Continuous monitoring runs automated tests on transactions as they are processed, so exceptions surface within hours or days rather than months later. This shortens the period of loss and preserves evidence while it is still fresh.

Question 33Fraud Risk Management and Prevention

Over one month a plant manager raises twelve separate purchase orders of about $4,900 each to the same supplier. Competitive tendering is required for any single order of $5,000 or more. What risk does this pattern most likely indicate?

  1. Collusive bidding between the plant manager and the supplier
  2. Duplicate payment of the same supplier invoice
  3. Fictitious overtime claims by plant staff
  4. Splitting orders to avoid the bidding threshold Correct answer.

Explanation

Structuring purchases into amounts just below an approval or tendering threshold is a control-circumvention technique that keeps a favored supplier off competitive tender. The pattern is a red flag even if each individual order is legitimate.

Question 34Fraud Risk Management and Prevention

Which event most clearly justifies reassessing an organization's fraud risk profile?

  1. The annual revision of the employee handbook
  2. A one-off increase in the number of invoices processed in a month
  3. Entry into a new market with unfamiliar payment practices Correct answer.
  4. A routine renegotiation of the office cleaning contract

Explanation

Fraud risk assessments should be refreshed when circumstances change materially, such as new markets, products, systems, acquisitions, or payment methods, because these introduce new exposures and new opportunities. Routine administrative or volume changes rarely alter the fraud risk profile.

Question 35Fraud Risk Management and Prevention

Which test would most directly identify salaries that continue to be paid to people who have left the organization?

  1. Recalculating the employer's statutory contributions
  2. Reviewing whether all staff are paid by direct deposit
  3. Matching the payroll register to HR termination records Correct answer.
  4. Comparing payroll cost with budget

Explanation

Matching the live payroll register against HR termination dates isolates payments made to leavers, which should not exist. The test works because it compares the payment population with an independent record of who is actually employed.

Question 36Fraud Risk Management and Prevention

Senior managers routinely ignore the travel approval policy they are supposed to follow. What is the most likely consequence for the fraud control environment?

  1. The written policy becomes legally unenforceable.
  2. The risk of travel expense fraud is accepted and disappears.
  3. Internal audit no longer needs to test travel expenses.
  4. Employees conclude the controls are optional. Correct answer.

Explanation

The control environment is set by example, so leaders who disregard their own rules signal that controls are discretionary. Once staff believe compliance is optional, the deterrent effect of the policy collapses and misconduct becomes more likely.

Question 37Fraud Risk Management and Prevention

Which approach best evaluates whether an anti-fraud culture is actually working in practice?

  1. Confirming the code of conduct is on the intranet
  2. Counting the number of fraud training sessions delivered
  3. Comparing survey results with reporting and disciplinary data Correct answer.
  4. Reviewing the organizational chart for clearly defined reporting lines

Explanation

Culture is evidenced by behavior rather than by documents or activity counts. Combining perception data with hard indicators such as reporting rates, investigation outcomes, and disciplinary actions gives a rounded view of whether policies are believed and used.

Question 38Fraud Risk Management and Prevention

Which limitation most constrains the use of Benford's law in fraud detection?

  1. It can be applied only to payroll transactions.
  2. It is valid only where the population contains fewer than one hundred transactions.
  3. It needs large sets of naturally generated numbers and is only an indicator. Correct answer.
  4. It requires the investigator to obtain a confession before it can be used.

Explanation

Benford's law describes the expected distribution of leading digits in naturally occurring data, so it requires a sufficiently large population and does not apply to assigned or sequential numbers. A deviation is a red flag that directs further work; it is never proof of fraud on its own.

Question 39Fraud Risk Management and Prevention

Why is transaction sampling a weak primary control for detecting fraud?

  1. Samples always overstate the error rate found in a population.
  2. Sampling can be performed only on paper-based accounting records.
  3. Regulators prohibit sampling over payroll and procurement transactions.
  4. Fraud is rare and concealed, so a sample seldom contains it. Correct answer.

Explanation

Sampling gives reasonable assurance about populations of routine, homogeneous items, but fraud is deliberate and designed to avoid detection, usually affecting very few transactions. That is why full-population analytics are preferred as a fraud detection technique, with sampling used for other assurance purposes.

Question 40Fraud Risk Management and Prevention

A sales team is paid bonuses based solely on reported revenue, with no clawback or quality review. Which fraud risk does this create?

  1. A lower likelihood of management override of controls
  2. Reduced opportunity for collusion with suppliers
  3. Pressure to record revenue early or fabricate sales Correct answer.
  4. A heightened risk of ghost employees in the payroll system

Explanation

Compensation tied exclusively to a single reported number creates a strong incentive, or pressure, to inflate or accelerate that number, such as recognizing revenue before it is earned or recording fictitious sales. Balanced measures, clawbacks, and quality review reduce this pressure.

Question 41Fraud Detection and Data Analytics

Under Benford's Law, approximately what share of naturally occurring financial amounts should begin with the digit 1?

  1. About 12 percent
  2. About 30 percent Correct answer.
  3. About 5 percent
  4. About 18 percent

Explanation

Benford's Law predicts a logarithmic distribution of leading digits in naturally occurring data sets, with digit 1 appearing roughly 30.1 percent of the time. The frequency declines steadily through digit 9, which appears about 4.6 percent of the time. This expected pattern gives examiners a benchmark against which to compare actual transaction data.

Question 42Fraud Detection and Data Analytics

Fraud detection differs from fraud prevention mainly because detection activities are:

  1. Focused exclusively on employee training
  2. Designed to stop misconduct before it happens
  3. Required only in publicly listed companies
  4. Performed after a scheme has already occurred Correct answer.

Explanation

Prevention aims to stop fraud from occurring at all, through controls such as segregation of duties and authorisation limits. Detection accepts that some schemes will occur and seeks to uncover them as early as possible through analytics, tips, audits and monitoring. The two are complementary but operate at different points in the fraud timeline.

Question 43Fraud Detection and Data Analytics

Studies of occupational fraud consistently find that the most common initial detection method is:

  1. Internal audit reviews of controls
  2. Tips from employees and others Correct answer.
  3. External audits by accounting firms
  4. Reconciliation of bank accounts

Explanation

Tips, whether from employees, customers, vendors or anonymous sources, are repeatedly reported as the single most frequent way frauds come to light. This is why confidential reporting hotlines and whistleblower protection are core elements of a detection programme. Audits and reconciliations detect a much smaller proportion of cases.

Question 44Fraud Detection and Data Analytics

A red flag in a fraud context is best described as:

  1. Conclusive proof that fraud has occurred
  2. A control that prevents misappropriation
  3. A legal standard required for prosecution
  4. An indicator warranting further inquiry Correct answer.

Explanation

A red flag is a symptom, anomaly or condition that suggests something may be wrong and justifies additional scrutiny. It is not evidence of guilt and must be followed up with substantive procedures. Examiners use red flags to prioritise where to investigate.

Question 45Fraud Detection and Data Analytics

Duplicate testing in data analytics is designed primarily to identify:

  1. Payments recorded more than once in the data Correct answer.
  2. Sequences of missing cheque numbers
  3. Transactions falling outside normal ranges
  4. Vendors whose addresses match employee records

Explanation

Duplicate testing looks for records that repeat the same key attributes, such as invoice number, vendor, amount and date. It targets double payment of invoices and duplicated expense claims. The test is typically run before other analytics so that the rest of the analysis is not distorted.

Question 46Fraud Detection and Data Analytics

Computer-assisted audit techniques (CAATs) are best described as:

  1. Interviews conducted with suspected employees
  2. Software that analyses entire data populations Correct answer.
  3. Manual vouching of individually selected documents
  4. Physical inspections of inventory counts

Explanation

CAATs are technology-based tools that let an examiner interrogate complete data sets rather than samples. They include data extraction, query and analysis software used for tests such as duplicates, gaps and outliers. Their key advantage is coverage of the full population at relatively low incremental cost.

Question 47Fraud Detection and Data Analytics

An exception report is designed to:

  1. List every transaction processed during a period
  2. Highlight items that fall outside defined criteria Correct answer.
  3. Replace the need for substantive audit testing
  4. Summarise the financial statements for management

Explanation

Exception reporting applies predefined criteria, such as thresholds, limits or business rules, and outputs only those items that breach them. This concentrates review effort on anomalous transactions instead of the whole population. The criteria must be set carefully so the report is neither overloaded nor incomplete.

Question 48Fraud Detection and Data Analytics

Gap testing would most likely reveal:

  1. An employee who never takes annual leave
  2. Unusually large round-number payments
  3. A vendor sharing a bank account with staff
  4. Missing cheque numbers in a sequence Correct answer.

Explanation

Gap testing looks for breaks in a sequence of documents or transactions, such as cheque, invoice or receipt numbers that should be consecutive but are not. A missing number may indicate a destroyed or diverted document. The technique depends on the numbers being issued sequentially without legitimate voids.

Question 49Fraud Detection and Data Analytics

Which data set would be the most appropriate to test using Benford's Law?

  1. Fixed asset identification codes
  2. Sequentially assigned purchase order numbers
  3. Customer telephone numbers held in a database
  4. Amounts paid to vendors for goods and services Correct answer.

Explanation

Benford's Law applies to naturally occurring numerical data that spans several orders of magnitude without artificial limits, such as payment amounts, expense claims and sales figures. Assigned identifiers and free-form numbers do not follow the expected logarithmic pattern. Applying the test to coded or sequential fields produces meaningless results.

Question 50Fraud Detection and Data Analytics

An analyst wants to find vendors whose names are spelled slightly differently but may be the same entity. The most suitable technique is:

  1. Fuzzy matching of vendor names Correct answer.
  2. Gap testing of payment numbers
  3. Stratification of invoice amounts
  4. Trend analysis of monthly totals

Explanation

Fuzzy matching compares strings using similarity algorithms so that near-identical names, such as minor spelling variants or abbreviations, are flagged as potential matches. It is widely used for vendor, employee and address de-duplication. Exact matching would miss these variants entirely.