CPFA common mistakes
CPFA · Understand the traps and how to avoid them.
Treating the ACPFA Institute program structure as one undifferentiated body of knowledge, so the candidate cannot say which body issues the credential, which body administers the exam, and which body handles recertification when a scenario question asks about accountability for a lapse.
Candidates study topic content hard and skim the program-governance material at the front of the syllabus because it feels administrative rather than technical. Under time pressure they collapse 'the Institute', 'the certifying body', and 'the local chapter or employer' into a single actor.
What to do instead
Build a one-page actor map before studying anything else: list each entity named in the program materials, its role (standards setting, exam administration, credential maintenance, discipline), and one sentence on what it does not do. Rehearse it by writing three short scenario answers from memory, each naming the responsible actor explicitly.
Assuming the credential is permanent once earned and answering recertification questions as if only a single renewal fee and a single deadline exist, missing that continuing-education hours, a code-of-ethics attestation, and a defined grace or lapse process are separate requirements.
Many professional credentials in adjacent fields renew on a simple fee cycle, so candidates import that mental model. Program materials that list requirements in separate sections reinforce the impression that they are alternatives rather than cumulative conditions.
What to do instead
Draw the recertification cycle as a checklist with three columns: requirement, evidence the candidate must retain, and deadline relative to the cycle end. Then answer practice questions by ticking each column aloud. Pay particular attention to what happens after a lapse and whether reinstatement differs from renewal.
Writing an investment policy statement that lists permitted asset classes but omits the objective, time horizon, risk tolerance, liquidity needs, and the review-and-amendment procedure, then defending it as complete because every asset class appears.
Candidates anchor on the visible, concrete part of a policy, the permitted investments, because it is the easiest to enumerate. The governance clauses feel like boilerplate and get compressed into a sentence or dropped entirely.
What to do instead
Memorize a fixed IPS skeleton of seven headings: purpose and scope, roles and delegated authority, objectives and constraints, permitted and prohibited investments, diversification and concentration limits, monitoring and reporting, review and amendment. For any policy question, check the answer against all seven headings and mark which are missing.
Counting and reconciling cash at the end of a shift without an independent second count, or allowing the same person who received the cash to perform the deposit reconciliation, and then describing this as efficient rather than as a control deficiency.
Candidates evaluate cash procedures on speed and convenience rather than on segregation of duties. In small teams where one person genuinely does everything, the candidate rationalizes the practice instead of identifying the compensating control that should exist.
What to do instead
Apply the two-question test to every cash scenario: who has custody, and who verifies? If the same person appears on both sides, the answer must name a deficiency plus a compensating control such as dual count, manager review of the reconciliation, or surprise audits. Practice by rewriting flawed procedures into compliant ones.
Treating fraud detection as a single annual audit event rather than a continuous set of red flags, so the candidate fails questions that hinge on recognizing behavioural and documentary warning signs such as an employee who never takes leave, lifestyle changes, duplicate vendor addresses, or adjusting entries made just below a review threshold.
Audit-focused training conditions candidates to think in terms of periodic testing. Red flags are also scattered across many small details rather than presented as a list, so they are easy to overlook when reading a scenario quickly.
What to do instead
Keep a running red-flag register organized by category (behavioural, documentary, financial, access-related) and add to it after every practice question you miss. When reading a scenario, scan the register explicitly before choosing an answer, and note which flag the question is testing.
Selecting the strongest-sounding response to a fraud scenario, such as immediately terminating the suspected employee or calling law enforcement, instead of the correct sequence of preserving evidence, escalating internally, and investigating before acting.
Candidates answer from a moral instinct that wrongdoing should be punished quickly, and the most punitive option reads as the most decisive. They also underestimate how premature confrontation destroys documentary and testimonial evidence.
What to do instead
Memorize the investigation sequence as a numbered chain: detect, document and preserve, escalate to the designated authority, investigate discreetly, decide on action, remediate the control. For any response-sequencing question, ask which step the option represents and reject options that skip ahead in the chain.
Confusing preventive controls with detective controls and choosing a detective control, such as a monthly bank reconciliation, when the scenario asks how to stop an error or loss from occurring in the first place.
Both control types are described in similar language and both sound protective. Candidates remember the control's name but not its position in the timeline relative to the transaction.
What to do instead
Classify every control you study into preventive (approval, authorization limits, segregation, physical safeguards, system access rules) or detective (reconciliation, exception report, audit, surprise count). Then answer by first identifying where in the transaction timeline the question sits, before looking at the options.
Treating a documented policy as proof that a control operates effectively, so the candidate accepts 'the organization has a written procedure' as sufficient evidence and misses that testing, monitoring, and exception follow-up are what demonstrate operating effectiveness.
Policy documents are tangible and easy to cite, while operating effectiveness requires evidence of testing that the scenario often omits. Candidates reward the presence of documentation instead of noticing its absence of corroboration.
What to do instead
Adopt the design-versus-operation distinction as a reflex: for every control described, ask whether the question is about how it is designed or whether it actually worked. If the scenario offers only a policy with no test results, sample evidence, or exception log, treat the control as unproven and say so.
Handling a customer complaint by explaining the organization's policy and internal constraints rather than acknowledging the customer's experience, taking ownership, and stating a concrete next step and timeframe.
Candidates with operational or audit backgrounds default to policy accuracy and defensiveness. Exam scenarios reward resolution behaviours, so a technically correct policy explanation reads as the safe answer when it is actually the failing one.
What to do instead
Use a four-part response template for every service scenario: acknowledge the specific problem, take ownership without blaming another department, state the concrete action and the timeframe, and confirm what the customer should expect next. Score each option against all four parts and eliminate any that lead with policy justification.
Escalating a routine customer service issue to a supervisor or compliance function as the first move, or conversely promising an outcome the front line has no authority to guarantee, instead of matching the response to the actual level of authority required.
Candidates fear giving a wrong answer on a regulated topic, so escalation feels safest. Others overcorrect toward customer satisfaction and commit to refunds, fee waivers, or exceptions that require approval, which is itself a control breach.
What to do instead
For every service scenario, name the decision rights involved before choosing: what can the front line decide, what needs a supervisor, and what needs compliance or a formal exception. Reject options that escalate matters the role can resolve and reject options that promise outcomes outside the role's authority.