CFBE common mistakes
CFBE · Understand the traps and how to avoid them.
When asked to design a fraud risk governance program, the candidate lists controls (hotline, code of ethics, training) without first establishing the governance structure: board or audit committee oversight, a designated fraud risk owner, a written fraud risk management policy, and a reporting line independent of management.
Candidates memorize control activities from COSO-style frameworks and jump straight to 'what we do' rather than 'who is accountable and how is it governed.' Exam questions asking for 'program design' or 'governance framework' are testing the tone-at-the-top and accountability layer, which is logically prior to control activities.
What to do instead
Answer governance questions in layers: (1) oversight body and its charter, (2) fraud risk policy and appetite statement, (3) roles and responsibilities including a fraud risk owner and independent reporting, (4) control activities, (5) monitoring and reporting. If the question asks for 'design' or 'program,' start at layer 1 and explicitly connect each control to an accountable owner.
On fraud risk assessment questions, the candidate treats the assessment as a one-time compliance exercise and fails to specify that risks must be scored on both likelihood and impact, refreshed when the business, systems, or third parties change, and linked to the control inventory so each significant risk maps to a mitigating control.
Many candidates have seen risk registers as static documents completed annually for auditors. Exam scenarios describing a new payment system, acquisition, or remote-work arrangement are testing whether the candidate recognizes a trigger for reassessment and the need for a risk-to-control mapping.
What to do instead
For any risk assessment question, state the method (inherent risk scored on likelihood and impact, residual risk after controls), the refresh triggers (new systems, new vendors, organizational change, fraud incidents, regulatory change), and the output (a risk register with each significant risk linked to specific controls and an owner). When a scenario introduces change, say explicitly that the assessment must be updated.
When asked to identify a segregation-of-duties conflict, the candidate names the two conflicting duties but stops there, without stating the compensating control (e.g., independent review, system-enforced approval, mandatory rotation) or explaining why the conflict creates a fraud opportunity.
Candidates often recognize the classic incompatible pair (custody and recordkeeping, authorization and reconciliation) but treat the question as a vocabulary test. Exam questions frequently ask for the best remediation or the reason the conflict matters, and a bare identification earns partial credit at best.
What to do instead
Structure every SoD answer in three parts: (1) name the incompatible functions and the specific fraud scheme they enable (e.g., same person creates vendor and approves payment enables fictitious vendor fraud), (2) state the remediation-separate the duties or, if impractical, apply a compensating control such as independent reconciliation or system-enforced dual approval, (3) note residual risk and monitoring. Practice writing this three-part answer for cash, procurement, payroll, and journal-entry scenarios.
On financial statement fraud questions, the candidate identifies revenue recognition manipulation but cannot name the specific technique (e.g., channel stuffing, bill-and-hold, round-tripping, premature recognition, holding the books open) or the red flag that would reveal it in the data (e.g., days sales outstanding rising faster than revenue, returns spiking after period end, unusual related-party sales).
Candidates study fraud at the level of category labels rather than mechanics. Exam questions often describe a pattern-revenue growth while cash flow declines, or a large fourth-quarter spike-and ask what scheme it suggests and what evidence would confirm it.
What to do instead
Build a scheme-to-red-flag table: for each revenue manipulation technique, list the journal-entry or ratio signature (e.g., bill-and-hold: sales with no corresponding cost of goods or shipping activity near period end; channel stuffing: rising DSO and post-period returns; round-tripping: matched purchases and sales with related parties). Practice reading a short fact pattern and naming both the technique and the corroborating evidence.
On asset misappropriation questions involving cash, the candidate recommends a generic control such as 'segregate duties' or 'implement a whistleblower hotline' instead of the control specific to the scheme described-for example, for skimming, surprise deposits and independent comparison of receipts to bank deposits; for lapping, mandatory vacation and rotation plus independent reconciliation of receivables; for register disbursement fraud, void and refund review.
Candidates default to broad framework language because it is safe and easy to recall. Exam scenarios are written so that the correct answer is the control that directly addresses the described scheme, and generic answers are usually distractors.
What to do instead
Memorize scheme-to-control pairs for the major cash schemes: skimming (compare sales records to deposits, surprise counts), cash larceny (daily deposit reconciliation by an independent person), lapping (rotation, mandatory vacation, customer confirmation), register disbursements (void/refund approval and review), check tampering (positive pay, dual signatures, review of voided checks). When you see a scheme in the stem, name the matching control before considering any generic option.
On procurement and vendor fraud questions, the candidate fails to distinguish the roles that must be separate in the procure-to-pay cycle-requisitioner, purchaser, receiver, invoice approver, and payment releaser-and therefore misses conflicts such as a buyer who can also set up vendors in the master file.
The procurement cycle has more distinct roles than the cash cycle, and candidates collapse them into 'purchasing' and 'payables.' Exam questions introduce a scenario where one person holds two adjacent roles and ask what fraud is enabled.
What to do instead
Draw the procure-to-pay chain as five boxes: requisition, purchase order, receipt of goods, invoice approval, payment. Then note the master-data role (vendor setup and bank-detail changes) as a sixth, high-risk function. For any scenario, place each named person in a box and look for a person occupying two boxes or the master-data role combined with any transaction role. State the enabled scheme (e.g., buyer who also sets up vendors enables fictitious vendors or bank-detail diversion).
On bribery and conflicts-of-interest questions, the candidate treats a conflict of interest as automatically illegal or, conversely, treats an undisclosed conflict as harmless because no money changed hands, and therefore misstates the required action (disclosure, recusal, or investigation) and the relevant red flags (undisclosed relationships, unusual gifts, vendor ownership by employees).
The legal and ethical lines differ: a conflict of interest is a situation requiring disclosure and management, not necessarily a crime, while bribery requires an intent element and often crosses borders with different laws (e.g., FCPA, UK Bribery Act). Candidates conflate the two or apply domestic assumptions to cross-border scenarios.
What to do instead
Separate the concepts: conflict of interest = private interest that could influence judgment; the control is disclosure, recusal, and monitoring. Bribery = offering or receiving something of value to influence an official act; the control is due diligence, gift and hospitality limits, third-party (agent) risk assessment, and books-and-records accuracy. For cross-border questions, check whether the scenario implicates a law with extraterritorial reach and whether facilitation payments are permitted under the applicable statute.
On cyber fraud, payment systems, and identity theft questions, the candidate recommends a control that addresses the symptom (e.g., 'train employees on phishing') rather than the control that prevents the specific loss described (e.g., out-of-band verification of payment-instruction changes, dual approval for bank-detail changes, transaction limits, and reconciliation of payment files to the general ledger).
Awareness training is memorable and often correct in general-security exams, but CFBE-style questions describe a business email compromise or account-takeover scenario and ask for the control that would have stopped the transfer. Training alone does not stop a fraudulent payment instruction.
What to do instead
For payment-fraud scenarios, apply the 'verify the change, verify the payee, verify the amount' rule: any change to vendor bank details requires independent out-of-band confirmation with a known contact, not a reply to the email; payments above a threshold require dual approval; payment files are reconciled to the ledger by someone outside the payment process. For identity theft, distinguish authentication (who is the customer) from authorization (what may they do) and name the control at each step.
During investigation and interviewing questions, the candidate describes an interrogation-style approach-confronting the suspect early, revealing all evidence, or conducting the interview before securing documentary evidence-rather than planning the interview sequence (witnesses first, subject last), establishing baseline behavior, and using non-accusatory questioning to elicit information before presenting evidence.
Candidates draw on popular portrayals of investigations and on the idea that obtaining a confession is the goal. Exam questions test procedural fairness, evidence integrity, and the order of investigative steps, and an aggressive approach is usually a distractor.
What to do instead
Memorize the investigation sequence: secure and preserve evidence (including chain of custody and forensic images) before interviews; interview witnesses and corroborating parties before the subject; in the subject interview, start with non-accusatory background questions, establish the subject's account, then introduce evidence incrementally to test consistency. State that the goal is a complete and admissible factual record, not a confession, and note the need for caution and voluntariness.
On evidence questions, the candidate describes evidence collection without addressing admissibility and chain of custody-for example, recommending that the investigator print emails or copy files directly rather than preserving forensic images with documented hash values and a custody log.
Candidates focus on what evidence shows rather than how it is preserved. Exam questions about digital evidence, employee interviews, or disciplinary hearings test whether the candidate knows that mishandled evidence can be excluded or challenged, and that the investigator's own documentation is part of the record.
What to do instead
For any evidence question, state four points: (1) preservation method appropriate to the medium (forensic image for devices, original documents for paper), (2) integrity verification (hash value, dated photograph, sealed container), (3) chain-of-custody log with every transfer signed and dated, and (4) admissibility considerations (relevance, authenticity, hearsay exceptions, privilege). Apply the same discipline to interview notes: contemporaneous, signed, and retained.