I85PREP
⌘ K
CFBE study materials
CFBE study resources

CFBE practice questions

One question at a time. Build your CFBE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fraud Risk Governance and Program Design

An organization is drafting its first fraud risk management program and wants a structure that separates oversight, risk assessment, prevention, detection, and investigation into distinct but linked components. Which framework is most commonly used as the organizing reference for such a program?

  1. The ISO 9001 quality management standard, which governs process consistency
  2. The Basel III capital adequacy accord, which sets minimum bank capital ratios
  3. The COSO fraud risk management guide, which builds on the internal control framework Correct answer.
  4. The NIST cybersecurity framework, which organizes controls by security function

Explanation

The COSO fraud risk management guide is the widely adopted reference that organizes a program around governance, risk assessment, preventive and detective controls, and investigation and corrective action. It extends the COSO internal control framework specifically to fraud. The other frameworks address capital, quality, or cybersecurity and do not provide a fraud program structure.

Question 2Fraud Risk Governance and Program Design

A board asks why the fraud risk management program needs an explicit governance layer rather than only a set of operational controls. What is the primary purpose of the governance layer?

  1. To replace the external audit function with an internal fraud committee
  2. To assign accountability, set tone at the top, and define oversight responsibilities for fraud risk Correct answer.
  3. To calculate the organization's insurance premiums for fidelity coverage
  4. To guarantee that no fraudulent transaction can ever be processed by the organization

Explanation

Governance establishes who owns fraud risk, how oversight is exercised, and the ethical tone set by leadership, which determines whether controls are respected. Controls alone fail without clear accountability and direction. Governance does not eliminate fraud, substitute for external audit, or price insurance.

Question 3Fraud Risk Governance and Program Design

In a fraud risk governance structure, which body typically holds ultimate accountability for the organization's fraud risk appetite and program oversight?

  1. The external audit firm engaged for the financial statement audit
  2. The accounts payable processing team
  3. The information technology service desk
  4. The board of directors or a delegated board committee Correct answer.

Explanation

Ultimate accountability for risk appetite and program oversight rests with the board or a committee to which it delegates, such as an audit or risk committee. Operational teams execute controls but do not own enterprise-level risk appetite. External auditors provide assurance and are not part of management's governance structure.

Question 4Fraud Risk Governance and Program Design

A fraud risk assessment team is building its risk inventory. Which approach best supports a defensible, comprehensive assessment?

  1. Relying solely on last year's internal audit findings and closing any gaps they identified
  2. Adopting the risk list from a peer organization without modification
  3. Combining interviews, process walkthroughs, data analytics, and industry fraud schemes into a structured risk register Correct answer.
  4. Asking each department head to confirm in writing that no fraud risk exists in their area

Explanation

A credible fraud risk assessment triangulates multiple sources, including interviews, process understanding, data analysis, and known schemes for the industry, and records results in a structured register. Single-source approaches miss risks that no prior audit or self-certification would surface. Copying another organization's list ignores differences in processes and exposure.

Question 5Fraud Risk Governance and Program Design

When scoring fraud risks, an assessment team rates inherent risk before considering controls and then rates residual risk after controls. What is the main benefit of capturing both ratings?

  1. It shows how much risk remains after mitigation and highlights where controls are insufficient Correct answer.
  2. It allows the team to skip the risk inventory in future assessment cycles
  3. It removes the need to test whether the controls actually operate as designed
  4. It converts all fraud risks into a single financial statement line item

Explanation

Comparing inherent and residual ratings reveals the effect of the control environment and exposes exposures that remain unacceptably high. Residual risk above appetite signals a need for additional controls or acceptance decisions. It does not eliminate control testing or replace the risk inventory.

Question 6Fraud Risk Governance and Program Design

An organization wants to reduce opportunity for fraud by segregating duties in its procurement process. Which pairing of duties creates the clearest segregation-of-duties conflict?

  1. One employee maintains the vendor master and a different employee reconciles the bank account
  2. One employee drafts the purchase requisition and a different employee approves it
  3. One employee receives goods and a different employee records the receipt in the system
  4. The same employee approves a vendor and also processes payments to that vendor Correct answer.

Explanation

Approving a vendor and also releasing payments gives one person the ability to create a fictitious vendor and pay it, which is a classic incompatible combination. The other pairings separate initiation, approval, custody, and reconciliation, which is the intended design. Segregation of duties targets combinations that let one person conceal a fraudulent act.

Question 7Fraud Risk Governance and Program Design

A company introduces a policy requiring dual authorization for wire transfers above a threshold. Which category of control does this represent?

  1. A purely corrective control applied after funds have left the account
  2. A preventive detective hybrid that stops unauthorized disbursements before they occur Correct answer.
  3. A compensating control that replaces the need for reconciliation
  4. A governance control that sets the enterprise risk appetite

Explanation

Dual authorization is primarily preventive because it blocks a transfer until a second approver acts, though the approval log also supports later detection. Corrective controls operate after an event, and reconciliation remains necessary regardless. Setting risk appetite is a governance act, not a transaction control.

Question 8Fraud Risk Governance and Program Design

A fraud detection program relies on exception reports. Which design choice most improves the likelihood that the reports actually surface fraudulent activity?

  1. Running the reports annually to limit the volume of items reviewed
  2. Setting thresholds so high that only the largest transactions appear
  3. Defining thresholds from known fraud scenarios and assigning named owners to review and clear exceptions Correct answer.
  4. Sending reports to a shared mailbox with no assigned reviewer

Explanation

Detection reports work when thresholds reflect realistic fraud scenarios and each exception has an accountable reviewer who documents resolution. Infrequent runs, unowned mailboxes, and overly high thresholds let fraudulent items pass unreviewed. Detection value depends on both report design and the discipline of follow-up.

Question 9Fraud Risk Governance and Program Design

Management is deciding how to respond to a residual fraud risk that exceeds appetite in a low-value, high-frequency process. Which response is most consistent with a risk-based program?

  1. Transfer the entire risk to the internal audit function
  2. Add a cost-effective monitoring control and document the decision to accept any remaining exposure Correct answer.
  3. Ignore the exposure because the individual transaction values are small
  4. Terminate the business process entirely to eliminate the risk

Explanation

Risk responses should be proportionate, so a low-value exposure is typically addressed with monitoring and a documented acceptance of residual risk within delegated authority. Eliminating the process is disproportionate, ignoring the risk is not a response, and internal audit provides assurance rather than owning management risk.

Question 10Fraud Risk Governance and Program Design

Which statement best describes the role of a fraud risk owner in a mature program?

  1. The external auditor responsible for expressing an opinion on the financial statements
  2. A named manager accountable for monitoring a specific fraud risk and ensuring controls operate Correct answer.
  3. The vendor that supplies the organization's monitoring software
  4. The whistleblower who reports a suspected scheme through the hotline

Explanation

A risk owner is a named manager who understands a specific risk, monitors it, and ensures the associated controls function and are updated. This accountability is central to making the risk register actionable. Auditors, reporters, and vendors have different roles and do not own management's risk.

Question 11Fraud Risk Governance and Program Design

An organization is establishing a whistleblower hotline. Which design feature most supports its effectiveness as a fraud detection channel?

  1. Routing all reports first to the line manager named in the complaint
  2. Limiting reports to issues that can be proven before submission
  3. Independently operated reporting with anonymity options and a documented triage and escalation process Correct answer.
  4. Publicizing the hotline only in the annual financial statements

Explanation

Effective hotlines are independently administered, allow anonymous reporting, and follow a defined triage and escalation path so reports reach the right investigators. Routing complaints to the accused manager, requiring proof at intake, or minimal publicity suppresses reporting and undermines the channel.

Question 12Fraud Risk Governance and Program Design

A fraud risk management program wants to measure whether its awareness training is changing behavior rather than just attendance. Which metric best reflects behavioral impact?

  1. The number of employees who completed the training module
  2. The total hours of training content produced
  3. Trends in hotline reports and phishing simulation failure rates over time Correct answer.
  4. The budget spent on the learning management system

Explanation

Behavioral impact is shown by outcomes such as report volume and quality and by how employees respond to simulated fraud attempts. Completion counts, content hours, and system spend measure activity or cost, not whether behavior changed. Program metrics should tie to fraud outcomes.

Question 13Fraud Risk Governance and Program Design

Which element is essential to a fraud risk management policy for it to be enforceable and useful?

  1. A list of every employee's personal financial disclosures
  2. A statement that the policy overrides local law where they conflict
  3. A guarantee that the policy will prevent all fraud
  4. Clearly defined prohibited conduct, responsibilities, and consequences approved at the appropriate authority level Correct answer.

Explanation

An enforceable policy defines prohibited conduct, assigns responsibilities, states consequences, and is approved by the appropriate authority so it carries weight. Personal financial disclosures are a separate control, no policy can guarantee prevention, and a policy cannot override applicable law.

Question 14Fraud Risk Governance and Program Design

A fraud risk assessment identifies that a subsidiary's expense reimbursement process has no receipt requirement and no manager review. Which classification best fits these conditions?

  1. A control deficiency that increases inherent fraud opportunity Correct answer.
  2. A residual risk that has already been fully mitigated
  3. A governance failure caused by the board's risk appetite statement
  4. A detection control operating as designed

Explanation

Missing receipts and absent review are gaps in the control environment that raise the opportunity for fraudulent claims. They are control deficiencies rather than mitigated risk, and they are not caused by the risk appetite statement. A detection control cannot be operating as designed when no review occurs.

Question 15Fraud Risk Governance and Program Design

Which factor is most important when prioritizing which fraud risks to address first in a program's implementation plan?

  1. The combination of likelihood and impact relative to the organization's risk appetite Correct answer.
  2. The alphabetical order of the departments involved
  3. The seniority of the manager who raised the risk
  4. The age of the software used in the affected process

Explanation

Prioritization should reflect likelihood and impact against risk appetite so that the greatest exposures are addressed first. Alphabetical ordering, the seniority of the person raising an issue, and the age of software are not measures of fraud exposure. A risk-based sequence directs limited resources effectively.

Question 16Fraud Risk Governance and Program Design

A chief audit executive reports functionally to the audit committee and administratively to the chief executive. Why does this reporting structure matter for fraud risk governance?

  1. It guarantees that all fraud will be detected by internal audit
  2. It allows internal audit to set the fraud risk appetite on behalf of the board
  3. It removes the need for management to own fraud controls
  4. It preserves the independence needed to report fraud findings objectively to those charged with governance Correct answer.

Explanation

Functional reporting to the audit committee protects internal audit's independence so it can escalate fraud findings without management filtering. Internal audit does not set risk appetite, does not relieve management of control ownership, and cannot guarantee detection. Independence is what makes assurance credible.

Question 17Fraud Risk Governance and Program Design

Which of the following best describes the concept of tone at the top in a fraud risk management program?

  1. The frequency with which executives travel to regional offices
  2. Leadership's demonstrated commitment to integrity and ethical conduct that shapes employee behavior Correct answer.
  3. The physical layout of the executive floor of the head office
  4. The wording used in the organization's marketing materials

Explanation

Tone at the top reflects how leaders visibly model integrity and enforce standards, which strongly influences whether employees follow controls. Marketing language, office layout, and travel frequency do not convey ethical commitment. Governance effectiveness depends heavily on this signal.

Question 18Fraud Risk Governance and Program Design

A company's fraud risk assessment is three years old, and the business has since launched a new online payment channel. What is the most appropriate action?

  1. Refresh the assessment to cover the new channel and its specific fraud schemes before relying on it Correct answer.
  2. Add the new channel to next year's internal audit plan only
  3. Continue using the existing assessment because it was approved by the board
  4. Reduce the assessment scope because the channel is new and unproven

Explanation

Fraud risk assessments should be refreshed when the business changes materially, and a new payment channel introduces distinct schemes such as account takeover and card testing. Relying on an outdated assessment leaves new exposures unmanaged. Deferring to an audit plan or narrowing scope does not address the gap.

Question 19Fraud Risk Governance and Program Design

What distinguishes a fraud risk register from a general operational risk register?

  1. It excludes any risk that has not yet resulted in a loss
  2. It records fraud-specific schemes, actors, and control gaps rather than broad operational disruptions Correct answer.
  3. It is maintained only by the external auditor
  4. It is required to be publicly disclosed in full

Explanation

A fraud risk register focuses on intentional acts, capturing schemes, potential actors, and the controls that address them, which differs from general operational risk categories like process failure or outages. It is maintained by management, includes risks before losses occur, and is not publicly disclosed in full.

Question 20Fraud Risk Governance and Program Design

An organization wants to strengthen the preventive control environment around its vendor master file. Which control most directly reduces the risk of fictitious vendors?

  1. Allowing buyers to add vendors directly so purchasing is not delayed
  2. Paying all invoices within five days of receipt to build vendor goodwill
  3. Reviewing the vendor master file only during the annual external audit
  4. Requiring independent verification of new vendors and restricting master file changes to authorized personnel Correct answer.

Explanation

Fictitious vendor schemes depend on inserting a fake vendor and then paying it, so independent verification and restricted change access directly reduce that opportunity. Fast payment, buyer-controlled additions, and once-a-year review increase rather than reduce the risk. Preventive controls should target the point where the fraud is introduced.

Question 21Fraud Risk Governance and Program Design

A fraud program's investigation protocol should specify which of the following to preserve the integrity of evidence and conclusions?

  1. Chain-of-custody procedures, confidentiality controls, and defined escalation and reporting lines Correct answer.
  2. An approach that lets the accused employee lead the evidence-gathering
  3. A policy that investigations conclude within 24 hours of the first allegation
  4. A rule that investigators may discuss the case freely with the subject's colleagues

Explanation

Investigations require documented custody of evidence, confidentiality to protect the process and the accused, and clear escalation and reporting so findings reach the right authority. Discussing cases with colleagues, imposing unrealistic deadlines, or letting the subject control evidence gathering compromises integrity. A defined protocol protects both the organization and individuals.

Question 22Fraud Risk Governance and Program Design

A multinational's fraud policy is written at headquarters, but local teams argue it does not fit their market. What governance approach best balances consistency with local relevance?

  1. Suspend the policy in markets where it is unpopular
  2. Set non-negotiable global minimum standards and allow documented local procedures that meet or exceed them Correct answer.
  3. Permit each country to write its own independent policy with no global baseline
  4. Impose the headquarters policy verbatim and prohibit any local adaptation

Explanation

A common approach is a global framework with mandatory minimum standards, supplemented by local procedures that address local law, culture, and risk while meeting the baseline. Fully independent local policies fragment oversight, rigid verbatim application invites noncompliance, and suspending the policy removes control. Governance should preserve a consistent floor.

Question 23Fraud Risk Governance and Program Design

Which combination best reflects a layered control environment in a fraud program?

  1. Assurance performed solely by the business unit being reviewed
  2. Preventive controls at the transaction level, detective monitoring, and independent assurance over both Correct answer.
  3. Detection reports reviewed only when a loss is suspected
  4. A single strong preventive control relied on without any monitoring

Explanation

Layered controls combine prevention at the point of transaction, detection through monitoring, and independent assurance to test whether both work. Single controls fail silently, reactive review leaves losses undetected, and self-assurance lacks independence. Layers provide redundancy against control failure.

Question 24Fraud Risk Governance and Program Design

A board committee asks how the fraud program's effectiveness should be reported. Which reporting content best serves governance oversight?

  1. Only the number of training sessions delivered during the year
  2. A narrative of every allegation received without any analysis
  3. Risk exposures against appetite, control testing results, incident trends, and status of remediation actions Correct answer.
  4. The program's total budget compared with prior years

Explanation

Oversight reporting should connect exposures to appetite, show whether controls are working, track incident trends, and report remediation progress so the committee can act. Training counts, raw allegation narratives, and budget comparisons alone do not inform risk decisions. Effective reporting is concise, risk-based, and actionable.

Question 25Fraud Risk Governance and Program Design

An organization is deciding whether to outsource its fraud monitoring to a third party. Which governance consideration is most important?

  1. Selecting the vendor with the lowest price regardless of capability
  2. Allowing the vendor to set the organization's risk appetite
  3. Defining oversight, data access, performance standards, and accountability in the contract while retaining risk ownership Correct answer.
  4. Assuming the vendor's controls fully transfer the fraud risk away from the organization

Explanation

Outsourcing can be effective only if the organization retains risk ownership and governs the relationship through clear standards, oversight, and data controls. Risk is not transferred by outsourcing, price alone does not indicate capability, and risk appetite remains an internal governance decision. Contract terms and monitoring make the arrangement accountable.

Question 26Fraud Risk Governance and Program Design

An organization is drafting its first fraud risk management policy and wants to ensure it establishes clear accountability. Which element should the policy include to assign responsibility for fraud risk decisions?

  1. A description of the fraud risk governance structure, including roles and responsibilities Correct answer.
  2. A list of all employees who have been investigated for fraud in the past
  3. A requirement that all employees sign an annual conflict-of-interest disclosure
  4. A detailed schedule of fraud awareness training sessions for the coming year

Explanation

A fraud risk management policy must define the governance structure, specifying who is accountable for fraud risk decisions, oversight, and reporting. This clarity enables enforcement and integration with the overall risk framework. Other elements, while useful, do not establish accountability for fraud risk decisions.

Question 27Fraud Risk Governance and Program Design

A fraud risk assessment team is evaluating the likelihood and impact of a potential vendor kickback scheme in a decentralized purchasing environment. Which factor is most important to consider when assessing the inherent fraud risk of this scheme?

  1. The level of segregation of duties between purchasing and accounts payable Correct answer.
  2. The average tenure of employees in the purchasing department
  3. The number of vendors currently approved in the vendor master file
  4. The frequency of internal audits conducted in the past year

Explanation

Inherent fraud risk is assessed before considering controls, but the design of existing controls such as segregation of duties affects the likelihood that a scheme could occur undetected. A lack of segregation between purchasing and accounts payable increases the opportunity for kickbacks. The other factors may provide context but are less directly tied to the inherent risk of the scheme.

Question 28Fraud Risk Governance and Program Design

A company's fraud risk register includes a risk of duplicate payments to vendors. The risk owner proposes implementing a monthly data analytics test to identify potential duplicates before payment. Which component of the fraud risk management framework does this proposal primarily address?

  1. Risk response Correct answer.
  2. Control environment
  3. Monitoring activities
  4. Risk assessment

Explanation

Risk response involves selecting and implementing actions to address identified fraud risks, such as preventive or detective controls. A monthly analytics test is a detective control that responds to the risk of duplicate payments. Monitoring activities evaluate the effectiveness of controls over time, while risk assessment identifies and evaluates risks.

Question 29Fraud Risk Governance and Program Design

A fraud risk management program has a policy that requires all employees to report suspected fraud to their direct supervisor. An employee reports a concern about their supervisor's expense reports to the supervisor's manager, who dismisses it without investigation. Which design weakness in the program's reporting mechanism does this scenario most directly illustrate?

  1. The policy fails to include a whistleblower protection provision.
  2. The policy lacks a confidential reporting channel that bypasses the chain of command. Correct answer.
  3. The policy does not require annual fraud awareness training for all employees.
  4. The policy does not specify a timeline for investigating fraud reports.

Explanation

A reporting mechanism that requires employees to report to their direct supervisor can be ineffective when the supervisor is involved or when management dismisses concerns. A confidential channel, such as a hotline, allows concerns to be raised independently and reduces the risk of retaliation or cover-up. The scenario does not mention training, protection, or timelines as the primary issue.

Question 30Fraud Risk Governance and Program Design

Which statement best describes the purpose of a fraud risk appetite statement within a fraud risk management program?

  1. It defines the level of fraud risk the organization is willing to accept in pursuit of its objectives. Correct answer.
  2. It outlines the disciplinary actions for employees who commit fraud.
  3. It lists the specific fraud schemes that the organization has experienced in the past.
  4. It provides a detailed procedure for conducting fraud investigations.

Explanation

A fraud risk appetite statement articulates the amount and type of fraud risk an organization is willing to tolerate. It guides decision-making about which risks to mitigate and which to accept, aligning risk management with strategy. The other options describe historical records, investigation procedures, or disciplinary policies, not risk appetite.

Question 31Fraud Risk Assessment and Data Analytics

A certified fraud examiner is building a data analytics test to flag duplicate vendor payments. Which data-quality condition must hold before the test produces reliable results?

  1. Invoice numbers must be unique per vendor within the payment file Correct answer.
  2. The payment file must exclude approved invoices
  3. All vendors must share a single bank account
  4. Payment amounts must always be rounded to whole dollars

Explanation

Duplicate-payment analytics rely on a reliable key such as invoice number combined with vendor identifier, so the analyst can detect the same invoice being paid twice. If that key is not unique or is inconsistently formatted, the test produces false positives and false negatives that undermine the fraud assessment.

Question 32Fraud Risk Assessment and Data Analytics

Which analytics technique best detects a vendor master file that contains employees' home addresses?

  1. Stratification of invoices by approval level
  2. Fuzzy matching of vendor addresses to the employee address file Correct answer.
  3. Trend analysis of monthly payment totals
  4. Benford's Law digit analysis on payment amounts

Explanation

Matching vendor records against the employee master file on address, bank account, or tax identifier is the standard test for conflicts of interest and fictitious vendors. Fuzzy matching is needed because addresses are often entered with slight variations that exact joins would miss.

Question 33Fraud Risk Assessment and Data Analytics

In a fraud risk assessment, what does the fraud risk universe refer to?

  1. The complete set of fraud schemes and scenarios relevant to the organization that will be assessed and ranked Correct answer.
  2. The inventory of audit software licenses held by the internal audit team
  3. The collection of external audit opinions issued over the past five years
  4. The list of employees who have been terminated for cause

Explanation

The fraud risk universe is the population of fraud schemes and scenarios the organization could face, organized by process or business unit. It is the starting point for scoring likelihood and impact and for deciding which risks warrant analytics and controls.

Question 34Fraud Risk Assessment and Data Analytics

An analyst runs a test for payments made to vendors whose tax identification numbers match employee records. Which fraud scheme does this test most directly address?

  1. Skimming of cash receipts
  2. Inventory shrinkage at the warehouse
  3. Payroll tax evasion by the organization
  4. Fictitious vendor or ghost employee scheme Correct answer.

Explanation

A tax identification number shared between the vendor master and payroll indicates that a payment may be flowing to an employee or a shell entity they control. This is a classic indicator of fictitious vendor or ghost employee schemes.

Question 35Fraud Risk Assessment and Data Analytics

What is the primary purpose of continuous monitoring in a fraud risk management program?

  1. To reduce the number of vendors in the master file
  2. To detect anomalies and control breakdowns on an ongoing basis rather than only at period end Correct answer.
  3. To replace the annual external audit entirely
  4. To guarantee that no fraud can ever occur

Explanation

Continuous monitoring applies automated tests and rules to transaction streams on a recurring basis so that exceptions surface promptly. It shortens detection time and supports the risk assessment by showing which controls are actually operating.

Question 36Fraud Risk Assessment and Data Analytics

Which metric best expresses the likelihood component of a fraud risk score?

  1. The number of prior fraud incidents or exceptions observed for that scheme Correct answer.
  2. The number of employees in the accounting department
  3. The dollar value of the largest single transaction in the process
  4. The age of the enterprise resource planning system

Explanation

Likelihood is estimated from the frequency with which a scheme has occurred or been attempted, including exception counts and known incidents. Impact, by contrast, is measured in financial or reputational terms.

Question 37Fraud Risk Assessment and Data Analytics

A fraud examiner wants to identify split purchase orders that evade approval thresholds. Which analytic is most appropriate?

  1. Ranking vendors by total annual spend
  2. Comparing invoice amounts to the Benford distribution
  3. Listing all purchase orders sorted by date
  4. Summing payments by vendor within a rolling time window and comparing to the approval threshold Correct answer.

Explanation

Split purchases appear as multiple orders just under the threshold, so aggregating by vendor over a short window reveals totals that exceed the authorization limit. The rolling window is important because splitting often occurs within days.

Question 38Fraud Risk Assessment and Data Analytics

Why should a fraud risk assessment distinguish inherent risk from residual risk?

  1. Because residual risk is measured only by external auditors
  2. Because residual risk equals inherent risk whenever controls are documented
  3. Because inherent risk applies only to financial statement fraud
  4. Because inherent risk reflects exposure before controls while residual risk reflects exposure after controls are applied Correct answer.

Explanation

Inherent risk captures the exposure assuming no controls, while residual risk is what remains after the design and operating effectiveness of controls are considered. The gap between them shows where controls add value and where additional analytics may be warranted.

Question 39Fraud Risk Assessment and Data Analytics

An analyst joins the accounts payable file to the approved purchase order file and finds invoices with no matching purchase order. What is the most appropriate next step?

  1. Conclude that fraud has occurred and refer the matter to law enforcement
  2. Delete the unmatched records as data errors
  3. Ignore the result because unmatched records are expected
  4. Treat the exceptions as a population for further review and root-cause analysis Correct answer.

Explanation

Exceptions from a join indicate either a control gap, a data issue, or possible fraud, and each requires investigation before conclusions are drawn. Analyzing the population for patterns such as a common approver or vendor helps distinguish error from intent.

Question 40Fraud Risk Assessment and Data Analytics

A payment file shows several vendors sharing the same post office box and the same phone number. Which conclusion is most defensible?

  1. The vendors are definitely fictitious shell companies
  2. The vendors must be related parties disclosed in the financial statements
  3. The data entry clerk made a typographical error
  4. The shared attributes are a red flag warranting verification of vendor legitimacy Correct answer.

Explanation

Shared addresses or phone numbers are indicators, not proof, because legitimate vendors can share a registered agent or mailbox service. The examiner should corroborate through independent verification such as site visits, business registries, or contact attempts.

Question 41Fraud Risk Assessment and Data Analytics

Which condition is most consistent with the fraud triangle element of opportunity in a procurement process?

  1. A manager faces intense pressure to meet quarterly earnings targets
  2. An employee has a gambling addiction
  3. A single buyer can both create vendors and approve payments without review Correct answer.
  4. An employee rationalizes that the company owes them for unpaid overtime

Explanation

Opportunity exists when weak controls or segregation of duties allow a person to commit and conceal fraud. One individual controlling vendor creation and payment approval removes the checks that would otherwise prevent the scheme.

Question 42Fraud Risk Assessment and Data Analytics

An examiner applies Benford's Law to a vendor payment population and finds a spike at round numbers such as exactly 5,000. What is the best interpretation?

  1. The spike may indicate threshold avoidance or manual intervention and should be investigated Correct answer.
  2. Benford's Law is invalid for any financial data set
  3. Benford's Law proves the data were fabricated
  4. The population conforms to Benford's Law and requires no further work

Explanation

Excess round-number amounts can signal approvals kept just below a control limit or manually entered figures. Benford analysis is a screening tool that directs attention to anomalies rather than a proof of fraud.

Question 43Fraud Risk Assessment and Data Analytics

Which data analytic would best identify employees who approve their own expense reimbursements?

  1. Testing whether receipts are attached to each claim
  2. Matching the approver identifier to the employee identifier on the same reimbursement record Correct answer.
  3. Comparing expense amounts across departments
  4. Reviewing the chart of accounts for duplicate account names

Explanation

Self-approval is detected by comparing the approver field with the payee or employee field on the same record. A match indicates a segregation-of-duties violation that enables concealment of improper claims.

Question 44Fraud Risk Assessment and Data Analytics

A fraud risk assessment workshop uses a heat map. How should likelihood and impact typically be combined?

  1. By averaging the two scores into a single unweighted figure
  2. By assigning every risk the same score until controls are tested
  3. By ranking risks solely on the dollar value of prior losses
  4. By plotting each risk on a matrix so that high-likelihood, high-impact risks are prioritized Correct answer.

Explanation

A heat map plots inherent or residual risk on two axes so decision makers can see which risks cluster in the high-high quadrant. This supports prioritization of analytics, controls, and monitoring resources.

Question 45Fraud Risk Assessment and Data Analytics

What is the key limitation of relying exclusively on exception reports generated by rule-based analytics?

  1. Rules cannot process large data sets
  2. Rules only detect schemes that were anticipated when the rule was written Correct answer.
  3. Rules always produce too few exceptions to review
  4. Rules require manual data entry for every transaction

Explanation

Rule-based tests encode known patterns, so novel or collusive schemes that do not match the rule logic can pass undetected. Effective programs combine rules with anomaly detection and periodic reassessment of the risk universe.

Question 46Fraud Risk Assessment and Data Analytics

An examiner wants to test whether payments were made to vendors that were added to the master file and paid within the same week. Why is this test useful?

  1. It identifies vendors that may have been created specifically to receive a fraudulent payment Correct answer.
  2. It verifies that purchase orders were properly authorized
  3. It confirms that all vendors have valid tax identification numbers
  4. It measures the average age of the vendor base

Explanation

A very short interval between vendor creation and first payment is a recognized red flag because legitimate onboarding usually involves verification steps. The test narrows the population for substantive procedures such as site verification or ownership checks.

Question 47Fraud Risk Assessment and Data Analytics

Which source of data would an examiner most likely use to test for undisclosed related-party transactions in procurement?

  1. The petty cash voucher file
  2. The fixed asset register
  3. The employee training completion log
  4. External corporate registry filings listing officers and shareholders Correct answer.

Explanation

Corporate registry filings identify officers, directors, and owners, which can be matched against vendor ownership records to reveal undisclosed relationships. This external data supplements internal vendor master information.

Question 48Fraud Risk Assessment and Data Analytics

A fraud risk assessment identifies that journal entries posted after close by users with privileged access represent a high residual risk. Which analytic best addresses this risk?

  1. Comparing the trial balance to the prior year
  2. Reviewing all journal entries for spelling errors in descriptions
  3. Counting the total number of journal entries per month
  4. Extracting manual entries posted outside business hours by privileged users for substantive review Correct answer.

Explanation

Top-side and after-hours manual entries by privileged users are classic vehicles for financial statement manipulation. Extracting that specific population focuses review on entries with the highest manipulation potential.

Question 49Fraud Risk Assessment and Data Analytics

Why is data completeness testing essential before drawing conclusions from a fraud analytics result?

  1. Because completeness guarantees the accuracy of every field
  2. Because complete data eliminates the need for professional skepticism
  3. Because regulators require all analytics to use complete data
  4. Because incomplete data can hide fraudulent records and produce misleadingly low exception counts Correct answer.

Explanation

If records are missing from the extract, schemes involving those records will not surface, giving false comfort. Record counts, control totals, and reconciliation to the general ledger help confirm the population is complete before results are interpreted.

Question 50Fraud Risk Assessment and Data Analytics

An examiner compares the vendor master file before and after a period and finds that a vendor's bank account details were changed shortly before a large payment. What does this pattern most likely suggest?

  1. An error in the accounts payable aging report
  2. A possible business email compromise or vendor bank account manipulation scheme Correct answer.
  3. A legitimate change in the vendor's fiscal year
  4. A routine annual update of vendor records

Explanation

A recent change to banking details followed quickly by a large payment is a recognized indicator of payment diversion fraud. Verification with the vendor through an independently obtained contact number is the appropriate control response.