CFE common mistakes
CFE · Understand the traps and how to avoid them.
When a question asks how to prevent a specific scheme, the candidate selects the detection-flavoured control (hotline, tip line, surprise audit) because it appeared in the same anti-fraud control list during study.
Review material presents prevention, deterrence, and detection controls as one block, so candidates memorise the items without tagging the mechanism each one uses.
What to do instead
Before looking at the answer choices, sort the options into three buckets: prevention reduces the opportunity (segregation of duties, authorisation limits, physical safeguards, system access restrictions); deterrence raises the perceived likelihood of being caught (hotline, published code with visible enforcement, surprise audits, proactive data testing); detection finds fraud after it occurs (reconciliations, exception reports, trend analysis). Then re-read the verb in the stem - prevent, deter, or detect.
In a scenario, the candidate labels an employee's excuse ('the company owes me', 'everybody does it') as pressure, or labels a weak control as rationalisation, because the stem also mentions a control weakness somewhere.
The three elements were memorised as a bare list of labels, and real vignettes describe behaviour instead of naming the element.
What to do instead
Run a fixed three-question test on every vignette: Could a control or oversight step have stopped this? If yes, the element in play is opportunity. Is there a non-shareable financial or personal problem driving the conduct? That is pressure. Does the person justify the act to themselves? That is rationalisation. Assign the element to the sentence it actually describes, not to the first fraud-triangle term the stem seems to hint at.
The candidate answers a question about who owns the fraud risk assessment, the anti-fraud programme, or the tone at the top by naming the internal auditor, the fraud examiner, or the compliance function.
Candidates work in or study audit and examination roles, so they default to the role they identify with rather than to the governance structure being tested.
What to do instead
Anchor responsibility: the board and senior management own the fraud risk management programme, set the tone, and accept the residual risk; the fraud examiner or internal auditor evaluates, tests, and reports on it but does not own it. On any 'primary responsibility' question, the answer is a governance body unless the stem explicitly limits the question to testing or investigation.
The candidate classifies an employee's theft of an unrecorded cash sale as larceny, or classifies a theft of cash after it was entered into the system as skimming, by looking at the job title or the dollar amount rather than the accounting moment.
Skimming, larceny, and fraudulent disbursements all involve cash leaving the organisation, so the definitions blur unless the candidate holds the recording timeline in mind.
What to do instead
Place the theft on a timeline every time: money taken before it is recorded on the books = skimming; money taken after it has been recorded = larceny; money leaving through a payment the organisation records as legitimate (cheque, refund, invoice, payroll, expense) = fraudulent disbursement. Ask 'was it on the books when it was taken?' before reading the choices.
The candidate conflates the corruption schemes - calling an undisclosed ownership interest in a supplier a bribery scheme, calling a payment demanded by a purchasing agent economic extortion, or calling a payment made after the decision an illegal gratuity when the stem describes an intent to influence formed beforehand.
All four involve a payment and a business decision, and the distinguishing facts are timing of intent, who initiated, and whether the interest was disclosed - details candidates skim past.
What to do instead
Use a decision sequence: Was something of value given or received with the intent to influence a business decision at the time of payment? Bribery. Was it given after the decision with no corrupt intent, as a reward? Illegal gratuity. Did the recipient demand it under threat of harm to the business? Economic extortion. Was there an undisclosed personal interest or relationship that conflicted with the employer's interest, with no payment needed? Conflict of interest. Locate the exact sentence in the stem that answers each test.
The candidate labels a fictitious-vendor scheme 'check tampering' because the payment left as a cheque, or labels a forged endorsement as check tampering against the employer when the employer's bank account was never debited.
Classification is driven by the payment instrument visible in the stem rather than by which disbursement stream was abused and who bore the loss.
What to do instead
Classify by the abused stream and the victim: billing schemes run through the purchasing and payables function (fictitious or inflated invoices); check tampering involves intercepting or altering a cheque the organisation legitimately drew (forged maker, altered payee, forged endorsement, authorised-maker); register disbursement schemes run through the cash register (false refunds, voided sales). For forged endorsement and other third-party interception, name the party whose funds were actually taken.
In a net worth or source-and-use question, the candidate omits personal living expenses, adds back business expenses, or compares ending net worth to known income without first computing the change in net worth.
The method requires several arithmetic steps in a fixed order, and under time pressure candidates jump straight to 'expenditures minus income' while skipping the bridge from balance sheet to income.
What to do instead
Write the formula out before touching the numbers: Assets minus Liabilities equals Net Worth; Ending Net Worth minus Beginning Net Worth equals Change in Net Worth; Change in Net Worth plus Personal Living Expenses plus other known personal expenditures, minus Known Income Sources, equals Unidentified Income. Keep business and personal flows in separate columns, and confirm that depreciation, loan proceeds, and asset purchases are treated consistently so nothing is counted twice.
The candidate opens with accusatory, admission-seeking questions in the first interview, or treats averted eyes, sweating, or fidgeting as proof that a subject is lying.
Popular depictions of interviewing overstate both how early confrontation should occur and how reliably non-verbal behaviour signals deception.
What to do instead
Sequence the interview: establish the fraud theory and predication first, conduct fact-finding interviews of witnesses and the subject that gather corroborated facts, and only then move to an admission-seeking interview with a subject whose guilt is already supported by evidence. Treat non-verbal behaviour as a lead to test against documentary evidence and baseline behaviour, never as a conclusion - and say so in the report.
The candidate collects or handles evidence without recording every transfer, photographs documents without noting who held them, or copies electronic files without preserving a hash value, then answers that the evidence is still usable because it is genuine.
Candidates focus on whether the evidence is authentic in substance and underestimate that authentication at a hearing depends on an unbroken documented chain.
What to do instead
Apply the handling routine to every item: record who obtained it, when, where, and from whom; log each subsequent transfer and storage location; keep originals in a controlled location and work from copies; image electronic media with a write-blocker and record the hash before and after. Remember that gaps in the chain generally affect the weight or admissibility of the item, so the fix is prevention, not argument afterwards.
The candidate applies 'beyond a reasonable doubt' to a civil fraud action or to the decision to refer a case for prosecution, or applies 'preponderance of the evidence' to a criminal proceeding, and conflates the fraud examiner's role with that of the auditor.
The four domains share vocabulary - fraud examination, audit, investigation, litigation - so the candidate carries the standard of proof and the role definition across from the wrong context.
What to do instead
Hold three distinctions: criminal matters require proof beyond a reasonable doubt and the examiner supplies evidence to prosecutors; civil matters require a preponderance of the evidence; a fraud examination resolves an allegation and does not express an opinion on financial statements, which is the auditor's function. Match the standard to the forum named in the stem before evaluating the choices.
The candidate assumes a private-sector internal investigation is bound by the same constitutional search and interview protections as a government investigation, or assumes that attorney work product and privilege automatically cover notes, interviews, and reports produced during the examination.
Legal protections are studied as general principles without the public/private actor distinction or the conditions that privilege requires, such as counsel direction and confidentiality not being waived by distribution.
What to do instead
Ask who is acting: constitutional limits on search and seizure and on custodial interrogation attach to government action, while private employers are governed by employment law, policy, contracts, and tort principles. For privilege, ask whether counsel directed the work, whether the material was kept confidential and not circulated, and whether privilege has been waived by disclosure to third parties or the auditor. Do not assume the label applies.