I85PREP
⌘ K
CFE study materials
CFE study resources

CFE practice questions

One question at a time. Build your CFE understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fraud Prevention and Deterrence

Which three conditions make up the fraud triangle?

  1. Incentive, conversion, and detection
  2. Opportunity, conversion, and concealment
  3. Pressure, opportunity, and rationalization Correct answer.
  4. Pressure, collusion, and concealment

Explanation

The fraud triangle explains fraud as arising from pressure or incentive, opportunity, and rationalization or attitude. Conversion and concealment describe parts of a fraud act rather than the three conditions. Detection and collusion are related concepts but not triangle elements.

Question 2Fraud Prevention and Deterrence

Tone at the top most directly refers to which of the following?

  1. The internal audit department's annual assessment of enterprise-wide risks
  2. The audit committee's review of financial statements
  3. Senior management's visible commitment to ethics and control Correct answer.
  4. The wording of the organization's external audit opinion

Explanation

Tone at the top is the ethical climate set by senior leadership through actions, communications, and priorities. Audits, risk assessments, and audit opinions are specific activities or outputs, not the climate itself.

Question 3Fraud Prevention and Deterrence

The primary purpose of a fraud reporting hotline is to do which of the following?

  1. Serve as the organization's general public relations contact line
  2. Replace all internal controls over cash receipts and disbursements
  3. Guarantee that every report submitted by an employee leads to discipline
  4. Provide a confidential channel for reporting suspected misconduct Correct answer.

Explanation

A hotline gives employees and other parties a confidential way to report suspected fraud or misconduct. It does not guarantee outcomes, replace controls, or function as a public relations line.

Question 4Fraud Prevention and Deterrence

Which combination of duties creates the greatest fraud risk when assigned to one employee?

  1. Custody of an asset and recordkeeping for that asset Correct answer.
  2. Archiving documents and retrieving them when requested
  3. Preparing a routine internal report and filing a copy of it
  4. Sorting incoming mail and distributing it to department mailboxes

Explanation

Combining custody of an asset with recordkeeping allows an employee to misappropriate the asset and adjust records to conceal it. Clerical filing, mail distribution, and archiving do not normally combine incompatible custody and recordkeeping duties.

Question 5Fraud Prevention and Deterrence

A code of conduct primarily communicates which of the following?

  1. The exact disciplinary penalty for each possible violation
  2. Expected ethical behavior and standards for employees Correct answer.
  3. The planned audit procedures for the coming fiscal year
  4. The organization's quarterly financial targets and forecasts

Explanation

A code of conduct states expected ethical behavior and standards that guide employee decisions. It may reference discipline generally, but it is not a penalty schedule, a financial forecast, or an audit plan.

Question 6Fraud Prevention and Deterrence

A fraud risk assessment is designed to do which of the following?

  1. Replace the external audit function with internal monitoring
  2. Identify fraud risks and evaluate their likelihood and impact Correct answer.
  3. Calculate the organization's quarterly tax liability and deferrals
  4. Eliminate the need for internal controls over financial reporting

Explanation

A fraud risk assessment identifies where fraud could occur and evaluates the likelihood and impact of those risks. It supports control design; it does not eliminate controls, compute taxes, or replace external audit.

Question 7Fraud Prevention and Deterrence

Fraud deterrence is strengthened most when employees believe which of the following?

  1. Fraud is common in their industry and often accepted
  2. Management values short-term profit above all other goals
  3. Fraud will likely be detected and punished Correct answer.
  4. Controls are primarily paper-based and rarely tested

Explanation

Deterrence depends on the perception that fraud will be detected and that consequences will follow. Belief that fraud is common or that controls are weak tends to increase risk rather than deter it.

Question 8Fraud Prevention and Deterrence

Pre-employment background checks help prevent fraud primarily by doing which of the following?

  1. Reducing the need for segregation of duties
  2. Guaranteeing that a newly hired employee will never commit fraud
  3. Verifying candidate history and credentials before hiring Correct answer.
  4. Increasing employee morale across the organization

Explanation

Background checks verify employment history, credentials, and other relevant facts before an individual is hired. They reduce risk but cannot guarantee future conduct or replace other controls such as segregation of duties.

Question 9Fraud Prevention and Deterrence

An employee can both add new vendors to the master file and release payments to vendors. Which fraud scheme is most directly enabled?

  1. Premature revenue recognition on long-term contracts
  2. Creation of fictitious vendors and payments to them Correct answer.
  3. Theft of physical inventory from the warehouse
  4. Understatement of sales revenue and related accounts receivable balances

Explanation

The ability to create a vendor and release payment allows an employee to set up a fictitious vendor and direct payments to it. Inventory theft and revenue recognition schemes involve different access and recording weaknesses.

Question 10Fraud Prevention and Deterrence

How does a mandatory vacation policy help prevent fraud?

  1. It removes the need for surprise audits and reconciliations
  2. It makes concealment harder because another employee performs the duties Correct answer.
  3. It automatically rotates all vendor master file access rights
  4. It increases the number of employees who are allowed to approve transactions

Explanation

Mandatory vacation requires another employee to perform the absent employee's duties, which can reveal irregularities that depended on continuous control by one person. It supplements, rather than replaces, audits, reconciliations, and access controls.

Question 11Fraud Prevention and Deterrence

A hotline's effectiveness is most likely compromised when which of the following occurs?

  1. Reports can be submitted anonymously by employees
  2. A log of reports is reviewed by the audit committee
  3. The hotline is available to both employees and external third parties
  4. Reports go directly to the supervisor who is the subject Correct answer.

Explanation

Routing reports to the person who is the subject of the allegation undermines independence and can expose the reporter to retaliation. Anonymous access, broad availability, and audit committee oversight generally support hotline effectiveness.

Question 12Fraud Prevention and Deterrence

Surprise audits deter fraud because they do which of the following?

  1. Guarantee that all frauds will be discovered
  2. Replace the need for a written code of conduct
  3. Reduce the organization's annual insurance premiums and deductibles
  4. Raise employees' perception that irregularities may be detected Correct answer.

Explanation

Surprise audits increase the perceived risk of detection because employees cannot predict when records or assets will be examined. They do not guarantee discovery, replace ethical standards, or directly determine insurance costs.

Question 13Fraud Prevention and Deterrence

An effective fraud risk assessment should be which of the following?

  1. Based only on prior fraud losses recorded by the organization
  2. Performed once at implementation and then never revised
  3. Updated periodically and when significant changes occur Correct answer.
  4. Limited to the accounting and finance departments only

Explanation

Fraud risks change with new systems, personnel, products, and operating environments, so the assessment must be refreshed periodically and when significant changes occur. A one-time or narrowly scoped assessment can miss emerging risks.

Question 14Fraud Prevention and Deterrence

Dual custody of cash means that which of the following applies?

  1. Cash receipts are deposited weekly rather than daily
  2. Cash is kept in a locked safe with a single keyholder
  3. Two employees are required to access or process the cash Correct answer.
  4. One employee counts cash while another employee records it

Explanation

Dual custody requires two people to be present or involved when cash is accessed or processed, reducing the risk that one person can misappropriate it. Counting and recording by separate employees is segregation of duties, not dual custody.

Question 15Fraud Prevention and Deterrence

Which factor most helps prevent management override of controls?

  1. Monthly bank reconciliations prepared by the accounting department
  2. A policy that all employees sign an attendance sheet
  3. A detailed chart of accounts with many cost centers
  4. Strong board oversight and an ethical culture Correct answer.

Explanation

Management override is best addressed through strong governance, independent board or audit committee oversight, and a culture that supports ethical behavior. Routine reconciliations and detailed account structures are useful but do not directly constrain senior management.

Question 16Fraud Prevention and Deterrence

Job rotation helps deter fraud by doing which of the following?

  1. Increasing the speed of transaction processing
  2. Reducing the total number of employees needed to process transactions
  3. Limiting an employee's ability to conceal a scheme over time Correct answer.
  4. Eliminating the need for employee training

Explanation

Job rotation moves employees into different roles, so a scheme that depends on one person's continuing control may be exposed. It is a deterrence and detection control, not a way to speed processing or reduce headcount.

Question 17Fraud Prevention and Deterrence

Which element is part of the COSO control environment?

  1. Monthly variance analysis of budget to actual results
  2. Physical inventory counts performed at each warehouse
  3. Preparation of monthly bank reconciliations by accounting
  4. Integrity and ethical values Correct answer.

Explanation

The control environment sets the tone of the organization and includes integrity, ethical values, board oversight, and organizational structure. Reconciliations, inventory counts, and variance analyses are control activities.

Question 18Fraud Prevention and Deterrence

Sales staff are paid commissions only on new contracts. Which fraud risk does this create?

  1. Pressure to record sales before the criteria are met Correct answer.
  2. A lower risk that management will override controls
  3. A reduced need for segregation of duties
  4. A higher risk of inventory shrinkage in the warehouse

Explanation

Commission-based compensation creates pressure or incentive to record sales that do not yet meet recognition criteria. It does not reduce override risk or eliminate the need for segregation of duties.

Question 19Fraud Prevention and Deterrence

Access to change vendor master file data should be which of the following?

  1. Restricted to authorized staff who do not process payments Correct answer.
  2. Shared with the receiving department for convenience
  3. Given to all accounts payable staff to improve processing efficiency
  4. Granted to the vendor's sales representative for accuracy

Explanation

Vendor master file changes should be restricted to authorized personnel who are independent of payment processing, reducing the risk of fictitious vendors. Broad or external access weakens the control.

Question 20Fraud Prevention and Deterrence

Fraud awareness training for employees should primarily cover which of the following?

  1. Common fraud red flags, policies, and reporting channels Correct answer.
  2. Only the penalties for theft of cash
  3. The organization's marketing strategy and sales targets
  4. Advanced forensic accounting and computer investigation techniques

Explanation

Employee fraud awareness training should help staff recognize red flags, understand relevant policies, and know how to report concerns. It is not limited to cash theft penalties or designed to make employees forensic specialists.

Question 21Fraud Prevention and Deterrence

According to deterrence theory, which combination most effectively discourages fraud?

  1. Severe penalties that are rarely enforced against employees
  2. Strong profits with weak monitoring of transactions
  3. Frequent policy changes without communication to staff
  4. High certainty of detection and consistent consequences Correct answer.

Explanation

Deterrence is strongest when people believe detection is likely and consequences are applied consistently. Severe but rarely enforced penalties and weak monitoring reduce the perceived risk of getting caught.

Question 22Fraud Prevention and Deterrence

An employee who believes 'everyone pads expenses, so it is acceptable' is primarily influenced by which fraud triangle element?

  1. Rationalization Correct answer.
  2. Opportunity
  3. Capability
  4. Concealment

Explanation

Rationalization is the justification or attitude that allows a person to view misconduct as acceptable. Opportunity refers to the ability to commit fraud, while capability and concealment are not elements of the fraud triangle.

Question 23Fraud Prevention and Deterrence

Two employees collude to bypass segregation of duties. Which control best compensates for this residual risk?

  1. Adding more steps to the transaction approval workflow
  2. Independent monitoring with surprise audits and analytics Correct answer.
  3. Posting the segregation of duties policy in every break room
  4. Requiring employees to sign an annual ethics acknowledgment

Explanation

Collusion can defeat the preventive effect of segregation, so independent monitoring through surprise audits and data analytics provides a detective compensating control. Ethics acknowledgments and posted policies support awareness but do not detect collusive activity.

Question 24Fraud Prevention and Deterrence

After controls are applied, the remaining fraud risk is called which of the following?

  1. Control risk
  2. Residual risk Correct answer.
  3. Inherent risk
  4. Detection risk

Explanation

Residual risk is the risk that remains after management applies controls. Inherent risk is assessed before controls, while detection risk and control risk are audit risk concepts.

Question 25Fraud Prevention and Deterrence

Publicizing disciplinary action taken against a fraud perpetrator primarily supports deterrence by doing which of the following?

  1. Increasing employees' perception that fraud has consequences Correct answer.
  2. Guaranteeing that collusion cannot occur in the future
  3. Replacing the fraud risk assessment process
  4. Eliminating the need for a confidential whistleblower hotline

Explanation

Publicizing consequences reinforces the perception that detected fraud leads to action, which strengthens deterrence. It does not guarantee prevention, eliminate reporting channels, or substitute for a risk assessment.

Question 26Fraud Prevention and Deterrence

Under the fraud triangle, the condition that exists when weak controls allow an employee to carry out a fraud is called:

  1. Concealment
  2. Pressure
  3. Rationalization
  4. Opportunity Correct answer.

Explanation

Opportunity is the fraud triangle element that exists when weaknesses in controls or access allow a person to commit and hide fraud. Pressure supplies the motive, while rationalization supplies the justification. Concealment is part of carrying out the scheme, not a separate triangle element.

Question 27Fraud Prevention and Deterrence

Tone at the top is best described as:

  1. The audit committee's written charter
  2. The size of the internal audit budget
  3. The number of fraud cases reported each year
  4. The ethical climate set by senior leaders Correct answer.

Explanation

Tone at the top refers to the ethical climate senior leaders establish through their statements, decisions, and personal example. It shapes whether employees see fraud prevention as a genuine priority. Written charters and budgets are governance tools, but they do not by themselves establish ethical tone.

Question 28Fraud Prevention and Deterrence

A company code of conduct primarily supports fraud prevention by:

  1. Guaranteeing that employees will never commit fraud
  2. Eliminating the need for monitoring controls
  3. Replacing the need for segregation of duties
  4. Stating ethical expectations and penalties Correct answer.

Explanation

A code of conduct communicates expected ethical behavior and the consequences of violations, which supports a strong control environment. It is a guiding and deterrent tool rather than a substitute for operational controls. Fraud prevention depends on multiple layers, including monitoring and segregation of duties.

Question 29Fraud Prevention and Deterrence

For a whistleblower hotline, anonymity is valuable mainly because it:

  1. Guarantees that every report is accurate
  2. Removes the need to investigate reports
  3. Reduces fear of retaliation Correct answer.
  4. Allows reporters to avoid all questioning

Explanation

Anonymity lowers the perceived personal risk of reporting, which encourages employees to raise concerns through the hotline. It does not remove the need to investigate or validate reports. The value lies in reducing fear, not in guaranteeing accuracy.

Question 30Fraud Prevention and Deterrence

The core principle of segregation of duties is that:

  1. No one person controls all stages of a transaction Correct answer.
  2. Every transaction requires signatures from two managers
  3. All employees must rotate jobs each year
  4. Cash must always be counted by two people

Explanation

Segregation of duties divides authorization, custody, recording, and reconciliation so that no single person can initiate, execute, and conceal a transaction. This reduces the opportunity element of the fraud triangle. Specific safeguards such as dual counts or job rotation are separate controls.

Question 31Fraud Prevention and Deterrence

Which is an example of a physical safeguard against fraud?

  1. Locked cabinet for blank check stock Correct answer.
  2. Budget-to-actual comparison
  3. Vendor master file review
  4. Monthly bank reconciliation

Explanation

Physical safeguards restrict direct access to assets and documents, such as locking blank check stock in a controlled cabinet. Bank reconciliations, vendor file reviews, and budget comparisons are analytical or detective controls. Physical protection reduces opportunity by preventing unauthorized access.

Question 32Fraud Prevention and Deterrence

A written anti-fraud policy most directly supports deterrence by:

  1. Communicating prohibited acts and investigation steps Correct answer.
  2. Ensuring that all fraud losses are covered by insurance
  3. Eliminating the need for employee training efforts
  4. Detecting fraud through data analytics software

Explanation

An anti-fraud policy sets out prohibited conduct, reporting expectations, and investigation procedures, which signals that fraud is taken seriously. Clear communication strengthens deterrence by making consequences visible. It does not replace analytics, insurance, or training.

Question 33Fraud Prevention and Deterrence

Perception of detection means employees are deterred when they believe:

  1. Managers trust them completely
  2. Fraud is impossible to commit
  3. Detection is likely and certain Correct answer.
  4. Punishment will be lenient

Explanation

Deterrence is strengthened when employees believe that fraudulent acts will probably be detected and addressed. The perception of detection matters even more than the existence of controls that employees do not believe are effective. Leniency or perceived trust does not create this deterrent effect.

Question 34Fraud Prevention and Deterrence

A purchasing manager's spouse owns a company bidding for a supply contract. The strongest prevention step is for the manager to:

  1. Negotiate the contract personally for fairness
  2. Disclose the relationship and be recused Correct answer.
  3. Keep the relationship private to avoid bias claims
  4. Approve the contract only if the price is lowest

Explanation

A conflict of interest should be disclosed and the conflicted person should be removed from decisions affecting the related party. Recusal prevents the manager from using influence to benefit a family interest. Personal negotiation or secrecy would increase the risk rather than reduce it.

Question 35Fraud Prevention and Deterrence

A vendor offers a buyer expensive tickets shortly before contract renewal. Under a typical gifts policy, the buyer should:

  1. Accept because the value is modest
  2. Accept and not report the gift
  3. Ask the vendor for cash instead
  4. Decline or disclose per policy limits Correct answer.

Explanation

Gifts and entertainment policies usually require employees to decline items above a set value or disclose them for approval. The timing near contract renewal heightens the conflict-of-interest risk. Accepting without disclosure or requesting cash would violate typical policy expectations.

Question 36Fraud Prevention and Deterrence

In the three lines of defense model, internal audit serves as:

  1. The second line, setting risk policy
  2. The first line, owning risk daily
  3. The third line, providing assurance Correct answer.
  4. An external regulator enforcing laws

Explanation

Internal audit provides independent assurance as the third line of defense, reviewing the effectiveness of risk management and controls. The first line owns and manages risk in day-to-day operations, and the second line provides oversight and compliance support. Regulators are external to the organization.

Question 37Fraud Prevention and Deterrence

Which responsibility best belongs to the audit committee in fraud risk governance?

  1. Performing daily bank reconciliations
  2. Designing transaction-level application controls for each system
  3. Overseeing the fraud risk program and internal audit Correct answer.
  4. Approving individual expense reports

Explanation

The audit committee provides board-level oversight of the fraud risk management program and the internal audit function. It does not perform operational tasks such as reconciliations, expense approvals, or detailed control design. This oversight role helps ensure that fraud risks receive appropriate attention.

Question 38Fraud Prevention and Deterrence

Setting dollar thresholds above which a manager must obtain higher approval is intended to:

  1. Increase the processing speed of all payments
  2. Replace the need for reconciliations
  3. Remove the need for audit trails
  4. Limit the loss one employee can authorize Correct answer.

Explanation

Authorization limits cap the amount that any one employee can commit or approve without additional oversight. This reduces the potential loss from a single person's error or abuse. The control does not eliminate the need for reconciliations or audit trails.

Question 39Fraud Prevention and Deterrence

Monthly bank reconciliations help prevent and detect fraud mainly because they:

  1. Allow check writers to reconcile their own accounts
  2. Eliminate the need for cash counts
  3. Increase the reported bank balance
  4. Independently compare recorded cash to bank records Correct answer.

Explanation

A bank reconciliation independently compares the organization's cash records with the bank's records, helping reveal unauthorized or unrecorded transactions. The control is strongest when performed by someone independent of cash handling and check writing. It does not increase cash or replace physical counts.

Question 40Fraud Prevention and Deterrence

The principle of least privilege requires that system access be:

  1. Limited to what each user needs for the job Correct answer.
  2. Shared among team members to cover absences
  3. Reviewed only after a fraud occurs
  4. Granted to all employees for convenience

Explanation

Least privilege limits each user's access to the specific systems and data needed to perform assigned duties. This reduces the opportunity for unauthorized transactions or data changes. Broad, shared, or post-incident-only access reviews undermine the principle.

Question 41Fraud Prevention and Deterrence

An employee assistance program most directly addresses which fraud triangle element?

  1. Opportunity
  2. Pressure Correct answer.
  3. Rationalization
  4. Capability

Explanation

An employee assistance program can help employees manage personal, financial, or emotional problems that create pressure to commit fraud. By addressing the underlying pressure, it reduces the likelihood that an employee will turn to fraud. It does not directly remove opportunities or change technical capability.

Question 42Fraud Prevention and Deterrence

A fraud risk register is used primarily to:

  1. Document fraud risks, likelihood, and owners Correct answer.
  2. List employees currently suspected of fraud
  3. Record only confirmed fraud losses
  4. Replace the need for internal controls

Explanation

A fraud risk register documents identified fraud risks, assesses their likelihood and impact, and assigns responsibility for mitigation. It supports prioritization and monitoring of risk responses. It is not a loss log, a suspect list, or a substitute for controls.

Question 43Fraud Prevention and Deterrence

Before adding a new high-risk vendor, due diligence should include:

  1. Skipping checks if the vendor offers a discount
  2. Verifying vendor existence, ownership, and bank details Correct answer.
  3. Allowing the vendor to set its own payment terms
  4. Relying solely on the sales representative's recommendation

Explanation

Vendor due diligence should confirm that the vendor is legitimate, identify its ownership, and validate bank details before payments are made. These steps reduce the risk of fictitious vendors, conflicts of interest, and payment diversion. Discounts or sales recommendations do not justify skipping verification.

Question 44Fraud Prevention and Deterrence

An anti-retaliation policy supports fraud prevention by:

  1. Requiring every report to be signed
  2. Protecting reporters who raise concerns Correct answer.
  3. Punishing employees who report suspicions
  4. Discouraging employees from ever using the hotline

Explanation

Protecting reporters from retaliation encourages employees to raise concerns internally rather than remaining silent or reporting externally. This increases the likelihood that fraud is detected early. Punishing reporters or discouraging hotline use would have the opposite effect.

Question 45Fraud Prevention and Deterrence

A sudden, unexplained improvement in a branch's key performance indicators should prompt management to:

  1. Ignore it because results improved
  2. Inquire whether results reflect manipulation Correct answer.
  3. Assume the data is correct
  4. Reward the branch immediately

Explanation

Unexplained performance improvements can signal manipulation of records, revenue recognition, or expenses, so management should inquire into the cause. Analytical review is most useful when unusual patterns are investigated rather than assumed to be valid. Immediate rewards or indifference can allow fraud to continue.

Question 46Fraud Prevention and Deterrence

An employee has a strong incentive and access to commit fraud but lacks the technical skill to conceal it. Under the fraud diamond, the employee is least likely to proceed because of lacking:

  1. Opportunity
  2. Capability Correct answer.
  3. Rationalization
  4. Pressure

Explanation

The fraud diamond adds capability to the fraud triangle, recognizing that a person must have the skills and position to execute and conceal the scheme. Even with motive and access, a lack of capability can prevent the fraud. Pressure, rationalization, and opportunity address different aspects of the decision.

Question 47Fraud Prevention and Deterrence

The Albrecht fraud scale replaces rationalization with which factor?

  1. Concealment
  2. Capability
  3. Personal integrity Correct answer.
  4. Opportunity

Explanation

The fraud scale uses situational pressure, opportunity, and personal integrity as its three factors. Personal integrity serves as a substitute for rationalization in explaining whether a person will act on pressure and opportunity. Capability belongs to the fraud diamond, and concealment is part of the fraud act.

Question 48Fraud Prevention and Deterrence

Cressey's research suggests fraud is most likely when a person has:

  1. A non-shareable financial problem Correct answer.
  2. A strict ethical code
  3. A large salary
  4. A short tenure

Explanation

Cressey described fraud as occurring when a person has a non-shareable financial problem, an opportunity to resolve it through trust violation, and a way to rationalize the act. The problem is non-shareable because the person feels unable to disclose it. Salary level, ethics, and tenure alone do not define this condition.

Question 49Fraud Prevention and Deterrence

An employee reports suspected fraud to a supervisor who is involved in the scheme. The greatest weakness in this reporting path is that:

  1. The employee may receive a reward
  2. The report may be suppressed or concealed Correct answer.
  3. The supervisor may document the report
  4. The report may be investigated too quickly

Explanation

When the reporting channel runs through someone implicated in the scheme, that person can suppress, alter, or conceal the report. This undermines detection and exposes the reporter to risk. Effective reporting paths should provide an independent alternative, such as a hotline or compliance function.

Question 50Fraud Prevention and Deterrence

Which control most directly reduces the risk that a terminated employee retains access to financial systems?

  1. Removing access as part of termination Correct answer.
  2. Conducting a monthly bank reconciliation
  3. Requiring annual ethics training for all staff
  4. Increasing the number of journal entry approvers

Explanation

Termination procedures should include prompt removal or disabling of system access, often through a checklist coordinated with human resources and IT. This prevents a former employee from initiating transactions or accessing sensitive data. Training, approver counts, and reconciliations address different risks.