I85PREP
⌘ K
CFF study materials
CFF study resources

CFF practice questions

One question at a time. Build your CFF understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Financial forensics (domain breakdown not published in retrieved source)

A fraud examiner is retained to determine whether an employee diverted customer payments. Which sequence best reflects the standard investigative process for a financial forensic engagement?

  1. Report preliminary conclusions, gather evidence, then plan the scope of work
  2. Preserve evidence, issue the report, then interview the suspect
  3. Plan the engagement and assess risk, gather and preserve evidence, analyze the data, then report findings Correct answer.
  4. Analyze the data, obtain the engagement letter, then preserve evidence

Explanation

Financial forensic engagements follow a logical progression: define scope and objectives, assess fraud risk, collect and preserve evidence in a defensible manner, perform analysis, and communicate results in a report. Evidence must be secured before meaningful analysis, and conclusions cannot precede the work performed. The report is the final deliverable, not an early step.

Question 2Financial forensics (domain breakdown not published in retrieved source)

Which document typically establishes the scope, objectives, and authority of a financial forensic engagement and is agreed before substantive work begins?

  1. The management representation letter
  2. The chain-of-custody form
  3. The engagement letter Correct answer.
  4. The audit committee charter

Explanation

The engagement letter defines the services to be performed, the scope and objectives, responsibilities of each party, and the basis for fees; it authorizes the work and frames later reporting. The audit committee charter governs an audit committee, not an external forensic engagement. A management representation letter is obtained near the end of an audit, and a chain-of-custody form tracks evidence.

Question 3Financial forensics (domain breakdown not published in retrieved source)

During an internal investigation, an examiner interviews employees about a suspected kickback scheme. Which practice best preserves the integrity of the interviews?

  1. Sharing the suspect's statement with other witnesses before their interviews
  2. Interviewing all employees together to compare their accounts in real time
  3. Conducting separate interviews and documenting each statement contemporaneously Correct answer.
  4. Recording only the interviewer's summary and discarding raw notes

Explanation

Witnesses should be interviewed separately so that one account does not contaminate another, and each statement should be documented contemporaneously to create a reliable record. Group interviews allow collusion and pressure. Disclosing one person's statement to others undermines independence, and destroying raw notes weakens the evidentiary record.

Question 4Financial forensics (domain breakdown not published in retrieved source)

An examiner obtains a laptop believed to contain evidence of expense fraud. Which action best supports admissibility of the digital evidence?

  1. Asking the suspect to email the relevant spreadsheets to the examiner
  2. Creating a forensic image with a write-blocker and documenting a hash value Correct answer.
  3. Booting the laptop normally and copying files to a personal drive
  4. Deleting temporary files to reduce the volume of data to review

Explanation

A forensic image made through a write-blocker preserves the original media without alteration, and a cryptographic hash documents that the image matches the source. Booting the machine or deleting files changes metadata and content. Having the suspect select and send files gives the subject control over what evidence exists.

Question 5Financial forensics (domain breakdown not published in retrieved source)

Which statement best describes the purpose of maintaining a chain of custody for documentary and digital evidence?

  1. It records each transfer and custodian so the evidence's integrity can be demonstrated Correct answer.
  2. It establishes the suspect's motive for the fraud
  3. It replaces the need for an expert report at trial
  4. It proves the financial amount of the loss to a reasonable certainty

Explanation

A chain of custody is a chronological record of who handled the evidence, when, and under what conditions, allowing the examiner to show the item was not altered. It does not quantify loss, substitute for analysis, or address motive. Its function is authentication and integrity, not valuation.

Question 6Financial forensics (domain breakdown not published in retrieved source)

An examiner reviews a company's accounts payable ledger and finds several vendors sharing the same bank account and mailing address. This pattern most directly suggests which fraud risk?

  1. Inventory shrinkage from theft by customers
  2. Revenue recognition cut-off error
  3. A fictitious vendor or shell company scheme Correct answer.
  4. Improper capitalization of repairs

Explanation

Vendors that share banking details, addresses, or phone numbers are a classic indicator of fictitious or shell vendors controlled by an employee. Revenue cut-off, customer theft of inventory, and capitalization policy errors do not produce duplicate vendor master data. The shared account points to a single beneficial owner behind multiple payees.

Question 7Financial forensics (domain breakdown not published in retrieved source)

In a financial statement fraud investigation, which condition is most consistent with the fraud triangle's 'opportunity' element?

  1. A manager faces pressure to meet analyst earnings forecasts
  2. An employee has gambling debts and needs cash quickly
  3. A single clerk both creates vendors and approves payments Correct answer.
  4. An executive rationalizes fraud as a temporary loan

Explanation

Opportunity refers to circumstances that allow fraud to occur, such as a lack of segregation of duties; one person controlling vendor creation and payment approval is a textbook example. Pressure involves financial need or targets, and rationalization is the offender's self-justification. Those two describe different legs of the triangle.

Question 8Financial forensics (domain breakdown not published in retrieved source)

Which of the following is the most reliable documentary evidence of a payment actually being received by a vendor?

  1. A canceled check or bank record showing the debit Correct answer.
  2. A purchase requisition signed by the department head
  3. A vendor invoice stamped as received
  4. A receiving report signed at the loading dock

Explanation

Independent bank records showing the actual debit provide external corroboration that funds left the organization and to whom, making them strong evidence of payment. Requisitions, receiving reports, and invoices are internally generated and can be created or altered. They document authorization or receipt of goods, not that money moved.

Question 9Financial forensics (domain breakdown not published in retrieved source)

An examiner analyzing a general ledger export wants to identify unusual journal entries. Which technique is most appropriate for this purpose?

  1. Summing all debit balances to confirm the ledger is in balance
  2. Calculating the average number of accounts per vendor
  3. Reviewing the chart of accounts for naming conventions
  4. Extracting entries posted on weekends or by users who rarely post Correct answer.

Explanation

CAAT-style analysis targets anomalies such as off-hours postings, unusual users, round-dollar amounts, or entries made after period close, which are common concealment techniques. Confirming debits equal credits only tests arithmetic. Reviewing account names or vendor counts does not isolate suspicious entries.

Question 10Financial forensics (domain breakdown not published in retrieved source)

An employee submits expense reports with receipts that appear to be altered to show higher amounts. Which analytical test would most efficiently flag this scheme across a large dataset?

  1. Looking for repeated receipt numbers or identical amounts across different dates Correct answer.
  2. Checking whether the employee has a corporate credit card
  3. Reviewing the employee's travel destinations
  4. Comparing receipt amounts with the employee's salary band

Explanation

Duplicate receipt numbers or identical amounts appearing on different dates indicate a receipt was resubmitted or altered, which is a hallmark of expense reimbursement fraud. Salary bands, destinations, and card ownership do not test the authenticity of the amounts claimed. Data matching for duplicates is a high-yield forensic test.

Question 11Financial forensics (domain breakdown not published in retrieved source)

An examiner computes Benford's Law analysis on a company's disbursement amounts and finds a significant excess of amounts beginning with the digit 4. What is the most appropriate interpretation?

  1. The digital anomaly warrants follow-up testing to determine its cause Correct answer.
  2. The disbursements are conclusively fraudulent and should be reported as such
  3. Benford's Law cannot be applied to financial data
  4. The result proves that the accounting system has a rounding error

Explanation

Benford's Law identifies distributions that deviate from expected digit frequencies, but an anomaly is a red flag that requires corroboration, not proof of fraud. Legitimate causes such as approval thresholds or pricing policies can skew digits. The examiner should investigate the underlying transactions before drawing conclusions.

Question 12Financial forensics (domain breakdown not published in retrieved source)

An examiner suspects that an employee created a fictitious vendor. Which combination of tests best corroborates the suspicion?

  1. Reviewing the vendor master file for a post office box address and verifying the entity's registration with the state Correct answer.
  2. Comparing the vendor's invoice totals with the annual budget
  3. Reviewing the purchase order sequence numbers for gaps
  4. Confirming the vendor's invoices were approved by the department manager

Explanation

Fictitious vendors often use mail drops and may not be registered as legitimate businesses, so master-file screening for P.O. boxes plus independent verification of registration directly tests existence. Manager approval and budget comparison do not establish that the vendor is real. Purchase order sequence gaps relate to completeness of records, not vendor existence.

Question 13Financial forensics (domain breakdown not published in retrieved source)

During a fraud examination, the examiner learns that the suspect's spouse owns a company that received payments from the suspect's employer. Which step is most appropriate next?

  1. Obtain public records to establish the ownership link and analyze the related transactions Correct answer.
  2. Delete the suspect's emails to prevent further access
  3. Confront the suspect immediately without further documentation
  4. Assume the payments are legitimate because they were approved

Explanation

A conflict-of-interest or related-party indicator should be corroborated through independent public records such as business registrations and property records, then tested against the payment data. Confronting the subject before evidence is developed risks destruction of records. Approval or deletion of data does not resolve the question.

Question 14Financial forensics (domain breakdown not published in retrieved source)

An examiner is asked to quantify losses from a billing scheme in which invoices were inflated by 10 percent over three years. Which approach best supports a defensible loss calculation?

  1. Comparing invoiced amounts with independent price lists or contract terms for each transaction Correct answer.
  2. Multiplying the suspect's annual salary by three
  3. Using the amount stated in the initial complaint
  4. Estimating the loss as a fixed percentage of total company revenue

Explanation

A defensible loss figure is built transaction by transaction, comparing what was billed with what should have been billed under contracts or market prices, then summing the overcharges. Salary, revenue percentages, and complaint allegations are not evidence-based measures of the actual loss. The calculation should be reproducible from source documents.

Question 15Financial forensics (domain breakdown not published in retrieved source)

Which of the following best describes the role of an expert witness in a financial forensic matter?

  1. To advocate for the retaining party's position
  2. To decide questions of law for the court
  3. To assist the trier of fact by applying specialized knowledge to the facts Correct answer.
  4. To serve as a fact witness who only recounts what was observed

Explanation

An expert witness provides opinion testimony based on specialized knowledge to help the court understand complex financial issues. The expert's duty is to the trier of fact, not to advocate for the retaining party. Questions of law are for the judge, and a fact witness testifies about firsthand observations rather than opinions.

Question 16Financial forensics (domain breakdown not published in retrieved source)

An examiner discovers that an employee has been issuing credits to a customer account and then collecting the refunds personally. Which control weakness most directly enabled this scheme?

  1. Insufficient physical security over the warehouse
  2. Absence of a whistleblower hotline
  3. Lack of segregation between issuing credits and processing refunds Correct answer.
  4. Failure to reconcile the fixed asset register

Explanation

The scheme works because the same person can both create the credit and direct or collect the refund, so no independent party reviews the adjustment. Separating authorization of credits from refund processing would interrupt the scheme. Warehouse security, fixed asset reconciliation, and hotlines do not address credit and refund authority.

Question 17Financial forensics (domain breakdown not published in retrieved source)

An examiner uses data analytics to compare the employee master file with the vendor master file and finds matches on tax identification numbers. What does this finding most likely indicate?

  1. A duplicate payment to a legitimate supplier
  2. A data entry error in the general ledger
  3. A routine update to the chart of accounts
  4. A potential undisclosed relationship between an employee and a vendor Correct answer.

Explanation

Matching tax identification numbers between employees and vendors suggests that an employee may have an undisclosed interest in a vendor, a related-party or conflict-of-interest red flag. The test does not address ledger errors, duplicate payments, or account maintenance. Such matches warrant verification and review of payments to the vendor.

Question 18Financial forensics (domain breakdown not published in retrieved source)

In preparing a forensic report, which practice best supports the report's reliability if it is later challenged?

  1. Omitting limitations so the report appears stronger
  2. Stating conclusions without describing the underlying procedures
  3. Including only the evidence that supports the client's theory
  4. Citing the specific documents and analyses supporting each finding Correct answer.

Explanation

A forensic report should link each conclusion to the evidence and procedures that produced it, so a reader can trace and test the reasoning. Omitting limitations or contrary evidence undermines objectivity and invites attack. Conclusions without documented support cannot be independently verified.

Question 19Financial forensics (domain breakdown not published in retrieved source)

An examiner finds that a bookkeeper has been writing checks to a vendor with no purchase orders and cashing them through a personal account. Which red flag combination is most consistent with this scheme?

  1. Multiple competitive bids and a signed contract
  2. Regular bank reconciliations performed by a second person
  3. Sequential invoice numbers and timely approvals
  4. Missing purchase orders, round-dollar amounts, and a vendor address matching the bookkeeper Correct answer.

Explanation

Check tampering and fictitious vendor schemes commonly show absent supporting documents, round-dollar amounts, and payee details linked to the perpetrator. Sequential invoices, competitive bids, and independent reconciliations are signs of a normal control environment. The combination of missing documentation and personal linkage is the strongest indicator.

Question 20Financial forensics (domain breakdown not published in retrieved source)

An examiner is asked to determine whether a company's revenue was overstated through channel stuffing. Which evidence would best support the conclusion?

  1. Shipping records showing large shipments near period end with unusually high subsequent returns Correct answer.
  2. A sales manager's statement that the quarter was strong
  3. A comparison of revenue to the prior year's budget
  4. The company's published earnings guidance

Explanation

Channel stuffing is indicated by shipments concentrated at period end followed by high return rates, which shows goods were pushed to distributors rather than genuinely sold. A manager's assertion, budget comparison, and guidance are not transaction-level evidence. Shipping and returns data provide the objective pattern needed.

Question 21Financial forensics (domain breakdown not published in retrieved source)

An examiner reviews a bank statement and notices a series of deposits just below the currency transaction reporting threshold. This pattern is most consistent with which activity?

  1. A bank error in posting amounts
  2. Ordinary payroll deposits
  3. Structuring to avoid reporting requirements Correct answer.
  4. Legitimate refunds to customers

Explanation

Repeated deposits deliberately kept just under a reporting threshold are a classic indicator of structuring, which is designed to evade currency transaction reporting. Payroll, posting errors, and customer refunds do not typically produce a consistent pattern of amounts just below the threshold. The pattern itself is the red flag requiring further review.

Question 22Financial forensics (domain breakdown not published in retrieved source)

An examiner needs to determine whether an employee's lifestyle is inconsistent with known income. Which evidence source is most appropriate and defensible?

  1. Public property records, vehicle registrations, and court filings Correct answer.
  2. Rumors circulating among coworkers
  3. The employee's social media posts alone
  4. Anonymous tips submitted to management

Explanation

Public records such as property deeds, vehicle registrations, and court filings provide verifiable, independent evidence of assets and obligations that can be compared with reported income. Rumors, social media alone, and anonymous tips may prompt inquiry but are not reliable evidence. The examiner should corroborate any lead with documented sources.

Question 23Financial forensics (domain breakdown not published in retrieved source)

An examiner testifies in a matter where the opposing party challenges the methodology used to extrapolate losses from a sample of transactions. Which response best strengthens the examiner's position?

  1. Asserting that the sample was chosen by management
  2. Stating that the exact loss cannot be determined so any estimate is acceptable
  3. Relying on the total amount claimed in the pleadings
  4. Explaining the sampling design, its statistical basis, and how the extrapolation was validated Correct answer.

Explanation

Extrapolation is defensible when the examiner can explain the sampling method, why it is representative, and how results were projected and tested. Delegating sample selection to management or accepting an untested estimate weakens reliability. The pleadings are allegations, not a methodology. Transparency about design and validation is the strongest response.

Question 24Financial forensics (domain breakdown not published in retrieved source)

An examiner discovers that the suspect used a company-issued device and personal cloud storage to conceal transactions. Which approach best addresses both sources while preserving admissibility?

  1. Asking the suspect to export the cloud data to a shared drive
  2. Relying on screenshots taken by an IT administrator
  3. Reviewing only the company device because personal accounts are out of scope
  4. Obtaining proper legal authority for each source and imaging both with documented hashes Correct answer.

Explanation

Each data source requires appropriate legal authority, and both should be acquired forensically with documented hashing to preserve integrity. Ignoring the personal account leaves evidence unexamined. Having the suspect export data or relying on informal screenshots compromises authenticity and custody. Proper authority plus forensic acquisition protects admissibility.

Question 25Financial forensics (domain breakdown not published in retrieved source)

An examiner evaluates whether a payment to a foreign intermediary may violate anti-bribery laws. Which factor is most relevant to the analysis?

  1. Whether the intermediary was paid in a currency other than the local currency
  2. Whether the payment was approved by the sales department
  3. Whether the payment was recorded accurately in the books and records Correct answer.
  4. Whether the intermediary's fee exceeded the industry average

Explanation

Anti-bribery frameworks require accurate recording of transactions, and improper payments are often concealed through false invoices or misclassified entries; the accuracy of books and records is therefore central. Currency, internal approval, and fee comparisons may be contextual but do not by themselves determine legality. The recording and purpose of the payment are the key issues.

Question 26Financial forensics (domain breakdown not published in retrieved source)

During a fraud examination, a controller is found to have both approved invoices and released payments to the same vendor for two years. Which internal control weakness does this most directly represent?

  1. Failure to segregate authorization and custody duties Correct answer.
  2. Lack of annual vendor address verification
  3. Inadequate physical security over blank check stock
  4. Absence of a documented chart of accounts

Explanation

Segregation of duties requires that the person authorizing a transaction not also control the related asset or payment release. Combining invoice approval with payment release gives one person the ability to create and conceal an improper disbursement. The other conditions may raise risk but do not describe the same conflict of duties.

Question 27Financial forensics (domain breakdown not published in retrieved source)

An examiner is retained to determine whether a company's reported receivables are genuine. Which source would best provide independent confirmation that a customer actually owes the balance?

  1. A written confirmation obtained directly from the customer by the examiner Correct answer.
  2. The company's aged accounts receivable subsidiary ledger
  3. The sales manager's memorandum describing the account
  4. The internal credit approval file for the customer

Explanation

Evidence is stronger when it comes from an independent source outside the entity and reaches the examiner directly. A confirmation sent and received by the examiner reduces the chance that company personnel altered the response. Internal records and management statements are less persuasive because they originate within the entity under investigation.

Question 28Financial forensics (domain breakdown not published in retrieved source)

An examiner interviews a warehouse supervisor about missing inventory. The supervisor repeatedly looks away, changes the subject, and gives vague answers about shipping logs. How should the examiner treat this behavior?

  1. As a cue warranting further inquiry, but not proof of involvement Correct answer.
  2. As irrelevant because demeanor is never admissible
  3. As grounds to immediately terminate the interview
  4. As conclusive proof that the supervisor participated in the theft

Explanation

Behavioral cues during interviews can guide follow-up questions but are not reliable indicators of deception on their own. The examiner should corroborate statements with documentary and physical evidence. Treating demeanor as proof risks a false conclusion about an innocent or nervous witness.

Question 29Financial forensics (domain breakdown not published in retrieved source)

An examiner is documenting a chain of custody for seized laptop hard drives. Which record element is most essential to preserve the evidence's integrity?

  1. A summary of the suspect's prior employment history
  2. Continuous documentation of who handled the item and when Correct answer.
  3. The examiner's opinion of the drive's contents
  4. A list of every file opened during review

Explanation

Chain of custody demonstrates that evidence was continuously controlled and unaltered from seizure through analysis. Each transfer, date, and custodian should be recorded so gaps or tampering can be ruled out. Opinions and unrelated background do not establish physical integrity of the item.

Question 30Financial forensics (domain breakdown not published in retrieved source)

An examiner reviews a suspect's bank records and finds regular round-dollar deposits of $9,500 each month from an unidentified source. Which interpretation is most appropriate at this stage?

  1. The deposits are normal and require no follow-up
  2. The deposits establish that the suspect evaded income tax
  3. The deposits prove a structuring scheme beyond doubt
  4. The deposits are a red flag requiring identification of the source Correct answer.

Explanation

Round-dollar recurring deposits from an unexplained source are a recognized anomaly that warrants investigation. Their pattern is suspicious but does not by itself establish a specific crime or intent. The examiner must identify the source and corroborate before drawing conclusions.

Question 31Financial forensics (domain breakdown not published in retrieved source)

Which document would an examiner examine first to understand the ownership structure of a privately held entity suspected of related-party transactions?

  1. The marketing department's budget
  2. The entity's organizational filings and ownership records Correct answer.
  3. The most recent utility bill for the entity
  4. A customer satisfaction survey

Explanation

Ownership and organizational filings identify the individuals and entities that control the subject company. That structure is the starting point for tracing related-party relationships and potential conflicts. Utility bills, surveys, and budgets do not reveal ownership or control.

Question 32Financial forensics (domain breakdown not published in retrieved source)

An examiner is preparing a report that will be used in litigation. Which practice best supports the report's credibility?

  1. Presenting only conclusions without describing the procedures performed
  2. Omitting any findings that weaken the client's position
  3. Citing the specific records examined and the methods applied Correct answer.
  4. Including the examiner's personal opinion of the suspect's character

Explanation

A forensic report is more defensible when it documents the evidence relied upon and the procedures used so another professional could evaluate or replicate the work. Transparency about methods and sources supports reliability under challenge. Omitting unfavorable findings or opining on character undermines objectivity.

Question 33Financial forensics (domain breakdown not published in retrieved source)

An examiner notices that a single journal entry posted at year-end moves a large amount from an expense account to a prepaid asset account with no supporting documentation. Which characteristic makes this entry most suspicious?

  1. It was posted at period end without support Correct answer.
  2. It was prepared by an accounting employee
  3. It was recorded in the general ledger
  4. It affected more than one account

Explanation

Year-end entries that lack supporting documentation and alter reported results are a classic earnings-management red flag. The timing and absence of support distinguish it from routine, documented transactions. Double-entry postings by accounting staff are ordinary and not inherently suspicious.

Question 34Financial forensics (domain breakdown not published in retrieved source)

An examiner is analyzing a disbursement file and wants to identify payments made to vendors whose addresses match employee home addresses. Which data field combination is most useful for this test?

  1. Vendor invoice amount and purchase order number
  2. Vendor payment date and check number
  3. Vendor address and employee address Correct answer.
  4. Vendor tax identification and general ledger account

Explanation

Matching vendor addresses against employee addresses can reveal fictitious vendors or conflicts of interest. Address is the shared field that enables the comparison. Dates, check numbers, amounts, and account codes do not by themselves link a vendor to an employee.

Question 35Financial forensics (domain breakdown not published in retrieved source)

An examiner is estimating losses from a payroll scheme in which a supervisor added ghost employees. Which approach best quantifies the loss?

  1. Averaging the total payroll for the industry
  2. Multiplying the suspect's annual salary by the number of years employed
  3. Using the company's total payroll expense for the year
  4. Summing the net pay issued to the identified ghost employees during the scheme period Correct answer.

Explanation

Loss quantification should be tied to the specific improper payments identified through evidence. Summing the amounts actually paid to the ghost employees during the scheme period measures the loss directly. Salary multiples, industry averages, and total payroll are not evidence-based measures of the improper payments.

Question 36Financial forensics (domain breakdown not published in retrieved source)

During an examination, an employee admits in an interview to taking cash but refuses to sign a written statement. What is the examiner's best course of action?

  1. Prepare a memorandum documenting the oral admission and the circumstances Correct answer.
  2. Record the admission as proven fact without corroboration
  3. Discard the admission because it was not written
  4. Threaten the employee with prosecution to obtain a signature

Explanation

An oral admission can still be useful evidence if the examiner contemporaneously documents what was said and the context. Corroborating evidence should be gathered to support the statement. Coercion and treating an uncorroborated admission as proven fact are improper.

Question 37Financial forensics (domain breakdown not published in retrieved source)

An examiner is reviewing email metadata from a company server. Which element is most useful in establishing when a message was actually sent?

  1. The signature block at the end of the message body
  2. The font used in the message
  3. The server-generated timestamp in the message header Correct answer.
  4. The subject line of the message

Explanation

Message headers contain server-generated timestamps that record transmission events. These are more reliable than content the sender controls. Subject lines, signatures, and formatting are authored content and can be altered or misleading.

Question 38Financial forensics (domain breakdown not published in retrieved source)

An examiner suspects that a purchasing manager steered contracts to a company owned by a relative. Which investigative step most directly tests this suspicion?

  1. Counting the number of purchase orders issued
  2. Comparing the vendor's ownership records with the manager's disclosed relationships Correct answer.
  3. Reviewing the manager's performance evaluations
  4. Reviewing the company's marketing plan

Explanation

Related-party schemes are proven by linking the vendor's ownership or control to a person connected to the employee. Comparing ownership records against disclosed relationships tests that link directly. Performance evaluations, marketing plans, and purchase order counts do not establish the relationship.

Question 39Financial forensics (domain breakdown not published in retrieved source)

An examiner finds that a company recorded revenue on goods shipped after the reporting date but dated the invoices before period end. Which assertion is most directly affected?

  1. Valuation of inventory
  2. Cutoff of revenue Correct answer.
  3. Classification of liabilities
  4. Completeness of expenses

Explanation

Cutoff concerns whether transactions are recorded in the correct accounting period. Dating invoices before period end for goods shipped afterward misstates the period in which revenue is recognized. Expense completeness, inventory valuation, and liability classification are different assertions.

Question 40Financial forensics (domain breakdown not published in retrieved source)

An examiner is evaluating a tip received through a hotline alleging that a manager accepts gifts from suppliers. Which initial step best preserves the value of the allegation?

  1. Disregard the tip because it is anonymous
  2. Confront the manager immediately with the allegation
  3. Document the tip details and gather corroborating records before any confrontation Correct answer.
  4. Announce the investigation to the entire department

Explanation

Early documentation and discreet corroboration protect the investigation and prevent destruction of evidence. Confronting the subject or publicizing the matter before gathering evidence can allow concealment. Anonymous tips can be valuable and should be assessed rather than dismissed.

Question 41Financial forensics (domain breakdown not published in retrieved source)

An examiner compares the number of invoices paid to each vendor in the last digit position and finds a vendor with an unusually high count of invoices ending in zero. What does this most likely suggest?

  1. The vendor provides legitimate volume discounts
  2. Invoices may have been fabricated or rounded artificially Correct answer.
  3. The vendor operates in a cash-intensive industry
  4. The company's accounting software is malfunctioning

Explanation

Fabricated amounts often cluster at round numbers because they are invented rather than generated by real transactions. An abnormal concentration of round-ending invoices warrants examination of supporting documents. Volume discounts, software faults, and industry type do not explain the digit pattern.

Question 42Financial forensics (domain breakdown not published in retrieved source)

An examiner is asked to determine whether a suspect's lifestyle is supported by legitimate income. Which evidence would be most persuasive?

  1. Documented asset purchases compared with documented income sources Correct answer.
  2. The suspect's social media posts about vacations
  3. A single credit card statement
  4. Neighbors' general impressions of the suspect's spending

Explanation

A lifestyle analysis compares documented expenditures and assets against documented, legitimate income. This method relies on verifiable records rather than impressions. General observations, social media, and isolated statements are weaker and less complete.

Question 43Financial forensics (domain breakdown not published in retrieved source)

An examiner discovers that an employee used a company credit card for personal purchases and coded them to a maintenance expense account. Which test would most efficiently detect this type of scheme across all cardholders?

  1. Counting the number of cards issued
  2. Reviewing the employee's personnel file
  3. Analyzing card transactions for merchant categories inconsistent with the assigned expense account Correct answer.
  4. Reviewing the company's travel policy manual

Explanation

Comparing merchant category and transaction detail against the expense account charged can reveal personal purchases disguised as business costs. This test scales across all cardholders. Personnel files, card counts, and policy manuals do not identify improper transactions.

Question 44Financial forensics (domain breakdown not published in retrieved source)

An examiner is preparing to testify about a loss calculation. The opposing counsel asks whether the examiner considered alternative explanations for the shortfall. What is the most defensible response?

  1. The examiner states that alternatives were unnecessary because the client requested the analysis
  2. The examiner declines to answer on the grounds of client confidentiality
  3. The examiner explains which alternatives were considered and why they were rejected or incorporated Correct answer.
  4. The examiner states that the calculation is proprietary and cannot be discussed

Explanation

An expert must be able to explain the reasoning behind a methodology, including how alternative explanations were addressed. Demonstrating that alternatives were considered strengthens the reliability of the opinion. Refusing to answer or relying on the client's request weakens credibility.

Question 45Financial forensics (domain breakdown not published in retrieved source)

An examiner is reviewing a general ledger and finds an entry debiting an expense account and crediting a liability account, posted by a user whose normal role is in shipping. Which factor most warrants follow-up?

  1. The entry was made during business hours
  2. The entry was posted by a user outside the accounting function Correct answer.
  3. The entry affects two accounts
  4. The entry uses standard account codes

Explanation

Entries posted by users whose job duties do not include accounting can indicate unauthorized access or override of controls. That anomaly, combined with the nature of the entry, merits examination of supporting documentation. Standard codes, business-hours timing, and double-entry structure are ordinary.

Question 46Financial forensics (domain breakdown not published in retrieved source)

An examiner is analyzing a company's payments to a foreign sales agent and wants to assess bribery risk. Which factor is most significant?

  1. The agent's commission rate is below industry average
  2. The agent has a long-standing contract
  3. The agent communicates primarily by email
  4. Payments were routed to an offshore account not tied to the agent's stated address Correct answer.

Explanation

Routing payments to an offshore account disconnected from the agent's stated location is a recognized bribery red flag. Such arrangements can conceal the ultimate recipient of funds. Commission levels, contract duration, and communication methods are less indicative of improper payments.

Question 47Financial forensics (domain breakdown not published in retrieved source)

An examiner is reconstructing income for a suspect who operates a cash business and keeps no reliable records. Which method is most appropriate?

  1. Estimating income from the suspect's job title
  2. Applying a source-and-application-of-funds analysis based on documented expenditures and known receipts Correct answer.
  3. Relying on the suspect's spouse's estimate of earnings
  4. Using the suspect's stated income without adjustment

Explanation

When records are unreliable, a source-and-application analysis reconstructs funds available and spent using documented evidence. Unexplained expenditures exceeding known legitimate sources can indicate unreported income. Self-reported figures and job-title assumptions lack evidentiary support.

Question 48Financial forensics (domain breakdown not published in retrieved source)

An examiner finds that a suspect deleted files from a company laptop shortly after being notified of an investigation. Which action best preserves the evidentiary value of the deletion?

  1. Forensically imaging the drive and analyzing file system artifacts and unallocated space Correct answer.
  2. Immediately reimaging the drive after the suspect's cooperation
  3. Asking the suspect to restore the files manually
  4. Relying on the suspect's explanation of what was deleted

Explanation

Forensic imaging preserves the drive state, and analysis of file system artifacts and unallocated space can recover deleted content and timing. This supports conclusions about what was deleted and when. Relying on the suspect or informal restoration risks loss and contamination of evidence.

Question 49Financial forensics (domain breakdown not published in retrieved source)

An examiner is evaluating whether a company's revenue growth is consistent with its industry. Reported revenue rose sharply while receivables days outstanding doubled and operating cash flow declined. Which conclusion is most supported?

  1. The decline in cash flow proves theft of cash by an employee
  2. The pattern is consistent with possible premature or fictitious revenue recognition Correct answer.
  3. The increase in receivables days is unrelated to revenue quality
  4. The revenue growth is fully supported by cash collections

Explanation

Revenue growth accompanied by lengthening receivables and declining operating cash flow can indicate revenue recognized before it is earned or collected. This pattern warrants examination of cutoff, side agreements, and collectability. It does not by itself prove employee theft, and the receivables trend is directly relevant to revenue quality.

Question 50Financial forensics (domain breakdown not published in retrieved source)

An examiner is asked to determine whether a suspect's gambling losses were funded by embezzled funds. Which evidence combination best supports the conclusion?

  1. The suspect's general reputation for gambling
  2. The number of casinos in the region
  3. Casino loyalty records and the suspect's bank deposits Correct answer.
  4. The suspect's stated intention to gamble less

Explanation

Linking documented gambling activity to documented fund flows establishes a connection between the losses and the source of funds. Casino records and bank deposits are verifiable financial evidence. Reputation, regional casino counts, and stated intentions do not trace funds.