I85PREP
⌘ K
CIFI study materials
CIFI study resources

CIFI practice questions

One question at a time. Build your CIFI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Insurance fraud detection

Which of the following best describes soft fraud in an insurance claim?

  1. Exaggerating or embellishing a legitimate claim Correct answer.
  2. Issuing a policy without underwriting
  3. Recording an incorrect claim code
  4. Inventing a loss that never occurred

Explanation

Soft fraud is opportunistic and builds on a real insured event, often by inflating damages, injuries, or lost income. It differs from hard fraud, which involves fabricating the loss itself.

Question 2Insurance fraud detection

In claims handling, a red flag is best described as which of the following?

  1. Proof that fraud occurred
  2. A legal finding of misrepresentation
  3. An indicator that warrants closer review Correct answer.
  4. A mandatory basis for denial

Explanation

A red flag is a warning sign or anomaly that suggests fraud may be present and justifies further review. It is not proof, a legal ruling, or an automatic denial trigger.

Question 3Insurance fraud detection

What is the primary function of a Special Investigation Unit (SIU)?

  1. Paying routine claims within adjuster authority
  2. Investigating suspected fraudulent claims and referring them appropriately Correct answer.
  3. Setting premium rates for policyholders
  4. Marketing fraud detection software

Explanation

An SIU investigates claims with suspected fraud, gathers evidence, and coordinates referrals to law enforcement or other appropriate parties. Routine payment and ratemaking are outside its primary role.

Question 4Insurance fraud detection

Which organization is a primary source of insurance fraud intelligence and vehicle theft data in the United States?

  1. The National Association of Insurance Commissioners
  2. The Insurance Services Office
  3. The National Insurance Crime Bureau Correct answer.
  4. The Federal Bureau of Investigation

Explanation

The National Insurance Crime Bureau (NICB) collects and shares insurance crime and vehicle theft intelligence with member insurers and law enforcement. The other organizations serve different regulatory, data, or law enforcement roles.

Question 5Insurance fraud detection

Which claimant circumstance is most commonly treated as a fraud red flag?

  1. Stable employment history
  2. Annual premium payment
  3. Sudden severe financial pressure before the loss Correct answer.
  4. Long-term policy tenure

Explanation

Sudden financial distress shortly before a loss can create motive and is a recognized fraud indicator. Long tenure, annual premium payment, and stable employment are generally neutral or positive factors.

Question 6Insurance fraud detection

When an adjuster refers a claim to SIU, what is most important to include in the referral?

  1. The adjuster's informal opinion without facts
  2. Specific red flags and supporting claim facts Correct answer.
  3. Only the claimant's name and policy number
  4. A statement that fraud has been proven

Explanation

A useful referral identifies the specific suspicious facts and red flags so the investigator can evaluate and prioritize the matter. It should not assert proof or rely on unsupported opinion.

Question 7Insurance fraud detection

A common financial motive for arson fraud is which of the following?

  1. Avoiding a deductible
  2. Reducing future premiums
  3. Relieving financial pressure by collecting proceeds Correct answer.
  4. Increasing the property's market value

Explanation

Arson fraud is often driven by the desire to obtain insurance proceeds to escape financial distress or dispose of an unwanted property. Deductibles and future premiums are not typical motives for intentionally setting a fire.

Question 8Insurance fraud detection

A material misrepresentation in an insurance application is one that does which of the following?

  1. Is always ignored by insurers
  2. Would have affected issuance or rating of the policy Correct answer.
  3. Occurs after the policy is issued
  4. Concerns only a mailing address

Explanation

Materiality depends on whether the truthful information would have influenced the insurer's decision to issue coverage or set its terms and premium. Minor or irrelevant details generally do not meet that standard.

Question 9Insurance fraud detection

Which pattern most suggests a staged auto accident?

  1. The claimant declines all medical treatment
  2. Police file a report at the scene
  3. A single-vehicle collision with no injuries
  4. Multiple occupants with identical injuries and the same attorney Correct answer.

Explanation

Staged accidents often involve coordinated participants who claim similar soft-tissue injuries and quickly retain the same attorney or clinic. A straightforward single-car loss or a claimant who avoids treatment does not fit that pattern.

Question 10Insurance fraud detection

What is the main purpose of an Examination Under Oath (EUO)?

  1. To cancel the policy retroactively
  2. To obtain sworn testimony about the claim Correct answer.
  3. To set the amount of the settlement
  4. To determine fault for the accident

Explanation

An EUO is a policy condition that allows the insurer to question the claimant or insured under oath about the claim. It is an investigative tool, not a fault determination, settlement valuation, or automatic cancellation.

Question 11Insurance fraud detection

In claims triage, fraud scoring is used primarily to do which of the following?

  1. Prioritize claims for further review by risk indicators Correct answer.
  2. Deny every high-scoring claim automatically
  3. Replace investigator judgment entirely
  4. Establish legal liability between parties

Explanation

Fraud scoring helps route claims with elevated risk indicators to appropriate review, such as SIU. A score is a prioritization tool and does not by itself prove fraud, replace judgment, or decide liability.

Question 12Insurance fraud detection

What is a primary use of ISO ClaimSearch in fraud detection?

  1. Calculating premium rates
  2. Issuing certificates of insurance
  3. Underwriting new policies
  4. Searching claims history for prior or duplicate claims Correct answer.

Explanation

ISO ClaimSearch is a claims database used to identify prior claims, possible duplicates, and patterns involving the same parties or losses. It is not an underwriting, ratemaking, or certificate-issuance system.

Question 13Insurance fraud detection

Which indicator most suggests medical provider fraud in an auto injury claim?

  1. Identical billing patterns across unrelated claimants Correct answer.
  2. Treatment consistent with injury severity
  3. Itemized bills supported by records
  4. Referral to licensed specialists

Explanation

Provider fraud often appears as templated treatment, identical billing, or unusual referral patterns across unrelated claimants. Legitimate documentation and treatment matching the injury do not suggest fraud.

Question 14Insurance fraud detection

Which observation is a workers' compensation fraud red flag?

  1. Reporting pain accurately to the physician
  2. Observed doing activities inconsistent with claimed disability Correct answer.
  3. Attending all medical appointments
  4. Returning to work when medically cleared

Explanation

Surveillance or other evidence showing a claimant performing physical activities that contradict the claimed disability is a classic workers' compensation fraud indicator. Compliance with treatment and accurate reporting are not red flags.

Question 15Insurance fraud detection

Which practice most indicates agent or broker premium fraud?

  1. Submitting applications promptly
  2. Explaining policy exclusions to clients
  3. Collecting premiums from policyholders
  4. Falsifying payroll or class codes to lower premiums Correct answer.

Explanation

Premium fraud can involve misrepresenting payroll, classification, or exposure data so the insurer charges less than the true risk requires. Normal application handling and premium collection are legitimate activities.

Question 16Insurance fraud detection

A phantom vehicle in an auto claim refers to which of the following?

  1. A stolen vehicle recovered without damage
  2. A rental car substituted for a damaged car
  3. An unidentified vehicle blamed for a collision Correct answer.
  4. A vehicle owned by the insurer

Explanation

A phantom vehicle is alleged to have caused a collision but cannot be identified or located, often supporting a claim against uninsured motorist coverage. The other choices describe different vehicle situations.

Question 17Insurance fraud detection

Which red flag may suggest public adjuster fraud?

  1. Documenting damages with photographs
  2. Communicating with the insurer in writing
  3. Providing a written contract before work begins
  4. Door-to-door solicitation after a disaster with inflated damages Correct answer.

Explanation

Aggressive post-disaster solicitation combined with exaggerated damage estimates can indicate public adjuster fraud. Written contracts, photographs, and written communication are normal professional practices.

Question 18Insurance fraud detection

Rescission of an insurance policy based on fraud typically does which of the following?

  1. Voids the policy from inception as if it never existed Correct answer.
  2. Transfers the policy to another insured
  3. Rewrites the policy at a higher premium
  4. Suspends coverage for thirty days

Explanation

Rescission treats the policy as void from the beginning because the insurer would not have issued it on the same terms but for the fraud or material misrepresentation. It is not a premium adjustment, temporary suspension, or transfer.

Question 19Insurance fraud detection

Which data analysis technique best detects duplicate claims?

  1. Rounding invoice totals
  2. Matching claimant, date-of-loss, and amount across claims Correct answer.
  3. Reviewing one claim in isolation
  4. Raising claim payment limits

Explanation

Duplicate detection depends on comparing key fields such as claimant identity, loss date, and loss amount across multiple claims to find repeated submissions. Isolated review or payment-limit changes do not reveal duplicates.

Question 20Insurance fraud detection

Which best describes concealment in insurance fraud?

  1. Intentionally withholding material information Correct answer.
  2. Accidentally forgetting to send a document
  3. Reporting a loss promptly
  4. Disputing a claim decision

Explanation

Concealment is the intentional failure to disclose material information that the insurer needs to evaluate the risk or claim. Simple mistakes, disputes, and prompt reporting are not concealment.

Question 21Insurance fraud detection

Which scheme involves reporting a vehicle as stolen or totaled while hiding or selling it?

  1. Premium padding
  2. Phantom vehicle fraud
  3. Owner give-up or salvage fraud Correct answer.
  4. Swoop-and-squat staging

Explanation

Owner give-up fraud occurs when an owner hides, sells, or destroys a vehicle and then reports it stolen or damaged to collect insurance. Phantom vehicle and staged collision schemes involve liability claims rather than disposing of the insured vehicle.

Question 22Insurance fraud detection

In a swoop-and-squat staged collision, the scheme typically involves which of the following?

  1. A single vehicle striking a parked car
  2. A pedestrian stepping into traffic
  3. A vehicle cutting in front and braking to force a rear-end hit Correct answer.
  4. Two drivers exchanging information without damage

Explanation

The swoop-and-squat scheme uses a vehicle that abruptly enters the claimant's lane and brakes, causing the following driver to rear-end it. The staged nature makes the innocent rear driver appear at fault.

Question 23Insurance fraud detection

In a civil insurance fraud case, the insurer generally must prove fraud by which standard?

  1. Probable cause alone
  2. Clear and convincing evidence in every state
  3. A preponderance of the evidence, unless a higher standard applies Correct answer.
  4. Beyond a reasonable doubt

Explanation

Civil fraud is generally proven by a preponderance of the evidence, although some jurisdictions require clear and convincing evidence. Beyond a reasonable doubt applies in criminal cases, and probable cause is a lower threshold for certain investigative actions.

Question 24Insurance fraud detection

Why is chain of custody important in a suspected arson claim?

  1. It sets the claim reserve
  2. It determines the policy limit
  3. It proves the insured's motive
  4. It documents continuous control of evidence for admissibility Correct answer.

Explanation

Chain of custody records who handled evidence, when, and how, helping establish that it has not been altered or contaminated. This supports admissibility and reliability in later proceedings.

Question 25Insurance fraud detection

Which scenario most clearly indicates workers' compensation premium fraud by an employer?

  1. Providing safety training to workers
  2. Paying premiums monthly
  3. Reporting a workplace injury promptly
  4. Underreporting payroll and misclassifying workers to cut premiums Correct answer.

Explanation

Premium fraud occurs when an employer misrepresents payroll, employee duties, or classification to pay less than the correct premium. Monthly payment, safety training, and prompt injury reporting are legitimate practices.

Question 26Insurance fraud detection

In claims fraud detection, a red flag is best described as which of the following?

  1. A statutory notice that must be filed with regulators
  2. A warning indicator that justifies further inquiry Correct answer.
  3. Conclusive proof that the claimant intended fraud
  4. A formal finding that voids the policy

Explanation

Red flags are circumstantial indicators that raise suspicion and justify additional investigation such as recorded statements, records review, or SIU referral. They do not, by themselves, establish intent or resolve coverage. A fraud finding requires evidence that satisfies the applicable legal standard.

Question 27Insurance fraud detection

Which of the following is one of the three elements of the fraud triangle?

  1. Opportunity Correct answer.
  2. Collusion
  3. Intent
  4. Negligence

Explanation

The fraud triangle consists of pressure, opportunity, and rationalization, and it is widely used to understand why individuals commit fraud. Opportunity refers to a situation that allows the misconduct to occur, such as weak claim verification controls. Investigators use the framework to spot conditions that make fraud more likely.

Question 28Insurance fraud detection

The National Insurance Crime Bureau (NICB) primarily performs which function?

  1. Setting statutory penalties for insurance fraud convictions
  2. Licensing claims adjusters in each state
  3. Issuing binding coverage interpretations for member insurers
  4. Sharing crime data and assisting member investigations Correct answer.

Explanation

The NICB is an industry-supported organization that collects and analyzes insurance crime intelligence and works with member insurers and law enforcement on suspected fraud and theft. It does not regulate insurers or adjusters. Its value to investigators lies in data sharing, training, and investigative support.

Question 29Insurance fraud detection

An insured with a genuine covered loss inflates the amount claimed for damaged contents. This conduct is best classified as which type of fraud?

  1. Hard fraud planned before the loss
  2. Internal fraud
  3. Opportunistic (soft) fraud Correct answer.
  4. Premium fraud

Explanation

Opportunistic or soft fraud occurs when an otherwise legitimate claim is exaggerated or padded after a real loss. It differs from hard fraud, which is planned in advance and staged. Recognizing this distinction helps investigators choose proportionate responses.

Question 30Insurance fraud detection

A homeowner policy has been in force for twelve days when the insured reports a large theft loss. To an investigator, this timing most likely suggests which of the following?

  1. The claimant has a strong prior loss history
  2. The loss may have been planned before coverage began Correct answer.
  3. The policy was probably backdated by the agent
  4. The insurer must deny the claim as a matter of course

Explanation

A short interval between policy inception and a large reported loss is a recognized timing indicator because it raises the possibility that the loss was contemplated before coverage existed. It is only a prompt for closer review, such as verifying purchase records and the date of loss. Timing alone never resolves the claim.

Question 31Insurance fraud detection

An adjuster wants to learn whether a claimant has filed similar claims with other insurers. Which source is designed for that purpose?

  1. The claimant's consumer credit score
  2. The current policy's declarations page
  3. An industry loss history report Correct answer.
  4. The state department of insurance complaint log

Explanation

Loss history reports aggregate claim activity reported by participating insurers, allowing an adjuster to see whether the claimant has submitted similar losses elsewhere. Undisclosed prior claims are a common indicator of repeated or organized fraud. The declarations page and credit data do not capture claim history across insurers.

Question 32Insurance fraud detection

An SIU analyst maps shared addresses, telephone numbers, and bank accounts appearing across several apparently unrelated claims. Which technique is being applied?

  1. Actuarial reserving
  2. Subrogation recovery
  3. Random file sampling
  4. Link analysis Correct answer.

Explanation

Link analysis looks for connections among people, businesses, addresses, and accounts to reveal relationships that are not obvious from a single claim file. Such connections often surface organized rings that stage losses and share proceeds. It is a core analytic tool in fraud detection.

Question 33Insurance fraud detection

A model flags claims whose features deviate sharply from those of comparable claims in the same portfolio. This approach is best described as which of the following?

  1. Subrogation screening
  2. Rule-based denial
  3. Anomaly detection Correct answer.
  4. File audit sampling

Explanation

Anomaly detection identifies claims that differ materially from peer claims on measurable characteristics such as loss amount, timing, or treatment duration. Flags are prioritized for review rather than treated as determinations of fraud. This contrasts with fixed rule sets that apply the same criteria to every claim.

Question 34Insurance fraud detection

Which finding most suggests fraud in a business interruption claim?

  1. Reported revenue far exceeds the figures in the insured's tax filings Correct answer.
  2. The business reopened two months after the loss
  3. The policy contains a coinsurance clause
  4. The insured keeps backups of accounting records offsite

Explanation

Business interruption claims are built on financial records, so a large gap between claimed revenue and independently filed tax figures indicates possible fabrication or inflation of the loss. Investigators compare claimed figures with tax returns, bank records, and sales data. Ordinary practices such as offsite backups or reopening do not raise concern.

Question 35Insurance fraud detection

A restoration contractor submits invoices for a covered loss. Which observation most suggests collusion between the contractor and the insured?

  1. The contractor's business address matches the insured's mailing address in claim records Correct answer.
  2. The contractor required a deposit before ordering materials
  3. The contractor photographed the damage before starting work
  4. The invoice itemizes labor and materials separately

Explanation

A shared address or other overlapping identifiers between the contractor and the insured suggests the parties may not be independent, which is a hallmark of collusive repair schemes. Investigators verify contractor licensing, business identity, and prior relationships. Normal invoicing and documentation practices are not indicators.

Question 36Insurance fraud detection

Surveillance of a claimant who reports total disability is generally conducted to do which of the following?

  1. Persuade physicians to alter their opinions
  2. Establish the claimant's reputation among neighbors
  3. Verify the claimant's actual activity level Correct answer.
  4. Gather evidence of unrelated criminal conduct

Explanation

Surveillance is used to document what a claimant can actually do, which can then be compared with the restrictions described in the claim and medical records. It supplements, rather than replaces, review of medical evidence. Investigators must stay within legal and ethical limits and avoid harassment or unrelated inquiries.

Question 37Insurance fraud detection

During a disability claim, an investigator finds public photos of the claimant hiking and lifting heavy equipment. What is the soundest use of this evidence?

  1. It should be authenticated and compared with the claimed limits Correct answer.
  2. It can be disregarded because social media is unreliable
  3. It proves fraud without any further verification
  4. It is inadmissible because it was posted publicly

Explanation

Publicly available content can be used, but it must be authenticated and evaluated in context, for example by comparing dates and activities with the restrictions the claimant reported. Only then can it support a fraud conclusion. Treating a single post as conclusive risks an unsupported denial.

Question 38Insurance fraud detection

In a fraud investigation interview, which approach is generally most effective at the start?

  1. Disclose all of the incriminating evidence at the outset
  2. Ask only closed questions requiring yes or no
  3. Obtain a free-form narrative before specific questions Correct answer.
  4. Require a signed written statement immediately

Explanation

Allowing the subject to give an uninterrupted account first captures spontaneous detail and fixes the person's version before evidence is introduced. Specific and confrontational questions come later, once the narrative is documented. This sequencing also reduces later claims that answers were suggested.

Question 39Insurance fraud detection

Which observation in a property claim submitted after a widespread storm most warrants scrutiny?

  1. The insured filed the claim on the day the storm passed
  2. Damage appears to predate the storm, with no pre-loss documentation Correct answer.
  3. The insured hired a contractor recommended by a neighbor
  4. The insured's policy has a percentage hurricane deductible

Explanation

After a catastrophe, volume pressures make it easier to attribute old or unrelated damage to the storm. Damage that appears older than the reported date of loss, combined with no way to establish pre-loss condition, calls for closer verification through photographs, inspections, and weather data. Rapid reporting, contractor referrals, and percentage deductibles are ordinary.

Question 40Insurance fraud detection

A fraud model has 90% sensitivity and 90% specificity, and 2% of claims in the portfolio are actually fraudulent. Of the claims the model flags, which statement is most accurate?

  1. Specificity guarantees that half of flagged claims are fraudulent
  2. Most flagged claims are fraudulent because sensitivity is high
  3. The share of fraudulent claims among flagged claims equals the specificity
  4. Most flagged claims are legitimate because the base rate is low Correct answer.

Explanation

With a 2% base rate, the many legitimate claims generate more false positives than the small fraud population generates true positives, so only a minority of flagged claims are actually fraudulent. Investigators should treat alerts as a triage input, not proof, and prioritize by additional evidence. This illustrates why predictive value depends heavily on prevalence.

Question 41Insurance fraud investigation

Which of the following best describes hard fraud?

  1. An insured inflates the value of a legitimate theft loss
  2. An applicant unintentionally omits a prior loss from an application
  3. A claimant submits a repair estimate that includes a clerical error
  4. A claimant fabricates or stages a loss to collect benefits Correct answer.

Explanation

Hard fraud involves deliberate, planned conduct such as staging an accident, creating a phantom claim, or arranging a fire for profit, all with the intent to obtain payment. Inflating a legitimate loss is commonly classified as soft fraud because the loss itself is real. Unintentional omissions and clerical mistakes lack the required intent.

Question 42Insurance fraud investigation

Which claim characteristic is a recognized red flag for possible fraud?

  1. The insured has never filed a claim in fifteen years
  2. The insured asks the adjuster to explain the settlement process
  3. The insured provides a photographed inventory of damaged contents
  4. The claim is reported days after coverage was increased Correct answer.

Explanation

A loss occurring immediately after policy inception or after a large increase in coverage suggests possible adverse selection or a planned loss. Detailed inventories and long claims-free histories are generally consistent with legitimate claims. Questions about the settlement process reflect normal consumer behavior.

Question 43Insurance fraud investigation

Which organization is an insurer-supported, not-for-profit body that gathers insurance crime data and provides investigative assistance to member companies?

  1. NICB Correct answer.
  2. NAIC
  3. ISO
  4. FIO

Explanation

The National Insurance Crime Bureau is funded by property-casualty insurers and acts as a clearinghouse and investigative support resource on insurance crime, including staged accidents and arson for profit. The NAIC is an association of state regulators, ISO-type vendors supply statistical and claims data products commercially, and the FIO is a federal office.

Question 44Insurance fraud investigation

What is the primary function of an insurer's Special Investigation Unit?

  1. To set premium rates based on claims experience
  2. To prosecute suspected fraud offenders in criminal court
  3. To adjust and pay claims within regulatory timeframes
  4. To investigate and document suspected fraudulent claims Correct answer.

Explanation

The SIU investigates claims referred for suspicion of fraud, documents its findings, and recommends a disposition to the company. Prosecution authority rests with government prosecutors, while payment of routine claims and rate setting belong to other functions.

Question 45Insurance fraud investigation

An examination under oath is best described as:

  1. An informal conversation with the insured at the loss scene
  2. Sworn testimony of an insured taken during a claim investigation Correct answer.
  3. A criminal deposition conducted by a prosecutor
  4. A recorded statement taken by a telephone adjuster

Explanation

An EUO is sworn testimony taken from an insured or claimant during the claim investigation, generally invoked under the policy's cooperation and examination provisions. It is transcribed by a court reporter and carries the same obligations of truthfulness as other sworn testimony. Telephone statements and scene conversations are not sworn proceedings.

Question 46Insurance fraud investigation

Insurance fraud is generally defined as:

  1. Any error made by an insured on an application or claim form
  2. Any claim that is ultimately denied by the insurer
  3. A dispute between an insurer and an insured over the value of a loss
  4. An intentional act to obtain an improper benefit from an insurer Correct answer.

Explanation

Fraud requires intent to obtain money or another benefit to which the person is not entitled, whether by false statement, concealment, or staging. Denials, honest errors, and valuation disputes can occur without any fraudulent intent.

Question 47Insurance fraud investigation

The purpose of maintaining a chain of custody for evidence is to:

  1. Establish the monetary value of the evidence
  2. Document each transfer and handler of the evidence Correct answer.
  3. Satisfy state rate-filing requirements
  4. Transfer ownership of the evidence to the insurer

Explanation

A chain of custody records who handled, moved, and stored evidence at every stage so that its integrity can be demonstrated if the matter is litigated. Gaps in the record can support challenges to admissibility or weight. Ownership and value of evidence are separate issues.

Question 48Insurance fraud investigation

Premium fraud in workers' compensation most commonly involves:

  1. An employee claiming benefits from two employers
  2. A physician billing for treatment that was not rendered
  3. An employer underreporting payroll or misclassifying workers to reduce premium Correct answer.
  4. An injured worker exaggerating the severity of an injury

Explanation

Premium fraud is committed at the policy acquisition stage, typically when an employer misstates payroll, hides employees, or misclassifies job duties to obtain a lower premium. The other options describe claim-stage conduct by workers or providers rather than premium manipulation.

Question 49Insurance fraud investigation

Which pattern most strongly suggests a staged auto accident?

  1. A claimant seeks treatment two days after the accident for neck pain
  2. The same occupants appear in several unrelated claims for the same insurer Correct answer.
  3. Two vehicles collide at an intersection with a police report and independent witnesses
  4. The at-fault driver admits fault at the scene

Explanation

Repeat participation of the same individuals across apparently unrelated claims is a classic indicator of an organized staging ring. Documented collisions with independent witnesses, brief treatment delays, and admissions of fault are common in ordinary claims.

Question 50Insurance fraud investigation

Which circumstance is a recognized red flag in a fire loss investigation?

  1. The business was failing and inventory records vanished Correct answer.
  2. The fire was confined to a single room and extinguished quickly
  3. The building had a working sprinkler system and monitored alarm
  4. The owner was out of the country when the fire started

Explanation

Financial motive coupled with the disappearance of records that would substantiate the loss is a well-recognized arson indicator. Functioning suppression systems, a documented absence, and limited damage are not inherently suspicious.