IASIU CIFA flashcards

40 cards. Read the term and the definition here. The deck at the top of this page is optional.

Fraud analyst core outputs

Detection of suspect activity, investigation and hypothesis testing, quantification of loss and exposure, and defensible reporting. Each output must be traceable to source data and documented so it can be reproduced later.

Chain of custody for data

A record of source system, extract date and time, query or filter applied, and handler for every dataset used. It lets another analyst regenerate the same result and supports admissibility of findings.

Fraud triangle elements

Pressure, opportunity, and rationalization. They guide interview questions and data selection but are behavioral concepts, not evidence; a finding still requires corroborating transaction-level proof.

Analyst versus auditor role

An auditor tests compliance against defined controls and rules. A fraud analyst tests behavior against expected patterns, looking for anomalies without a predefined rule, then quantifies loss and exposure.

Benford's Law first-digit percentages

In naturally occurring multi-order-of-magnitude data, leading digit 1 appears about 30.1% of the time, 2 about 17.6%, 3 about 12.5%, falling to 9 at roughly 4.6%. Deviations are indicators, not proof.

Relative size factor

Largest amount in a group divided by the second-largest amount in that group. A high ratio means one transaction dominates a vendor or account and warrants review for an outlier or fabricated payment.

Duplicate payment testing keys

Exact match on invoice number plus vendor catches simple duplicates. Fuzzy matching on amount, date, and description catches altered invoice numbers used to pay the same bill twice.

Segregation of duties test

Compare the user IDs that created, approved, and paid each transaction. The same ID appearing in two of those steps is a control gap that enables concealment.

Base-rate fallacy in alerting

When fraud prevalence is low, even a sensitive test yields mostly false positives. With 1% prevalence and a 5% false-positive rate, most alerts are clean, so triage must weigh expected loss.

Disconfirming evidence rule

Before running a query, state what data would prove the fraud theory false. Testing for that absence reduces confirmation bias and strengthens the eventual conclusion.

Root cause separation

Distinguish the fraudulent act itself, the control failure that permitted it, and the detection failure that delayed discovery. Each needs a separate recommendation.

Expected loss prioritization

Rank anomalies by probability of occurrence multiplied by estimated exposure, not by count. This directs limited investigative hours toward the largest potential loss.

Ratio versus interval data

Ratio data has equal spacing and a true zero, so ratios such as twice as large are meaningful. Interval data has equal spacing but no true zero, so only differences are meaningful.

Data quality dimensions

Completeness, accuracy, consistency, timeliness, uniqueness, and validity. Profiling each dimension before analysis prevents conclusions built on incomplete or duplicated records.

Granularity in a dataset

The level of detail represented by one row, such as one transaction versus one account. Mixing granularities in a join or total causes double counting and overstated losses.

Metadata for an extract

Descriptive information about the data: table and field definitions, source system, refresh date, and owner. Capturing it with each extract makes later analysis and testimony defensible.

Primary and foreign keys

A primary key uniquely identifies each row and cannot be null. A foreign key references another table's primary key, enforcing referential integrity between related tables.

NULL semantics in databases

NULL means unknown or missing, not zero or blank. Comparisons with NULL return unknown, so queries must use IS NULL or IS NOT NULL rather than equals NULL.

Database index tradeoff

An index speeds lookups and joins on a column but adds storage and slows inserts and updates. Unindexed joins on large transaction tables are a common cause of slow fraud queries.

Audit table value in investigations

Transaction and audit logs record inserts, updates, and deletes with user and timestamp. They are the primary evidence for proving who changed a record and when.

Analysis workflow sequence

Define the question, obtain data, profile and clean, explore, test hypotheses, validate, report, and preserve evidence. Skipping profiling or validation is the most common cause of unsupported conclusions.

Reconciliation control total

Before drawing conclusions, confirm that row counts and amount totals in the analysis file tie back to source system control totals. Unexplained differences mean records were lost or duplicated.

Cleaning decision log

A record of every exclusion, correction, and transformation, with the rule applied and the number of records affected. It preserves reproducibility and defends against challenges to the analysis.

Exploratory versus confirmatory analysis

Exploratory analysis looks for distribution shape, outliers, and gaps without a fixed hypothesis. Confirmatory analysis tests a hypothesis defined in advance, reducing the risk of pattern-finding in noise.

Exact-match VLOOKUP requirement

VLOOKUP with FALSE as the fourth argument returns only an exact match. Omitting it allows approximate matching, which silently pairs wrong records in fraud cross-matching.

INDEX and MATCH combination

INDEX returns a value at a given row and column position; MATCH finds that position. Together they perform lookups in any direction, including leftward, unlike VLOOKUP.

COUNTIF duplicate detection

COUNTIF(range, criteria) counts occurrences of a value. Applying it to invoice numbers and filtering for counts greater than one lists duplicates while preserving the original rows as evidence.

Text normalization before matching

TRIM removes stray spaces and SUBSTITUTE or UPPER standardizes case and characters. Without normalization, exact matching misses duplicates created by formatting differences.

Chart selection by question type

Bar charts compare categories, histograms show distribution, line charts show trend over time, and scatter plots show relationships between two numeric variables. Pie charts suit few categories only.

Axis integrity in fraud reports

Truncated axes exaggerate differences and undermine credibility. Label units, currency, and time zone, and show the counts behind any percentage displayed.

Network chart purpose

A link chart maps relationships among people, accounts, addresses, and phone numbers. Shared nodes reveal hidden connections such as common addresses or circular payment flows.

Rule-based versus anomaly detection

Rules apply explicit thresholds and are transparent but static and easy to evade. Anomaly models learn normal behavior and catch unknown schemes but produce more false positives.

Exception report definition

A listing of every record that falls outside a policy limit, such as approvals above a delegate's authority. It is complete rather than sampled, so it directly evidences control breaches.

Cross-matching independent files

Comparing two unrelated datasets, such as employee and vendor masters, to find shared addresses, bank accounts, or tax IDs. Shared attributes suggest undisclosed relationships or shell vendors.

WHERE versus HAVING

WHERE filters individual rows before grouping and cannot use aggregate results. HAVING filters groups after aggregation, so HAVING COUNT(*) > 1 finds duplicate keys.

LEFT JOIN orphan record pattern

A LEFT JOIN returns all rows from the left table plus matches. Filtering WHERE right_table.key IS NULL finds records with no counterpart, such as payments lacking a purchase order.

CTE for readable fraud logic

A WITH clause defines a named temporary result set. Chaining CTEs breaks complex fraud logic into reviewable steps that a second analyst can verify independently.

Pandas merge and groupby

merge joins two dataframes on a key; groupby aggregates rows by category. Combining them reproduces vendor-level totals and duplicate counts directly from transaction extracts.

Reproducible script practices

Set a random seed for sampling, pin library versions, and keep scripts in version control. The same script must regenerate identical results months later for testimony or review.

Preserve source extract integrity

Never edit the original data file. Write cleaned output separately and record a hash of the source so any alteration can be detected and disproven.