KASNEB CFFE cheat sheet

Fraud triangle components: (1) pressure or incentive, (2) opportunity arising from weak controls, (3) rationalisation. Fraud diamond adds capability as a fourth element; fraud pentagon adds arrogance.

ACFE fraud tree has three main branches: asset misappropriation, corruption, financial statement fraud. Asset misappropriation is the most frequently reported; financial statement fraud causes the highest median loss.

Tips and anonymous reports are consistently the most common initial detection method, ahead of internal audit, management review and external audit.

Three lines of defence: first line = operational management owning controls; second line = risk, compliance and financial control functions; third line = independent internal audit providing assurance.

Segregation of duties rule: custody of assets, authorisation of transactions, and record keeping must be split so no single person controls all three (the ability to both commit and conceal).

COSO internal control components: control environment, risk assessment, control activities, information and communication, monitoring activities.

Residual fraud risk = inherent fraud risk reduced by the design and operating effectiveness of preventive and detective controls; controls cannot reduce risk below a residual level that must be accepted or avoided.

Behavioural red flags for detection: living beyond known means, unusually close relationship with a supplier or customer, reluctance to take annual leave or delegate, and defensive reaction to routine audit enquiry.

Investigation sequence: predication and case assessment, planning and scope, evidence collection and document analysis, interviews, reporting, then remediation and control review.

Interview ordering rule: interview peripheral witnesses first, then knowledgeable witnesses, and interview the prime suspect last, once maximum corroborating evidence is in hand.

Interview structure: free narrative first, then primary/open questions, then closed questions for detail, then confirmation and a signed written statement.

Cognitive interview techniques: reinstate context, request everything remembered, vary retrieval order, change perspective. These increase recall of genuinely remembered detail.

PEACE model stages: Planning and preparation, Engage and explain, Account, Closure, Evaluate; designed to obtain reliable accounts without coercion.

PEACE and cognitive interviewing are non-accusatory and preferred where reliability and admissibility matter; the Reid nine-step technique is accusatory and restricted in several jurisdictions.

Decision rule: no promise of leniency, no threat, no deprivation, and no misleading representations of evidence - statements obtained by these means are unreliable and generally inadmissible.

Evidence handling: original documents are preferred under the best evidence rule; every item's chain of custody must be documented and unbroken from seizure to production in court.

Benford's Law first-digit expected frequencies: 1 = 30.1%, 2 = 17.6%, 3 = 12.5%, 4 = 9.7%, 5 = 7.9%, 6 = 6.7%, 7 = 5.8%, 8 = 5.1%, 9 = 4.6%. Large deviations warrant investigation, not automatic conclusions.

Net worth method: unexplained income = (closing net worth − opening net worth) + personal expenditures + non-deductible items − reported after-tax income. A material unexplained balance indicates possible unreported funds.

Expenditure (sources and uses) method: total funds applied to expenditures and asset increases minus known legitimate sources of funds equals unexplained funds.

Audit risk model: AR = IR × CR × DR, therefore DR = AR ÷ (IR × CR). Higher inherent or control risk requires lower detection risk and therefore more extensive substantive testing.

Common materiality benchmarks: about 5% of profit before tax, 1% of total revenue, or 0.5%–1% of total assets; performance materiality is set below overall materiality.

Sampling risk arises because a sample may not be representative; non-sampling risk arises from human error, inappropriate procedures or misinterpretation. Attribute sampling tests controls; variables sampling tests monetary amounts.

Reliability hierarchy of evidence: externally generated documents received directly by the auditor > external documents held by the client > internal documents > oral representations, which require corroboration.

ISA 240 position: management and those charged with governance are responsible for preventing and detecting fraud; the auditor applies professional scepticism and is responsible for obtaining reasonable assurance that statements are free of material misstatement, including fraud.

Cut-off testing around period end detects window dressing, premature revenue recognition and holding open the books; the two-way test checks transactions recorded before and after year-end against supporting documentation.

Common-law civil fraud elements: (1) false representation of a material fact, (2) knowledge of falsity or recklessness (scienter), (3) intent to deceive, (4) justifiable reliance by the victim, (5) resulting damage.

Ethical threats under the IESBA/IFAC code: self-interest, self-review, advocacy, familiarity and intimidation. Responses are elimination of the circumstance, safeguards, or decline/withdraw from the engagement.

Governance separation rule: the roles of chair and chief executive should be held by different individuals, and the audit committee should comprise independent non-executive directors with at least one financial expert.

Money laundering stages: placement (entry of criminal proceeds into the financial system), layering (obscuring the audit trail), integration (reintroduction as apparently legitimate funds).

AML controls: customer due diligence and beneficial ownership identification, ongoing monitoring, suspicious transaction/activity reporting, and statutory record retention.

Bribery: offering, promising or giving an undue advantage to influence an official act. UK Bribery Act strict liability offence of failing to prevent bribery applies to commercial organisations, with 'adequate procedures' as the defence.

Whistleblower protection turns on good-faith reasonable belief rather than on the truth of the allegation; retaliation and detrimental treatment are prohibited and confidentiality of identity is preserved.

Fraud examiner conduct rules: preserve confidentiality, avoid conflicts of interest (disclose and recuse), maintain objectivity, and presume a person innocent until the evidence establishes otherwise.

Order of volatility (most to least volatile): CPU registers and cache → RAM and running processes → network connections and swap → temporary files → disk storage → remote logs → backup and archival media. Collect the most volatile first.

Forensic acquisition rule: use a hardware or software write blocker, image bit-for-bit, hash the source and the image (MD5 or SHA-256), verify the hashes match, and perform all analysis on the copy.

Chain of custody record must capture who collected the item, what it is, when and where it was collected, why, and every subsequent transfer, signature and storage location.

Live acquisition is justified only where powered-off seizure would lose evidence, e.g. full-disk encryption, an active remote session, or volatile RAM-resident artefacts.

Deleted data recovery: file-system index recovery first; if unavailable, file carving scans unallocated and slack space for known file signatures.

MAC (modified, accessed, created/changed) timestamps in file-system metadata; inconsistencies among them, or timestamps inconsistent with the document's stated date, indicate possible tampering.

Email header analysis: Received chains, Message-ID, originating IP, and SPF/DKIM/DMARC results establish authenticity and routing, which is central to business email compromise cases.

CAATs and data analytics test 100% of a population: duplicate payment matching, gap detection in sequential numbers, round-number and threshold testing, and after-hours or weekend transaction analysis.