KASNEB CFFE common mistakes
KASNEB CFFE · Understand the traps and how to avoid them.
Labelling every control named in a scenario as 'prevention' or 'detection' by keyword matching (e.g., calling bank reconciliations, surprise cash counts and exception reports 'prevention controls' because they appear in a controls list).
Candidates memorise control names as flat lists and never anchor each control to the fraud timeline stage it addresses, so they classify on familiarity rather than on when the control operates.
What to do instead
For every control, answer two questions in writing before choosing: (a) does it act before, during or after the act? (b) does it stop the act happening or find it once it has happened? Segregation of duties, authorisation limits and pre-employment screening = prevention; reconciliations, hotlines, data analytics and surprise audits = detection; disciplinary action and recovery = response.
Producing a 'fraud risk assessment' answer that is only a list of fraud schemes (theft of cash, ghost employees, procurement collusion) with no likelihood rating, impact rating, existing control, residual rating or named risk owner.
Under time pressure candidates dump remembered fraud typologies to show knowledge, mistaking coverage of schemes for an assessment of risk exposure.
What to do instead
Use a fixed four-column table for every identified scheme: inherent likelihood × impact → existing controls and control effectiveness → residual rating → owner and treatment. Marks in scenario questions are usually allocated to the rating logic and the control gap, not to the length of the scheme list.
In investigative interviews, opening with closed or leading questions ('You took the KES 400,000 on 12 March, didn't you?') and never allowing an uninterrupted free narrative before probing.
The candidate's mental model of interviewing comes from films and police drama, where confrontation is the goal; they also fear silence and rush to fill it, so they control the conversation instead of the interviewee.
What to do instead
Structure every interview answer as: planning and objective → non-accusatory introduction → open free narrative ('Take me through how the payments process works from your side') → open probing (who, what, when, where, how) → then, only if needed, closed and specific challenge questions → cognitive re-interview → documented summary read back and signed. Explicitly state where in that sequence each question belongs.
Writing in the investigation report that the suspect 'is guilty of fraud', 'defrauded the company' or 'should be prosecuted', and relying on the suspect's admission alone as proof of the loss amount.
Candidates conflate the investigator's role with the court's; a confession feels like the strongest possible evidence so corroboration and loss quantification are treated as optional.
What to do instead
In the report separate three sections: (1) findings of fact with source document references, (2) the investigator's opinion limited to whether the evidence supports each allegation element, (3) recommendations (disciplinary, civil recovery, referral). Never use the word 'guilty'. For every admission, list the independent corroboration (bank records, approved-vendor master, CCTV, third-party confirmation) and show the loss computed from documents, not from what the suspect said.
Applying Benford's Law or other digital-analysis tests to any dataset regardless of suitability - e.g., running first-digit Benford on 60 transactions, on assigned sequential invoice numbers, or on data with hard cut-offs and thresholds.
Software makes the test one click, and the candidate has memorised 'Benford detects fraud' without the preconditions of naturally occurring, unconstrained, large-population data.
What to do instead
Before naming a test, state its preconditions: Benford needs a large population (typically several hundred plus), data that occurs naturally, no artificial minimum/maximum, and no assigned or sequential numbering. If the data fails a precondition, say so and substitute a test that fits (duplicate payments, round-sum, weekend/holiday postings, split transactions just below approval thresholds, gap detection in sequential series).
Treating a forensic engagement as if it were a statutory audit: stating that the forensic auditor gives an opinion on the truth and fairness of the financial statements, or that the work provides 'reasonable assurance' to shareholders.
Both use audit-type procedures and the candidate recycles statutory audit language because it is the vocabulary they have practised most.
What to do instead
State the engagement objective in the first line: a forensic audit/ investigation answers a specific allegation to a court or disciplinary standard, is usually non-recurring, is adversarial, and gives no audit opinion and no assurance opinion. Contrast it explicitly against internal audit (process assurance) and statutory audit (opinion on financial statements under ISAs) whenever the question hints at scope confusion.
Citing a Kenyan statute by vague reference ('the anti-corruption law', 'the money laundering Act') or attributing powers to the wrong body - e.g., saying the EACC prosecutes corruption cases, or confusing the Bribery Act with the Anti-Corruption and Economic Crimes Act.
Candidates learn statute names as labels rather than as a map of institution, offence and penalty, and avoid exact names because they are unsure of them.
What to do instead
Build and memorise a three-column grid before the exam: statute (full title and year) → offence or obligation created → institution with the power (EACC investigates, DPP prosecutes and may authorise; FRC and the relevant professional body discipline accountants; the courts determine guilt). In answers, name the statute and the institution in the same sentence so the examiner can see both are correct.
Resolving ethics scenarios with the shortcut 'if it is legal it is ethical', or by simply asserting 'this is a conflict of interest, so resign', without identifying the specific threat and the safeguard applied.
Ethics questions feel like common sense, so candidates answer from personal opinion and skip the professional-code language they were actually examined on.
What to do instead
Apply a named framework in the answer: identify the threat type (self-interest, self-review, advocacy, familiarity, intimidation), rank it (low/medium/high) against the significance test, then state the safeguard - disclose and recuse, escalate to the audit committee, obtain independent second review, or, only if no safeguard reduces the threat to an acceptable level, decline or resign. Then test the conclusion against a consequences/duties/virtue check and against confidentiality-versus-public-interest duties.
Handling digital devices in the wrong order at collection: switching a seized laptop on and browsing folders to 'see what is there', copying files with drag-and-drop, letting the suspect or IT staff keep the original, and recording the device only later.
Candidates know the phrase 'preserve evidence' but not the operational sequence, and they want to confirm the allegation quickly while on site.
What to do instead
Write the sequence as a fixed checklist and use it in every answer: secure and photograph the scene → follow order of volatility (RAM and running sessions before disk, disk before backups, backups before archived logs) → isolate the device from networks → image with a write blocker, never boot from the suspect drive → hash the image (SHA-256) before and after, record both values → store the original sealed with a signed, timed chain-of-custody form → all analysis on the forensic copy only. Then state that any file opened on the original is a challenge to admissibility.
Presenting digital exhibits (screenshots, social media posts, emails, exported chat logs) as conclusive proof without addressing authenticity, source system, capture method, or the possibility of alteration, and asserting that deleted data is unrecoverable.
Digital output looks objective and self-proving, and candidates have not practised the authentication step or the technical facts about deletion and cloud data.
What to do instead
For each digital exhibit state: the source system and custodian, the acquisition method and tool, the hash or audit trail linking the exhibit to the copy, the time zone and clock source, and who had access that could have altered it. Treat deletion as recoverable in principle (unallocated space, slack space, backups, server logs, cloud retention) and state which artefact you would request. Where authenticity cannot be established internally, recommend independent expert examination and note the weight, not just the admissibility, of the exhibit.