KASNEB CFFE key terms

A model explaining fraud as the result of three conditions occurring together: pressure or incentive, opportunity, and rationalisation. Examiners use it to structure fraud risk assessments and to decide which controls reduce risk.

An extension of the fraud triangle that adds capability, recognising that even where pressure, opportunity and rationalisation exist, an offender also needs the position, skill and confidence to commit and conceal the fraud.

A warning sign suggesting fraud may be present, such as unusual journal entries, a lifestyle beyond known means, or a supplier sharing an employee's address. A red flag is an indicator to investigate, not proof.

A structured exercise that identifies the fraud schemes an organisation is exposed to, assesses their likelihood and impact, and evaluates whether existing preventive and detective controls reduce the risk to an acceptable level.

Dividing tasks such as authorising a transaction, recording it and holding the related asset among different people, so that no single person can commit and conceal a fraud or error.

The ethical message senior management and the board send through their decisions, behaviour and communications, which strongly influences whether employees regard fraud as acceptable or unacceptable.

An independent, confidential channel through which employees and outsiders can report suspected fraud, often anonymously. Tips received through such channels are among the most common ways frauds are detected.

Controls and activities designed to uncover fraud while it is occurring or after it has happened, including tips, surprise audits, reconciliations, exception reporting and data analytics.

A written blueprint for an investigation that sets out the allegations, objectives, scope, evidence to be collected, interviews to be held, resources, timetable, reporting lines and legal considerations.

A planned, structured conversation with a witness, complainant or subject to obtain accurate information about alleged misconduct, conducted fairly and without threats or improper promises.

The concluding interview with a suspected perpetrator, held when the evidence is strong, designed to obtain a truthful account, an admission and a signed statement while respecting the subject's rights.

A memory-enhancing technique that asks a witness to reinstate the context, recall events in different orders and from other perspectives, and report everything, producing more accurate detail.

The close examination of the wording, structure and internal consistency of a written or spoken account to spot omissions, contradictions and areas requiring further questioning; it supports other evidence rather than replacing it.

Independent evidence that supports or confirms a fact, such as documents, records, physical items or a second witness. Investigators should not rely on an uncorroborated confession or a single account.

The formal written record of an investigation, covering background, scope, evidence examined, findings on each allegation, conclusions and recommendations, written so a reader who was not present can follow the reasoning.

The application of accounting, auditing and investigative skills to matters that may end up in court, typically to quantify losses, trace funds, or explain complex transactions to a judge or tribunal.

An attitude of questioning and alertness to conditions that may indicate misstatement or fraud, requiring the examiner to obtain sufficient appropriate evidence rather than accepting explanations at face value.

Techniques that compare financial information with expectations, such as trend analysis, ratio analysis, budget-versus-actual comparisons and reasonableness tests, to highlight unusual relationships that deserve investigation.

The observed pattern that in many large sets of naturally occurring numbers the leading digit is 1 about 30 per cent of the time and higher digits progressively less often; material deviation may indicate invented figures.

An indirect method of proving unexplained income by measuring the change in a person's net worth over a period, adding personal living expenses, and comparing the total with known legitimate income.

An indirect method that compares a person's known sources of funds with known uses over a period; unexplained expenditure, or a shortfall in sources, suggests income from an undisclosed source.

Evidence in written or electronic form, such as invoices, contracts, ledgers, minutes and bank records, used to prove transactions; its authenticity, completeness and provenance must be verified.

The recorded sequence of transactions and system activity that allows each item to be traced from its source to the financial statements and back, supporting audit testing and fraud investigation.

A formal statement of the values, principles and conduct rules expected of members of a profession, typically covering integrity, objectivity, confidentiality, professional competence and professional behaviour.

A situation in which a person's private interest, relationship or financial stake could improperly influence their professional judgement, requiring disclosure and appropriate management or removal from the engagement.

The system of rules, practices and processes by which an organisation is directed and controlled, covering board responsibilities, accountability, transparency, risk oversight and relationships with stakeholders.

The legal obligation of a person in a position of trust, such as a director or trustee, to act honestly and in the best interests of the organisation rather than for personal gain.

The process of disguising the criminal origin of funds through placement, layering and integration so they appear to come from a legitimate source; forensic work includes tracing and reporting such flows.

Offering, giving, receiving or soliciting something of value to influence the action of an official or private person; it is a corruption offence often hidden through intermediaries, inflated invoices or consultancy payments.

The state of being free from financial, personal or other relationships that could compromise objectivity, and of being seen to be free from them, in fact and in appearance.

The disciplined process of identifying, preserving, acquiring, analysing and presenting electronic evidence so that it remains reliable and admissible in legal, disciplinary or court proceedings.

A bit-for-bit copy of a storage device or other data source, including deleted files and unallocated space, taken through a write blocker so the original is left unchanged.

A digital fingerprint produced by an algorithm such as SHA-256; matching hashes taken before and after acquisition or analysis demonstrates that the evidence has not been altered.

A hardware or software device that prevents any write operation to a storage medium during acquisition, preserving the integrity of the original evidence for later comparison.

A chronological record showing who handled each item of evidence, when, where and for what purpose, from seizure or collection to presentation in court, proving that it is authentic and unaltered.

Data about data, such as an author name, creation date, modification history and location embedded in a file, which can show when a document was created or changed and by whom.

Information that is lost when a system is switched off or rebooted, such as memory contents, running processes and network connections, which should be captured first in order of volatility.

The process of identifying, preserving, collecting, processing and producing electronically stored information for legal proceedings, including steps to avoid spoliation and to review for relevance and privilege.

Techniques used to frustrate digital investigation, such as file wiping, timestamp alteration, encryption and anonymising tools; their deliberate use may itself indicate knowledge and intent.