CFEEN Niger cheat sheet

Fraud triangle: pressure/incentive, opportunity, rationalization - all three usually present for occupational fraud to occur.

Fraud diamond adds capability: the individual's position, authority, or technical skill needed to execute and conceal the scheme.

COSO internal control: five components - control environment, risk assessment, control activities, information/communication, monitoring.

Segregation of duties splits custody of assets, authorization, and recordkeeping so no single person controls all three.

Deterrence rests on perceived detection probability and certainty of punishment more than on severity of penalty.

Per SAS 99 / ISA 240, auditors treat revenue recognition as a presumed fraud risk and must test management override of controls.

Anonymous hotlines are consistently the most common initial detection method for occupational fraud in global studies.

Fraud risk assessment is iterative: identify risks, assess likelihood and impact, design responses, then monitor and re-evaluate.

Asset misappropriation is the most frequent occupational fraud category; financial statement fraud is least frequent but most costly.

Larceny vs skimming: larceny steals cash already recorded on the books; skimming steals cash before it is recorded.

Check tampering includes forged maker, forged endorsement, altered payee, and authorized-maker schemes.

Billing schemes: shell company, pass-through, and pay-and-return; all route payments through fictitious or inflated vendor invoices.

Payroll schemes: ghost employees, falsified hours or wages, commission schemes, and workers' compensation manipulation.

Corruption schemes: bribery, illegal gratuities, economic extortion, and conflicts of interest.

Financial statement fraud schemes: fictitious revenue, timing differences, concealed liabilities, improper valuation, and improper disclosures.

Net worth analysis: unexplained increase in net worth is compared to known income to estimate illicit proceeds.

Evidence types: documentary, testimonial, physical, and demonstrative; documentary is most common in financial investigations.

Chain of custody records who handled evidence, when, and where, preserving admissibility and integrity.

Interview progression: neutral third parties, then witnesses, then the subject last, after all corroborating evidence is gathered.

Fraud examination report states findings, evidence, methodology, and impact; it is written for a reader who may be a court.

Data interrogation uses CAATs such as filtering, sorting, joining, and duplicate detection to isolate anomalies.

Benford's Law predicts first-digit frequency; large deviations in naturally occurring data sets warrant examination.

Ratio and trend analysis compares financial relationships across periods and against peer benchmarks to flag inconsistencies.

Suspicious activity indicators: unusual journal entries near period end, round-dollar amounts, and entries lacking support.

Fraud elements generally: a false statement of material fact, knowledge of falsity, intent to deceive, justifiable reliance, and resulting damages.

Criminal burden of proof is beyond a reasonable doubt; civil burden is a preponderance of the evidence.

Interviewing a subject does not by itself create a custodial interrogation, but detention or restraint may trigger rights warnings.

Confidentiality obligations and privilege affect what an investigator may disclose and to whom.

Rules of evidence: relevance, materiality, and competence determine whether an item is admissible.

Hearsay is an out-of-court statement offered for its truth; business-records and other exceptions often apply to documents.

Statutes of limitation vary by jurisdiction and by offense, and may be tolled by concealment or ongoing conduct.

Employment law constrains investigation methods: searches, surveillance, and discipline must follow policy and local law.