CFEEN Niger common mistakes
CFEEN Niger · Understand the traps and how to avoid them.
Treating fraud prevention as synonymous with internal control, so on questions about deterrence the candidate selects the 'add another approval layer' answer and ignores the element that actually changes the perpetrator's cost-benefit calculation.
CFE material separates prevention (culture, tone at the top, hiring and vendor due diligence, fraud awareness training, hotlines) from detection (audits, reconciliations, surprise counts). Candidates who have an audit or accounting control background default to controls because that is what they know, and the exam deliberately offers plausible control answers to test the distinction.
What to do instead
Before answering, label the stem: is it asking what stops an act from occurring (prevention/deterrence) or what finds it after it occurs (detection)? Build a one-page table with three columns: prevention measure, detection measure, and the mechanism each uses. When two answers both look reasonable, choose the one that operates before the act.
Choosing the fraud triangle as the explanation for every motivational question, including questions about organized, repeated, or group offending where the fraud diamond, the fraud scale, or the A-B-C (action, benefit, concealment) analysis is the better fit.
The triangle (pressure, opportunity, rationalization) is the most memorized model, so it becomes the default. Candidates do not notice stems that describe capability (position, expertise, confidence to execute) or that describe an entire concealment cycle rather than a single act.
What to do instead
Memorize what each model adds: the diamond adds capability; the scale replaces rationalization with personal integrity and weighs pressure against opportunity; A-B-C describes the mechanics of a scheme. Read the stem for keywords - 'skill', 'authority', 'able to execute' point to capability, not pressure.
On financial statement fraud questions, accepting an answer because the journal entry described is possible, without checking whether it is the entry that produces the stated effect on the financial statements in the same period.
Candidates reason from 'could someone record this?' rather than 'does this recording achieve the fraudster's objective?'. Financial statement schemes work through timing (premature revenue, holding books open, delayed expense recognition), improper valuation, or concealment of liabilities, and each has a specific direction of effect on revenue, assets, and income.
What to do instead
For every financial statement question, write the fraudster's objective (overstate revenue, understate liabilities, smooth earnings), then test each option on direction and period. Practise by journalizing the scheme both ways and stating which account is overstated and in which period.
Misclassifying asset misappropriation schemes - calling a billing scheme a payroll scheme, or a register disbursement a skimming scheme - because the candidate keys on where the money ended up rather than on how it was taken.
The schemes overlap in outcome (cash leaves the organization). The classification depends on the mechanism: skimming removes cash before it is recorded; larceny steals cash already on the books; fraudulent disbursements use a payment mechanism (billing, payroll, expense reimbursement, check tampering, register disbursement). Candidates who do not hold the taxonomy firmly guess from the loss description.
What to do instead
Draw the cash flow from customer to bank and mark each point where theft can occur; assign each point to its scheme family. Then drill short scenarios and name the family plus the sub-scheme before reading the answer choices, so the options cannot pull you off the taxonomy.
Skipping or rushing the evidence-handling questions - for example, choosing to confront a suspect first, or to copy and return a device, or to interview a witness before securing documents - because the candidate focuses on solving the fraud rather than on preserving admissibility.
Investigation questions reward a sequence: secure and document, then analyse, then interview. Candidates with operational or audit backgrounds are used to gathering information quickly and informally, and the exam offers 'get the explanation first' answers that feel efficient but destroy chain of custody and tip off subjects.
What to do instead
Memorize the standard sequence and the reason for each step: plan and predication, covert/background, documents and physical evidence secured and logged, witnesses, then subject interview last. Practise identifying which step is out of order in a described investigation, since the exam often tests ordering rather than the step itself.
Answering interview questions with the confrontational or accusatory approach, or treating the interview as an interrogation, when the stem describes a witness, a cooperative employee, or an early fact-finding stage.
Candidate intuition says a fraud interview is hostile. CFE material distinguishes interviewing (information gathering, non-accusatory, often with witnesses and cooperative subjects) from interrogation (accusatory, used with a subject believed responsible, after evidence is developed). Choosing the aggressive option on a witness question is one of the most frequent misses.
What to do instead
Classify the person in the stem first: witness, complainant, peripheral employee, or subject. Match tone and technique to that classification. Learn the cognitive interview structure (free recall, then open questions, then specific questions) and reserve accusatory technique for the subject stage after evidence is complete.
Confusing the legal thresholds - reasonable suspicion, predication, probable cause, preponderance of the evidence, and proof beyond a reasonable doubt - and applying the criminal standard to a workplace or civil decision, or vice versa.
The terms sound interchangeable and candidates learn them from crime drama rather than from procedure. The exam tests which standard applies at which decision point: whether to open an investigation, whether to refer to law enforcement, whether to terminate employment, and what a civil court requires.
What to do instead
Build a threshold ladder with the decision each standard authorizes. Note explicitly that an employer's disciplinary decision is not a criminal conviction and does not require beyond-reasonable-doubt proof, while a criminal referral does require probable cause. Answer by first naming the decision in the stem, then the standard attached to it.
Assuming a fraud is a crime in every jurisdiction, or that because conduct is unethical or a breach of policy it is necessarily prosecutable, and picking the 'refer to police' answer for conduct that is only a policy violation or a civil wrong.
Many fraud-adjacent acts (aggressive accounting within the rules, conflicts of interest, breaches of fiduciary duty) are civil or administrative matters, not criminal offences, and definitions of theft, fraud, and forgery vary by legal system. Candidates generalize from their home jurisdiction or from moral disapproval.
What to do instead
For each scenario, separate three questions: does it breach policy, does it create civil liability, and does it meet the elements of a criminal offence? Learn the common elements of fraud and theft as legal concepts (intent, deception or taking, reliance, loss) and treat the referral decision as requiring all elements plus the applicable standard of proof.
Treating red flags as proof - concluding 'the employee is the fraudster' from lifestyle or behavioural indicators alone, or dismissing an anomaly because the person is trusted - instead of converting indicators into testable hypotheses and corroborating with documents.
Red flags are probabilistic and have innocent explanations; the exam rewards disciplined reasoning from indicator to evidence to conclusion. Candidates either over-convict on a single flag or under-investigate because of seniority, tenure, or personal sympathy, and both errors show up in conclusion-type questions.
What to do instead
For every red flag, state at least one innocent explanation and the specific record that would distinguish the two. Answer conclusion questions only after checking whether the stem supplies corroborating evidence; if it supplies only an indicator, the correct answer is usually 'investigate further', not 'conclude fraud'.
Managing time badly by grinding on long scenario questions and leaving the final block unanswered, or by changing first-instinct answers on review without a concrete reason from the stem.
Scenario items in the fraud schemes and investigation domains are long and invite re-reading; candidates lose minutes hunting for a detail that is not there, then rush the shorter law and deterrence items where they could have banked marks. Review-phase changes are usually driven by anxiety rather than by a newly noticed fact.
What to do instead
Adopt a two-pass strategy: answer every item once, flagging any that need more than about a minute, and never leave a blank. On the second pass, change an answer only if you can name the specific word in the stem that invalidates your first choice. Practise with timed sets that mix domains so the switching cost is trained, not just the content.