Investigation
Investigation
This domain tests the disciplined process of resolving fraud allegations: predication, planning, evidence gathering, analysis, interviewing, and reporting. The exam emphasizes documentation, objectivity, and lawful limits.
Core rules
- Predication: a reasonable basis to believe fraud occurred. Without it, an investigation can become a fishing expedition and create legal exposure.
- Plan scope, objectives, resources, confidentiality, and legal constraints before fieldwork.
- Evidence must be relevant, reliable, and sufficient. Preserve originals; use chain-of-custody logs; image digital devices before analysis.
- Data analysis: compare vendor and employee master files, test duplicates, gaps, outliers, Benford’s law, and segregation-of-duties conflicts.
- Interviews: witness interviews before subject interviews; use open questions, then transition to admission-seeking only with strategy and documentation.
- Report facts, methodology, findings, and limitations. Distinguish fact from opinion.
Worked example
A tip alleges a procurement officer favors one bidder. The examiner first confirms predication, then collects bid documents, evaluation sheets, email, and payment records. She images the officer’s work laptop with a custody log, analyzes bidder ownership and contact data, interviews panel members, and only then interviews the officer. Reasoning: documents and witness accounts are less reactive than the subject; preserving digital evidence prevents spoliation; sequencing reduces collusion and destruction risk. The report links evidence to each finding and avoids a legal conclusion.
Traps
Do not interview the subject first. Do not rely on copies without documenting origin. Do not overstate guilt in a report. Do not ignore privacy and employment-law limits during device searches. Do not let confirmation bias steer data tests.