← CFE guide
CFE study flashcards
75 original cards on the fundamentals — first 15 free, full deck with a free account. Space flips, arrows move, K marks known.
Original study cards by FinCrime Desk — not actual exam content, not affiliated with ACAMS/ACFE.
0 of 75 marked known
No cards in this view — clear the topic filter or turn off “hide known”.
Printable deck
Checking your session…
Occupational fraud taxonomy
Occupational fraud
The use of one's occupation for personal enrichment through deliberate misuse or misapplication of the employing organisation's resources or assets.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
The three primary categories of occupational fraud
Asset misappropriation, corruption, and financial statement fraud. Misappropriation is the most common; financial statement fraud is typically the costliest per case.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Asset misappropriation
Theft or misuse of an organisation's assets — cash, inventory, information or other property — by someone entrusted with them.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Skimming
Removing cash before it is recorded in the accounting system. Because the receipt was never on the books, the theft leaves no direct ledger trail — an "off-book" fraud.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Larceny (cash)
Stealing cash after it has been recorded. Unlike skimming, it is an "on-book" fraud, so the shortfall is detectable by reconciling records to actual funds.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Lapping
Concealing a stolen receivable payment by applying a later customer's payment to the earlier account, rolling the shortage forward indefinitely and requiring continual concealment.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Billing scheme
Causing the organisation to pay for goods or services that are fictitious, inflated or personal — typically via shell vendors, pass-through entities or personal purchases.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Shell-vendor red flags
A vendor with no physical presence, an address matching an employee, invoice numbers in tight sequence, round-sum amounts, and no purchase order or receiving record.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Ghost employee
A payroll scheme in which someone who does not work for the organisation — fictitious or departed — remains on payroll with payments routed to the perpetrator.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Expense reimbursement schemes
Mischaracterised, overstated, fictitious or duplicated expense claims. Low value per instance, high frequency, and often the first evidence of a broader pattern.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Corruption (as a fraud category)
Schemes where an employee misuses influence in a transaction to obtain a benefit: bribery, kickbacks, illegal gratuities, extortion and undisclosed conflicts of interest.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Kickback
An undisclosed payment from a vendor to an employee who steers business to that vendor — usually recovered by the vendor through inflated prices to the organisation.
FinCrime Desk · CFE deck
Occupational fraud taxonomy
Conflict of interest
An undisclosed economic or personal interest in a transaction the employee influences. Disclosure is what distinguishes a managed interest from a fraud scheme.
FinCrime Desk · CFE deck
Financial statement schemes
Financial statement fraud
The deliberate misstatement or omission of amounts or disclosures in financial statements to deceive users — most often to inflate reported performance or hide obligations.
FinCrime Desk · CFE deck
Financial statement schemes
The five classic categories of financial statement fraud
Fictitious revenues, timing differences, concealed liabilities and expenses, improper disclosures, and improper asset valuation.
FinCrime Desk · CFE deck
Financial statement schemes
Fictitious revenue
Recording sales that never occurred — fabricated customers, sham transactions or sales lacking substance — usually accompanied by fake supporting documentation.
FinCrime Desk · CFE deck
Financial statement schemes
Channel stuffing
Pushing more product to distributors than they can sell to pull revenue into the current period. Warning signs include quarter-end shipment surges and later returns.
FinCrime Desk · CFE deck
Financial statement schemes
Cut-off manipulation
Recording revenue or expenses in the wrong period — holding the books open past period end or delaying expense recognition — to smooth or inflate reported results.
FinCrime Desk · CFE deck
Financial statement schemes
Concealed liabilities
Omitting or understating obligations: unrecorded payables, off-balance-sheet arrangements, unrecorded warranty or litigation exposure, or capitalising costs that should be expensed.
FinCrime Desk · CFE deck
Financial statement schemes
Improper capitalisation
Treating an ordinary expense as an asset so it hits earnings gradually rather than immediately, overstating both current income and the balance sheet.
FinCrime Desk · CFE deck
Financial statement schemes
Cookie-jar reserves
Overstating reserves in strong periods and releasing them in weak ones to smooth earnings. The manipulation is in the timing rather than the total.
FinCrime Desk · CFE deck
Financial statement schemes
Round-trip transaction
Simultaneous, offsetting deals between parties with no economic substance, recorded to inflate reported revenue or volume on both sides.
FinCrime Desk · CFE deck
Financial statement schemes
Related-party transaction risk
Transactions with parties connected to management may not be at arm's length and can be used to move losses or manufacture revenue. Disclosure and substance are the tests.
FinCrime Desk · CFE deck
Financial statement schemes
Horizontal vs vertical analysis
Horizontal analysis compares line items across periods to spot unusual change; vertical analysis expresses items as a percentage of a base (sales or total assets) to spot structural anomalies.
FinCrime Desk · CFE deck
Financial statement schemes
Why ratio analysis helps detect statement fraud
Manipulated numbers break normal relationships — receivables growing far faster than sales, or margins improving while the industry contracts — and ratios expose the divergence.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
The fraud triangle
Pressure, opportunity and rationalisation. Fraud becomes likely when all three are present; controls chiefly attack opportunity, because it is the element organisations can directly influence.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
Pressure (fraud triangle)
A perceived non-shareable financial problem or performance demand — personal debt, addiction, lifestyle, or targets the individual believes must be met.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
Opportunity (fraud triangle)
The perceived ability to commit and conceal the act without being caught, created by weak controls, unchecked authority, or an absence of independent review.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
Rationalisation (fraud triangle)
The self-justification that lets an otherwise honest person reconcile the act with their self-image: "I'm only borrowing it", "I'm owed this", "everyone does it".
FinCrime Desk · CFE deck
Fraud triangle & behaviour
The fraud diamond
An extension of the triangle adding capability: the individual's position, knowledge and confidence to actually execute and conceal the scheme.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
Behavioural red flag: living beyond means
One of the most frequently observed indicators. It is corroborating context, never proof, and must be tested against evidence rather than acted on alone.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
Behavioural red flag: refusal to take leave
A perpetrator who must maintain concealment daily resists vacation or rotation. Mandatory leave and job rotation are controls precisely because they interrupt concealment.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
Behavioural red flag: unusually close vendor relationships
An employee who insists on being the sole contact for a vendor, resists competitive bidding, or accepts hospitality may be concealing a corruption scheme.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
Control override by management
Management's ability to bypass controls is the reason senior-level fraud is both harder to prevent and more damaging. Independent oversight, not process design, is the mitigant.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
Collusion
Two or more people cooperating to defeat controls, most obviously segregation of duties. It is the main reason no control set eliminates fraud risk entirely.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
Why tips matter as a detection channel
People who see the scheme spot it before analytics do. Accessible, confidential reporting channels and visible non-retaliation are what make tips arrive.
FinCrime Desk · CFE deck
Fraud triangle & behaviour
Predication
The set of circumstances that would lead a reasonable, professionally trained person to believe a fraud has occurred, is occurring or will occur. Investigations should not begin without it.
FinCrime Desk · CFE deck
Investigation & interviewing
Fraud examination
A methodology for resolving allegations of fraud from inception to disposition: obtaining evidence, taking statements, writing reports, testifying, and assisting in detection and prevention.
FinCrime Desk · CFE deck
Investigation & interviewing
Fraud theory approach
Analyse available data, create a hypothesis, test it, then refine or amend it as evidence accumulates. The hypothesis directs evidence-gathering without prejudging the conclusion.
FinCrime Desk · CFE deck
Investigation & interviewing
Why interviews run from neutral to suspect
Neutral third parties and corroborative witnesses are interviewed first so the examiner enters the subject interview informed, and so the subject has less warning to destroy evidence or align stories.
FinCrime Desk · CFE deck
Investigation & interviewing
Open vs closed questions
Open questions invite narrative and are used to gather information; closed questions confirm specifics. Interviews typically move from open to closed as facts firm up.
FinCrime Desk · CFE deck
Investigation & interviewing
Leading question
A question that contains the expected answer. It has a narrow legitimate use in confirming known facts, but contaminates fact-gathering and weakens the evidential value of what follows.
FinCrime Desk · CFE deck
Investigation & interviewing
Admission-seeking interview
Conducted only when there is reasonable evidence of culpability, privately, and by an examiner prepared to document precisely what was said. Coercion or threats destroy the value of any admission.
FinCrime Desk · CFE deck
Investigation & interviewing
Chain of custody
The documented record of who held evidence, when, and what was done with it. A gap in that record is the fastest way to have evidence excluded or discounted.
FinCrime Desk · CFE deck
Investigation & interviewing
Handling original documents
Preserve originals, work from copies, log receipt, and avoid marking or altering the item. The same principle underlies forensic imaging of digital evidence.
FinCrime Desk · CFE deck
Investigation & interviewing
Data analytics in fraud examination
Testing whole populations rather than samples — duplicate payments, vendor-employee address matches, round-sum entries, out-of-hours journal postings — to direct where human review goes.
FinCrime Desk · CFE deck
Investigation & interviewing
Benford's Law
In many naturally occurring numeric sets, leading digits follow a predictable declining distribution. Deviations flag data sets worth examining; they do not by themselves prove manipulation.
FinCrime Desk · CFE deck
Investigation & interviewing
Net-worth method
An indirect method estimating unreported income by measuring change in assets less liabilities, adjusted for known income and living expenses — used where direct records are unavailable.
FinCrime Desk · CFE deck
Investigation & interviewing
What belongs in a fraud examination report
Scope, procedures performed, evidence obtained and factual findings — written objectively. The examiner reports facts; guilt is a legal conclusion for others to reach.
FinCrime Desk · CFE deck
Investigation & interviewing
Why examiners avoid opinions on guilt
Stating a legal conclusion exceeds the examiner's role, exposes them to defamation and liability claims, and gives opposing counsel an easy line of attack on the whole report.
FinCrime Desk · CFE deck
Legal concepts
General elements of fraud
A material false statement, knowledge of its falsity, reliance on it by the victim, and resulting damages. Wording varies by jurisdiction, but the structure recurs.
FinCrime Desk · CFE deck
Legal concepts
Materiality
Whether a misstatement or omission would influence a reasonable person's decision. Immaterial inaccuracies may be errors; material ones support a fraud claim.
FinCrime Desk · CFE deck
Legal concepts
Scienter
Knowledge of wrongdoing — the intent element that separates fraud from error or negligence, and the element most often contested in litigation.
FinCrime Desk · CFE deck
Legal concepts
Civil vs criminal fraud actions
Criminal actions are brought by the state and carry a higher burden of proof and penalties including imprisonment; civil actions are brought by victims and typically seek recovery.
FinCrime Desk · CFE deck
Legal concepts
Burden of proof: criminal vs civil (general)
Criminal matters require proof beyond a reasonable doubt; civil matters typically require a preponderance of the evidence — a materially lower standard.
FinCrime Desk · CFE deck
Legal concepts
Attorney-client privilege
Protects confidential communications made for legal advice. Examiners working at counsel's direction may fall within it; sharing the material outside the privileged circle can waive it.
FinCrime Desk · CFE deck
Legal concepts
Work-product doctrine
Protects materials prepared in anticipation of litigation from discovery. Whether an investigation report qualifies often turns on why and for whom it was prepared.
FinCrime Desk · CFE deck
Legal concepts
Spoliation
Destroying or failing to preserve evidence relevant to litigation. It can trigger sanctions and adverse inferences, which is why legal hold is issued early.
FinCrime Desk · CFE deck
Legal concepts
Legal hold
A directive suspending routine deletion of records that may be relevant to an investigation or dispute, issued as soon as litigation or enforcement is reasonably anticipated.
FinCrime Desk · CFE deck
Legal concepts
Defamation risk in investigations
Communicating unproven allegations to people without a legitimate need to know invites liability. Restricting distribution and reporting facts rather than conclusions is the discipline.
FinCrime Desk · CFE deck
Legal concepts
Whistleblower retaliation exposure
Adverse action against someone who reported in good faith creates legal exposure independent of whether the underlying allegation is substantiated.
FinCrime Desk · CFE deck
Legal concepts
Expert witness vs fact witness (general)
A fact witness testifies to what they observed; an expert may offer opinions within their expertise. Examiners can appear in either role and should know which one they are in.
FinCrime Desk · CFE deck
Prevention & deterrence
Fraud risk assessment
A structured identification of fraud schemes the organisation is exposed to, their likelihood and impact, and whether existing controls actually address them.
FinCrime Desk · CFE deck
Prevention & deterrence
Segregation of duties
Splitting authorisation, custody, recording and reconciliation across people so no individual can both commit and conceal a scheme.
FinCrime Desk · CFE deck
Prevention & deterrence
Preventive vs detective controls
Preventive controls stop an act before it happens (approval limits, access restrictions); detective controls surface it afterwards (reconciliations, analytics, audits). Programmes need both.
FinCrime Desk · CFE deck
Prevention & deterrence
Deterrence through perceived detection
The strongest deterrent is the belief that fraud will be caught. Visible monitoring, publicised outcomes and surprise audits raise perceived detection risk.
FinCrime Desk · CFE deck
Prevention & deterrence
Mandatory vacation and job rotation
Controls that force another person into a role, interrupting the continuous concealment most long-running schemes require.
FinCrime Desk · CFE deck
Prevention & deterrence
Surprise audits
Unannounced testing removes the ability to prepare or reverse manipulation before review, which is what gives them deterrent value beyond scheduled audits.
FinCrime Desk · CFE deck
Prevention & deterrence
Hotline / reporting mechanism design
Confidential, independently operated, available to employees and third parties, with non-retaliation stated and followed. Untriaged tips are worse than no hotline.
FinCrime Desk · CFE deck
Prevention & deterrence
Code of conduct
The written statement of expected behaviour and reporting duties. It only functions where it is trained, acknowledged and enforced consistently at every level.
FinCrime Desk · CFE deck
Prevention & deterrence
Tone at the top
Senior leadership's demonstrated attitude to ethics and control. Where leaders bypass controls, employees read the exception as the real policy.
FinCrime Desk · CFE deck
Prevention & deterrence
Vendor due diligence as anti-fraud control
Verifying vendor existence, ownership and independence at onboarding, then re-verifying periodically, defeats shell-vendor and kickback schemes at the point of entry.
FinCrime Desk · CFE deck
Prevention & deterrence
Employee background screening
Role-appropriate pre-hire verification of identity, credentials and history, applied consistently and lawfully, to keep known risk out of positions of trust.
FinCrime Desk · CFE deck
Prevention & deterrence
Continuous monitoring
Automated, recurring tests over full transaction populations that flag exceptions as they arise, shrinking the window between a scheme starting and someone noticing.
FinCrime Desk · CFE deck
Prevention & deterrence
Post-incident remediation
After a scheme is resolved: fix the control gap that allowed it, test whether the same gap exists elsewhere, and document both — otherwise the next case is the same case.
FinCrime Desk · CFE deck