CFE Volume Three Key Notes

Please note that key notes below are highlights of content and areas that you need pay special attention to. It is best to read the official study manual once and start the practice questions immediately to reinforce your learning concepts. Key notes here are compiled based on our experience and candidates feedback that are frequently appeared in the exams.

The value of a fraud examination relies on the credibility of the evidence that is obtained. Evidence of fraud is taken from the witness by the statements or form of documents. So, the fraud examiners must know how to legally and properly obtain the documentary evidence and statement from the witness.


After the evidence is obtained and analyzed, the fraud examiner reports the result to the designated individuals. The report is the narration of the examiner’s findings, activities and recommendations.


The fraud examiners are called to provide a testimony regarding their findings at a trial, deposition or any other legal procedures. While providing the testimonial the examiner should be truthful. 


The fraud examiners are not responsible for the prevention of fraud, the responsibilities belongs to the management and the other authorities responsible for it. It is expected that the fraud examiners will be actively looking and recommending the right polices and procedures to prevent fraud.


Forensic accounting uses their professional accounting skills which involves potential or criminal or actual litigation. Forensic accounting is actually action support that is involved with accounting. 


Fraud examination can be performed either by an accountant or non-accountant. An accountant can also perform the forensic accounting task. Fraud examination involves  anti-fraud matters only.


Forensic accounting includes the following professional services;

  • Computer forensics
  • Electronic discovery
  •  Bankruptcies, insolvencies, and reorganizations
  •  Workplace fraud investigations
  • Calculations of economic losses
  • Business valuations
  •  Professional negligence

The fraud examination is conducted with the assumption that the case will end up in litigation. This will make sure that the fraud examiner will maintain the proper rules of the evidence and also maintain the guidelines made by the law.


The fraud examination must follow the law, so they should not handle or continue any examination without the right prediction. Prediction depends on the type of examination and individual steps taken when the examination is performed. 


The fraud examiner should approach the investigation by looking for a way to prove how the fraud have occurred and to prove how the fraud have not occurred. The two-perspective approach need to followed as per the law.


Fraud examination starts when all the facts are not clear at that time the fraud examiners should follow from the general to the specific. The examination will begin with basic information which is known, beginning at the verge and then moving on to the specific details.


During fraud examination, the fraud examiners should follow the fraud theory approach strictly.  The fraud theory approach is used as an examination tool designed to assist the examiners sort and  oversee the examinations based on the available information.


The following steps are involved in the fraud theory approach;

  •  Analyzing available data
  • Creating a hypothesis
  • Testing the hypothesis
  • Refining and amending the hypothesis

In the fraud theory approach, examiner should begin by the data needs to be analyzed so that the fraud examiners can create a basic hypothesis to figure out what have occurred. 


After analyzing the data that was available, they should create a basic hypothesis on what has occurred.  


After creating the hypothesis, the examiner should test it by receiving the new information or by altering and adding it to the known information. A hypothesis can be tested by creating a what-if scenario.


Once the hypothesis is tested, the fraud examiner should determine that the theory is not provable, the examiner should repeatedly revise and test the hypothesis based on the known facts.


After collecting the evidence for fraud examination, the management should respond in a proper and timely manner. The initial response is really critical. To make sure that the outcome of fraud examination comes out right a fraud response plan needs to be developed.


In fraud response plan the following sections needs to be followed;

  • Reporting protocols
  • A response team responsible for conducting an initial assessment
  • Factors used to determine the course of action
  • Litigation hold procedures
  • Principles for documenting the response plan
  • A template or form to report fraud incidents

To Conduct an Initial Assessment to Determine the Appropriate Response the following steps should to be taken;

  • Determine if fraud occurred.
  • Identify the status of the fraud
  • Identify potential claims and offenses.

In the investigation portion of the initial assessment the following is involved;

  • Contacting the source, if the investigation was triggered by a report or complaint
  • Interviewing key individuals
  • Reviewing key evidence

In fraud response plan a response team is required to identity the person who is required to respond to the types of fraud that occurs. The member of response team members depends on the type and probable seriousness of the suspected fraud.


In fraud response plan to take the best action regarding the fraud that have occurred, the management needs to make a list of factors that is required to make the right decision. To identify the factors the response team figures out whether to move the incident to an investigation level.


For Planning and Conducting a Formal Investigation the following steps are involved;

  • Completing engagement letters or contracts
  • Issuing advisory letters
  • Assembling the fraud team
  • Learning about the organization at issue
  • Developing an investigation plan

In fraud response litigation hold procedure is required to make sure that the documents are not destroyed once the evidence of unethical behavior occurs.


An Engagement letters contain  the following basic parts;

  • Opening
  • Body
  • Terms
  • Indemnity clause
  • Close

In fraud response litigation hold procedure is established in an organization for the following reasons;

  • Promptly notify employees who might possess relevant documents.
  • Issue a preliminary hold order to all individuals and employees who might possess
    relevant information.
  • Promptly notify information technology (IT) personnel and get their involvement if
    electronic data is at issue.
  • Notify employees and IT personnel of their duty to preserve.
  • Suspend any deletion protocols.
  • Prohibit the destruction, loss, or alteration of any potentially relevant documents.
  • Prohibit employees from destroying, hiding, or manipulating documents.
  • Alert employees as to the risk to the company and the employees if they fail to heed the
    litigation hold request.

In fraud response the management should establish  principles to keep record of all the information consistent or made during each stage of the fraud investigation, which includes the first response which is used to support making decision.


For Assembling the Fraud Team the following skills team members needs to be have;

  • Accounting and audit knowledge
  • Knowledge of the industry
  • Knowledge of the organization
  • Knowledge of the law and the rules of evidence in the jurisdiction where the fraud occurred
  • Knowledge of privacy issues in the jurisdiction where the fraud occurred and where the
    investigation will occur
  • An understanding of psychology and motivational factors
  • Interviewing skills
  • Communication skills
  • Computer skills

In fraud response a fraud incident report log should contain the following information;

  • How the organization became aware of the suspected fraud, including the name of any
    complaining party
  • The date the issue was raised or reported
  • The nature of the suspected fraud
  • Department or divisions involved
  • Suspect employees or parties
  • Actions taken

In initial response to suspicions or allegations of fraud the following actions is required;

  • Activate the response team.
  • Engage legal counsel, if necessary.
  • Consider contacting the insurance providers.
  • Address immediate concerns.
  • Conduct an initial assessment.
  • Document the initial response.