CFIP Study Guide: Linking Evidence Across All Eight Domains

Study the eight CFIP domains as one investigation workflow rather than eight separate subjects. For every topic you review, ask three questions: what evidence this method needs, what must be preserved before analysis, and what legal limit applies. Practice with scenarios that cross domains, such as a procurement fraud that starts with an accounting anomaly and ends with digital evidence and a referral decision. Link each accounting method to the digital records and legal authority that support it, and each interview technique to the case theory it is meant to test.

Start every study session by classifying the allegation before choosing a method

Identify whether the suspicion involves misappropriation, corruption, financial statement manipulation, or concealment, because each points to different procedures.

The same document can lead to four different investigations. An unusual vendor payment could be a billing scheme, a kickback, a management override entry, or a simple clerical error. If you begin studying procedures without this classification habit, you will apply asset tracing where a controls test belongs, or run a Benford-style screen where the real issue is a conflict of interest between the buyer and the supplier. Classification is a decision you make on paper: write the allegation, list the scheme types that fit, and name the one test that would distinguish them.

Use the fraud triangle as your classifier, not just a memorized list. Pressure and rationalization explain who might offend; opportunity tells you where to look. A purchasing officer under personal financial stress with sole approval authority for small-value orders presents an opportunity-driven pattern that directs your tests toward split orders and vendor legitimacy, not toward revenue recognition. Make this two-line habit part of every practice question: the scheme family, and the opportunity element that gives you your first test.

• Scheme families: asset misappropriation, corruption, financial statement fraud, concealment and laundering
• Opportunity analysis names the control that failed or never existed
• One distinguishing test per classification keeps your plan focused
• Reclassify whenever evidence contradicts your first theory

Trace ledger anomalies to source documents before you theorize

An unusual journal entry is a lead, not evidence of fraud; verify it against source documents, reconciliations, and the accrual logic of the transaction.

Principles and practice of accounting underpins every CFIP accounting method, and the trap is skipping it. A suspicious credit to revenue that does not match a customer contract could be manipulation, or could be a legitimate accrual adjustment booked late. Your procedure is mechanical: trace the entry to its supporting document, check the bank reconciliation that should cover the same period, and test whether the accrual or cash treatment matches the underlying transaction. Only when the entry cannot be explained do you escalate it into the forensic track.

Practice with a trial balance mindset: every unexplained entry must balance somewhere, and the offsetting side often reveals the scheme. An expense credited against a suspense account, an asset written off without approval, or revenue recognized before delivery each leave a trace in a different statement relationship. Build fluency by reconstructing the flow from ledger to trial balance to statement for a small fictional company, then deliberately planting three types of unusual entries and explaining where each trace leads.

• Trace: ledger entry, source document, bank statement, approval trail
• Check reconciliations for the same period before calling an entry unusual
• Distinguish accrual timing differences from genuine manipulation
• The offsetting side of an entry often identifies who benefited

Preserve digital evidence before analysis, and verify integrity with hashes

Acquire a forensic image, compute and record hash values, and document chain of custody before any analysis touches the data.

Computer and digital forensics in the CFIP syllabus is about defensibility, not tool menus. The sequence matters: identify sources, acquire an image of storage media rather than working on originals, calculate a hash value at acquisition, and record who handled the evidence and when. Volatile data, such as running processes and live network connections, must be captured before shutdown because it disappears on power-off. If you analyze the original or skip the hash record, the entire financial reconstruction built on that data becomes challengeable.

Logs and metadata give investigations their timeline. Email headers date communications, file system metadata shows when documents were created or altered, and application logs tie a user identity to a transaction. The scenario below shows how digital evidence and accounting analysis depend on each other: the hash preserves the data, the ledger interpretation gives it meaning. Practice describing the order of steps out loud, then in writing, until the sequence is automatic.

• Order: identify, acquire image, hash, document custody, then analyze
• Capture volatile data before powering a live system down
• Work from images, never originals
• Logs and metadata supply dates and user attribution for the accounting story

Legal authority and privilege boundaries decide what evidence you can use

Confirm your authority to search, seize, or interview; respect privacy, consent, and privilege; escalate admissibility questions to qualified counsel.

Investigation law constrains every other domain. An interview conducted without proper authority, documents collected beyond consent or a legal basis, or privileged communications swept into your workpapers can invalidate otherwise excellent analysis. Before planning any procedure, answer three questions: what authority covers this step, what privacy or consent limits apply, and could this material be privileged. When the answer is uncertain, the syllabus point is escalation: qualified legal counsel decides, not the investigator.

The distinction between internal investigation authority and law enforcement power is a recurring point of confusion. A corporate investigator relies on company policy, employment terms, and consent; a police officer relies on statutory search powers. Confusing the two leads to evidence gathered in ways that regulators or courts may reject. The table below contrasts the two settings so you can identify which rules govern a scenario before you plan the first interview or document request.

• Three checks before any step: authority, privacy and consent, privilege
• Private investigators do not possess statutory search powers
• Privileged material needs counsel involvement before collection escalates
• Admissibility questions are legal questions: escalate, do not improvise

Choose the investigative accounting method that matches the available records

Match the net worth, bank deposit, source-and-application, or specific-item method to the records the subject actually maintains.

Investigative accounting offers several quantification methods, and choosing the wrong one is a structural error, not a detail. The net worth method compares a subject's assets, liabilities, and living expenses across periods to expose unexplained income; it needs personal balance sheet data. The bank deposit method sums deposits across accounts and subtracts identified legitimate sources; it needs complete banking records. Source-and-application analysis compares known funds in and out; the specific-item method traces one asset or transaction. The method follows the evidence trail that exists.

The worked scenarios below apply this rule. In the first, complete bank records make the bank deposit method natural and the net worth method unnecessary. In the second, missing business records push the analysis toward net worth, which then depends on legally obtained personal financial information. Practice by listing, for each method, the records it assumes, the output it produces, and the defense a subject could raise, such as gifts or prior accumulations, so you can anticipate corroboration needs.

Scenario one: the supplier refund that only makes sense with the email trail

A credited expense refund contradicts procurement records; the resolution combines ledger tracing, digital evidence, and a legal check.

A controller notices a credit note reversing a supplier invoice for services never delivered, booked against a cost center with weak approval controls. The tempting shortcut is to conclude kickback and start interviewing. The better sequence: first trace the credit note to source documents and the bank reconciliation, confirming the supplier account is controlled by the same buyer who approved the original invoice. This is an accounting finding. Second, request the buyer's mailbox through proper authority; the acquired image is hashed and logged, and email metadata shows the credit note was requested by the buyer using a lookalike address a week after the supplier contract lapsed. This is the digital evidence layer.

A plausible mistake occurs at the legal step: the investigator screenshots the mailbox from a colleague's open session instead of following the acquisition and consent procedure, so the defense can challenge custody and privacy. The better decision is to pause, confirm authority with counsel, and image the mailbox properly even though the analysis is already clear. Why it matters: the accounting trace and the metadata told a consistent story, but only the defensible acquisition makes that story usable in a referral to the employer, a regulator, or law enforcement.

• Accounting layer: credit note trace and reconciliation isolate the anomaly
• Digital layer: hashed mailbox image with metadata dates the fraudulent request
• Legal layer: authority and consent confirmed before collection
• Outcome: a referral package where every finding traces to preserved evidence

Scenario two: cash business, missing records, and the net worth decision

When business records are incomplete, the net worth method can still expose unexplained income if personal financial data is lawfully obtained.

An owner-operated distribution business reports thin profits year after year while visibly expanding its property holdings. Expense-driven scheme tests find nothing systematic; bookkeeping is poor rather than manipulated. A plausible mistake is forcing a bank deposit method onto incomplete, cash-heavy records and presenting a distorted income estimate. The better decision is recognizing the record conditions and switching to the net worth method: reconstruct the owner's assets, liabilities, and plausible living costs across several years, and identify the unexplained increase in net worth that reported income cannot cover.

The mistake to avoid in net worth analysis is treating the computed unexplained amount as proven income without corroborating alternative explanations: inheritances, prior savings, loans, or gifts. Each alternative must be checked against the records you lawfully hold, and gaps become interview topics planned with rapport-based technique rather than accusation, because the goal is to test the case theory, not to trap the subject. Why it matters: the net worth figure is only as strong as the completeness of the asset picture and the elimination of innocent sources, which is exactly what a reviewer or tribunal will probe.

• Method selection follows record completeness, not preference
• Net worth requires lawful access to personal financial information
• Corroborate and eliminate innocent explanations before quantifying loss
• Interviews test the theory; they do not replace corroboration

Corruption and laundering patterns connect the scheme to the money trail

Bribery, kickbacks, procurement fraud, and laundering appear as third-party flows; trace beneficial ownership and concealment patterns to link them.

Studies on fraud and corruption supply the pattern recognition that makes scenarios legible. Kickbacks rarely appear in the victim company's books; they surface as inflated prices, weak vendor vetting, split orders below approval thresholds, or unexplained vendor switching. Conflicts of interest show up as related-party patterns a screening step can flag. Money laundering adds the placement, layering, and integration framing: concealment usually leaves layered transactions through third parties, and beneficial ownership indicators, such as shell entities or nominee arrangements, become the tracing target.

Connect these patterns back to investigative accounting: once you suspect third-party facilitation, asset tracing asks who ultimately controls the receiving entity. Public sector settings add procurement-specific indicators, such as single-source awards without justification or specifications written around one vendor. Practice by reading a fictional procurement file and listing every indicator present, then stating which accounting procedure and which digital record would corroborate each indicator. This cements the syllabus integration the credential is designed around.

• Kickbacks surface in prices and vendor behavior, not in the victim's ledger
• Split orders and single-source awards are classic procurement indicators
• Layering and integration point toward beneficial ownership tracing
• Each indicator needs a named corroborating procedure

Referral packages, expert reports, and testimony boundaries

Structure findings so each conclusion cites preserved evidence, quantified loss, and clearly bounded expert scope.

Criminal investigations and investigation law converge at the reporting stage. A referral package for law enforcement or a regulator should contain the case theory, the corroborated facts, the evidence log with custody records, the quantification of loss with its method stated, and the gaps that remain. Expert reports and testimony add a boundary discipline: you report what the evidence supports and the method produced, not opinions about guilt. Distinguishing factual findings from legal conclusions keeps your work admissible and your credibility intact.

Write practice reports for your two scenarios above, then self-review against a rubric: is every factual claim traceable to a logged exhibit, is the quantification method named with its assumptions, are limitations disclosed, and is the language free of conclusions reserved for the trier of fact. This exercise doubles as exam preparation because it forces you to explain why each method was chosen, which is the reasoning the CFIP syllabus emphasizes across all eight domains.

• Case theory first, then corroborated facts, then exhibits
• Name the quantification method and its assumptions in the report
• Disclose limitations and remaining gaps
• Factual findings only: guilt is decided by the trier of fact

A weekly linking drill and a preparation sequence you can adapt

Drill one cross-domain scenario per week, score it with a rubric, and rotate the domain that anchors the scenario.

Practical exercise, one hour weekly: write a two-paragraph fictional scenario anchored in a different domain each week, then complete a five-row answer grid. Row one, allegation classification and scheme family. Row two, the accounting method or test chosen and why. Row three, the digital evidence involved, its acquisition order, and the hash and custody steps. Row four, the legal checks: authority, consent, privacy, privilege. Row five, the reporting output and remaining gaps. Expected observation: your first attempts will leave rows three and four thin, because accounting intuition arrives faster than custody and authority thinking. Rubric: award yourself a point per row for naming concrete steps, and two bonus points when the legal check changes your procedure rather than being an afterthought; a score of six out of seven across three consecutive weeks is a solid learning milestone.

Adaptable preparation sequence: weeks one and two, master classification and accounting fundamentals by rebuilding a small company's ledger-to-statement flow and planting unusual entries. Weeks three and four, add digital forensics order-of-operations and law checks to the same scenarios. Weeks five and six, layer investigative accounting methods, choosing among net worth, bank deposit, source-and-application, and specific item based on record conditions. Week seven, corruption patterns and referral package writing. Week eight, run the drill on two scenarios from memory and score with the rubric. Readiness checks: you can state the acquisition order without hesitation, select the accounting method in under a minute from a record description, name the three legal checks unprompted, and produce a five-row grid for an unfamiliar scenario scoring at least six of seven.

• Weekly drill: new scenario, same five-row grid, rotate the anchor domain
• Expect legal and custody rows to lag accounting rows early; that is the point
• Sequence: accounting core, then digital and legal overlays, then methods, then reporting
• Ready when the grid scores six of seven on unfamiliar scenarios

CFIP readiness checks you can run before sitting the exam

Verify four competencies: classification speed, method selection, evidence sequence, and legal escalation judgment.

Run these checks with closed notes. First, given any allegation sentence, name the scheme family and one distinguishing test within sixty seconds. Second, given a record description, name the investigative accounting method and its main assumption within sixty seconds. Third, recite the digital evidence order of operations, including where volatile data fits and what the hash is for. Fourth, given a step such as imaging a laptop or interviewing a spouse, state whether your authority covers it and when escalation to counsel is required. If all four pass, your cross-domain workflow is functioning.

For administrative details about the credential, including registration and exam logistics, consult the issuing body directly through the IICFIP website, since this guide focuses on the syllabus content rather than administrative requirements. When you want extra question practice, the free CFIP practice questions page and the broader study guides library on this site pair well with the drill above, giving you additional scenarios to classify and grid before exam day.

• Sixty-second classification and method selection from any scenario sentence
• Order-of-operations recall for digital evidence, volatile data included
• Three legal checks stated unprompted, with escalation triggers named
• Pair the drill with additional practice questions for volume

References and further reading

Use these references to explore the concepts and check the latest information from the relevant organizations.

• iicfip.org

Continue your preparation

• Certified Forensic Investigation Professional Cfip
• Study Guides