This question tests your knowledge of Domain 10.

In the context of Basic Principles of Evidence, specifically relating to privilege, the question asks about CFE.

The correct answer is B: Lose the case if a trier of fact concludes that he restrained Janessa without consent or legal justification.

This question tests knowledge of evidence principles. The correct answer correctly distinguishes between types of evidence, admissibility requirements, or evidentiary privileges. Proper handling of evidence is crucial for successful fraud investigations and prosecutions.

The correct answer is: Whether recording is legal depends on consent laws — so the most helpful question is effectively: “Is consent required from one or all parties to record this conversation?”

Among the provided choices, the closest match is NOT listed explicitly. But based on the ACFE manuals, the correct interpretation is that none of the technical details (audio/video, file format, time, duration) matter — only the legal consent requirement matters.

Complete Detailed Explanation with Exact Extracts from Fraud Examiner (CFE) - Investigation Documents: =

The 2014 International Fraud Examiners Manual states:

“In some circumstances, recording an interview might be illegal. Some jurisdictions limit an employer’s right to record employee interviews during an investigation. In fact, in some jurisdictions, audio recording an interview is permitted only with the consent of all parties to the communication. Thus, fraud examiners should always consult with an attorney when deciding whether to record an interview.”

It further emphasizes:

“A telephone recording consent form stipulates where, when, and with whom telephone conversations can be recorded… Be cautioned that the form alone does not make the conduct of recording a telephone conversation illegal or legal.”

???? Interpretation:

The legality of recording has nothing to do with:

Audio vs video (A)

Digital file format (B)

Work hours (C)

Duration (D)

Instead, it depends entirely on jurisdictional consent laws (one-party vs all-party consent).

The Fraud Examiners Manual states:

“Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction… emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive”.

Thus, statement C is NOT true.

The manual states:

“When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence.”

Thus, B is the least accurate statement.

Oral consent is generally not sufficient to obtain a suspect’s bank records. The CFE Prep - Investigations states:

“Accessing a subject’s bank records from financial institutions generally requires written consent. Oral consent is the least effective way to obtain permission”.

The Fraud Examiners Manual also notes that bank information can usually only be obtained with subpoena, search warrant, or written consent.

The CFE Prep Guide clarifies:

“A fraud response plan outlines the actions… when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success”.

Thus, statement D is false.

The best answer is A. A personal mobile phone brought to the office from home. In the CFE Law materials, workplace privacy analysis turns on whether the employee has a reasonable expectation of privacy in the place or item searched and whether the employer’s search is justified, necessary, and proportionate. Personal items that belong to the employee, especially items brought from home and used for private communications or storing personal data, are the strongest candidates for a protected privacy interest.

By contrast, an employer-issued laptop is usually much less private because it is company property and often subject to workplace monitoring policies. A desk drawer in a communal workspace may carry some expectation of privacy in certain situations, but generally less than a personally owned phone, especially if the workspace is shared or subject to employer access. A recycling bin is the weakest option because discarded items usually carry little or no reasonable expectation of privacy. Therefore, among the listed choices, the item an employee is most likely to have a reasonable expectation of privacy in is the personal mobile phone. This answer is also consistent with the broader CFE principle that privacy protection is strongest where the item is personal, private, and not owned or controlled by the employer.

The Fraud Examiners Manual stresses confidentiality:

“To preserve confidentiality, investigators should avoid transmitting confidential information by email or other electronic means whenever possible, as these are susceptible to interception or unauthorized access.”

Suspending employees or blanket bans on discussion are not best practices. Confidentiality is preserved primarily by secure communication and controlled access to information.

In inquisitorial criminal justice systems, discovery generally occurs through the investigative and examining phases rather than through party-driven requests like those used in adversarial systems. Judges, prosecutors, or examining magistrates often play a central role in developing the evidentiary dossier. This differs from adversarial systems, where the parties commonly request, exchange, and challenge evidence through formal discovery procedures. Option A is incorrect because the parties do not primarily create the evidentiary record in the same manner as adversarial litigation. Option C is also incorrect because inquisitorial proceedings are usually not party-driven. Option D is wrong because discovery does not typically begin after the trial starts. Therefore, the most accurate statement is that discovery primarily occurs during the investigative and examining phases.

Isla is attempting to create rapport. Introductory questions should help establish trust, cooperation, and communication before the examiner moves into the fact-gathering portion of the interview. The Fraud Examiners Manual describes rapport as a harmonious relationship that fosters cooperation and trust. Asking a simple, friendly question about coffee or tea is casual conversation designed to make Doug comfortable and create common ground. Option A is too broad because the facts do not show she is structuring a questioning pattern. Option B is different; the interview theme states the general purpose of the interview. Option D is incorrect because the question is not meant to distract Doug, but to relax him and encourage open communication.

Before beginning the interview phase, Javier should review the case file to ensure that the interview plan is not missing important information. Proper interview preparation requires a clear understanding of the case facts, the interview’s purpose, the information expected from each witness, and the best strategy for obtaining that information. Option B is incorrect because the examiner should determine the purpose of the interview in advance. Option C is too rigid because the most appropriate interviewer should be selected based on the specific interview and witness. Option D is also incorrect because although the setting should be comfortable and secure, it should not be overly familiar to the subject, such as the subject’s home or office.

When the objective is asset recovery through civil legal action, the practical value of litigation depends heavily on collectability—whether a favorable judgment can be satisfied. CFE guidance on tracing and asset recovery highlights that tracing engagements are commonly undertaken specifically to determine whether a potential defendant can pay a court-ordered sum if judgment is entered, and to locate assets that can be used to satisfy a judgment. If the defendant is judgment-proof or has insufficient reachable assets, the legal action might be economically irrational even if liability is strong. While statute of limitations (D) is legally important, the question asks what is most important before moving forward with a recovery action; from an investigative and recovery perspective, the threshold question is whether there are assets to recover or a realistic path to enforcement. Past arrests (B) do not answer the recovery feasibility question. Option C misframes the decision: legal actions proceed based on evidence and counsel’s assessment, but recoverability often drives whether to invest in litigation. Therefore, assessing whether the defendant has sufficient money or property to satisfy a judgment is the most important preliminary question.

From the 2014 International Fraud Examiners Manual, under the section related to tracing financial transactions, specifically tracing the disposition of loan proceeds, the following objectives of tracing activities are explicitly outlined:

“Tracing the disposition of loan proceeds can help fraud examiners:

Determine whether loan proceeds were deposited into hidden or unknown accounts

Determine whether loan proceeds were used to pay off other loans

Identify the involvement of previously unknown individuals (potential witnesses)

Determine whether payments were made from hidden accounts

Identify undisclosed related-party transactions”

There is no mention that tracing loan proceeds can uncover previous civil offenses committed by the subject. Civil offenses refer to non-criminal violations (e.g., breach of contract, torts), which tracing of financial transactions like loan proceeds is not directly designed to uncover.

This is not a recognized purpose of tracing as taught in the CFE Investigation section. The core objectives revolve around uncovering hidden assets, hidden accounts, payments, and potential witnesses — not prior legal infractions.

Therefore, the correct answer is A, as it is the only option that is NOT true according to official CFE investigation materials.

Circumstantial evidence proves a fact indirectly through inference rather than directly proving the disputed fact. The restaurant’s reservation logbook showing no record of the lunch does not directly prove the employee lied, but it strongly supports an inference that the claimed lunch did not occur. That makes option B circumstantial evidence. Option C is direct evidence because the client personally testifies that the lunch never occurred. Option D is also direct evidence because the employee’s own email confession directly addresses the false reimbursement. Option A is stronger documentary evidence that the client paid, but the logbook example best illustrates an indirect proof pattern. Fraud examiners often use circumstantial evidence to support conclusions when direct admissions or eyewitness testimony are unavailable.

The main purpose of imaging a seized computer’s hard drive is to create a forensic copy that can be used for analysis while preserving the original evidence. A forensic image is an exact duplicate of the storage media, created using proper forensic tools and verified for accuracy. Investigators generally analyze the image rather than the original device to reduce the risk of altering original evidence. Option A is incorrect because forensic analysis should not normally be performed directly on the suspect system. Option B describes documentation of the scene, which is important but not the purpose of imaging. Option D is not the primary objective. Imaging protects evidence integrity and supports later authentication and admissibility.