The manual explains:

“After the interviewer establishes rapport through normal conversation, he must observe the respondent’s reactions. This will serve as a baseline for observing behaviour when questions that are more sensitive are asked.”

A neutral, non-threatening question such as “How long have you been in this department?” is ideal for establishing a baseline.

This question tests your knowledge of Domain 1.

In the context of Overview of the Legal System, specifically relating to civil, the question asks about civil actions in most jurisdictions is CORRECT, CORRECT.

The correct answer is B: Civil actions begin with the filing of a pleading, usually in the jurisdiction where the defendant resides or where the claim originated..

This question relates to the legal system framework. Understanding the distinction between different legal systems and processes is crucial for fraud examiners. The correct answer accurately describes the relationship between different legal entities and their jurisdictions.

CFE Prep clarifies entrapment:

“Entrapment occurs when law enforcement induces a person to commit a crime that he is not predisposed to commit… It is imperative that adequate predication exists before the operation is commenced. For example, if the officer received a reliable tip, that could serve as adequate predication.”

Here, the officer acted on a reliable tip, so the entrapment claim would fail.

This question tests your knowledge of Domain 1.

In the context of Overview of the Legal System, specifically relating to inquisitorial, the question asks about the core concepts in this area.

The correct answer is D: The judge.

This question relates to the legal system framework. Understanding the distinction between different legal systems and processes is crucial for fraud examiners. The correct answer accurately describes the relationship between different legal entities and their jurisdictions. In adversarial systems, opposing parties present their cases before a neutral judge or jury, while in inquisitorial systems, judges take a more active role in investigating cases.

The Fraud Examiners Manual defines:

“Testimonial evidence is that evidence which is presented in the form of witness statements, whether oral or written, offered in response to questions” (Fraud Examiners Manual – Evidence section).The colleague’s statement overhearing a conversation is testimonial evidence.

Social media content is dynamic—posts can be edited, deleted, or moved—so fraud examiners must preserve relevant information promptly and in a manner that supports authenticity and admissibility. CFE investigative guidance emphasizes that documentary (including digital) evidence carries limited value in legal proceedings unless it can be shown to be authentic and in substantially the same condition as when collected. Simply saving a link (Option A) is weak because the underlying content can change, and a link does not preserve what was actually observed. Requesting a copy from the platform (Option B) is often impractical as a routine step and may require legal process; it also does not replace contemporaneous preservation by the examiner. A “forensic shutdown” (Option C) is not an appropriate method for preserving web-based social media content because the key evidence exists on external servers, not solely on the examiner’s machine. Proper practice is to download/capture and preserve what was observed while documenting the collection steps and maintaining a defensible chain of custody so authenticity can be established if needed in court.

This question tests your knowledge of Domain 1.

In the context of Overview of the Legal System, specifically relating to inquisitorial, the question asks about the qualifications of expert witnesses in most inquisitorial jurisdictions is CORRECT, CORRECT.

The correct answer is D: The qualification of an expert is generally based on standardized requirements.

This question relates to the legal system framework. Understanding the distinction between different legal systems and processes is crucial for fraud examiners. The correct answer accurately describes the relationship between different legal entities and their jurisdictions. In adversarial systems, opposing parties present their cases before a neutral judge or jury, while in inquisitorial systems, judges take a more active role in investigating cases. Expert witnesses provide specialized knowledge to help the fact finder understand complex issues. Their testimony must be relevant, reliable, and based on sufficient facts or data.

This question tests your knowledge of Domain 1.

In the context of Overview of the Legal System, specifically relating to common law, the question asks about MOST ACCURATE, the litigation privilege in common law jurisdictions.

The correct answer is A: The primary purpose of the litigation privilege is to protect confidential communications between a client and the client ' s legal representative.

This question relates to the legal system framework. Understanding the distinction between different legal systems and processes is crucial for fraud examiners. The correct answer accurately describes the relationship between different legal entities and their jurisdictions.

Jabbar is most likely engaging in e-discovery. Electronic discovery involves identifying, collecting, processing, reviewing, and producing electronically stored information for use in legal proceedings. The question states that Jabbar is part of a legal team, is gathering and reviewing documents found on a suspect’s laptop, and is sorting through electronic documents to locate key information for court. That description fits e-discovery more directly than digital forensics. Digital forensics focuses on preserving, imaging, extracting, and analyzing digital evidence using forensic methods. Data analysis involves examining datasets for patterns, anomalies, and trends. An evidence chronology organizes events in time order. Because the task centers on reviewing electronic documents for litigation use, option B is the best answer.

The existence of a collective bargaining agreement is most likely to affect an employee’s rights during an internal investigation. The Fraud Examiners Manual explains that employee rights during investigations can vary by jurisdiction, employment contract, collective labor laws, labor-rights protections, company policies, and other applicable legal rules. A collective bargaining agreement may contain restrictions on interview procedures, representation rights, disciplinary processes, notice requirements, or the employer’s ability to compel cooperation. The likelihood that a case will go to trial, the amount of evidence available, and the employee’s length of service might influence investigation strategy, but they do not usually define the employee’s legal rights in the same direct way. Therefore, option B is the best answer.

The employee could raise an entrapment defense. Entrapment occurs when law enforcement officers or government agents induce a person to commit a crime that the person was not previously predisposed to commit. The facts state that Mari, a law enforcement officer, posed as a salesperson, offered a kickback, and eventually persuaded the employee to accept after an initial rejection. Those facts support an argument that the criminal act was induced by government conduct. Collusion involves agreement among parties to commit wrongdoing, but it is not the defense described here. Coercion involves compulsion or threats, which are not stated. Fraudulent misrepresentation concerns false material statements, not inducement by law enforcement. Therefore, option C is correct.

According to the 2014 International Fraud Examiners Manual:

“The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional. The fraud examination process encompasses a variety of tasks that might include:

• Obtaining evidence

• Reporting

• Testifying

• Assisting in fraud detection and prevention”.

Similarly, in the CFE Prep - Investigations study guide:

“Fraud examination is best described as… a methodology for resolving fraud allegations from inception to disposition. The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional”.

This clearly verifies that fraud examination is the correct term for the process of resolving fraud allegations from beginning (inception) to end (disposition).

Therefore, the correct answer is D. Fraud examination.

Data quality is important on both the inbound and outbound sides of any data transfer. Fraud examiners must ensure that the data received are complete, readable, accurate, and appropriate for the requested period and fields. They should also consider control totals, missing records, formatting issues, and whether the transfer process affected integrity. Option A is incorrect because many jurisdictions have data privacy laws governing collection, storage, disclosure, and transfer of personal data. Option B is wrong because interoperability matters even when a data sharing agreement exists; the receiving party must be able to read and use the data. Option C is not a necessary feature of every data sharing agreement. The best statement is that data quality must be ensured throughout the transfer.

A best practice when collecting and organizing documents is to establish a document database early in the investigation. A document database helps the examiner track what was collected, where it came from, who provided it, when it was obtained, and how it relates to issues in the case. It also supports indexing, retrieval, review, and later report preparation. Option A is poor practice because originals and working copies should be controlled carefully and not mixed in a way that risks alteration or loss. Option B may be useful for some documents, but chronological order alone is not sufficient. Option D is inefficient and not the best general practice. Therefore, establishing a document database early is the strongest answer.

The correct answer is B. The CFE Manual explains that although legal professional privilege generally applies to confidential communications between a lawyer and the client, in most jurisdictions the protection extends to communications with third-party consultants hired to help provide legal advice, including fraud examiners, accountants, bankers, and other experts. Therefore, when an attorney shares privileged material with a fraud examiner who has been retained to assist in the case, that disclosure does not automatically waive the privilege.

Option A is incomplete and therefore not the most accurate. While the client does hold the privilege, the Manual also states that the privilege can be waived by the client’s attorney or a third party in some circumstances. Option C is incorrect because not every disclosure to a third party causes waiver; disclosure to a consultant working within the legal team may remain protected. Option D is also incorrect because the use of email itself does not create waiver. The more important question is whether the communication remained within the privileged relationship and was shared only with those assisting counsel. Since the fraud examiner was hired to work on the case, B is the most accurate answer.