The 2014 International Fraud Examiners Manual and CFE Prep - Investigations explicitly state:

“Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. … when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.”

Thus, the correct answer is C.

The organizational filings with the government of the jurisdiction in which the company is incorporated

Organizational filings (e.g., articles of incorporation) are generally public records and include ownership information, initial shareholders, and the location of the principal office.

This question tests your knowledge of Domain 1.

In the context of Overview of the Legal System, specifically relating to civil, the question asks about BEST.

The correct answer is C: Injunction.

This question relates to the legal system framework. Understanding the distinction between different legal systems and processes is crucial for fraud examiners. The correct answer accurately describes the relationship between different legal entities and their jurisdictions.

Fraud examiners should generally avoid allowing unnecessary observers in interviews. Additional observers can affect the interviewee’s responses, create confidentiality concerns, increase the chance of later disputes, and potentially expose the organization or examiner to legal claims. The Fraud Examiners Manual emphasizes that interviews should be controlled and that the interviewer should avoid unnecessary third-party participation unless the law, a collective bargaining agreement, language needs, or similar requirements make an observer necessary. The HR manager’s desire to observe is not, by itself, a sufficient reason to permit attendance. Option D is still risky because silent presence can influence the interview. Option A is based on comfort rather than investigative control. Therefore, if the law permits, Ana should not allow the HR manager to witness the interview.

According to the Fraud Examiners Manual:

“Credit card records are important in tracing assets… information on credit card charges might provide leads to identifying hidden assets. For example, if a fraud examiner notices that the subject used his credit card to purchase items at a marina, the fraud examiner should investigate further to determine if the subject owns a boat”.

Therefore, A is correct.

The correct answer is B. To prove a conspiracy claim, the government generally must show that the defendant knew the unlawful purpose of the conspiracy and intentionally joined it. A conspiracy does not require proof that the defendant personally completed the intended crime. The offense is based on the unlawful agreement and the defendant’s knowing participation in that agreement.

Option A is incorrect because a conspirator does not need to know every detail, objective, or step in the overall scheme. Many conspiracies involve participants with limited knowledge of the full operation, yet they can still be criminally liable if they knowingly join the unlawful plan. Option C is also incorrect because a defendant does not need to know the identity of every other participant. Conspiracy law focuses on intentional participation in the common unlawful purpose, not complete familiarity with all members. Option D is incorrect because the government usually does not need to prove that the defendant actually accomplished the conspiracy’s goal. Joining the conspiracy with the required criminal intent is enough. In fraud-related prosecutions, conspiracy is especially important because it allows liability to attach to coordinated misconduct even when one participant did not personally perform every act in the scheme. Therefore, B is the most accurate statement.

This question tests your knowledge of Domain 4.

In the context of Securities Fraud, specifically relating to securities, the question asks about the core concepts in this area.

The correct answer is A: True.

This question tests knowledge of securities fraud and regulation. The correct answer accurately describes the role of regulatory bodies, securities laws, or fraud schemes in this context. Securities fraud is a specialized area requiring knowledge of specific regulations and oversight mechanisms.

This question tests your knowledge of Domain 1.

In the context of Overview of the Legal System, specifically relating to criminal, adversarial, the question asks about TRUE, criminal proceedings and discovery in adversarial jurisdictions.

The correct answer is D: The judge is the primary driver of the discovery process in criminal proceedings..

This question relates to the legal system framework. Understanding the distinction between different legal systems and processes is crucial for fraud examiners. The correct answer accurately describes the relationship between different legal entities and their jurisdictions. In adversarial systems, opposing parties present their cases before a neutral judge or jury, while in inquisitorial systems, judges take a more active role in investigating cases.

This question tests your knowledge of Domain 6.

In the context of Tax Fraud, specifically relating to tax avoidance, the question asks about the core concepts in this area.

The correct answer is B: False.

This question focuses on tax fraud concepts. The correct answer distinguishes between legal tax avoidance and illegal tax evasion, or identifies specific tax evasion schemes. Tax fraud investigations require specialized knowledge of tax laws and common evasion techniques.

 “As a general rule, questioning should proceed from the general to the specific; it is best to seek general information before details. A variation… is to begin with known information and work towards unknown areas”【9:2014 International Fraud Examiners Manual.pdf†L39-L51】.

 Random order is not recommended and breaks the logical flow.

Before disposing of evidence, a fraud examiner should consider the organization’s document retention policy and any legal duty to preserve evidence. A proper document retention policy identifies what records should be retained, how long they should be retained, and when destruction is permitted. However, destruction must stop when litigation, investigation, or legal document requests are reasonably anticipated or pending. The type of fraud, such as corruption or asset misappropriation, does not by itself determine whether evidence can be destroyed. Whether the evidence is digital or tangible affects preservation method, not the basic retention decision. Whether evidence would support a conviction is also not the examiner’s disposal standard. Evidence handling must follow retention rules, legal obligations, and counsel’s guidance.

The Fraud Examiners Manual notes that when witnesses become hostile or argumentative, the interviewer should generally remain calm and avoid reacting to hostility. Reacting, reasoning, or arguing often escalates the situation. Instead, the interviewer should maintain control and neutrality .

This question tests your knowledge of Domain 1.

In the context of Overview of the Legal System, specifically relating to criminal, the question asks about the core concepts in this area.

The correct answer is B: False.

This question relates to the legal system framework. Understanding the distinction between different legal systems and processes is crucial for fraud examiners. The correct answer accurately describes the relationship between different legal entities and their jurisdictions.

“Records obtained from financial institutions are perhaps the single most important financial source available to a fraud examiner for tracing purposes. They can be used as evidence for fraud, uncover criminal profits, identify criminal assets, and locate assets”.

The Fraud Examiners Manual advises avoiding prematurely alerting perpetrators. Recommended methods include:

“Conducting investigations at times when the suspect is not present (such as nonbusiness hours)”.

This avoids tipping off suspects.