The correct answer is C. An unusually close or overly friendly relationship between an employee and a third-party contractor can be a red flag of corruption. Such relationships may indicate favoritism, undisclosed conflicts of interest, kickbacks, bid manipulation, or preferential treatment in procurement decisions. The behavior is not proof of wrongdoing, but it warrants further review when combined with unusual awards, pricing, sole-source justifications, weak documentation, or repeated business with the same vendor. Option A reflects proper restraint, not suspicious conduct. Option B suggests the employee is not benefiting from bribery-prone markets. Option D is generally positive because disclosure of conflicts allows the organization to evaluate and manage ethical risks. Red flags must be assessed in context with documents, transactions, and relationships.

================

Detailed Explanation:

Rationale for Correct Answer: Simply holding two jobs without disclosure is not inherently a conflict of interest unless the roles compete, overlap, or present divided loyalties. The other options all describe undisclosed financial or relational interests that conflict with the employer’s best interest.

Analysis of Incorrect Options:

A. Harriet’s stock ownership – Direct financial conflict.

C. Jennifer’s board positions – Competing loyalties between competitors.

D. Ernest hiring his brother – Nepotism without disclosure is a conflict.

Key Concept: Conflict of interest schemes in corruption.

Detailed Explanation:

Rationale for Correct Answer: One form of bid-rigging occurs when colluding vendors agree that one will submit a low bid and later withdraw it , allowing another conspirator to win the contract. This practice is sometimes referred to as “ complementary bidding ” or the withdrawal of low bids .

Analysis of Incorrect Options:

A. Bribery receipt – Refers to corrupt payments, not collusion.

B. Bid solicitation – The process of inviting bids, not collusion.

D. Contract acceptance – A legitimate procurement step, not fraud.

Key Concept: Bid-rigging through collusion — vendors withdrawing low bids to favor co-conspirators.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters typically change the contact information (e.g., phone number, email) to prevent the true account holder from receiving alerts about suspicious activity. Leaving the contact information unchanged would risk detection. Thus, option B is NOT a common fraudster tactic.

Analysis of Incorrect Options:

A – True; fraudsters steal funds or make purchases.

C – True; known as “credential stuffing” or account chaining.

D – True; phishing is a primary way to obtain credentials.

Key Concept: Cyber-enabled fraud – account takeover schemes.

Detailed Explanation:

Rationale for Correct Answer: When cash is stolen, the accounting equation (Assets = Liabilities + Equity) must still balance. Fraudsters may increase a liability (e.g., record fictitious payables) to cover the missing cash. This is a common concealment method.

Analysis of Incorrect Options:

A. Increasing another asset – Would require inflating assets, but this usually affects financial statement fraud, not cash theft concealment.

B. Increasing owners’ equity – Not logical without legitimate earnings or capital contributions.

D. Creating fictitious revenue – Used in financial statement fraud, not in balancing theft concealment.

Key Concept: Concealment methods for asset misappropriation — offsetting missing cash with fictitious liabilities .

Detailed Explanation:

Rationale for Correct Answer: Social engineering involves manipulating or deceiving people into revealing confidential information or taking actions that aid the attacker (e.g., clicking malicious links, sharing credentials). It targets human weaknesses rather than technical vulnerabilities.

Analysis of Incorrect Options:

A. IP spoofing – Forging an IP address to disguise origin.

B. Electronic piggybacking – Unauthorized use of someone else’s access connection.

C. Packet sniffing – Monitoring data traffic across a network.

Key Concept: Cyberfraud techniques – social engineering.

The ACFE Fraud Examiners Manual addresses Nonconforming Goods or Services under Contract and Procurement Fraud . The Manual states that, to detect nonconforming schemes, the fraud examiner should examine contract specifications, contractor statements, invoices, supporting documents, the received product, and test and inspection results for discrepancies with contract specifications. It then specifically adds:

“Additionally, to detect nonconforming schemes, the fraud examiner should:

• Review correspondence and contract files for indications of noncompliance.

• Request assistance from outside technical personnel to conduct after-the-fact tests.”

This language matches Option B exactly, so it is the most appropriate detection technique.

Why the other options are incorrect

A. Interviewing complaining contractors and unsuccessful bidders about the presence of red flags

This is a detection technique the Manual associates with change order abuse , not nonconforming goods or services schemes.

C. Comparing the direct and indirect labor account totals from the prior year to the current year

This type of comparative cost analysis is more consistent with testing for cost mischarging or other accounting irregularities, not the primary detection methods for nonconforming goods/services. The Manual’s nonconforming-scheme detection guidance focuses on specifications, inspection results, product testing, and contract/correspondence review.

D. Determining if the costs of the contract have exceeded or are expected to exceed the value of the contract

That is not identified by the Manual as the most appropriate method for detecting nonconforming goods or services. Again, the Manual directs the examiner to look for noncompliance with specifications and supporting documentation.

References

ACFE Fraud Examiners Manual, 2020 International Edition

Contract and Procurement Fraud — Nonconforming Goods or Services

Detecting Nonconforming Goods or Services Schemes

Related contrast: Detecting Change Order Abuse

The correct answer is D. Front businesses are attractive for money laundering because they allow illegal proceeds to be mixed with legitimate revenue, especially where cash sales are common and expenses are variable. Bars, restaurants, nightclubs, and similar businesses can make it difficult to reconcile actual customer activity with reported revenue and operating costs. This makes it easier to overstate revenues, inflate expenses, or insert illicit funds into the business records. Option A is inaccurate because money launderers might pay taxes on falsely reported income to make the funds appear legitimate. Option B is incorrect because a front may show high income despite low visible customer activity. Option C is too narrow and inaccurate because these businesses often involve variable purchases and pricing.

================

The correct answer is D. Procurement fraud prevention requires ongoing vendor monitoring based on the organization’s highest-risk vendor schemes. Monitoring should focus on practical red flags, such as unusual pricing, duplicate vendors, related-party indicators, excessive change orders, suspicious payment patterns, or vendors lacking proper support. Option A violates segregation of duties because the person maintaining the vendor master file should not also approve invoice payments. Option B is weak because vendor background checks should occur before vendors are added to the master file, not after. Option C is incorrect because procurement monitoring should be ongoing and risk-based, not restricted to annual reviews. The ACFE material emphasizes vendor management, vendor master file controls, and monitoring based on relevant red flags.

================

Detailed Explanation:

Rationale for Correct Answer: Finding personal checks in the cash register is unusual, but it does not specifically indicate a register disbursement scheme (such as false refunds or voids). The other options are classic red flags for such schemes.

Analysis of Incorrect Options:

A – Missing transaction numbers suggest manipulation.

C – Excessive voids near approval limits indicate fraud concealment.

D – Allowing cashiers to void their own sales creates opportunity for abuse.

Key Concept: Register disbursement schemes and their red flags.