The correct answer is B. Cash register disbursement schemes commonly involve false voids, false refunds, or unauthorized register activity. Secure access codes help establish individual accountability and prevent one employee from processing fraudulent transactions under another employee’s credentials. Training employees not to share access codes strengthens this control. Option A is weak because announced cash counts reduce deterrence; surprise counts are more effective. Option C does not provide meaningful control because another non-supervising employee might not detect or challenge improper activity. Option D is inappropriate because employees should not independently reconcile their own register activity; independent review is necessary. The professional control principle is to restrict access, preserve accountability, and require supervisory or independent review of register disbursements.

================

The correct answer is D. Self-regulatory organizations are industry-based bodies that perform certain oversight functions under the supervision of securities regulators in some jurisdictions. Their duties can include monitoring member firms, examining trading operations, enforcing industry rules, and supporting market integrity. Option A is inaccurate because SROs are not simply governmental entities, although they may operate under statutory recognition or regulatory oversight. Option B is too absolute because SROs may participate in dispute resolution or arbitration in some jurisdictions. Option C is also overstated because SRO authority generally focuses on members and regulated market participants, not securities-related allegations within all private companies. The ACFE materials recognize self-regulation as part of the securities regulatory framework, subject to oversight and standards of fairness and confidentiality.

Comprehensive and Detailed Explanation

Why the correct answer is: False accounting entry

According to the ACFE Fraud Examiners Manual – Financial Transactions and Fraud Schemes , under Financial Institution Fraud → Types of Embezzlement Schemes , the Manual provides explicit descriptions of relevant banking fraud schemes, including false accounting entries .

The Manual lists False Accounting Entries as a form of embezzlement in which an employee manipulates general ledger accounts or other accounting records to conceal a theft or unauthorized activity :

“False Accounting Entries” are specifically categorized as a type of embezzlement scheme used by dishonest bank employees to hide misappropriated funds.

In this question, the accountant:

Adjusted the bank’s general ledger

With the intent to conceal the theft of customer funds

This aligns exactly with the ACFE definition of false accounting entries , which involve altering legitimate financial records to hide fraudulent actions.

Therefore, the best ACFE-defined description of the scheme is:

→ False accounting entry (Option B)

Why the other options are incorrect

A. Unauthorized withdrawal

The Manual separately defines Unauthorized Withdrawals as a type of embezzlement in which a bank employee directly removes funds from accounts without permission:

“Unauthorized Withdrawals” are listed as a distinct embezzlement scheme involving unapproved removal of customer funds.

However, in this scenario, the defining act is manipulating ledger records , not simply withdrawing funds. The nature of the concealment technique makes false accounting entry the correct classification.

C. Moving money from inactive accounts

The Manual defines:

“Moving Money from Customers’ Dormant or Inactive Accounts” as a scheme in which employees transfer funds from inactive accounts to themselves.

In this question, the stolen funds come from an active customer account , so this option does not apply.

D. Unauthorized disbursement of funds

The Manual includes:

“Unauthorized Disbursement of Funds to Outsiders” as another type of financial institution fraud.

This refers to payments made to external parties without authorization—not to ledger manipulation to hide theft.

Again, the defining characteristic in the scenario is the use of false ledger entries , which makes Option B the most accurate according to ACFE terminology.

Detailed Explanation:

Rationale for Correct Answer: New account fraud occurs when fraudsters open accounts with false or stolen identities to exploit financial institutions before controls detect suspicious activity. Mobile deposits are particularly vulnerable because criminals can use counterfeit or altered images to deposit fraudulent checks quickly. This aligns with the Fraud Examiners Manual (2020) discussion of high-risk delivery channels for new account fraud.

Analysis of Incorrect Options:

A. Established accounts – Incorrect; fraud risk is higher in new accounts due to limited history and weaker controls.

C. Six months definition – Not an ACFE standard; there is no fixed six-month definition.

D. ATMs rarely targeted – Incorrect; ATMs are frequently exploited in new account fraud schemes.

Key Concept: New account fraud in identity theft and corruption-related schemes.

Detailed Explanation:

Rationale for Correct Answer: The term Employee deviance refers to conduct that is harmful both to the organization and to the employee engaging in it. This encompasses a broad set of behaviors, including fraud, theft, abuse, and violations of organizational norms. While employee theft and fraud are subsets, deviance is the umbrella concept.

Analysis of Incorrect Options:

B. Employee theft – Specific to stealing from the employer, not the broader definition of detrimental conduct.

C. Employee fraud – Specific to deceptive practices, not all deviant acts.

D. All of the above – Incorrect, since the definition most accurately matches “Employee deviance.”

Key Concept: Employee Deviance — broader behavioral category that includes fraud, theft, and other misconduct.

Detailed Explanation:

Rationale for Correct Answer: Skimming involves theft of cash before it is recorded in the books. Examining journal entries for false credits to inventory would detect inventory fraud, not skimming. Therefore, B is not useful for detecting skimming.

Analysis of Incorrect Options:

A – Confirming customer balances can reveal payments that were never posted because they were skimmed.

C – Physical counts may expose discrepancies caused by skimming disguised as inventory shortages.

D – Comparing register totals to actual cash can reveal missing amounts due to skimming.

Key Concept: Skimming detection focuses on reconciling recorded vs. unrecorded cash.

Detailed Explanation:

Rationale for Correct Answer: The balance sheet summarizes account balances from the ledger at a specific date, presenting assets, liabilities, and equity. It reflects the organization’s financial position and is derived from ledger balances.

Analysis of Incorrect Options:

B. Income statement – Summarizes revenues and expenses, not all ledger balances.

C. Financial statement – A general term, but the specific answer here is balance sheet.

D. General journal – Book of original entry, not a summary.

Key Concept: Balance sheet as a summary of ledger accounts.

The correct answer is D. Users being denied access to files they normally use is a significant indicator of possible network intrusion. Such denial might result from unauthorized permission changes, malware, ransomware encryption, account compromise, or malicious alteration of access controls. In a professional fraud examination context, this condition should trigger immediate incident-response procedures, including review of system logs, firewall records, router logs, and affected files. Options A and C describe routine security and system maintenance activities. Option B is not inherently suspicious because the country has a legitimate client connection. The ACFE computer and internet fraud materials emphasize that compromised systems should be treated as suspect and reviewed for irregularities and abnormal activity.

================

Detailed Explanation:

Rationale for Correct Answer: Recognized schemes for stealing inventory include:

Larceny schemes (direct theft)

Asset requisition and transfer schemes (false requisitions to divert assets)

Purchasing and receiving schemes (over-ordering or falsifying deliveries).

“ Sales & Equipment handling ” is not a defined fraud scheme, making D correct.

Analysis of Incorrect Options:

A. Larceny schemes – Valid theft method.

B. Asset requisition and transfer – Document manipulation method.

C. Purchasing and receiving schemes – Valid misappropriation scheme.

Key Concept: Inventory theft schemes under the Fraud Tree.

Detailed Explanation:

Rationale for Correct Answer: Skimming is the theft of incoming cash before it is recorded in the books . Since the payment is never recorded, no audit trail exists, making it an “off-book” scheme.

Analysis of Incorrect Options:

A – Incorrect; skimming can involve both sales and receivable payments.

C – Incorrect; skimming is off-book , not on-book.

D – Incorrect; skimming is typically harder to detect than larceny, since there is no record.

Key Concept: Skimming vs. larceny – off-book theft of cash receipts.