A junior examiner got a whistleblower tip about a VP's lavish spending. He pulled the VP's expense reports and corporate card statements, finding nothing that violated policy. He closed the case. Six months later, the company wrote off $1.2 million after discovering the VP was approving fraudulent invoices from a shell company he owned. The examiner's mistake wasn't in his analysis; it was in his starting point. He investigated the person instead of the scheme, a fatal flaw the CFE exam punishes without mercy.
The CFE Investigation section (CFE-INV) tests your ability to apply investigative methodology. It covers gathering evidence, interviewing, and reporting. Success depends on applying the Fraud Theory Approach and understanding the correct sequence of actions, from establishing predication to proving the legal elements of fraud.
Key facts
- Section name: Investigation (CFE-INV)
- Official blueprint weighting: 20-25% of the total CFE exam score
- Question format: Adaptive exam with up to 125 multiple-choice questions per section
- Time allotted: Approximately 2 hours and 30 minutes (part of the 10-hour total exam time)
- Core source material: ACFE Fraud Examiners Manual (2026 edition)
- Official body: Association of Certified Fraud Examiners (ACFE)
According to the ACFE's 2024 Report to the Nations, tips are the most common way frauds are detected, accounting for 43% of cases (ACFE). This fact directly influences the CFE-INV section, which heavily tests your ability to properly handle and substantiate initial allegations.
What Is the CFE Investigation Section?
The CFE Investigation section is the practical core of the exam, evaluating your ability to execute a fraud examination from the initial tip to the final report. This section moves beyond the "what" of fraud schemes (covered in Section 1) and into the "how"—how you legally and effectively gather the facts. It tests your proficiency in interviewing, collecting documents, analyzing transactions, and working with digital evidence.
Studying for CFE CFE-INV? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Success here isn't about memorizing a list of techniques. It's about applying the right technique at the right time. Exam questions are often scenario-based, asking you to make a judgment call: given these facts, what is your next logical step? Choosing an action that is premature, like confronting a suspect without enough evidence, or out of sequence is the most common way to get a question wrong.
CFE-INV Blueprint Breakdown (2026)
The ACFE breaks this section down into five key domains. While they provide weighting ranges, you should prepare for all topics as the exam can pull heavily from any of them. Our adaptive learning engine at VoraPrep analyzes your performance on thousands of practice questions to pinpoint and strengthen your weak spots in these specific domains.
| Blueprint Domain | Key Topics Tested | Why It Matters |
|---|---|---|
| A. Planning & Conducting a Fraud Examination | Fraud theory approach, predication, evidence gathering, case management. | This is the foundation. Failing to establish predication makes all other actions legally and professionally unsound. |
| B. Interviewing Witnesses | Question types (introductory, informational, assessment), verbal and nonverbal cues, signed statements. | Getting information from people is an art. The exam tests the science behind it, like the proper sequence of questions. |
| C. Obtaining & Evaluating Evidence | Chain of custody, documentary evidence, data analytics, public records, digital forensics. | Evidence is the backbone of any case. You must know how to collect it, preserve its integrity, and evaluate its strength. |
| D. Tracing Illicit Transactions | Net worth method, bank deposit analysis, asset misappropriation tracing. | Following the money is critical. The exam will test your understanding of the methods used to uncover hidden assets. |
| E. Report Writing | Structure of a formal fraud report, legal considerations, communicating findings. | A brilliant investigation is useless if you can't communicate the results clearly and objectively in a written report. |
The Core Skill: Thinking Through the Fraud Theory Approach
To pass the CFE-INV section, you must stop thinking like an accountant and start thinking like an investigator. An accountant looks at a set of transactions and asks, "Are these balanced and compliant?" An investigator asks, "What is the worst-case scenario that could explain these facts?"
This is the Fraud Theory Approach. It is a decision-tree you must apply under exam pressure.
Step 1: Analyze the Available Data
Your starting point is the initial information you have—a tip, an anomaly from a data analytics test, or a manager's concern.- Condition: You receive a credible allegation that a procurement manager, Jane, is taking kickbacks.
- Action: Collect preliminary, non-invasive data. Review her vendor files, procurement contracts, and the company's vendor onboarding policy. Do not pull her emails or bank records yet.
Step 2: Create a Hypothesis
Based on the data, form a "what if" theory. The hypothesis should be specific and testable.- Condition: You find Jane approved five contracts with a new vendor, "Apex Solutions," who was incorporated just three days before the first contract was signed.
- Action (Hypothesis): "What if Jane owns or is related to the owner of Apex Solutions and is using it to overcharge the company?"
Step 3: Test the Hypothesis
This is where you move into active evidence gathering. Your goal is to prove or disprove the theory.- Condition: Your hypothesis is ready.
- Action: Now you have predication—a reasonable basis to suspect wrongdoing. You can now take more intrusive steps. Conduct public records searches on Apex Solutions to find its owner. Use data analytics to compare Apex's pricing to other vendors.
Step 4: Refine and Conclude
As you gather evidence, you will either confirm your hypothesis or be forced to change it.- Condition: Public records show Apex Solutions is owned by Jane's brother-in-law. Pricing analysis shows Apex charges 40% more than competitors for similar goods.
- Action: The hypothesis is largely confirmed. You now have sufficient evidence to move to the next stage, which may involve interviewing Jane and other witnesses.
Exam scenarios frequently test this sequence. A common wrong answer involves jumping from Step 1 straight to a confrontational interview—a move that a seasoned CFE would never make.
Connecting Your Investigation to the Legal Elements of Fraud
Every action you take in an investigation serves one purpose: to gather evidence that satisfies the legal elements of fraud. Knowing these elements is not just for the Law section; it provides the roadmap for your entire investigation. It tells you what you need to prove.
> ⚠️ Exam trap: > A question might give you proof of a loss and a false statement, then ask if you have proven fraud. The answer is no. You must have evidence for all the elements. The exam tests your ability to recognize which pieces of the puzzle are still missing.
Here are the core elements you are working to prove:
- A material false statement: A lie about something important.
- Knowledge that the statement was false: The person knew they were lying (intent).
- Reliance on the false statement by the victim: The company believed the lie and acted on it.
- Damages resulting from that reliance: The company lost money or property because it acted on the lie.
When you create your hypothesis using the Fraud Theory Approach, you are really hypothesizing how a subject committed all four of these elements. Every piece of evidence you collect should be mapped back to one of them.
Worked Example: Tracing a Concealed Payment
Let's apply this thinking to a common exam scenario. You are investigating Sarah, a controller suspected of embezzling funds. You have her financial records for 2025. Your goal is to determine if her lifestyle is supported by her known income.
Free 10-Question Diagnostic Assessment
Pinpoint your exact knowledge gaps in 10 minutes and receive a personalized 12-week study roadmap PDF with zero obligation.
> 💡 Worked example: > You are using the Net Worth Method to analyze Sarah's finances. Here's the data you've collected: > > * Assets at Start of Year (Jan 1, 2025): $250,000 > * Assets at End of Year (Dec 31, 2025): $450,000 > * Liabilities at Start of Year: $100,000 > * Liabilities at End of Year: $80,000 > * Known Legitimate Income during 2025: $120,000 (salary) > * Known Expenditures during 2025: $90,000 (living expenses, mortgage, etc.) > > ### Step 1: Calculate Net Worth at the Start and End of the Period > * Beginning Net Worth = Assets ($250k) - Liabilities ($100k) = $150,000 > * Ending Net Worth = Assets ($450k) - Liabilities ($80k) = $370,000 > > ### Step 2: Calculate the Increase in Net Worth > * Increase = Ending Net Worth ($370k) - Beginning Net Worth ($150k) = $220,000 > > ### Step 3: Calculate Funds from Unknown Sources > * Add the Increase in Net Worth ($220k) to the Known Expenditures ($90k). This tells you the total amount of funds she had to have available during the year. Total funds needed = $310,000. > * Subtract her Known Legitimate Income ($120k) from the total funds needed ($310k). > * Funds from Unknown Sources = $310,000 - $120,000 = $190,000 > > ### Step 4: Form a Conclusion and Define the Next Investigative Step > Sarah has $190,000 in income that cannot be explained by her salary. This figure is your target. Your next investigative step is to find the source of that $190,000, likely by subpoenaing her personal bank records to trace the specific deposits.
The Most-Tested Trap: Confusing Interviewing Techniques
Candidates consistently lose points by failing to distinguish between the different types of interviews and their specific purposes. An informational interview with a witness uses open-ended questions to gather facts. An admission-seeking interview with a suspect is designed to secure a confession. Using the wrong technique at the wrong time can destroy your case.
The Trap: You have strong evidence a suspect committed fraud. The question asks for your initial approach in an interview with them. The tempting wrong answer is an accusatory question like, "Why did you create a fake vendor to steal from the company?" Why it's wrong: A skilled investigator never starts with an accusation. You first build rapport and establish a baseline of behavior. You ask non-threatening, open-ended questions to get the person talking. You only introduce incriminating evidence and seek an admission after you have locked them into their story. Starting with an accusation allows them to immediately deny everything and shut down the conversation.Here is a simple way to keep them straight:
| Technique | Informational Interview | Admission-Seeking Interview |
|---|---|---|
| Goal | Gather facts and information. | Obtain a legally valid confession. |
| Subject | Neutral third-party witnesses. | The primary suspect. |
| Location | Neutral, comfortable setting. | Private, controlled environment. |
| Tone | Conversational and non-confrontational. | Controlled and assertive. |
| Question Type | Open-ended ("Tell me about...") | Accusatory and direct ("You used the money for...") |
Knowing which tool to use for the job is a judgment call, and it's exactly what the CFE-INV exam is designed to measure. With VoraPrep's adaptive question bank, you can drill these scenario-based questions until the correct sequence becomes second nature. Try VoraPrep's free CFE practice questions to see the difference.
How to Study for CFE-INV: A 4-Week Plan
Don't just read the Fraud Examiners Manual. You need to actively practice applying its concepts. This section requires about 20-30 hours of focused study.
Week 1: Foundations (5-7 hours)
Read the manual sections on Predication and the Fraud Theory Approach. Your only goal is to understand the sequence of a proper investigation. Do 50-100 practice questions focused only on this domain.Week 2: Evidence & Interviews (7-10 hours)
Focus on the chapters covering evidence handling, chain of custody, and interviewing. Create flashcards for the different types of evidence and the phases of an interview. Spend significant time on practice questions that ask you to choose the "best" next question to ask a witness.Week 3: Tracing & Reporting (7-10 hours)
Dive into the financial analysis techniques like the Net Worth Method. Work through examples until you can do the calculations quickly. Review the components of a formal fraud report. Your Vory tutor is available 24/7 to walk you through complex calculations if you get stuck.Week 4: Final Review & Simulation (5 hours)
Take a full, 125-question simulated CFE-INV exam. VoraPrep's platform provides an authentic 1:1 exam simulation. Analyze your results, paying close attention to the explanations for the questions you got wrong. Spend your final hours reviewing only your weakest areas.For a complete breakdown of all four sections, review the complete CFE exam structure and blueprint.