CFE Exam · 10 min read 2026 Blueprint Verified

CFE Section 2: Fraud Investigations and Legal Issues (Planning, Interviewing, Evidence, Legal Systems, Expert Testimony) Cheat Sheet (2026): Key Formulas, Rules, and Mnemonics

Rob Pfleghardt

10-year Price Waterhouse alumnus · Founder of VoraPrep · Former CPA (1987–2024) · with the VoraPrep Editorial Team

CFE Section 2: Fraud Investigations and Legal Issues (Planning, Interviewing, Evidence, Legal Systems, Expert Testimony) Cheat Sheet (2026): Key Formulas, Rules, and Mnemonics
⚡ 2026 CFE Rapid-Review Toolkit

Save this Cheat Sheet as a PDF or test your weak spots on these formulas in 5 minutes

Benchmark your CFE readiness with our free 10-question diagnostic or unlock all flashcards & 1:1 exam simulations free for 14 days.

Key Takeaways

  • Treat Law and Investigation as separate but related subjects; Law is the "rulebook," and Investigation is the "gameplay."
  • The PEACE model for interviewing is a core framework for the Investigation section, emphasizing rapport and planning over confrontation.
  • For the Law section, you must know the difference between the "beyond a reasonable doubt" and "preponderance of the evidence" standards.
  • A broken chain of custody makes evidence inadmissible, a concept tested in both sections but governed by the rules in the Law section.
  • The Hearsay Rule and its exceptions are a common trap in the Law section; not every out-of-court statement is automatically excluded.
  • Mastering the application of these concepts through scenario-based practice is far more effective than rote memorization of definitions.

Most candidates fail because they study the CFE Law and Investigation sections as one blurry topic. They are two distinct exams, and confusing their boundaries is the fastest way to lose points on both.

Quick answer

The CFE exam's Law section tests legal frameworks, rules of evidence, and courtroom procedures, while the Investigation section tests the practical application of gathering information through interviews, surveillance, and evidence collection. Success requires knowing which rules apply to which stage of the process.

Key facts

Official Body
The Association of Certified Fraud Examiners (ACFE)
Exam Sections
4 (Financial Transactions & Fraud Schemes, Law, Investigation, Fraud Prevention & Deterrence)
Pass Rate
Approximately 65-70% across all sections (ACFE)
Recommended Study Hours
80-120 hours total for all four sections
Salary Range (CFE Certified)
$85,000-$140,000 annually
Law Section Focus
Legal systems, rules of evidence, expert testimony, and specific white-collar crime statutes.
Investigation Section Focus
Interviewing, evidence collection procedures, report writing, and covert examinations.

Why Do Candidates Confuse the CFE Law and Investigation Sections?

Candidates often merge the CFE Law and Investigation sections in their minds because the topics are deeply intertwined in a real-world fraud examination. You can't conduct an investigation without understanding the legal rules, and the legal rules are meaningless without the context of an investigation.

The exam, however, splits them.

  • The Law Section (Section 2) is about the rules. It covers the legal system, constitutional rights, rules of evidence, specific statutes like mail and wire fraud, and the standards for expert testimony. Think of this as the legal theory.
  • The Investigation Section (Section 3) is about the process. It covers the practical steps of an investigation: planning, interviewing witnesses, collecting documents, performing surveillance, and writing the final report. This is the application.

A common mistake is memorizing an investigative technique (like the PEACE model) without understanding the legal constraints (like Fourth Amendment rights against unreasonable searches) that govern it. This guide will help you build a mental firewall between the two, so you can apply the right concept to the right question. Try VoraPrep's free CFE practice questions to see how these concepts are tested differently.

Free 5-Min Diagnostic

Studying for CFE? Benchmark your score in 5 minutes.

Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.

What Core Concepts Drive the Investigation Section?

The Investigation section tests your ability to plan and execute a fraud examination methodically and ethically. It's less about legal theory and more about procedural competence.

The PEACE Model: Your Interviewing Framework

The PEACE Model is a non-confrontational approach to investigative interviewing that prioritizes information gathering. The exam expects you to know each stage and its purpose.

Step 1: Planning and Preparation

This is where you define objectives, review documents, and outline your questions. You must understand your legal authority to conduct the interview and the context of the situation.

Step 2: Engage and Explain

You build rapport and explain the interview's purpose. This stage is critical for establishing a cooperative tone and ensuring the subject understands the process.

Step 3: Account

Here, you elicit the subject's story using primarily open-ended questions. Your goal is to get an uninterrupted narrative first, then probe for details. Avoid leading questions.

Step 4: Closure

Summarize the key points discussed to ensure understanding. Explain the next steps and end the interview professionally, preserving the rapport you built.

Step 5: Evaluation

After the interview, you assess the information obtained against other evidence and determine if your objectives were met. This informs the next steps of your investigation.

Worked example: Applying the PEACE Model You are interviewing a warehouse manager, David, about inventory shrinkage.
  1. Planning: You've reviewed inventory logs showing discrepancies that align with David's shifts. Your objective is to understand the inventory reconciliation process from his perspective.
  2. Engage: You meet David in a neutral office, explain you're reviewing inventory procedures to improve accuracy, and ask for his help.
  3. Account: You start broad: "Can you walk me through how you handle incoming and outgoing shipments?" You let him explain his full process before asking clarifying questions about the specific dates where discrepancies occurred.
  4. Closure: You summarize his description of the process and thank him for his time. You mention that you might have follow-up questions as you continue the review.
  5. Evaluation: You compare David's account to the documented procedures. He mentioned a "scrap pile" for damaged goods that isn't on the official logs, providing a new avenue for investigation.

Evidence Collection and Chain of Custody

While the rules of admissibility are in the Law section, the process of collecting and preserving evidence is a cornerstone of the Investigation section.

  • Chain of Custody: This is the chronological, documented record of who handled a piece of evidence from the moment of its collection to its presentation in court. Any gap in this chain can render the evidence useless.
  • Documentation: The exam will test your understanding of proper evidence handling. This includes marking evidence with the date, time, location, and collector's initials, and storing it in a secure location.
✨ Free Interactive Calculator

Calculate Your CFE Score & Study Hours by Domain

Adjust your practice scores across official CFE blueprint domains to predict your pass probability and generate a domain-weighted study schedule.

Open CFE Score Calculator →

The Law section requires you to think like a legal consultant to a fraud examination. You must understand the legal environment in which fraud cases are tried.

Criminal vs. Civil Legal Systems

This distinction is fundamental. Questions will often provide a scenario and expect you to know which standard of proof or potential outcome applies.

FeatureCriminal CasesCivil Cases
PurposeTo punish an offenderTo compensate a victim
PartiesGovernment vs. DefendantPlaintiff vs. Defendant
Burden of ProofBeyond a reasonable doubt (high bar)Preponderance of the evidence (low bar)
OutcomeJail, fines, probationMonetary damages, injunctions
RightsFull constitutional rights apply (5th Am.)Limited application of certain rights

Key Rules of Evidence

Evidence must be relevant, material, and competent to be admissible. Beyond that, you must know key exclusionary rules.

Exam trap: The Hearsay Rule Hearsay is an out-of-court statement offered to prove the truth of the matter asserted. It's generally inadmissible. The trap is forgetting the numerous exceptions. A question might describe a witness repeating what someone else told them. The tempting wrong answer is to always deem it inadmissible hearsay. The right answer often lies in an exception. For example, a statement made by a co-conspirator during and in furtherance of the conspiracy is not hearsay and is admissible. Another key exception is a business record created in the ordinary course of business. Know the major exceptions, not just the rule itself.

Expert Testimony Standards

As a CFE, you may be called as an expert witness. You need to know the rules that govern your testimony.

  • Federal Rule of Evidence 702: Outlines the qualifications for an expert witness and the requirements for their testimony to be admissible.
  • Daubert Standard: A rule of evidence from the case Daubert v. Merrell Dow Pharmaceuticals, Inc., which requires a trial judge to act as a "gatekeeper" to ensure that scientific expert testimony is based on reliable methodology.

Essential White-Collar Crime Statutes

You don't need to be a lawyer, but you must recognize the core federal statutes used to prosecute fraud.

  • Mail Fraud & Wire Fraud: Using mail or wire communications (internet, phone) to further a fraudulent scheme. These are prosecutors' workhorse statutes due to their broad application.
  • RICO Act: The Racketeer Influenced and Corrupt Organizations Act targets ongoing criminal enterprises.
  • Money Laundering: The process of making illegally-gained proceeds appear legal.

VoraPrep's complete 6-pillar course provides textbook-grade lessons that break down each of these legal concepts. Our interactive lessons use embedded active-recall checkpoints to ensure you retain this critical information, a method proven to be more effective than passively watching video lectures.

How Can I Prepare in a 7-Day Sprint?

Use this intensive schedule to focus your review on the highest-yield topics for both the Law and Investigation sections.

Day 1: Legal Foundations (Law)

Focus entirely on the distinctions between criminal and civil law. Drill the burdens of proof, potential outcomes, and parties involved. Use the comparison table as your guide.

Day 2: Rules of Evidence (Law)

Cover admissibility, chain of custody, and key exclusionary rules like Hearsay. Spend time on the major exceptions to the Hearsay Rule.

Day 3: Legal Procedures & Rights (Law)

Review expert testimony standards (Daubert, Rule 702) and key constitutional rights, particularly the Fourth (searches) and Fifth (self-incrimination) Amendments.

Day 4: Interviewing Mastery (Investigation)

Dedicate today to the PEACE model. Work through scenarios, identifying the correct stage and the appropriate type of question to ask. VoraPrep's adaptive practice banks can serve you questions specifically on interviewing until you master it.

Day 5: Evidence & Investigation Process (Investigation)

Focus on the practical side of evidence: collection, preservation, and documentation. Review covert examinations and report writing standards. Our CFE Law Section Guide: Rules of Evidence, Chain of Custody, Bankruptcy & Constitutional Rights is a great resource here.

Day 6: Integrated Practice

Take practice quizzes that mix questions from both Law and Investigation. This forces you to switch your thinking and correctly identify which "hat" to wear. Analyze the explanations for every question you get wrong. Ask Vory, your 24/7 personal tutor, to walk you through any concepts that are still unclear.

Day 7: Mock Exam & Final Review

Take a timed mock exam for both the Law and Investigation sections. Use VoraPrep's Calibrated Pass-Readiness Score Predictor to see where you stand. Spend the rest of the day reviewing your weakest areas based on that data.

⚡ Test Yourself: 1 Real CFE Question · Instant Reveal
CFE Section 1: Financial Transactions and Fraud Schemes

During a financial statement fraud investigation, a Certified Fraud Examiner discovers that the controller recorded fictitious credit sales on December 30 and reversed them in January. Which financial ratio will show the MOST immediate distortion comparing Year 1 to Year 0?

Frequently asked questions

What are the hardest parts of the CFE Law section?

Candidates often struggle with the specific rules of evidence, particularly the Hearsay Rule and its many exceptions. Distinguishing the nuances between different white-collar crime statutes can also be challenging.

How much of the Investigation section is about interviewing?

Interviewing techniques are a significant component. Mastering the PEACE model and understanding how to apply different questioning strategies in various scenarios is critical for passing this section.

Do I need to memorize case names like Daubert for the exam?

You don't need to memorize case citations, but you must know the legal principle or standard established by landmark cases like Daubert (gatekeeping role of the judge for expert testimony) and Miranda (rights during a custodial interrogation).
Ready to Pass Your CFE Exam? VoraPrep offers a complete 6-pillar interactive course featuring textbook-grade lessons, adaptive practice, 1:1 exam simulators, FSRS flashcards, a personalized study plan, and Vory, your 24/7 personal tutor. Stop studying with overpriced, passive video lectures and experience a modern, effective approach. Visit voraprep.com to get started. Start Your Free 14-Day Trial at voraprep.com →

Official resources and references

RP

About the Author: Rob Pfleghardt

Rob Pfleghardt is the founder of VoraPrep, a comprehensive exam prep platform across 30 professional licensure and certification exams in Accounting & Tax (CPA, EA, CMA, CFE, CPP, CGFM), Securities & Wealth (CFP, SIE, FINRA Series, CFA, FRM), Audit & Cyber (CISA, CIA, CRISC, CISM, CISSP, CCSP, Security+, CIPP/US), HR Leadership (SHRM-CP, PHR), and Federal Regulatory (CBLE). A Virginia Tech graduate in Accounting and Finance, Rob began his career at Price Waterhouse, spending a decade in audit and IT consulting. After holding a CPA license for 37 years (1987–2024) and scaling his own enterprise IT consultancy serving commercial and federal clients, Rob launched VoraPrep to build adaptive training technology and blueprint-aligned curriculum for working professionals.

Free Diagnostic Assessment

Find your exact CFE weak spots in 10 minutes.

Most candidates fail because they study blindly. Take our free 10-question diagnostic to identify your weakest blueprint topics and receive a custom 12-week study plan PDF generated instantly.

Keep reading

Free 5-min CFE diagnostic + 12-week plan PDF

Start →
CFE 1:1 Prometric Simulator

2,000+ practice questions with instant Socratic feedback