The ACFE reports a global CFE exam pass rate hovering around 70%, yet the Investigation section disproportionately trips up candidates who mistake memorization for mastery. They learn the what of a technique like the Net Worth Method but fail when the exam asks why it's the right tool for one scenario and the wrong one for another.
To pass the CFE Investigation section, you must apply a judgment-first approach to evidence collection, interviewing, and data analysis. Success requires choosing the most appropriate technique for a given scenario, understanding its legal boundaries, and meticulously documenting the chain of custody, rather than just reciting procedural steps.
Key facts
- Official Body: Association of Certified Fraud Examiners (ACFE).
- Exam Sections: Financial Transactions & Fraud Schemes, Law, Investigation, and Fraud Prevention & Deterrence.
- Investigation Section Focus: This is one of four major domains, focusing on practical application of investigative techniques, not a fixed percentage weight.
- Passing Score: A minimum score of 75% is required on each of the four sections.
- Recommended Study Hours: The ACFE suggests a comprehensive plan of 200+ hours for the entire exam; budget at least 50-60 hours for the Investigation section.
- Median CFE Salary (US): The ACFE's 2024 Compensation Guide for Anti-Fraud Professionals reports a median salary of $95,000 for CFEs in the United States.
How Do You Handle Evidence and Chain of Custody?
You handle evidence by systematically collecting, marking, and storing it while meticulously documenting every transfer of possession to maintain a perfect chain of custody. This isn't just administrative work; it's the bedrock of a legally sound investigation. If you can't prove the integrity of your evidence, any findings you build upon it will collapse under scrutiny.
The exam will test your understanding of the different types of evidence:
Studying for CFE? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
- Testimonial: Evidence gathered from witnesses through interviews and statements.
- Documentary: Evidence from paper or digital documents, like invoices, emails, or contracts. The "best evidence rule" generally requires the original document unless it's unavailable.
- Physical: Tangible items such as a computer, a weapon, or a forged check.
- Observational: Evidence you personally see or perceive, such as observing a suspect's behavior during surveillance.
Step 1: Collection and Marking
Once you obtain a piece of evidence, you must immediately mark it. This typically involves placing it in a container (like a sealed evidence bag), and then writing the date, time, location obtained, case number, and your initials on the container. This links the evidence to the specific investigation.Step 2: Secure Storage
Evidence must be stored in a secure, access-controlled location, such as a locked cabinet or a safe. This prevents tampering, damage, or loss.Step 3: Documenting the Chain of Custody
This is the most critical step. You must maintain a log that details every single person who has handled the evidence, from the moment of collection to its presentation in court. Each entry includes the person's name, the date and time of transfer, and the reason for the transfer. Any break in this chain can render the evidence inadmissible.> ⚠️ Exam trap: The exam will present scenarios where evidence is handled casually, for example, an auditor leaves a crucial document on their desk overnight. The correct answer will always identify this as a break in the chain of custody that compromises the evidence's integrity. Don't underestimate the importance of these procedural details.
How Should You Conduct Effective Fraud Interviews?
You conduct effective fraud interviews by understanding and applying the correct techniques for three distinct phases: informational, assessment, and admission. Each has a different goal and requires a different approach. Using an admission-seeking tactic during an informational interview is a surefire way to alienate a key witness.
- Informational Interviews: The goal is to gather facts and background information from neutral, third-party witnesses. Use open-ended questions ("Tell me about the expense approval process") and be a patient, active listener.
- Assessment Interviews: These are used to assess the credibility of a potential suspect when you are uncertain of their role. You ask non-threatening, non-accusatory questions to observe their verbal and non-verbal reactions to the information you present.
- Admission Interviews: This is the final stage, conducted only when you have sufficient evidence to reasonably believe the subject is culpable. Its sole purpose is to obtain a legally admissible confession.
The Admission Interview: Securing the Confession
The Admission Interview is a structured conversation designed to get a confession. It is not an interrogation. You must adhere to strict legal and ethical lines, especially concerning employee rights. For instance, in the U.S., unionized employees may have Weingarten rights to have a union representative present. If the interviewer is a law enforcement officer in a custodial setting, Miranda warnings are required.
The key is to present evidence strategically and offer the subject a moral rationalization.
> ✅ Tip: A powerful rationalization gives the subject a face-saving reason to confess. Instead of saying, "You stole the money," you might say, "It seems like the financial pressure was immense, and you were just trying to get by." This lowers their defensive barriers and makes admission more likely.
| Interview Stage | Primary Objective | Key Strategy | Common Mistake |
|---|---|---|---|
| Informational | Gather facts, build rapport | Open-ended questions, active listening | Prejudging, leading questions |
| Assessment | Observe behavior, gauge honesty | Non-confrontational questions, evaluate reactions | Over-interpreting, failing to corroborate |
| Admission | Obtain confession, specific details | Rationalization, phased evidence presentation | Premature accusation, insufficient evidence |
What Are Indirect Methods for Proving Illicit Income?
Indirect methods are techniques used to prove illicit income when you cannot directly trace the stolen funds. Instead of following the money out of the victim company, you prove it ended up in the suspect's hands by analyzing their financial status. The CFE exam requires you to know several, but the Net Worth Method is the most detailed.
The Net Worth Method: A Detailed Walkthrough
The Net Worth Method calculates a subject's unexplained income by comparing their net worth at the beginning and end of a period, then factoring in their known income and expenses.
The formula is: Unexplained Income = (Net Worth at End - Net Worth at Beginning) + Nondeductible Expenditures - Known Legitimate Income> 💡 Worked example: > > You are examining the finances of Jane Doe, a controller suspected of embezzlement, for the year 2025. > > January 1, 2025 (Beginning): > * Assets: $350,000 > * Liabilities: $200,000 > * Beginning Net Worth: $150,000 > > December 31, 2025 (End): > * Assets: $550,000 (includes a new car bought with cash) > * Liabilities: $180,000 > * Ending Net Worth: $370,000 > > Known Income & Expenditures for 2025: > * Reported Salary: $90,000 > * Gift from parents (Non-Taxable): $25,000 > * Estimated Nondeductible Expenditures (living expenses, vacations, etc.): $60,000 > > Let's calculate Jane's unexplained income: > > ### Step 1: Calculate Net Worth Increase > * $370,000 (End NW) - $150,000 (Beginning NW) = $220,000 > > ### Step 2: Add Nondeductible Expenditures > The increase in net worth only shows what she kept. We must add back what she spent* to find the total funds available to her. > * $220,000 (NW Increase) + $60,000 (Expenditures) = $280,000 > > ### Step 3: Subtract Known Legitimate Income > * Now, we subtract the money we know she had legitimately. > * $280,000 - $90,000 (Salary) - $25,000 (Gift) = $165,000 > > Jane's Unexplained Income for 2025: $165,000 > > This $165,000 is the amount she must have obtained from an unknown source. > > ⚠️ Exam trap: Candidates often forget to add back the nondeductible expenditures. They see the net worth increase and try to reconcile it directly with income. You must remember that the total funds a person had available were used for two things: increasing their wealth (net worth) and paying for their life (expenditures).
Other Indirect Methods to Know
While the Net Worth Method is primary, be aware of others:
Free 10-Question Diagnostic Assessment
Pinpoint your exact knowledge gaps in 10 minutes and receive a personalized 12-week study roadmap PDF with zero obligation.
- Expenditures Method: A simplified version that compares known expenditures to known income. If expenses exceed income, the difference is unexplained.
- Bank Deposits Method: Analyzes all deposits into a subject's bank accounts. After subtracting known income sources, the remainder is considered potentially illicit income.
How Can Data Analytics Uncover Fraud Red Flags?
Data analytics can rapidly identify anomalies and red flags in large datasets that would be impossible to spot manually. For the CFE exam, you must understand how to apply specific tests and, just as importantly, when not to apply them. VoraPrep's adaptive learning engine can help you master these distinctions with over 2,000 practice questions.
Applying Benford's Law Correctly
Benford's Law states that in many naturally occurring sets of numbers, the first digit is more likely to be small. The digit '1' appears as the leading digit about 30% of the time, while '9' appears less than 5% of the time. Fabricated numbers often violate this pattern.
Its power is in screening, not proving. A deviation from Benford's Law is a red flag that requires further investigation.
Use Benford's Law for:- Large datasets (thousands of entries).
- Data that spans several orders of magnitude (e.g., invoice amounts from $10 to $100,000).
- Naturally occurring numbers like payment amounts or sales figures.
- Small datasets.
- Numbers with an artificial minimum or maximum (e.g., all expenses must be over $50).
- Assigned numbers like check numbers, invoice numbers, or zip codes.
Beyond Benford's: Other Key Data Tests
- Duplicate Testing: Searching for duplicate invoice numbers, payment amounts, or vendor addresses.
- Gap Testing: Identifying missing check numbers or invoice numbers in a sequence.
- Trend Analysis: Analyzing financial data over time to spot unusual spikes or dips in accounts like sales, returns, or write-offs.
What Are the Essentials of Digital Forensics?
Digital forensics involves the recovery and investigation of material found in digital devices. The most critical principle for the CFE exam is the order of volatility. You must collect evidence from the most volatile (temporary) to the least volatile (permanent) locations.
- CPU, Cache, and Register Contents: Most volatile.
- Routing Tables, ARP Cache, Process Tables: Highly volatile.
- RAM (System Memory): Disappears when power is lost.
- Temporary System Files: May be deleted on shutdown.
- Hard Drive Data: Most persistent.
Failing to capture RAM before powering down a machine could destroy crucial evidence about what programs were running.
How Do You Write an Effective Fraud Examination Report?
You write an effective report by presenting your findings clearly, objectively, and based solely on the evidence. The report is the formal record of the investigation and must be strong enough to stand on its own.
A standard fraud examination report includes:
- Introduction/Summary: A brief overview of the case and the key findings.
- Background: Information about the entity or individuals involved.
- Scope and Objectives: What the investigation covered and what it aimed to achieve.
- Methodology: The specific investigative techniques used.
- Findings: A detailed, chronological presentation of the facts, with each finding supported by specific evidence (referenced as exhibits).
- Conclusion: A summary of what the evidence shows (or doesn't show). Avoid expressing opinions on guilt or innocence; simply state the facts.
The golden rule is objectivity. Your job is to report the facts, not to be an advocate. For more detail on this and other topics, see our complete guide to the CFE Investigation section.