Most candidates think Section 3 is the "soft" part of the CFE exam. They treat Criminology and Governance like a vocabulary test and fail. The real trap is realizing too late that these questions demand you apply rigid frameworks like COSO and the ACFE Code of Ethics with the same precision as a financial calculation.
Per VoraPrep's CFE blueprint analysis, these free CFE Section 3 practice questions test your ability to apply frameworks for Criminology, Governance, Fraud Risk Management, and Anti-Fraud Controls. They mirror the exam by requiring judgment based on the ACFE Fraud Examiners Manual, not just rote memorization of terms.
Key facts
- Official Exam Name
- Certified Fraud Examiner (CFE) Exam
- Exam Section
- Section 3: Fraud Prevention and Deterrence
- Official Body
- Association of Certified Fraud Examiners (ACFE)
- Blueprint Topics
- Criminology, Ethics, Governance, Fraud Risk Management, and Anti-Fraud Controls.
- Question Format
- 125 multiple-choice questions
- Time Limit
- 125 minutes (exactly 1 minute per question)
- Reported Pass Rate
- The ACFE has historically cited pass rates between 65-70%, often for candidates who use a dedicated review course (ACFE).
What Do These Section 3 Practice Questions Cover?
These sample questions are not a simple knowledge check. They are designed to simulate the mental challenge of the CFE exam's Fraud Prevention and Deterrence section. This part of the exam shifts your focus from investigating fraud that has already happened to preventing it from ever starting.
The questions below cover a representative mix of the Section 3 blueprint, forcing you to apply concepts rather than just define them.
- Criminology & Ethics: Why do people commit fraud and what are your professional obligations?
- Governance: Who is responsible for oversight versus execution?
- Fraud Risk Management: How do you systematically identify and mitigate vulnerabilities?
- Anti-Fraud Controls: Which specific control best addresses a given risk?
As you work through them, focus on the reasoning. The ACFE wants to see that you can think like a fraud examiner. For a full-length simulated exam experience, you can always try VoraPrep's free CFE practice questions.
Studying for CFE? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
How Does the Exam Distinguish Preventive vs. Detective Controls?
A frequent trap on Section 3 is choosing a control that finds fraud when the question asks how to stop it. You must know the difference. Preventive controls are proactive barriers, while detective controls are reactive alerts.
| Control Type | Goal | Timing | Examples |
|---|---|---|---|
| Preventive | Stop fraud before it happens | Before the transaction | Segregation of duties, required approvals, system access controls, background checks |
| Detective | Find fraud after it occurs | After the transaction | Reconciliations, surprise audits, data analytics, whistleblower hotlines |
The exam will test your ability to select the right type of control for a given scenario.
CFE Section 3 Practice Questions and Explanations
Work through these questions one by one. Read the full explanation, especially for the ones you get wrong. Pay close attention to why the incorrect answers are tempting but ultimately flawed.
Question 1
A mid-sized manufacturing company, Precision Parts Inc., recently discovered a $250,000 billing scheme perpetrated by an accounts payable clerk. The board of directors wants to implement a program to prevent future occurrences. Which of the following is the most effective first step in establishing a comprehensive fraud prevention program?
This question tests your understanding of the foundational step in fraud prevention. You can't effectively prevent fraud until you know where you are most vulnerable.
- B is correct because a fraud risk assessment is the systematic process of identifying and prioritizing potential fraud risks. It allows the company to tailor its prevention efforts to its specific operational realities. You have to diagnose the illness before you can prescribe the medicine.
- A is tempting because technology feels like a powerful solution. However, new software without a clear understanding of the risks it's meant to address is just an expensive tool. Fraud can still occur within even the most advanced systems if processes are flawed.
- C is a good component of a fraud prevention program, but it's not the first step. Ethics training is most effective when it addresses the specific risks and ethical dilemmas employees at Precision Parts will actually face, which are identified during the risk assessment.
- D is a detective control, not a preventive one. Surprise audits are designed to find fraud that is already occurring, which is valuable, but the question asks for prevention.
Question 2
According to Donald R. Cressey's Fraud Triangle, which element is most directly addressed by implementing strong internal controls, such as segregation of duties and mandatory vacations?
This is a direct application of a core criminological theory you must know for Section 3. The examiner wants to see if you can map a specific control to the correct element of the theory.
- B is correct because internal controls are designed to reduce or eliminate the opportunity for an individual to commit and conceal fraud. Segregating duties means no single person controls a transaction from start to finish. Mandatory vacations force a fraudster out of the office, allowing their temporary replacement to potentially discover irregularities.
- A is incorrect. Perceived pressure (e.g., gambling debts, medical bills) is an external factor related to the individual's personal life. Internal controls do not directly affect an employee's financial pressures.
- C is incorrect. Rationalization is the internal justification the fraudster uses ("The company owes me"). This is a psychological component that internal controls don't directly influence.
- D is not part of Cressey's original Fraud Triangle. While later models like the Fraud Pentagon (by Wolfe and Hermanson) add capability as a key element, the question specifically asks about the Fraud Triangle. Including a term from a related but different theory is a classic exam trick.
Question 3
A publicly traded company's audit committee is responsible for overseeing the financial reporting process. Which of the following duties is least likely to be a primary responsibility of the audit committee?
This question targets your knowledge of corporate governance and the specific roles defined by regulations like the Sarbanes-Oxley Act (SOX). The key is distinguishing between oversight and preparation.
- C is correct because preparing the financial statements is the direct responsibility of management, specifically the CEO and CFO. The audit committee's role is to oversee and review management's work, not to do it for them.
- A is a core responsibility of the audit committee under SOX. The committee has the sole authority to hire and fire the external auditors, ensuring their independence from management.
- B is also a SOX requirement. The audit committee must establish a "whistleblower" mechanism for employees to report concerns confidentially.
- D is a fundamental oversight function. The committee reviews the effectiveness of the company's internal control structure to ensure the financial reporting process is reliable.
Question 4
The ACFE Code of Professional Ethics requires a Certified Fraud Examiner to "exhibit the highest level of integrity in the performance of all professional assignments." Which of the following actions would be a clear violation of this standard?
Ethics questions on the CFE exam are not about feelings; they are about the strict application of the code. Look for the most direct and serious breach.
- D is a flagrant violation. Accepting payment to conceal a known fraud compromises integrity and professional independence. This is the definition of unethical and illegal conduct. It directly subverts the entire purpose of being a CFE.
- A is a potential conflict of interest, but not necessarily a clear violation on its own. The proper course of action would be to disclose the relationship to the client or employer to determine if it impairs objectivity. Simply accepting the engagement after disclosure might be permissible.
- B is likely not a violation. Internal reporting structures are normal. The violation would occur if the manager instructed the CFE to ignore the issue and the CFE complied without escalating the matter further if it were significant.
- C is the proper function of an expert witness. A CFE's duty is to form an objective opinion based on evidence. If that evidence supports the side that hired them, testifying to that fact is ethical. The violation would be to alter or ignore evidence to fit a client's desired narrative.
Question 5
Which criminological theory suggests that fraudulent behavior is learned through interaction with others in a process of communication within intimate personal groups?
This is a pure knowledge question on criminological theories. You need to have these definitions memorized.
- C is correct. Edwin Sutherland's Differential Association Theory posits that criminal behavior, including fraud, is learned from peers and close associates who hold definitions favorable to law-breaking. Think of a junior employee being taught how to pad expense reports by a senior colleague.
- A is incorrect. Rational Choice Theory suggests individuals commit crime after weighing the potential benefits against the potential costs (like being caught).
- B is incorrect. Strain Theory suggests that when individuals cannot achieve societal goals (like wealth) through legitimate means, they experience "strain" and may turn to illegitimate means (like fraud).
- D is incorrect. Social Control Theory asks the opposite question: Why don't people commit crime? It argues that strong bonds to society (attachment, commitment, involvement) prevent most people from deviating.
Question 6
While part of a complete anti-fraud program, proactive detection techniques differ from prevention. Which of the following is the best example of a proactive data analytics test to detect a ghost employee scheme?
This question requires you to think practically about how to use data to find red flags before a whistleblower comes forward. The key is to distinguish a general red flag from a specific data test for a specific scheme.
- D is correct because it describes a specific, targeted data analytics test designed to find the classic indicators of a ghost employee. Ghosts often lack tax deductions, use a P.O. box instead of a real address, or have their pay deposited into the same bank account as another (real) employee. This is a proactive search for anomalies.
- A is a reactive, manual process. It is not a proactive data test and is highly inefficient.
- B is a valid data test, but it's designed to detect conflicts of interest or shell company schemes where an employee is paying a vendor they secretly own. It is not the best test for a ghost employee.
- C is a red flag for fraud in general, as fraudsters often avoid taking vacation so their scheme isn't discovered. However, it is not as specific to detecting ghost employees as the test described in D.
Question 7
A company's management team establishes a formal code of conduct, creates an anonymous whistleblower hotline, and develops a clear organizational structure with defined lines of authority. According to the COSO Internal Control – Integrated Framework, these actions primarily relate to which of the five components?
This question tests your knowledge of the foundational COSO framework, which is critical for Section 3. You must be able to categorize different anti-fraud measures into the correct COSO component.
- B is correct. The Control Environment is the "tone at the top." It encompasses the standards, processes, and structures that provide the basis for carrying out internal control. A code of conduct, organizational structure, and commitment to integrity and ethical values are the core of the Control Environment.
- A is incorrect. Risk Assessment is the process of identifying and analyzing risks to achieving objectives. While the Control Environment helps manage risk, these specific actions are about setting the ethical foundation, not the process of risk identification itself.
- C is incorrect. Control Activities are the specific actions established by policies and procedures to help ensure management's directives are carried out. Examples include reconciliations, approvals, and segregation of duties. A whistleblower hotline is more foundational (part of the environment) than a specific transactional control activity.
- D is incorrect. Monitoring Activities are the ongoing evaluations used to ascertain whether each of the five components of internal control is present and functioning. The hotline helps with monitoring, but its establishment is part of creating the environment.
Calculate Your CFE Score & Study Hours by Domain
Adjust your practice scores across official CFE blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Can You Interpret Your Score?
Count up your correct answers, but focus on the why. This is a diagnostic, not a final grade.
- 6-7 Correct: You have a strong grasp of the core principles and are thinking like an examiner. You can distinguish between related concepts (prevention vs. detection) and apply frameworks like COSO and the Fraud Triangle. Your next step is to use our adaptive CFE question bank to find and eliminate any remaining knowledge gaps with timed practice.
- 4-5 Correct: You understand the basic definitions but may struggle to apply them under pressure. Did you mix up the COSO components or the roles of governance bodies? This is common. This week, create a one-page chart outlining the five COSO components with 2-3 examples for each.
- 0-3 Correct: You may be relying too much on memorization. Section 3 is about judgment. If you're missing these, it’s a sign to go back to the foundational concepts in the ACFE Fraud Examiners Manual. For each concept, ask: "How would an organization do this?" Visualize the steps of a fraud risk assessment or the implementation of a control.
Why Is a Complete CFE Prep Course Better Than Just Questions?
A handful of sample questions is a great start, but passing the CFE exam requires building deep, consistent practice. This is where a complete, end-to-end exam prep course makes the difference. VoraPrep is not just a question bank; it's a full 6-pillar study system designed for busy professionals who prefer interactive learning over passive video lectures.
- Complete Textbook-Grade Lessons: Step-by-step interactive lessons break down complex topics like COSO's framework and the ACFE Code of Ethics, ensuring higher retention than watching hours of videos.
- Adaptive Practice Banks: With over 2,000 CFE practice questions, our adaptive engine learns your weak spots and serves you more questions on those topics until you achieve mastery.
- 1:1 Test-Center Exam Simulators: Our mock exams perfectly replicate the look, feel, and timing of the real CFE exam, building your confidence and pacing.
- FSRS Spaced-Repetition Flashcards: Master key terms, theories, and rules with our memory-scheduled flashcards.
- Personalized Daily Study Plan: Our system builds a dynamic calendar around your exam date and provides a readiness score to predict your performance.
- Vory, Your 24/7 Personal Tutor: Stuck on a concept at 11 PM? Ask Vory inside any lesson or question for a step-by-step explanation.
Legacy courses can cost thousands. VoraPrep provides a complete, interactive learning system for a simple monthly or annual subscription. You can see a full breakdown on our CFE exam details and format page.