Curriculum of Certified Fraud Examiner Module 3: Investigation

Module 3 of the Certified Fraud Examiner (CFE) curriculum, "Investigation" focuses on the essential skills and knowledge needed for planning and conducting a comprehensive fraud examination. This module is crucial as it delves into the investigative processes that form the backbone of identifying, analyzing, and addressing fraudulent activities within organizations. Through meticulous planning, evidence collection, and effective reporting, fraud examiners can tackle the complex challenges associated with fraud investigations.

Fraud examinations, which could involve looking into claims of fraud or asking questions concerning the anti-fraud policies and procedures of an organization, are arguably the most significant aspect of a fraud examiner's extensive and diverse knowledge base. Numerous variables may influence a fraud examination, making it more difficult for the investigative team and the fraud examiner to complete. But meticulous preparation will lessen these difficulties and guarantee that all parties are ready to conduct a responsible and comprehensive interaction that accomplishes its objectives without endangering outcomes. A fraud examination's likelihood of success is considerably increased by taking the time to carefully plan it out.

Why Conduct a Fraud Examination? There are a variety of reasons why companies decide to carry out fraud investigations. Specifically, a well-conducted fraud assessment can accomplish a number of organizational goals, such as:

• Identifying improper conduct
• Identifying the persons responsible for improper conduct
• Stopping ongoing fraud
• Sending a message throughout the organization that fraud will not be tolerated
• Determining the extent of potential liabilities or losses that might exist
• Helping facilitate the recovery of losses
• Stopping future losses
• Mitigating other potential consequences
• Strengthening internal control weaknesses

The collection of evidence plays a fundamental role in any fraud examination by proving or disproving that fraud has occurred. Much of the investigative process includes collecting evidence through various means, which might involve obtaining the consent of subjects of an investigation, conducting interviews of suspects and witnesses, reviewing accounting records, searching offices, seizing computers, and surveilling individuals or locations, among other things.

Most fraud examinations involve the collection of three main types of evidence. The three primary types of evidence that fraud examiners must consider and gather when conducting their investigations are:

• Testimonial evidence
• Digital evidence
• Documentary evidence

An interview is a question-and-answer session designed to elicit information. It differs from an ordinary conversation in that an interview is structured, not free-form, and is designed for a purpose. An interview might consist of only one question or a series of questions.

To effectively prepare for the interview phase of an investigation, the fraud examiner must first develop a plan. The fraud examiner should contemplate what the interview is intended to accomplish and state an objective. They should also review the case file to ensure that the plan is not devoid of important information that might have been overlooked. The most appropriate member of the investigative team should be selected to conduct the interview based on the interview's specifics.

Many investigations and fraud examinations depend on the information obtained through interviews with suspects. In fact, a successful suspect interview that concludes with an admission often brings the entire investigation to a resolution, allowing the fraud examiner to focus on compiling all of the information into a conclusive report to management.

The signed statement should reduce the verbal admission to a short, concise written statement. The interviewer should prepare the statement and have the fraudster sign it before they leave the interview. There should be no attempt to make the statement longer than necessary, and it should rarely exceed two or three handwritten pages.

A covert operation is an investigation technique designed to obtain evidence by use of agents whose true intentions are not communicated to the target. Covert operations must be undertaken carefully. With proper planning and precautions, such operations can prove very beneficial to an investigation. When considering a covert operation, fraud examiners must consider privacy laws, the potential cost of human and technological resources, any source or informant's motivations and expectations regarding their participation, and the potential to alert suspects to the existence of an investigation. The two main forms of covert operations are :

• Undercover operations
• Surveillance operations

In most cases, it is appropriate to dedicate the majority of the fraud examiner's first efforts to locating, gathering, and obtaining all relevant documents. Documents serve as the cornerstone of the fraud examination case and aid in establishing the framework for the inquiry. Records can be used as proof to show that a fraud was committed, to define its parameters, and to pinpoint the individuals involved. The majority of documented evidence in fraud examinations typically originates from within the business under investigation, but fraud examiners should keep in mind that external sources might also contribute to the information needed to carry out a successful examination.

Whether using the internet for an investigation or using software to analyze data, fraud examiners rely heavily on technology to aid them in an investigation. More data are stored electronically than ever before-financial data, marketing data, customer data, vendor listings, sales transactions, email correspondence, and more—and evidence of fraud could be located within those data. Unfortunately, fraudulent data often look like legitimate data when viewed in the raw. Taking a sample and testing it might not uncover fraudulent activity.

Fortunately, fraud examiners can sort through piles of information by using data analysis software and techniques. These methods can help identify trends and anomalies in data and transactions, as well as non-compliance with controls and processes.

The presence of the internet and other technology in all aspects of life facilitates opportunities for technology to be used in perpetrating almost every type of fraud, and in most fraud cases, fraud examiners gather some type of digital evidence. Fraud examiners must, therefore, be prepared to address the myriad issues related to examinations involving digital evidence.

Digital Investigations Versus Digital Forensics! Although the phrases "digital forensics" and "digital investigations" may seem interchangeable, they have several key differences. Digital investigations are those that use pertinent digital data that has been processed or saved by digital devices—that is, devices that process data that is represented by numbers (digits). The recovery and examination of data from digital devices, usually for use in a court of law, is the scope of digital forensics.

Tracing refers to the search for evidence for the purpose of showing what has happened to property, identifying the proceeds of property, and identifying those who have handled or received property or the proceeds of property. Accordingly, fraud examiners are often tasked with tracing illicit transactions and the associated assets. General process for tracing illicit transactions:

• Collect information
• Profile the subject (i.e., assemble the personal-financial and behavioural profile)
• Review information for leads and prioritize leads.
• Trace the illicit transactions
• Evaluate recovery options.

Writing effective reports is a critical skill for fraud examiners. A thorough investigation or keen analysis will often do little good if the fraud examiner cannot convey the information in a written format. Typically, fraud examiners must be very flexible with their writing technique because reports should generally be tailored to the situation, as well as to the needs of the party requesting the report. Even so, many aspects of good writing-such as accuracy, relevancy, and clarity—are universal to all reports. The two most common types of reports fraud examiners are engaged to create are:

• Fraud examination reports
• Expert reports

The "Investigation" Module 3 of the CFE curriculum equips fraud examiners with the essential skills needed for effective investigation and reporting. By mastering the techniques of planning, evidence collection, and analysis, fraud examiners can enhance their ability to uncover fraudulent activities and contribute to organizational integrity. Comprehensive understanding and application of these investigative practices are vital for achieving successful outcomes in fraud examinations.