87) A well-known standard for information security management systems development is
A) SOX.
B) ISO 27000.
C) COBIT.
D) both B and C
88) An example of fraud indicators is
A) mismatch in an inventory count.
B) a cash register that doesn’t balance.
C) a suspicious invoice.
D) All of the above are correct.
89) The method used to exploit an interesting pattern relating to the first digit of numbers
appearing in a random data set is called
A) the Benford analysis.
B) the regression analysis.
C) the vulnerability analysis.
D) the pattern analysis.
90) Type 1 errors occur when
A) a fraud indicator fails to signal fraud.
B) a fraud indicator falsely signals fraud.
C) a fraud indicator turns out not to be a fraud indicator.
D) all of the above
91) Type 2 errors occur when
A) a fraud indicator fails to signal fraud.
B) a fraud indicator falsely signals fraud.
C) a fraud indicator turns out not to be a fraud indicator.
D) all of the above
92) Total fraud costs are computed by adding
A) costs of prevention and costs of investigations.
B) costs of prevention, costs of investigations, and costs of detections.
C) costs of prevention, costs of investigations, costs of detections, and costs of losses.
D) costs of prevention, costs of investigations, costs of detections, costs of losses, and costs of
reputations.
93) Which of the following is part of the fraud investigation process?
A) Conducting the initial notifications and evaluation
B) Considering legal issues
C) Defining the scope, objectives, and costs of the investigation
D) Engaging a fraud indicator
94) In many fraud cases, the best approach is to
A) immediately stop a recurring fraud.
B) allow the fraud to continue.
C) hire forensic specialists.
D) both A and B
95) Evidence may include
A) tangible objects.
B) documents.
C) testimony.
D) all of the above
96) Physical and document evidence include
A) fingerprints.
B) trace evidence.
C) forged document.
D) all of the above
97) A signed confession is
A) a court-admissible evidence.
B) protected under the umbrella of attorney-client privilege.
C) a physical evidence.
D) not admissible in court.
98) Evidence is collected in the following order:
A) Observations, physical and document evidence, and interviews.
B) Observations, interviews, and physical and document evidence.
C) Physical and document evidence, observations, and interviews.
D) Physical and document evidence, interviews, and observations.
99) An order from a government agency or officer of a court that compels the recipient, under
penalty, to produce physical evidence, documents, or testimony is called
A) a search warrant.
B) a subpoena.
C) a notification.
D) an interview.
100) Working with numbers in accounts and following them backward to the source document is
known as
A) tracing.
B) vouching.
C) rediscovery.
D) approximation.
101) In law enforcement circles, surreptitious observation is called
A) clandestine observation.
B) invigilation.
C) surveillance.
D) all of the above
102) Calibration is the process of carefully observing a suspect’s behavior
A) during introductory questioning.
B) throughout the entire questioning.
C) after questioning.
D) all of the above
103) After the informational questioning, which type of questions will the interviewer ask the
suspect as a means to assess his or her honesty?
A) Concluding questions
B) Assessment questions
C) Admission seeking questions
D) None of these answers are correct.
104) After the introductory and informational questions, non-suspects will be presented with
A) additional informational questions.
B) admission seeking questions.
C) assessment questions.
D) concluding questions.
105) After the introductory and informational questions, suspects will be presented with
A) additional informational questions.
B) admission seeking questions.
C) assessment questions.
D) concluding questions.
106) Individuals who respond more to audio stimuli typically
A) look down and to the left when recalling information.
B) look up and to the left when recalling information.
C) look down and to the right when recalling information.
D) look up and to the right when recalling information.
107) How many written confessions should be prepared if the suspect has committed five
crimes?
A) One
B) Three
C) Five
D) It depends on the crime committed.
108) Discovery is the process in which
A) opposing parties cannot require each other and relevant parties to produce out-of-court
evidence.
B) opposing parties can prohibit each other and relevant parties to produce out-of-court evidence.
C) opposing parties can require each other and relevant parties to reproduce previously court-
admissible evidence.
D) opposing parties can require each other and relevant parties to produce out-of-court evidence.
109) Rule 702 permits those qualified as experts to present expert testimony in court if
A) the testimony is based upon sufficient facts or data.
B) the testimony is the product of reliable principles and methods.
C) the witness has applied the principles and methods reliably to the facts of the case.
D) all of the above
110) Financial statement fraud differs from earnings management in terms of
A) legality.
B) terminology.
C) procedures.
D) the parties involved.
111) Example of financial statement fraud red flags include
A) weak internal control.
B) inadequate personnel-related practices.
C) irregular accounting practices.
D) all of the above
112) A company may overstate its reported assets by
A) avoiding depreciation.
B) inflating asset valuations.
C) understating bad-debt allowances.
D) all of the above
113) Which of the following is an example of revenue cycle fraud?
A) Earnings management
B) Writing off large depreciable or amortizable assets
C) Pocketing cash but not recording its collection
D) all of the above
114) Which of the following best describe the fraud scheme that involves removing cash from
the cash register and replacing it with bogus checks?
A) Sales skimming
B) Robbing the cash register
C) Swapping checks for cash
D) Shortchanging the customer
115) Which of the following best describes the fraud scheme that involves an employee
pocketing cash but not recording its collection?
A) Sales skimming
B) Robbing the cash register
C) Swapping checks for cash
D) Shortchanging the customer
116) Which of the following procedures would deter the lapping of accounts receivable?
A) Segregation of accounting duties
B) Training cashiers to follow strict procedures for making change
C) Performing reconciliations on a register-by-register basis and separately for each cashier shift
D) Limiting employee after-hours access to company resources
117) The fraud scheme that involves using a stolen customer check to make a payment on
account is called
A) stealing cash in transmission.
B) shorting bank deposits.
C) lapping of accounts receivable.
D) check laundering.
118) Bid rigging frauds is an example of
A) revenue cycle fraud.
B) account receivable fraud.
C) expenditure cycle fraud.
D) fraudulent financial reporting.
119) Which of the following procedures can be used to detect “phantom” employees?
A) Maintaining personnel files in an independent personnel department
B) Requiring management and personnel review and approval for all personnel-related activities
C) Implementing a multi-review and approval process within the purchasing department
D) both A and B
120) An imprest fund accounting system can be used to minimize
A) theft of petty cash.
B) fraudulent financial reporting.
C) theft of company checks.
D) fraudulent returns.
121) The primary objectives of computer forensics include studying computers and computer
networks in order to
A) identify perpetrators of crimes or undesirable behavior.
B) locate existing data.
C) deconstruct databases
D) identify alternate site centers.
122) Content analysis involves the process of
A) comparing the content of computer files in order to determine any differences between them.
B) determining the content of files and electronic communications.
C) locating and extracting data of interest from computer-storage devices.
D) converting data from one format to another.
123) Comparison analysis involves the process of
A) comparing the content of computer files in order to determine any differences between them.
B) determining the content of files and electronic communications.
C) locating and extracting data of interest from computer-storage devices.
D) converting data from one format to another.
124) One of the major disadvantages to pulling the plug is that
A) it is ineffective.
B) it is inefficient.
C) it leads to the loss of the computer’s volatile memory.
D) none of the above
125) ________ is the only IP that is visible on the Internet.
A) LAN IP
B) WAN IP
C) Dynamic IP
D) ISP IP
126) Hackers can hide their real IP addresses by using
A) LAN IP.
B) WAN IP.
C) proxy server chains.
D) ISP IP.
127) At the conclusion of an investigation, the investigator prepares a report that would typically
contain
A) concluding comments indicating a suspect’s guilt.
B) the scope and objectives of the investigation.
C) privileged attorney-client comments.
D) all of the above
128) Presented below is a list of terms relating to the different types of evidence and the
evidence collection process, followed by definitions of those terms.
Required: Match the letter next to each definition with the appropriate term. Each answer will be
used only once.
________ 1. Observation
________ 2. Invigilation
________ 3. Surveillance
________ 4. Document examiners
________ 5. Search warrant
________ 6. Subpoena
________ 7. Predication
________ 8. Tracing
________ 9. Questioned document
________ 10. Vouching
A. A widely accepted principle that requires that investigations be started or continued only
when there is a reasonable basis to do so
B. Following a source document that evidences a transaction through the entire accounting cycle
C. The use of the senses to assess the behavior of persons and other activities such as business
processes
D. A court order that authorizes law enforcement to search for and seize evidence
E. Surreptitious observation
F. Document evidence whose authenticity or authorship is in question
G. An order from a government agency or officer of a court that compels the recipient, under
penalty, to produce physical evidence, documents, or testimony
H. People who specialize in analyzing questioned documents
I. Selecting numbers in accounts and following them backward in the accounting cycle to the
source documents
J. An observation technique that involves observing a suspect’s behavior before, during, and
after an announced investigation
129) Presented below is a list of terms relating to fraud schemes, followed by definitions of those
terms.
Required: Match the letter next to each definition with the appropriate term. Each answer will be
used only once.
________ 1. Sales skimming
________ 2. Bid rigging frauds
________ 3. Payroll fraud
________ 4. Fraudulent cost-plus billing
________ 5. Swapping checks for cash
________ 6. Short shipments
________ 7. Shortchanging the customer
________ 8. Check washing
________ 9. Kickback frauds
________ 10. Robbing the cash register
A. Involves removing cash from the cash register and replacing it with bogus checks
B. Scheme that typically involves an employee pocketing cash but not recording its collection
C. The involvement of using chemicals to remove a check’s payment details and then adding
new details for the payee, date, or amount of payment
D. In situations where cash register receipts are not reconciled with sales receipts per each
individual cash register, the employee is free to rob the cash register with impunity
E. A dishonest purchasing agent might purchase from a friend or relative even though to do so is
not in the best interest of the company
F. A fraud scheme in which a cashier uses distraction or deception in order to pocket part of the
change due to the customer
G. Vendors bill customers for the vendor’s costs plus a fictitious markup
H. A dishonest purchasing agent might accept secret payments or favors in exchange for
favoring a particular vendor
I. Involves improper hiring, improper changes to employee personnel files and pay rates, and
improper work-related reporting
J. Vendors ship fewer than the ordered amount of goods but bill for the amount ordered
130) Describe the similarities and differences between financial statement fraud and financial
statement manipulation.
131) Describe procedures or activities that a company can implement to minimize financial
statement fraud.
132) You have been hired by your client to investigate an alleged fraud case. Due to the complex
nature of your client’s transactions, you determined that it is necessary for you to obtain expert
opinions and analyses to aid your investigation.
Required:
a. Identify the qualifications that your expert will need to possess in order to serve as your expert
consultant.
b. Describe the conditions under which your expert will be permitted to testify based on Rule
702.