Chapter 07
1. Which of the following is the last step in an investigation?
a.
Interview suspect
b.
Interview former employees
c.
Interview former buyers
d.
Perform surveillance
a
a.
b.
Incorrect. This step is done at the beginning of the investigation to collect information.
c.
Incorrect. This step is done during the investigation.
d.
Incorrect. This step is done during the investigation.
1
2. When investigating fraud, investigators should usually interview suspects:
a.
at the beginning of the investigation process to really put the heat on them.
b.
in the middle of the investigation process to make them feel that they are not really a suspect.
c.
at the end of the investigation process so that they can gather sufficient evidence against them.
d.
any time during the investigation process to avoid creating undue stress and suspicion among other employees.
c
a.
b.
c.
d.
1
3. Which of the following is NOT a method for theft investigation?
a.
Covert operations (surveillance)
b.
Electronic searches
c.
Invigilation
d.
Physical evidence
b
a.
b.
Correct. This is a method for concealment investigation.
c.
d.
1
4. Characteristics of invigilation include which of the following?
a.
A method of creating a loosely monitored environment to catch fraudulent activities.
b.
It is an inexpensive method to monitor all employees during the investigation process.
c.
It is most commonly used in such high-risk areas as expensive inventory.
d.
A method of watching and recording physical facts, acts, and movements.
c
5. Identify the best pattern/order to go about a theft investigation.
a.
Search public records, check personal records, interview suspect, interview former employers, and interview
other buyers.
b.
Check personnel records, interview former employers, search public records, ,interview other buyers, and
interview suspect.
c.
Interview suspect, interview former employers, search public records, check personal records, and interview
other buyers.
d.
Interview other buyers, check personal records, interview former employers, interview suspect, and search
public records.
b
a.
b.
Correct. This is the best order.
c.
d.
1
6. Which of the following is NOT a type of surveillance?
a.
Stationary or fixed point
b.
Audit
c.
Tailing
d.
Electronic surveillance
b
a.
Incorrect. This is a type of surveillance.
b.
c.
Incorrect. This is a type of surveillance.
d.
Incorrect. This is a type of surveillance.
1
7. Which investigation technique relies on a person’s senses, especially hearing and seeing?
a.
Invigilation
b.
Surveillance and covert operations
c.
Electronic evidence
d.
Obtaining physical evidence
b
a.
b.
c.
d.
b.
Incorrect. Invigilation is an investigative technique that can be expensive.
c.
1
8. Surveillance is usually used to investigate:
a.
Theft acts.
b.
Concealment possibilities.
c.
Conversion possibilities.
d.
Key internal controls.
a
a.
b.
c.
d.
1
9. What is invigilation?
a.
A theft investigation technique which records the physical evidence, facts, and movements, which form part of
a fraud.
b.
A theft investigation technique which involves close supervision of the suspects during the examination
period.
c.
A theft investigation technique which is used when large scale fraud is likely and other methods of
investigation fail.
d.
A theft investigation technique which involves confiscating and searching computers and other electronic
sources of information.
b
a.
Incorrect. This is surveillance.
b.
c.
Incorrect. This is undercover operation.
d.
1
10. Undercover operations should be used only when:
a.
large scale fraud is likely and other investigation methods fail.
b.
controls are made so strict that opportunities to commit fraud are virtually impossible.
c.
the investigation cannot be kept a secret.
d.
there is a need to develop theories about what kind of fraud has occurred.
a
b.
Incorrect. This situation warrants invigilation.
c.
d.
Incorrect. This is the primary step of the theft investigation process.
1
11. Which of the following statements is FALSE?
a.
Fraud investigations should begin in a manner that does not arouse suspicion.
1
Chapter 07
b.
Initially, investigators should avoid using words like investigation.
c.
The investigation process usually starts by approaching the suspect.
d.
Investigators should focus on gathering the strongest types of evidence.
a.
b.
c.
Correct. Approaching the suspect is one of the last steps in fraud.
d.
1
12. Subjects of covert operations are protected against unreasonable breaches of privacy under the ______ of the
constitution.
a.
Fourth Amendment
b.
Fifth Amendment
c.
Second Amendment
d.
Seventh Amendment
a.
Correct. The Fourth Amendment protects the right of a person against unreasonable searches.
b.
c.
d.
1
13. Which of the following is true about invigilation?
a.
The strict controls imposed are temporary in nature.
b.
During the period of invigilation, evidence is presented to suspects with the hopes of getting a confession.
c.
When invigilation is conducted, it is best to cover all aspects of the business.
d.
Invigilation should be accomplished in 5-7 days.
a.
b.
Incorrect. Suspects are never alerted to the real intent of invigilation until afterwards.
d.
Incorrect. Generally at least 14 days is recommended.
1
14. An investigator locates the scene that should be observed, anticipates the action that is most likely to occur at the
scene, and keeps detailed notes on all activities involving the suspect. Which type of surveillance is being used here?
a.
Static surveillance
b.
Electronic surveillance
c.
Stationary surveillance
d.
Moving surveillance
a.
15. In most investigations of a fraud suspect, investigators should begin by:
a.
Confronting the suspect.
b.
Checking personal and company records.
c.
Interviewing co-workers.
d.
Performing invigilation.
b
1
16. Undercover operations are costly and time-consuming and should be used with extreme care. In which of the
following situations would it be ineffective to conduct an undercover operation?
a.
When law enforcement authorities are informed
b.
When the investigation can be closely monitored
c.
When other investigation methods are available
d.
When the investigation can remain secretive
a.
Incorrect. Under this circumstance, undercover operations can be effective.
b.
Incorrect. Under this circumstance, undercover operations can be effective.
c.
d.
Incorrect. Under this circumstance, undercover operations can be effective.
1
17. A(n) ____ is a tool for explicitly considering all aspects of the fraud and for establishing fraud theories.
a.
Vulnerability chart
b.
Perceptual map
c.
Surveillance log
d.
Pareto chart
a.
b.
c.
d.
1
b.
c.
d.
1
18. Experts recommend that invigilation must continue:
a.
for at least 7 days.
b.
for at least 14 days.
c.
for at least 21 days.
d.
for an indefinite period determined by the individual investigator.
b
a.
b.
c.
d.
1
19. ______ means that there are symptoms or red flags that a fraud may be occurring.
a.
Predication
b.
Vulnerability
c.
Audit
d.
Presumption
a
a.
b.
c.
d.
1
20. Several factors are considered in deciding whether or not to investigate fraud. Which of the following is NOT one of
them?
a.
The signal that investigation or noninvestigation will send to others in the organization.
b.
Perceived cost of the investigation.
c.
Exposure or amount that could have been taken.
d.
Perceived strength of the predication.
e.
Preparation of a surveillance log.
e
a.
b.
c.
d.
e.
1
21. Which of the following is a form of surveillance that is usually only available to law enforcement officers?
a.
Surveillance using video cameras
b.
Wiretapping
c.
Stationary surveillance
Chapter 07
d.
Tailing
b
a.
b.
c.
d.
1
22. Which of the following are theft act investigative methods that usually involve observing or listening to potential
perpetrators?
a.
Audits
b.
Online resources
c.
Document examination
d.
Surveillance and covert operations
d
a.
b.
c.
d.
1
23. For fraud to occur, usually three elements are necessary: pressure, opportunity, and _______.
a.
excitement
b.
guidance
c.
rationalization
d.
money
c
a.
b.
c.
d.
1
24. What is the term for a calculation (using encryption technologies) based on the contents of a disk or file that are
engineered so that even small changes in the source data will produce significantly different checksum results?
a.
cyclic random check number
b.
cyclic redundancy check number
c.
cyclic repetition check number
d.
random variable check number
b
a.
b.
c.
d.
25. What is used in court cases to prove that data has not been adversely affected during analysis?
a.
Arithmetic mean
b.
Deviation measure
c.
Random sampling
d.
Checksums
d
a.
b.
c.
d.
1
26. The two primary checksum methods used today are:
a.
E-TTL I and E-TTL II.
b.
SSFDC and SDHC.
c.
MD5 and SHA-1.
d.
SSFDC and RS–232.
c
a.
b.
c.
d.
1
27. Which investigative method is most useful after you have gathered other types of evidence and know who to interview
and what questions to ask?
a.
Inquiry
b.
Theft
c.
Concealment
d.
Conversion
a
a.
b.
c.
d.
1
28. Which investigation technique usually does not work well in kickback situations?
a.
Concealment
b.
Theft
c.
Inquiry
d.
Conversion
1
Chapter 07
a
a.
b.
c.
d.
1
29. A divisional manager is suspected of adding ghost employees to the payroll. Which investigative method can most
easily uncover this type of fraud?
a.
Undercover operations
b.
Theft
c.
Concealment
d.
Conversion
c
a.
b.
c.
d.
1
30. Electronic surveillance may have only limited value in the investigation of employee frauds and many other white-
collar crimes. Why?
a.
Lack of adequate technology
b.
Concerns regarding employees’ privacy
c.
Prohibitively high cost of installation and maintenance
d.
Relative ease of tampering evidence
b
a.
b.
c.
d.
1
31. Which of the following is a basic objective of surveillance, whether manual or electronic?
a.
Identify victims of the fraud
b.
Analyze how the money comes back in the form of assets
c.
Understand the cover-up or concealment of fraud
d.
Catch fraud at the theft act stage
d
a.
b.
c.
d.
1
Chapter 07
32. Which general term refers to the gathering of electronic evidence?
a.
Checksum
b.
Online verification
c.
Electronic audit
d.
Computer forensics
d
a.
b.
c.
d.
1
33. Concealment investigative techniques do not work well in kickback situations. Why?
a.
The parties in the transaction will be hard to trace.
b.
Results of concealment investigative techniques are not admissible as evidence in courts.
c.
There is usually no direct documentary evidence.
d.
The risk involved in such investigations is unusually high.
c
a.
b.
c.
d.
1
34. Which of the following observations concerning physical evidence is TRUE?
a.
It is not useful in fighting fraud cases.
b.
It is more associated with nonfraud types of crimes.
c.
It is useful in fraud cases because fraud has physical symptoms.
d.
It does not involve electronic sources of information.
b
a.
b.
c.
d.
1
35. Identify the first step in any electronic evidence collection process.
a.
Seizure of the device
b.
Automated search of the device
c.
Clone the device
d.
Do a manual reconnaissance
a
POINTS:
1
36. Which step in the electronic evidence collection process is important to ensure that the original disk is kept in its
seized state?
a.
Evidence mapping
b.
Search
c.
Seizure
d.
Cloning
d
a.
b.
c.
d.
1
37. Which checksum method is considered more advanced and secure than the method it replaced?
a.
MD5
b.
CRC-1
c.
SHA-1
d.
CRC-2
c
a.
b.
c.
d.
1
38. What usually dictates which of the four common ways frauds are investigated is utilized?
a.
the method in which the selected investigator possesses the strongest expertise
b.
the method preferred by the investigator (the one he or she is most familiar with)
c.
the level of authority of the suspected perpetrator within the company
d.
the specific type of fraud committed
d
a.
b.
c.
d.
1
39. Which of the following is important regarding invigilation?
a.
b.
c.
d.
Chapter 07
a.
Invigilation should include all areas of the business.
b.
The time period for the invigilation should be at least one month.
c.
Past records should be analyzed in order to establish an operating profile for the invigilation.
d.
The investigator should make the decision regarding the temporary controls to be put in place for the
invigilation.
a
a.
Incorrect: only the impacted areas should be included.
b.
Incorrect: at least fourteen days is recommended.
c.
Correct: a history is necessary to create a profile.
d.
Incorrect: management makes this decision.
1
40. Which of the following is NOT a component of a vulnerability chart?
a.
listing assets that are missing
b.
concealment possibilities
c.
internal controls that had to be compromised
d.
identification of the suspected perpetrator
d
a.
Incorrect: this is part of the vulnerability chart.
b.
Incorrect: this is part of the vulnerability chart.
c.
Incorrect: this is part of the vulnerability chart.
d.
Correct: this is NOT part of the vulnerability chart.
1
41. Which of the following indicates an observed symptom fired flag) of fraud?
a.
An employee is unhappy with her pay.
b.
An employee is undergoing a messy divorce.
c.
An employee has bought a luxury car and some expensive jewelry.
d.
An employee was seen shredding documents after hours.
c
a.
Incorrect: this is a pressure only.
b.
Incorrect: this is a pressure only.
c.
Correct: this is an indication of excess cash to spend.
d.
Incorrect: although suspicious activity but not necessarily fraud.
1
42. Which of the following is a benefit of creating a vulnerability chart?
a.
It forces the investigators to explicitly consider all aspects of a fraud act.
b.
It conveys a warning to all employees that fraud will not be tolerated.
c.
It lists/coordinates the steps the investigator must take to uncover the perpetrator.
d.
It shows management where controls are weak.
a
a.
43. Which of the following is an increasingly popular form of gathering physical evidence of fraud?
a.
reviewing spending habits of the those possibly involved
b.
confiscating and searching computers
c.
tracking missing inventory through bar codes
d.
creating and viewing surveillance tapes
b
a.
b.
c.
d.
1
44. What is the term for gathering and analyzing electronic evidence?
a.
confiscating computers
b.
computer forensics
c.
electronic surveillance
d.
electronic investigation
b
a.
b.
c.
d.
1
b.
Incorrect. Most employees are not aware that the chart is being created.
c.
Incorrect. The vulnerability chart does not uncover the perpetrator.
d.
1