Study for the CFE as a single decision pipeline rather than four separate subjects. For every practice item, first decide whether it is asking a scheme, legal, investigative, or preventive question; then answer from that lens. Labeling the lens before reading the options is the habit this guide builds through scenarios, a decision table, and a self-check rubric.
Why the Same Fact Pattern Can Ask Four Different CFE Questions
CFE content spans financial transactions and fraud schemes, law, investigation, and fraud prevention and deterrence. One scenario can be answered from any of those lenses. Identifying the intended lens is the first decision in every practice item.
The four domains differ in what they do with a fact pattern. Financial transactions explain how a scheme works and which records it disturbs. Law defines what must be proven for an offense and whether evidence can be used. Investigation covers how to gather evidence and interview people defensibly. Prevention and deterrence ask which controls or conditions would stop the scheme from recurring. A question about the same dishonest purchasing manager is a different question depending on which of these it invokes.
Build the lens-labeling habit now. When you work practice items, cover the answer options, read the stem, and predict two things: which domain the item is drawn from and what that domain considers a complete answer. Then uncover the options and check whether one matches your prediction. Items whose stems mix lenses - a legal question embedded in an investigative scenario - deserve a second pass, because the distractors are often correct statements from the wrong lens.
The table below gives starter cues you can refine as you practice.
| Fact-pattern cue | Likely domain lens | What the best answer does |
|---|---|---|
| A scheme is described mechanically (who took what, through which records) | Financial Transactions and Fraud Schemes | Names the scheme mechanism and the records its concealment must touch |
| The item asks whether conduct is actionable or evidence is usable | Law | Works the elements or admissibility test instead of judging factual guilt |
| The item asks how to proceed once suspicion exists | Investigation | Orders steps so evidence stays intact and interviews stay neutral |
| The item asks what the organization should change afterward | Prevention and Deterrence | Selects a control that reduces opportunity or improves timely detection |
Predication: When Red Flags Justify Moving Forward
Predication is the set of circumstances that would lead a reasonable, prudent professional to believe fraud may have occurred. Red flags are individual warning signs; predication is the cumulative basis for expanded procedures. Separate the two before acting.
A red flag is an anomaly that might have an innocent explanation - a lifestyle change, an unusual vendor address, a shift in approval patterns. Predication emerges when multiple facts, taken together, would lead a reasonable professional to suspect fraud and to take further investigative steps. The fraud triangle - perceived pressure, perceived opportunity, and rationalization - helps you explain why a scheme could be occurring, but the presence of its elements is context and a prevention lens, not proof that a specific person committed a specific act.
Scenario 1 - the early confrontation. An accounts-payable analyst notices a purchasing manager approving invoices from a vendor registered to a mailbox address, and hears the manager recently bought an expensive car. The analyst's instinct is to confront the manager that afternoon and copy senior staff on an email listing the anomalies. That is the plausible mistake: a confrontation built on two red flags tips off the subject, invites an innocent explanation to harden into a story, can prompt destruction of records, and may expose the organization to a defamation claim. The better decision is to treat the observations as unverified indicators and quietly expand procedures first - pull the vendor master file, sample the invoices for supporting documents, review approval logs against receipt records. Those steps either generate predication or resolve the anomaly. Why it matters: the legitimacy of everything that follows, from document seizures to admission-seeking interviews, rests on the predication you built before you acted, not on the red flag that started the hunch.
- Red flag: a single anomaly with possible innocent explanations.
- Predication: cumulative circumstances supporting further investigative procedures.
- Proof: evidence sufficient to establish the elements - a different standard entirely.
Tracing Schemes to Their Accounting Footprints
Each occupational fraud mechanism leaves a characteristic trail in the books. Skimming hides in missing or altered revenue records; fraudulent disbursements inflate expenses; concealment requires offsetting entries. Match every scheme name to the records it must disturb.
Learn schemes by mechanism, not by memorized label. Skimming is off-book: cash is taken before it hits the accounting system, so the trail runs through sales summaries, voids, and unrecorded receivables. Lapping is a concealment rotation: receipts from one customer are applied to another's account, which shows up as aging receivables that never clear. Fraudulent disbursement schemes - billing, payroll, expense reimbursement - are on-book: false transactions enter the records and must be supported, authorized, and recorded, which is exactly where the examiner looks. The distinction between off-book schemes, which are hard to detect from the books, and on-book schemes, which leave entries to examine, drives which detection method fits which scheme.
Make the footprint the memorized unit. For each scheme you study, write down three things: the mechanism in one sentence, the records the scheme must touch to conceal itself, and one analytical test or data source that would surface it. Mind maps work well here - scheme in the center, concealment records on one branch, detection tests on the other. When a practice item describes a transaction pattern, resist naming the scheme first; instead ask which records would have to be false for this pattern to exist, then match that record set to the scheme it defines. This ordering also prepares you for investigation questions, because the records you identified become your document request list.
Legal Elements and Admissibility: Testing Proof, Not Guilt
Law items turn on two questions: are the elements of the offense satisfied, and is the evidence usable? Work the legal test before forming any view of the facts. Factual suspicion never substitutes for a missing element or an admissibility bar.
For fraud-type claims, practice running the elements deliberately: a false representation of a material fact, knowledge of its falsity, intent that the victim rely on it, justifiable reliance, and resulting damages. An item can fail on any single element - an honest but mistaken statement lacks knowledge, a lie told to someone who did not rely on it lacks reliance - and the correct answer addresses the failed element rather than the general dishonesty of the behavior. Also keep the procedural framing in mind: civil and criminal matters carry different burdens of proof, so the same facts can support different outcomes depending on the setting the item describes.
Scenario 2 - the secondhand statement. During a routine walk-through, a staff member tells the investigator, without the manager present, that the manager once admitted padding vendor invoices. The investigator's draft report cites this statement as evidence that the manager committed fraud. That is the mistake: the statement is secondhand - the witness is repeating what someone else said - so its value depends on whether the actual speaker can be located and questioned, and on whether any legal exception would let it be heard at all. The better decision is to treat the statement as an investigative lead: document when and how it was received, then go find the original speaker, take that person's direct account, and corroborate it with the vendor invoices and approval records themselves. Why it matters: a case anchored to secondhand statements can collapse when the declarant cannot be produced, while a case anchored to direct testimony and documents stands on its own regardless.
Investigation Sequence: Interviews and Evidence Handling
A defensible examination orders its work: secure and copy the records first, interview neutral and corroborative witnesses in the middle, and approach the subject with admission-seeking questions last. Evidence integrity - originals, copies, and custody documentation - is examined alongside technique.
Interview sequencing follows a logic you can reason through rather than memorize. Early interviews gather background and explain documents, so they use open, non-accusatory questions. Middle interviews corroborate what records suggested. The subject is interviewed last, after you know the documents, so questions can be precise and answers cannot be quietly rehearsed against evidence you have not yet collected. Statements should be captured in the interviewee's own words and, where appropriate, confirmed in writing, because an interview you summarize loosely is an interview the subject can later reinterpret.
Evidence handling runs in parallel. Preserve original documents, work from copies, and record who obtained each item, from whom, when, and how it was stored - the chain of custody that lets the item be attributed to a source later. For electronic records, keep the original intact and perform your analysis on preserved copies so the source data can be rechecked. Practice items often pair these rules with interview questions, so rehearse them together: a perfectly sequenced interview plan is worth little if the exhibits behind it have an unexplained custody gap, and vice versa.
Prevention and Deterrence: Changing the Environment, Not Blaming People
Prevention questions ask which change reduces opportunity, pressure, or rationalization going forward, or detects schemes earlier. Prefer answers that alter the control environment - segregation of duties, monitoring, governance - over answers that only react to the individual already caught.
Distinguish prevention from detection even though one control can do both. Segregation of duties and authorization limits are prevention: they shrink the opportunity a person has to commit and conceal a scheme in the first place. Reconciliations, data analytics, and surprise reviews are detection: they shorten the time a scheme can run unnoticed. When a stem asks what the organization should do after a scheme is discovered, check whether the option punishes the individual, detects similar schemes, or prevents them - the stem's own wording tells you which of the three is being tested.
Practical exercise - the predication rewrite. Take a short published fraud case summary, or a case note from your own work. Produce four items: first, a two-sentence predication statement describing only observable facts, with no accusations; second, the scheme mechanism named in one sentence; third, two specific records you would request next; fourth, one preventive control targeted at the condition that enabled the scheme. Then check your work against this rubric, one point each: the predication contains no conclusions about guilt; the mechanism is stated as a process rather than a label alone; the requested records are documents that plausibly exist; the control changes opportunity or detection rather than discipline. Score yourself across three different cases. A self-check of three or four points consistently is a learning milestone showing the pipeline is working - it is a study signal, not a prediction of any exam result.
A Five-Phase Preparation Sequence and Readiness Checks
Sequence study by decision, not by page count: scheme vocabulary, then legal tests, then investigative procedure, then integrated case practice, then mixed timed sets with lens labeling. A short note on administration: eligibility, fees, and scheduling are set by the issuer, so verify them at acfe.com rather than through secondary summaries.
Phase one builds scheme vocabulary with the footprint method from earlier: mechanism, concealment records, detection test. Phase two drills legal tests - elements of fraud, admissibility concepts, custody rules - as checklists you can run on any fact pattern. Phase three rehearses procedure: the interview sequence, evidence handling, and how a predication statement is written. Phases two and three can run partly in parallel because law questions and procedure questions use different mental moves. Keep each phase's length flexible to your background; someone who works in audit will move faster through phase one than someone who comes from law enforcement, and the reverse is equally true in phase three.
Phase four is where the pipeline comes together: work full case-style scenarios and force yourself to write, before answering, which lens each sub-question uses and what that lens considers a complete answer. Phase five is mixed timed practice - the free practice sets at lendingexam.com work well here - after which you return to any missed items and sort each miss into one of three causes: wrong lens identified, right lens but wrong test applied, or test known but not run to completion. Track the distribution across sessions; the mix tells you which phase to revisit. Pair this with the broader guides at lendingexam.com/study-guides when you want alternate framing on a domain that stays weak.
Readiness checks before you consider the material solid: you can label the domain lens of an unfamiliar practice item before reading its options; you can write a clean predication statement in two sentences without conclusions; you can state the elements of fraud and name the records each major scheme must touch; your rewrite exercise consistently meets three or four rubric points; and your missed-item causes are shifting from wrong lens toward execution details. Hitting these consistently is evidence of learning progress, not a guarantee about any particular sitting.
- Phase 1: scheme mechanisms mapped to concealment records and detection tests.
- Phase 2: legal tests as run-anywhere checklists.
- Phase 3: interview sequence, custody, and predication writing.
- Phase 4: integrated case practice with explicit lens labeling.
- Phase 5: timed mixed sets with missed-item cause tracking.
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.