CFE Investigation: From Allegation to Defensible Findings

Fraud investigations often begin with a fragment of information: an anonymous complaint, an unexplained reconciliation difference, a missing document or a payment that does not fit the expected business process. None of those is a proven case. An examiner's task is to turn uncertainty into a disciplined factual inquiry, test competing explanations and communicate findings in a form that others can evaluate. That work requires planning, evidence management, interviewing, financial analysis and professional restraint.

“Investigation” was a separate subject area in the former four-part Certified Fraud Examiner exam. Since June 2, 2026, ACFE has used a redesigned three-section CFE exam, including a combined Fraud Investigations and Legal Issues section. The historical investigation page remains a useful way to study the underlying discipline, but it should not be described as a stand-alone current examination section. Candidates exploring ACFE certifications should check the issuer’s current assessment route.

Begin with an allegation, not a verdict

Suppose an internal auditor reports repeated payments to a vendor with little evidence of completed work. The report may justify an inquiry, but “the purchasing manager committed fraud” goes further than the evidence. A sound initial plan identifies testable propositions: Were services contracted and delivered? Who authorized the payments? Did the vendor exist independently? Were there connections among the supplier, employees and approval records? Were transactions structured to bypass control thresholds?

Investigators should also define the scope and authority of the work. A corporate internal review differs from a law-enforcement inquiry or a regulatory examination. A business may have policy rights to examine certain records but not unrestricted authority to search private devices or access unrelated accounts. At the outset, identify who commissioned the review, which issues it covers, the relevant records, legal constraints, preservation needs and escalation requirements.

Develop a hypothesis matrix rather than relying on one story. An apparent fictitious vendor might reflect a genuine consultant with poor filing practices, an unauthorized purchase, billing error, conflict of interest or deliberate diversion of funds. Each explanation predicts different records and behavior. The investigation should seek evidence capable of disproving its preferred account, not simply material that confirms a suspicion.

Early case triage also requires judgment about risk. If critical records are at risk of deletion or an active payment process could continue causing loss, an authorized team may need prompt preservation or control action. That does not excuse broad, unnecessary access or premature accusations. Urgency should change the order of lawful steps, not the standard of accuracy.

Evidence preservation begins before the first interview

Financial and digital records are only as useful as their integrity. An email screenshot without metadata may be easy to misinterpret. A spreadsheet copied and edited during analysis may no longer be a reliable original. Transaction records can have time-zone differences, incomplete fields or altered reference numbers after system migrations. Before drawing conclusions, examiners must know where data came from, how it was obtained and what transformations occurred.

A basic evidence record should capture provenance, acquisition timing, authorized handlers, storage and significant processing steps. For digital files, suitable preservation methods can include maintaining originals, using verified forensic processes where appropriate and recording technical integrity checks. The precise procedure depends on the evidence, legal environment and authorized investigation method. The key principle is reproducibility: a reviewer should be able to distinguish the original record from an analyst's working copy.

Records from enterprise systems demand additional care. A vendor ledger may contain invoice dates, posting dates, payment dates and approval timestamps with different meanings. Anomalies may arise because of system settings rather than intentional manipulation. The examiner should reconcile definitions before comparing datasets; otherwise a false assumption about dates can manufacture an apparent sequence that never happened.

Evidence relevance matters as much as volume. Downloading every employee's mailbox may be unnecessary, invasive and legally problematic when a limited set of purchasing correspondence would test the allegation. A targeted and documented acquisition strategy reduces privacy exposure and helps the investigation remain focused.

Follow the transaction beyond the accounting entry

A journal entry records an accounting event; it does not by itself prove what the underlying business event was. For a vendor payment, examine the purchase request, contract, evidence of receipt, invoice, approval chain, bank instructions and subsequent reconciliation. If a document is missing, ask whether it never existed, was legitimately stored elsewhere or was removed. The inference matters because the same accounting anomaly can have several explanations.

Investigators benefit from mapping both a transaction trail and a decision trail. The transaction trail shows the movement of value. The decision trail shows which people or systems initiated, approved, changed and reviewed each step. A suspicious payment may be explained by error at an upstream approval stage rather than misconduct by the person whose name appears last on the bank batch.

Analytical techniques can find records worth investigating. Matching vendor bank accounts, examining unusual invoice sequences, identifying changes shortly before payments and comparing access privileges with transaction activity are often informative. But the method must be adapted to the business. A shared bank account might be legitimate for affiliated entities; several payments just below a threshold may reflect contractual milestones. The examiner must obtain corroboration before inferring deliberate evasion.

Knowing common fraud schemes and financial transactions helps investigators recognize why funds may move through intermediaries, split among invoices or be supported by misleading records. The current CFE structure assesses that knowledge separately from the now-integrated investigation-and-legal-issues material.

Interviewing is a test of information, not a contest

Interviews can clarify ambiguous documents, reconstruct workflows and reveal facts that records do not capture. Their purpose is not to force a predetermined admission. Begin by understanding what the person is likely to know and which facts require confirmation. An interview with a payroll administrator will differ from one with a procurement approver or an employee accused of misconduct.

Neutral, open questions often provide a better starting point than accusations. “Walk me through how a supplier is approved” can reveal responsibilities and exceptions; “Why did you approve this fraudulent invoice?” assumes the very conclusion under investigation. As the interview progresses, precise questions should test dates, documents, decision points and contradictions. The interviewer should distinguish what the witness saw personally from what they inferred or heard from someone else.

Notes and recordings must comply with organizational policy and applicable law. Investigators should preserve the substance and context of responses, including uncertainty and corrections. A dramatic single sentence taken out of context can distort a statement. When a witness revises an earlier account, that does not automatically establish deception; memory, newly reviewed records and misunderstanding are also possible explanations.

Professional skepticism operates in both directions. Some witnesses may intentionally mislead; others may be mistaken; an accused person may provide exculpatory evidence that deserves testing. A fair inquiry gives potentially material contrary evidence a place in the file. The examiner's credibility depends on willingness to revise a hypothesis when the record requires it.

Connecting digital, financial and human evidence

Modern workplace cases often involve multiple data systems. A purchasing approval could be entered through an enterprise application, supported by an email and followed by a payment initiated through a banking portal. User IDs, shared credentials and automated workflow accounts complicate attribution. A system log may show which credential performed an action, but additional evidence may be needed to establish who controlled that credential at the time.

Timing analysis can be decisive but fragile. Servers may store UTC timestamps while business users see local dates. Logs can be retained for different periods, and an application's displayed “last modified” field may not represent the first creation event. Examiners should document time conversion and any gaps rather than presenting a timeline with unsupported precision.

When assembling a narrative, use propositions supported by identified evidence. For example: “the vendor bank details changed two days before payment, following a request from this account,” is narrower and more useful than “the employee orchestrated theft” if the latter remains unproven. Separate the chronology from hypotheses, open questions and legal conclusions. A report should help decision-makers assess strength and limitations rather than conceal uncertainty behind confident prose.

Legal boundaries are part of the investigative method

The integration of legal issues into the redesigned CFE section reflects a practical truth: a well-meaning investigation can become indefensible if evidence is obtained unlawfully or procedural rights are ignored. Issues may include confidentiality, data protection, employment practices, privilege, admissibility, preservation duties and the different powers of private investigators and public authorities. There is no single global rulebook that resolves all such questions.

The historically separate CFE law subject is essential to evaluating whether a record can be accessed, how an interview should be conducted and when an issue requires qualified legal advice. Certification does not confer law-enforcement powers or authority to practice law.

Investigations should also avoid confusing disciplinary standards with criminal proof. Organizations can have internal policies and employment processes that evaluate conduct differently from a court. A report can document what the organization found and which policy concerns arise without claiming to resolve every criminal element or jurisdictional question.

Writing findings that withstand scrutiny

A useful final report usually identifies the allegation and scope, the procedures used, the evidence reviewed, the factual findings, limitations and relevant recommendations or referrals within the mandate. The wording should distinguish confirmed facts, credible but unresolved indications and unsupported allegations. Supporting schedules need clear definitions and reconciled totals; charts should not disguise missing data.

Imagine an investigation that identifies $180,000 in payments to a questionable vendor. It would be inaccurate to call the entire amount a proven loss if some legitimate services may have been provided. The report may instead identify the payments reviewed, the amounts lacking support and what additional records would resolve uncertainty. Precision is more persuasive than overstated certainty.

The examiner's work does not necessarily end with a report. Authorized management may need to correct a control weakness, preserve records, refer a matter for legal advice, or revisit similar transactions. Those actions should be assigned through appropriate governance rather than executed unilaterally by the investigator. A good case reveals how a process failed, not simply who first raised the concern.

Preparing for the current CFE investigation questions

Use ACFE's latest official three-section outline and identify the investigation and legal elements assessed together. Practice with short case files containing payment records, contradictory interview accounts, system logs and potential legal restrictions. For each scenario, ask what the next lawful and proportionate step is, which evidence would resolve a hypothesis, and what the examiner should not infer from the available facts.

Review incorrect answers by mistake category: premature conclusion, poor scope control, unreliable evidence, interviewing bias, incorrect transaction interpretation or disregard of legal constraints. Rework the case with altered facts so you test the governing principle rather than memorizing a preferred answer. That approach prepares candidates for both the revised assessment and the reality of conducting defensible fraud examinations.