CHAPTER4 A company's control environment includes:

a) the tone that management establishes

People will often be dishonest if they are placed towards what is honest and acceptable
in an environment of: behavior
a) poor controls
b) corporate hiring practices
b) high pressure c) having an internal audit department
c) low integrity d) all of the above
d) loose accountability
e) all of the above d) all of the above

e) all of the above Which of the following factors generally results

Which of the following factors contribute to
creating a corporate culture of honesty and
openness?
a) hiring honest people
b) performing criminal background checks
c) not having an open-door policy
d) having well-understood and respected code
of ethics
e) both a and d
f) all of the above
e) both a and d
Which of the following personnel and operating
policies contribute to high-fraud environments?
a) management by crisis
b) rigid rules
c) high employee lifestyle expectations
d) poor promotion opportunities
e) all of the above
e) all of the above
The single most effective tool in preventing and
detecting fraud is usually:
a) monitoring employees
b) having a good system of internal controls
c) having a well-written company code of ethics
d) following strict hiring procedures
b) having a good system of internal controls
in a high-fraud environment?
a) hiring honest people
b) providing an EAP
c) autocratic management
d) both a and b
c) autocratic management
Which of the following aspects of fraud usually
results in the largest savings?
a) fraud prevention
b) fraud detection
c) fraud investigation
d) it is impossible to tell
a) fraud prevention
Which of the following is usually the most
effective tool in preventing and detecting
fraud?
a) discouraging collusion between employees
and customers or vendors
b) effective investigations of fraud symptoms
c) having a good system of internal controls
d) creating an expectation of punishment in the
company
c) having a good system of internal controls
Which of the following is the typical fraud
model that describes most firms?
a) fraud incident, assessing risk, investigation,
reporting
b) fraud incident, investigation, action,
resolution
c) assessing risk, fraud incident, investigation,
resolution
d) assessing risk, investigation, implementing a
fraud program, reporting
b) fraud incident, investigation, action,
resolution
The "tone at the top" is an important element in
fighting fraud, which involves:
a) doing a good job of integrity risk assessment
b) having a positive organization where
effective fraud teaching and training is
conducted
c) setting a proper example or modeling
appropriate management behavior
d) both b and c
c) setting a proper example or modeling
appropriate management behavior
Which of following is NOT a recognized method
of eliminating fraud opportunities?
a) having good internal controls
b) monitoring employees
c) creating an expectation of punishment
d) engendering employee goodwill by having lax
rules
d) engendering employee goodwill by having lax
rules
Which of the following is NOT a reason
identified by Deloitte why whistle-blowing
systems fail?
a) lack of anonymity
b) pressure to comply
c) culture
d) lack of awareness
b) pressure to comply
Alerting vendors and contractors to company
policies often result in:
a) loss of interest in the organization by vendors
b) discovery of current frauds and the
prevention of future frauds
c) strained vendor/purchaser relationships
d) heightened incidence of recurrent reverse
vendor frauds
b) discovery of current frauds and the
prevention of future frauds
Even with the right opportunity or significant
pressure, most people would probably not steal
or embezzle.
false
Studies show that a positive and honest work
culture in a company does little to prevent
fraud.
false
An important factor in creating a culture of
honesty, openness, and assistance in the
workplace is maintaining an employee
assistance program.
true
A good internal control system within a
company can ensure the absence of fraud.
false
When fraud is committed, the problem is often
not a lack of controls, but the overriding of
existing controls by management and others.
true
The two elements in creating a positive work
environment are (1) having an open-door policy
and (2) having positive personnel and operating
procedures.
false

Not prosecuting fraud perpetrators is cost-

effective both in the short run and the long run.

false

Even a good system of internal controls will

often not be completely effective because of
fallibilities of the people applying and enforcing
the controls.

true

The increasingly complex nature of business

helps to decrease the number of collusive
frauds.

false

Tips and complaints are the most common way

fraud is detected.

true

The major role of employee assistance

programs is to help employees recover from the
damaging psychological effects of fraud.

false

Not all possible controls should be

implemented; rather, one must assess a
control's cost and benefits before
implementation.

true

Creating an expectation of punishment causes

firm morale to deteriorate and often results in
lower productivity.

false
CHAPTER5
Which of the following is true regarding fraud?
a) it is easily identified
b) it is seldom observed
c) when a fraud occurs, there is no question
whether or not a crime has been committed
d) many witnesses are usually available when
fraud occurs
b) it is seldom observed
Which of the following is NOT a fraud symptom
related to source documents?
a) duplicate payments
b) missing documents
c) a tip from an employee
d) photocopied documents
c) a tip from an employee
Which of the following is a fraud symptom
related to an internal control weakness?
a) lack of proper authorization
b) lack of independent checks
c) inadequate accounting system
d) lack of physical safeguards
e) all of the above are fraud symptoms related
to internal controls
e) all of the above are fraud symptoms related
to internal controls
In the three elements of fraud (theft act,
concealment, conversion), who is usually in the
best position to detect the fraud?
a) co-workers and managers
b) customers
c) owners
d) vendors
a) co-workers and managers
When a person commits a crime:
a) he or she usually becomes engulfed by
emotions of fear and guilt
b) he or she will experience no changes in
behavior
c) he or she usually becomes friendly and nice
d) he or she experiences a lower stress level
a) he or she usually becomes engulfed by
emotions of fear and guilt
Most people who commit fraud:
a) use the embezzled funds to increase their
savings account
b) give the embezzled funds to charity
c) experience o change in their lifestyle
d) use the embezzled funds to improve their
lifestyle
d) use the embezzled funds to improve their
lifestyle
Which of the following is NOT a reason why
people are hesitant to come forward with
knowledge or suspicions of fraud?
a) they often think that squealing on someone is
wrong
b) they fear reprisal for being a whistle-blower
c) it is usually impossible to know for sure that a
fraud is taking place
d) people who report fraud are not rewarded
monetarily
d) people who report fraud are not rewarded
monetarily
Which of the following is NOT one of the
categories of employee fraud symptoms?
a) accounting anomalies
b) analytical anomalies
c) tips and complaints
d) firm structure
d) firm structure
Embezzlement of assets reduced the left side of
the accounting equation. To conceal the theft,
the embezzler must find a way to reduce the
right side of the accounting equation. A
perpetrator would most likely reduce the right
side of the equation by:
a) reducing accounts payable
b) paying dividends
c) increase expenses
d) altering stock accounts
c) increase expenses
Which of the following is NOT a fraud symptom
related to journal entries?
a) unexplained adjustments to receivables,
payables, revenues, or expenses
b) journal entries that do not balance
c) journal entries without documentary support
d) journal entries made near the beginning of
accounting periods
d) journal entries made near the beginning of
accounting periods
Which of the following is NOT a common
internal fraud symptom or problem?
a) lack of segregation of duties
b) unexplained adjustments to receivables,
payables, revenues, or expenses
c) lack of independent checks
d) overriding of existing controls
b) unexplained adjustments to receivables,
payables, revenues, or expenses
Once in a while, someone commits fraud or
another crime and does not feel stress. Such
people are referred to as:
a) psychopathic
b) altruistic
c) philanthropic d) increase expenses

d) magnanimous

a) psychopathic Which of the following is a common fraud

symptom relating to ledgers?

a) a ledger that does not balance

Fraud is usually detected by recognizing and
pursuing: b) a ledger that balances too perfectly

a) synonyms c) master account balances that do not equal

the sum of the individual customer or vendor
b) symptoms balances
c) equity d) both a and c
d) legends d) both a and c
b) symptoms

Which element is NOT a common element of

A letter is most likely to be fraudulent if: fraud?

a) it is signed by only one person a) concealment

b) it is addressed to an individual, rather than a b) coercion

department c) conversion
c) it is a photocopy of an original letter d) theft act
d) it is written on outdated company letterhead e) all of the above are common elements of
c) it is a photocopy of an original letter fraud

b) coercion

If a perpetrator has stolen assets, which of the

following is the easiest method for concealing
Analytical anomalies are present in every fraud.
the theft?
false
a) reduce liabilities (such as payables)

b) manipulate dividend or stock accounts

Recording an expense is a possible way to
c) increase other assets (such as receivables) conceal the theft of cash.
d) increase expenses true
A check is an example of a source document. Psychopaths feel no guilt because they have no
conscience.
true
true

Internal control weaknesses give employees

opportunities to commit fraud. It is safe to assume that fraud has not occurred
if one or more elements of the fraud triangle
true cannot be observed.

The internal control system of an organization is
comprised of the control environment, the
accounting system, and control procedures
(activities).
false
The three elements of a typical fraud consist of
concealment, conversion, and completion.

true false

Analytical fraud symptoms are the least Auditors can best help detect fraud at the
effective way to detect fraud. conversion stage.

false false

Most people who commit fraud use the Some complaints and tips turn out to be
embezzled funds to save for retirement. unjustified.

false true

As fraud perpetrators become more confident Fraud is a crime that is seldom observed.
in their fraud schemes, they usually steal and
spend increasingly larger amounts. true

true
Because of the nature of fraud, auditors are
often in the best position to detect its
First-time offenders usually exhibit no occurrence.
psychological changes.
false
False
Most people who commit fraud feel a perceived Fraud perpetrators often live beyond their
financial pressure. means since their income does not support
their lifestyle.
true
true

Studies have found that the most common

internal control problem when frauds occur is
having a lack of proper authorizations.
false
Nearly all individuals and organizations are
subject to real or perceived pressures and can
rationalize.
True

Fraud perpetrators who manipulate accounting

records to conceal embezzlements often
attempt to balance the accounting equation by
recording expenses.

true

Employee transfers, audits, and mandatory

vacations are all ways to provide independent
checks on employees.

true

New whistle-blowing laws have helped make

tips and complaints more effective.

true

Co-workers are usually in the best position to

detect fraud.

true
CHAPTER6
When detecting fraud,it is important that fraud
investigators:
a. remain objective and neutral
b. assume guilt
c. assume guilt
c. assume innocence
d. none of the above
remain objective and neutral
Data-driven fraud detection:
a) determines the cost of fraud
b) identifies possible fraud suspects
c) looks for anomalies in databases
d) all of the above
looks for anomalies in databases
once a buyer starts accepting kickbacks from a
supplier:
a. prices often increase
b. purchases from other vendors often decreae
c. the supplier usually takes control of the
purchasing relationship
d. all of the above
prices increase, purchases from other vendors
often decrease, supplier usually takes control of
the purchasing relationship
The most obvious disadvantage of the data-
driven approach is:
a. databases are very large and often cannot be
analyzed using analysis packages like ACL, IDEA,
or ActiveData
b. high cost
c. the decrease in employee morale
d. none of the above
high cost
Benford's law
a. is usually unsuccessful as a fraud detection
tool
b. predicts that the first digit of random number
sets will begin with a 1 more often than a 2, a 2
more often than a 3, and so on
c. applies to personal ID numbers
d. all of the above
predicts that the first digit of random number
sets will begin with a 1 more often than a 2, and
a 2 more often than a 3 and so on
a detection method that focuses on the kinds of
frauds that can occur and then uses technology
to determine whether those frauds actually
exist is called:
a. fishing fraud detection
b. data mining
c. data-driven fraud detection
d. benford's law
data-driven fraud detection
when deciding which detection method to use,
it is important to:
a. determine the advantages and disadvantages
of each approach
b. identify the costs involved
c. determine which method will meet the
client's objectives
d. all of the above
determine the advantages and disadvantages of
each approach, ID costs involved, determine
which method will meet the client's objectives
fraud is best detected through the financial
statements by focusing on

a. unexplained changes in financial statement
balances
b. consistencies
c. intuition
d. management's behavior when financial
statements are released
unexplained changes in financial statement
balances
The most effective way to convert balance
sheets and income statements from position
and period statements to change statements is
to
a. compare balances in the statements from
one period to the next
b. calculate key ratios and compare them from
period to period
c. perform horizontal and vertical analyses
d. all of the above
Perform horizontal and vertical analyses
Profit, margin, return on assets, and return on
equity are all examples of:
a. vertical analysis
b. key financial statements ratios
c. horizontal analysis
d. none of the above
Key financial statement ratios
When vertical analysis is performed:
a. ratios are used to detect fraud
b. changes in significant balance totals are
examined
c. financial statements balances are converted
to percentages
d. total revenues are compared to total
expenses
Financial statement balances are converted to
percentages
Horizontal analysis is different from vertical
analysis in that:
a. there is no difference between horizontal and
vertical analysis
b. horizontal analysis calculates the percentage
change in balance sheet and income statment
numbers from one period to the next, while
vertical analysis converts balances in a single
period to percentages
c. horizontal analysis converts balances in a
single period to percentages, while vertical
analysis calculates the percentage change in
balance sheet and income statement numbers
from one person to the next
d. key ratios are compared from one period to
the next
Horizontal analysis calculates the percentage
change in balance sheet and income statement
numbers from one period to the next, while
vertical analysis converts balances in a single
period to percentages
Which of the following is an advantage of using
data analysis software to detect fraud
a. it is a static approach, and results cannot be
recombined in different ways
b. data analysis software can only be used to
analyze small data sets
c. Data analysis software can analyze entire
populations rather than just samples
d. significant numbers of hits can occur,
requiring iterative refinement of analyses
Data analysis software can analyze entire
populations rather than just samples
Benford's Law is:
A. The most expensive of all the digital analysis
methods to implement and use.
B. The most effective way to identify actual
frauds.
C. A method that uses vertical financial
statement analysis.
D. An effective way to identify anomalies in data
sets.
An effective way to identify anomalies in data
sets
When conducting financial statement analysis,
which ratio will be the most useful in
determining whether a company has
erroneously inflated accounts receivable
a. current ratio
b. profit margin
c. accounts receivable turnover
d. debt percentage
accounts receivable turnover
when trying to identify outliers, what is one of
the best statistical approaches
a. a pie graph indicating the relative amounts
b. stratification of cases by value
c. time trending using the high-low slope
method
d. the z-score calculation
z-score calculation
an advantage of using ODBC to import data into
a data warehouse is that:
a. ODBC doesn't require the use of corporate
database servers
b. ODBC compresses data when stored on the
CD or DVD
c. ODBC automatically retrieves column names
and types from the database
d. ODBC keeps the investigator from dealing
with the difficult SQL language
ODBC automatically retrieves column names
and types from the database
the soundex algorithm
a. uses consonants but ignores vowels
b. creates numerical score representing how a
word sounds
c. is useful when fuzzy matching values
d. all of the above
uses consonants but ignores vowels, creates a
numerical score representing how a word
sounds, is useful when fuzzy matching values
unusual patterns always indicate the existence
of fraud
F
ODBC is the best approach to import because it
achieves a direct, rich connection to the source
database
T
data-driven analysis uses the company's
database to search for normal relationships
between numbers
F
according to Benford's law, the first digit of
natural sets of numbers will begin with a 9 or
more often than with an 8
F
when using Benford's law, potential suspects
are less likely to know you are trying to detect
fraud than if you use more direct detention
techniques
T a single symptom (red flag) is almost always
enough information to identify the type of fraud
Understanding the kinds of frauds that can scheme occuring
occur is not important when using a data-driven
detection method F

F If a search reveals that an employee and a

vendor have the same telephone number, this
digital analysis using Benford's law can be result may indicate that:
performed on databases of any size

T a. vendors are overcharging for goods

purchased
data-driven fraud detection can pay large b. employees may be establishing dummy
dividends and is an effective way to reduce the vendors
cost of fraud in any organization c. contractors are billing at the wrong rates
d. a vendor is receiving kickbacks or other
T
favors
unexplained changes are common in financial
b. employees may be establishing dummy
statements
vendors
F

balance sheets must be converted to change

statements before they can be used in detecting
fraud

vertical analysis is a more direct method than

horizontal analysis in focusing on changes in
financial statements from one period to another

vertical analysis is a useful detection technique

because percentages are easily understood

the z-score calculation is the best way to stratify

data

F
CHAPTER7
The fraud triangle plus inquiry paradigm is an
effective way to understand the various types of
investigative methods.
True
One advantage of using a vulnerability chart is
that it forces investigators to consider all
aspects of a fraud.
True
Electronic surveillance if often of limited value
in the investigation of employee fraud because
of concerns regarding employees' privacy rights
True
Surveillance is a theft investigation technique
that relies on the examination of documents
False. Surveillance is a technique for
investigating theft that relies on watching and
recording activities of individuals, not studying
documents
Mobile observation is usually much more risky
than stationary surveillance
True
During invigilation, no controls are imposed on
any activity
False. During invigilation, strict controls are
imposed on activities being studied.
Surveillance logs should always be drafted
before an investigation begins
False.
Not only are undercover operations both legal
and valid, but they are also inexpensive
False. Undercover operations are extremely
expensive.
Investigation of fraud should only take place
when predication has first been established.
True
If possible, when using theft act investigation
methods, interviewing the prime suspects
should happen last
True
Tailing includes the use of video, e-mail,
wiretapping, and access to PCs
False. E-mail, wiretapping, and access to PC's
are used in electronic surveillance. Tailing
involves following someone with audio or video
recording devices.
Invigilation is a theft act investigative technique
that involves close supervision of suspects
during an examination period
True
To get an accurate reading, it is generally
agreed that the invigilation period should be at
least four days in length
False. Is should be at least 14 days in length
In determining which investigative method to
use, it is most important that investigators focus
on the costs of each possible method.
False. Investigators should focus on the
strongest type of evidence in determining which
method to use.
seizing and searching computers is illegal
because it infringes on the rights guaranteed by
the Fourth Amendment to the Constitution
False
It is impossible to retrieve the data from a file
that has been deleted on a computer
False. When a file is deleted, the space is only
made available for overwriting. The original
data remains in the disk until another program
uses the freed space to write something new.
The SHA-1 checksum method is more advanced
and is considered more robust than the MD5
method.
True.
Which of the following is NOT a category used
in the fraud triangle plus inquiry paradigm?
a. theft investigative techniques
b. concealment investigatigve techniques
c. action investigative techniques
d. conversion investigative techniques
Action investigative techniques
When beginning an investigation, fraud
examiners should use techniques that will:
a. not arouse suspicion
b. identify the perpetrator
c. determine the amount of the fraud
d. identify when the fraud occured
Not arouse suspicion
When conducting interviews during an
investigation, which of the following words
should usually be avoided?
a. audit
b. inquiry
c. investigation
d. record examination
Investigation
When beginning a fraud investigation, which of
the following methods is most useful in
identifying possible suspects?
a. preparing an identification chart
b. preparing vulnerability chart
c. preparing a surveillance log
d. hiring a private investigator to tail the subject
Preparing a vulnerability chart
Invigilation:
a. is most commonl used when investigating
crimes that involve the taking of physical assets
b. can create tremendous amounts of
documentary evidence
c. provides evidence to help determine whether
fraud is occurring
d. all of the above are ture
Provides evidence to help determine whether
fraud is occurring
Which of the following is not a theft
investigative method?
a. invigilation
b. honesty testing
c. seizing and searching computers
d. surveillance and covert operations
Honesty testing
When deciding whether or not to investigate,
which of the following factors should an
organization not consider?
a. possible cost of the investigation
b. perceived strength of the predication
c. possible public exposure resulting because of
the investigation
d. all of the above should be considered
Possible public exposure resulting because of
the investigation
Perceived strength of the predication
Possible cost of the investigation
Surveillance, when properly performed, is done:
a. Without the perpetrator's knowledge
b. During nonworking hours
c. Only by law enforcement agents
d. None of the above
Without the perpetrator's knowledge
Which of the following is not included in a
vulnerability chart?
a. explanations of the fraud triangle in relation
to suspects of fraud
b. breakdowns in key internal controls that may
have created fraud opportunities
c. internal controls that a company plans to
institute in the future
d. theft act investigation methods
Internal controls that a company plans to
institute in the future
A vulnerability chart:
a. forces investigators to explicitly consider all
aspects of a fraud
b. shows the history of fraud in a company
c. identifies weaknesses in every aspect of a
companys' internal control
d. gives a detailed record of all the movements
and activites of the suspect
Forces investigators to explicitly consider all
aspects of a fraud
Fixed-point, or stationary, observations can be
conducted by:
a. certified fraud examiners
b. company personnel
c. private investigators
d. anyone, if conducted properly
Anyone
Surveillance logs should include all of the
following except:
a. time the observation began and ended
b. cost of the surveillance equipment used
c. movements and activities of the suspect
d. distance the observation was from the scene
Cost of the surveillance equipment used
Wiretapping, a form of electronic surveillance,
can be legally used by:
a. internal auditors
b. company controllers
c. CPAs.All of the above
d. none of the above
No CPAs, company controllers, internal auditors
can use it
Which theft investigative method is most
limited in value during employee fraud
investigations because of concerns regarding
employees' privacy at work?
a. electronic surveillance
b. invigilation
c. forensic accounting
d. interviewing and interrogation
Electronic surveillance
Who should be consulted before any form of
surveillance takes place?
a. public investors and the company's board of
directors
b. state attorney general
c. legal counsel and human resources
d. all company executives

Legal counsel and human resources

When seizing computers, a calculation (also

called a hash) that ensures you have an exact
clone and have not changed data is called a(n):

a. NIST number
b. ODBC connection
c. internet packet calculation
d. CRC checksum number

CRC checksum number

A snapshot of active memory should be done:

a. Before seizure of the computer

b. After seizure of the computer but before
turning off the computer
c. After turning off the computer but before
calculation of the checksum number
d. After calculation of the checksum number
but before searching

After seizure of the computer but before

turning off the computer

Now that many companies are storing their

data "in the cloud" it is easier to access the
electronic data of suspected perpetrators.

False
CHAPTER8
In a fraud investigation, documents:
a) Usually contain extremely valuable
information
b) Are rarely used in court
c) Are not reliable sources of information
d) Are only valuable in obtaining a confession
a) Usually contain extremely valuable
information
Chain of custody refers to:
a) Marking on a document so it can be
identified later
b) A record of when a document is received and
what has happened to it since its receipt
c) Databases used in trials to assist lawyers
d) The way in which courts are organized
b) A record of when a document is received and
what has happened to it since its receipt
Marking documentary evidence is important to
ensure that:
a) Documents are legal
b) Databases can be created with valuable
information
c) Documents can be identified later
d) Marking documentary evidence is not
important
c) Documents can be identified later
Discovery sampling:
a) Is a type of variable sampling
b) Is one of the more difficult statistical
sampling methods to understand
c) Is never used in conducting a fraud
examinations
d) Deals with the probability of discovering at
least one error in a given sample size if the
population error is a certain percentage
d) Deals with the probability of discovering at
least one error in a given sample size if the
population error is a certain percentage
Documentary evidence such as private tax
returns can usually be obtained only by:
a) Subpoena
b) Search warrant
c) Voluntary consent
d) All of the above
d) All of the above
Which of the following is not true regarding
document experts?
a) They can usually determine whether a
document was written by the person whose
signature the document bears
b) They can usually determine whether a
document has been forged
c) They can usually determine whether the date
the document bears is the date the document
was written
d) All of the above are true statements
d) All of the above are true statements
Which of the following is not a benefit of
statistical sampling?
a) It allows auditors to be certain that fraud
does not exist in a population
b) It is helpful when populations are large
c) It allows quantification of risk
d) It allows inference about a population
a) It allows auditors to be certain that fraud
does not exist in a population
Which of the following methods of gathering
documents is based primarily on luck?
a) Documents discovered during audits
b) Hard-to-get private documents that are
subpoenaed
c) Documents discovered through searching
public sources
d) Documents provided by tipsters
d) Documents provided by tipsters
Which of the following is true of graphologists?
a) They can only perform their work in
laboratory settings
b) They perform the same type of work as
forensic document experts
c) They study handwriting as a way to interpret
and identify personalities
d) They are required to be members of the
ABFDE organization
c) They study handwriting as a way to interpret
and identify personalities
What can a fraud examiner conclude if one or
more instances of fraud are found in a sample
taken from a population?
a) There is a slight risk that fraud exists in the
population
b) The population contains fraud
c) The sample may not have been randomly
selected, and thus no conclusions can be drawn
d) The sample is most likely not representative
of the population as a whole
b) The population contains fraud
What can a fraud examiner conclude if his or
her tests confirm that no instances of fraud are
present in a sample taken from a population?
a) There is virtually no risk that fraud exists in
the population
b) The population contains no fraud
c) Only that no fraud is present in that particular
sample
d) The sample is most likely not representative
of the population as a whole
c) Only that no fraud is present in that particular
sample
How are most frauds concealed?
a) By shredding source documents
b) By converting to a paperless office without
paper transactions
c) By creating fictitious documents or altering
source documents
d) By firing employees who will not go along
with the fraud
c)By creating fictitious documents or altering
source documents
Which of the following is usually the best way to
obtain documentary evidence?
a) Computer-based queries of full population
accounting and other databases
b) A statistically sound sampling approach like
discovery sampling
c) Chance, accident, or tip discovery
d) None of the above are effective methods of
discovering evidence
a) Computer-based queries of full population
accounting and other databases
Programs like CaseMap, CaseCentral, ZANTAZ,
Ringtail, and DatiCon are examples of:
a) Software that implements discovery sampling
techniques
b) Link analysis software
c) Software packages used to index and store
evidence
d) Forensic software used to investigate hard
drives and other digital devices
c) Software packages used to index and store
evidence
Concealment is the covering of tracks, obscuring
of evidence, and removal of red flags to hide a
perpetrators fraud.
True
Checks are excellent sources of physical
evidence.
False
Traditional chain of custody evidence
procedures are not appropriate when used with
electronic evidence.
False
Photocopies are always preferable to original
documents as evidence.
False
There is no difference between forensic
document and experts and graphologists.
False
Evidence should be uniquely marked so it can
be easily identified later
True
Concealment investigative methods sometimes
involved the study of documents that have been
manipulated.
True
Discovery sampling is probably the most
difficult of all statistical sampling variations to
understand.
False
As long as a sample is selected randomly, it will
always be representative of the population as a
whole.
False
Even if photocopies of original documents are
allowed to be introduced as evidence in a court
of law, they are still considered secondary
evidence.
True
A canceled check typically shows the account
number of the person who presented the check,
the teller who processed the check, and the
sequence number of the transaction.
True
Random number tables are ineffective and
should not be used when selecting random
samples from a population.
False
Using a computer to access records (data
mining) can be a very effective approach for
determining if fraud exists because the auditor
can look at entire populations.
True
Bates numbers are identifying numbers used by
attorneys involved in litigation to track all
documents.
True
Programs like IBM's i2 Analyst's Notebook and
Xanalys Link Exploreer perform link analysis.
True
The best way to obtain documentary evidence
in a computer database is to use discovery
sampling to find the appropriate records.
False