The CFE syllabus is often studied as four separate chapters, but fraud examination work is integrated: one set of facts can invoke scheme classification, analytics, law, and interviewing at once. The actionable method here is a routing habit. For every practice fact pattern, name the scheme family, one detection method, the contested legal element, and the next interview type before you answer. This guide demonstrates the habit with two worked scenarios, a classification table, and a rubric-scored drill you can adapt to your own sequence.
The core study problem: routing one fact pattern through four domains
A single fraud scenario can be examined through scheme classification, detection method, legal elements, or interviewing technique. Building a routing habit — deciding which domain the facts invoke before answering — organizes the entire syllabus.
The CFE credential covers preventing, detecting, and investigating fraud, along with the complex financial transactions and legal issues that surround it, as the ACFE describes in outlining the skills CFEs bring to resolving allegations and designing anti-fraud programs. In practice these skills overlap. A kickback is simultaneously a corruption scheme, a target for vendor-comparison analytics, a question of undisclosed interest, and an interview subject.
Because study materials present these topics in separate chapters, the connective work falls to you. Make routing explicit: for every practice fact pattern, name three things before answering — the scheme family the conduct belongs to, the tool that would surface it, and the legal element in dispute. If you cannot name all three, you have learned the chapter but not the integrated view of fraud examination the scenarios demand.
Classifying schemes: asset misappropriation vs. corruption vs. financial statement fraud
The three families differ in what happens to value. Asset misappropriation converts organizational assets; corruption abuses influence for undisclosed personal benefit; financial statement fraud misrepresents the entity's performance or position to report users.
Route on the destination of value. If an employee skims cash receipts, steals inventory, or manipulates payroll, that is asset misappropriation — value leaves the organization directly. If a purchasing manager accepts kickbacks, steers contracts to a relative's firm, or extorts a vendor, value generally stays inside the organization but decisions are distorted for personal gain. That single question — where did the value go, and was the deception aimed at assets or at decisions — resolves most classification choices.
Financial statement fraud differs in kind: the deception targets people relying on reports rather than the assets themselves. Common vehicles include fictitious revenues, concealed liabilities, and improper asset valuations. Misclassification is the practical danger: treating a conflict-of-interest purchasing scheme as simple theft leads to the wrong analytics (cash counts instead of vendor comparisons) and the wrong interview targets, so classification is worth drilling until it is automatic.
- Skimming and cash larceny — theft of cash receipts before or after they are recorded
- Billing, payroll, and expense reimbursement schemes — fictitious or inflated disbursements
- Bribery, illegal gratuities, economic extortion, and conflicts of interest — the corruption family
- Fictitious revenues, timing differences, concealed liabilities, and improper valuations — financial statement fraud
| Scheme family | Where value goes | First-line detection tools | Legal issue to track |
|---|---|---|---|
| Asset misappropriation | Out of the organization to the fraudster | Reconciliations, cash counts, exception reports on disbursements | Conversion of the asset and quantifying the loss |
| Corruption | Stays in the organization; decisions are distorted | Vendor comparison, conflict-of-interest screening, due diligence | Undisclosed interest or an improper benefit exchanged |
| Financial statement fraud | Misrepresented to users of the reports | Analytical review, journal-entry testing, ratio and trend analysis | Reliance on the misstated report and resulting damage |
Using the fraud triangle to separate prevention from detection questions
Pressure, opportunity, and rationalization explain why fraud occurs, but they serve different tasks: prevention targets opportunity through controls, while detection looks for symptoms that pressure or rationalization have already produced.
A prevention question asks what control would shrink opportunity: segregation of duties, vendor master controls, authorization limits, mandatory rotation of duties. A detection question asks what symptom an existing scheme leaves behind: unmatched invoices, missing supporting documents, unusual journal entries near period end, or records that cannot be located. Mapping each anti-fraud response to the triangle leg it addresses keeps the two question types distinct when facts blend them together.
The triangle also clarifies why controls alone are not the whole answer. Pressure and rationalization are internal to the individual; opportunity is the leg an organization can engineer away directly. That is why anti-fraud programs emphasize control design and monitoring while still using analytics and reporting channels to catch schemes that develop despite sound controls. In scenario work, name the leg first, then name the response — the ordering itself is a useful discipline.
Scenario 1: converting lifestyle suspicion into a net worth computation
Suspecting someone lives beyond their salary is not a finding. The net worth method converts that suspicion into numbers: net worth increase plus living expenses, minus known income, approximates income from unknown sources.
Simplified worked example: an examiner notices an employee's home and car look expensive relative to salary. The plausible mistake is a report stating the employee 'must be stealing' because the lifestyle exceeds income. The better decision is to assemble balance sheets for consecutive years. Suppose net worth rose from 120,000 to 165,000 — an increase of 45,000 — and living expenditures were 40,000, while known income totaled 70,000. Then income from unknown sources is 45,000 + 40,000 − 70,000 = 15,000 for that year, labeled clearly as an estimate with stated assumptions.
The computation matters because it separates an unsupported hunch from a methodical estimate that can withstand scrutiny, and it can be repeated year over year to show a pattern. Track its assumptions: it presumes you can reasonably identify assets, expenditures, and income, and a simplified example omits adjustments a complete analysis would require. Practicing the arithmetic on paper fact patterns builds the reasoning without touching real case data.
Scenario 2: sequencing interviews so information precedes admission-seeking
Interviews have distinct purposes: information-seeking interviews build the factual record from neutral sources, while admission-seeking interviews resolve an allegation with a suspect. Confronting the suspect first risks tipping off the subject.
Scenario: an examiner identifies a prime suspect in a billing scheme and schedules that person for a confrontation first, hoping for a quick confession. The plausible mistake: the suspect learns the scope of the inquiry, alerts accomplices, and documents quietly disappear. The better decision is to interview neutral custodians and non-suspects first — for example, the accounts payable clerk who processes the invoices and the vendor side's contract manager — to establish documents, processes, and facts before approaching the suspect.
Sequencing reflects the investigative logic that facts gathered early constrain a suspect's ability to explain away evidence later. It also shapes conduct: information-seeking questions stay open and non-accusatory, while admission-seeking interviewing uses structured, escalating questioning aimed at resolving the allegation. Rehearsing the sequencing decision on paper scenarios trains the judgment without any real-world interviewing risk, and it forces you to justify each interview's purpose in order.
Legal elements: mapping each element of fraud to the evidence that proves it
Fraud claims turn on elements such as a material false representation, knowledge of its falsity, intent to induce reliance, actual reliance, and resulting damages. For each element, know which investigative evidence would support it.
In framework terms, a false representation made knowingly to induce reliance that is in fact relied upon, causing damage, gives fraud its structure — and each element demands different proof. Intent is usually shown circumstantially, through concealment, altered records, or suspicious behavior, while damages require quantification tied to the scheme. Elements also differ between civil and criminal contexts, including the burden of proof involved, so the element list is a tool for organizing evidence, not a substitute for jurisdictional detail.
Jurisdictions define offenses and required proof differently, so treat the elements as an organizing framework rather than a universal statute, and rely on the CFE course materials for the precise treatment used in the syllabus. The study habit that pays off: for every scheme you study, list each element beside one matching piece of evidence — a falsified invoice for the misrepresentation, a hidden ledger for knowledge and intent, a loss calculation for damages. The mapping turns abstract law into recallable specifics.
A routing drill, an adaptable study sequence, and readiness checks
Close the loop by drilling integration: classify fact patterns, compute methods on paper, sequence interviews, and map legal elements. Score yourself against a rubric, then rotate through the domains in planned passes.
Run a routing drill: write or collect ten short fact patterns, and for each record (a) the scheme family, (b) one detection method, (c) one contested legal element, and (d) whether the next interview should be information-seeking or admission-seeking. Self-check rubric: routing 8 of 10 correctly is a solid learning milestone; if the legal element or interview column is consistently your weakest, spend the next pass there. Treat the score as a study progress marker, not a prediction of your exam result.
A workable sequence you can adapt: first pass, read each domain and build a one-page map of the schemes, methods, and elements it contains; second pass, work paper scenarios and calculations like the net worth example; third pass, do mixed practice questions and full routing drills; final pass, review only the columns where your rubric scores lag. Administrative details such as exam length, fees, and eligibility belong to the issuer — link the ACFE's CFE page rather than memorizing numbers that change.
Readiness checks to finish with:
- Compute a net worth method estimate from a paper fact pattern without notes, and state two assumptions it depends on
- For three fact patterns, name the scheme family and the first analytics you would run, using the table above as a benchmark
- Draft an interview sequence for an allegation, labeling each interview's purpose and why it comes at that point
- Map every element of fraud to one piece of matching evidence for two different schemes
- Score one full routing drill; repeat a week later and compare column-level results
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.