ACFE Certified Fraud Examiner -Fraud Schemes and Financial Crimes CFE-Fraud-Schemes-and-Financial-Crimes Exam Dumps: Updated Questions & Answers (August 2026)

Detailed Explanation:

Rationale for Correct Answer: Cost mischarging occurs when costs are charged to improper accounts or contracts. The best way to detect it is through analytical review —comparing direct vs. indirect labor account totals across periods to identify unusual shifts or spikes.

Analysis of Incorrect Options:

A. Reviewing inspection/testing reports – Effective for detecting defective/substituted goods, not mischarging.

C. Inspecting packaging – Identifies product substitution, not accounting mischarges.

D. Examining change orders – Useful for contract fraud, but not direct mischarging.

Key Concept: Cost mischarging detection through analytical procedures .

Detailed Explanation:

Rationale for Correct Answer: Fraudsters conceal inventory shrinkage through multiple methods, including unrecorded sales, false write-offs, or manipulating perpetual records. The ACFE manual notes that concealment is a common theme in inventory fraud. Hence, all of the above are valid.

Analysis of Incorrect Options:

A, B, C – Each is correct individually, but the most comprehensive answer is D.

Key Concept: Concealment methods for inventory theft.

The correct answer is D. For a ghost employee scheme to work, the fictitious or nonworking employee must be entered into the payroll system with sufficient payroll data to generate payment, including wage rate information. The ghost does not need to be a real person; the identity might be fabricated, stolen, or based on a former employee. Payment does not have to be made by direct deposit because checks, payroll cards, or other methods can also be used. The payment also does not need to be delivered to someone outside the victim company; insiders commonly collect or control the payments. The ACFE materials describe ghost employee schemes as payroll fraud involving adding the ghost, collecting timekeeping information, and issuing the paycheck.

================

The correct answer is D. Traditional identity theft involves using the real identifying information of another person to impersonate that individual. Here, the fraudster uses another person’s actual name and picture to create a social media profile, meaning the fraudster is posing directly as a real person rather than creating a hybrid or fictitious identity. Synthetic identity theft combines real and fabricated information to create a new identity, which is not described here. Criminal identity theft involves using another person’s identity in a law enforcement or criminal justice context. New account identity theft is not the best ACFE category for this question because the facts emphasize impersonation using real identity information. The ACFE materials distinguish traditional identity theft from synthetic and criminal identity theft.

================

Detailed Explanation:

Rationale for Correct Answer: When employees steal incoming checks and deposit them into interest-bearing accounts, they may be (1) converting the stolen checks , (2) temporarily concealing the fraud , and (3) executing a form of short-term skimming . All options apply, making D. All of the above correct.

Analysis of Incorrect Options: Each of A, B, and C alone captures part of the practice, but only D reflects the full scope.

Key Concept: Check theft and temporary placement in personal accounts as part of skimming concealment.

The correct answer is A. The income statement reports revenues and expenses for a period, and most companies present net sales or net service revenues as the first line item. Net sales means gross sales reduced by sales returns, allowances, refunds, or discounts. Option B is incorrect because gross profit is generally net sales minus cost of goods sold, not revenues minus operating expenses. Operating expenses are deducted after gross profit to help determine operating income. Option C incorrectly defines net profit; net profit reflects revenues minus all relevant expenses, not merely sales minus cost of goods sold. Option D is also incorrect because gross revenue is before deductions, while net sales are after deductions. The ACFE accounting materials explain these income statement relationships.

================

Detailed Explanation:

Rationale for Correct Answer: Shrinkage refers to discrepancies between physical inventory counts and perpetual inventory records. Causes include theft, errors, waste, or fraud. It is one of the most common indicators of asset misappropriation.

Analysis of Incorrect Options:

A. Altered inventory – Not a recognized accounting term.

B. Account receivable – Unrelated to inventory.

D. Write-offs – A corrective accounting entry, not the variance itself.

Key Concept: Inventory shrinkage as a red flag for fraud.

The correct answer is C. An unusually close or overly friendly relationship between an employee and a third-party contractor can be a red flag of corruption. Such relationships may indicate favoritism, undisclosed conflicts of interest, kickbacks, bid manipulation, or preferential treatment in procurement decisions. The behavior is not proof of wrongdoing, but it warrants further review when combined with unusual awards, pricing, sole-source justifications, weak documentation, or repeated business with the same vendor. Option A reflects proper restraint, not suspicious conduct. Option B suggests the employee is not benefiting from bribery-prone markets. Option D is generally positive because disclosure of conflicts allows the organization to evaluate and manage ethical risks. Red flags must be assessed in context with documents, transactions, and relationships.

================

Detailed Explanation:

Rationale for Correct Answer: Technical security controls include software- and hardware-based measures such as application security, firewalls, and encryption . Application security protects against vulnerabilities in the programs employees use.

Analysis of Incorrect Options:

B. Human audits – Administrative control, not technical.

C. Penetration testing – A detective measure/test, not a control itself.

D. Data security – A broad goal, not a specific technical control.

Key Concept: Technical security controls for preventing cyberfraud.

Detailed Explanation:

Rationale for Correct Answer: A disproportionate increase in COGS without a corresponding increase in sales is a red flag for inventory theft or misappropriation . Theft reduces ending inventory, which artificially inflates COGS, while sales remain unchanged or grow modestly.

Analysis of Incorrect Options:

A – Warranty liabilities affect expenses, not COGS.

B – Fewer sales would reduce both revenue and COGS proportionally, not cause a large disparity.

C – Sales returns reduce revenue, not inflate COGS.

Key Concept: Using analytical review to detect inventory theft via COGS anomalies.