Rationalization, Themes and Defusing Alibis

1. Why This Topic Matters

The admission-seeking interview is the climax of a fraud examination. By the time a Certified Fraud Examiner sits down with a suspect for this type of interview, the evidence should already point strongly toward one person, and the goal is no longer to gather facts but to obtain a legally admissible confession. Rationalization, theme development and the defusing of alibis are the psychological core of that process. Without them, a suspect who has been accused will simply dig in, deny, and leave the room. With them, the examiner gives the suspect a face-saving path to telling the truth.

For the CFE Exam, this material sits in the Investigation section under Interview Theory and Application. It is heavily tested because it is procedural, sequential and full of specific rules (what to say, what not to say, what order to present evidence in, what themes are acceptable). Candidates who memorise the sequence of the admission-seeking interview and understand the purpose of each step tend to score well; those who treat it as common sense tend to miss the detail-oriented questions.

2. Where These Steps Fit in the Admission-Seeking Interview

The Fraud Examiners Manual lays out the admission-seeking interview as a sequence. You should know the order cold:

1. Direct accusation – stated as fact, not a question ('Our investigation has clearly established that you...').
2. Observe the reaction – innocent people usually react with strong, direct denial; guilty people often hesitate or offer weak denials.
3. Repeat the accusation – calmly, without raising voice or getting emotional.
4. Interrupt denials – using delays, interruptions and reasoning so the suspect does not become entrenched in a lie.
5. Establish rationalization – develop a theme that gives the suspect a morally acceptable reason for the conduct.
6. Defuse (diffuse) alibis – neutralise the suspect's excuses using evidence, witnesses and the suspect's own deceptions.
7. Present the alternative question – two choices, both of which are admissions, one more morally acceptable than the other.
8. Obtain the benchmark admission – the first 'yes'.
9. Reinforce the rationalization – keep the suspect comfortable so the admission continues.
10. Obtain the verbal confession – fill in the who, what, when, where, how and how much.
11. Obtain the written (signed) statement.

Steps 5 and 6 – rationalization/themes and defusing alibis – are the subject of this guide. Notice that rationalization comes after denials are interrupted and before alibis are addressed; the exam likes to test this placement.

3. What Rationalization Is

Rationalization is the interviewer offering the suspect a reason for the offense that is morally acceptable to the suspect, so that they can admit the conduct without feeling like a bad person. It draws directly on the Fraud Triangle: perpetrators almost always rationalize their behaviour to themselves ('I was only borrowing it', 'they owed me'). The interviewer simply hands the suspect a rationalization that matches how the suspect already feels.

Critical points the exam expects you to know:

• The rationalization is a moral excuse, not a legal one. The interviewer must never suggest that the reason reduces legal responsibility or that the suspect will receive leniency. Doing so can render the confession involuntary and inadmissible.
• The interviewer must be non-judgmental and sympathetic, even if the theme is not something the interviewer personally believes. The manual is clear that the interviewer does not have to agree with the rationalization, only present it convincingly.
• The interviewer should watch the suspect's reaction to each theme and switch themes if one does not resonate. A theme that fits the suspect's circumstances (financial pressure, resentment of a supervisor) is far more effective than a generic one.
• The rationalization is typically delivered as a monologue by the interviewer while the suspect is kept from denying; the interviewer talks, the suspect listens.
• Once a benchmark admission is obtained, the rationalization is reinforced so the suspect remains willing to talk.

4. The Common Themes

The Fraud Examiners Manual lists a number of themes. You should be able to recognise each one and distinguish it from statements that are not appropriate themes (such as promises of leniency or threats).

• Unfair treatment – 'I know this company hasn't always treated you fairly. You worked hard and they passed you over.' Very effective with employees who feel wronged.
• Inadequate recognition – the suspect's contributions were never acknowledged; the money was a way of taking what was deserved.
• Financial problems – bills, medical costs, debts; 'You didn't do this for luxury, you did it because you were in a corner.'
• Aberration of conduct – 'This isn't like you. This is a one-time lapse, not who you really are.' Suggests the act was out of character.
• Family problems – divorce, sick child, pressure at home that drove the conduct.
• Accuser's actions – the victim (or the person who reported it) behaved in a way that provoked the conduct; the suspect's reaction was understandable.
• Stress, drugs and alcohol – the suspect was not thinking clearly because of pressure or substance problems.
• Revenge – getting even with a boss or organisation that mistreated the suspect.
• Depersonalising the victim – 'It's a big company, nobody got hurt, they're insured.' Stealing from a faceless entity feels less wrong than stealing from a person.
• Minor moral infraction – characterising the conduct as 'borrowing', 'an advance', or 'cutting a corner' rather than stealing or lying.
• Altruism – 'You didn't do it for yourself; you did it for your family / your staff / to keep the business alive.'
• Genuine need – the suspect truly needed the money and intended to pay it back.

Note the recurring logic: every theme shifts blame away from the suspect's character and onto circumstances, other people or the victim, while never denying that the act occurred. That is what makes a theme a theme.

5. What Defusing Alibis Is

After the accusation is repeated and denials are interrupted, most guilty suspects stop flatly denying and instead start offering alibis – explanations intended to show why the evidence does not mean what it appears to mean ('I had permission', 'I was out of town that week', 'someone else uses my password'). Defusing (the manual sometimes uses 'diffusing') alibis means systematically showing the suspect that their explanations will not hold up, so that denial becomes pointless and confession becomes the easiest option.

The manual describes three principal tools:

(a) Display physical evidence
• Present evidence one piece at a time, never all at once. The suspect should never know how much (or how little) evidence the examiner actually has.
• Present it in reverse order of importance – the least significant item first, saving the strongest evidence for last. This gradually convinces the suspect that resistance is hopeless and prevents the suspect from building a story around the strongest item.
• Let the suspect explain each item; each weak explanation further undermines their position.
• Do not reveal exactly how the evidence was obtained, so the suspect cannot tailor explanations to gaps in the investigation.

(b) Discuss witnesses
• Tell the suspect that other people have provided information, but do not identify witnesses or reveal the specifics of what they said. Disclosing names can expose witnesses to retaliation and gives the suspect something concrete to attack.
• The implication is that the examiner knows more than the suspect realises.

(c) Discuss deceptions
• Point out the inconsistencies and lies in the suspect's own statements in a calm, non-accusatory way ('A moment ago you said you never handled those cheques; the records show you endorsed six of them.').
• The goal is to make the suspect realise that their story is collapsing, not to humiliate them.
• Many instructors summarise the approach as: do not call the person a liar; show them that their story is not believable and that you both know it.

Once alibis are defused, the suspect frequently becomes quiet, withdrawn or visibly resigned. That is the signal to move to the alternative question ('Did you plan this from the start, or did it just get out of hand?'), which leads to the benchmark admission.

A caution the exam may raise: the examiner should be careful about fabricating evidence or making false claims about evidence that does not exist. Beyond the ethical concern, it can damage the credibility of the confession and the examiner, and in some jurisdictions create legal problems. The manual's approach relies on presenting real evidence strategically, not on inventing it.

6. How the Pieces Work Together – A Worked Illustration

Suppose an accounts payable clerk is suspected of setting up a shell vendor. After the accusation and repeated accusation, the clerk begins denying. The examiner interrupts: 'Hold on, let me finish.' The examiner then develops a theme: 'I've looked at your file. You've been here eleven years, you've trained half the department, and you've been passed over twice. I think the company let you down, and I think things got tight at home. This isn't about greed; this is about a good person under pressure.' The clerk stops denying and says, 'I never set up any vendor; the system lets anyone do that.' The examiner now defuses the alibi: first a minor item ('The vendor's address matches your sister's P.O. box'), then stronger evidence ('These approvals carry your user ID on days you were the only one logged in'), then: 'You told me earlier you had never heard of this vendor, but your e-mail shows you corresponded with it.' The clerk goes silent. The examiner asks the alternative question: 'Was this something you planned for a long time, or did it just start as a one-time thing to get through a rough patch?' 'It was just supposed to be once.' That is the benchmark admission; the examiner reinforces the theme and moves to the details.

7. Exam Tips: Answering Questions on Rationalization, Themes and Defusing Alibis

• Memorise the sequence. Questions often describe a scenario and ask what the examiner should do next. Know that rationalization follows the interruption of denials, that defusing alibis follows rationalization, and that the alternative question follows defused alibis.

• Moral, not legal. If an answer choice has the interviewer suggesting reduced charges, leniency, keeping the matter 'in-house', or that the reason 'makes it not really a crime', it is wrong. Rationalization gives a moral excuse only. Promises of leniency and threats both jeopardise admissibility.

• Know the theme list. Expect questions of the form 'Which of the following is NOT a common rationalization theme?' Items such as unfair treatment, inadequate recognition, financial problems, aberration of conduct, family problems, accuser's actions, stress/drugs/alcohol, revenge, depersonalising the victim, minor moral infraction, altruism and genuine need are themes. Things like 'threatening prosecution', 'promising a job reference' or 'calling the suspect a thief' are not.

• Reverse order of importance. When evidence is displayed, it is shown one item at a time, least important first, strongest last. Any answer saying 'present all evidence at once' or 'lead with the strongest evidence' is a distractor.

• Do not name witnesses. The examiner may say others have provided information but should not identify them or reveal what they said.

• Deceptions are pointed out calmly. The correct technique is to note inconsistencies in the suspect's story without hostility, not to accuse the suspect of lying in an emotional way.

• Innocent versus guilty reactions. Questions sometimes blend this topic with reaction observation: innocent people tend to deny strongly and immediately; guilty people tend to offer weak, delayed or conditional denials and then shift to alibis. Rationalization is only pursued when the examiner is reasonably certain of guilt.

• Interviewer attitude. Correct answers describe the interviewer as calm, sympathetic, non-judgmental, and willing to switch themes if one does not work. The interviewer does not need to believe the theme personally.

• Watch for terminology variants. The manual may say 'diffuse' or 'defuse' alibis and 'establish rationalization' or 'develop a theme'. Treat them as the same concepts.

• Scenario questions: read for the suspect's current behaviour. If the suspect is still denying, the answer involves interrupting denials and presenting a theme. If the suspect is offering explanations, the answer involves defusing alibis with evidence, witnesses or deceptions. If the suspect has gone quiet and resigned, the answer is the alternative question.

• Eliminate extremes. Choices that involve lying about non-existent evidence, raising your voice, making the accusation a question, or discussing the legal consequences are almost always incorrect under ACFE methodology.

8. Quick Review Summary

• Rationalization = offering a morally acceptable reason so the suspect can save face; never a legal excuse or promise of leniency.
• Themes = unfair treatment, inadequate recognition, financial problems, aberration of conduct, family problems, accuser's actions, stress/drugs/alcohol, revenge, depersonalising the victim, minor moral infraction, altruism, genuine need.
• Defusing alibis = physical evidence (one piece at a time, reverse order of importance), witnesses (not identified), deceptions (inconsistencies pointed out calmly).
• Sequence = accusation, observe, repeat, interrupt denials, rationalize, defuse alibis, alternative question, benchmark admission, reinforce rationalization, verbal confession, written confession.

Master the order, the purpose of each step and the specific do-and-don't rules, and the exam questions on this topic become very manageable.