Covert Operations Defined and Documented
5 minutes
5 Questions
In the Certified Fraud Examiner (CFE) body of knowledge, covert operations are investigative techniques in which the fraud examiner conceals his or her true identity, purpose, or presence in order to gather evidence that could not be obtained through open inquiry. The ACFE defines covert operations as activities such as undercover work, surveillance (physical, electronic, or moving), and the use of informants or confidential sources, all conducted without the knowledge of the subject. Because the subject is unaware, these methods can reveal behavior, conversations, and documents that would otherwise be hidden or destroyed. Covert operations are considered a last resort, used only when other, less intrusive methods are impractical or have failed, and when the potential benefit clearly outweighs the legal, ethical, and reputational risks. Documentation is a cornerstone of any covert operation. Before beginning, the examiner should prepare a written memorandum, often called an operational plan or predication memo, that records the information upon which the operation is predicated, the specific objectives, the identity of the subject(s), the methods to be used, the personnel involved, the estimated duration, and the anticipated costs. The plan should also identify legal counsel consulted and management or client approval obtained, which protects the examiner against later claims of entrapment, invasion of privacy, or improper conduct. During the operation, every contact, observation, and piece of evidence must be logged contemporaneously with date, time, location, participants, and a factual description, avoiding opinions or speculation. Surveillance logs, photographs, recordings, and expense records should be preserved and maintained in a secure chain of custody. After the operation concludes, a comprehensive report summarizes findings and ties each conclusion to documented evidence. Proper definition and documentation ensure that covert operations remain lawful, defensible in court, consistent with the CFE Code of Professional Ethics, and credible to management, prosecutors, and judges.
Covert Operations Defined and Documented: A Complete CFE Exam Guide
Introduction: Why This Topic Matters
Covert operations sit at the high-risk end of the fraud examiner's toolkit. Unlike document review, data analysis, or formal interviews, covert techniques involve concealment of the examiner's identity or purpose. That concealment creates legal exposure (entrapment, invasion of privacy, pretexting violations), ethical exposure (allegations of fishing expeditions or bad faith), and practical exposure (operatives can be discovered, injured, or compromised). The ACFE therefore treats covert operations as a method of last resort that must be justified in advance and documented in writing before it begins.
On the CFE Exam, this subject appears in the Investigation section. Questions test whether you understand what a covert operation is, when it is appropriate, what the pre-operation memorandum must contain, and why that documentation protects both the examiner and the client. Because the content is rule-based and definitional, it is highly testable and rewards candidates who memorize the specifics.
Part 1: What Is a Covert Operation?
A covert operation is an investigative technique in which the fraud examiner (or an operative acting on the examiner's behalf) conceals his or her true identity, the true purpose of the inquiry, or both, in order to gather information that could not be obtained through open methods.
The Fraud Examiners Manual identifies two principal forms:
1. Undercover operations - an operative assumes a false identity or role (for example, posing as a new employee, a vendor, or a customer) to observe conduct and gather evidence from the inside.
2. Surveillance - the secret, continuous or periodic observation of persons, places, or things to obtain information about the identities and activities of subjects. Surveillance may be fixed (stationary), moving (tailing), or electronic (within legal limits).
Related but distinct is pretexting - obtaining information by misrepresenting who you are or why you want it. Pretexting is sometimes used within covert work but is heavily restricted by law in certain contexts (discussed below).
Key Definitional Points to Memorize
- Covert operations are not a first-line technique. They should be used only when other, less intrusive methods have been exhausted, are impractical, or would alert the subject and destroy evidence.
- They must be based on predication - a reasonable, articulable basis to believe fraud has occurred, is occurring, or will occur. A covert operation launched without predication is a fishing expedition and invites legal liability.
- The potential benefit must outweigh the cost and risk. Covert work is expensive, slow, and dangerous to operatives if discovered.
Part 2: When Are Covert Operations Appropriate?
The CFE body of knowledge lists circumstances in which covert techniques may be justified:
- Conventional methods (document examination, interviews, data analysis) have failed or would be ineffective.
- The information sought cannot be obtained any other way.
- There is a need to observe the actual commission of the offense or identify co-conspirators.
- Open inquiry would tip off the suspects and lead to destruction of evidence or flight.
- The fraud is ongoing and the organization needs to catch it in progress.
Conversely, covert operations are generally inappropriate when the matter is minor relative to the cost and risk, when the same facts are available through records, or when legal counsel has not been consulted.
Part 3: Problems and Risks of Covert Operations
Exam questions frequently ask you to identify the drawbacks. Know these:
- Legal liability - claims of invasion of privacy, defamation, false imprisonment, intentional infliction of emotional distress, or violation of wiretap and surveillance statutes.
- Entrapment - in criminal matters, inducing a person to commit a crime he or she was not otherwise predisposed to commit can defeat prosecution. Operatives must observe and gather evidence, not instigate wrongdoing.
- Pretexting restrictions - in the United States, the Gramm-Leach-Bliley Act prohibits using false pretenses to obtain customer financial information from financial institutions, and the Telephone Records and Privacy Protection Act prohibits pretexting to obtain phone records. Many jurisdictions have similar privacy laws.
- Discovery of the operation - if the operative is exposed, the investigation may collapse and the operative may be endangered.
- Cost and time - undercover placements can run for months.
- Reputational damage to the organization if the operation becomes public or is portrayed as spying on employees.
- Management and union issues - collective bargaining agreements and employment law may restrict workplace surveillance.
Part 4: How Covert Operations Must Be Documented
This is the heart of the topic. Before any covert operation begins, the fraud examiner should prepare a written memorandum that establishes the basis for the operation. The memorandum is placed in the case file and serves as the permanent record of why the operation was undertaken and how it was to be conducted.
Required Contents of the Covert Operations Memorandum
The Fraud Examiners Manual specifies that the memorandum should document, at a minimum:
1. The information upon which the covert operation is predicated - the facts, tips, red flags, or preliminary findings that justify the operation. This is the predication statement.
2. The information expected to be gained - the specific objectives of the operation. What questions will it answer? What evidence is it designed to obtain?
3. The identities of suspects, if known - who is being targeted and why.
4. The identities of the operatives - who will conduct the operation, including any outside agencies or contractors, along with relevant dates and the planned scope.
Many practitioners also include: the legal review performed, the name of the approving executive or counsel, the anticipated duration, the budget, the rules of engagement for the operative (what the operative may and may not do), and the method for reporting results.
Timing: The Memorandum Comes First
The memorandum must be prepared before the operation commences, not reconstructed afterward. A contemporaneous, dated record demonstrates that the examiner acted on legitimate predication rather than retroactively justifying a fishing expedition. Exam questions often hinge on this timing point.
Why the Memorandum Matters
- It proves predication, which is the examiner's primary defense against allegations of harassment, discrimination, or bad faith.
- It defines scope, preventing the operation from drifting into unrelated areas and limiting exposure.
- It supports the chain of authority, showing that management and legal counsel knew of and approved the operation.
- It protects operatives by establishing what they were and were not authorized to do.
- It provides a foundation for later testimony if the matter proceeds to litigation or prosecution.
Approval and Legal Review
The ACFE emphasizes that covert operations should be approved by appropriate management and reviewed by legal counsel before they begin. Counsel confirms that the planned activity complies with privacy, employment, surveillance, and pretexting laws in the relevant jurisdiction. Where the operation involves law enforcement cooperation or possible criminal referral, coordination with prosecutors helps avoid entrapment issues.
Part 5: How Covert Operations Work in Practice
A well-run covert operation follows a predictable sequence:
1. Identify the need - conventional methods have been tried or ruled out.
2. Confirm predication - gather and record the facts that justify covert action.
3. Prepare the memorandum - document predication, objectives, suspects, operatives, and scope.
4. Obtain approvals - management sign-off and legal review.
5. Select and brief operatives - choose individuals with appropriate skills; set clear limits (observe, do not instigate; do not break the law; do not engage in pretexting prohibited by statute).
6. Execute and supervise - maintain regular, secure contact with operatives; keep contemporaneous notes and logs.
7. Document results - every observation should be recorded with date, time, place, persons present, and what was seen or heard. Surveillance logs and operative reports become evidence.
8. Terminate and preserve - end the operation when objectives are met or when risk becomes unacceptable; secure all records in the case file.
Part 6: Exam Tips - Answering Questions on Covert Operations Defined and Documented
Tip 1: Lock in the definition. If a question describes an examiner concealing identity or purpose to gather information, the answer is a covert operation. Distinguish undercover (assuming a role) from surveillance (secret observation).
Tip 2: Remember the last-resort rule. Any answer choice suggesting covert operations should be used routinely, early, or as a first step is wrong. The correct framing is: use only when other methods are exhausted or impractical and the benefit outweighs the risk.
Tip 3: Predication is non-negotiable. Questions may describe a manager who simply wants to see what employees are up to. That is a fishing expedition, not predication. The examiner should decline or insist on a documented basis first.
Tip 4: Know the four memorandum elements cold. Expect a question asking which item does or does not belong in the covert operations memorandum. The core four are: (a) the information the operation is based on, (b) the information expected to be gained, (c) the identities of suspects if known, and (d) the identities of operatives. If an answer choice lists something irrelevant like the suspect's performance review history or the examiner's hourly rate, eliminate it.
Tip 5: Timing questions - before, not after. If asked when the memorandum should be prepared, the answer is before the operation begins. Any option suggesting it is prepared at the conclusion or only if litigation arises is incorrect.
Tip 6: Purpose questions - protection and predication. If asked why the memorandum is prepared, choose the answer that speaks to documenting predication and protecting the examiner and organization from later allegations of impropriety. Do not choose answers framed around convenience or saving time.
Tip 7: Legal review and approval. Questions may ask who should be consulted before a covert operation. Legal counsel and appropriate management are the standard answers. Operatives acting on their own initiative is always wrong.
Tip 8: Entrapment versus observation. If a scenario has an operative encouraging, pressuring, or creating the opportunity for a crime the subject would not otherwise commit, recognize entrapment risk. The operative's role is to observe and record, not to induce.
Tip 9: Pretexting traps. If a scenario involves posing as a customer to obtain someone's bank account details or phone records, flag it as a likely statutory violation (Gramm-Leach-Bliley Act for financial data; Telephone Records and Privacy Protection Act for phone records). The examiner should not do it.
Tip 10: Watch for absolute language. The CFE Exam often uses words like always, never, and only. Covert operations should never be undertaken without predication and documentation, but they are not categorically prohibited. Read each stem carefully.
Tip 11: Scenario-based elimination. For long scenario questions, ask three things in order: Is there predication? Was a memorandum prepared beforehand with the required elements? Was legal counsel consulted? The answer choice that satisfies all three (or correctly identifies which is missing) is usually correct.
Quick Review Summary
- Definition: investigative technique where identity and/or purpose is concealed; includes undercover operations and surveillance.
- When used: only after other methods are exhausted or impractical; benefit must exceed risk; requires predication.
- Risks: lawsuits, entrapment, privacy and pretexting violations, exposure of operatives, cost, reputational harm.
- Documentation: written memorandum prepared BEFORE the operation stating (1) the information the operation is based on, (2) the information expected to be gained, (3) the identities of suspects if known, and (4) the identities of operatives.
- Approval: management sign-off and legal counsel review.
- Purpose of memo: prove predication, define scope, protect against allegations of impropriety or fishing expeditions, and support later testimony.
Master these points and you will be well prepared for any CFE Exam question on how covert operations are defined and documented.
Covert operations sit at the high-risk end of the fraud examiner's toolkit. Unlike document review, data analysis, or formal interviews, covert techniques involve concealment of the examiner's identity or purpose. That concealment creates legal exposure (entrapment, invasion of privacy, pretexting violations), ethical exposure (allegations of fishing expeditions or bad faith), and practical exposure (operatives can be discovered, injured, or compromised). The ACFE therefore treats covert operations as a method of last resort that must be justified in advance and documented in writing before it begins.
On the CFE Exam, this subject appears in the Investigation section. Questions test whether you understand what a covert operation is, when it is appropriate, what the pre-operation memorandum must contain, and why that documentation protects both the examiner and the client. Because the content is rule-based and definitional, it is highly testable and rewards candidates who memorize the specifics.
Part 1: What Is a Covert Operation?
A covert operation is an investigative technique in which the fraud examiner (or an operative acting on the examiner's behalf) conceals his or her true identity, the true purpose of the inquiry, or both, in order to gather information that could not be obtained through open methods.
The Fraud Examiners Manual identifies two principal forms:
1. Undercover operations - an operative assumes a false identity or role (for example, posing as a new employee, a vendor, or a customer) to observe conduct and gather evidence from the inside.
2. Surveillance - the secret, continuous or periodic observation of persons, places, or things to obtain information about the identities and activities of subjects. Surveillance may be fixed (stationary), moving (tailing), or electronic (within legal limits).
Related but distinct is pretexting - obtaining information by misrepresenting who you are or why you want it. Pretexting is sometimes used within covert work but is heavily restricted by law in certain contexts (discussed below).
Key Definitional Points to Memorize
- Covert operations are not a first-line technique. They should be used only when other, less intrusive methods have been exhausted, are impractical, or would alert the subject and destroy evidence.
- They must be based on predication - a reasonable, articulable basis to believe fraud has occurred, is occurring, or will occur. A covert operation launched without predication is a fishing expedition and invites legal liability.
- The potential benefit must outweigh the cost and risk. Covert work is expensive, slow, and dangerous to operatives if discovered.
Part 2: When Are Covert Operations Appropriate?
The CFE body of knowledge lists circumstances in which covert techniques may be justified:
- Conventional methods (document examination, interviews, data analysis) have failed or would be ineffective.
- The information sought cannot be obtained any other way.
- There is a need to observe the actual commission of the offense or identify co-conspirators.
- Open inquiry would tip off the suspects and lead to destruction of evidence or flight.
- The fraud is ongoing and the organization needs to catch it in progress.
Conversely, covert operations are generally inappropriate when the matter is minor relative to the cost and risk, when the same facts are available through records, or when legal counsel has not been consulted.
Part 3: Problems and Risks of Covert Operations
Exam questions frequently ask you to identify the drawbacks. Know these:
- Legal liability - claims of invasion of privacy, defamation, false imprisonment, intentional infliction of emotional distress, or violation of wiretap and surveillance statutes.
- Entrapment - in criminal matters, inducing a person to commit a crime he or she was not otherwise predisposed to commit can defeat prosecution. Operatives must observe and gather evidence, not instigate wrongdoing.
- Pretexting restrictions - in the United States, the Gramm-Leach-Bliley Act prohibits using false pretenses to obtain customer financial information from financial institutions, and the Telephone Records and Privacy Protection Act prohibits pretexting to obtain phone records. Many jurisdictions have similar privacy laws.
- Discovery of the operation - if the operative is exposed, the investigation may collapse and the operative may be endangered.
- Cost and time - undercover placements can run for months.
- Reputational damage to the organization if the operation becomes public or is portrayed as spying on employees.
- Management and union issues - collective bargaining agreements and employment law may restrict workplace surveillance.
Part 4: How Covert Operations Must Be Documented
This is the heart of the topic. Before any covert operation begins, the fraud examiner should prepare a written memorandum that establishes the basis for the operation. The memorandum is placed in the case file and serves as the permanent record of why the operation was undertaken and how it was to be conducted.
Required Contents of the Covert Operations Memorandum
The Fraud Examiners Manual specifies that the memorandum should document, at a minimum:
1. The information upon which the covert operation is predicated - the facts, tips, red flags, or preliminary findings that justify the operation. This is the predication statement.
2. The information expected to be gained - the specific objectives of the operation. What questions will it answer? What evidence is it designed to obtain?
3. The identities of suspects, if known - who is being targeted and why.
4. The identities of the operatives - who will conduct the operation, including any outside agencies or contractors, along with relevant dates and the planned scope.
Many practitioners also include: the legal review performed, the name of the approving executive or counsel, the anticipated duration, the budget, the rules of engagement for the operative (what the operative may and may not do), and the method for reporting results.
Timing: The Memorandum Comes First
The memorandum must be prepared before the operation commences, not reconstructed afterward. A contemporaneous, dated record demonstrates that the examiner acted on legitimate predication rather than retroactively justifying a fishing expedition. Exam questions often hinge on this timing point.
Why the Memorandum Matters
- It proves predication, which is the examiner's primary defense against allegations of harassment, discrimination, or bad faith.
- It defines scope, preventing the operation from drifting into unrelated areas and limiting exposure.
- It supports the chain of authority, showing that management and legal counsel knew of and approved the operation.
- It protects operatives by establishing what they were and were not authorized to do.
- It provides a foundation for later testimony if the matter proceeds to litigation or prosecution.
Approval and Legal Review
The ACFE emphasizes that covert operations should be approved by appropriate management and reviewed by legal counsel before they begin. Counsel confirms that the planned activity complies with privacy, employment, surveillance, and pretexting laws in the relevant jurisdiction. Where the operation involves law enforcement cooperation or possible criminal referral, coordination with prosecutors helps avoid entrapment issues.
Part 5: How Covert Operations Work in Practice
A well-run covert operation follows a predictable sequence:
1. Identify the need - conventional methods have been tried or ruled out.
2. Confirm predication - gather and record the facts that justify covert action.
3. Prepare the memorandum - document predication, objectives, suspects, operatives, and scope.
4. Obtain approvals - management sign-off and legal review.
5. Select and brief operatives - choose individuals with appropriate skills; set clear limits (observe, do not instigate; do not break the law; do not engage in pretexting prohibited by statute).
6. Execute and supervise - maintain regular, secure contact with operatives; keep contemporaneous notes and logs.
7. Document results - every observation should be recorded with date, time, place, persons present, and what was seen or heard. Surveillance logs and operative reports become evidence.
8. Terminate and preserve - end the operation when objectives are met or when risk becomes unacceptable; secure all records in the case file.
Part 6: Exam Tips - Answering Questions on Covert Operations Defined and Documented
Tip 1: Lock in the definition. If a question describes an examiner concealing identity or purpose to gather information, the answer is a covert operation. Distinguish undercover (assuming a role) from surveillance (secret observation).
Tip 2: Remember the last-resort rule. Any answer choice suggesting covert operations should be used routinely, early, or as a first step is wrong. The correct framing is: use only when other methods are exhausted or impractical and the benefit outweighs the risk.
Tip 3: Predication is non-negotiable. Questions may describe a manager who simply wants to see what employees are up to. That is a fishing expedition, not predication. The examiner should decline or insist on a documented basis first.
Tip 4: Know the four memorandum elements cold. Expect a question asking which item does or does not belong in the covert operations memorandum. The core four are: (a) the information the operation is based on, (b) the information expected to be gained, (c) the identities of suspects if known, and (d) the identities of operatives. If an answer choice lists something irrelevant like the suspect's performance review history or the examiner's hourly rate, eliminate it.
Tip 5: Timing questions - before, not after. If asked when the memorandum should be prepared, the answer is before the operation begins. Any option suggesting it is prepared at the conclusion or only if litigation arises is incorrect.
Tip 6: Purpose questions - protection and predication. If asked why the memorandum is prepared, choose the answer that speaks to documenting predication and protecting the examiner and organization from later allegations of impropriety. Do not choose answers framed around convenience or saving time.
Tip 7: Legal review and approval. Questions may ask who should be consulted before a covert operation. Legal counsel and appropriate management are the standard answers. Operatives acting on their own initiative is always wrong.
Tip 8: Entrapment versus observation. If a scenario has an operative encouraging, pressuring, or creating the opportunity for a crime the subject would not otherwise commit, recognize entrapment risk. The operative's role is to observe and record, not to induce.
Tip 9: Pretexting traps. If a scenario involves posing as a customer to obtain someone's bank account details or phone records, flag it as a likely statutory violation (Gramm-Leach-Bliley Act for financial data; Telephone Records and Privacy Protection Act for phone records). The examiner should not do it.
Tip 10: Watch for absolute language. The CFE Exam often uses words like always, never, and only. Covert operations should never be undertaken without predication and documentation, but they are not categorically prohibited. Read each stem carefully.
Tip 11: Scenario-based elimination. For long scenario questions, ask three things in order: Is there predication? Was a memorandum prepared beforehand with the required elements? Was legal counsel consulted? The answer choice that satisfies all three (or correctly identifies which is missing) is usually correct.
Quick Review Summary
- Definition: investigative technique where identity and/or purpose is concealed; includes undercover operations and surveillance.
- When used: only after other methods are exhausted or impractical; benefit must exceed risk; requires predication.
- Risks: lawsuits, entrapment, privacy and pretexting violations, exposure of operatives, cost, reputational harm.
- Documentation: written memorandum prepared BEFORE the operation stating (1) the information the operation is based on, (2) the information expected to be gained, (3) the identities of suspects if known, and (4) the identities of operatives.
- Approval: management sign-off and legal counsel review.
- Purpose of memo: prove predication, define scope, protect against allegations of impropriety or fishing expeditions, and support later testimony.
Master these points and you will be well prepared for any CFE Exam question on how covert operations are defined and documented.
Test mode:
CFE - Covert Operations Defined and Documented Example Questions
Test your knowledge of Covert Operations Defined and Documented
Question 1
Inventory shrinkage at a distribution center has risen, but no tip, document or data analysis points to any person or scheme. The operations manager asks a fraud examiner to place an undercover operative among warehouse staff 'to see whether anyone is stealing.' The operative would report weekly to the manager. Which aspect of the proposal is the MOST significant obstacle to treating it as a properly founded covert operation?
Question 2
A covert operation is an investigative technique in which an examiner or agent uses deception, such as an assumed identity, to gather evidence directly from the people involved in a suspected fraud.
Question 3
A warehouse supervisor is suspected of selling company inventory to outside buyers for cash. With legal counsel's approval, a fraud examiner poses as a scrap dealer, contacts the supervisor, and arranges to buy goods while recording each transaction. Which of the following BEST characterizes the examiner's technique?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Covert Operations Defined and Documented questions
17 questions (total)