Risks of Covert Operations

Why This Topic Matters
Covert operations sit at the high-risk end of the fraud examiner's toolkit. When they succeed, they can produce evidence that no interview, document review or data analysis could ever uncover: direct observation of a kickback being paid, a recorded admission, or the identity of an outside accomplice. When they fail, they can destroy a case, expose the organization to lawsuits, endanger the people involved and embarrass everyone who authorized them. Because the downside is so severe, the ACFE Fraud Examiners Manual devotes specific attention to the risks of covert operations and to the controls a fraud examiner must put in place before approving one. On the CFE Exam, this topic appears in the Investigation section, usually within questions on Covert Examinations, Undercover Operations, Surveillance and the Use of Informants. Examiners who understand why covert work is dangerous, and what must be done to manage that danger, consistently answer these questions correctly.

What Is a Covert Operation?
A covert operation is an investigative technique in which the fraud examiner (or an operative acting on the examiner's behalf) gathers information about a suspected fraud without the knowledge of the subject. The two principal forms recognized in the CFE body of knowledge are:
• Undercover operations – an operative assumes a false identity or role (for example, posing as a new employee, a vendor or a customer) to gain the confidence of the subject and observe or participate in the activity under investigation.
• Surveillance – the planned, secret observation of people, places or objects, which may be stationary (fixed), moving (mobile or tailing) or electronic (video, audio, computer monitoring).
Closely related is the use of informants – individuals, often insiders, who supply information in exchange for money, leniency or other motives.
Covert operations are generally regarded as a last resort. According to ACFE guidance, they should be used only when: (1) there is sufficient predication (a reasonable basis to believe fraud has occurred or is occurring), (2) the information cannot reasonably be obtained through conventional means, (3) the operation is legal in the relevant jurisdiction, and (4) the risks have been evaluated and are acceptable in light of the expected benefit.

The Categories of Risk
Exam questions tend to group the risks into four broad families. Learn all four and be able to give examples of each.

1. Legal Risks
This is the category examiners test most frequently.
• Entrapment – inducing a person to commit a crime he or she was not otherwise predisposed to commit. Strictly speaking, entrapment is a defense available against government agents, but a private operative who encourages or creates the wrongdoing can still cause the evidence to be excluded, trigger civil liability, and ruin the credibility of the entire investigation. The operative should observe and facilitate, never instigate.
• Invasion of privacy – intruding into areas where the subject has a reasonable expectation of privacy (homes, restrooms, locker rooms, private conversations). Surveillance that crosses this line creates tort liability.
• Illegal electronic surveillance – wiretapping and interception laws are strict. Recording a conversation to which the operative is not a party, or recording in a jurisdiction that requires all-party consent, can be a crime as well as a civil wrong.
• Defamation and false imprisonment – an operative who repeats unproven accusations, or who detains a subject, exposes the organization to additional tort claims.
• Trespass – entering property without consent during surveillance.
• Labor and employment law – many jurisdictions and collective bargaining agreements restrict covert monitoring of employees; placing an undercover operative in a unionized workforce without regard to the agreement can produce grievances or unfair labor practice charges.
• Licensing laws – in many places, persons who conduct surveillance or undercover work for hire must hold a private investigator's license. Using an unlicensed operative can invalidate evidence and create penalties.
• Constitutional issues – when the operation is run jointly with, or at the direction of, law enforcement, Fourth Amendment (search and seizure) and Fifth/Sixth Amendment (self-incrimination and right to counsel) protections may attach, and evidence gathered improperly may be suppressed.

2. Physical and Personal Safety Risks
• The operative may be discovered (cover blown) and face retaliation or violence from the subjects, particularly where organized crime, drug activity or large sums are involved.
• Mobile surveillance creates traffic and accident risk.
• Undercover operatives who become too close to the subjects may be drawn into illegal activity themselves, either to maintain cover or through genuine corruption (sometimes described as the operative going native or being turned).
• Prolonged undercover assignments produce psychological stress, divided loyalties and poor judgment.

3. Operational and Evidentiary Risks
• Loss of control – once an operative is in place, management cannot direct every action in real time; a single ill-judged statement can compromise months of work.
• Poor documentation – covert evidence is only valuable if it is contemporaneously and accurately recorded (logs, notes, chain of custody for recordings). Lapses make the evidence unusable.
• Leaks – the more people who know about the operation, the greater the probability the subject learns of it. The ACFE stresses strict need-to-know confidentiality.
• Unreliable informants – informants may exaggerate, fabricate, pursue personal vendettas, or play both sides. Information from informants must be independently corroborated and the informant's identity protected.
• Cost and time – covert operations are expensive, slow and offer no guarantee of results.
• Scope creep – without written objectives, an operation can drift into a general fishing expedition, which is both unethical and legally hazardous.

4. Organizational and Reputational Risks
• Embarrassment – a botched or publicized undercover operation can damage the organization's reputation with employees, customers, regulators and the media.
• Morale and trust – employees who discover they were being watched by a colleague may react with anger, resentment and reduced productivity, even if they were innocent.
• Liability for the operative's conduct – the organization may be held responsible for wrongful acts committed by its agent during the operation.
• Damage to the underlying case – if the covert work is tainted, prosecutors may decline the case and civil recovery may be jeopardized.

How Risk Is Managed – The Controls the Exam Expects You to Know
Nearly every question about risks has a mirror-image question about mitigation. The Fraud Examiners Manual recommends the following before and during any covert operation:
• Confirm predication – never launch a covert operation on suspicion alone or to see what turns up.
• Obtain written authorization from appropriate senior management. The authorization memorandum should set out the information sought, the predication (reasons the operation is justified), the legal basis and legal review, the identities of the operatives and those with knowledge, the methods to be used, and the expected duration and cost.
• Consult legal counsel on privacy, wiretap, labor, licensing and jurisdictional issues before anything begins.
• Define clear objectives and a time limit; end the operation when the objective is met or when it becomes clear it will not be.
• Limit knowledge to those who absolutely need it.
• Select and train the operative carefully; build a credible, verifiable cover identity and plan the operative's extraction.
• Instruct the operative never to instigate or encourage criminal conduct, to avoid participating in illegal acts, and to report regularly.
• Maintain meticulous documentation – surveillance logs, dated notes, properly handled recordings.
• Corroborate informant information independently and keep informant identities confidential; pay informants only in accordance with policy and document payments.
• Coordinate with law enforcement where the matter is likely to become criminal, while recognizing that such coordination changes the legal rules that apply.

How to Answer Exam Questions on Risks of Covert Operations
CFE questions on this topic are usually one of four types:
• Definition or identification – 'Which of the following is a risk associated with undercover operations?' The correct answer is almost always a legal exposure (entrapment, invasion of privacy, defamation), a safety exposure, or an operational exposure (operative discovered, operative drawn into wrongdoing). A distractor will often be a benefit of covert work dressed up as a risk.
• Best practice or 'which is NOT recommended' – these test the mitigation list. The incorrect choice is typically something that increases risk: informing many people, starting without predication, proceeding without legal review, allowing the operative to suggest the crime, or having no written objectives.
• True or false statements – watch for absolutes. Statements such as 'covert operations should be the first investigative step' or 'entrapment is never a concern for private investigators' are false.
• Scenario questions – a short fact pattern asks what the fraud examiner should do. Apply the sequence: predication → legal review → written authorization with objectives → need-to-know → careful selection of operative → document everything → do not instigate.

Exam Tips: Answering Questions on Risks of Covert Operations
• Think 'last resort'. If an answer choice positions covert work as a routine or preliminary technique, it is wrong. The ACFE position is that covert operations are used only when conventional methods are unavailable or have failed.
• Memorize the authorization memo elements. Information sought, predication, legal review, who is involved and who knows, methods, time and cost. Questions frequently ask which element belongs (or does not belong) in the memorandum.
• Separate 'observe' from 'instigate'. Any choice in which the operative proposes, encourages or supplies the means for the crime points to entrapment risk and is the wrong thing to do.
• Remember the legal grab-bag. If asked to list legal risks, the examiner is looking for entrapment, invasion of privacy, illegal recording/wiretap violations, defamation, false imprisonment, trespass, labor-law and licensing violations. If one of these appears as an option, it is very likely correct.
• Confidentiality is a control, not a risk. Distractors sometimes list 'maintaining strict secrecy' among risks; secrecy is the mitigation. The risk is the leak.
• Informants require corroboration. If a question involves an informant, the correct answer will nearly always emphasize verifying the information independently and protecting the informant's identity, and will warn against relying on uncorroborated informant claims.
• Government involvement changes the rules. When law enforcement directs or participates, constitutional protections apply and the entrapment defense becomes fully available to the subject. Questions that mention police involvement are testing whether you recognize this shift.
• Watch for 'morale' and 'embarrassment'. These softer organizational risks are legitimate and do appear as correct answers; do not dismiss them as too vague.
• Eliminate benefits disguised as risks. 'Obtaining evidence unavailable by other means' is an advantage, not a risk. Cross out such options immediately.
• Read for 'NOT' and 'EXCEPT'. Many covert-operations questions are negatively phrased. Underline the negative word before evaluating the choices.

Practice Questions
Q1. Which of the following is the primary reason a fraud examiner should document predication before beginning an undercover operation?
A. To comply with professional licensing rules
B. To demonstrate that the operation was justified and not a fishing expedition
C. To ensure the operative is paid correctly
D. To satisfy the subject's right to notice
Answer: B. Written predication shows the operation had a reasonable basis, protecting against claims of harassment, invasion of privacy and entrapment.

Q2. An undercover operative, frustrated at the slow pace of the investigation, suggests to a purchasing manager that they split a bribe from a vendor. The manager agrees. The greatest risk created by the operative's conduct is:
A. Trespass
B. Defamation
C. Entrapment
D. Breach of licensing law
Answer: C. The operative induced conduct the subject may not otherwise have undertaken.

Q3. Which of the following would MOST increase the risk that a covert operation is compromised?
A. Limiting knowledge to a small group on a need-to-know basis
B. Setting a defined time frame for the operation
C. Briefing the subject's department on the existence of an internal review
D. Having legal counsel review the plan
Answer: C. Widening the circle of knowledge is the classic cause of leaks and blown cover.

Q4. True or False: Information provided by an informant may be accepted at face value if the informant has been reliable in the past.
Answer: False. Informant information should always be independently corroborated; informants may have hidden motives or may be mistaken.

Q5. All of the following are elements the Fraud Examiners Manual recommends including in a covert operation authorization memorandum EXCEPT:
A. The information expected to be obtained
B. The predication for the operation
C. The anticipated cost and duration
D. The names of all employees in the subject's department
Answer: D. The memo identifies operatives and those with knowledge of the operation, not the entire workforce.

One-Page Summary to Memorize
• Covert operations = undercover work, surveillance and informants, conducted without the subject's knowledge.
• Use only with predication, when other methods will not work, when legal, and after weighing risk against benefit.
• Legal risks: entrapment, invasion of privacy, illegal recording, defamation, false imprisonment, trespass, labor and licensing violations, constitutional issues when government is involved.
• Safety risks: operative discovered, retaliation, accidents, operative corrupted or drawn into crime.
• Operational risks: loss of control, leaks, poor documentation, unreliable informants, cost, scope creep.
• Organizational risks: embarrassment, morale damage, liability for operative's acts, tainted case.
• Controls: predication, written senior-management authorization memo, legal counsel review, clear objectives and time limit, need-to-know, careful operative selection and training, never instigate, document everything, corroborate informants, coordinate with law enforcement where appropriate.
• Exam mindset: covert work is a last resort; secrecy and documentation are controls; anything that encourages the crime, widens knowledge, or skips legal review is the wrong answer.