Data Collection Challenges

Overview

Data collection is the foundation of every data analysis engagement in a fraud examination. Before a Certified Fraud Examiner can run Benford's Law tests, duplicate payment searches, or trend analyses, the right data must be identified, requested, obtained, verified, and prepared. The ACFE recognises that this stage is frequently the most time-consuming and error-prone part of the entire data analysis process. This guide explains why data collection challenges matter, what they are, how fraud examiners manage them in practice, and how to approach exam questions on the topic within the Data Analysis and Reporting Tools area of the CFE Exam.

Why This Topic Is Important

1. Garbage in, garbage out. No analytical technique, however sophisticated, can compensate for incomplete, inaccurate, or mismatched data. If the dataset is flawed, the conclusions drawn from it will be flawed, and the examiner may miss red flags or, worse, accuse innocent parties.

2. Evidentiary integrity. Data gathered during a fraud examination may ultimately be presented in litigation. If the collection process cannot be shown to be complete, authentic, and properly documented, the evidence may be challenged or excluded.

3. Efficiency and cost. Fraud examinations are often conducted under tight deadlines and budgets. The ACFE notes that obtaining and cleaning data often consumes more time than the analysis itself. Understanding the challenges in advance allows the examiner to plan realistically.

4. Legal and regulatory exposure. Mishandling personal or confidential data during collection can breach privacy laws, employment agreements, or data protection regulations, creating liability for the examiner and the organisation.

5. Exam weighting. The CFE Exam tests the examiner's understanding of the full data analysis life cycle, and questions on the practical obstacles of acquiring data appear regularly in the Investigation section.

What Data Collection Challenges Are

Data collection challenges are the practical, technical, legal, and organisational obstacles that arise when a fraud examiner attempts to obtain the data needed for analysis. The ACFE Fraud Examiners Manual identifies a range of common difficulties, which can be grouped as follows:

1. Identifying and Locating the Right Data
- Organisations store data across numerous systems: ERP platforms, legacy mainframes, departmental spreadsheets, cloud applications, email servers, and third-party processors.
- The examiner may not know which system holds the relevant records, or who owns the data.
- Some data may no longer exist due to retention policies, system migrations, or archiving.
- The fraud examiner must first understand the business processes and systems before knowing what to ask for.

2. Gaining Access and Securing Cooperation
- Data is typically controlled by the IT department, which may have competing priorities, limited resources, or reluctance to release information.
- Access permissions and security policies may restrict who can extract data.
- The examiner must often rely on IT personnel to perform the extraction, which introduces the risk of errors or incomplete pulls.
- In confidential investigations, requesting data may tip off the subject if the request goes through the wrong channel or involves the suspect's own department.

3. Data Format and Compatibility Issues
- Data may be stored in proprietary formats that analysis tools cannot read directly.
- Different systems use different date formats, currency conventions, character encodings, and field structures.
- Legacy systems may export data in fixed-width text files, EBCDIC encoding, or report-print formats that require significant conversion.
- Joining data from multiple systems requires common keys (such as vendor numbers or employee IDs) that may not exist or may be inconsistent.

4. Data Volume
- Large organisations generate millions of transactions. Extracting, transferring, and storing such volumes can strain systems and tools.
- Pulling too much data wastes time and resources; pulling too little risks missing relevant transactions.
- Scoping decisions (date ranges, business units, account types) must balance completeness against practicality.

5. Data Quality Problems
- Incomplete data: missing fields, blank records, truncated extracts.
- Inaccurate data: input errors, outdated master files, inconsistent spellings of vendor or employee names.
- Duplicate records: the same entity appearing under multiple IDs.
- Inconsistent coding: different departments using different codes for the same thing.
- These problems must be addressed during data cleansing and normalisation before meaningful analysis can occur.

6. Verifying Completeness and Accuracy of the Extract
- The examiner cannot simply assume that the data received matches what exists in the source system.
- Control totals, record counts, and hash totals must be compared between the source system and the extract.
- Field-level checks (date ranges, minimum and maximum values, blank fields) help confirm the extract is complete.

7. Legal, Privacy, and Confidentiality Constraints
- Data protection laws (such as the GDPR in Europe and various privacy statutes elsewhere) restrict how personal data can be collected, transferred, and processed.
- Cross-border data transfers may be prohibited or require specific safeguards.
- Employee privacy rights, union agreements, and employment contracts may limit access to certain records.
- Privileged communications and third-party confidential information may be mixed in with relevant data.
- Data may need to be anonymised or access restricted on a need-to-know basis.

8. Preserving Evidentiary Integrity
- Original data must be preserved unaltered; analysis should be performed on a verified copy.
- Chain of custody must be documented from extraction through analysis.
- Metadata (creation dates, authorship, modification history) must be preserved where relevant.
- Read-only access to the working copy prevents accidental modification.

9. Unstructured Data
- Emails, documents, chat logs, and free-text comment fields are harder to collect and analyse than structured transactional data.
- Collecting unstructured data often requires specialised forensic tools and raises additional privacy and privilege concerns.

10. Documentation and Data Dictionaries
- Field names in system exports are often cryptic (for example, VND_STAT_CD).
- Without a data dictionary or system documentation, the examiner may misinterpret what a field represents.
- Obtaining the data dictionary and understanding business rules behind the data is essential.

How Fraud Examiners Manage Data Collection Challenges

The ACFE describes a structured approach to data analysis in which data collection is handled deliberately and methodically. The key steps and best practices are:

Step 1: Understand the Business and Its Systems
Before requesting data, the examiner should learn how the business operates, which processes are relevant to the suspected fraud, where the data for those processes resides, and who controls it. Flowcharts, interviews with process owners, and system inventories are useful tools.

Step 2: Define Objectives and Build Fraud Profiles
The examiner identifies the specific fraud schemes under consideration and determines what data would reveal them. This prevents over-collection and ensures the request is targeted. For example, a suspected billing scheme requires vendor master files, accounts payable transactions, and employee master data to compare addresses.

Step 3: Prepare a Precise, Written Data Request
A clear request to IT should specify:
- The systems and tables required
- The exact fields needed
- Date ranges and other scoping parameters
- The desired output format (preferably a common delimited format or a format readily imported into the analysis tool)
- A request for the data dictionary and record layout
- A request for control totals and record counts from the source system
- Confidentiality instructions

Step 4: Consider Confidentiality in Routing the Request
The request should be routed so that the subject of the investigation is not alerted. This may mean working with senior IT management rather than departmental staff, or using an independent extraction.

Step 5: Obtain Data in Usable Form
Where possible, obtain data directly from the source system rather than from reports or spreadsheets prepared by others, since secondary sources may be filtered, summarised, or manipulated. Avoid print-image reports that require re-keying or parsing.

Step 6: Verify the Data
Immediately upon receipt, reconcile the extract to the source using record counts, control totals (for example, total of all invoice amounts), and spot checks of individual records. Check for blank fields, date ranges outside the requested scope, and obvious anomalies. Any discrepancies should be resolved with IT before proceeding.

Step 7: Preserve the Original and Work on a Copy
Secure the original extract in a read-only state, document its receipt (date, source, person providing, method of transfer), and create a working copy for analysis. Maintain chain-of-custody documentation.

Step 8: Cleanse and Normalise
Standardise formats (dates, currencies, text case), remove or flag duplicates, resolve inconsistent codes, and join datasets using reliable keys. Document every transformation so the process can be replicated and defended.

Step 9: Address Legal and Privacy Requirements
Consult with legal counsel regarding privacy laws, cross-border transfer restrictions, and privilege issues. Restrict access to the data, anonymise where feasible, and ensure the collection is proportionate to the investigation's purpose.

Step 10: Document the Entire Process
A complete record of what was requested, what was received, how it was verified, and how it was prepared supports the credibility of the analysis and the admissibility of resulting evidence.

Key Concepts Frequently Tested

- Data should be requested in a format compatible with the analysis software, and the data dictionary should be requested alongside the data.
- The examiner should obtain data from the original source system, not from secondary reports.
- Completeness should be verified using control totals and record counts compared against the source.
- The original data should be preserved; analysis is performed on a copy.
- Obtaining and preparing data is often the most time-consuming phase of data analysis.
- IT cooperation is essential, and the examiner should communicate clearly and plan for IT resource constraints.
- Privacy laws may restrict collection, transfer, and use of personal data.
- Data from multiple systems must be normalised before it can be combined and analysed.
- Unstructured data requires different collection methods and tools than structured data.

Exam Tips: Answering Questions on Data Collection Challenges

Tip 1: Think sequence. Many questions test whether you understand that data collection and verification come before analysis. If a question asks what the examiner should do first upon receiving data, the answer is to verify its completeness and accuracy, not to begin running tests.

Tip 2: Prefer the source. When options include obtaining data from the original system versus from a manager's spreadsheet or a printed report, the ACFE position favours the original source system. Secondary sources may be incomplete, filtered, or altered.

Tip 3: Remember control totals. If a question asks how to confirm that an extract is complete, look for answers involving record counts, control totals, or hash totals reconciled to the source system. Reviewing a sample of records alone is not sufficient to prove completeness.

Tip 4: Protect the original. Questions about evidentiary integrity are answered by preserving the original data unaltered, working on a copy, maintaining chain of custody, and documenting every step.

Tip 5: Watch for confidentiality traps. If a scenario involves a suspect who works in or manages the department holding the data, the best answer usually involves routing the data request through a channel that does not alert the suspect.

Tip 6: Recognise the time factor. The ACFE repeatedly emphasises that collecting and preparing data takes longer than expected. Answers that assume data can be obtained instantly or that skip the verification stage are usually wrong.

Tip 7: Identify the type of challenge. Read the scenario carefully and classify the problem: is it an access issue, a format issue, a quality issue, a volume issue, or a legal issue? The best answer will address that specific category. For instance, inconsistent vendor names across systems is a normalisation issue, not an access issue.

Tip 8: Legal considerations override convenience. If a question involves personal data, cross-border transfer, or privileged material, the correct answer will typically involve consulting counsel and complying with applicable laws, even if that slows the examination.

Tip 9: Data dictionary matters. If a scenario describes confusion over what a field means, the solution is to obtain the data dictionary or system documentation, not to guess based on field names.

Tip 10: Eliminate extreme answers. Options that suggest collecting all data in the organisation, skipping verification to save time, or modifying original files to fix errors are almost always incorrect. The ACFE approach is targeted, verified, documented, and preserves originals.

Tip 11: Use ACFE terminology. Terms such as data cleansing, normalisation, control totals, data dictionary, record layout, chain of custody, and structured versus unstructured data signal the correct answer when they appear in options consistent with the concepts above.

Sample Question Walkthrough

A fraud examiner requests accounts payable data from the IT department. The file arrives, but the examiner wants to ensure the extract is complete before beginning the analysis. Which of the following is the MOST appropriate step?

A. Begin the analysis immediately, since IT is responsible for data accuracy
B. Compare record counts and control totals from the extract to the totals in the source system
C. Review the first 100 records to confirm the fields look reasonable
D. Ask the accounts payable manager whether the file looks correct

The correct answer is B. Verifying completeness requires reconciling the extract to the source using record counts and control totals. Option A skips verification; Option C checks only a sample and cannot confirm completeness; Option D relies on a potentially interested party and is not an objective verification.

Summary

Data collection challenges encompass the difficulties of locating, accessing, extracting, formatting, verifying, protecting, and documenting the data needed for fraud analysis. The fraud examiner overcomes them by understanding the business, writing precise requests, obtaining data from the source, verifying completeness with control totals, preserving originals, cleansing and normalising carefully, respecting legal constraints, and documenting everything. On the CFE Exam, success depends on recognising the correct sequence of steps, favouring source data and objective verification, protecting evidentiary integrity, and applying the ACFE's disciplined, documented approach to every scenario.