Fraud Examination and Predication
5 minutes
5 Questions
Fraud examination is a methodology for resolving allegations of fraud from inception to disposition. It encompasses obtaining evidence, taking statements, writing reports, testifying to findings, and assisting in the detection and prevention of fraud. Unlike a financial audit, which is recurring and designed to express an opinion on financial statements, a fraud examination is non-recurring, adversarial in nature, and conducted only when there is sufficient reason to believe fraud may have occurred. The examiner's goal is to determine whether fraud has occurred and, if so, to identify who is responsible, how it was committed, and the extent of the loss. Fraud examinations follow a structured approach: beginning with the general and moving to the specific, reviewing documents, interviewing neutral third-party witnesses, then corroborative witnesses, then co-conspirators, and finally the suspect. The fraud theory approach guides this process, in which the examiner analyzes available data, creates a hypothesis, tests it, and refines or amends it as evidence develops. Predication is the foundation on which every fraud examination must rest. It is defined as the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe a fraud has occurred, is occurring, or will occur. Predication may arise from an anonymous tip, a hotline complaint, an audit finding, internal control irregularities, unusual financial patterns, or a whistleblower report. Importantly, a fraud examination should never be commenced without adequate predication; mere suspicion or a hunch is insufficient. Conducting an examination without proper predication exposes the organization and examiner to legal risk, including claims of defamation, invasion of privacy, or wrongful termination. Predication also serves as the starting point for developing the fraud theory, as the examiner evaluates the allegation, determines what evidence would be necessary to prove or disprove it, and plans the scope of the investigation. In summary, predication provides the legal and ethical justification for proceeding, while the fraud examination provides the disciplined process for resolving the matter.
Fraud Examination and Predication: A Complete CFE Exam Guide
Why This Topic Matters
Fraud Examination and Predication sits at the very foundation of the Investigation section of the CFE Exam (Planning and Conducting a Fraud Examination). Before a fraud examiner interviews a single witness or pulls a single document, there must be a legitimate reason to begin. That reason is called predication. The ACFE treats this as a professional and ethical gatekeeper: an examination launched without proper predication exposes the examiner and the organization to claims of defamation, invasion of privacy, wrongful termination, and malicious prosecution. On the exam, this topic is tested heavily through definitions, the fraud theory approach, the differences between auditing and fraud examination, and the proper sequencing of investigative steps. Mastering it not only earns points on its own but also frames how you should think about every other investigation question.
What Is a Fraud Examination?
According to the Fraud Examiners Manual, a fraud examination is a methodology for resolving fraud allegations from inception to disposition. It encompasses more than just investigating; it includes:
• Obtaining documentary evidence
• Interviewing witnesses and potential suspects
• Writing investigative reports
• Testifying to findings
• Assisting in the detection and prevention of fraud
The key word is resolving. A fraud examination is conducted to determine whether fraud occurred, who was responsible, how it was committed, how much was lost, and what should be done about it. It is a structured, disciplined process, not an open-ended fishing expedition.
Fraud Examination vs. Auditing
The exam frequently asks you to distinguish fraud examination from financial auditing. Memorize these six contrasts:
1. Timing - Auditing is recurring (performed on a regular basis). Fraud examination is non-recurring (conducted only when there is sufficient predication).
2. Scope - Audits are general examinations of financial data. Fraud examinations are specific, focused on resolving particular allegations.
3. Objective - The audit objective is to render an opinion on the financial statements. The fraud examination objective is to affix blame (determine whether fraud occurred and who was responsible).
4. Relationship - Auditing is non-adversarial. Fraud examination is inherently adversarial, because the examiner is attempting to affix blame.
5. Methodology - Audits use audit techniques (primarily examination of financial data). Fraud examinations use fraud examination techniques, including document examination, review of outside data (such as public records), and interviews.
6. Presumption - Auditors exercise professional skepticism. Fraud examiners work to establish proof sufficient to support or refute an allegation.
What Is Predication?
This is the single most testable definition in this concept. The ACFE defines predication as: "the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe a fraud has occurred, is occurring, and/or will occur."
Break the definition into its components:
• Totality of circumstances - Predication is based on the whole picture, not a single isolated fact. Several small red flags together can form adequate predication.
• Reasonable, professionally trained, and prudent individual - This is an objective standard. The question is not whether the examiner personally feels suspicious, but whether a trained professional would reasonably believe fraud may exist.
• Has occurred, is occurring, and/or will occur - Predication can relate to past, present, or anticipated fraud.
Predication is the basis upon which a fraud examination is commenced. Fraud examinations should not be conducted without proper predication. Common sources of predication include anonymous tips or hotline complaints, complaints from employees, customers or vendors, audit findings and accounting anomalies, analytical irregularities, behavioral red flags combined with other indicators, and results of surveillance or data analysis.
Note that an anonymous tip can be sufficient predication to begin an examination, provided it is specific enough that a reasonable professional would believe it warrants looking into. Mere suspicion, hunches, rumors without substance, or a desire to look into someone for personal reasons do not constitute predication.
Why Predication Matters So Much
Proper predication protects everyone involved:
• It protects the subject from unwarranted intrusion into their privacy and reputation.
• It protects the examiner and organization from civil liability (defamation, false imprisonment, invasion of privacy, intentional infliction of emotional distress, wrongful discharge).
• It protects the integrity of the examination, ensuring resources are directed at legitimate concerns.
• It supports admissibility and credibility later, because the examination can be shown to have started for a legitimate business reason.
The Fraud Theory Approach
Because fraud is usually concealed and direct evidence is rare at the outset, fraud examinations follow the fraud theory approach. The examiner begins with the assumption, based on predication, that fraud has occurred, and then develops a working theory of how it was committed. The steps, in order, are:
1. Analyze available data - Review what is already known: the tip, the documents, the accounting records, the people involved.
2. Create a hypothesis - Form a theory of what type of fraud could have occurred, who might be involved, and how (for example, a 'worst-case' theory that the purchasing manager is receiving kickbacks from a vendor).
3. Test the hypothesis - Gather evidence that would exist if the hypothesis were true, and determine whether it does exist.
4. Refine and amend the hypothesis - If the evidence does not support the theory, revise it or develop a new one. Repeat until the allegation is resolved.
Exam questions often scramble these steps or ask which comes first. Remember: analyze, hypothesize, test, refine.
Core Principles of Fraud Examination Methodology
The exam also tests several guiding assumptions and practices:
• Assume litigation will follow. Every fraud examination should be conducted as if the case will ultimately end up in court. This governs how evidence is gathered, documented, and preserved, and how interviews are conducted.
• Act on predication. Do not begin without it, and do not expand the scope beyond what the predication supports without new predication.
• Approach from two perspectives. To prove a fraud occurred, the examiner must also attempt to prove it did not occur, and vice versa. Both sides must be considered; the examiner seeks the truth, not merely confirmation of a theory.
• Move from the general to the specific. Begin with broad information gathering and narrow toward specific facts and individuals.
• Move from the least culpable to the most culpable. Interview neutral third-party witnesses first, then corroborative witnesses, then co-conspirators, and finally the subject or target. The subject is interviewed last so the examiner has maximum information in hand.
Evidence-Gathering Order
A typical fraud examination proceeds in this sequence:
1. Document analysis - Gather and examine documentary and electronic evidence first, before alerting potential suspects.
2. Neutral third-party witnesses - Individuals with no stake in the outcome.
3. Corroborative witnesses - Individuals who can confirm facts but may be closer to the subject.
4. Co-conspirators - Suspected participants, approached from least to most culpable.
5. The subject (target) - Interviewed last.
Documents are generally collected before interviews because documents do not change their story, cannot be coached, and may disappear if suspects are alerted.
The Fraud Examination Team
Fraud examinations are rarely solo efforts. Depending on the case, the team may include Certified Fraud Examiners, legal counsel (who may direct the engagement to preserve privilege), internal auditors, corporate security, human resources personnel, management representatives, IT or digital forensics specialists, and outside consultants such as forensic accountants or private investigators. The examiner should understand each party's role and ensure communication flows appropriately, especially through counsel when privilege is a concern.
Exam Tips: Answering Questions on Fraud Examination and Predication
Tip 1 - Know the predication definition word for word. Expect the exam to present variations and ask which is correct. Look for the three anchors: 'totality of circumstances,' 'reasonable, professionally trained, and prudent individual,' and 'has occurred, is occurring, and/or will occur.' A distractor may drop one element or substitute 'certain' for 'believe.'
Tip 2 - Predication is a threshold, not proof. If a question asks whether an examiner needs proof of fraud before beginning, the answer is no. The examiner needs a reasonable basis to believe fraud may have occurred. Conversely, if a question suggests beginning an examination on a 'gut feeling' or because someone 'seems dishonest,' that is insufficient predication.
Tip 3 - Anonymous tips can be predication. A common true/false style item asks whether an anonymous hotline tip can justify an examination. It can, provided its content is specific enough to make a reasonable professional believe fraud may exist.
Tip 4 - Memorize the fraud theory approach in order. Analyze available data, create a hypothesis, test the hypothesis, refine and amend the hypothesis. Questions often ask 'what is the first step' (analyze data) or 'what should the examiner do if the evidence does not support the hypothesis' (refine and amend).
Tip 5 - Master the audit vs. fraud examination table. The six dimensions (timing, scope, objective, relationship, methodology, presumption) appear repeatedly. If a question describes something as recurring, general, non-adversarial, and opinion-based, it is auditing. If it describes something non-recurring, specific, adversarial, and aimed at affixing blame, it is fraud examination.
Tip 6 - Remember the litigation assumption. When a question asks how a fraud examiner should treat evidence or conduct the engagement, the guiding principle is to assume the case will end in litigation. Any answer choice that implies casual handling of evidence or informal documentation is likely wrong.
Tip 7 - Interview the subject last. Questions on sequencing almost always hinge on this rule. Neutral third parties first, then corroborative witnesses, then co-conspirators (least culpable to most culpable), and the target last. Documents are gathered before interviews begin.
Tip 8 - Watch for 'both perspectives' language. The ACFE stresses that an examiner must attempt to prove the allegation both true and false. An answer suggesting the examiner should only gather evidence supporting guilt reflects bias and is incorrect.
Tip 9 - Scenario questions: ask 'Is there predication?' first. When a scenario describes vague suspicions, personality conflicts, or rumors without facts, the correct response is usually to gather more information or decline to proceed rather than launch a full examination. When a scenario includes specific anomalies, credible complaints, or documented irregularities, predication likely exists and the examiner may proceed.
Tip 10 - Connect predication to liability. If asked why predication is required, link it to protecting against lawsuits (defamation, invasion of privacy, wrongful termination) and protecting the rights of the accused. The exam rewards understanding the 'why,' not just the 'what.'
Quick Review Summary
• A fraud examination is a methodology for resolving fraud allegations from inception to disposition.
• Predication is the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe fraud has occurred, is occurring, and/or will occur.
• Never begin a fraud examination without proper predication.
• Fraud examination differs from auditing in timing, scope, objective, relationship, methodology, and presumption.
• The fraud theory approach: analyze data, create a hypothesis, test it, refine and amend it.
• Assume litigation will follow; approach from both perspectives; move from general to specific and from least to most culpable.
• Gather documents first; interview the subject last.
With these principles firmly in mind, you will be well prepared to handle any exam question on Fraud Examination and Predication, and you will have the conceptual framework needed for the rest of the Investigation section.
Fraud Examination and Predication sits at the very foundation of the Investigation section of the CFE Exam (Planning and Conducting a Fraud Examination). Before a fraud examiner interviews a single witness or pulls a single document, there must be a legitimate reason to begin. That reason is called predication. The ACFE treats this as a professional and ethical gatekeeper: an examination launched without proper predication exposes the examiner and the organization to claims of defamation, invasion of privacy, wrongful termination, and malicious prosecution. On the exam, this topic is tested heavily through definitions, the fraud theory approach, the differences between auditing and fraud examination, and the proper sequencing of investigative steps. Mastering it not only earns points on its own but also frames how you should think about every other investigation question.
What Is a Fraud Examination?
According to the Fraud Examiners Manual, a fraud examination is a methodology for resolving fraud allegations from inception to disposition. It encompasses more than just investigating; it includes:
• Obtaining documentary evidence
• Interviewing witnesses and potential suspects
• Writing investigative reports
• Testifying to findings
• Assisting in the detection and prevention of fraud
The key word is resolving. A fraud examination is conducted to determine whether fraud occurred, who was responsible, how it was committed, how much was lost, and what should be done about it. It is a structured, disciplined process, not an open-ended fishing expedition.
Fraud Examination vs. Auditing
The exam frequently asks you to distinguish fraud examination from financial auditing. Memorize these six contrasts:
1. Timing - Auditing is recurring (performed on a regular basis). Fraud examination is non-recurring (conducted only when there is sufficient predication).
2. Scope - Audits are general examinations of financial data. Fraud examinations are specific, focused on resolving particular allegations.
3. Objective - The audit objective is to render an opinion on the financial statements. The fraud examination objective is to affix blame (determine whether fraud occurred and who was responsible).
4. Relationship - Auditing is non-adversarial. Fraud examination is inherently adversarial, because the examiner is attempting to affix blame.
5. Methodology - Audits use audit techniques (primarily examination of financial data). Fraud examinations use fraud examination techniques, including document examination, review of outside data (such as public records), and interviews.
6. Presumption - Auditors exercise professional skepticism. Fraud examiners work to establish proof sufficient to support or refute an allegation.
What Is Predication?
This is the single most testable definition in this concept. The ACFE defines predication as: "the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe a fraud has occurred, is occurring, and/or will occur."
Break the definition into its components:
• Totality of circumstances - Predication is based on the whole picture, not a single isolated fact. Several small red flags together can form adequate predication.
• Reasonable, professionally trained, and prudent individual - This is an objective standard. The question is not whether the examiner personally feels suspicious, but whether a trained professional would reasonably believe fraud may exist.
• Has occurred, is occurring, and/or will occur - Predication can relate to past, present, or anticipated fraud.
Predication is the basis upon which a fraud examination is commenced. Fraud examinations should not be conducted without proper predication. Common sources of predication include anonymous tips or hotline complaints, complaints from employees, customers or vendors, audit findings and accounting anomalies, analytical irregularities, behavioral red flags combined with other indicators, and results of surveillance or data analysis.
Note that an anonymous tip can be sufficient predication to begin an examination, provided it is specific enough that a reasonable professional would believe it warrants looking into. Mere suspicion, hunches, rumors without substance, or a desire to look into someone for personal reasons do not constitute predication.
Why Predication Matters So Much
Proper predication protects everyone involved:
• It protects the subject from unwarranted intrusion into their privacy and reputation.
• It protects the examiner and organization from civil liability (defamation, false imprisonment, invasion of privacy, intentional infliction of emotional distress, wrongful discharge).
• It protects the integrity of the examination, ensuring resources are directed at legitimate concerns.
• It supports admissibility and credibility later, because the examination can be shown to have started for a legitimate business reason.
The Fraud Theory Approach
Because fraud is usually concealed and direct evidence is rare at the outset, fraud examinations follow the fraud theory approach. The examiner begins with the assumption, based on predication, that fraud has occurred, and then develops a working theory of how it was committed. The steps, in order, are:
1. Analyze available data - Review what is already known: the tip, the documents, the accounting records, the people involved.
2. Create a hypothesis - Form a theory of what type of fraud could have occurred, who might be involved, and how (for example, a 'worst-case' theory that the purchasing manager is receiving kickbacks from a vendor).
3. Test the hypothesis - Gather evidence that would exist if the hypothesis were true, and determine whether it does exist.
4. Refine and amend the hypothesis - If the evidence does not support the theory, revise it or develop a new one. Repeat until the allegation is resolved.
Exam questions often scramble these steps or ask which comes first. Remember: analyze, hypothesize, test, refine.
Core Principles of Fraud Examination Methodology
The exam also tests several guiding assumptions and practices:
• Assume litigation will follow. Every fraud examination should be conducted as if the case will ultimately end up in court. This governs how evidence is gathered, documented, and preserved, and how interviews are conducted.
• Act on predication. Do not begin without it, and do not expand the scope beyond what the predication supports without new predication.
• Approach from two perspectives. To prove a fraud occurred, the examiner must also attempt to prove it did not occur, and vice versa. Both sides must be considered; the examiner seeks the truth, not merely confirmation of a theory.
• Move from the general to the specific. Begin with broad information gathering and narrow toward specific facts and individuals.
• Move from the least culpable to the most culpable. Interview neutral third-party witnesses first, then corroborative witnesses, then co-conspirators, and finally the subject or target. The subject is interviewed last so the examiner has maximum information in hand.
Evidence-Gathering Order
A typical fraud examination proceeds in this sequence:
1. Document analysis - Gather and examine documentary and electronic evidence first, before alerting potential suspects.
2. Neutral third-party witnesses - Individuals with no stake in the outcome.
3. Corroborative witnesses - Individuals who can confirm facts but may be closer to the subject.
4. Co-conspirators - Suspected participants, approached from least to most culpable.
5. The subject (target) - Interviewed last.
Documents are generally collected before interviews because documents do not change their story, cannot be coached, and may disappear if suspects are alerted.
The Fraud Examination Team
Fraud examinations are rarely solo efforts. Depending on the case, the team may include Certified Fraud Examiners, legal counsel (who may direct the engagement to preserve privilege), internal auditors, corporate security, human resources personnel, management representatives, IT or digital forensics specialists, and outside consultants such as forensic accountants or private investigators. The examiner should understand each party's role and ensure communication flows appropriately, especially through counsel when privilege is a concern.
Exam Tips: Answering Questions on Fraud Examination and Predication
Tip 1 - Know the predication definition word for word. Expect the exam to present variations and ask which is correct. Look for the three anchors: 'totality of circumstances,' 'reasonable, professionally trained, and prudent individual,' and 'has occurred, is occurring, and/or will occur.' A distractor may drop one element or substitute 'certain' for 'believe.'
Tip 2 - Predication is a threshold, not proof. If a question asks whether an examiner needs proof of fraud before beginning, the answer is no. The examiner needs a reasonable basis to believe fraud may have occurred. Conversely, if a question suggests beginning an examination on a 'gut feeling' or because someone 'seems dishonest,' that is insufficient predication.
Tip 3 - Anonymous tips can be predication. A common true/false style item asks whether an anonymous hotline tip can justify an examination. It can, provided its content is specific enough to make a reasonable professional believe fraud may exist.
Tip 4 - Memorize the fraud theory approach in order. Analyze available data, create a hypothesis, test the hypothesis, refine and amend the hypothesis. Questions often ask 'what is the first step' (analyze data) or 'what should the examiner do if the evidence does not support the hypothesis' (refine and amend).
Tip 5 - Master the audit vs. fraud examination table. The six dimensions (timing, scope, objective, relationship, methodology, presumption) appear repeatedly. If a question describes something as recurring, general, non-adversarial, and opinion-based, it is auditing. If it describes something non-recurring, specific, adversarial, and aimed at affixing blame, it is fraud examination.
Tip 6 - Remember the litigation assumption. When a question asks how a fraud examiner should treat evidence or conduct the engagement, the guiding principle is to assume the case will end in litigation. Any answer choice that implies casual handling of evidence or informal documentation is likely wrong.
Tip 7 - Interview the subject last. Questions on sequencing almost always hinge on this rule. Neutral third parties first, then corroborative witnesses, then co-conspirators (least culpable to most culpable), and the target last. Documents are gathered before interviews begin.
Tip 8 - Watch for 'both perspectives' language. The ACFE stresses that an examiner must attempt to prove the allegation both true and false. An answer suggesting the examiner should only gather evidence supporting guilt reflects bias and is incorrect.
Tip 9 - Scenario questions: ask 'Is there predication?' first. When a scenario describes vague suspicions, personality conflicts, or rumors without facts, the correct response is usually to gather more information or decline to proceed rather than launch a full examination. When a scenario includes specific anomalies, credible complaints, or documented irregularities, predication likely exists and the examiner may proceed.
Tip 10 - Connect predication to liability. If asked why predication is required, link it to protecting against lawsuits (defamation, invasion of privacy, wrongful termination) and protecting the rights of the accused. The exam rewards understanding the 'why,' not just the 'what.'
Quick Review Summary
• A fraud examination is a methodology for resolving fraud allegations from inception to disposition.
• Predication is the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe fraud has occurred, is occurring, and/or will occur.
• Never begin a fraud examination without proper predication.
• Fraud examination differs from auditing in timing, scope, objective, relationship, methodology, and presumption.
• The fraud theory approach: analyze data, create a hypothesis, test it, refine and amend it.
• Assume litigation will follow; approach from both perspectives; move from general to specific and from least to most culpable.
• Gather documents first; interview the subject last.
With these principles firmly in mind, you will be well prepared to handle any exam question on Fraud Examination and Predication, and you will have the conceptual framework needed for the rest of the Investigation section.
Test mode:
CFE - Fraud Examination and Predication Example Questions
Test your knowledge of Fraud Examination and Predication
Question 1
In fraud examination methodology, what is the consequence when an allegation lacks predication?
Question 2
A department head engages a fraud examiner on a predicated allegation that a payroll clerk added a ghost employee to the payroll. At the kickoff meeting, the department head says, "Your job is to prove she did it." Which of the following BEST describes how the examiner should frame the objective of the engagement?
Question 3
An organization receives a predicated allegation that a sales director has been inflating commission claims. The chief financial officer proposes that the accounting department recompute the director's commissions and treat any variance as the final finding. The fraud examiner assigned to the matter must respond to this plan. Which response BEST reflects the nature of a fraud examination?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Fraud Examination and Predication questions
19 questions (total)