Planning a Fraud Examination

1. Why Planning a Fraud Examination Matters

Planning is the foundation of every successful fraud examination. In the ACFE Fraud Examiners Manual, the Investigation section stresses that a fraud examination is a non-recurring, adversarial, litigation-focused process. Unlike a routine audit, it is initiated only when there is reason to believe fraud has occurred, and it may end in a courtroom, a termination hearing, a regulatory action, or an insurance claim. Because of this, a poorly planned examination can expose the examiner and the organization to serious consequences: destroyed or tainted evidence, loss of attorney-client privilege, tipping off the subject, defamation or wrongful-termination claims, wasted budget, and ultimately an inability to prove or disprove the allegation.

For the CFE Exam, this topic is heavily tested because it ties together the core philosophy of the fraud examination profession: predication, the fraud theory approach, the assumption of litigation, and the proper order of evidence gathering. Candidates who understand why each planning element exists will find the exam questions far more intuitive.

2. What Is Planning a Fraud Examination?

Planning a fraud examination is the structured process of deciding whether an examination is warranted, defining its objectives and scope, assembling the right team, developing a working hypothesis, and mapping out how evidence will be gathered so that the findings will withstand legal scrutiny. The Fraud Examiners Manual frames it around several key concepts:

(a) Predication. Predication is the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe a fraud has occurred, is occurring, or will occur. A fraud examination should never be commenced without proper predication. Predication can come from a tip, a complaint, an audit finding, an anomaly in the accounting records, or observed behavioral red flags. A mere hunch, rumor, or dislike of an employee is not sufficient predication. Fraud examinations are initiated to resolve the allegation, not to go on a fishing expedition.

(b) The assumption of litigation. Every fraud examination should be conducted with the assumption that the case will end in litigation. This single principle drives nearly every planning decision: how evidence is documented, how the chain of custody is maintained, who is interviewed and when, and why legal counsel should be involved early.

(c) The fraud theory approach. Because fraud is usually hidden and the examiner begins with incomplete information, the Manual prescribes a hypothesis-driven method. The examiner assumes a fraud has occurred, builds a theory of how it was committed, and then sets out to prove or disprove it. The four steps, in order, are:
1. Analyze available data – review the existing documents, records, and information that gave rise to the predication.
2. Create a hypothesis – based on the data, develop a "worst-case scenario" theory of what the fraud is and how it could have been committed (e.g., a kickback scheme between a purchasing agent and a vendor).
3. Test the hypothesis – gather evidence that would exist if the hypothesis were true (e.g., vendor pricing above market, a sole-source relationship, lifestyle changes by the buyer).
4. Refine and amend the hypothesis – if the evidence does not support the theory, revise it or develop a new one and repeat the testing process.

The Manual illustrates this with the Linda Reed Collins case study, in which a tip about a purchasing manager leads to a hypothesis of a kickback/billing scheme that is then tested through document review and interviews.

(d) Fraud examination vs. audit. Exam questions frequently test the distinctions, which are part of planning because they define the examiner's mindset:
- Timing: Audits are recurring; fraud examinations are non-recurring and conducted only with sufficient predication.
- Scope: Audits are general (financial data); fraud examinations are specific, resolving particular allegations.
- Objective: Audits express an opinion on financial statements; fraud examinations seek to affix blame (determine whether fraud occurred and who is responsible).
- Relationship: Audits are non-adversarial; fraud examinations are adversarial by nature.
- Methodology: Audits use audit techniques; fraud examinations use document examination, review of outside data (such as public records), and interviews.
- Presumption: Auditors exercise professional skepticism; fraud examiners seek to establish sufficient proof to support or refute an allegation.

3. How Planning Works: The Practical Steps

Step 1 – Evaluate and document predication. Receive the tip or red flag, assess its credibility and the totality of circumstances, and document the basis for proceeding. If predication is insufficient, the proper course is to gather more information or decline to open a full examination, not to begin interviewing suspects.

Step 2 – Involve legal counsel early. When the examination is conducted at the direction of counsel, communications and work product may be protected by the attorney-client privilege and the work-product doctrine. Counsel also advises on employee rights, privacy, labor agreements, and the risks of defamation, false imprisonment, or wrongful discharge. External examiners should obtain a written engagement letter (preferably from counsel) that sets out scope, objectives, fees, and reporting lines.

Step 3 – Define objectives and scope. Decide what the examination must answer: Did a fraud occur? Who is responsible? What is the loss? How did controls fail? Is recovery or prosecution a goal? Clear objectives keep the examination focused and prevent scope creep.

Step 4 – Assemble the fraud examination team. Depending on the matter, the team may include Certified Fraud Examiners, legal counsel, internal auditors, security or loss-prevention personnel, human resources, IT and digital forensics specialists, a management representative, and outside consultants (e.g., forensic accountants or private investigators). The team should be kept small and on a strict need-to-know basis to preserve confidentiality and avoid alerting the subject. The fraud examiner should remain objective and independent; anyone with a conflict of interest should be excluded.

Step 5 – Develop the hypothesis and the case plan. Using the fraud theory approach, determine the likely scheme and identify what evidence would exist if it were true. The case plan should list the documents to secure, the data to analyze, the witnesses to interview and in what order, the tools required (data analytics, forensic imaging), the budget, and the timeline. Many examiners prepare a written case outline or memorandum that is updated as the hypothesis is refined.

Step 6 – Plan the order of evidence gathering. The Manual prescribes a deliberate sequence that moves from the general to the specific and from the least culpable to the most culpable:
1. Document and records examination – collect and analyze internal and external documents first; they are objective, do not alert the subject, and help frame later interviews.
2. Neutral third-party witnesses – people with no stake in the outcome (e.g., a bank officer, a records custodian).
3. Corroborative witnesses – individuals who can confirm facts but may not be directly involved (e.g., co-workers who noticed anomalies).
4. Co-conspirators – those suspected of complicity, interviewed from the least culpable to the most culpable.
5. The target (subject) – interviewed last, after the examiner has gathered enough evidence to conduct an informed admission-seeking interview.

Step 7 – Protect evidence and confidentiality. Plan for securing original documents, imaging electronic devices, preserving metadata, maintaining a chain of custody, and restricting access to the investigative file. Consider whether to suspend the subject's system access and when to do so without compromising the investigation.

Step 8 – Plan notifications and reporting. Determine who in management, the board, or the audit committee must be informed, whether and when law enforcement or regulators should be notified, and whether insurance (fidelity bond) notice deadlines apply. Plan the format of the final report, which should present facts objectively without stating opinions on guilt.

4. Common Planning Pitfalls

- Beginning without adequate predication.
- Interviewing the subject first, thereby tipping them off and allowing evidence destruction.
- Failing to involve counsel, losing privilege protection.
- Allowing too many people into the "circle of knowledge."
- Locking onto a single theory and refusing to refine it when evidence contradicts it.
- Treating the examination like a routine audit and failing to document for litigation.
- Letting management or the complainant dictate conclusions rather than following the evidence.

5. Exam Tips: Answering Questions on Planning a Fraud Examination

Tip 1 – Memorize the definition of predication word for word. The exam loves this: "the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe a fraud has occurred, is occurring, or will occur." If a question asks whether an examination can be started on a vague suspicion or an anonymous rumor alone, the answer is generally no – additional information should be gathered to establish predication first.

Tip 2 – Know the four steps of the fraud theory approach and their order. Analyze available data → Create a hypothesis → Test the hypothesis → Refine and amend the hypothesis. Questions often ask which step comes first (analyzing data, not creating a hypothesis) or what happens when the evidence does not support the theory (refine/amend it, not abandon the examination).

Tip 3 – Remember the "worst-case scenario" assumption. When developing a hypothesis, the examiner assumes the most serious plausible scheme and works to prove or disprove it. Do not confuse this with assuming the subject is guilty; it is a method of ensuring nothing is overlooked.

Tip 4 – Assume litigation. If a question asks about the general assumption under which every fraud examination should be conducted, the answer is that the case will end in litigation. This is why documentation, chain of custody, and counsel involvement are emphasized.

Tip 5 – Know the order of interviews cold. Neutral third parties first, then corroborative witnesses, then co-conspirators (least culpable to most culpable), and the target last. Any answer choice suggesting the subject should be interviewed early to "get their side first" is a distractor. Also recall that document examination generally precedes interviews.

Tip 6 – Differentiate fraud examination from audit. Expect questions that give a characteristic and ask whether it describes an audit or a fraud examination. Keywords: recurring, general, opinion, non-adversarial, professional skepticism = audit; non-recurring, specific, affix blame, adversarial, proof = fraud examination.

Tip 7 – Legal counsel and privilege. When a question asks who should direct or retain the examiner to maximize confidentiality protections, the answer points to legal counsel (attorney-client privilege and work-product doctrine). Also recall that counsel helps avoid liability for defamation, invasion of privacy, and wrongful discharge.

Tip 8 – Watch for absolutes and "best" questions. Many CFE questions ask for the best or most appropriate action. Eliminate choices that skip predication, involve the subject prematurely, widen the circle of knowledge unnecessarily, or express a conclusion of guilt. The Manual's approach is always methodical, objective, and evidence-driven.

Tip 9 – Team composition questions. If asked who typically belongs on a fraud examination team, recognize CFEs, legal counsel, internal auditors, security, HR, IT/forensic specialists, management representatives, and outside consultants. If asked who should not be included, think of anyone with a conflict of interest or anyone who is a potential subject or witness.

Tip 10 – Use the Manual's vocabulary. When two answers seem close, pick the one phrased in Fraud Examiners Manual terms ("predication," "fraud theory approach," "corroborative witness," "neutral third-party witness," "affix blame"). The exam is drawn directly from the Manual, and matching its language is a reliable strategy.

6. Quick Review Summary

- Planning begins with predication; no predication, no examination.
- Assume the case will end in litigation.
- Apply the fraud theory approach: analyze data, hypothesize (worst case), test, refine.
- Involve legal counsel early to preserve privilege and manage legal risk.
- Assemble a small, qualified, independent team on a need-to-know basis.
- Gather evidence from documents first, then neutral witnesses, corroborative witnesses, co-conspirators, and finally the target.
- Keep the examination specific, adversarial, non-recurring, and focused on establishing proof rather than offering an opinion.

Master these principles and you will be well prepared not only for the CFE Exam questions on Planning a Fraud Examination, but also for conducting defensible, professional examinations in practice.