Recommendations in Fraud Examination Reports

Why This Topic Matters

The fraud examination report is the culmination of the entire engagement. Every interview conducted, every document analyzed, and every transaction traced ultimately flows into a written product that management, the board, counsel, regulators, or a court will rely upon. The recommendations section is where the examination transitions from what happened to what should happen next. Handled well, recommendations help an organization recover losses, close control gaps, and prevent recurrence. Handled poorly, they can expose the fraud examiner to allegations of bias, defamation, or overstepping professional boundaries, and they can undermine the credibility of the entire report in litigation.

On the CFE Exam, this topic sits within the Investigation section under Report Writing. Questions test whether you understand not only how to craft useful recommendations, but also the important limits the ACFE places on what a fraud examiner should and should not say in a written report. Many candidates lose points here because they assume a fraud examiner should recommend everything (prosecution, termination, control changes) in the main report. The ACFE position is more nuanced, and the exam tests that nuance.

What Are Recommendations in a Fraud Examination Report?

Recommendations are suggested courses of action arising from the findings of the examination. In the fraud examination context, they generally fall into a few categories:

1. Recommendations for further investigation – for example, extending the review to other periods, departments, vendors, or employees when the evidence suggests the scheme may be broader than the original scope.

2. Recommendations for remedial action on internal controls – addressing the specific weaknesses that allowed the fraud to occur or go undetected, such as inadequate segregation of duties, missing approval thresholds, weak vendor master file controls, or lack of independent reconciliations.

3. Recommendations concerning policy and procedure changes – updating codes of conduct, whistleblower mechanisms, fraud awareness training, or monitoring and data analytics programs.

4. Recommendations regarding disposition – matters such as disciplinary action, civil recovery, insurance claims, or referral to law enforcement. These are the most sensitive and, per ACFE guidance, are usually not placed in the body of the formal written report.

The critical concept to grasp is that the fraud examiner is a fact finder, not a decision maker. The report documents what the evidence shows. Decisions about what to do with those facts belong to management, the board, legal counsel, and the justice system.

Where Recommendations Fit in the Report Structure

The Fraud Examiners Manual describes a typical long-form report as containing sections such as: Background, Executive Summary, Scope, Approach (team, procedures performed), Findings, Summary, Impact, Recommendations, and Follow-Up. Recommendations, when included, should appear in a separate, clearly labeled section at the end of the report, or in a separate document or appendix altogether. This separation preserves the objective, factual character of the findings and prevents readers from confusing the examiner's suggestions with the evidence itself.

Importantly, the ACFE notes that depending on the circumstances, a report may or may not include recommendations. Whether recommendations are included depends on the engagement terms, the client's wishes, and the advice of counsel. In many engagements, particularly those conducted under attorney direction or anticipated to end in litigation, recommendations are communicated orally or in a separate memorandum rather than in the discoverable fact report.

How It Works: Principles for Effective Recommendations

1. Tie every recommendation to a finding. A recommendation that does not trace back to a documented weakness or fact identified in the examination lacks foundation and invites challenge. The reader should be able to see the logical chain: this control failed, this is how it was exploited, therefore this change is suggested.

2. Address root causes, not just symptoms. If an employee created fictitious vendors because no one independently reviewed vendor master file additions, the recommendation should target the review and approval process, not merely suggest removing the fictitious vendors.

3. Be specific and actionable. Vague recommendations such as 'improve controls' are of little use. Specify what control, who should own it, and how it should operate. For example: 'Require that all additions and changes to the vendor master file be approved by an individual outside the accounts payable function and that a monthly exception report of such changes be reviewed by the controller.'

4. Consider cost versus benefit. Controls should be proportionate to the risk. Recommending controls that cost more than the exposure they mitigate reflects poor judgment. The exam may present a scenario where the 'best' answer is the one that balances control strength with practicality.

5. Prioritize. Where multiple weaknesses exist, indicate which carry the greatest risk so management can allocate resources sensibly.

6. Maintain impartiality. Recommendations must be written in the same neutral, professional tone as the rest of the report. They should never read as advocacy against a particular individual.

7. Stay within your expertise. A fraud examiner may offer opinions on the adequacy of internal controls and on whether the evidence is consistent with a fraud scheme. A fraud examiner should not offer legal conclusions (for example, whether a statute was violated) unless qualified to do so, and should defer legal, tax, or technical matters to the appropriate professionals.

What Recommendations Must NOT Contain

This is the area most heavily tested. The ACFE Code of Professional Ethics states that a Certified Fraud Examiner shall not express an opinion regarding the guilt or innocence of any person or party. This principle extends into the recommendations section. Avoid:

• Statements such as 'John Smith is guilty of embezzlement and should be prosecuted.' Guilt is determined by a court. The report may state that the evidence indicates funds were diverted and that Smith had access and authority over the account, but it does not pronounce guilt.

• Legal conclusions, such as declaring that conduct constituted 'fraud' in the legal sense or violated a specific statute, unless the examiner is an attorney or is quoting counsel.

• Recommendations for termination or specific discipline of an identified individual. Employment decisions carry legal consequences and belong to management and counsel. If asked, the examiner may discuss options orally or in a privileged communication.

• Speculation, assumptions, or conclusions not supported by evidence presented in the findings.

• Inflammatory, emotional, or judgmental language. Words like 'obviously,' 'clearly dishonest,' or 'criminal' should not appear.

• Opinions as to the character or motives of individuals.

The reasoning behind these limits is practical as well as ethical. A fraud examination report is frequently discoverable in civil or criminal proceedings. Opinions about guilt can expose the examiner and the client to defamation claims. Recommendations about prosecution may be construed as evidence of malice or predetermined conclusions. A report confined to facts and control observations is far more defensible under cross-examination.

Recommendations and the Qualities of a Good Report

The ACFE identifies key characteristics of a well-written report: accuracy, clarity, impartiality, relevance, and timeliness. Recommendations must satisfy all five. They should be accurate (grounded in verified facts), clear (understandable to a non-expert reader), impartial (not targeting individuals), relevant (connected to the scope and findings), and timely (delivered while the organization can still act, since delays allow further losses or evidence loss).

Follow-Up

Closely related to recommendations is the Follow-Up section, which notes what actions remain outstanding, such as additional interviews, document requests pending, or referrals made. The exam sometimes blends these; remember that follow-up describes unfinished examination tasks, while recommendations describe suggested organizational actions.

Exam Tips: Answering Questions on Recommendations in Fraud Examination Reports

Tip 1 – Remember the fact finder role. When a question asks what the examiner should do regarding prosecution, termination, or guilt, the correct answer almost always involves not stating it in the written report. The examiner presents facts; management and counsel decide outcomes. If one answer choice has the examiner 'recommending that the subject be fired and prosecuted' in the report, it is usually a distractor.

Tip 2 – Guilt or innocence is never an opinion the examiner gives. Any option in which the report expresses or implies a conclusion about a person's guilt violates the ACFE Code of Professional Ethics. Eliminate it immediately.

Tip 3 – Internal control recommendations ARE appropriate. Do not overcorrect. Fraud examiners can and do recommend control improvements, and the exam treats this as a legitimate and valuable part of the engagement. Opinions on the adequacy of internal controls and whether evidence is consistent with fraud are permissible.

Tip 4 – Separate section, or separate document. If asked where recommendations belong, the answer is a distinct section near the end of the report, or a separate report or memorandum, depending on client wishes and counsel's advice. They never belong mixed into the findings.

Tip 5 – Watch for 'should the report always include recommendations?' questions. The answer is no. Inclusion is situational, driven by the engagement agreement and legal considerations. A true/false item stating that every fraud examination report must contain recommendations is false.

Tip 6 – Favor specific, root-cause, cost-justified options. When comparing sample recommendations, the best one identifies a concrete control, assigns responsibility, addresses the underlying weakness, and is proportionate to the risk.

Tip 7 – Think about litigation exposure. If a scenario mentions that the matter may go to court, lean toward answers that keep the written report factual and move sensitive recommendations into oral briefings or privileged communications with counsel.

Tip 8 – Distinguish recommendations from follow-up and impact. Impact describes the effect of the fraud (loss amounts, reputational harm). Follow-up lists outstanding examination tasks. Recommendations propose organizational actions. Read the question carefully to identify which section it is really asking about.

Tip 9 – Apply the five report qualities. If an answer choice would make the report inaccurate, unclear, biased, irrelevant to scope, or untimely, it is wrong even if it sounds helpful.

Tip 10 – Stay within expertise. Answers that have the examiner issuing legal opinions, tax rulings, or technical conclusions outside the fraud examination discipline are distractors unless the scenario establishes the examiner holds the relevant qualification.

Quick Summary

Recommendations convert examination findings into forward-looking action. They should focus on further investigative steps and internal control improvements, be placed in a separate section or document, trace directly to documented findings, address root causes, and be specific, practical, and prioritized. They must never express opinions on guilt or innocence, offer unqualified legal conclusions, or dictate disciplinary or prosecutorial decisions, which rest with management, counsel, and the courts. Master this balance between usefulness and restraint, and you will handle any CFE Exam question on this topic with confidence.