Fraud Risk Assessment: Free CFE Practice Questions

Question 1

A fraud risk assessment team rates three risks. Fictitious expense reimbursements carry high inherent risk, but strong existing controls leave the residual risk low. Shell company billing carries moderate inherent risk, but because vendor master file changes are never reviewed, its residual risk is high and above the risk appetite. Petty cash misuse has moderate residual risk that falls within the appetite. Management can fund only one remediation project this year. Which allocation is MOST appropriate?

Fund new vendor master file controls to reduce the billing risk Fund added expense report controls, as its inherent rating is highest Insure the billing risk through a fidelity bond policy now Fund petty cash controls, as small losses there recur most often

Correct Answer: Fund new vendor master file controls to reduce the billing risk

Funding vendor master file controls is most appropriate because shell company billing is the only risk whose residual rating is high and exceeds management's risk appetite, and the missing review of vendor file changes is a specific control gap that remediation can directly close.
Adding expense report controls misdirects resources, since existing controls already reduce that risk to a low residual level; inherent ratings do not drive remediation priority. Petty cash residual risk already falls within the appetite. A fidelity bond only transfers part of the financial loss and leaves the control weakness that enables the scheme in place.
Key concept: prioritizing fraud risk responses by residual risk relative to risk appetite.

Question 2

A fraud examiner is consolidating fraud risk assessment results from three divisions into one report for the board. The board wants a single ranked list of the organization's most significant fraud risks. While compiling, the examiner finds that one division scored likelihood and impact on a three-point scale and the other two used a five-point scale. Which action should the examiner take to produce a reliable enterprise ranking?

Average the divisions' scores and rank on the combined result Rank each division's risks in a separate list for the board Rank the risks as submitted and footnote the scales Apply one common rating scale to all risks before ranking

Correct Answer: Apply one common rating scale to all risks before ranking

Converting every division's likelihood and impact ratings to one common scale before ranking makes the scores truly comparable. Only then can risks from all three divisions be combined into a single, defensible enterprise list for the board.
Ranking the risks as submitted and footnoting the scales still mixes incompatible numbers, so a 3 on a three-point scale looks weaker than it really is. Separate divisional lists fail to give the board the single ranked list it asked for. Averaging scores built on different scales carries the distortion into the combined result.
Key concept: normalizing fraud risk assessment scoring so results can be consolidated and prioritized consistently across the enterprise.

Question 3

During a fraud risk assessment of a company's purchasing cycle, a fraud examiner learns that accounts payable clerks can add and edit vendor master records with no secondary approval. No fraud has been reported in this area, and the purchasing manager says the clerks are trustworthy. Which action BEST serves the objective of the assessment?

Interview the clerks who edited vendor records to see whether any acted with improper intent Defer rating this area until data analytics confirm whether any vendor loss has occurred Open a fraud examination of recent vendor changes and report any fictitious vendors found Record it as a fraud risk, rate its likelihood and impact, and report it for a response

Correct Answer: Record it as a fraud risk, rate its likelihood and impact, and report it for a response

A fraud risk assessment identifies where fraud could occur, regardless of whether it has occurred, so letting clerks add and edit vendor master records without approval should be documented as a risk. It should then be rated for likelihood and impact and reported so management can decide on a response, such as segregation of duties or change approval.
Opening a fraud examination is premature because there is no predication. Interviewing clerks about intent treats a control gap as suspected misconduct. Deferring the rating until analytics confirm a loss confuses detecting fraud with assessing risk. Assurances that the clerks are trustworthy do not reduce the inherent risk.
Key concept: Fraud risk assessment focuses on potential fraud, not proven fraud.

Fraud Risk Assessment

CFE - Fraud Risk Assessment Example Questions

Question 1

Question 2

Question 3

Unlock Premium Access