Fraud Risk Management: Free CFE Practice Questions

Question 1

Under fraud risk management best practices, how do the results of management's fraud risk assessment BEST relate to the board's oversight of the anti-fraud program?

They show the board where to focus its scrutiny of anti-fraud controls They serve as the external auditor's evidence of anti-fraud control design They allow management to set the board's appetite for fraud risk They replace the board's need to oversee anti-fraud controls separately

Correct Answer: They show the board where to focus its scrutiny of anti-fraud controls

Management's fraud risk assessment identifies and prioritizes the organization's most significant fraud risks. This gives the board a risk-based map of where to concentrate its oversight and scrutiny of anti-fraud controls.
The assessment does not replace board oversight. The board must still independently monitor management and the controls, especially given the risk of management override. Fraud risk tolerance is set by the board, not dictated by management. The assessment is an internal management tool, not primarily evidence prepared for external auditors, who must perform their own procedures.
Key concept: board oversight of fraud risk management informed by a risk-based fraud risk assessment.

Question 2

After a fraud risk assessment rates fictitious vendor billing as a high residual risk, management adds a second approval signature to every invoice and proposes to treat the risk as addressed. A fraud examiner reviewing the plan notes that the fraud control activity principle of the fraud risk management framework calls for a mix of control types. Which change BEST aligns the plan with that principle?

Treat the risk as mitigated once approvals run and reassess it in the next annual cycle Assign internal audit to perform the second approval so the control is fully independent Add a third signature for large invoices to deepen the preventive layer of the approvals Add data analytics on vendor and payment records to detect schemes that bypass the approvals

Correct Answer: Add data analytics on vendor and payment records to detect schemes that bypass the approvals

Adding data analytics on vendor and payment records is correct because it introduces a detective control. Detective controls catch schemes that slip past preventive approvals, such as collusion or management override, which creates the balanced preventive and detective mix the principle calls for.
Adding a third signature only deepens the same preventive layer and is still vulnerable to collusion. Having internal audit perform approvals compromises its independence and adds no new control type. Treating the risk as mitigated ignores the gaps left by relying on a single control type and skips ongoing monitoring.
Key concept: The COSO/ACFE fraud control activity principle calls for combining preventive and detective controls, including proactive data analytics.

Question 3

When fraud risk is assessed within strategic enterprise risk management, which of the following BEST describes the main reason it is tied to the organization's strategic objectives?

To certify that strategic objectives are free from material fraud risk To gauge how fraud could impede achievement of the entity's goals To transfer fraud risk ownership to the strategic planning team To rank strategic goals by the fraud losses each one has already produced

Correct Answer: To gauge how fraud could impede achievement of the entity's goals

Linking fraud risk to strategic objectives lets management judge how fraud events could prevent the organization from achieving its goals, so fraud risks can be prioritized by their potential effect on what matters most.
Ranking goals by losses already incurred is backward-looking, whereas risk assessment is forward-looking and covers risks that have not yet materialized. Ownership of fraud risk stays with management and the board, not a strategic planning team. No assessment can certify that objectives are free of fraud risk, because it only identifies, evaluates and helps manage that risk.
Key concept: integrating fraud risk into enterprise risk management by aligning it with strategic objectives.

Fraud Risk Management

CFE - Fraud Risk Management Example Questions

Question 1

Question 2

Question 3

Unlock Premium Access