Your FREE CFE Flashcards 2026 – 200+ Cards

The use of one's occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization's resources or assets. The ACFE defines and studies it in the Report to the Nations.

Asset misappropriation, corruption, and financial statement fraud. They are the three top branches of occupational fraud.

Asset misappropriation — it occurs in the large majority of cases but typically has the lowest median loss of the three categories.

Financial statement fraud — it is the rarest of the three categories but produces by far the highest median loss.

Cash schemes and noncash (inventory and other assets) schemes. Cash schemes are further divided into fraudulent disbursements, skimming, and larceny.

The theft of cash before it is recorded in the accounting system — an 'off-book' fraud. Because the receipt is never entered, it is harder to detect than larceny.

The theft of cash after it has already been recorded in the accounting system — an 'on-book' fraud, which leaves a record that can reveal the imbalance.

Skimming steals cash before it is recorded (off-book); larceny steals cash already recorded on the books (on-book). Skimming leaves no direct entry; larceny creates a detectable discrepancy.

Billing schemes, check tampering, and expense reimbursement schemes. Billing schemes (shell company, nonaccomplice vendor, personal purchases) are typically the most costly disbursement type.

A billing scheme in which a fraudster sets up a fictitious entity with no real operations to submit invoices for goods or services never provided, then approves and pays them.

A scheme where an employee buys goods through a shell company at the real cost, then resells them to the employer at an inflated price, pocketing the markup.

A fraudulent disbursement in which the perpetrator prepares or alters a check drawn on the employer's account — by forging the maker's signature, altering the payee, or forging an endorsement.

A forged-maker scheme fakes the authorized signer's signature on a check; an altered-payee scheme changes the payee on an otherwise legitimately signed check.

An employee fraudulently claims reimbursement — through mischaracterized, overstated, fictitious, or multiple (duplicate) expenses — for costs the organization should not bear.

A fraud at the point of sale using false refunds or false voids to remove cash from a register and conceal the theft in the records.

A fraudulent disbursement scheme in which a perpetrator causes the employer to issue payments by submitting false claims — ghost employees, falsified hours/salary, or commission schemes.

Someone on the payroll who does not actually work for the company (a fictitious person or a real person who does not work there). Wages are issued and intercepted by the fraudster.

The wrongful use of influence in a business transaction to gain a benefit contrary to one's duty. Its subtypes are bribery, conflicts of interest, illegal gratuities, and economic extortion.

The offering, giving, receiving, or soliciting of anything of value to influence an official act or business decision. Bribery is a core corruption scheme.

A form of bribery in which a vendor gives a portion of an overbilled or steered payment back to an employee who helped direct business to that vendor.

A corruption scheme in which the normally competitive bidding process is manipulated — through bid suppression, complementary bidding, bid rotation, or market division — to favor a chosen vendor.

When an employee has an undisclosed economic or personal interest in a transaction that harms the employer — for example, secretly owning a vendor the employee approves payments to.

Giving something of value to reward a decision already made, rather than to influence one in advance (as a bribe does). It still corrupts the relationship.

The flip side of bribery: an employee demands payment from a vendor as a condition of making a decision in the vendor's favor (pay or lose the business).

The deliberate misrepresentation of an organization's financial condition through intentional misstatement or omission of amounts or disclosures to deceive financial statement users.

Fictitious (overstated) revenues, timing differences (improper revenue/expense recognition), concealed liabilities and expenses, improper disclosures, and improper asset valuation.

Recording sales of goods or services that did not occur — e.g., to fake customers or via fake invoices — to inflate reported revenue and earnings.

Inducing customers to buy more product than they need (often near period-end with generous return rights) to inflate current-period revenue; a timing/improper-recognition scheme.

An investment fraud that pays earlier investors with money from new investors rather than from real profits. It collapses when new money slows or redemptions surge.

A Ponzi scheme centers on a single operator paying 'returns' from new investor funds; a pyramid scheme pays participants for recruiting others, with money flowing up through layers of recruits.

An indicator or symptom that fraud may be occurring — such as employees living beyond their means, control overrides, missing documents, or unusual financial relationships. Red flags are not proof, but warrant inquiry.

Living beyond one's means, financial difficulties, unusually close vendor relationships, control issues / unwillingness to share duties, and recent divorce or family problems — the most common per the Report to the Nations.

Living beyond their means, followed by financial difficulties. The ACFE Report to the Nations consistently identifies these as the top behavioral warning signs.

The fraudulent acquisition and use of another person's identifying information (such as Social Security or account numbers) to commit fraud or other crimes.

Exploiting the float between banks by writing checks against accounts with insufficient funds, covering them with other bad checks, to create the illusion of a balance.

Deceptive practices in the securities markets — such as insider trading, misrepresentation in offerings, market manipulation, or investment schemes (e.g., Ponzi schemes) — that induce investors to act on false information.

Fraud against banks and similar institutions — loan fraud, false statements on applications, mortgage fraud, embezzlement, and check/credit-card fraud.

Deceptive schemes targeting individuals — telemarketing fraud, advance-fee schemes, false advertising, charity fraud, and similar scams.

Concealing assets, making false statements, or filing fraudulent claims in connection with a bankruptcy proceeding to defeat creditors or wrongfully obtain relief.

Using computers or networks to commit fraud — phishing, business email compromise, ransomware-enabled extortion, account takeover, and data theft.

A scheme in which fraudsters impersonate an executive or vendor by email to trick an employee into wiring funds or changing payment details. It is a leading source of fraud loss.

Concealing the theft of one customer's payment by applying a later customer's payment to the first customer's account, continually shifting the shortage forward.

Higher-authority perpetrators cause larger losses: owners/executives cause the highest median losses, then managers, then employees — because authority enables larger schemes and control override.

A biennial global study of occupational fraud cases reported by Certified Fraud Examiners — covering frequency by scheme, median losses, detection methods, perpetrator profiles, and the impact of controls.

The ACFE estimates organizations lose about 5% of revenue to fraud each year — a figure drawn from CFE estimates in the Report to the Nations.

Using an individual ('mule') to receive and transfer fraud proceeds — often recruited through scams — to launder funds and distance the fraudster from the money.

Stealing tiny, hard-to-notice amounts repeatedly (e.g., fractions of cents in many transactions) so the aggregate theft escapes detection.

A billing scheme in which a vendor (or an accomplice/shell entity) bills for goods or services that were never delivered, and an employee approves the false invoice for payment.

When an employee with an undisclosed interest in a vendor steers business to that vendor, harming the employer. It is a corruption subtype that the employee must disclose.

Schemes that occur before a contract is awarded — need recognition fraud, bid tailoring, bid manipulation, and collusion among bidders or between a bidder and an employee.

A collusive bid-rigging scheme in which conspiring vendors take turns winning contracts, submitting intentionally high 'complementary' bids when it is not their turn.

A bid-rigging tactic where conspirators submit bids that are intentionally too high or contain unacceptable terms, creating the appearance of competition while a chosen vendor wins.

Fraud after the contract is awarded — change-order/modification abuse, cost mischarging, and delivering non-conforming goods or services.

Premium fraud manipulates the basis for premiums (e.g., understating payroll or risk); claim fraud submits false or inflated claims for benefits not owed.

A benefit-fraud scheme — for example, a claimant faking or exaggerating an injury, or a provider billing for treatment never given — within insurance fraud.

Fraud by service providers (billing for services not rendered, upcoding, unbundling), by patients (false claims, identity misuse), and by insurers or plans.

Billing for a more expensive service or procedure than the one actually provided, to obtain a higher reimbursement.

Tax evasion is the illegal nonpayment or underpayment of tax through deception; tax avoidance is the legal arrangement of affairs to minimize tax. Only evasion is fraud.

Failure to declare income, falsified or inflated deductions, use of stolen taxpayer identities, and abusive use of tax havens or shelters.

Hiding or failing to disclose assets in a bankruptcy proceeding to keep them from creditors — a core bankruptcy fraud scheme along with fraudulent conveyances and planned bankruptcies.

Transferring assets to another party for little or no value to put them beyond the reach of creditors, often before or during a bankruptcy.

Buying or selling securities based on material nonpublic information in breach of a duty — a securities fraud scheme regulated by the SEC.

A securities fraud in which promoters inflate a stock's price with false or misleading positive statements, then sell their shares at the peak, leaving other investors with losses.

A payment/identity fraud in which a criminal gains control of a victim's existing account — via stolen credentials or social engineering — to make unauthorized transactions.

Skimming captures magnetic-stripe data with a hidden reader; shimming captures chip-card data with a thin device inserted in the card slot. Both enable counterfeit payment cards.

A social-engineering attack using fraudulent emails, texts, or sites that impersonate a trusted source to trick victims into revealing credentials or sending money.

Malware that encrypts a victim's data and demands payment for the decryption key, often combined with extortion threats to leak stolen data.

AI-generated synthetic audio, video, or images impersonating a real person — used to enhance social-engineering schemes such as business email compromise.

Stealing trade secrets, research, or proprietary data — through insider threats, cyberattacks, or social engineering — distinct from lawful competitive intelligence.

The illegal or unethical acquisition of a competitor's confidential information, as opposed to competitive intelligence gathered from public sources.

A long-con scam in which a fraudster builds a relationship with a victim, then lures them into a fraudulent (often crypto) investment, draining their funds over time.

Scams that specifically target older adults — such as impersonation, romance, or tech-support scams — exploiting trust, isolation, or cognitive decline.

A register disbursement scheme removes money already recorded using false refunds or voids (on-book); skimming takes the cash before the sale is recorded (off-book).

Concealing the theft of one customer's payment by crediting it with a later customer's payment, continually rolling the shortage forward.

Adding a fictitious or non-working person to payroll and intercepting their wages — a payroll fraud subtype.

A shell company bills for goods or services never provided; a pass-through (nonaccomplice vendor) scheme buys real goods through the shell and resells them to the employer at a markup.

To resolve allegations or signs of fraud from inception to disposition — gathering evidence, taking statements, writing reports, and assisting in detection and prevention — conducted only with predication.

The totality of circumstances that would lead a reasonable, prudent professional to believe a fraud has occurred, is occurring, or will occur. A fraud examination should not begin without predication.

A method of building a case: analyze available data, create a hypothesis, test the hypothesis, then refine and amend it as evidence develops — moving from the general to the specific.

From the least culpable / most neutral to the most culpable — typically neutral third parties first, then corroborative witnesses, then co-conspirators, and the prime suspect last.

An interview conducted only when there is reasonable cause that the subject is culpable, designed to obtain a legally sound confession; it is conducted privately and saved for the suspect last.

Placement (introducing illicit cash into the financial system), layering (separating proceeds from their source through complex transactions), and integration (returning the funds to the launderer as apparently legitimate).

Placement — the initial entry of cash into the financial system — because that is when illicit funds are most exposed to controls such as currency-transaction reporting.

The second stage: conducting complex layers of transactions (transfers, conversions, shell entities) to obscure the audit trail and separate the funds from their criminal origin.

The final stage: reintroducing laundered funds into the economy as seemingly legitimate income or assets, making them available to the launderer without obvious links to crime.

A primary U.S. anti-money-laundering law requiring financial institutions to keep records and file reports (such as currency transaction reports and suspicious activity reports) that help detect and prevent money laundering.

A report financial institutions must file with regulators (FinCEN in the U.S.) when they detect transactions that may signal money laundering, fraud, or other crimes.

A report U.S. financial institutions must file for cash transactions exceeding a set threshold (over $10,000), designed to detect money laundering and structuring.

Deliberately breaking a large cash transaction into smaller amounts to evade reporting thresholds (such as the CTR threshold). Structuring is itself illegal.

Anti-money-laundering rules requiring institutions to verify customer identity, understand the nature of the customer's activity, and assess money-laundering risk.

The natural persons who ultimately own or control a legal-entity customer. AML rules require identifying beneficial owners to prevent the use of shell entities to hide illicit funds.

Common law relies heavily on judicial precedent (case law) with judges as neutral referees; civil law relies on comprehensive written codes, with judges taking a more active, investigative role.

Direct evidence proves a fact without inference (e.g., eyewitness testimony); circumstantial evidence requires an inference to connect it to a conclusion (e.g., a document edited after the period in question).

To prove the contents of a writing, recording, or photograph, a party generally must produce the original document when available, rather than a copy or oral description.

Testimonial evidence is given by a witness under oath; documentary evidence consists of writings and records; physical (real) evidence is tangible objects. Fraud cases rely heavily on documentary evidence.

The chronological documentation showing the seizure, control, transfer, and analysis of evidence. An unbroken chain is essential to admit evidence and prove it was not altered.

To maintain the integrity and admissibility of evidence; metadata and system logs can establish when a file was created or altered, and altering or losing originals can render evidence inadmissible.

A lay witness testifies only to facts personally observed; an expert witness, qualified by knowledge or experience, may offer opinions to help the trier of fact understand specialized evidence.

To provide objective, competent opinion testimony within the examiner's expertise — clearly, without advocacy or overstatement — and to remain credible under cross-examination.

Criminal cases are brought by the government, must prove guilt 'beyond a reasonable doubt,' and can result in incarceration; civil cases are brought by private parties, use a lower 'preponderance of the evidence' standard, and seek monetary or equitable remedies.

The high burden of proof in criminal cases: the evidence must leave the trier of fact firmly convinced of guilt. It is stricter than the civil 'preponderance of the evidence' standard.

The civil standard of proof — the proposition is more likely true than not (greater than 50%). It is lower than the criminal 'beyond a reasonable doubt' standard.

Fraud requires intent to deceive (a knowing misrepresentation); negligence is a failure to exercise reasonable care without intent to deceive. Intent is the key distinguishing element of fraud.

Generally: a material false statement, knowledge of its falsity (scienter), reliance by the victim, and resulting damages. Proving intent (scienter) is often the central challenge.

A principle that in many naturally occurring datasets, the leading digit is more likely to be small (1 appears as the first digit about 30% of the time). Deviations can flag possibly fabricated numbers.

When numbers are assigned or constrained — e.g., ZIP codes, sequential invoice numbers, or values with built-in minimums/maximums — because they do not follow a natural first-digit distribution.

Using software to test large datasets for anomalies — duplicate payments, gaps in sequences, round numbers, Benford's analysis, and outliers — to identify transactions warranting investigation.

A financial statement audit gives reasonable assurance the statements are free of material misstatement; a forensic/fraud examination targets specific allegations or anomalies, gathering evidence to a legal standard.

A circumstantial method to prove illicit income by comparing a subject's known sources of funds to their expenditures and asset accumulation; an unexplained excess suggests hidden income.

An indirect method of proving unreported income by measuring the increase in a subject's net worth over a period plus living expenses, less known legitimate income.

Observing a subject's activities without their knowledge to gather evidence; it must comply with privacy laws and organizational policy to remain lawful and admissible.

To document the evidence, findings, and basis for conclusions clearly and objectively. It may be scrutinized in litigation, so it must use precise terms and avoid inflammatory or conclusory language.

Opinions on the ultimate legal question of guilt, inflammatory or biased language, and conclusions unsupported by evidence. The report states facts and findings, leaving guilt to the trier of fact.

Establishing a subject's normal verbal and nonverbal behavior with non-threatening questions before asking sensitive ones, so the examiner can notice meaningful changes in behavior.

Introductory, informational, assessment, closing, and (only when warranted) admission-seeking questions — generally moving from non-threatening to more pointed.

A control separating people or departments to prevent the misuse or flow of confidential or material nonpublic information — relevant to insider-trading and conflict-of-interest controls.

Examiners must respect search-and-seizure, privacy, employment, and data-protection laws; obtaining evidence unlawfully can make it inadmissible and expose the examiner and employer to liability.

Public sources are openly available (court filings, websites, public records); nonpublic sources require authorization or legal process (a target's confidential bank or account records).

The lawful identification, preservation, and analysis of electronic evidence — files, metadata, logs, and devices — using sound methods that preserve integrity and chain of custody.

Embezzlement is the fraudulent conversion of property by someone to whom it was lawfully entrusted; larceny is the wrongful taking of property the perpetrator did not have lawful possession of.

Legal safeguards (such as those under Sarbanes-Oxley and Dodd-Frank in the U.S.) that protect employees who report fraud or violations from retaliation, encouraging the reporting of misconduct.

Because tips are consistently the most common way occupational fraud is detected, and organizations with reporting hotlines detect fraud sooner and suffer smaller losses.

Investigations should be conducted discreetly to protect reputations, preserve evidence, comply with the presumption of innocence, and reduce legal exposure for defamation or wrongful accusation.

The identification, preservation, collection, and production of electronically stored information for legal proceedings — distinct from forensic analysis of devices.

Because it can be easily altered, overwritten, or lost (e.g., when a device is used or powered off), so it must be preserved promptly using forensically sound methods.

Seizure, image acquisition (a forensic copy), analysis, and documenting/reporting — preserving the original and chain of custody throughout.

Open-source intelligence — information gathered from publicly available sources such as social media, public records, the internet archive, and the deep or dark web.

Public records (court filings, corporate and securities filings) are openly accessible; nonpublic records (credit reports, bank records) require authorization, consent, or legal process.

A legal protection that keeps confidential communications between a client and attorney from disclosure; it can be waived if the communication is shared with third parties.

A protection for materials prepared in anticipation of litigation; it shields an attorney's or examiner's mental impressions and analysis from discovery.

A directive to preserve all potentially relevant records once litigation is reasonably anticipated; failing to preserve evidence can lead to spoliation sanctions.

The destruction, alteration, or failure to preserve evidence relevant to litigation, which can result in sanctions or an adverse inference against the responsible party.

An employee's generally recognized obligation to cooperate with a legitimate internal investigation, balanced against rights such as privacy and protection from self-incrimination.

Inducing a person to commit a crime they were not otherwise predisposed to commit; it is a legal concern that can arise in covert operations and undercover work.

A source who provides information confidentially; examiners must follow procedures and legal limits on using and protecting informants and verifying their information.

An indirect method that proves hidden income by measuring increases in a subject's assets and net worth over a period, beyond what known legitimate income explains.

An indirect method that proves hidden income by showing a subject's expenditures exceeded their known sources of funds during a period.

Federal crimes that punish using the mail (mail fraud) or interstate wire communications (wire fraud) to carry out a scheme to defraud; they are common federal fraud charges.

A U.S. law prohibiting bribery of foreign officials and requiring accurate books and records and internal controls; the UK Bribery Act is a comparable foreign statute.

An arrangement in which prosecutors agree to suspend charges against an organization if it meets conditions (cooperation, remediation, monitoring) for a set period.

Charging document, first appearance/arraignment, pretrial negotiations, trial, judgment, sentencing, and appeal.

The principle that a corporation can be held criminally responsible for crimes committed by its employees or agents acting within the scope of their employment for the company's benefit.

Mediation, arbitration, and reconciliation — alternative dispute resolution methods that resolve disputes without a full trial.

Regulatory penalties such as fines, license suspension or revocation, and debarment from government contracting, imposed by agencies rather than courts.

Evidence used to attack the credibility of a witness — for example, prior inconsistent statements or bias — rather than to prove the underlying facts.

Showing that evidence is what it claims to be (e.g., via metadata, testimony, or a chain of custody) — a prerequisite for admissibility.

To learn a subject's normal verbal and nonverbal behavior with non-threatening questions, so the examiner can notice meaningful changes when sensitive topics arise.

Open questions invite a narrative; closed questions seek specific facts or yes/no answers; leading questions suggest the answer and are generally avoided except in cross-examination.

Subject-matter jurisdiction is a court's authority to hear a type of case; venue is the proper geographic location for the case to be tried.

Because consent and wiretapping laws vary by jurisdiction (one-party vs. all-party consent); an unlawful recording can be inadmissible and expose the examiner to liability.

A model of the three conditions generally present when occupational fraud occurs: pressure (a perceived non-shareable financial need), opportunity, and rationalization. Developed from criminologist Donald Cressey's research.

Criminologist Donald Cressey, from his study of embezzlers ('trust violators'). His findings on pressure, opportunity, and rationalization underpin the Fraud Triangle.

A perceived non-shareable financial problem or motivation — debts, addictions, lifestyle, or performance targets — that drives an individual toward committing fraud.

The perceived ability to commit and conceal the fraud without being caught — typically created by weak internal controls. It is the leg most directly within an organization's control.

The fraudster's justification of the act as acceptable — 'I'll pay it back,' 'I'm underpaid,' 'the company can afford it' — allowing them to reconcile the crime with their self-image.

Because fraud is driven by the offender's perception — a perceived (not necessarily real) non-shareable pressure and a perceived opportunity. The fraudster acts on belief, not objective reality.

Opportunity — through strong internal controls, segregation of duties, oversight, and monitoring. Pressure and rationalization are largely internal to the individual.

An extension of the Fraud Triangle that adds a fourth element — capability (the personal traits and position that enable a person to actually carry out the fraud) — to pressure, opportunity, and rationalization.

Tips — by a wide margin, per the ACFE Report to the Nations — followed by internal audit and management review. Most tips come from employees.

The ethical example and message set by senior management and the board. A strong, honest tone discourages fraud; a poor tone or a dominant CEO who overrides controls elevates fraud risk.

A widely used model defining internal control through five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

Control environment, risk assessment, control activities, information and communication, and monitoring activities — together they support reliable reporting, operations, and compliance.

The foundation of internal control: the integrity, ethical values, governance, and tone set by the organization that influence the control consciousness of its people.

By ensuring relevant information — including how to report concerns — flows to the right people throughout the organization so issues are identified and acted on.

Preventive controls stop fraud before it happens (segregation of duties, approvals, positive pay); detective controls find it after the fact (reconciliations, audits, data analysis, hotlines). A program needs both.

Dividing key tasks — authorization, custody, recording, and reconciliation — among different people so no single person can both commit and conceal fraud. A foundational preventive control.

An ongoing, periodically updated process that identifies the organization's fraud risks, evaluates whether existing controls adequately mitigate each one, and prioritizes the gaps for action.

Because the business, its people, systems, and external risks change continually; a one-time assessment quickly becomes stale and misses newly emerging fraud schemes.

It evaluates whether current controls adequately mitigate each identified fraud risk and identifies residual risks that need additional or stronger controls.

A structured, organization-wide approach to fraud risk governance, assessment, prevention, detection, and response — aligned with overall governance and enterprise risk management.

Establish a fraud risk governance policy, perform fraud risk assessments, design prevention and detection controls, conduct investigations and corrective action, and monitor the program — per the ACFE/COSO fraud risk guidance.

The ethical rules binding Certified Fraud Examiners — including integrity, objectivity, professional competence, confidentiality, and a prohibition on knowingly making material misrepresentations or committing illegal or unethical acts.

Make a material misrepresentation, or commit any illegal or unethical act. CFEs must also act with integrity, exhibit professional competence, and maintain confidentiality.

No. Under the ACFE Code of Professional Ethics, a CFE shall not express an opinion regarding the guilt or innocence of any person or party — that is for the trier of fact.

Financially motivated, nonviolent crime committed by individuals or organizations, typically involving deceit and abuse of trust — a term coined by sociologist Edwin Sutherland.

White-collar crime committed by a business for the entity's benefit — for example, systematically falsifying emissions or financial data to gain a competitive advantage.

Education that teaches employees what fraud is, how to recognize it, the organization's policies and consequences, and how to report concerns — reinforcing prevention and deterrence.

A confidential channel — often third-party operated and available 24/7 — for employees, vendors, and customers to report suspected fraud. Hotlines significantly improve detection and reduce losses.

Discouraging potential fraudsters by increasing the perceived likelihood of detection and punishment — through visible controls, audits, enforcement, and a strong ethical culture.

To independently evaluate controls and risk management, test for fraud indicators, and recommend improvements. Internal audit is a leading detective control after tips.

An organization-wide process for identifying, assessing, and managing risks — including fraud risk — aligned with strategy and governance. COSO publishes a widely used ERM framework.

So fraud risk is managed consistently with the organization's other risks and overseen by the board and management, rather than handled in isolation.

A formal statement of an organization's ethical principles and expected behavior. A clear, enforced code supports the control environment and deters fraud.

The belief among employees that fraud will be caught. Increasing this perception — through visible auditing, monitoring, and enforcement — is one of the strongest deterrents to fraud.

Actively searching for fraud before it surfaces — through data analytics, continuous monitoring, surprise audits, and targeted reviews — rather than waiting for it to be reported.

An unannounced examination of records or operations. Because employees cannot prepare for it, it both detects fraud and deters it by raising the perceived chance of being caught.

Requiring employees in sensitive roles to take time off or rotate duties, so ongoing schemes that require constant concealment are more likely to surface.

By limiting access, requiring authorizations, segregating duties, and creating records and reviews — they remove the opening in the Fraud Triangle that lets a person commit and hide a scheme.

Organizations with anti-fraud controls (hotlines, training, surprise audits, etc.) detect fraud faster and suffer significantly lower median losses than those without them.

Prevention stops fraud through controls that remove opportunity; deterrence discourages it by raising the perceived risk of getting caught and punished. Effective programs do both.

The organization's response after fraud is found — discipline, recovery, control improvements, and reporting — to remediate harm and prevent recurrence.

A bank control in which the company sends a list of issued checks; the bank pays only matching checks, blocking altered or counterfeit checks — a preventive control against check tampering.

Requiring two people to complete a sensitive transaction (such as a large wire), so collusion would be needed to commit fraud — a preventive control.

Validating new vendors and changes to vendor banking details before payment, to block shell-company and business-email-compromise schemes — a preventive control.

Visibly investigating, prosecuting, and disciplining fraud signals that the organization will not tolerate it, raising the perceived cost of fraud and discouraging would-be offenders.

Opportunity — typically created by weak internal controls and oversight — is the condition organizations can most directly reduce, lowering the chance fraud occurs and goes undetected.

Occupational crime benefits the individual at the organization's expense; organizational (corporate) crime is committed by the business for the entity's own benefit.

The system of rules, practices, and oversight (board, audit committee, controls) that directs and holds an organization accountable, reducing fraud risk when strong.

An independent audit committee oversees financial reporting, internal control, and the audit function, providing accountability that helps deter and detect fraud.

Frameworks and bodies such as the OECD Principles of Corporate Governance, the Treadway Commission/COSO, and sustainability standards setters inform governance practice.

Management owns the anti-fraud program: setting culture and tone, raising awareness, establishing policies and training, and designing and operating internal controls.

A gap in the design or operating effectiveness of controls that leaves a fraud risk unaddressed — for example, missing segregation of duties or controls that are not actually performed.

To plan and perform the audit to obtain reasonable assurance the financial statements are free of material misstatement, whether caused by error or fraud — not to guarantee fraud is absent.

Internal auditors serve the organization and evaluate controls/risk; external auditors give an independent opinion on the financial statements; government auditors examine public funds and compliance.

The threshold at which a misstatement could influence the decisions of financial-statement users; auditors design procedures around material amounts.

Using automated, ongoing analysis of transactions to detect anomalies in near real time, strengthening both prevention and detection.

Designing prompts and reminders (such as honesty declarations placed before, not after, a form) that encourage ethical behavior and reduce fraud.

A confidential, well-publicized reporting channel with anti-retaliation protections; because tips are the top detection method, it is one of the most effective controls.

An environment — driven by tone at the top, structure, and performance management — in which ethical behavior is expected and fraud is not tolerated.

A formal, enforced statement of ethical expectations sets the standard for behavior, supports the control environment, and signals that fraud will not be tolerated.

The fraud risk that exists before considering any controls — the natural exposure of an activity, account, or process.

The fraud risk that remains after controls are applied; management responds to it by accepting, mitigating, avoiding, or transferring it.

Internal fraud risks come from employees and insiders; external fraud risks come from outside parties such as vendors, customers, or cybercriminals.

The amount and type of risk an organization is willing to accept in pursuit of its objectives; it guides how residual fraud risk is treated.

An organization-wide process for identifying, assessing, and managing risks — including fraud risk — aligned with strategy and governance; COSO and ISO 31000 publish ERM frameworks.

Guidance built on principles for fraud risk governance, assessment, prevention/detection, investigation, and monitoring — the leading framework for managing fraud risk.

Fraud risk arising from vendors, agents, contractors, and other outside parties, managed through due diligence, monitoring, and contractual controls.

An attitude of a questioning mind and a critical assessment of evidence; the ACFE Code expects CFEs to maintain it rather than assume honesty or dishonesty.

No. Under the ACFE Code of Professional Ethics, a CFE shall not provide assurance that a fraud has not occurred or will not occur — only conclusions supported by the evidence.

Requiring employees in sensitive roles to take time off or rotate duties, so ongoing schemes that depend on constant concealment are more likely to surface.

An unannounced examination employees cannot prepare for; it both detects schemes and deters them by raising the perceived likelihood of being caught.