Certified Fraud Examiner (CFE) Practice Exam

Passing the Certified Fraud Examiner (CFE) exam takes more than knowing fraud terminology or reviewing study notes. Candidates are expected to evaluate complex situations, recognize fraud indicators, assess internal controls, interpret financial information, and choose the most appropriate investigative response. Developing these practical skills is just as important as understanding the underlying concepts.

This practice exam is built to help you prepare with realistic, exam-style questions that reflect the type of thinking used by fraud examiners in professional environments. Whether you’re beginning your CFE preparation or completing a final review before exam day, these questions provide meaningful practice, highlight knowledge gaps, reinforce essential concepts, and help you approach the certification exam with greater confidence.

Why This CFE Practice Exam Is Different

This study resource is designed around practical fraud examination scenarios instead of simple memorization. Every question encourages you to analyze facts, identify fraud risks, evaluate internal controls, interpret evidence, and apply professional judgment just as Certified Fraud Examiners do in actual investigations.

You’ll practice identifying fraud indicators, recognizing control weaknesses, interpreting financial information, evaluating interview scenarios, understanding legal considerations, and selecting the most appropriate investigative response under realistic conditions.

What’s Included

• Realistic multiple-choice practice questions
• Detailed answer explanations for every question
• Scenario-based and case-style questions
• Financial statement fraud exercises
• Asset misappropriation examples
• Corruption and bribery scenarios
• Procurement fraud cases
• Payroll fraud questions
• Vendor fraud detection exercises
• Internal control evaluation
• Fraud risk assessment questions
• Evidence collection and preservation
• Digital forensics concepts
• Interview and interrogation scenarios
• Ethics and professional responsibility
• Data analytics and fraud detection
• Cyber-enabled fraud examples
• Governance and compliance questions
• Whistleblower and reporting scenarios
• Exam-style practice that mirrors real testing conditions

Who Should Take This Practice Exam?

This practice exam is ideal for:

• Candidates preparing for the Certified Fraud Examiner (CFE) certification
• Internal auditors
• External auditors
• Forensic accountants
• Compliance officers
• Corporate investigators
• Risk management professionals
• Financial crime investigators
• Internal control specialists
• Banking compliance professionals
• Government investigators
• Law enforcement professionals involved in financial crime investigations
• Anti-money laundering professionals
• Corporate security professionals
• Accounting and finance professionals expanding into fraud examination

Core Domains Covered

The practice exam provides balanced coverage across the major knowledge areas commonly tested on the CFE examination, including:

• Financial Transactions and Fraud Schemes
• Fraud Prevention and Deterrence
• Investigation Techniques
• Law and Legal Considerations
• Internal Controls
• Occupational Fraud
• Financial Statement Fraud
• Asset Misappropriation
• Corruption
• Procurement Fraud
• Payroll Fraud
• Digital Evidence
• Data Analytics
• Ethics and Professional Standards
• Fraud Risk Management

Topics Covered

This practice exam includes questions covering:

• Occupational fraud schemes
• Fraud Triangle and Fraud Diamond
• Asset misappropriation
• Cash theft and cash larceny
• Skimming schemes
• Billing fraud
• Payroll fraud
• Expense reimbursement fraud
• Check tampering
• Procurement fraud
• Vendor fraud
• Shell companies
• Kickbacks
• Bribery
• Conflicts of interest
• Bid rigging
• Financial statement manipulation
• Revenue recognition fraud
• Inventory fraud
• Journal entry fraud
• Fraud risk assessment
• Internal control design
• Segregation of duties
• Continuous monitoring
• Data analytics
• Digital forensic principles
• Electronic evidence
• Chain of custody
• Interview planning
• Witness interviews
• Documentary evidence
• Fraud reporting
• Governance
• Corporate ethics
• Compliance programs
• Cyber-enabled fraud
• Business email compromise
• Whistleblower programs
• Professional standards
• Fraud prevention strategies

How This Practice Test Was Created

Every question is written to reflect the type of reasoning expected from fraud professionals working in real organizations. Instead of focusing on memorization alone, the questions emphasize investigative judgment, evidence evaluation, financial analysis, fraud detection, internal controls, ethics, governance, and professional decision-making.

Each explanation is written to reinforce learning by explaining not only why the correct answer is right, but also why the remaining options are less appropriate in the given situation. This approach helps build long-term understanding rather than short-term memorization.

Study Tips for Passing the CFE Exam

• Study consistently instead of cramming during the final week.
• Practice answering scenario-based questions under timed conditions.
• Focus on understanding fraud schemes rather than memorizing definitions.
• Learn how internal controls prevent and detect fraud.
• Review financial statement relationships and common manipulation techniques.
• Become familiar with evidence handling and investigative procedures.
• Practice identifying fraud indicators from case scenarios.
• Carefully read every answer explanation, including questions answered correctly.
• Track weak areas and revisit them regularly.
• Complete multiple full-length practice sessions before exam day.

Exam Day Strategy

• Read every question carefully before reviewing the answer choices.
• Look for key facts instead of making assumptions.
• Eliminate clearly incorrect answers first.
• Avoid spending excessive time on one difficult question.
• Stay calm and maintain a steady pace throughout the exam.
• Review flagged questions if time allows.

Most Important Areas to Focus On

Many successful candidates spend extra time mastering these high-value topics:

• Occupational fraud schemes
• Internal controls
• Financial statement fraud
• Evidence evaluation
• Interview techniques
• Procurement fraud
• Payroll fraud
• Vendor fraud
• Fraud risk assessment
• Data analytics
• Digital evidence
• Ethics
• Corporate governance
• Fraud prevention
• Investigation methodology

Common Mistakes to Avoid

• Memorizing answers instead of understanding concepts.
• Ignoring detailed answer explanations.
• Spending too much time on low-value topics.
• Skipping scenario-based practice questions.
• Failing to review internal controls thoroughly.
• Not practicing under timed conditions.
• Overlooking ethics and professional standards.
• Waiting until the final week to begin practice exams.
• Studying only familiar topics while avoiding weaker areas.
• Rushing through questions without reading every fact carefully.

Why Practice Questions Matter

Reading study material builds knowledge, but answering realistic practice questions develops the judgment required to apply that knowledge during the exam. Repeated exposure to exam-style scenarios improves confidence, strengthens analytical thinking, and helps you recognize fraud indicators more quickly.

Consistent practice also improves time management, reinforces key concepts, and prepares you for the decision-making expected of a Certified Fraud Examiner in both the examination and professional practice.

CFE Sample Questions and Answers

Question 1. A company’s controller is responsible for preparing journal entries, reconciling bank accounts, and approving vendor payments. During a fraud examination, you discover multiple payments to a recently created vendor with no supporting invoices. Which fraud risk factor is most significant?

A. The controller has advanced accounting knowledge.

B. One employee controls multiple incompatible financial functions.

C. Vendor records are stored electronically.

D. Payments were made by electronic transfer.

Correct Answer: B

Answer Explanation:
This scenario highlights a classic breakdown in internal controls through the absence of segregation of duties. When one individual can create vendors, authorize transactions, and reconcile accounts, the opportunity for occupational fraud increases substantially. Fraud examiners evaluate whether incompatible responsibilities have been assigned to the same employee because this removes independent oversight. Electronic payments or accounting expertise alone do not create fraud, but unrestricted authority combined with poor supervision does. Effective organizations separate authorization, custody of assets, recordkeeping, and reconciliation responsibilities among different individuals to reduce fraud opportunities and improve the likelihood that irregularities will be detected before significant financial losses occur.

Question 2. A fraud examiner receives an anonymous allegation that a procurement manager consistently awards contracts to one supplier despite higher prices. What should be the examiner’s first step?

A. Publicly accuse the procurement manager.

B. Immediately notify all employees.

C. Conduct a preliminary assessment to determine whether the allegation has sufficient credibility.

D. Recommend criminal prosecution.

Correct Answer: C

Answer Explanation:
Professional fraud examinations begin with an objective assessment rather than assumptions of guilt. Anonymous tips are valuable sources of fraud detection, but investigators should first evaluate available documentation, purchasing trends, vendor relationships, and transaction history before expanding the investigation. This approach helps determine whether sufficient evidence exists to justify additional investigative procedures while protecting innocent individuals from unnecessary accusations. Public allegations or legal recommendations before gathering facts may expose the organization to legal liability and damage employee morale. Maintaining confidentiality and following a structured investigative process preserves evidence and supports fair, defensible conclusions.

Question 3. An employee submits reimbursement claims for meals that occurred on weekends during periods when no company travel was authorized. Which fraud scheme does this most likely represent?

A. Financial statement fraud

B. Expense reimbursement fraud

C. Payroll fraud

D. Investment fraud

Correct Answer: B

Answer Explanation:
Expense reimbursement fraud occurs when employees seek payment for fictitious, inflated, duplicated, or personal expenses. Weekend meal claims without authorized business travel present a strong indicator that expenses may not have been business-related. Fraud examiners would compare travel authorizations, receipts, corporate calendars, credit card records, and approval documentation to verify the legitimacy of each claim. Patterns involving repeated questionable reimbursements often reveal intentional abuse rather than isolated errors. Strong reimbursement policies, supervisory review, and periodic audits reduce the likelihood that employees can successfully submit fraudulent expense claims over extended periods.

Question 4. During an interview, a suspect repeatedly answers questions with unnecessary details and avoids making direct eye contact. What should the fraud examiner conclude?

A. The suspect is definitely lying.

B. The behavior alone proves fraud occurred.

C. The observations may indicate stress but should never be considered proof of deception.

D. The interview should end immediately.

Correct Answer: C

Answer Explanation:
Behavioral cues can assist interviewers, but no single behavior reliably indicates deception. Individuals may display nervousness, avoid eye contact, or provide lengthy responses for many reasons, including anxiety, personality differences, or fear of being misunderstood. Certified Fraud Examiners rely primarily on corroborated evidence rather than behavioral observations when reaching conclusions. Interviews should focus on obtaining facts, clarifying inconsistencies, and documenting responses objectively. Decisions regarding fraud should be based on documentary evidence, financial analysis, witness statements, and other verified information rather than assumptions drawn solely from body language or communication style.

Question 5. A manufacturing company reports unusually high inventory levels while warehouse inspections reveal many empty storage locations. Which financial statement fraud technique is most likely involved?

A. Understating liabilities

B. Overstating inventory assets

C. Premature revenue recognition

D. Fictitious payroll expenses

Correct Answer: B

Answer Explanation:
Inventory is a significant asset for many businesses, making it a common target for financial statement manipulation. Recording nonexistent or inflated inventory increases reported assets while reducing the cost of goods sold, thereby overstating profits. Fraud examiners compare inventory records with physical counts, shipping documents, receiving reports, and production records to verify existence and valuation. Empty warehouse space despite large reported inventory balances is a significant red flag. Independent inventory observations and reconciliation procedures are essential audit techniques for detecting inventory-related financial reporting fraud.

Question 6. Which element of the Fraud Triangle represents an individual’s belief that dishonest conduct is acceptable?

A. Opportunity

B. Rationalization

C. Capability

D. Detection

Correct Answer: B

Answer Explanation:
Rationalization refers to the mental justification individuals use to convince themselves that unethical behavior is acceptable. Examples include believing they are underpaid, intending to repay stolen funds later, or thinking everyone else behaves similarly. The Fraud Triangle explains that fraud generally requires pressure, opportunity, and rationalization to coexist. Although rationalization cannot usually be observed directly, investigators often identify it through interviews, emails, or statements made after fraud is discovered. Organizations that promote strong ethical cultures and consistent accountability reduce employees’ ability to justify dishonest behavior.

Question 7. A fraud examiner discovers that a vendor’s mailing address matches an employee’s residential address. Which scheme should be investigated first?

A. Ghost employee fraud

B. Shell company fraud

C. Payroll tax fraud

D. Securities fraud

Correct Answer: B

Answer Explanation:
A vendor sharing the same address as an employee is a significant indicator of a potential shell company scheme. Employees sometimes establish fictitious businesses to submit fraudulent invoices and divert company funds. Investigators should review vendor registration documents, ownership records, invoice history, payment approvals, purchasing files, and banking information. Although identical addresses do not automatically prove fraud, they warrant immediate examination because legitimate vendors rarely operate from employee residences without disclosure. Vendor due diligence and periodic master file reviews are effective preventive controls against shell company fraud.

Question 8. Which document generally provides the strongest evidence that inventory was actually shipped to a customer?

A. Internal sales forecast

B. Employee timesheet

C. Bill of lading

D. Marketing brochure

Correct Answer: C

Answer Explanation:
A bill of lading is a transportation document confirming that goods were transferred to a carrier for delivery. Fraud examiners frequently compare bills of lading with sales invoices, purchase orders, customer acknowledgments, and shipping records when investigating revenue recognition or inventory fraud. Because it documents physical shipment, it provides persuasive evidence supporting the existence of a legitimate sales transaction. Internal planning documents and marketing materials do not verify delivery. Reliable source documents are critical when determining whether reported sales reflect genuine business activity.

Question 9. A company receives a whistleblower complaint through its ethics hotline. What should management do first?

A. Delete the complaint if anonymous.

B. Maintain confidentiality while initiating an appropriate review.

C. Inform all employees immediately.

D. Suspend every employee mentioned.

Correct Answer: B

Answer Explanation:
Whistleblower reports should be handled carefully to protect both the reporting individual and anyone accused of misconduct. Maintaining confidentiality encourages future reporting and reduces the risk of retaliation or evidence destruction. Management should document the allegation, preserve relevant records, evaluate credibility, and determine whether a formal investigation is warranted. Anonymous reports often uncover significant fraud and should never be dismissed solely because the source is unidentified. Organizations with trusted reporting systems consistently detect fraud earlier and experience lower financial losses than organizations without effective reporting mechanisms.

Question 10. A fraud examiner identifies multiple invoices with identical amounts submitted by different vendors within days of each other. Which analytical procedure would most likely reveal additional suspicious transactions?

A. Benford’s Law and duplicate payment analysis

B. Employee satisfaction survey

C. Fixed asset depreciation review

D. Product quality inspection

Correct Answer: A

Answer Explanation:
Data analytics plays an essential role in modern fraud examinations. Duplicate payment testing identifies repeated invoice amounts, vendor similarities, and suspicious payment patterns that may indicate coordinated fraud. Benford’s Law can also help identify unnatural numerical distributions deserving further review. Investigators often combine analytical procedures with vendor master file analysis, approval history, and supporting documentation to determine whether transactions are legitimate. Analytical testing allows examiners to review entire populations rather than limited samples, increasing the likelihood of identifying concealed fraud schemes across large financial datasets.

Question 11. A senior executive intentionally delays recording expenses until the following reporting period to meet earnings targets. What type of fraud has most likely occurred?

A. Corruption

B. Asset misappropriation

C. Financial statement fraud

D. Identity theft

Correct Answer: C

Answer Explanation:
Deliberately postponing expense recognition inflates current-period earnings and misrepresents the organization’s true financial performance. This is a form of financial statement fraud because management intentionally manipulates accounting records to deceive investors, lenders, or regulators. Fraud examiners evaluate journal entries, accruals, supporting documentation, and period-end adjustments to identify improper cutoff practices. Such schemes may appear relatively small initially but can become increasingly significant when management repeatedly manipulates financial results to satisfy market expectations or compensation targets tied to reported earnings.

Question 12. During a corruption investigation, evidence shows an employee accepted expensive vacations from a supplier before awarding contracts. Which offense is most likely involved?

A. Bribery

B. Payroll fraud

C. Expense reimbursement fraud

D. Lapping

Correct Answer: A

Answer Explanation:
Accepting valuable personal benefits from a supplier in exchange for favorable business decisions is characteristic of bribery. Corruption schemes undermine fair competition and often result in organizations paying excessive prices or receiving inferior goods and services. Fraud examiners investigate communications, procurement records, contract evaluations, travel records, financial transactions, and conflict-of-interest disclosures. Even if the supplier ultimately delivers acceptable products, undisclosed personal benefits may violate company policy, professional ethics, and criminal laws. Strong procurement controls and mandatory disclosure requirements help reduce corruption risks.

Question 13. Which interview approach generally produces the most reliable information during a fraud examination?

A. Begin with accusations.

B. Ask open-ended questions before moving to specific issues.

C. Interrupt witnesses frequently.

D. Reveal all evidence immediately.

Correct Answer: B

Answer Explanation:
Open-ended questions encourage interviewees to provide detailed narratives in their own words, allowing investigators to identify inconsistencies, gather new information, and better understand events. Beginning with accusations often causes individuals to become defensive and less cooperative. Skilled fraud examiners gradually narrow questioning after establishing background information and rapport. They also avoid unnecessarily revealing investigative evidence until appropriate because doing so may allow deceptive individuals to tailor their responses. Effective interviewing combines preparation, active listening, patience, and careful documentation throughout the examination process.

Question 14. A bank employee repeatedly transfers small amounts from dormant customer accounts into an account under the employee’s control. Which fraud scheme is illustrated?

A. Skimming

B. Cash larceny

C. Asset misappropriation through unauthorized transfers

D. Bid rigging

Correct Answer: C

Answer Explanation:
Unauthorized transfers from customer accounts constitute asset misappropriation because the employee intentionally diverts organizational or customer assets for personal benefit. Dormant accounts are often targeted because account holders may not monitor balances regularly. Fraud examiners analyze transaction logs, account activity, authorization records, access permissions, and employee system usage to identify unauthorized transfers. Continuous monitoring systems, exception reporting, and mandatory vacations are effective controls because they increase the likelihood that concealed schemes involving electronic transfers will be discovered before significant losses accumulate.

Question 15. Which characteristic makes documentary evidence generally more persuasive than oral statements?

A. Documents cannot be forged.

B. Documentary evidence is typically more objective and can often be independently verified.

C. Witnesses never forget details.

D. Documents eliminate the need for interviews.

Correct Answer: B

Answer Explanation:
Fraud investigations rely heavily on documentary evidence because it frequently provides objective, verifiable support for factual conclusions. Financial records, contracts, invoices, emails, shipping documents, and electronic logs can often be authenticated through independent sources. Although documents can be altered or fabricated, forensic procedures help determine authenticity. Oral statements remain valuable but may be influenced by memory limitations, misunderstandings, or intentional deception. Strong fraud examinations combine documentary evidence, witness interviews, digital evidence, and analytical procedures to develop well-supported investigative findings suitable for legal or disciplinary proceedings.

Question 16. A company unexpectedly experiences declining profits despite steadily increasing reported sales. Which additional indicator would most strongly support concerns about fictitious revenue?

A. Growing accounts receivable with slow collections

B. Reduced employee turnover

C. Lower electricity expenses

D. Increased employee training hours

Correct Answer: A

Answer Explanation:
Rapidly increasing accounts receivable combined with poor collection performance often indicates that reported sales may not represent genuine customer transactions. Fictitious or premature revenue recognition frequently creates receivables that cannot be collected because legitimate customers do not exist or have not accepted the goods. Fraud examiners analyze aging reports, customer confirmations, cash receipts, shipping documentation, and credit approvals to determine whether reported revenue is supported by actual business activity. Comparing financial trends across multiple reporting periods often reveals inconsistencies that warrant additional investigation.

Question 17. An employee steals cash received from customers before it is entered into the accounting records. Which fraud scheme has occurred?

A. Skimming

B. Lapping

C. Payroll fraud

D. Financial statement fraud

Correct Answer: A

Answer Explanation:
Skimming occurs when cash is stolen before it is officially recorded in the organization’s accounting system. Because no accounting entry initially exists, skimming schemes can be difficult to detect without strong internal controls. Fraud examiners compare sales records, customer complaints, inventory movement, bank deposits, surveillance footage, and reconciliation reports to identify missing receipts. Preventive measures include segregation of duties, mandatory receipts, surprise cash counts, independent reconciliations, and increased management oversight. Organizations handling significant cash collections remain especially vulnerable to skimming without effective controls.

Question 18. A fraud examiner images a suspect’s company laptop before reviewing its contents. What is the primary reason for creating a forensic image?

A. To improve internet speed.

B. To preserve original digital evidence and maintain its integrity.

C. To reduce storage costs.

D. To bypass legal requirements.

Correct Answer: B

Answer Explanation:
Digital forensic best practices require investigators to preserve original electronic evidence by creating a forensic image before conducting examinations. This process captures an exact copy of storage media while minimizing the risk of altering original data. Maintaining evidence integrity supports legal admissibility and allows investigators to repeat analyses if necessary. Fraud examiners also document chain of custody, use validated forensic tools, and record each investigative step carefully. Preserving original evidence is essential because improperly handled digital evidence may be challenged or excluded during legal proceedings.

Question 19. A nonprofit organization’s treasurer has never taken vacation in twelve years and refuses assistance with financial responsibilities. Why is this considered a fraud red flag?

A. Long employment automatically proves fraud.

B. Employees avoiding time away may be attempting to conceal ongoing fraudulent activities.

C. Vacation policies are irrelevant.

D. Experience eliminates fraud risk.

Correct Answer: B

Answer Explanation:
Employees engaged in ongoing fraud sometimes avoid vacations because another individual performing their duties could discover concealed irregularities. Although refusing leave does not prove misconduct, it is a recognized behavioral red flag that should prompt management to review internal controls and financial activities. Mandatory vacations, job rotation, and independent reconciliations frequently expose schemes that depend on continuous control by one individual. Fraud examiners consider behavioral indicators alongside documentary evidence, financial analysis, and interviews rather than treating any single red flag as conclusive proof of wrongdoing.

Question 20. A fraud examiner has gathered sufficient evidence indicating that a senior executive manipulated financial records. Which action best reflects professional ethical responsibilities?

A. Suppress unfavorable findings to protect the organization.

B. Report objective findings supported by evidence regardless of the executive’s position.

C. Destroy working papers after completing the investigation.

D. Modify conclusions to satisfy management.

Correct Answer: B

Answer Explanation:
Certified Fraud Examiners are expected to maintain integrity, objectivity, independence, and professional skepticism throughout every engagement. Investigative conclusions must be based solely on reliable evidence rather than organizational politics or the status of individuals involved. Suppressing evidence or altering findings compromises professional ethics and may expose both the examiner and the organization to significant legal consequences. Working papers should be preserved according to applicable policies and legal requirements because they document investigative procedures and support conclusions. Credibility depends on impartial reporting that accurately reflects the facts established during the examination.