What's Your Fraud IQ?


Although the required knowledge, expertise, and roles of auditors and fraud examiners differ, CPAs occasionally find themselves in situations where evidence of fraud is right in front of them. Without a basic understanding of some methods for identifying and analyzing suspicious transactions, unsuspecting accountants might let the red flags of fraud keep flying. Do you have what it takes to pick up on the warning signs of fraud? Do you know what to do if you spot something questionable? Use this quiz to test your knowledge of some of the techniques that can help detect and analyze potential fraud.


1. The data analysis technique that involves testing whether, within a given data set, digits appear in certain positions in the numbers in the expected proportion is known as __________.


a. Digit occurrence matching

b. Benford’s law analysis

c. Correlation analysis

d. One-to-one checking



2. Lester Van Andel suspects that one of the purchasing agents at Clint Industries is funneling orders—complete with inflated purchase prices—to small companies run by his family members in exchange for kickbacks. Van Andel knows that these vendors’ business filings with the Secretary of State should contain enough information to help him confirm the companies’ ownership and thus the conflict of interest. However, to access the filings with the Secretary of State, he will need to obtain a subpoena.


a. True

b. False



3. In an interview situation, which of the following behaviors is often a sign of deception?


a. Repeating each question

b. Starting each answer with “honestly” or “to tell the truth”

c. Answering each question with another question, such as “Why would I do something like that?”

d. All of the above



4. According to the ACFE’s 2008 Report to the Nation on Occupational Fraud and Abuse, which of the following is the most common behavioral red flag exhibited by fraudsters?


a. Divorce or family problems

b. Unwillingness to share duties

c. Living beyond their means

d. Unusually close association with a vendor or customer



5. If a desktop computer is believed to contain evidence of a fraud, what is the first step that should be taken in securing it for analysis?


a. Turning it off using the shutdown process

b. Unplugging it

c. Sorting through the files to make a note of where on the hard disk the pertinent evidence is located

d. Copying all files on the computer to a portable hard drive



6. Sherry Elkins, an accounts payable clerk, has been embezzling money from her employer by manipulating the company’s billing function. Which of the following data analysis techniques would be helpful in identifying fraudulent A/P transactions?


a. Identifying vendors with no contact name

b. Identifying the least-used vendor accounts

c. Identifying the most-used vendor accounts

d. All of the above



7. While reviewing sales invoices, Michelle Starle, CPA, comes across a document with some odd markings. Based on several other suspicious things she’s noticed, her initial hunch is that it has been altered as part of a fraud scheme. What is the first thing she should do with the document?


a. Circle the suspicious writing on it

b. Fold it, put it in an envelope, and mail it to the police

c. Make a copy of it and put the original in a folder

d. Paperclip it to a legitimate invoice for comparison by her supervisor




1. (b) Benford’s law, also called the first-digit law, states that in a population of multidigit numbers, the first digit of the numbers will be distributed in a predictable way. For example, the first digit of a multidigit number is 1 approximately 30% of the time—far more than the expected frequency of one out of nine. Conversely, the first digit of a multidigit number is 9 only 4.6% of the time. Many fraudsters, however, fail to take this nonintuitive pattern into account when creating false documentation or transactions to cover their tracks. Some dishonest employees even attempt to be clever by evenly distributing the digits involved in their concealment techniques. Therefore, a pattern of numbers—such as invoice numbers or dollar amounts—whose digits deviate far from the values expected based on Benford’s law might indicate that not all of the included numbers are legit.


2. (b) Most states require corporations that do business within their jurisdictions to complete annual filings with the Secretary of State. Such filings are considered public records; consequently, access to such records does not necessitate a subpoena or the permission of the registered company. Additionally, nearly every state makes the information from such filings available online to the general public. The information included in such filings varies from state to state, but generally includes: information on the company’s owners, directors and executives; the principle business address; the date of incorporation; and business ID numbers. Similar filings and information are also frequently available for LLCs. (For a consolidated listing of the corporate and business filings available for each state, see llrx.com/columns/roundup29.htm.)


3. (d) Certain verbal responses or patterns can offer clues that the individual providing the responses is under stress; often such signals indicate that the respondent is trying to hide something. For example, if an individual repeats the interviewer’s questions, he or she might be attempting to gain more time to think of what to say. Similarly, beginning responses with oaths, such as “honestly” or “to tell the truth,” can be a liar’s way of attempting to add credibility to the dishonest statement he or she is about to make. Answering questions with questions—such as “Why would I do something like that?” or “What makes you think I would know that?”—is another method used to deflect a question without providing a directly dishonest answer. While many clues are too subtle to be noticed by anyone other than trained investigators, being aware of the verbal signs of deception can only help a CPA in detecting questionable situations. In the world of accounting and audits, when someone appears stressed in response to being asked about specific processes or transactions, it is reasonable to consider what they have to hide and whether it could be fraud.


4. (c) In the ACFE’s 2008 Report to the Nation on Occupational Fraud and Abuse, 38.6% of the cases reported involved a perpetrator who was living beyond his or her means, making this the most common behavioral red flag exhibited by the fraudster. Additionally, 34.1% of the perpetrators were experiencing known financial difficulties at the time of their crimes. While these findings certainly do not mean that all individuals who live beyond their means or experience financial difficulties will resort to fraud, the fact that these common threads were woven through more than one-third of reported fraud cases indicates that certain behavioral characteristics—particularly if displayed by employees who have access to company finances—are worth noting. Further, although divorce or family problems, an unwillingness to share duties, and an unusually close association with a vendor or customer were less commonly cited red flags than living beyond one’s means, these warning signs were present in 17.1%, 18.7% and 15.2% of the reported fraud cases, respectively. Accountants are generally tasked with analyzing numbers, controls and transactions, but by expanding their observations to the people who record the numbers, design and execute the controls, and carry out the transactions, additional frauds may be uncovered and losses to companies mitigated.


5. (b) Analysis of computer files and structures for investigation and legal purposes should be left to professional computer forensics experts, and such an expert should always be consulted before touching the computer under investigation. However, accountants should be aware that any desktop computer that is being seized—or that might be seized at a later date—for an investigation should be unplugged from the power source rather than turned off using the normal shutdown process, as there may be data contained within the computer’s hard drive that would be erased with a system shutdown. Additionally, it is imperative that the files are left intact and untouched—no sorting through them or copying them to another location—in order to maintain the integrity of the data on the computer for purposes of the forensic examination.


6. (d) The billing function is a common target for employee embezzlement, as that’s where the vast majority of an organization’s cash disbursements are initiated. Frauds against the billing function take many forms; luckily, so do the tests that can help detect such schemes. Queries that identify vendors with no listed contact person can indicate accounts set up for the sole purpose of submitting fraudulent invoices to the company for payment. Additionally, identifying vendors on the extreme ends of the usage spectrum can illuminate transactions that merit further scrutiny. Transactions involving a one-time vendor might be legitimate, but they might also be a sign of a fraudster testing the waters. Likewise, a vendor that is used disproportionately often might be a sign of a conflict of interest or kickback scheme. Other common data analysis techniques that are used to identify fraud against the billing function include comparing vendor and employee contact information and searching for matching/similar addresses, phone numbers, and tax ID numbers; searching for duplicate or consecutive invoice numbers from the same vendor; and stratifying invoice amounts to identify invoices that fall just below approval thresholds.


7. (c) A document—particularly one with forgeries or fraudulent alterations—can be an important piece of physical evidence in a legal case against a fraudster. Often such documents will need to be analyzed by a forensic document examiner to confirm whether and how they have been forged, altered or fabricated. Consequently, Starle should handle the document cautiously, taking care not to fold it, mark on it, or alter it in any way, so as to not taint any evidential value the document has. Even placing a paper clip on the document can change the original document’s condition enough to affect the forensic analysis. Additionally, most forensic examinations require the original document, since most photocopies do not reproduce certain features with sufficient clarity or detail to allow adequate examination. Therefore, Starle should make a working copy for purposes of her review and preserve the original document—preferably in a secure paper folder or sealed envelope to avoid damage or contamination—for submission to a forensic document examiner.




If you answered seven questions correctly, congratulations. Your arsenal of antifraud knowledge is well-armed and ready to aid in the fight against fraudulent conduct. Keep up the good work.


If you answered five or six questions correctly, you’re on the right track. Use the resources on this page to continue to build on your knowledge of fraud detection and investigation.


If you answered fewer than five questions correctly, you may want to brush up on your antifraud knowledge. The resources are a good place to start. Enhancing your understanding of fraud detection and investigation concepts will help ensure that you have what it takes to keep fraud from slipping by on your watch.


Andi McNeal (amcneal@acfe.com) is director of research for the Association of Certified Fraud Examiners.


To comment on this article or to suggest an idea for another article, contact Loanna Overcash, senior editor, at lovercash@aicpa.org or 919-402-4462.





JofA articles



  • Characteristics and Skills of the Forensic Accountant , tinyurl.com/ygqm7m7
  • Managing the Business Risk of Fraud: A Practical Guide , tinyurl.com/bhkmeu
  • How Fraud Hurts You and Your Organization (#056513HS)


For more information or to place an order, go to cpa2biz.com or call the Institute at 888-777-7077.


On-Site Training

  • Advanced Forensic Techniques for Accountants (#AFTA)
  • Auditing Real-World Frauds: A Practical Case Application Approach (#ARWF)
  • Forensic Accounting: Fraudulent Reporting and Concealed Assets (#FAFR)
  • Forensics and Financial Fraud: Real- World Issues & Answers (#FFF)


To access courses, go to aicpalearning.org and click on “On-Site Training” and search by “Acronym Index.” If you need assistance, please contact a training representative at 800-634-6780 (option 1).


Web sites


FVS Section

Membership in the Forensic and Valuation Services (FVS) Section provides you with access to numerous specialized resources in the forensic and valuation services discipline areas, including practice guides and exclusive member discounts for products and events. Go to aicpa.org/FVS to learn more about the FVS Section or to join go to tinyurl.com/d93r6w.


Where to find January’s flipbook issue

Starting this month, all Association magazines — the Journal of Accountancy, The Tax Adviser, and FM magazine (coming in February) — are completely digital. Read more about the change and get tips on how to access the new flipbook digital issues.


Get your clients ready for tax season

Upon its enactment in March, the American Rescue Plan Act (ARPA) introduced many new tax changes, some of which retroactively affected 2020 returns. Making the right moves now can help you mitigate any surprises heading into 2022.