CFE Investigation: Evidence, Interviews, and the 2026 Exam

The word Investigation appears in older Certified Fraud Examiner (CFE) exam lists because it used to identify a distinct section. That history matters, but the examining structure changed on June 2, 2026. The Association of Certified Fraud Examiners (ACFE) now combines the investigative and legal material under Fraud Investigations and Legal Issues. Candidates should not book or prepare for a supposedly separate current CFE Investigation exam on the strength of a legacy page title. The modern section draws together planning, evidence, interviews, data analysis, reporting and the legal constraints that shape how those activities can be performed.

The CFE credential remains issued by ACFE. The revised examination contains three sections rather than the historical four. The current Fraud Investigations and Legal Issues section has 120 questions and a 2.5-hour limit, according to ACFE's 2026 examination materials. This article concentrates on investigative reasoning: how to move from a credible concern to findings that survive challenge, and why procedural discipline is not an administrative afterthought.

Begin with an allegation, not a conclusion

Fraud investigations often begin with imperfect signals: a whistleblower report, an internal-audit exception, a complaint from a vendor or unexplained account activity. The first responsibility is to understand what is alleged, what is actually known and which records could preserve the facts. Treating the allegation as proven encourages confirmation bias, inappropriate interviews and over-collection of personal information. Treating it as meaningless because it is anonymous can miss a serious control failure. A proportionate initial assessment weighs specificity, credibility, potential harm, urgency and the availability of corroboration.

An investigation plan should define its scope and hypotheses. Suppose someone alleges that a procurement employee steered business to a relative's company. At least three possibilities deserve examination: a legitimate supplier selection, a policy violation without financial loss, or a corrupt arrangement involving undisclosed benefits. A good plan identifies how records and interviews can discriminate between them. It also sets boundaries: relevant time period, business units, systems, custodians, data-retention risks and the authority under which information will be gathered.

Documenting a plan helps prevent mission drift. It should not become rigid when new evidence points elsewhere, but material scope changes should be explained and authorized. Investigators should consider conflicts of interest, impartiality, confidentiality and whether legal counsel or specialist support is required. These governance questions affect both the credibility of findings and the organization's exposure if the investigation is later reviewed by regulators, a court or an employment tribunal.

Documentary evidence and provenance

Business records can establish that a transaction occurred, who approved it and how it was recorded. They do not automatically establish why a person acted or whether a record is genuine. A vendor invoice might have been issued by a real company, but its underlying services may be fictitious. A purchase order may carry an employee's approval while the employee disputes authorizing it. Documentary examination therefore tests both content and provenance: who created the item, when, from which system, under what control and whether independent evidence confirms it.

Compare records across functions wherever possible. In a suspected billing scheme, examine purchase requisitions, contracts, delivery or service confirmations, accounts-payable entries, payment authorizations, bank details and vendor-master changes. A mismatch between a purchase order and invoice may be an ordinary error. Repeated invoices without evidence of receipt, routed through an unusually restricted approval path, may indicate a deliberate pattern. The narrative must account for innocent explanations as well as adverse facts.

Preserving originals matters. If a source file is copied to an analysis workbook, the analyst should retain the original and note every transformation. A finding based on a spreadsheet formula that accidentally excludes rows is unreliable even if the investigator acts in good faith. Record retrieval date, custodian, source system, access limitations and any known deficiencies. Where copies are created, an organization may use hashes or other controls to support integrity, depending on the evidence type and legal setting.

Digital evidence is useful only when interpreted correctly

Email, access logs, accounting-system changes, collaboration messages and endpoint artifacts can reveal timing, authorization and relationships that paper files obscure. They can also be easy to misread. A login associated with a user account does not always prove which human used a shared workstation. A message header may establish routing but not necessarily the author's intent. System timestamps can reflect different time zones, clock errors or extraction methods. Investigation notes should distinguish what a digital record directly shows from the conclusions inferred from it.

For a fraudulent bank-change request, the decisive sequence might include an altered vendor record, inbound message metadata, approval activity and a payment to a new account. Investigators should preserve potentially ephemeral logs promptly, while honoring access rights, employment rules and applicable privacy requirements. Technical specialists may be needed to acquire data defensibly; an accountant copying a folder is not automatically performing forensic imaging.

A useful cross-check is a timeline with each event linked to its evidence source and time standard. If a purported approval was entered after a payment went out, examine whether the system supports retrospective entry, whether timestamps reflect export delays and who had the necessary permissions. A timeline is a hypothesis-testing tool, not simply an attractive presentation in a final report.

Interviews: gather information before seeking admissions

Interviews provide explanations and context that records alone may not capture. An effective sequence often starts with people who can explain processes and documents before approaching those centrally implicated by the allegation. The investigator should determine each interview's purpose, prepare questions linked to specific information needs and avoid language that assumes guilt. Open questions invite a description of normal practice; narrower follow-ups test important details, contradictions and exceptional transactions.

Witness memory is fallible, especially when events are old or routine. A statement that “we always require two approvals” is evidence of an expected control, not proof that two approvals occurred in the case at issue. Ask the witness to describe the actual procedure, show relevant records if appropriate and explain known exceptions. Corroborate rather than relying on confident recollection. Keep notes that separate direct quotations, summarized responses and the investigator's interpretations.

An interview aimed at eliciting an admission presents heightened ethical and legal concerns. The investigator should understand applicable rights, employment arrangements, interview rules and restrictions on coercion or deception. The purpose is not to win a psychological contest. Unfair pressure can produce unreliable statements and undermine the entire case. Timing also matters: confronting an individual too early can contaminate witness accounts or increase the risk that records disappear. Such decisions require a plan and, often, legal input.

Financial analysis and tracing the economic benefit

The investigative challenge is often to connect a suspicious accounting entry with actual movement of money or another benefit. A fictitious-invoice scheme might involve an apparent vendor, an approval override and an account controlled by an insider. Tracing would establish where the funds went, who controlled the receiving account and whether the billed services existed. The objective is not to decorate the file with complex diagrams, but to test whether the evidence supports each step in the proposed fraud mechanism.

Investigators use trend analysis, joins across databases, duplicate-payment tests, network links among vendors, reconciliations and other techniques. Each can generate false positives. Two vendors sharing an address may belong to the same legitimate business park; round-dollar amounts may arise from fixed-fee contracts; duplicate invoice numbers may be normal across unrelated suppliers. The analyst should understand the data's keys, missing fields, recording conventions and validation rules before making allegations.

Financial pattern recognition also benefits from knowledge of CFE Financial Transactions and Fraud Schemes, whose historical emphasis now maps largely into the current Fraud Schemes and Financial Crimes section. Scheme knowledge suggests what to test—for instance, vendor ownership in a possible conflict of interest or original sales evidence in a potential skimming case. Investigation knowledge explains how to obtain and evaluate the records without claiming more certainty than they support.

Legal constraints shape evidence collection

The old CFE Law subject area is now integrated with fraud investigations because authority and admissibility cannot be separated from collection technique. Accessing an employee's personal messages, searching devices, recording conversations, using covert techniques or obtaining banking records may require specific legal authority, consent, policies or procedural safeguards. Those requirements differ by jurisdiction and organizational setting. A procedure permitted in an internal audit context may be inappropriate in a criminal investigation.

Investigators should understand the difference between preserving evidence and being entitled to access it. An organization may be obligated to retain a business document while the right to read privileged communications or sensitive personal data remains restricted. Counsel can help set a lawful scope, identify privilege concerns and design an appropriate review process. In cross-border matters, privacy, data-transfer and employment laws can complicate an otherwise straightforward request for a central system export.

Chain-of-custody records and documented collection methods support credibility, but they do not magically make unlawfully acquired evidence admissible. The factual relevance of a record, its authenticity, the method of acquisition and the rules of the forum are distinct issues. Exam preparation should recognize that distinction rather than memorizing a universal legal rule that does not exist.

Reports that separate evidence from inference

A defensible report should tell a reader what question was investigated, what scope and procedures were used, what the evidence established, which limitations remain and how the conclusions follow. It should identify sources sufficiently for a reviewer to retrace important findings without exposing more personal or confidential information than necessary. Interview summaries, spreadsheets and document references should use consistent identifiers and dates. Conclusions should also distinguish a policy breach, a control weakness, an unexplained discrepancy and evidence of intentional wrongdoing.

For example, “the vendor bank account was changed without the required second approval” is a clear control finding if supported by logs and policy. “The accounts-payable manager colluded with the vendor” goes further and requires proof linking the manager to intent and the counterparties. Reports should not use a criminal label merely to make an internal finding sound consequential. If the evidence permits several explanations, the report should state the remaining uncertainty and what additional information would resolve it.

Loss quantification needs similar discipline. Direct confirmed payments, potential exposure, avoided losses and consequential costs may require different assumptions. An investigator who simply totals every payment to a questioned vendor may overstate loss if genuine services were delivered during part of the relationship. Document methodology, treatment of recoveries and any known limitation. Readers can then evaluate the outcome without guessing how the number was obtained.

Preparing for the revised examination

A candidate using the legacy Investigation material should retain the fundamentals of planning, documentary evidence, data analysis, interviews, asset tracing and reporting. Then integrate the legal topics now formally presented with those activities under Fraud Investigations and Legal Issues. ACFE's current exam outline also identifies evidence principles, covert operations, sources of information, legal systems, noncriminal actions, criminal prosecutions and testimony as relevant subject areas. Those topics should not be left for an obsolete separate Law exam.

Practice with complete case files, not disconnected trivia. Start with a clear allegation, draft alternative explanations, identify relevant documents and witnesses, and then decide what can lawfully be obtained. Given a short timeline and source extracts, write a conclusion that distinguishes fact from inference. Consider what defense or independent reviewer would challenge. Such preparation develops the professional judgment required for real examination work, not only recognition of terms.

The modern CFE investigator combines curiosity with restraint. Good evidence collection may reveal fraud, error or a valid business explanation. The task is to find out which conclusion is supported while preserving the rights of those involved and the integrity of the record. That is why the 2026 integration of investigation and legal issues is substantively meaningful, not merely a change to the exam menu.