Chapter 7--Investigating Theft Acts Chapter 7--Investigating Theft Acts

Student: ___________________________________________________________________________

1. Which of the following is the last step in an investigation?

A. Interview suspect
B. Interview former employees
C. Interview former buyers
D. Perform surveillance

2. When investigating fraud, investigators should usually interview suspects:

A. at the beginning of the investigation process to really put the heat on them.
B. in the middle of the investigation process to make them feel that they are not really a suspect.
C. at the end of the investigation process so that they can gather sufficient evidence against them.
D. any time during the investigation process to avoid creating undue stress and suspicion among other
employees.

3. Which of the following is NOT a method for theft investigation?

A. Covert operations (surveillance)
B. Electronic searches
C. Invigilation
D. Physical evidence

4. Characteristics of invigilation include which of the following?

A. A method of creating a loosely monitored environment to catch fraudulent activities.
B. It is an inexpensive method to monitor all employees during the investigation process.
C. It is most commonly used in such high-risk areas as expensive inventory.
D. A method of watching and recording physical facts, acts, and movements.
5. Identify the best pattern/order to go about a theft investigation.
A. Search public records, check personal records, interview suspect, interview former employers, and interview
other buyers.
B. Check personnel records, interview former employers, search public records, ,interview other buyers, and
interview suspect.
C. Interview suspect, interview former employers, search public records, check personal records, and interview
other buyers.
D. Interview other buyers, check personal records, interview former employers, interview suspect, and search
public records.

6. Which of the following is NOT a type of surveillance?

A. Stationary or fixed point
B. Audit
C. Tailing
D. Electronic surveillance

7. Which investigation technique relies on a person's senses, especially hearing and seeing?
A. Invigilation
B. Surveillance and covert operations
C. Electronic evidence
D. Obtaining physical evidence

8. Surveillance is usually used to investigate:

A. Theft acts.
B. Concealment possibilities.
C. Conversion possibilities.
D. Key internal controls.

9. What is invigilation?
A. A theft investigation technique which records the physical evidence, facts, and movements, which form part
of a fraud.
B. A theft investigation technique which involves close supervision of the suspects during the examination
period.
C. A theft investigation technique which is used when large scale fraud is likely and other methods of
investigation fail.
D. A theft investigation technique which involves confiscating and searching computers and other electronic
sources of information.
10. Undercover operations should be used only when:
A. large scale fraud is likely and other investigation methods fail.
B. controls are made so strict that opportunities to commit fraud are virtually impossible.
C. the investigation cannot be kept a secret.
D. there is a need to develop theories about what kind of fraud has occurred.

11. Which of the following statements is FALSE?

A. Fraud investigations should begin in a manner that does not arouse suspicion.
B. Initially, investigators should avoid using words like investigation.
C. The investigation process usually starts by approaching the suspect.
D. Investigators should focus on gathering the strongest types of evidence.

12. Subjects of covert operations are protected against unreasonable breaches of privacy under the ______ of
the constitution.
A. Fourth Amendment
B. Fifth Amendment
C. Second Amendment
D. Seventh Amendment

13. Which of the following is true about invigilation?

A. The strict controls imposed are temporary in nature.
B. During the period of invigilation, evidence is presented to suspects with the hopes of getting a confession.
C. When invigilation is conducted, it is best to cover all aspects of the business.
D. Invigilation should be accomplished in 5-7 days.

14. An investigator locates the scene that should be observed, anticipates the action that is most likely to occur
at the scene, and keeps detailed notes on all activities involving the suspect. Which type of surveillance is being
used here?
A. Static surveillance
B. Electronic surveillance
C. Stationary surveillance
D. Moving surveillance

15. In most investigations of a fraud suspect, investigators should begin by:

A. Confronting the suspect.
B. Checking personal and company records.
C. Interviewing co-workers.
D. Performing invigilation.
16. Undercover operations are costly and time-consuming and should be used with extreme care. In which of
the following situations would it be ineffective to conduct an undercover operation?
A. When law enforcement authorities are informed
B. When the investigation can be closely monitored
C. When other investigation methods are available
D. When the investigation can remain secretive

17. A(n) ____ is a tool for explicitly considering all aspects of the fraud and for establishing fraud theories.
A. Vulnerability chart
B. Perceptual map
C. Surveillance log
D. Pareto chart

18. Experts recommend that invigilation must continue:

A. for at least 7 days.
B. for at least 14 days.
C. for at least 21 days.
D. for an indefinite period determined by the individual investigator.

19. ______ means that there are symptoms or red flags that a fraud may be occurring.
A. Predication
B. Vulnerability
C. Audit
D. Presumption

20. Several factors are considered in deciding whether or not to investigate fraud. Which of the following is
NOT one of them?
A. The signal that investigation or noninvestigation will send to others in the organization.
B. Perceived cost of the investigation.
C. Exposure or amount that could have been taken.
D. Perceived strength of the predication.
E. Preparation of a surveillance log.

21. Which of the following is a form of surveillance that is usually only available to law enforcement officers?
A. Surveillance using video cameras
B. Wiretapping
C. Stationary surveillance
D. Tailing
22. _______ are theft act investigative methods that usually involve observing or listening to potential
perpetrators.
A. Audits
B. Online resources
C. Document examination
D. Surveillance and covert operations

23. For fraud to occur, usually three elements are necessary: pressure, opportunity, and _______.
A. excitement
B. guidance
C. rationalization
D. money

24. A(n) _______ is a calculation (using encryption technologies) based on the contents of a disk or file. They
are engineered so that even small changes in the source data will produce significantly different checksum
results.
A. cyclic random check number
B. cyclic redundancy check number
C. cyclic repetition check number
D. random variable check number

25. What is used in court cases to prove that data has not been adversely affected during analysis?
A. Arithmetic mean
B. Deviation measure
C. Random sampling
D. Checksums

26. The two primary checksum methods used today are:

A. E-TTL I and E-TTL II.
B. SSFDC and SDHC.
C. MD5 and SHA-1.
D. SSFDC and RS-232.

27. _____ investigative methods are usually helpful in investigating all types of frauds, but they are most useful
after you have gathered other types of evidence and know who to interview and what questions to ask.
A. Inquiry
B. Theft
C. Concealment
D. Conversion
28. Which investigation technique usually does not work well in kickback situations?
A. Concealment
B. Theft
C. Inquiry
D. Conversion

29. A divisional manager is suspected of adding ghost employees to the payroll. Which investigative method
can most easily uncover this type of fraud?
A. Undercover operations
B. Theft
C. Concealment
D. Conversion

30. Electronic surveillance may have only limited value in the investigation of employee frauds and many other
white-collar crimes. Why?
A. Lack of adequate technology
B. Concerns regarding employees’ privacy
C. Prohibitively high cost of installation and maintenance
D. Relative ease of tampering evidence

31. Which of the following is a basic objective of surveillance, whether manual or electronic?
A. Identify victims of the fraud
B. Analyze how the money comes back in the form of assets
C. Understand the cover-up or concealment of fraud
D. Catch fraud at the theft act stage

32. Which general term refers to the gathering of electronic evidence?

A. Checksum
B. Online verification
C. Electronic audit
D. Computer forensics

33. Concealment investigative techniques do not work well in kickback situations. Why?
A. The parties in the transaction will be hard to trace.
B. Results of concealment investigative techniques are not admissible as evidence in courts.
C. There is usually no direct documentary evidence.
D. The risk involved in such investigations is unusually high.
34. Which of the following observations concerning physical evidence is TRUE?
A. It is not useful in fighting fraud cases.
B. It is more associated with nonfraud types of crimes.
C. It is useful in fraud cases because fraud is usually seen and has physical symptoms.
D. It does not involve electronic sources of information.

35. Identify the first step in any electronic evidence collection process.
A. Seizure of the device
B. Automated search of the device
C. Clone the device
D. Do a manual reconnaissance

36. Which step in the electronic evidence collection process is important to ensure that the original disk is kept
in its seized state?
A. Evidence mapping
B. Search
C. Seizure
D. Cloning
Chapter 7--Investigating Theft Acts Key

1. Which of the following is the last step in an investigation?

A. Interview suspect
B. Interview former employees
C. Interview former buyers
D. Perform surveillance

2. When investigating fraud, investigators should usually interview suspects:

A. at the beginning of the investigation process to really put the heat on them.
B. in the middle of the investigation process to make them feel that they are not really a suspect.
C. at the end of the investigation process so that they can gather sufficient evidence against them.
D. any time during the investigation process to avoid creating undue stress and suspicion among other
employees.

3. Which of the following is NOT a method for theft investigation?

A. Covert operations (surveillance)
B. Electronic searches
C. Invigilation
D. Physical evidence

4. Characteristics of invigilation include which of the following?

A. A method of creating a loosely monitored environment to catch fraudulent activities.
B. It is an inexpensive method to monitor all employees during the investigation process.
C. It is most commonly used in such high-risk areas as expensive inventory.
D. A method of watching and recording physical facts, acts, and movements.
5. Identify the best pattern/order to go about a theft investigation.
A. Search public records, check personal records, interview suspect, interview former employers, and interview
other buyers.
B. Check personnel records, interview former employers, search public records, ,interview other buyers, and
interview suspect.
C. Interview suspect, interview former employers, search public records, check personal records, and interview
other buyers.
D. Interview other buyers, check personal records, interview former employers, interview suspect, and search
public records.

6. Which of the following is NOT a type of surveillance?

A. Stationary or fixed point
B. Audit
C. Tailing
D. Electronic surveillance

7. Which investigation technique relies on a person's senses, especially hearing and seeing?
A. Invigilation
B. Surveillance and covert operations
C. Electronic evidence
D. Obtaining physical evidence

8. Surveillance is usually used to investigate:

A. Theft acts.
B. Concealment possibilities.
C. Conversion possibilities.
D. Key internal controls.

9. What is invigilation?
A. A theft investigation technique which records the physical evidence, facts, and movements, which form part
of a fraud.
B. A theft investigation technique which involves close supervision of the suspects during the examination
period.
C. A theft investigation technique which is used when large scale fraud is likely and other methods of
investigation fail.
D. A theft investigation technique which involves confiscating and searching computers and other electronic
sources of information.
10. Undercover operations should be used only when:
A. large scale fraud is likely and other investigation methods fail.
B. controls are made so strict that opportunities to commit fraud are virtually impossible.
C. the investigation cannot be kept a secret.
D. there is a need to develop theories about what kind of fraud has occurred.

11. Which of the following statements is FALSE?

A. Fraud investigations should begin in a manner that does not arouse suspicion.
B. Initially, investigators should avoid using words like investigation.
C. The investigation process usually starts by approaching the suspect.
D. Investigators should focus on gathering the strongest types of evidence.

12. Subjects of covert operations are protected against unreasonable breaches of privacy under the ______ of
the constitution.
A. Fourth Amendment
B. Fifth Amendment
C. Second Amendment
D. Seventh Amendment

13. Which of the following is true about invigilation?

A. The strict controls imposed are temporary in nature.
B. During the period of invigilation, evidence is presented to suspects with the hopes of getting a confession.
C. When invigilation is conducted, it is best to cover all aspects of the business.
D. Invigilation should be accomplished in 5-7 days.

14. An investigator locates the scene that should be observed, anticipates the action that is most likely to occur
at the scene, and keeps detailed notes on all activities involving the suspect. Which type of surveillance is being
used here?
A. Static surveillance
B. Electronic surveillance
C. Stationary surveillance
D. Moving surveillance

15. In most investigations of a fraud suspect, investigators should begin by:

A. Confronting the suspect.
B. Checking personal and company records.
C. Interviewing co-workers.
D. Performing invigilation.
16. Undercover operations are costly and time-consuming and should be used with extreme care. In which of
the following situations would it be ineffective to conduct an undercover operation?
A. When law enforcement authorities are informed
B. When the investigation can be closely monitored
C. When other investigation methods are available
D. When the investigation can remain secretive

17. A(n) ____ is a tool for explicitly considering all aspects of the fraud and for establishing fraud theories.
A. Vulnerability chart
B. Perceptual map
C. Surveillance log
D. Pareto chart

18. Experts recommend that invigilation must continue:

A. for at least 7 days.
B. for at least 14 days.
C. for at least 21 days.
D. for an indefinite period determined by the individual investigator.

19. ______ means that there are symptoms or red flags that a fraud may be occurring.
A. Predication
B. Vulnerability
C. Audit
D. Presumption

20. Several factors are considered in deciding whether or not to investigate fraud. Which of the following is
NOT one of them?
A. The signal that investigation or noninvestigation will send to others in the organization.
B. Perceived cost of the investigation.
C. Exposure or amount that could have been taken.
D. Perceived strength of the predication.
E. Preparation of a surveillance log.

21. Which of the following is a form of surveillance that is usually only available to law enforcement officers?
A. Surveillance using video cameras
B. Wiretapping
C. Stationary surveillance
D. Tailing
22. _______ are theft act investigative methods that usually involve observing or listening to potential
perpetrators.
A. Audits
B. Online resources
C. Document examination
D. Surveillance and covert operations

23. For fraud to occur, usually three elements are necessary: pressure, opportunity, and _______.
A. excitement
B. guidance
C. rationalization
D. money

24. A(n) _______ is a calculation (using encryption technologies) based on the contents of a disk or file. They
are engineered so that even small changes in the source data will produce significantly different checksum
results.
A. cyclic random check number
B. cyclic redundancy check number
C. cyclic repetition check number
D. random variable check number

25. What is used in court cases to prove that data has not been adversely affected during analysis?
A. Arithmetic mean
B. Deviation measure
C. Random sampling
D. Checksums

26. The two primary checksum methods used today are:

A. E-TTL I and E-TTL II.
B. SSFDC and SDHC.
C. MD5 and SHA-1.
D. SSFDC and RS-232.

27. _____ investigative methods are usually helpful in investigating all types of frauds, but they are most useful
after you have gathered other types of evidence and know who to interview and what questions to ask.
A. Inquiry
B. Theft
C. Concealment
D. Conversion
28. Which investigation technique usually does not work well in kickback situations?
A. Concealment
B. Theft
C. Inquiry
D. Conversion

29. A divisional manager is suspected of adding ghost employees to the payroll. Which investigative method
can most easily uncover this type of fraud?
A. Undercover operations
B. Theft
C. Concealment
D. Conversion

30. Electronic surveillance may have only limited value in the investigation of employee frauds and many other
white-collar crimes. Why?
A. Lack of adequate technology
B. Concerns regarding employees’ privacy
C. Prohibitively high cost of installation and maintenance
D. Relative ease of tampering evidence

31. Which of the following is a basic objective of surveillance, whether manual or electronic?
A. Identify victims of the fraud
B. Analyze how the money comes back in the form of assets
C. Understand the cover-up or concealment of fraud
D. Catch fraud at the theft act stage

32. Which general term refers to the gathering of electronic evidence?

A. Checksum
B. Online verification
C. Electronic audit
D. Computer forensics

33. Concealment investigative techniques do not work well in kickback situations. Why?
A. The parties in the transaction will be hard to trace.
B. Results of concealment investigative techniques are not admissible as evidence in courts.
C. There is usually no direct documentary evidence.
D. The risk involved in such investigations is unusually high.
34. Which of the following observations concerning physical evidence is TRUE?
A. It is not useful in fighting fraud cases.
B. It is more associated with nonfraud types of crimes.
C. It is useful in fraud cases because fraud is usually seen and has physical symptoms.
D. It does not involve electronic sources of information.

35. Identify the first step in any electronic evidence collection process.
A. Seizure of the device
B. Automated search of the device
C. Clone the device
D. Do a manual reconnaissance

36. Which step in the electronic evidence collection process is important to ensure that the original disk is kept
in its seized state?
A. Evidence mapping
B. Search
C. Seizure
D. Cloning