Investigation Planning and Case Management

Introduction

A fraud examination rarely fails because an investigator cannot identify a suspicious transaction. It more often fails because the allegation was poorly assessed, the scope drifted, evidence was not preserved, responsibilities were unclear, or conclusions exceeded the evidence. Investigation planning and case management provide the structure that converts an allegation into a fair, efficient, documented, and defensible inquiry.

An investigation is a controlled process of determining facts relevant to an allegation. It is not a search for confirmation of an initial suspicion. The investigator must formulate competing explanations, obtain reliable evidence, test those explanations, document judgments, and escalate matters when legal, regulatory, operational, or safety risks require it.

This chapter focuses on allegation assessment, hypothesis testing, scope, team design, independence, confidentiality, timelines, documentation, escalation, and the use of technology. The principles apply to internal investigations, external forensic engagements, regulatory inquiries, and investigations supporting civil or criminal proceedings.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish an allegation, a fact, an inference, and a hypothesis.
2. Assess allegations using structured criteria such as specificity, plausibility, corroboration, materiality, and urgency.
3. Define investigation objectives, scope, exclusions, and decision rights.
4. Design an appropriately independent investigation team.
5. Develop a hypothesis-testing plan and an evidence matrix.
6. Manage confidentiality, legal privilege, records, timelines, and investigative risks.
7. Recognize when and how to escalate an investigation.
8. Evaluate the limitations of investigation methods and the responsible use of analytics and artificial intelligence.

1. The Investigation as a Decision Process

An investigation begins with uncertainty. A report may state that a procurement manager accepted kickbacks, that payroll records contain fictitious employees, or that financial results were manipulated. At the beginning, none of these statements should automatically be treated as established fact.

Four concepts must be distinguished:

• Allegation: an assertion that misconduct may have occurred.
• Fact: information sufficiently supported by reliable evidence for the purpose at hand.
• Inference: a reasoned interpretation drawn from facts.
• Hypothesis: a proposed explanation that can be tested against evidence.

For example, “the supplier is related to the purchasing officer” is an allegation. A corporate registry showing common ownership is evidence supporting a fact about ownership. The inference may be that the transaction presents a conflict of interest. The hypothesis may be that the officer influenced supplier selection to benefit the related party.

The investigator's task is not merely to collect information. It is to make disciplined decisions about what information is needed, how reliable it is, whether alternative explanations remain viable, and what action is justified.

The investigation funnel

A useful model is a funnel:

1. Receipt: capture the allegation without altering its meaning.
2. Triage: assess urgency, safety, legal, regulatory, and preservation needs.
3. Preliminary assessment: determine whether a proportionate inquiry is justified.
4. Planning: define objectives, scope, hypotheses, people, evidence, and timetable.
5. Examination: collect and test evidence.
6. Evaluation: assess competing explanations and limitations.
7. Reporting: communicate findings, qualifications, and recommendations.
8. Closure and remediation: preserve the file, track actions, and identify lessons.

The funnel should narrow uncertainty, not prematurely narrow the facts considered.

2. Allegation Assessment and Triage

2.1 Receiving and recording an allegation

The initial record should preserve:

• date and method of receipt;
• the source and contact details, where available;
• the exact words used by the reporter;
• persons, entities, transactions, systems, and locations mentioned;
• alleged conduct, dates, amounts, and affected accounts;
• supporting documents or links;
• immediate safety, retaliation, destruction, or regulatory concerns; and
• restrictions on disclosure requested by the reporter.

The investigator should separate the reporter's statement from the investigator's interpretation. Paraphrasing can unintentionally introduce conclusions or omit qualifiers.

2.2 Assessment criteria

No single scoring model replaces professional judgment, but a structured assessment improves consistency. Important dimensions include:

An allegation need not be highly specific to justify action. A vague report may still require preservation or safety measures. Conversely, a detailed allegation may be malicious or mistaken. Triage determines the next proportionate step; it does not determine guilt.

2.3 Triage outcomes

Possible outcomes include:

• no further action, with reasons documented;
• referral to another function, such as human resources, information security, or health and safety;
• preliminary fact-finding;
• a full investigation;
• immediate preservation and investigation;
• regulatory, law-enforcement, legal, or board escalation; or
• a combined response involving several functions.

The decision should identify the evidence supporting the triage, the risks accepted, the decision-maker, and the date for review. Closing an allegation without investigation is itself a significant judgment and must be documented.

3. Defining Objectives, Scope, and Terms of Reference

3.1 Objectives

Objectives describe what the investigation must determine. Strong objectives are neutral and answerable. Examples are:

• Determine whether invoices from Supplier X between January and June were supported by genuine goods or services.
• Determine whether employees disclosed confidential pricing information to an external party.
• Determine the amount and period of any misstatement, the persons involved, and control failures.
• Determine whether the conduct breached policy, contract, law, or regulatory requirements.

“Prove that the manager committed fraud” is a poor objective because it presupposes the conclusion.

3.2 Scope and exclusions

The terms of reference should state:

• allegations and questions to be examined;
• time period;
• entities, business units, accounts, systems, and jurisdictions;
• relevant conduct and transactions;
• applicable policies, contracts, laws, or professional standards;
• intended users of the report;
• authority to obtain information and interview personnel;
• exclusions and conditions for changing them;
• reporting milestones; and
• approval and escalation arrangements.

Scope must be sufficiently broad to address connected conduct but sufficiently focused to remain manageable. Scope creep occurs when additional issues are pursued without evaluating their relevance, resources, independence, or legal implications. A scope change should be recorded with its rationale, approval, impact on timing, and effect on the original objectives.

3.3 Scope boundaries and materiality

Materiality in an investigation is broader than a financial-statement threshold. A small payment may reveal bribery, a control failure, retaliation, or a pattern extending to larger transactions. Scope decisions should therefore consider financial magnitude, legal significance, frequency, seniority, vulnerability of affected persons, and reputational consequences.

4. Hypothesis Testing and the Evidence Plan

4.1 Competing hypotheses

Investigators should formulate at least one plausible innocent or non-fraud explanation alongside the misconduct hypothesis. For a duplicate payment, possible hypotheses include:

• intentional duplicate payment;
• legitimate recurring service incorrectly coded;
• duplicate invoice caused by a system migration;
• payment reversal and reprocessing; or
• data-entry error without improper benefit.

The purpose is not to treat all explanations as equally likely. It is to reduce confirmation bias and identify evidence that could disconfirm the favored explanation.

A hypothesis should be specific enough to test. “Something improper happened” is too vague. A stronger hypothesis is: “The employee created a fictitious vendor and routed payments to an account controlled by an associate.”

4.2 Evidence matrix

An evidence matrix connects questions to evidence and conclusions.

The matrix should be updated as evidence changes the issues or creates new hypotheses.

4.3 Reliability and corroboration

Evidence quality depends on relevance, authenticity, completeness, accuracy, independence, and the conditions under which it was obtained. A contemporaneous system record may be useful, but it is not automatically complete or accurate. A witness account may be sincere but affected by memory, incentives, or limited observation.

Corroboration means obtaining independent support for a proposition. It does not require every fact to be proved by multiple sources. The appropriate level depends on the importance of the proposition, the reliability of the source, and the consequences of error.

Investigators should document contradictory evidence rather than silently excluding it. A conclusion is stronger when it explains why contrary information was not sufficient to displace it.

5. Investigation Team Design and Independence

5.1 Roles

A case may involve:

• a case sponsor who authorizes resources and receives updates;
• a lead investigator responsible for methodology and conclusions;
• forensic accountants who quantify transactions and losses;
• data analysts who extract and test records;
• legal advisers who advise on law, privilege, reporting, and process;
• information-technology specialists who preserve and examine digital evidence;
• human-resources or safeguarding specialists where employee welfare is relevant; and
• communications or regulatory specialists for disclosure decisions.

The team should use a responsibility matrix. The lead investigator coordinates work, but specialists must retain professional responsibility for their analyses.

5.2 Independence and conflicts

Independence is both actual and perceived. A person may be technically impartial but appear compromised because of a reporting relationship, prior involvement, personal relationship, financial interest, or pressure from a senior executive.

Before assignment, each team member should disclose conflicts. Controls may include recusal, independent review, separate reporting lines, external investigators, or restricted access. Independence does not mean the investigator has no prior knowledge; it means judgments are not improperly influenced by interests connected with the outcome.

5.3 Confidentiality and privilege

Confidentiality limits disclosure to those with a legitimate need to know. It protects the integrity of the investigation and reduces retaliation, rumor, and evidence contamination. It is not an absolute promise that information will never be disclosed. Law, regulation, court orders, safeguarding duties, or organizational policy may require disclosure.

Legal privilege is jurisdiction-specific and should not be assumed merely because a lawyer is copied on an email. The purpose, participants, labels, storage arrangements, and applicable law matter. Investigators should obtain legal advice about privilege rather than making unsupported claims.

Practical controls include role-based access, secure repositories, encrypted transfer, neutral file names, distribution logs, interview protocols, and careful wording in email. Confidentiality must not be used to conceal wrongdoing, obstruct legitimate reporting, or prevent a subject from receiving procedural fairness.

6. Timeline, Resources, and Case Controls

A case plan should identify milestones such as preservation, scoping, data acquisition, preliminary analysis, interviews, review, reporting, and closure. Dates should be realistic and linked to dependencies. For example, interviews may depend on document review, and a quantified loss may depend on a complete ledger extraction.

A simple planning table is useful:

Resource planning should consider volume of data, number of jurisdictions, language, specialist skills, interview complexity, and the possibility of legal challenge. Investigators should record assumptions and revise estimates when evidence changes the case.

7. Documentation and Chain of Custody

The case file should allow an informed reviewer to understand what was alleged, what was done, what was found, what was not found, and why decisions were made. Core records include:

• allegation and triage record;
• conflict checks and approvals;
• terms of reference and scope changes;
• risk assessment and investigation plan;
• evidence register;
• collection and chain-of-custody records;
• analysis workpapers and source references;
• interview plans, notes, and confirmations;
• decision and escalation logs;
• draft and final reports; and
• remediation and closure records.

A chain of custody documents the history of an item from identification through collection, transfer, storage, examination, and disposition. It should identify the item, collector, date and time, method, storage location, transfers, access, and integrity controls. Digital evidence may require forensic imaging, hash values, metadata preservation, and specialist tools. A hash can help demonstrate that a file has not changed, but it does not by itself prove that the original file was truthful or complete.

Documentation must be contemporaneous enough to preserve reasoning, but it should not become a dumping ground. Each workpaper should state its purpose, source, procedure, result, and conclusion or limitation.

8. Interviews and Procedural Fairness

Interview planning should consider sequence, objectives, documents to show, language, accessibility, support persons, recording rules, and personal safety. Witnesses are generally interviewed before subjects, but the sequence may change where there is a risk of evidence destruction or collusion.

A fair interview is non-coercive and gives the subject a meaningful opportunity to respond to significant information. Investigators should avoid accusatory assumptions, distinguish open questions from leading questions, and record material admissions, denials, uncertainty, and requests for clarification. Notes should identify who was present, when and where the interview occurred, and whether the account was confirmed or corrected.

Procedural fairness does not require revealing every investigative step or compromising confidential sources. It does require that conclusions not rest on undisclosed material errors that the subject had no reasonable opportunity to address.

9. Escalation and Decision Rights

Escalation should be planned rather than improvised. Escalation triggers may include:

• immediate threat to life, health, safety, or vulnerable persons;
• continuing financial loss or active evidence destruction;
• suspected involvement of senior executives or board members;
• bribery, sanctions, money laundering, market abuse, or other regulated conduct;
• cross-border data, privacy, or jurisdictional issues;
• retaliation against a reporter or witness;
• a conflict that undermines independence;
• evidence suggesting the original scope is materially incomplete; or
• a requirement to notify insurers, auditors, regulators, law enforcement, lenders, or a board committee.

The investigator should not independently promise immunity, negotiate with suspects, contact law enforcement, or make public statements unless authorized. Escalation decisions should state the trigger, information available, uncertainty, recommended action, decision-maker, and time of review.

A useful distinction is between operational escalation—obtaining additional resources or management action—and external escalation—notifying a regulator, law-enforcement body, insurer, auditor, or other outside party. Legal advice is often essential before external disclosure.

10. Technology, Analytics, and Artificial Intelligence

Technology can improve case management, but it does not remove professional judgment. Common applications include:

• exception testing for duplicate invoices, round-dollar payments, split purchases, unusual timing, and dormant vendors;
• link analysis of people, accounts, devices, vendors, and transactions;
• workflow systems for tasks, approvals, access, and audit trails;
• forensic imaging and e-discovery tools; and
• language processing for document classification and review prioritization.

Analytics may be expressed through ordinary accounting and statistical methods. For example, a duplicate-payment test may compare supplier, invoice number, date, amount, and bank account. Similarity algorithms can identify near-duplicates, but thresholds create false positives and false negatives. A flagged transaction is an investigative lead, not a conclusion.

Artificial intelligence can assist with classification, summarization, translation, and pattern detection. Risks include hallucinated facts, hidden training data, leakage of confidential information, biased classification, inability to reproduce a result, and overreliance on a probability score. Human reviewers should validate source documents, preserve prompts and outputs where relevant, test performance, and ensure that automated results do not determine adverse action without human assessment.

11. Worked Application: Illustrative Case

Background

Northbridge Components, a fictional manufacturing company, receives an anonymous report alleging that a procurement manager created a fictitious supplier, Apex Industrial Services, and approved payments totaling $480,000 over eighteen months. The report states that the supplier performed no work and that payments were transferred to an account connected to the manager's relative.

Problem and triage

The allegation is specific about the supplier, period, role, and approximate amount. It presents risks of continuing payments, evidence destruction, retaliation, and possible financial-reporting consequences. The chief audit executive therefore authorizes immediate preservation of procurement, accounts-payable, email, vendor-master, and bank-detail records. The manager is not informed of the allegation before preservation controls are implemented, consistent with legal advice and company policy.

Planning and hypotheses

The lead investigator defines the following hypotheses:

• H1: Apex was fictitious or did not provide the invoiced services.
• H2: The manager or an associate controlled or benefited from the receiving account.
• H3: Payments resulted from a legitimate service relationship or administrative error rather than intentional misconduct.

The scope covers Apex transactions, vendor creation and changes, purchase orders, receiving records, approvals, communications, bank details, and related-party information during the eighteen-month period. It excludes unrelated suppliers unless the evidence indicates a common method.

Examination

The team reconciles the accounts-payable ledger to bank payments and identifies 96 invoices. Vendor-master records show that Apex was created two days before the first payment. The address matches a residential property associated with the manager's relative. No receiving reports or work outputs are found for 71 invoices. A sample of operations managers cannot confirm the services. Email evidence shows the manager instructed a junior employee to bypass the ordinary competitive-bid process.

The team also identifies alternative explanations. Twenty-five invoices have supporting maintenance records, and several employees state that Apex performed emergency repairs. Bank-account ownership evidence is incomplete, so the team does not initially conclude that the manager personally received funds.

Interviews and evaluation

The junior employee confirms that the manager supplied the vendor information and directed expedited approvals. The manager states that Apex was selected because of urgent repairs and denies any family connection. The manager is shown the vendor address, approval messages, and missing receiving records and is invited to explain them. The manager cannot identify the technicians or provide contracts but disputes the interpretation of the emails.

Further work obtains corporate registry records linking Apex to the relative. Bank records, obtained through an authorized process, show transfers from Apex to an account controlled by the relative shortly after Northbridge payments. The evidence supports H1 and H2 for most transactions. The 25 documented repair invoices are evaluated separately; they may involve policy violations or inflated pricing but should not automatically be classified as fictitious services.

Outcome

The final report concludes that the evidence supports intentional creation and use of a related supplier, improper bypassing of procurement controls, and payments totaling $355,000 for which no credible service evidence exists. It identifies $125,000 as legitimate or insufficiently supported for a fraud conclusion, while recommending further commercial review. The report explains the evidence, contradictory information, limitations, methodology, and basis for the classifications.

The matter is escalated to the audit committee and legal counsel. The manager is suspended in accordance with employment procedures, recovery and insurance options are assessed, relevant regulatory notifications are considered, and vendor-master controls are redesigned. The case file records the preservation steps, data sources, interviews, calculations, approvals, and remediation tracking.

Learning points

1. Immediate preservation can be necessary before full fact development.
2. Competing hypotheses prevent every unusual transaction from being labeled fraudulent.
3. Related-party evidence can support an inference of benefit but must be connected to the transactions.
4. Quantification should distinguish proven loss, unsupported amounts, and amounts requiring further review.
5. A fair report states limitations and does not overclaim intent.

12. Challenges and Limitations

Investigations operate under imperfect conditions. Records may be incomplete, systems may have changed, witnesses may disagree, and evidence may be held in another jurisdiction. Investigators may also face pressure to reach a rapid or politically convenient conclusion.

Important limitations include:

• Incomplete data: absence of a record is not always evidence that an event did not occur.
• Selection bias: testing only flagged items can miss unflagged misconduct and exaggerate the apparent rate of wrongdoing.
• Memory decay: delayed interviews may reduce accuracy.
• Access restrictions: privacy, labor, secrecy, and cross-border rules can limit collection.
• Attribution problems: a user account or device may not establish who actually acted.
• Quantification uncertainty: gross payments, recoverable loss, avoided costs, and consequential loss are different concepts.
• Confirmation bias: investigators may favor evidence supporting the initial allegation.

Reports should state these limitations clearly. A limitation does not automatically invalidate a conclusion, but it affects the strength and appropriate use of that conclusion.

Professional and Governance Implications

Effective case management is a governance activity. Boards and audit committees need assurance that allegations are assessed consistently, senior personnel cannot suppress investigations, whistleblowers are protected, and remediation is tracked. Management needs timely information without receiving unsupported accusations. Investigators need authority, independence, resources, and access to competent legal advice.

For accounting and finance professionals, employability depends not only on detecting anomalies but also on explaining them responsibly. Employers value professionals who can preserve evidence, communicate uncertainty, protect confidentiality, use data intelligently, and make recommendations that are proportionate to verified facts.

Best-Practice Checklist

Before closing a case, the lead investigator should confirm that:

• the allegation and triage decision are documented;
• conflicts and independence have been assessed;
• objectives, scope, exclusions, and changes are approved;
• preservation and access controls were implemented;
• hypotheses and alternative explanations were tested;
• evidence sources, procedures, and limitations are traceable;
• interviews were conducted fairly and recorded adequately;
• calculations reconcile to source records;
• escalation and reporting obligations were considered;
• findings distinguish facts, inferences, and opinions;
• confidentiality and retention requirements are satisfied; and
• remediation has an owner, deadline, and follow-up review.

Chapter Summary

Investigation planning and case management transform an allegation into a controlled process for establishing facts and supporting decisions. Effective practice begins with accurate allegation capture, risk-based triage, and immediate preservation where necessary. Neutral objectives, clear scope, documented exclusions, and approved changes prevent both tunnel vision and uncontrolled scope creep.

Hypothesis testing requires competing explanations, an evidence matrix, critical evaluation of reliability, and attention to contradictory information. Team members must be competent, independent, and subject to conflict checks. Confidentiality protects the process but is not an absolute barrier to lawful disclosure, and legal privilege must be assessed under applicable law.

A defensible case file documents collection, chain of custody, analysis, interviews, decisions, limitations, and escalation. Technology and AI can improve efficiency, but automated flags are leads rather than findings and require human validation. Finally, reports should distinguish facts, inferences, hypotheses, and limitations, while governance arrangements ensure fair treatment, appropriate escalation, and effective remediation.

Key Terms

Allegation: An assertion that misconduct may have occurred.

Case management: The organized planning, control, documentation, and closure of an investigation.

Chain of custody: The documented history of evidence from collection through storage, transfer, examination, and disposition.

Competing hypothesis: An alternative explanation tested against the same evidence.

Confidentiality: Restricting information to authorized persons with a legitimate need to know.

Corroboration: Independent support for a factual proposition.

Escalation: Referring a matter to a higher authority, specialist, or external body because risk or decision rights require it.

Evidence matrix: A planning tool linking issues and hypotheses to evidence sources, tests, and limitations.

Fact: Information supported sufficiently by reliable evidence for the relevant decision.

Forensic investigation: A structured examination intended to establish facts that may support organizational, civil, regulatory, or criminal decisions.

Hypothesis: A proposed explanation capable of being tested.

Independence: Freedom from interests or relationships that improperly influence professional judgment.

Inference: An interpretation reasoned from established or supported facts.

Materiality: The significance of an issue considering financial, legal, operational, reputational, and stakeholder consequences.

Preservation: Actions taken to prevent relevant information from being altered, lost, or destroyed.

Scope: The defined boundaries of an investigation.

Triage: Initial assessment of urgency, risk, jurisdiction, and appropriate response.

Terms of reference: The approved document stating investigation objectives, scope, authority, responsibilities, and reporting arrangements.

Workpaper: A documented record of an investigative procedure, source, result, conclusion, or limitation.

Review Questions

Short Answer Questions

1. Distinguish an allegation, a fact, an inference, and a hypothesis.
2. Identify five criteria that may be used when triaging an allegation.
3. Why should an investigation include an innocent or non-fraud hypothesis?
4. What information should be included in terms of reference?
5. Explain why a hash value does not prove that digital evidence is truthful.

Long Answer Questions

1. Explain how a poorly defined scope can damage an investigation and describe controls for managing scope changes.
2. Discuss the relationship between investigator independence, confidentiality, legal privilege, and procedural fairness.
3. Describe the contents and importance of a defensible investigation case file.
4. Explain how interviews should be planned and conducted to support reliable and fair findings.
5. Evaluate the benefits and risks of using data analytics and artificial intelligence in fraud investigations.

Analytical / Application Questions

1. An anonymous report alleges that a finance director approved payments to a supplier owned by a close friend. Design a triage plan, identify immediate preservation actions, and propose three competing hypotheses.
2. An analytics tool flags 400 possible duplicate invoices, but testing finds many legitimate recurring charges. Explain how you would validate the model, reduce false positives, and document the limitations.
3. During an investigation, evidence suggests that the original allegation is part of a wider scheme involving another country. Decide whether to expand or escalate the case and specify the factors that should be documented.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes an allegation from a fact?

A. An allegation is always false, while a fact is always true.

B. An allegation is an assertion requiring assessment, while a fact is supported by reliable evidence.

C. An allegation is a conclusion reached after interviews.

D. An allegation is legally privileged in every jurisdiction.

Correct Answer: B. An allegation is an assertion requiring assessment, while a fact is supported by reliable evidence.

Question 2

What is the primary purpose of formulating competing hypotheses?

A. To guarantee that the investigation finds fraud.

B. To reduce confirmation bias and test alternative explanations.

C. To avoid collecting documentary evidence.

D. To replace the need for professional judgment.

Correct Answer: B. To reduce confirmation bias and test alternative explanations.

Question 3

Which item belongs most directly in an investigation's terms of reference?

A. An assumption that the subject is guilty.

B. The investigator's preferred disciplinary outcome.

C. Objectives, scope, authority, responsibilities, and reporting arrangements.

D. A promise that no information will ever be disclosed.

Correct Answer: C. Objectives, scope, authority, responsibilities, and reporting arrangements.

Question 4

Which circumstance most clearly creates an independence concern?

A. The investigator has experience with accounting systems.

B. The investigator previously approved the transactions under examination.

C. The investigator uses an evidence register.

D. The investigator reports progress to an authorized sponsor.

Correct Answer: B. The investigator previously approved the transactions under examination.

Question 5

What does a chain-of-custody record primarily document?

A. The probability that a suspect committed the misconduct.

B. The financial materiality of an allegation.

C. The history and handling of evidence from collection onward.

D. The final disciplinary decision.

Correct Answer: C. The history and handling of evidence from collection onward.

Question 6

Which is the most appropriate interpretation of an analytics alert?

A. It is conclusive proof of fraud.

B. It is an investigative lead requiring validation.

C. It may be ignored if the amount is small.

D. It automatically establishes intent.

Correct Answer: B. It is an investigative lead requiring validation.

Question 7

Why should an investigation report discuss contradictory evidence?

A. To make the report longer regardless of relevance.

B. To demonstrate that alternative explanations were considered.

C. To prevent the subject from responding.

D. To establish legal privilege automatically.

Correct Answer: B. To demonstrate that alternative explanations were considered.

Question 8

Which situation is a strong escalation trigger?

A. A routine delay in obtaining a noncritical document.

B. A typographical error in an interview note that is corrected.

C. Evidence of continuing loss and possible destruction of records.

D. A completed workpaper with a clear source reference.

Correct Answer: C. Evidence of continuing loss and possible destruction of records.

Question 9

Which statement about confidentiality is most accurate?

A. Confidentiality permits investigators to conceal unlawful conduct.

B. Confidentiality means information can be shared with everyone in management.

C. Confidentiality restricts disclosure but may be overridden by lawful reporting duties.

D. Confidentiality and legal privilege are identical in every jurisdiction.

Correct Answer: C. Confidentiality restricts disclosure but may be overridden by lawful reporting duties.

Question 10

In the illustrative Northbridge case, why were some payments not classified as fictitious services?

A. They were below the financial-statement materiality threshold.

B. They had supporting maintenance records and required separate evaluation.

C. The procurement manager admitted responsibility for them.

D. They were made to a related supplier and therefore were automatically legitimate.

Correct Answer: B. They had supporting maintenance records and required separate evaluation.