CFE Exam Quiz 04

There are many reasons why organizations choose to conduct fraud examinations. In particular, a properly executed fraud examination can address a number of organizational objectives, including:
1. Identifying improper conduct
2. Identifying the persons responsible for improper conduct
3. Stopping fraud
4. Sending a message throughout the organization that fraud will not be tolerated
5. Determining the extent of potential liabilities or losses that might exist
6. Helping facilitate the recovery of losses
7. Stopping future losses
8. Mitigating other potential consequences
9. Strengthening internal control weaknesses

Fraud can be discovered in several ways, such as via a tip or complaint, an auditing procedure, monitoring, or chance. However, according to the ACFE 2016 Report to the Nations, approximately 39 percent of all internal investigations originate with a tip from an employee, customer, or vendor. Management review and internal audit each initiate approximately 16 percent of internal investigations, while the remainder is discovered through other means. Because tips are the most valuable resource for discovering internal fraud, companies should proactively seek them out by implementing easily accessible and anonymous (where permitted by law) fraud reporting tools, such as a tip hotline or dedicated Web page. Additionally, these reporting programs should be designed to accept tips from external sources such as customers and vendors. Not all tips are valid, and while it is important to consider the motives of individuals willing to supply information of this kind, all tips must be approached as if they will provide useful information. In many instances, the tipster provides information that is of value in commencing an internal fraud examination. In such cases, the tipster observes or becomes aware of activity that is suspicious and feels a sense of obligation to report it.

Once the evidence has been obtained and analyzed, and findings have been drawn from it, the fraud examiner must report the results to the designated individuals (e.g., management, the board, or the audit committee). A fraud examination report is a narration of the fraud examiner’s specific activities, findings, and, if appropriate, recommendations. Such communications are necessary so that those responsible can determine the appropriate course of action. The results of an examination can be communicated in various ways. The appropriate method of communication depends on the facts at issue, but most reports are communicated orally or in writing. When communicating the results of a fraud examination, the fraud examiner is responsible for providing clear, accurate, and unbiased reports reflecting the fraud examination results. This need arises from the possibility that such results might end up being read or used by various groups of people, such as organization insiders, attorneys, defendants, plaintiffs, witnesses, juries, judges, and the media.

Although fraud examination shares certain characteristics with forensic accounting, they are not the same discipline. Forensic accounting is the use of professional accounting skills in matters involving potential or actual civil or criminal litigation. The word forensic is defined by Black’s Law Dictionary as “used in or suitable to courts of law or public debate.” Therefore, forensic accounting is actually litigation support involving accounting. Accordingly, many fraud examinations can be considered forensic accounting, but not all forensic accounting is a fraud examination. For example, an individual hired to appraise property in a minority shareholder derivative suit would engage in forensic accounting even if the engagement does not involve fraud. While fraud examinations can be conducted by either accountants or non-accountants, forensic accounting work can only be performed by accountants. In addition, while forensic accounting is litigation support work that involves accounting, fraud examinations only involve anti-fraud matters.

Fraud examination is a methodology of resolving signs or allegations of fraud from inception to disposition. The fraud examination methodology establishes a uniform, legal process for resolving signs or allegations of fraud on a timely basis. It provides that fraud examinations should move in a linear order, from the general to the specific, gradually focusing on the perpetrator through an analysis of evidence. Fraud examinations involve efforts to resolve allegations or signs of fraud when the full facts are unknown or unclear; therefore, fraud examinations seek to obtain facts and evidence to help establish what happened, identify the responsible party, and provide recommendations where applicable. When conducting a fraud examination, the fraud examiner should assume litigation will follow, act on predication, approach cases from two perspectives, move from the general to the specific, and use the fraud theory approach.

Fraud examinations must adhere to the law; therefore, fraud examiners should not conduct or continue fraud examinations without proper predication. Predication is the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe that a fraud has occurred is occurring, or will occur. In other words, predication is the basis upon which an examination, and each step taken during the examination, is commenced. A fraud examiner acts on predication when there are a sufficient basis and legitimate reason to take each step in an examination. Accordingly, fraud examiners should begin a fraud examination only when there are circumstances that suggest fraud has occurred, is occurring, or will occur, and they should not investigate beyond the available prediction. If fraud examiners cannot articulate a factual basis or good reason for an investigative step, they should not do it. Therefore, fraud examiners should reevaluate the predication as the fraud examination proceeds. That is, as a fraud examination progresses and new information emerges, fraud examiners should continually reevaluate whether there is adequate prediction to take each additional step in the examination. If fraud examiners act without predication, they might expose themselves and their clients or employers to liability.

Fraud examinations commence when the full facts are unknown or unclear; therefore, they should proceed from the general to the specific. That is, fraud examinations should begin with general information that is known, starting at the periphery, and then move to the more specific details. For example, consider the order of interviews in fraud examinations. In most examinations, fraud examiners should start interviewing at the periphery of all possible interview candidates and move toward the witnesses who appear more involved in the matters that are the subject of the examination. Thus, the usual order of interviews is as follows:
1. Neutral third-party witnesses, starting with the least knowledgeable and moving to those who are more knowledgeable about the matters at issue.
2. Parties suspected of complicity, starting with the least culpable and moving to the most culpable.
3. The primary suspect(s) of the examination.

Once Bridges has created a hypothesis, he should test it through the acquisition of new information or by correcting and integrating known information.Testing a hypothesis involves creating a what-if scenario. For example, in the facts of the Linda Reed Collins case study, Bridges hypothesizes that, based on the anonymous tip, a vendor is bribing a purchasing agent. He would test this hypothesis by looking for some or all of the following facts:
1. A vendor is receiving an unusually large amount of business.
2. Purchases of high-priced, low-quality goods or services over an extended period.
3. A purchasing agent has a personal relationship with a vendor.
4. A purchasing agent with the ability to steer business toward a favored vendor.
5. A purchasing agent’s lifestyle suggests unexplained wealth or outside income.

Note that, Fraud examinations commence when the full facts are unknown or unclear; therefore, they should proceed from the general to the specific. That is, fraud examinations should begin with general information that is known, starting at the periphery, and then move to the more specific details.
For example, consider the order of interviews in fraud examinations. In most examinations, fraud examiners should start interviewing at the periphery of all possible interview candidates and move toward the witnesses who appear more involved in the matters that are the subject of the examination. Thus, the usual order of interviews is as follows:
1. Neutral third-party witnesses, starting with the least knowledgeable and moving to those who are more knowledgeable about the matters at issue
2. Parties suspected of complicity, starting with the least culpable and moving to the most culpable.
3. The primary suspect(s) of the examination.

Note that Management should also develop a fraud incident report log of all suspicions of fraud, including those not investigated, to serve as a record of the organization’s response efforts. Once a suspicion of fraud arises, the issue should be recorded and detailed in the log, and as the issue progresses, the log should be modified. Ultimately, it should contain details of actions taken and conclusions reached. The report log should include information on the following items:
1. How the organization became aware of the suspected fraud, including the name of any complaining party
2. The date the issue was raised or reported
3. The nature of the suspected fraud
4. Department or divisions involved
5. Suspect employees or parties
6. Actions are taken

Note that, There are many different types of forensic document examinations. However, most examinations concern signatures, handwriting, hand printing, or documents created by a typewriter or word processor. Additionally, issues concerning photocopies and determining when a document was prepared frequently arise. Fraud examiners should be aware that many different types of forensic examinations are possible, but that the following forensic
examinations could be of particular value when fraud involves documents:
1. Detecting forged signatures
2. Identifying the writers of signatures, handwriting, and hand printing
3. Detecting altered documents
4. Detecting and restoring erasures and eradications
5. Determining when a document was or was not prepared
6. Detecting counterfeited documents and examining printed documents
7. Detecting and restoring faint indented writings
8.Comparing paper and inks
9. Determining whether two sheets of paper came from the same tablet or pad of paper
10. Examining paper folds and sequence of folds
11. Comparing torn or cut paper edges
12. Restoring charred and partially burned documents
13. Identifying the machine that made a photocopy and whether two copies were made on the same machine
14. Examining facsimile (fax) copies
15. Identifying the source of, or alterations to, notary seals, wax seals, and cachets

Note that, A document can be a piece of physical evidence and not just a source of information. As a piece of evidence, it should be handled carefully and stored properly in a sealed, initialed, and dated paper folder or envelope to avoid damage or contamination. If necessary, make a working copy and preserve the original document for submission to a forensic document examiner. Most forensic examinations require the original document, not a copy of it because most photocopies do not reproduce original writings, typescript, or other features with sufficient clarity or detail to allow adequate examination. All evidence received should be marked so that it can later be identified. The most common way to mark evidence is with the date and initials of the person obtaining it. If it is not practical to mark the document, or if marking it would damage the document, then it should be placed in an acid-free envelope that has been marked and sealed. To avoid creating indentations on the original document, do not write on the envelope after the document has been placed inside of it. When initiating a document for future identification, do it in a noncritical area and use an instrument that is different from the one used on the document. Other than making unobtrusive initials for identification, do not write or mark on original documents. Do not fold, staple, use paper clips, crumple, or do anything else that would change an item’s original condition. Store photocopies and laser-printed documents in paper folders or envelopes, not transparent plastic envelopes; such envelopes can result in the copies sticking to the plastic and destroying some document features.

From the moment evidence is received, its chain of custody must be maintained for it to be accepted by the court. The chain of custody is both a process and a document that memorializes who has had possession of an object and what they have done with it. Essentially, the chain of custody is a recordkeeping procedure similar to physical inventory procedures. Investigation Analyzing Documents Establishing the chain of custody for a document establishes authenticity is in fact what the party offering the document says it is), but it also ensures that evidence has not been altered or changed from the time it was collected through production in court. In general, to establish the chain of custody, fraud examiners must make a record of when
they receive an item or when it leaves their care, custody, or control. This is best handled by a memorandum with the custodian of the records when the evidence is received. The memorandum should state:
1. What items were received
2. When they were received
3. From whom they were received
4. Where they are maintained
If the item is later turned over to someone else, a record of this should be made—preferably in memorandum form. All evidence received should be uniquely marked so that it can be identified later. The preferable way is to initial and date the item; however, this can pose problems in the case of original business records furnished voluntarily. For such records, a small checkmark or another nondescript identifier can be used. If it is not practical to mark the original document, it should be placed in a sealed envelope, which should then be initialed and dated.

Charred or partially burned documents might contain valuable evidence if restored by experts, but they are very fragile and should be handled with extreme care. For proper preservation and storage, trained experts might use special polyester film sheets and envelopes, which are not readily available to fraud examiners. Fraud examiners can best preserve such evidence for submission to a forensic expert by using a sturdy crush-proof Charred or partially burned documents might contain valuable evidence if restored by experts, but they are very fragile and should be handled with extreme care. For proper preservation and storage, trained experts might use special polyester film sheets and envelopes, which are not readily available to fraud examiners. Fraud examiners can best preserve such evidence for submission to a forensic expert by using a sturdy crush-proof container into which they place layers of cotton (available in rolls at fabric and sewing materials shops). They should carefully slide a sheet of paper or thin cardboard under the burned fragments, lift them and place them on the layers of cotton, and then remove the paper used for lifting. Then, they should gently place additional layers of cotton over the fragments until the container is filled, taking care not to compress the cotton. Fraud examiners should then seal the container, initial and date it, add an identifying contents label or exhibit number, and clearly write or stamp the word fragile on the container.

Note that, A simulated or traced forgery is writing, usually a signature, prepared by carefully copying or tracing a model example of another person’s writings. Although identifiable as a forgery, a simulated or traced signature forgery often does not contain enough of the forger’s normal handwriting characteristics to permit expert identification. Remember, no one writes their signature exactly the same way twice. If two signatures look exactly alike, try superimposing the signature areas of the two documents by holding them in front of bright light. If they match, then it is likely that one or both are traced forgeries. Be aware that, in some instances, it might be possible to locate the original document bearing the genuine signature that was traced. This regularly occurs in employee fraud and embezzlement cases in banks and other financial institutions where the account holder’s signature card on file served as the source for the tracing. If the forged signature precisely superimposes over the genuine signature, then it is also likely that faint indentations might be present in the signature area of the original genuine document. Also, ink traces from the genuine signature might be transferred to the reverse side of the traced signature. Latent fingerprint treatment of the original source document might reveal the fingerprints of the suspect.

Note that, Non-dictated writing samples include materials that are written by the individual during the everyday course of business. This type of writing tends to reveal the individual’s normal writing habits. For comparison purposes, try to obtain samples of a suspect or victim’s signature or other writings that were not prepared by that person but can be authenticated. Courts will accept any writings that were witnessed by others. Other acceptable documents include those that were created “in the normal course of business,” such as canceled checks; signed or written documents in employee personnel records; applications for employment, licenses, or home utility installations; and many others. The fraud examiner should use personal experiences and knowledge of the suspect’s routine activities to locate sources for these types of samples. When the evidence documents include suspected forged signatures, several genuine samples of the forgery victim’s signature should be obtained for submission to the expert. If possible, include any documents bearing the victim’s genuine signature that the suspect might have had access to and that might have served as a model for tracing or simulation. Non-dictated writing samples should:
1. Be as contemporaneous as possible to the date of the evidence documents; if the questioned writings were prepared in the 1970s, writings recently prepared by a suspect might not be adequate for comparisons. However, except for infirmity or extreme age, the writings of most adults usually do not change much except over long periods of time. Investigation 3.214 2017 Fraud Examiners Manual (International)
2. Consist of the same signature or words containing many of the same letters and combinations of letters as the questioned writings on the evidence documents.
3. Consist of the same type of writings as on the evidence documents, such as hand-printed or handwritten capital letters or lowercase, or a combination of both.
4. Consist, if possible, of the same kinds of writings; a person’s informal writings, such as hastily prepared signatures on credit card receipts, might be very different from more formal writings, such as a signature on a contract or other legal document.

Note that, Because expert handwriting identifications can truly prove the case, adequate pre-interview preparation by the fraud examiner is essential. At the time of the interview session, the fraud examiner should have all of the proper writing materials and should have the original or copies of the evidence documents to serve as a guide for dictating the sample text. Here are a few tips for conducting this type of interview:
1. Do not rush through the interview.
2. Take as much time as necessary.
3. Take short comfort breaks if the suspect tires.
4. Do not allow the suspect to see the evidence documents before or during the process of taking the samples.

Note that, Relative to typewritten documents, the specific sources of documents made by computerized ink jet or laser printers are far more difficult to identify. In some cases, the only expert determinations concerning items made from these printers are that the same typeface design and size (font), letter spacing, and print process were used. Many brands of laser printers do print small yellow dots on all documents that reveal the printer’s serial number and the time and date that the document was printed. These marks can be seen under a microscope or by holding the document under a blue light, which causes the yellow dots to appear black. However, only some law enforcement agencies, such as the U.S. Secret Service, have the ability to fully decode these marks, which are largely used to detect counterfeit currency. In some instances, experts might be able to identify the product used to print a document. Product identification might be possible because some color printers embed their identification numbers in some printouts. Similarly, some printers can be identified by minor variants in the way they feed paper through the printing mechanisms.

Note that, Photocopies are admissible as original evidence for:
1. Anonymous letters
2. Unauthorized disclosure of information in the form of copies of letters, memoranda, files, and other records
3. Copies made to conceal forgeries or to insert or manipulate text
4. Spurious disinformation dissemination of counterfeit official documents
Locating the source of a copy can be crucial in some investigations. And in some cases, it is possible to determine what kind of copier was used to produce the copy in question. Some types of machines leave minute markings, indentations, and other features on the copy that can assist the expert in determining the brand and model of the machine used. It is also possible to identify the particular machine used by examining the pattern of unique
and identifiable “trash marks.” Trash marks are uniquely identifiable markings on copies (e.g., specks, spots, streaks, or edge markings). Fraud examiners can identify a particular machine by examining the trash marks left on copies and comparing the marks with copies from a known machine. The fraud examiner should be aware, however, that some of these markings are permanent, while others are transient and temporary.

Note that, There are four steps that fraud examiners should follow when taking photocopier samples. First, make six “blank” copies by leaving the glass document surface empty and closing the lid. As the machine produces each copy, remove it, turn it over, and initial and number the reverse side of each one in the same sequence it was produced by the machine. These copies will reproduce all trash marks made by the machine, including the entire document cover, glass surface, and internal printing element surface. The fraud examiner should obtain six sample copies because different photocopier models have varying printing element surface sizes, usually ranging in size from one to three sheet impressions before repeating on the same area of the surface). Second, place a ruler or other calibrated measuring device on the glass document surface of the photocopier, close the cover, and make six copies. (These copies allow an expert to determine the standard amount of reduction or enlargement the machine makes when in the actual size or one-to-one mode.) If the machine requires documents to be fed into it (because it does not have a glass document surface), use any sample document available as an original and include that sample document along with the copies of it. On the reverse side of each copy, initial and number it in the same sequence that the copies were produced by the machine, as outlined in the first step. Third, place a sample document containing both typewritten and handwritten text on the glass document surface in the standard position, close the document cover, and again print six copies, initialing and numbering as previously directed. Also, include the sample document with the copy samples. Finally, place all of the sample copies and sample documents into a large sturdy paper or cardboard envelope or folder (do not use a plastic envelope). But before placing the documents in the envelope, note the make, model, and location of the machine. Initial, date, and seal the envelope, and submit it to the document examiner along with the questioned evidence documents.

Note that Expert examinations of contemporary documentary materials include the following methods:
1. To determine the kind of ink and when the ink was first manufactured, experts conduct ink analyses and comparisons with a library of ink standards maintained by the U.S. Secret Service Laboratory in Washington, DC.
2. To determine the kind of typewriter that was used and when the typewriter was first manufactured, experts examine the typewriting and compare the typewriting with collections of typewriter reference standards maintained by forensic laboratories.
3. To determine who manufactured the paper and when it was first produced, experts examine the paper, especially watermarked paper, and conduct searches of reference materials.
4. To determine what kind of machine was used and when those machines were first produced, experts examine photocopies and fax copies and compare them to the reference standards.
5. To prove or disprove the date of the questioned copy, experts compare the questioned photocopies with photocopies known to have been produced on a particular machine on a particular date.

Fraud examiners should never attempt to develop indented writings by shading or scratching on the surface of a sheet of paper with a pencil. Although this method will reveal deep indentations, it will not reveal faint indentations and will prevent expert examinations from analyzing them. Moreover, shading or scratching with a pencil might prevent other types of technical examinations. Likewise, fraud examiners should not apply any sort of liquid to an original document with indented writings, as doing so can damage the document’s ability to be analyzed. Some indented writings can be seen by employing an oblique-lighting method. In this method, the fraud examiner takes the document into an area with subdued overhead lighting, places the document on a flat surface, and shines a bright beam of light—from a small-beam flashlight or small high-intensity lamp—across the document at a low oblique angle or parallel to the surface. Because shadows in the indentations will only show at right angles to the beam of light, it is necessary to move the light around and note the changing shadows as they form the text of the indentations.

Note that, Many types of documents are counterfeited. Most documents that have monetary value, such as currency, bank checks, traveler’s checks, money orders, bearer bonds, postage stamps, gift certificates, or lottery tickets, have all been counterfeited at one time or another. Identity documents (e.g., passports, birth certificates, driver’s licenses, and government and commercial employee identity cards) are also often counterfeited. Other counterfeited documents include commercial product labels, business stationery and forms, business logos, motor vehicle titles and registration forms, and safety inspection stickers. Despite most efforts to prevent counterfeiting, almost every type of document with value can be, and probably has been, counterfeited. Counterfeiting has become big business, especially in some developing countries, where they use the latest high-tech printers to produce large quantities of high-quality counterfeit documents and “knock-off” products in violation of international copyright and trademark laws.

Note that, Many counterfeits can be detected by making a side-by-side comparison with a corresponding genuine document. But when conducting a side-by-side comparison, fraud examiners must be alert for different versions or form revisions. Look for subtle differences in ink colors and brilliance, different types of the paper substrate, different typestyles and type sizes (fonts), and evidence that the text on the genuine document was retouched for the reproduction. The retouching will be most evident in areas where text, serial numbers, and the like are superimposed on a background design, especially if the documents are printed in black ink. When furnished with genuine documents for comparisons with suspected counterfeits, forensic document examiners can also identify differences between the printing processes, ink formulations, and paper substrates used. In some instances, experts have been able to reconstruct portions of the filled-in text or serial numbers that appeared on the genuine document but were removed in the retouching process. If the experts can reconstruct portions of the genuine document’s text, they might be able to identify the original document. And if the original document is identified, fraud examiners can trace the history of the document’s owner to identify and locate the counterfeiter. Moreover, if the original document is identified, it might be possible to identify the counterfeiter by obtaining fingerprints from the document.

To effectively prepare for the interview phase of an investigation, the fraud examiner must first develop a plan. The fraud examiner should contemplate what the interview is intended to accomplish and state an objective. He should also review the case file to ensure that it does not contain important information that has been overlooked. Prior to the commencement of an interview, there should be a clear concept of what information might be gleaned from each of the potential witnesses, as well as the best strategy to go about obtaining it. Generally, the most vulnerable witnesses should be interviewed before the more reluctant witnesses. This will provide the fraud examiner with a broader base of information that can be used to formulate later questions. When possible, the interview should be held in a venue where the subject will feel comfortable and secure, although it is not recommended that the interview take place in a particularly familiar environment such as the interviewee’s home or office. The most appropriate member of the investigative team should be selected to conduct the interview based on the specifics of the interview. Rather than devise an exhaustive list of questions to ask the subject, the fraud examiner should instead formulate a brief outline of key points to discuss during the interview. Additionally, an investigator should consider which evidentiary documents to bring into the interview, if any, as well as which documents he might seek from the subject.

All effective interviewers share certain characteristics. Above all, they are amiable and possess strong interpersonal skills. Successful interviewers are the type of people with whom others are willing to share information. The effective interviewer does not interrupt the respondent with unnecessary questions. In most interviews, pertinent information results from volunteered information, as opposed to responses to a specific question. The effective interviewer displays interest in his subject and in what is being said. Additionally, effective interviewers demonstrate fairness. The respondent must understand that the interviewer is attempting to obtain only the relevant facts and is not targeting him unfairly. This can best be done by phrasing questions in a non-accusatory manner. Also, effective interviewers work informally. Little is accomplished when the interviewer is formal, ostentatious, or attempts to impress the respondent with his authority. Information gathering is best accomplished by approaching the interview in an informal and low-key fashion. Moreover, an interviewer should lack bias. If the respondent perceives that the interviewer is biased or is attempting to confirm foregone conclusions, the respondent will be less likely to cooperate. Accordingly, the interviewer should make every effort to demonstrate impartiality.

Note that, One of the important forces in social interaction is the tendency of one person to communicate, verbally or nonverbally, his expectations to the other person. The second person then tends to respond, consciously or unconsciously, to those expectations. This might be viewed as one manifestation of the more general human tendency to conform to the group and to the anticipations of higher-status people. It is in this conformity to group norms that security is sought. In the interview setting, the interviewer communicates expectations to the respondent. The interviewer should be able to transmit both a general expectation of cooperation and a more specific expectation that the respondent will answer the questions truthfully. The interviewer must clearly distinguish between asking for information and expecting it. The former is mainly achieved with verbal communication, while the latter is accomplished through nonverbal behavior. The interviewer who expects the respondent to cooperate will likely be more successful than one who only asks questions.

In recent years, the kinesic interview or interrogation has become more popular among those in the law enforcement community. The methods used in kinesic interviews are different than those used in traditional interviews. In kinesic interviews, the interviewer is not necessarily looking for a confession from the subject. Instead, the interviewer is attempting to assess whether the subject is telling the truth by reading his body language and
other physical manifestations of deception. In the book The Kinesic Interview Technique, authors Frederick C. Link and D. Glenn Foster define the kinesic interview technique as: [An interview technique] used for gaining information from an individual who is not willingly or intentionally disclosing it. Link and Foster believe that the kinesic interview is based entirely on the concept of stress— an event or circumstance that forces an individual’s mind or body out of psychological equilibrium. When stress occurs, humans, like any other living creature, have an emotional reaction. Link and Foster refer to this as the “fight or flight syndrome,” in which we either run from a stressful situation or brace to face it. Either way, they hypothesize, our animalistic tendencies dictate that we must react to stress. When this concept is applied to the interview situation, the kinesic interview technique is applied to attempt to read the interview subject’s reaction to stress. The kinesic method relies, in a broad sense, on the interviewer’s ability to observe the subject for signs or symptoms of deceit. The kinesic interview is conducted not just to observe what the subject says, but also how the subject says it; the subject’s gestures, posturing, facial expressions, and voice inflection are just a few of the traits that an investigator looks at. This style of interviewing assumes that when most human beings lie or are deceitful to others, they will reveal this deceit through their body language. An individual’s reactions to stress are generally subconscious; in most cases, the interviewee does not even realize that he is acting noticeably different. The actions or signs that an interviewer is looking for are called meaningful behavior—activities that might suggest that an interviewee is under stress.

Note that, Link and Foster identify three distinct categories into which meaningful behavior can be divided:
1. Self-initiated verbal statements that the interviewee initiates without prompting
2. Prompted verbal responses or statements made by the interviewee in response to structured questions asked by the interviewer
3. Nonverbal behavior or body language, which includes body positioning movements, lack of movement, and observable physiological changes

The following factors should be considered when applying kinesic techniques:
1. No single behavior, by itself, proves anything.
2. Behaviors must be relatively consistent when the stimuli are repeated.
3. The interviewer must establish what is normal or baseline behavior for each subject and then look for changes from the baseline. These observed changes in the subject’s baseline behavior are diagnosed in clusters, not individually.
4. Behaviors must be timely.
5. Observing and interpreting behavior is hard work.
6. The subjects will watch interviewers while the interviewers watch them.
7. Kinesic interviewing is not as reliable with some groups.