- What the 17 Topics Actually Represent
- Foundations: Investigative Basics, Ethics, Case Management, Documentation
- Crime-Specific Content: Eight Subject Areas
- People and Source Skills: Informants and Interviews
- Forensics, Legal Fundamentals, and Agency Partnerships
- How the Exam Is Delivered and Scored
- Sequencing the Domains in Your Preparation
- Exam-Only Versus Bundled Access
- Frequently Asked Questions
- The 17 areas listed here are preparation-curriculum topics from McAfee Institute's CPCI page, not an official weighted exam blueprint.
- The exam-only page advertises 23 exam domains, but the complete named list was not retrieved, so no weights are assumed.
- The final exam is three hours, requires 70% or better, and is delivered online by the Institute's examination system.
- Exam-only access costs $450; training plus exam costs $750 and includes 28 advertised modules and 100 instructional hours.
What the 17 Topics Actually Represent
If you are searching for the Certified Professional Criminal Investigator (CPCI) exam domains, you need one clarification before anything else: the 17 content areas in this guide are the topics McAfee Institute publishes in the curriculum summary of its CPCI product page. They are listed in a published sequence, but they are unweighted. They are not 17 official exam domains, they are not the 28 advertised course modules, and they are not an exhaustive exam blueprint.
That honesty is useful. A candidate who knows the list is a curriculum outline rather than a scoring blueprint will study broadly instead of gambling on a few high-weight areas. For a broader study framework built around this list, see our CPCI study guide, and for the wider picture of the credential itself, what CPCI certification is covers the basics.
The 17 areas fall naturally into four clusters, which is how this guide organizes them:
- Foundations: investigative foundations, ethics, case management, documentation
- Crime-specific content: core crime categories, cyber investigations, workplace violence, organized retail crime, homicide, death investigations, human trafficking, corruption
- People and sources: informant development, investigative interviews
- Technical, legal, and institutional: computer and mobile forensics, legal fundamentals, law-enforcement partnerships
Foundations: Investigative Basics, Ethics, Case Management, Documentation
The first four topics in the published sequence are not glamorous, but they are the connective tissue for everything else. A homicide scenario and an organized retail crime scenario both ask the same underlying questions: how did you open the file, what rules constrained you, how did you track the work, and could another person reconstruct what you did?
Domain 1: Investigative foundations
This area establishes what an investigation is, what it is for, and how an investigator thinks. Expect the exam to test reasoning about objectives and approach rather than trivia.
- The purpose and general structure of an investigation, from the initial report through resolution
- Distinguishing facts, inferences, and assumptions in a developing case
- Identifying sources of information and deciding which to pursue first
- Recognizing the difference between investigating in a public-sector and a private or corporate setting
Domain 2: Ethics
Ethics sits second in the sequence, and it is worth treating as a thread rather than a standalone chapter. Scenario questions in this credential family commonly embed an ethical wrinkle inside a procedural question.
- Objectivity: following evidence rather than a preferred theory
- Confidentiality of case information and sources
- Conflicts of interest and when to disclose or step away
- Honest reporting, including documenting facts that weaken your own case
Domain 3: Case management
Case management is about running work, not just doing it. It covers how an investigator organizes leads, priorities, deadlines, and resources across a file.
- Opening, prioritizing, and tracking leads and tasks
- Maintaining a case timeline and an investigative plan that evolves with new information
- Deciding when to escalate, refer, or close
- Coordinating multiple investigators on a single matter
Domain 4: Documentation
Documentation is where careful investigators separate themselves from careless ones. Reports, notes, and logs are the product of the work and the foundation of any later proceeding.
- Contemporaneous note-taking and what makes notes reliable
- Report structure: clear, factual, chronological, free of speculation
- Evidence handling records and chain-of-custody discipline
- Why the report must stand on its own for a reader who was not there
Crime-Specific Content: Eight Subject Areas
The middle of the published sequence moves into subject matter. Eight of the 17 topics are tied to particular categories of offense or investigation. Rather than memorizing statutes for any one jurisdiction, concentrate on the investigative problem each category poses: what makes it hard, what evidence it generates, and who else is usually involved.
Core crime categories and cyber investigations (Domains 5 and 6)
Core crime categories is the broad survey area, covering the common offense types an investigator encounters and the elements and evidence associated with them. Cyber investigations extends that survey into digital settings, where the offense, the evidence, and the offender may all be remote or anonymous.
- For core categories, know how to identify the elements that must be shown and which evidence supports each element
- For cyber matters, focus on digital evidence sources, preservation urgency, and how online activity is tied to a real person
- Understand how a traditional offense can have a cyber component, such as fraud, harassment, or threats conducted online
Workplace violence and organized retail crime (Domains 7 and 8)
These two topics highlight a feature of the credential that distinguishes it from purely sworn-officer material: they sit squarely in corporate and private-sector investigation. Workplace violence involves recognizing warning behavior, assessing threats, and coordinating responses among security, HR, management, and law enforcement. Organized retail crime involves coordinated theft and fencing operations that cross stores, jurisdictions, and sometimes state lines.
- Workplace violence: threat assessment, escalation indicators, documentation of concerning behavior, and handoffs to police
- Organized retail crime: distinguishing organized rings from opportunistic shoplifting, building case packages, and working with retail partners and law enforcement
Homicide and death investigations (Domains 9 and 10)
Homicide and death investigations are listed separately, and that separation is instructive. A death investigation begins with a question that may not have a criminal answer: was this natural, accidental, suicide, or homicide? Homicide work assumes a criminal act and focuses on scene management, victimology, witness canvassing, forensic coordination, and suspect development.
- Scene control and preservation of evidence before anything is moved
- Establishing the manner and circumstances of death versus proving criminal responsibility
- The role of medical and forensic professionals and how investigators work alongside them
- Victimology: understanding who the victim was and how that drives lead development
Human trafficking and corruption (Domains 11 and 12)
Both of these areas involve crimes that are often hidden, long-running, and dependent on cooperation from reluctant participants. Human trafficking investigations require recognizing indicators, understanding victim dynamics, and building cases that do not rely solely on a frightened victim's testimony. Corruption investigations center on abuse of position, following money and communications, and navigating the sensitivity of investigating insiders.
- Trafficking: recognizing indicators, victim-centered approaches, financial and communications evidence, and referral pathways
- Corruption: identifying the quid pro quo, tracing benefits, protecting the integrity of the inquiry, and managing conflicts of interest
Key Takeaway
Do not study the eight crime-specific areas as eight separate piles of facts. Ask the same four questions of each: what evidence does it generate, who is the typical witness or source, which other agencies are likely involved, and what ethical or legal trap is hiding in the scenario?
People and Source Skills: Informants and Interviews
Two topics in the sequence concern people rather than offenses: informant development and investigative interviews. They are learnable, scenario-friendly skills, and they tend to reward candidates who think carefully about process.
Domain 13: Informant development
This area addresses how investigators identify, recruit, manage, and protect human sources, and how to keep those relationships from compromising the case or the investigator.
- Assessing source reliability, motivation, and access
- Boundaries, documentation, and control of the relationship
- Protecting source identity and managing risk to the source
- Corroboration: never resting a case on uncorroborated source information
Domain 14: Investigative interviews
Interviewing is among the most testable skills because it lends itself to scenario questions about sequence, approach, and legality.
- Planning an interview: objectives, background, location, and order of questions
- Building rapport and using open-ended questions before narrowing
- Differences between interviewing witnesses, victims, and suspects
- Recognizing the legal and ethical limits on how information may be obtained
- Recording and documenting the interview accurately
Interviews are where the legal and ethical foundations show up most visibly. A question about how to handle a reluctant witness may really be testing whether you understand voluntariness, rights, and the reliability of statements. Review this area alongside legal fundamentals rather than in isolation.
Forensics, Legal Fundamentals, and Agency Partnerships
The final three topics in the published sequence round out the credential with technical, legal, and institutional knowledge.
Domain 15: Computer and mobile forensics
This area covers how digital evidence is identified, preserved, and examined. It complements the cyber investigations topic but is more about evidence handling than offense types.
- Preserving devices and data without altering them
- Understanding what kinds of information computers and phones can hold
- Why proper handling and documentation determine whether digital evidence is usable
- When to involve specialized forensic examiners instead of attempting a review yourself
Domain 16: Legal fundamentals
Legal fundamentals gives the investigator the framework within which everything else operates. The exam will favor general principles over jurisdiction-specific rules, since the credential serves candidates from varied settings.
- Lawful collection of evidence and the consequences of getting it wrong
- Rights and protections that affect searches, statements, and detention
- The difference between criminal and civil contexts and between public and private investigators' authority
- Testifying and presenting findings credibly
Domain 17: Law-enforcement partnerships
The final topic recognizes that few significant cases are solved alone. Investigators, particularly those in the private sector, must know how and when to bring in police and prosecutors.
- Deciding when a matter should be referred to law enforcement
- Packaging findings so another agency can act on them
- Maintaining professional boundaries and information-sharing discipline
- Cooperating without compromising your own organization's obligations
One note on audience: the Institute's own page is internally inconsistent about whether private and corporate investigators are in or out of scope, so do not assume the credential requires sworn status. Our CPCI requirements guide explains the actual eligibility paths.
How the Exam Is Delivered and Scored
Knowing the domain list is only half the picture. The mechanics of the sitting matter too.
| Item | What is verified |
|---|---|
| Exam length | Three hours (training hours are separate and are not exam hours) |
| Passing score | 70% or better on the final examination |
| Delivery | McAfee Institute's online examination system with proctoring; the Institute's general materials mention both AI-powered proctoring and ProctorU, so confirm the booking instructions rather than assuming one vendor |
| Question style | General Institute guidance describes multiple-choice, true/false, and scenario questions in a closed-book online format |
| Exact question count | Not verified for CPCI; general Institute figures should not be treated as a CPCI specification |
The unverified question count is worth sitting with. Because the exact total and the scored/unscored split are not confirmed, avoid any preparation plan that depends on a specific number of questions or a per-question time budget derived from one. Instead, practice reading scenarios carefully and managing time across a three-hour window. For more on the score threshold, read our explanation of the CPCI passing score, and for a view on difficulty see how hard the CPCI exam is.
Sequencing the Domains in Your Preparation
Generic study advice is plentiful. The only planning question specific to this credential is the order in which to take on the 17 topics. A sensible approach is to front-load the areas that every other topic depends on, then move through the crime-specific material, and finish with integration practice.
Foundations first
- Investigative foundations, ethics, case management, and documentation
- Reason: these four underlie every scenario and act as tiebreakers between plausible answers
Crime-specific and people skills
- Core crime categories, workplace violence, organized retail crime, homicide, death investigations, human trafficking, corruption
- Informant development and investigative interviews, paired with legal fundamentals
Technical and institutional topics
- Cyber investigations, computer and mobile forensics, law-enforcement partnerships
- Reason: these draw on everything earlier, especially documentation and legal fundamentals
Integration
- Timed, mixed scenario practice across all 17 areas
- Review weak topics rather than re-reading strong ones
The eight-week span is a suggestion, not a requirement, and you should compress or stretch it to fit your experience. A candidate with years of homicide work can move quickly through that area and spend extra time on cyber and trafficking; a corporate investigator may do the opposite. Our CPCI cheat sheet is a handy final-week review once you have worked through the material.
Exam-Only Versus Bundled Access
The domain list is derived from the Institute's preparation curriculum, so it helps to understand the two ways to access the credential, because they differ in how much of that curriculum you receive.
| Feature | Exam-only license | Training plus exam |
|---|---|---|
| Price | $450 | $750 |
| Exam attempt | One attempt, proctored | Included |
| Exam license term | One year | One year |
| Official training | Not included | Lifetime course access, 28 advertised modules, 100 instructional hours |
| Study manual and quizzes | Excluded per the inclusions panel | Official materials included |
| Advertised CPE credits | None | 100 advertised completion credits |
Two cautions. First, some generic or sticky-page copy on the Institute's site appears to contradict the exam-only inclusions panel; rely on the explicit panel, which excludes training, the manual, and review quizzes. Second, the 100 advertised completion CPE credits are not an independently verified allocation toward a later renewal cycle, so do not budget on them. Exam-only availability also does not mean the 100-hour course is mandatory. For the full financial picture, including retakes, see our CPCI certification cost breakdown, and for the longer-term question, whether the certification is worth it.
A related point: a lifetime learning access period and a one-year exam license do not translate to a lifetime credential. Renewal information on the Institute's own pages is not fully reconciled, so verify current renewal terms before relying on any figure. The Institute also states plainly that certification does not guarantee employment or acceptance by third parties.
If you want to test your grasp of all 17 areas under realistic conditions, our CPCI practice test lets you work through scenario-style questions across the full range of topics.
Frequently Asked Questions
No. They are the topics in the order McAfee Institute publishes in its CPCI curriculum summary. They are unweighted and are not an official exam blueprint. The exam-only page advertises 23 exam domains, but the full list was not retrieved, so no weights or additional headings are assumed.
The final exam runs three hours, and you need 70% or better to pass. The bundled program also requires at least 70% on course quizzes and sections, along with completion of applicable training and assignments. The exact question total has not been verified.
No. An exam-only license is available for $450 with one proctored attempt and a one-year license. It excludes the official training, study manual, and review quizzes. The $750 bundle adds those materials, 28 advertised modules, and 100 instructional hours.
Start with investigative foundations, ethics, case management, documentation, and legal fundamentals, since they apply across scenarios. Because no official weights are published, avoid skipping any area entirely, and use practice questions to find your weakest topics.
No. The Institute states that certification does not guarantee employment or third-party acceptance, and no reliable CPCI-specific salary figure has been verified. For a careful discussion, see our CPCI salary guide and CPCI jobs overview.