ASIS PCI cheat sheet

Case management is the coordinated planning, tracking, and documentation of an investigation from intake through disposition.

A case file should record intake date, complainant, allegation, assigned investigator, and current status as core identifiers.

Chain-of-custody entries require the item identifier, date and time of transfer, releasing party, receiving party, and purpose.

Statute of limitations deadlines are calculated from the date of the offense or discovery, depending on jurisdiction; record the source rule.

Case priority is typically ranked by severity, risk of loss or escalation, and evidentiary perishability rather than by arrival order.

A case closure memo states the disposition (substantiated, unsubstantiated, exonerated, unfounded) and the basis for that finding.

Confidentiality classification (e.g., public, internal, restricted) governs who may access the case file and must be logged on access.

Periodic case review intervals should be defined in policy; overdue reviews are a documented management exception, not a judgment call.

Chain of custody is unbroken only if every transfer is documented; a single undocumented gap compromises admissibility.

Best evidence rule favors original documents; copies are admissible only when originals are unavailable and the reason is documented.

Digital evidence requires hash values (e.g., SHA-256) captured at acquisition to demonstrate integrity; record the tool and version.

Volatile data (RAM, active sessions, network connections) is collected before non-volatile data per order-of-volatility principles.

Physical evidence is packaged separately to prevent cross-contamination; each item gets a unique evidence number.

Photographs of a scene should include an overview, mid-range, and close-up with scale, plus a photo log correlating image to item.

Evidence storage must be access-controlled; every access is logged with identity, date, time, and purpose.

Relevance, authenticity, and legal acquisition are the three tests applied before evidence is admitted; document each.

Analysis separates observed fact from inference; each conclusion in a report must cite the specific evidence supporting it.

Timeline reconstruction orders events by verified timestamp; conflicting timestamps are flagged rather than reconciled silently.

Link analysis maps relationships among people, accounts, locations, and events; each link is labeled with its evidentiary source.

A findings matrix maps each allegation to evidence, witness, and conclusion to expose gaps before presentation.

Reports state methodology, limitations, and data sources so a reader can assess reliability independently.

Presentation to decision-makers leads with the finding and basis, then supporting detail; opinion is labeled as opinion.

Redaction removes protected data (PII, medical, privileged) before release; a redaction log records what was removed and why.

Testimony preparation requires the investigator to know the case file, the chain of custody, and the limits of their expertise.

Interviewing moves from open-ended questions to closed, specific questions; leading questions are avoided in the narrative phase.

The cognitive interview uses context reinstatement and varied retrieval to improve witness recall without suggestion.

Surveillance logs record date, time, location, subject description, activity observed, and observer identity for each entry.

Undercover and covert operations require documented authorization, defined scope, and periodic review to remain lawful.

Forensic analysis of devices follows write-blocking to prevent alteration of the source media.

Records and open-source research must document the source URL, capture date, and method so findings are reproducible.

Surveillance video review uses a time-synchronization note when the recorder clock differs from actual time.

Entrapment risk arises when an agent induces a person to commit an offense they were not predisposed to commit; document predisposition evidence.

Objectivity requires the investigator to pursue exculpatory as well as inculpatory evidence.

The investigative process follows intake, planning, evidence gathering, analysis, reporting, and disposition.

Reasonable suspicion versus probable cause: the former is articulable facts suggesting involvement; the latter is facts sufficient for a reasonable person to believe an offense occurred.

Privacy and consent rules govern searches of persons, property, and devices; document the legal basis for each search.

Conflict of interest (personal, financial, prior relationship) must be disclosed and the investigator recused if material.

Documentation must be contemporaneous; later recollection is noted as such with the date of entry.

Use of force, detention, and questioning of subjects are constrained by policy and law; the investigator records the authority relied upon.

Evidence handling follows the same standard regardless of case size; proportionality applies to resources, not to integrity.