Fraud Investigation and Evidence Handling
Predication and planning
An investigation begins only with predication - a reasonable basis (complaint, anomaly, audit finding) to believe fraud occurred. Plan the scope, the hypothesis (who, what, when, how, how much), resources, legal constraints and confidentiality before touching anything. Use a fraud theory approach: form a hypothesis, test it, revise it.
Evidence types and standards
Documentary, testimonial, physical, electronic and demonstrative evidence. Assess each item for relevance, reliability and sufficiency. Originals carry more weight than copies (best evidence principle). Electronic evidence requires forensic imaging and hash verification so the copy can be shown unaltered; log every transfer.
Chain of custody
Record who obtained each item, when, where, from whom, and every hand-off. A broken chain hands the defence an easy attack on authenticity, even where the evidence is genuine. Keep originals in a secure, access-controlled store.
Order of steps. Secure and preserve documents and data before interviewing, so the subject cannot destroy or tailor evidence and so admissions can be tested against known facts.
Traps. Confusing admissibility (may it be presented?) with weight (how persuasive is it?); interviewing the suspect first; accepting screenshots without metadata; keeping evidence in the investigator's desk drawer; writing conclusions of guilt in workpapers.
Rule of thumb. If you cannot answer "who held this item at every moment since it was created or seized?", the chain is broken - fix it now, not at the hearing.