Investigation Planning, Evidence Collection, and Interviewing
Domain 7 tests structured investigation: planning, evidence mapping, lawful collection, chain of custody, and interviews that test hypotheses rather than confirm them.
Core rules
- Start with a written plan: scope, fraud hypotheses, evidence needed, legal constraints, resources, and decision points.
- Build an evidence matrix linking each allegation to documentary, physical, digital, and testimonial evidence. Record source, custodian, date, and reliability.
- Preserve evidence lawfully. Maintain chain of custody for physical items and hash or image digital devices where appropriate. AIS, VDR, CCTV, emails, and terminal systems are time-sensitive.
- Interview witnesses separately and late in the process, after documents have been reviewed. Use open questions first, then specific challenges. Do not disclose evidence that could contaminate accounts.
- Consider privilege, data protection, employment law, and jurisdiction before searching devices or conducting recorded interviews.
Worked example
A cargo shortlanding is suspected. The plan should first secure the manifest, gate records, seal numbers, CCTV, and discharge survey. Only then should the forwarder and driver be interviewed. If the driver is interviewed first, the accounts may align with the documents rather than reveal the discrepancy. The report should show what was verified, what was not, and why.
Traps
Interviewing before evidence review, failing to preserve digital evidence, and writing conclusions without an evidence trail are common failures. Avoid coercive questioning and undocumented assumptions.