The Fuel Distributor's Preferred Supplier List
You are engaged by the audit committee of Sahel Energy, a fuel distributor in Niamey with 90 employees and annual revenue of XOF 8 billion. The procurement manager, Ms. Halima, has approved 70% of purchase orders to a single broker, Sahara Link, which was incorporated nine months after she joined. Sahara Link address matches a stationery shop owned by her cousin. Prices to Sahara Link are 9% above other quotes, but Ms. Halima file contains three competing quotes that appear to be from the same printer and use identical wording. The CFO has given you the procurement manager laptop and a USB drive, but the laptop was already opened by IT to check for viruses. Ms. Halima is on annual leave and has not been told about the investigation. A junior procurement clerk, Mr. Adamou, processed the paperwork and says he was just following orders.
1. What evidence-handling and legal risks arise because IT opened the laptop before you received it, and how should you proceed?
Read the worked answer
The main risk is contamination and broken chain of custody: IT may have altered files, deleted malware, or changed timestamps, so the laptop is no longer a pristine source. That weakens admissibility and gives the defense an argument that evidence was tampered with. Proceed by documenting the handover, interviewing IT about exactly what they did, and preserving the laptop and USB in a sealed evidence bag with a custody log. Make a forensic image using a write-blocker, hash it, and work only from the image. Do not rely on the laptop alone: obtain server logs, email archives, procurement files, and bank records. In Niger, work with local counsel on criminal-procedure and privacy requirements before searching personal files. If the laptop was powered on, volatile data may be lost; note that limitation. The examiner should not clean up files or re-save documents. If the evidence is critical, consider an independent forensic examiner.
2. Plan the interview sequence and explain why, including how to handle Mr. Adamou and Ms. Halima.
Read the worked answer
Start with non-suspects who can establish facts: IT staff about the laptop, then the stationery shop owner or landlord, then the junior clerk Mr. Adamou. Interview Mr. Adamou before Ms. Halima because he is a witness and may be frightened; ask about the workflow, who gave instructions, and how quotes were prepared, without accusing him. Then interview the three quote suppliers, if reachable. Interview Ms. Halima last, after documents are secured, because she is the likely subject and may destroy evidence or coordinate stories. Do not reveal the investigation before her interview. In the interview, use a non-accusatory fact-finding phase first, then present contradictions. Avoid threats or promises; allow her to leave if the interview is voluntary, and follow company policy and local law. If criminal referral is likely, coordinate with counsel and consider whether a caution is required. The sequence protects the evidence and tests each person account against independent facts.
3. How would you test whether the three quotes are fabricated and whether Sahara Link is a shell company?
Read the worked answer
For the quotes: inspect document metadata, fonts, printer marks, and creation dates; compare wording and formatting; contact the supposed quoting companies to confirm they bid; and check whether the quotes were received before the purchase order. Identical wording and one printer suggest they were prepared by the same person. For Sahara Link: search the corporate registry for incorporation date, capital, directors, and address; compare the address to the cousin stationery shop; check bank account opening records and beneficial ownership; review email headers and domain registration; and analyze payments for round sums or rapid transfers. Price analysis is also useful: a consistent 9% premium over other quotes is unusual and may reflect a kickback built into the price. The examiner should triangulate: registry data alone is not proof, but registry plus address plus timing plus price premium is strong circumstantial evidence. Preserve the documents and avoid confronting the cousin before the registry checks are complete.