Law
Law
This domain tests the legal framework surrounding fraud examinations: criminal versus civil liability, elements of fraud, evidence rules, rights of subjects, privacy, and testimony. The examiner must know what conduct is unlawful and what evidence can be used.
Core rules
- Criminal fraud requires proof beyond a reasonable doubt; civil fraud generally requires a preponderance of the evidence.
- Common fraud elements: a false statement or concealment, knowledge of falsity, intent to deceive, justifiable reliance, and damages.
- Evidence must be admissible, relevant, and reliable. Hearsay is generally inadmissible unless an exception applies; business records are a common exception.
- Chain of custody supports authenticity. Digital evidence needs forensic imaging and hash verification.
- Rights and privacy: searches of employee devices depend on policy, consent, jurisdiction, and proportionality. Privileged communications may be protected.
- Expert testimony must be based on sufficient facts, reliable methods, and helpful application; the examiner should not opine on legal guilt.
Worked example
An employee is accused of embezzling cash. The employer wants both criminal prosecution and civil recovery. Reasoning: the criminal case must prove each element beyond a reasonable doubt; the civil case can proceed on a preponderance standard and seek restitution or damages. Evidence gathered for employment purposes may still be challenged in court, so preserve originals and document access. The examiner’s report should state factual findings and losses, not declare the employee guilty.
Traps
Do not mix burdens of proof. Do not assume a company policy authorizes unlimited device searches. Do not repeat hearsay as fact. Do not offer legal conclusions. Do not ignore jurisdiction and privilege.