5.2 Evidence: types, chain of custody & documentation

The Central Role of Evidence

Evidence is anything perceivable by the senses that tends to prove or disprove a fact at issue. In a fraud examination, the goal is to gather sufficient, relevant, and competent evidence to establish the facts. To be useful in court, evidence must generally be relevant (it makes a fact more or less probable), material (it bears on a fact of consequence to the case), and competent (it is reliable and was lawfully obtained). Even highly incriminating evidence is worthless if a court excludes it because it was gathered improperly or cannot be authenticated. The examiner's job, therefore, is not only to find evidence but to collect and preserve it so that its integrity — and therefore its admissibility — is never in doubt. Two disciplines make that possible: an unbroken record of how each item was handled, and careful, contemporaneous documentation of every step taken.

Direct vs. Circumstantial Evidence

• Direct evidence proves a fact without any inference: an eyewitness who saw the suspect take the cash, a signed confession, or a video recording of the act.
• Circumstantial evidence proves a fact indirectly and requires an inference: a suspect's unexplained wealth, altered records, or fingerprints on a forged check. Most fraud is proved with circumstantial evidence because fraud is a crime of concealment; a well-assembled body of circumstantial evidence can be as persuasive as direct evidence.

The Four Forms of Evidence

Classified by form, evidence falls into four categories:

Documentary evidence dominates most financial-fraud cases, which is exactly why disciplined handling of documents is essential.

Chain of Custody

The chain of custody is the chronological record of who obtained a piece of evidence, when and where it was obtained, and who had control or possession of it from the moment it was collected until it is presented in court. Its purpose is to prove that the evidence has not been altered, substituted, or tampered with. A broken or undocumented chain of custody is one of the most common reasons evidence is ruled inadmissible.

To maintain the chain of custody, each time evidence changes hands the examiner should record:

1. Who received the item and from whom;
2. When the transfer occurred (date and time);
3. Why it was transferred and what was done with it; and
4. Where it was stored.

A memorandum of the evidence should be prepared when an item is first received, describing what was received, from whom, when, and its condition. Original documents should be secured; the examiner works from copies whenever possible and stores originals in a safe, controlled location — a locked cabinet or evidence room with restricted access.

Marking and Handling Physical Evidence

When physical evidence is obtained, the examiner should mark it for identification — typically by initialing and dating the item or its container (an evidence bag or envelope) — without altering or damaging the item itself. Documents should be handled minimally to preserve latent fingerprints and prevent contamination: they should not be folded, stapled, written on, or marked in a way that alters the original. Electronic evidence demands special care; the examiner makes forensic images (bit-for-bit copies), analyzes the copy, and preserves the original media so the underlying data is never changed.

The Best-Evidence Rule

The best-evidence rule (in U.S. federal practice, Federal Rules of Evidence 1002) requires that, to prove the contents of a writing, recording, or photograph, the original be produced unless it is unavailable for a legitimate reason. A duplicate is generally admissible to the same extent as an original unless a genuine question is raised about the original's authenticity or it would be unfair to admit the duplicate. This rule is why fraud examiners strive to obtain and safeguard original documents; when an original cannot be secured, the examiner documents why and preserves the best available copy.

Documentation Discipline

Everything the examiner does should be documented contemporaneously. Working papers, evidence logs, interview memoranda, and a document-control system (indexing and cross-referencing each item) create a complete, retrievable record. Good documentation supports the fraud theory, withstands cross-examination, and lets another professional retrace the examiner's steps and reach the same conclusions. Notes should record facts and observations rather than conclusions or opinions about guilt, and each document obtained should carry a source, date, and identifying reference so it can be located again quickly. Poor or missing documentation, by contrast, can sink an otherwise strong case, because it opens the door to arguments that evidence was mishandled, altered, or fabricated. In short, sound evidence practice is a chain: relevant and competent evidence, an unbroken custody trail, careful marking and storage, respect for the best-evidence rule, and thorough contemporaneous records together keep a fraud case defensible.