The ManicaPost
Grashworth Mwanza
The majority of fraud investigations involve employing investigative techniques such as interviewing, document examinations, covert operations, computer forensics among others.
Document examination can be so daunting and draining, especially when there is plenty of documentary evidence to comb through.
This article endeavours to equip loss control personnel with skills and procedures that may aid an effective investigation on occupational fraud.
Documentary evidence, if examined very well, can prove to be very useful in litigation. The good thing about documents is that unlike a witness who may be unreliable through alteration of statements, documents don’t lie.
It is always prudent to bear in mind that any fraud case may culminate in litigation where the investigator, if qualified, may be required to testify as an expert witness.
It is because of this ever lurking possibility that any fraud investigator must always exercise due diligence in any case of fraud investigation. In this article, we will touch on how to conduct document examination.
The investigator will usually obtain a great deal of documentary evidence. It is critical that the investigator understands the relevance of this evidence, and how it should be preserved and presented.
Always keep in mind that documents can either help or hurt a case, depending on which ones are presented and how they are presented. The goal is to make certain that all relevant documents are included, and all irrelevant documents eliminated.
Many examiners pay too much attention to documents. It is easy to get bogged down in detail when examining records and to lose sight of a simple fact: documents do not make cases, witnesses make cases. The documents make or break the witness. So-called “paper cases” often confuse and bore a jury.
Basic procedures in handling evidence are required for it to be accepted by the court. Proof must be provided that the evidence is relevant and material. Evidence submitted must be properly identified, and it must be established that the proper chain of custody was maintained. We will return to this concept of chain of custody later in this article.
Normally, the relevance of documents cannot be determined easily early in a case. For that reason, it is recommended that all possible relevant documents be obtained. If they are not needed, they can always be returned. Below, we discuss a few general rules regarding the collection of documents for investigations purposes:
Obtain original documents where feasible. Make working copies for review, and keep the originals segregated.
Do not touch originals any more than necessary; they might later have to undergo forensic analysis. Forensic analysis would also involve who touched the documents.
Maintain a good filing system for the documents. This is especially critical where large numbers of documents are obtained. Losing a key document is an unpardonable sin, and can mortally damage the case. For ease of reference, documents can be stamped sequentially.
Chain of custody
From the moment evidence is received, its chain of custody must be maintained for it to be accepted by the court. This means that a record must be made when the item is received or when it leaves the care, custody, or control of the fraud examiner.
This is best handled by a memorandum of interview with the custodian of the records when the evidence is received. The memorandum should state: What items were received? When were they were received? From whom were they were received? Where are they are maintained?
If the item is later turned over to someone else, a record of this should be made, preferably in memorandum form. All evidence received should be uniquely marked so that it can be identified later.
The preferable way is to initial and date the item; however, this can pose problems in the case of original business records furnished voluntarily. For them, a small tick mark or other nondescript identifier can be used. If it is not practical to mark the original document, it should be placed in a sealed envelope, which should then be initialled and dated.
Obtaining documentary evidence
Where both parties agree, it is always possible to obtain evidence by consent. This is the preferred method. The consent can be oral or written. In the cases of information obtained from possible adverse witnesses, or the target of the examination, it is recommended that the consent be in writing.
However, in many cases, the investigator will not wish to alert the suspect on his intentions, and other routes must be taken. Where the evidence is owned and in the control of the party that requests the investigation, for instance in desk drawers in the office, then the investigator is usually able to obtain the documents as required. Where evidence is held by other parties, or in uncontrolled locations, specific legal action is required before attempting to obtain it. This usually takes the form of a subpoena or other order from the court to produce the documents and records, including electronic ones.
Other forms of court orders can be used to obtain witness evidence and statements.
Under no circumstances should the investigator attempt to obtain documents by other means, as this can lead to charges of theft, trespass, and other sanctions.
Types of evidence
Evidence is either direct or circumstantial. Direct evidence shows prima facie the facts at issue. What constitutes direct evidence depends on the factors involved. Circumstantial evidence is that which indirectly shows culpability.
Organisation of evidence
Keeping track of the amount of paper generated is one of the biggest problems in fraud cases. It is essential that documents obtained be properly organised early on in an examination, and that they be continuously re-organised as the case progresses.
Remember, it is usually difficult to ascertain the relevance of the evidence early in the case. Good organisation in complex cases includes the following:
Segregating documents by either witness or transaction. Chronological organisation is the least preferred method.
Making a “key document” file for easy access to the most relevant documents. Periodically review the key document files. Move the less important documents to back-up files and keep only the most relevant paper in the main files.
Establishing a database early on in the case of a large amount of information.
This database can be kept manually or computerised and accessed by keywords. The database should include, at a minimum, the date of the document, the individual from whom the document was obtained, date obtained, a brief description, and the subject to whom the document pertains.
Grashworth Mwanza writes in his personal capacity. He is a Certified Fraud Examiner (CFE), an Expert Consultant in Fraud Prevention, Detection, Investigation and Litigation. He can be contacted on [email protected].
