ACC 425 Module 5 Evidence and Chain of Custody Assignment Example

Keeping Evidence Usable: Securing Records, Email and a Laptop in a Produce Kickback Investigation

[Student Name]

Southern New Hampshire University

ACC 425: Interview Techniques and Legal Aspects of Fraud

Module Five Assignment

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Keeping Evidence Usable: Securing Records, Email and a Laptop in a Produce Kickback Investigation

Introduction

The investigation into the Iowa grocery wholesaler's produce buyer is approaching its final interviews. Before then, the evidence must be secured in a way that would survive challenge in a civil suit, a criminal referral or an employment arbitration. Evidence that is lost, altered or of uncertain origin may be excluded or given little weight, regardless of what it shows. This assignment plans the collection and preservation of each type of evidence, the chain of custody and the admissibility questions each item raises (Golden et al., 2006).

Order of Collection

The items at greatest risk of loss are electronic and in the buyer's control: his company email, his laptop and any messages with the broker. They are secured first, quietly, before the buyer is interviewed. Records in the company's accounting system are at less risk, because the buyer cannot alter posted transactions, but they are exported early so that the version used in analysis is fixed. Documents from outside sources, such as the tipster's bank records, are logged as soon as they are received.

Electronic Evidence

Counsel will issue a legal hold to the IT manager, suspending the company's 90-day automatic deletion of email for the buyer, the purchasing director and anyone else who corresponded with the broker. The IT manager will export those mailboxes to a secure location and document the export.

The buyer's company laptop will be collected on the morning of his interview, when he is in the conference room, by the IT manager and the forensic accountant together. It will be sealed in an evidence bag, logged and delivered to an outside certified forensic examiner, who will create a bit-for-bit image of the drive and calculate hash values for the original and the image. A hash value is a mathematical fingerprint: if a single character in the data changes, the value changes, so matching values show the image is exact and later analysis did not alter anything. Analysis will be done only on the image. No one in the company will open files on the laptop, because doing so can change file dates and invite a challenge that the evidence was tampered with (Kranacher & Riley, 2019).

Accounting Records

Purchase orders, receiving logs, invoices and payment records for the broker and comparable vendors will be exported from the accounting system with the system's audit log, showing who created and approved each record. The IT manager will sign a statement describing the system, how records are created in the ordinary course of business and how the export was made. That statement lays the foundation for treating them as ordinary business records, an exception that lets entries made routinely, close in time to the event, by people who knew the facts, come into evidence even though they are out-of-court statements.

Documents From the Tipster

The broker's former bookkeeper provided printouts of bank statements showing the broker's monthly payments to the brother-in-law's company. These are copies from an outside source of uncertain completeness. They are logged with the date, the method of receipt and her description of how she obtained them, and they are kept unmarked. Their main value is to direct counsel's request for certified bank records, which would satisfy the original document rule and be easier to authenticate than a former employee's printouts.

Chain of Custody Log

Table 1. Chain of Custody Log (Extract)

Each entry records who held the item, when and why, and each transfer is signed by both parties. The log itself is kept with the investigation file. Gaps in custody are among the most common grounds for challenging evidence, because they leave room to argue that an item was changed (Association of Certified Fraud Examiners, 2023).

Who Does What

Evidence handling fails most often when the wrong person performs a technical step. The plan assigns each task to someone qualified for it and independent enough to testify about it. The IT manager handles system exports and the legal hold, because he administers the systems and can explain how records are created. The outside forensic examiner handles the laptop, because imaging and hashing require training and tools the company lacks, and because an outside examiner is easier to defend as neutral. The forensic accountant analyzes the data and maintains the log. Counsel obtains third-party records through proper legal process. No one from purchasing, including the director, handles any evidence, since his own decisions are part of what is being examined.

Admissibility Questions

Relevance is not in doubt for any item. Authentication asks whether an item is what it is claimed to be: the laptop image is authenticated through the examiner's testimony and hash values, the accounting records through the IT manager's statement, and the tipster's printouts would need either her testimony or certified bank copies. Hearsay applies to statements offered for their truth: the accounting records and emails written in the ordinary course of business may qualify under exceptions, while the buyer's own emails may be admissible as statements of a party. The original document rule favors certified bank records over printouts when the content of the records is at issue.

Conclusion

Electronic evidence is secured first through a legal hold and forensic imaging with hash values, system records are exported with audit logs and certified, and the tipster's documents are logged and used to obtain certified copies. A chain of custody log records every transfer. These steps give counsel evidence whose origin and integrity can be proved, which is what makes the findings usable.

References

Association of Certified Fraud Examiners. (2023). Fraud examiners manual (2023 ed.). Author.

Golden, T. W., Skalak, S. L., & Clayton, M. M. (2006). A guide to forensic accounting investigation. Wiley.

Kranacher, M.-J., & Riley, R. A. (2019). Forensic accounting and fraud examination (2nd ed.). Wiley.