| Course | ACC 427 Investigating with Computers |
|---|---|
| Module | Module 5 |
| Paper type | undergraduate electronic document review assignment |
| Length | About 1,010 words, 6 pages |
| Format | APA 7 student paper |
| School | Southern New Hampshire University |
| Program | BS Accounting |
| Updated | October 2026 |
Free sample paper for ACC 427 Module 5
Finding the Right 23 Documents: A Defensible Review of a Fleet Supervisor's Email and Messages
[Student Name]
Southern New Hampshire University
ACC 427: Investigating with Computers
Module Five Assignment
[Instructor Name]
[Date]
The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.
Finding the Right 23 Documents: A Defensible Review of a Fleet Supervisor's Email and Messages
Introduction
The fuel card analysis at the waste hauler found 186 purchases, $33,600 in total, on a fleet supervisor's card while his assigned pickup was more than 20 miles from the station. Before he is interviewed, the investigators want to know whether his communications explain the purchases, innocently or otherwise. His company email and the text messages on his company phone are the most likely sources. This assignment plans a review that finds what matters without reading every item and that could be explained later to counsel, an arbitrator or a court.
Preservation and Collection
Counsel issued a legal hold suspending deletion for the supervisor's mailbox, and the IT manager exported it with a record count and hash value. The supervisor's company phone, issued under a policy stating that company devices may be inspected, was collected during a routine equipment check and its messages extracted by an outside examiner using forensic tools, which record hash values and preserve original data (Kent et al., 2006). Messages on his personal phone are outside the company's authority and were not touched.
Culling
Table 1. Review Funnel
| Stage | Items |
|---|---|
| Collected email and messages | 48,000 |
| After limiting to 14 months around the purchases | 19,400 |
| After removing exact duplicates and system notices | 6,200 |
| Retrieved by tested keyword list | 1,140 |
| Reviewed in ranked order by technology-assisted review | 380 |
| Relevant | 23 |
Each reduction rule was written down before it was applied: the date range starts two months before the first suspect purchase and ends with the collection date, and duplicates are identified by hash value, not by subject line.
Keywords: Built and Tested
A first list came from the case facts: the names of the two stations near the supervisor's home, diesel, tank, generator, fuel card, the name of a relative's farm that appeared in a property record and his personal address. Testing on a random sample of 200 documents showed that diesel alone retrieved hundreds of routine fleet messages, so it was paired with the station names or the word farm. A seed set of three known relevant messages, found during the preservation check, confirmed that the revised list retrieved all three. The final list retrieved 1,140 items.
Technology-Assisted Review
Rather than read 1,140 items in date order, reviewers coded an initial sample of 100 as relevant or not, and the software used those decisions to rank the rest by likely relevance, learning from each additional decision. Cormack and Grossman (2014) found that continuous active learning, in which the system keeps learning from every reviewed document, reached high recall with less effort than simple keyword review or protocols that stop training early. Here, relevant documents were concentrated near the top: after 380 documents, 20 consecutive batches had produced no new relevant items, and review stopped.
Privilege and Personal Information
Eleven messages between the supervisor and an employment lawyer he consulted about an unrelated matter were identified by the lawyer's address and set aside unread by investigators, pending counsel's review. Personal medical information in a few messages was redacted from review copies, and those messages were flagged so they would not be produced without counsel's approval.
Validation
A random sample of 400 documents from the 5,060 not retrieved by keywords was reviewed in full. None was relevant. That result supports, though it cannot guarantee, the conclusion that few relevant documents remain outside the review set. Casey (2011) stresses that the reliability of conclusions from digital evidence depends on documenting what was examined and what was not, and this sample is part of that record.
Who Reviewed and How Decisions Were Recorded
Two reviewers, the forensic accountant and a paralegal from counsel's office, coded documents using a written protocol that defined relevant as any communication about fuel purchases, the stations, the farm, the supervisor's card or the pickup's use outside routes. Borderline documents were coded by both reviewers independently and discussed, and the protocol was updated when a new category appeared, such as messages about a generator. Every coding decision was stored in the review platform with the reviewer's name and time. A sample of 50 documents coded not relevant by one reviewer was recoded by the other; they agreed on 48, and the two disagreements were resolved and the protocol clarified. That agreement rate gives counsel a basis for trusting the coding, and the record allows an outside expert to audit it.
Why Not Simply Read Everything?
Reading all 6,200 items would have taken two reviewers about two weeks and delayed the interview while the supervisor continued to use the card. More importantly, exhaustive manual review is not as accurate as it seems: reviewers tire, and consistency falls over thousands of documents. The combination of tested keywords, ranking and validation sampling reached the relevant material in two days and produced measurable evidence of how much might have been missed, something a manual read does not provide.
Findings
The 23 relevant items include texts with a relative arranging deliveries of diesel to a farm on weekends matching the dates of the flagged purchases, an email from the supervisor to a station manager asking that receipts list the company truck number and a message mentioning a farm generator. They do not establish whether the fuel was for company use, but they give the interviewers specific dates and statements to ask about. The farm messages line up with 141 of the 186 flagged purchases, which makes them the central topic for the interview and a reason to ask counsel whether the relative should also be approached.
Conclusion
A preserved collection of 48,000 items was reduced by recorded rules to 6,200, searched with a tested keyword list, ranked with technology-assisted review and validated by sampling what the search did not retrieve. Privileged and personal material was protected. The 23 relevant documents give the investigation its next questions, and the process log makes the review defensible. If the supervisor later offers an innocent explanation, the same preserved collection can be searched again for messages that support or contradict it, without collecting anything new.
References
Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the Internet (3rd ed.). Academic Press.
Cormack, G. V., & Grossman, M. R. (2014). Evaluation of machine-learning protocols for technology-assisted review in electronic discovery. In Proceedings of the 37th International ACM SIGIR Conference on Research and Development in Information Retrieval (pp. 153-162). Association for Computing Machinery. https://doi.org/10.1145/2600428.2609601
Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-86
What the ACC 427 Module 5 instructions ask for
The Module Five assignment in ACC 427 usually asks how to search large collections of email and documents for evidence. Expect to describe preservation and collection, including who performed each step, reduction of the collection by date range and duplicates, development of search terms, review methods including keyword searching and technology-assisted review, handling of privileged communications and documentation that would let the process be explained and defended. Many versions ask about measuring the effectiveness of a search, for example by sampling documents not retrieved. Report counts at each stage, explain why each choice was made and note the risks of over- and under-inclusive searches, since both can weaken an investigation: one buries reviewers, the other misses evidence.
How this ACC 427 Module 5 email and document review assignment example is built
The sample reviews a fleet supervisor's company email and the messages on his company phone, preserved under a legal hold. The collection of 48,000 items is reduced to 6,200 by limiting dates to the 14 months around the suspect purchases and removing duplicates. A draft keyword list built from the case, station names, diesel, tank, generator and the supervisor's personal address, is tested on a sample and refined. Keywords retrieve 1,140 items; technology-assisted review ranks them, and reviewers read the top 380, finding 23 relevant, including messages arranging diesel for a relative's farm. Privileged messages with counsel are set aside. A sample of 400 unretrieved items finds none relevant.
Where the ACC 427 Module 5 rubric puts the points
Rubrics for the ACC 427 review assignment typically score preservation and collection, culling, search term development and testing, use of review technology, privilege handling, validation and documentation. Top papers report counts at each stage, test search terms on samples before relying on them, explain why technology-assisted review is appropriate and validate the result by sampling documents the search did not retrieve. Graders reward attention to privilege and personal information, and a clear explanation of when and why review stopped. Common deductions include keyword lists with no testing, review processes with no record of decisions and conclusions that ignore what the search might have missed.
ACC 427 Module 5 help: the mistakes that cost points
A common failure in review papers is offering a keyword list as if it were self-evidently complete, without testing whether it finds known relevant documents or measuring what it misses. Another frequent gap is privilege: messages with lawyers must be identified and withheld from investigators who should not see them. If your case involves shared drives, chat platforms or text messages on personal phones, preservation and legal limits differ and the plan must reflect them. Keep a short log of every decision, which terms were added or dropped and why, because the log is what makes a review defensible when someone later asks how documents were chosen and why others were not.
Get ACC 427 Module 5 written to your instructions
Send the ACC 427 Module 5 case and instructions. The paper will plan preservation, culling, keyword development and testing, any technology-assisted review, privilege screening, validation sampling and documentation, with counts at each stage. Your first one costs nothing; allow about two days. The paper above is an original model document written by our desk, not a submitted student paper and not an official Southern New Hampshire University document.
More ACC 427 papers and related BS Accounting samples
- ACC 427 Module 1 Discussion: Where the Digital Evidence Lives
- ACC 427 Module 2 Data Acquisition Assignment: Getting a Complete Copy of the Scale Data
- ACC 427 Module 3 Data Analysis Assignment: Voids, Gaps and the 3 p.m. Pattern
- ACC 427 Module 4 Project One: Fuel Cards Matched to Truck GPS
- ACC 427 Module 6 Discussion: How Far May an Employer Look?
- OL 320 Module 1 Opportunity Recognition Discussion
- QSO 340 Module 7 Project Two Status Report
- ACC 202 Module 4 Project Milestone Two
- ACC 318 Module 1 Discussion: A Lawsuit, a Fine and the Contingency Rules
ACC 427 Module 5 questions, answered
Where can I find a free ACC 427 Module 5 email review sample?
This page includes a full ACC 427 Module 5 assignment planning a defensible review of a supervisor's email and messages in a fraud case.
What is culling in electronic review?
Reducing a collection before review by removing items outside the relevant dates, duplicates and system files, so reviewers focus on likely relevant material.
What is technology-assisted review?
A process in which software learns from reviewers' decisions on sample documents and ranks the rest by likely relevance, so the most relevant are reviewed first.
How can a search be validated?
By reviewing a random sample of documents the search did not retrieve and estimating how many relevant documents were missed.
Why is privilege screening necessary?
Communications with lawyers seeking or giving legal advice may be privileged. Reviewing or disclosing them improperly can waive privilege or taint the investigation.