ACC 646 Module 5 Evidence Assignment Example

Evidence Handling and Analytical Testing Plan

[Student Name]

Southern New Hampshire University

ACC 646: Introduction to Forensic Accounting and Fraud Examination

Module Five Assignment

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Evidence Handling and Analytical Testing Plan

Introduction

The investigation plan from Milestone One calls for analysis of hauler invoices, scale tickets, batch plant receipts, company email and the superintendent's company laptop. This assignment sets out how each type of evidence will be collected and preserved so it can be used if the matter goes to court, and which analytical tests suit the data (Kranacher & Riley, 2019).

Types of Evidence

The evidence falls into three groups. Documentary evidence includes paper hauler invoices, delivery sheets signed by batch plant receivers and the vendor file with the hauler's W-9 and contract. Electronic evidence includes the scale system database, which records every weighed load with time, truck number and weight; the accounting system's payment records; the batch plant production logs; company email; and the superintendent's laptop. Testimonial evidence will come later from interviews. Each type has different preservation needs, and the team will not collect testimonial evidence until the documents and data are secured.

Chain of Custody

Original paper invoices and delivery sheets will be collected from the accounts payable file room by the forensic manager with the controller present, placed in sealed and labeled evidence envelopes and logged with the date, time, collector, description and storage location. Every later transfer is recorded with signatures. The originals are scanned once, the scans used for all analysis and the originals stored in a locked cabinet in counsel's office. Golden et al. (2006) stress that a gap in the custody record can be enough for opposing counsel to question whether a document was altered.

Digital Evidence

Electronic evidence follows NIST guidance for integrating forensic techniques into investigations (Kent et al., 2006). A certified forensic examiner will image the superintendent's company laptop and phone using write-blocking tools, compute hash values on the originals and the images, and record both; matching hashes prove the images are identical. The scale system and accounting databases will be exported by IT under the examiner's supervision, with hashes recorded for each export file. All analysis is done on working copies, never on originals. Email will be preserved through a litigation hold on the company's mail server, applied quietly so the superintendent is not alerted. Casey (2011) notes that metadata, such as file creation and modification dates, is often as important as content, so the examiner will preserve it.

Admissibility

Out-of-court statements offered for their truth are hearsay, but records a company keeps as a routine part of its operations, created close to the events by someone who knew the facts, are generally admissible under the business records exception. Scale tickets, invoices and production logs meet that description, provided a custodian, such as the controller or IT manager, can testify to how they are created and kept. The forensic team's own schedules are summaries; they will be supported by the underlying records and prepared so a witness can explain every step.

Choosing Analytical Tests

Under Benford's law, smaller leading digits turn up far more often than larger ones in many real-world number sets, with 1 leading about 30 percent of the time. It works as a screen when values range from small to very large and nobody assigns or caps them (Nigrini, 2020). Hauler invoices fail that test. Each load is billed at a contract rate of about $600, so invoice totals are multiples of that rate and cluster at a few leading digits by design. A Benford test would flag every invoice and reveal nothing.

Better tests for this scheme are built from its mechanics. The capacity test divides loads billed each day by the hauler's eight registered trucks; a quarry round trip takes about 70 minutes, so more than nine loads per truck in a ten-hour day is not physically possible. The closure-day test flags loads billed on the 41 days the north quarry was closed for weather or maintenance. The three-way match compares each invoiced load with a scale ticket and a batch plant receipt by date, truck and weight.

Results of tailored tests on hauler invoices, 2022 to 2025

The flagged groups overlap; the three-way match is the main measure, and the other tests corroborate it.

Benford Test of All Vendor Payments

Benford's law does suit the company's full vendor payment file, about 38,000 payments over three years ranging from a few dollars to over a million. A first-two-digits test showed the data broadly conforming, with one large spike at 48 and 49, payments between $4,800 and $4,999. The company's approval limit is $5,000, above which a second signature is required. Of 311 payments in that range, 164 went to the tire dealer identified in Module Two. The spike is not proof; it is a lead that supports investigating the purchasing agent's relationship with the dealer, possibly through split invoices. The next step is to pull the 164 invoices and look for consecutive numbers, same-day dates and identical descriptions that would show one purchase broken into pieces.

Working Paper Standards

Every analytical step will be documented so a reviewer, or an opposing expert, can reproduce it. Each working paper records the source file and its hash, the query or formula applied, the person who performed it and the date, and the reviewer's sign-off. Matching rules, such as the tolerance allowed when a truck number on an invoice differs from the scale record by one digit, are written down before the matching is run, not adjusted afterward to fit expectations. Exceptions removed from a flagged population are listed with the reason and the supporting document. The AICPA's forensic services standard expects the practitioner to obtain sufficient relevant data to support conclusions, and disciplined working papers are how that is shown if the analysis is challenged in a deposition.

Conclusion

Evidence will be gathered with documented custody, analyzed only on verified copies and supported by records a custodian can authenticate. Analytical tests will be chosen for fit: tailored matching for the hauler and Benford screening for the broader vendor file, with every anomaly treated as a lead to be explained.

References

Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the Internet (3rd ed.). Academic Press.

Golden, T. W., Skalak, S. L., & Clayton, M. M. (2006). A guide to forensic accounting investigation. Wiley.

Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-86

Kranacher, M.-J., & Riley, R. A. (2019). Forensic accounting and fraud examination (2nd ed.). Wiley.

Nigrini, M. J. (2020). Forensic analytics: Methods and techniques for forensic accounting investigations (2nd ed.). Wiley.