Admissibility, Authentication and Chain of Custody

1. Why This Topic Matters

A fraud examination that cannot survive a courtroom is only half an investigation. Fraud examiners gather documents, interview witnesses, image hard drives and trace funds, but every one of those efforts can be wasted if the resulting evidence is excluded by a judge. The ACFE places Admissibility, Authentication and Chain of Custody within the Law section of the CFE Exam (under Basic Principles of Evidence) precisely because fraud examiners must conduct every engagement with the assumption that the matter might end in litigation. Even when a case settles or is handled internally, the standards of admissibility define what good evidence looks like.

Three practical consequences flow from this:
• Admissibility determines whether the trier of fact (judge or jury) is ever allowed to see or hear the evidence at all.
• Authentication determines whether the proponent has shown that the item is genuinely what it is claimed to be.
• Chain of custody determines whether the court can trust that the item has not been altered, substituted or contaminated between the time it was collected and the time it is offered.

On the exam, this content area is heavily tested because it draws together rules of evidence, investigative best practice and digital forensics. Expect questions that are conceptual (definitions and rules), applied (what should the examiner do in a scenario) and discriminating (which of several similar-sounding terms is correct).

2. What Evidence Is – The Foundation

Evidence is anything perceivable by the five senses, and any proof such as testimony, documents, records, tangible objects or demonstrative exhibits, that is legally presented to prove or disprove the existence of a fact. The Fraud Examiners Manual groups evidence into three basic forms:
• Testimonial evidence – oral or written statements given by witnesses under oath.
• Real (physical) evidence – tangible objects such as a forged check, a laptop, a weapon or a counterfeit invoice.
• Documentary evidence – writings, recordings, photographs, spreadsheets, e-mails and electronic records. Many authorities also list demonstrative evidence (charts, diagrams, summaries, re-creations) that illustrates other evidence.

Evidence is also classified as direct (proves a fact without inference, e.g., an eyewitness who saw the defendant sign the check) or circumstantial (proves a fact indirectly by inference, e.g., the defendant's sudden unexplained wealth). Both are admissible; fraud is most often proven circumstantially because intent is rarely witnessed directly.

3. Admissibility – The Three-Part Test

For evidence to be admissible, it generally must be relevant, material and competent. Memorize these three words; the exam loves to ask which one applies to a given fact pattern.

Relevant. Under Federal Rule of Evidence (FRE) 401, evidence is relevant if it has any tendency to make a fact of consequence more or less probable than it would be without the evidence. This is a very low threshold. Irrelevant evidence is never admissible; relevant evidence is admissible unless some rule excludes it.

Material. Materiality asks whether the evidence relates to a fact that is actually at issue in the case. Evidence can be logically relevant to something yet immaterial because that something does not matter to the legal dispute. (In the modern Federal Rules, materiality is folded into the definition of relevance as a fact of consequence, but the CFE materials still treat it as a distinct concept.)

Competent. Competent evidence is evidence that is not barred by an exclusionary rule. Examples of incompetent evidence include inadmissible hearsay, privileged communications, evidence obtained in violation of constitutional rights (the exclusionary rule in criminal cases) and evidence from a witness who lacks personal knowledge.

Exclusion of relevant evidence (FRE 403). Even relevant, material and otherwise competent evidence may be excluded if its probative value is substantially outweighed by the danger of unfair prejudice, confusing the issues, misleading the jury, undue delay, wasting time or needlessly presenting cumulative evidence. The key phrase is substantially outweighed; the balance is tilted toward admission.

Character evidence and other acts. Evidence of a person's character is generally not admissible to prove that the person acted in conformity with that character on a particular occasion. However, under FRE 404(b), evidence of other crimes, wrongs or acts may be admissible to prove motive, opportunity, intent, preparation, plan, knowledge, identity or absence of mistake or accident. This is especially important in fraud cases, where a prior similar scheme can be offered to show intent or a common plan rather than bad character.

Hearsay. Hearsay is an out-of-court statement offered to prove the truth of the matter asserted. It is generally inadmissible because the declarant was not under oath, not subject to cross-examination and not observable by the jury. Key exceptions and exclusions relevant to fraud examiners include:
• Admissions by a party-opponent – a statement made by the opposing party (for example, a confession obtained in an admission-seeking interview) is treated as non-hearsay under FRE 801(d)(2).
• Business records exception (FRE 803(6)) – records of regularly conducted activity are admissible if made at or near the time by (or from information transmitted by) someone with knowledge, kept in the ordinary course of business, and made as a regular practice, as shown by the testimony or certification of a custodian or other qualified witness. Records prepared specifically for litigation do not qualify.
• Public records, present sense impressions, excited utterances, statements against interest, statements of then-existing mental state and dying declarations.
Note that a statement is not hearsay if offered for a purpose other than its truth, such as to show that the listener was on notice or to show the statement was made at all.

Privileges. Certain communications are protected and therefore incompetent as evidence: attorney-client privilege, the attorney work-product doctrine (which can protect a fraud examiner's work when retained by counsel), spousal privileges, physician-patient and psychotherapist privileges, clergy privilege and, in some U.S. states (but not under federal law), an accountant-client privilege. The Fifth Amendment privilege against self-incrimination applies to individuals, not corporations, and only to testimonial (not pre-existing documentary) evidence.

Expert testimony. Under FRE 702 a qualified expert may give opinion testimony if it is based on sufficient facts, uses reliable principles and methods, and reliably applies them to the case. Under the Daubert standard, trial judges act as gatekeepers evaluating testability, peer review, error rate, standards and general acceptance. Fraud examiners frequently testify as experts on forensic accounting matters, so understanding how an expert's methodology is scrutinized is part of this topic.

4. Authentication – Proving the Item Is What You Say It Is

Authentication (or identification) is a condition precedent to admissibility for real and documentary evidence. Under FRE 901(a), the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is. This is a threshold of prima facie showing, not proof beyond doubt; once met, any remaining disputes about genuineness go to the weight the jury gives the evidence, not its admissibility.

Recognized methods of authentication (FRE 901(b)) include:
• Testimony of a witness with knowledge – e.g., the records custodian who confirms a ledger is the company's ledger, or the investigator who seized the laptop.
• Nonexpert opinion about handwriting – a lay witness familiar with the handwriting (familiarity not acquired for the litigation).
• Comparison by an expert or the trier of fact with an authenticated specimen (questioned-document examination).
• Distinctive characteristics – appearance, contents, substance, internal patterns or other features taken together with circumstances (the reply doctrine for letters and e-mails falls here).
• Opinion about a voice and evidence about a telephone conversation.
• Evidence about public records – showing a document was recorded or filed in a public office.
• Ancient documents or data compilations – at least 20 years old, in a condition creating no suspicion, found where it would be expected.
• Evidence about a process or system – describing a process and showing it produces an accurate result (critical for computer-generated data, surveillance footage and forensic imaging).
• Methods provided by statute or rule.

Self-authenticating documents (FRE 902) require no extrinsic evidence of authenticity. The list includes domestic public documents that are sealed and signed, certified copies of public records, official publications, newspapers and periodicals, trade inscriptions and labels, acknowledged (notarized) documents, commercial paper and related documents, certified domestic records of regularly conducted activity (which also satisfies the business records hearsay exception), and, under FRE 902(13) and 902(14), certified records generated by an electronic process or system and certified data copied from an electronic device, storage medium or file when authenticated by a qualified person's certification (typically using hash values).

Photographs, videos and recordings. A photograph is typically authenticated by any witness who is familiar with the scene and can testify that the image fairly and accurately depicts it; the photographer is not required. Audio and video recordings may be authenticated by a participant or by evidence of the recording system's reliability.

Digital evidence. E-mails, text messages, social media posts and database extracts are authenticated through a combination of methods: testimony of the sender or recipient, distinctive characteristics (e-mail addresses, signature blocks, content known only to the parties), metadata, system logs, and testimony about the reliability of the forensic collection process. Generating and recording cryptographic hash values (such as MD5 or SHA-256) at the time of collection and again before trial demonstrates that the digital copy is bit-for-bit identical to the original and has not been altered.

5. The Best Evidence Rule (Original Writing Rule)

Closely linked to authentication is the best evidence rule under FRE 1002: to prove the content of a writing, recording or photograph, the original is required unless the rules or a statute provide otherwise. Important refinements:
• The rule applies only when the content of the document is what is being proved, not when a document is merely mentioned in passing.
• Duplicates (photocopies, scans, printouts from the same electronic file) are admissible to the same extent as originals under FRE 1003 unless a genuine question is raised about the original's authenticity or it would be unfair to admit the duplicate.
• For electronically stored information, any printout or other output readable by sight that accurately reflects the information is an original.
• Under FRE 1004, secondary evidence (such as testimony about the contents) is admissible if the original is lost or destroyed (not in bad faith by the proponent), cannot be obtained by judicial process, is in the possession of the opponent who fails to produce it after notice, or relates only to a collateral matter.
• Under FRE 1006, the contents of voluminous writings, recordings or photographs may be presented through a summary, chart or calculation, provided the underlying originals or duplicates are made available to the other parties for examination. Fraud examiners' schedules and flowcharts of transactions are routinely admitted this way.

6. Chain of Custody – Protecting the Integrity of Evidence

Definition. The chain of custody is the chronological, documented record of the seizure, custody, control, transfer, analysis and disposition of evidence, from the moment it is obtained until it is presented in court (and ultimately returned or destroyed). Its purpose is to establish that the item offered is the same item that was collected and that it has not been tampered with, altered, substituted or contaminated.

Why it matters. A broken or undocumented chain gives the opposing party an opening to argue that the evidence is unreliable. In criminal matters a significant gap can lead to exclusion; in most civil matters and in many criminal ones, minor gaps affect the weight rather than the admissibility of the evidence, unless there is affirmative evidence of tampering. Either way, the credibility of the examiner is at stake.

Core requirements. The Fraud Examiners Manual recommends that a memorandum (chain-of-custody log) be prepared at the time evidence is received and that it record:
• What item was received (with a unique description and identifying marks or serial numbers).
• When it was received (date and time).
• From whom it was received.
• Where it was received or seized.
• Who has had possession of it and when (every transfer, with signatures of both the releasing and receiving parties and the reason for the transfer).
• Where and how it has been stored and secured.

Best practices for documentary evidence.
• Mark each original document uniquely (for example, by initialing and dating on the back, or by using a control number on an attached evidence tag or transparent envelope). Do not write on the face of an original.
• Place originals in protective, sealed envelopes or sleeves; make working copies and conduct analysis on the copies so the originals are handled as little as possible.
• Store originals in a secure, access-controlled location (locked cabinet or evidence room) and maintain a sign-out log.
• Avoid staples, paper clips, highlighters, folding or any action that could alter the original or destroy latent evidence such as fingerprints or indented writing. Where forensic document examination is anticipated, handle documents with gloves and keep them flat in protective covers.
• Record the source of each document (who provided it, which file or drawer it came from) at the time of collection.

Best practices for digital evidence.
• Do not work on the original device or media; create a forensic image (bit-stream copy) using a write-blocker so nothing is written to the source.
• Compute and record hash values of the original and the image to prove they are identical; re-verify before analysis and before trial.
• Document the make, model, serial number and condition of devices, photograph them in place before seizure, and record the state (powered on/off) and any volatile data captured.
• Store media in anti-static, tamper-evident packaging and log every access.
• Use trained forensic specialists; improper collection by untrained staff is a leading cause of challenges to digital evidence.

Testimony establishing the chain. At trial, the proponent typically calls the person who collected the evidence and, where necessary, each custodian who handled it, or relies on business-records certification for routine transfers. The witness describes how the item was identified, secured and preserved and confirms it is in substantially the same condition as when collected.

7. How the Three Concepts Work Together

Think of the path to admission as a series of gates. First, the evidence must be relevant and material to a fact in issue. Second, it must be competent, meaning no exclusionary rule (hearsay, privilege, constitutional violation, best evidence rule) blocks it. Third, real and documentary evidence must be authenticated, and a well-maintained chain of custody is the primary tool for authenticating physical and digital items. Finally, the court weighs whether FRE 403 concerns justify exclusion. Only after passing through all gates does the jury see the evidence, and even then the opponent may attack its weight by pointing to weaknesses in authentication or gaps in custody.

8. Worked Scenarios

Scenario A. A fraud examiner photocopies a suspicious invoice, writes notes on the original, and leaves the original on her desk overnight before locking it up. Issue: The original has been altered and was not secured; the chain of custody has a gap. The copy may still be admissible as a duplicate, but the defense will argue tampering. Correct practice: initial and date the back or use an evidence tag, write only on copies, and secure the original immediately with a log entry.

Scenario B. The examiner wants to introduce the company's general ledger printouts. Analysis: The ledger is hearsay but falls within the business records exception; it can be authenticated by the controller or by a custodian's certification (self-authenticating under FRE 902(11)). Printouts of electronically stored data qualify as originals under the best evidence rule.

Scenario C. An employee's confession, given in an interview, is offered against the employee. Analysis: It is an admission by a party-opponent and therefore not hearsay. The examiner who heard it authenticates it through testimony; a signed statement strengthens the showing.

Scenario D. The examiner's team imaged a laptop without a write-blocker and did not record hash values. Analysis: The image can still be offered, but authentication under the process or system method is weakened and the defense will contest reliability. The failure goes primarily to weight, but a court could exclude it if the risk of alteration is significant.

Scenario E. The prosecution offers evidence that the defendant ran an identical billing scheme at a prior employer. Analysis: Not admissible to show bad character, but admissible under FRE 404(b) to show intent, plan, knowledge or absence of mistake.

9. Exam Tips: Answering Questions on Admissibility, Authentication and Chain of Custody

Tip 1 – Know the three-word test cold. Relevant, material, competent. If a question describes evidence that logically bears on the case but a rule (hearsay, privilege) blocks it, the answer is that it is not competent. If it bears on something not actually in dispute, it is not material. If it has no tendency to prove anything, it is not relevant.

Tip 2 – Remember the direction of the FRE 403 balance. Relevant evidence is excluded only when probative value is substantially outweighed by unfair prejudice. Answer choices that say evidence is excluded whenever it is prejudicial are wrong; almost all incriminating evidence is prejudicial.

Tip 3 – Authentication is a low bar. The standard is evidence sufficient to support a finding that the item is what it is claimed to be. Choices requiring certainty, or requiring the photographer to authenticate a photograph, are distractors. Any witness familiar with the scene can authenticate a photo.

Tip 4 – Chain-of-custody gaps usually go to weight, not admissibility. Unless the question says the gap suggests tampering or the court is applying a strict criminal standard, the best answer is that a break makes the evidence less persuasive or may render it inadmissible, not that it automatically excludes it. Watch for absolute words like always and never.

Tip 5 – Memorize what the chain-of-custody memorandum must contain. What the item is, when it was received, from whom, where it was received, who has had custody since, and where/how it has been stored. A question asking which item does not belong will often insert something like the examiner's opinion of guilt or the market value of the item.

Tip 6 – Originals versus copies. Work on copies; preserve originals; initial/date originals discreetly (typically on the back) or use tags; never write on the face of an original. For the best evidence rule, remember that duplicates are generally admissible, that printouts of electronic data are originals, and that summaries of voluminous records are admissible if the underlying records are made available.

Tip 7 – Distinguish hearsay from non-hearsay. A statement by the opposing party is not hearsay. A business record is hearsay but admissible under an exception if made in the regular course of business at or near the time by someone with knowledge. A document created for litigation does not qualify as a business record.

Tip 8 – Know the 404(b) purposes list. Motive, opportunity, intent, preparation, plan, knowledge, identity, absence of mistake or accident. If a question asks why prior fraudulent acts are admissible, the answer is one of these, never to show the defendant is a dishonest person.

Tip 9 – Digital evidence vocabulary. Write-blocker, forensic image, bit-stream copy, hash value. If a question asks how to demonstrate that a digital copy has not been altered, the answer is comparing hash values. If it asks how to prevent alteration during acquisition, the answer is a write-blocker.

Tip 10 – Self-authenticating documents. Expect a question listing several documents and asking which requires extrinsic authentication. Certified public records, notarized documents, official publications, newspapers, trade labels and certified business records are self-authenticating; a private, unsigned internal memo is not.

Tip 11 – Privilege nuances. Attorney-client privilege belongs to the client and can extend to a fraud examiner working under the direction of counsel (Kovel arrangement / work product). There is no federal accountant-client privilege. The Fifth Amendment protects individuals, not corporations, and protects testimony, not pre-existing records.

Tip 12 – Read the question stem for the standard being tested. Words like admissible, weight, authenticate, original and custody each signal a different rule. Identify the rule first, then evaluate the answer choices against it. Eliminate choices that confuse admissibility with credibility, or that describe practices (writing on originals, analyzing the original drive, leaving evidence unsecured) that violate recognized best practice.

Tip 13 – True/False items. The CFE Exam includes true/false questions. Statements such as Circumstantial evidence is inadmissible, A photograph can be authenticated only by the person who took it, or Any break in the chain of custody automatically renders evidence inadmissible are false. Statements such as Duplicates are generally admissible to the same extent as originals and Fraud examiners should assume every case may end in litigation are true.

10. Quick-Reference Summary

• Evidence forms: testimonial, real, documentary (plus demonstrative); direct or circumstantial.
• Admissibility test: relevant + material + competent; subject to FRE 403 balancing.
• Competence barriers: hearsay (with exceptions such as business records and party admissions), privileges, constitutional exclusion, best evidence rule.
• Authentication: evidence sufficient to support a finding the item is what it is claimed to be; methods under FRE 901; self-authenticating items under FRE 902 including certified electronic records.
• Best evidence rule: original required to prove content; duplicates generally admissible; electronic printouts are originals; summaries allowed for voluminous records.
• Chain of custody: documented record of who, what, when, where and how from collection to court; mark, secure, log, copy; digital evidence requires imaging, write-blocking and hashing; gaps usually affect weight but can lead to exclusion.
• Mindset: handle every piece of evidence as though it will be scrutinized by opposing counsel and a judge, because one day it may be.