Collecting, Storing and Disposing of Evidence

Why This Topic Matters
Evidence is the backbone of every fraud examination. A fraud examiner can conduct brilliant interviews and uncover damning transactions, but if the evidence was gathered improperly, stored carelessly or destroyed prematurely, it may be excluded from court, challenged as tampered with, or lost altogether. Opposing counsel will attack the handling of evidence when they cannot attack its content. For this reason the ACFE devotes significant attention to how evidence is obtained, how it is preserved and documented, and how it is eventually disposed of. On the CFE Exam, this material appears in the Investigation section, and questions frequently test precise procedural rules (for example, how to mark an original document or who had custody at each stage). Knowing these rules protects the integrity of the examination, the credibility of the examiner and the admissibility of the findings.

What Is Meant by Collecting, Storing and Disposing of Evidence?
The topic covers the full life cycle of physical and documentary evidence in a fraud examination:
• Collecting – legally obtaining documents, records, physical items and electronic data that tend to prove or disprove an allegation.
• Storing – preserving, marking, logging, organizing and securing that evidence so it remains authentic, unaltered and traceable.
• Disposing – returning, retaining or destroying evidence only when it is legally and procedurally appropriate to do so.
Running through all three phases is the chain of custody, the documented, unbroken record of every person who has possessed the evidence from the moment it was obtained until it is presented in court or disposed of.

How It Works – Part 1: Collecting Evidence
Lawful methods of obtaining documents. The Fraud Examiners Manual identifies three principal ways evidence is obtained:
1. Voluntary consent – the owner or custodian willingly provides the records. Consent should be documented, preferably in writing, and must be given by someone with authority over the items.
2. Subpoena – a legal order (issued through a court or grand jury) compelling production of documents or testimony. Fraud examiners who are not attorneys or law enforcement generally obtain subpoenas through counsel.
3. Search warrant – available only to law enforcement, issued by a judge upon a showing of probable cause. Private examiners cannot execute search warrants, though they may assist authorities.
Private-sector examiners must also respect employee privacy, company policy, confidentiality agreements and data-protection laws when gathering evidence.

Obtain originals when feasible. Original documents are the strongest form of documentary evidence and satisfy the best evidence rule. Copies may be admissible when originals are unavailable through no bad faith of the proponent, but the examiner should always try to secure the original first and work from copies afterward.

Document the receipt. At the moment evidence is received, the examiner should prepare a memorandum (an evidence or chain-of-custody memo) recording:
• what item was received and a detailed description of it;
• the date and time it was received;
• from whom it was received and that person's authority to provide it;
• where and how it was obtained;
• who received it and where it will be maintained.
Each later transfer must be recorded in the same way, with signatures and dates, so the chain is never broken.

Handle evidence minimally. Documents should be handled as little as possible. Where fingerprints or forensic examination may matter, use gloves and place items in protective (clear plastic or paper) envelopes. Never fold, staple, paper-clip, highlight, write on or otherwise alter an original.

Electronic evidence. Digital data should be collected by, or under the guidance of, qualified computer forensic specialists. The rule is to create a forensically sound image (bit-for-bit copy) using write-blocking tools, verify it with hash values (e.g., MD5 or SHA), and perform all analysis on the copy, never the original media. Metadata and system logs must be preserved, and the collection process documented in the chain of custody just like physical items.

How It Works – Part 2: Storing and Preserving Evidence
Marking evidence. Every item must be uniquely identifiable. The accepted practice is to mark evidence with the examiner's initials and the date of receipt, placed on the protective envelope or evidence tag, or, if directly on the item, in an inconspicuous location that does not obscure or damage the content. A unique control number is assigned, and large document sets are often Bates-numbered (sequentially stamped) so every page can be referenced precisely.

Make working copies. Once logged and marked, originals are placed in secure storage and the examiner works exclusively from copies. Copies should be clearly identified as copies and cross-referenced to the original's control number.

Secure storage. Originals must be kept in a locked, access-restricted location (safe, locked cabinet or evidence room), protected from fire, water, heat and humidity. Access should be limited to a small number of named individuals, and every removal and return should be recorded in an evidence log. Electronic images should be stored on secure, backed-up media with hash values re-verified when accessed.

Organizing the evidence. Fraud cases often generate thousands of pages. The Manual recommends:
• Segregating documents by witness or by transaction, depending on how the case will be presented;
• Maintaining a key document file containing the most important exhibits, with the bulk of documents kept separately;
• Preparing a chronology of events so the story can be told in sequence;
• Keeping a document database or index (date, source, description, control number, relevance) for rapid retrieval;
• Establishing a theory of the case early so documents are organized around what must be proved.
Good organization is itself a preservation tool: evidence that cannot be found or explained is effectively lost.

How It Works – Part 3: Disposing of Evidence
Disposal is the most frequently mishandled phase. Key principles:
• Never dispose of evidence while a matter is pending or reasonably anticipated. Destroying relevant material after litigation is foreseeable constitutes spoliation, which can lead to sanctions, adverse inferences, dismissal or criminal exposure.
• Wait until the case is fully resolved – including appeals, regulatory actions and any related civil or criminal proceedings – and until applicable record-retention periods have expired.
• Obtain approval from legal counsel (and, where relevant, the client or law enforcement) before destroying or returning anything.
• Return property to its rightful owner when appropriate and obtain a signed receipt that becomes the final entry in the chain of custody.
• Destroy securely – shred paper, and use forensic wiping or physical destruction for digital media – and document the destruction (what, when, how, by whom, under whose authority).
• Follow a written retention and disposal policy. Organizations should have a records-retention schedule and a litigation-hold procedure that suspends routine destruction the moment an investigation or lawsuit is anticipated.

Common Pitfalls Tested on the Exam
• Writing notes or highlighting directly on an original document.
• Allowing undocumented transfers of evidence (gaps in the chain of custody).
• Analyzing original computer media instead of a verified image.
• Failing to record the source and date when evidence is received.
• Discarding documents under a routine retention schedule after litigation becomes foreseeable.
• Assuming a private fraud examiner can execute a search warrant.
• Storing evidence in an unsecured desk drawer or shared network folder.

Exam Tips: Answering Questions on Collecting, Storing and Disposing of Evidence
1. Think 'chain of custody' first. If a question describes evidence changing hands, the correct answer almost always involves documenting who received it, when, from whom and where it is kept. A break in the chain is the classic reason evidence becomes vulnerable to challenge.
2. Originals vs. copies. Remember the rule: obtain originals when feasible, secure them, and work from copies. If an answer suggests analyzing or annotating the original, it is wrong.
3. Marking. The expected answer is initials and date on the protective envelope or in an inconspicuous spot, plus a unique identifier. Any option involving marking that alters or obscures the document is a distractor.
4. Three ways to obtain documents. Memorize consent, subpoena and search warrant, and recall that only law enforcement executes search warrants.
5. Organization methods. Expect questions on segregating documents by witness or transaction, building a chronology, and keeping a key document file. If asked for the best way to organize a large volume of documents, a database/index with a chronology is typically the answer.
6. Digital evidence equals image plus hash. Forensic image, write blocker, hash verification, analysis on the copy. Questions about seizing a computer are testing whether you know not to boot or examine the original.
7. Disposal timing. The correct answer always errs on the side of retention: dispose only after all proceedings (including appeals) are concluded, retention requirements are met, and counsel approves. Watch for 'spoliation' and 'litigation hold' as key terms.
8. Watch for absolute words. Options containing 'always destroy', 'never need documentation' or 'any employee may release' are usually incorrect. The CFE Exam rewards cautious, well-documented procedure.
9. Read the role in the scenario. Whether the examiner is a private investigator, internal auditor or law enforcement officer changes what legal tools are available (for example, subpoena through counsel versus search warrant).
10. Apply the 'would this survive cross-examination?' test. When torn between two answers, choose the one that would best withstand an attorney asking how you can prove the evidence is authentic and unaltered.

Quick Review Summary
Collect lawfully (consent, subpoena, warrant); obtain originals; document receipt immediately; handle minimally; mark with initials, date and control number; make working copies; store originals in secure, access-logged locations; organize by witness/transaction with a chronology and key document file; image digital media and verify with hashes; maintain an unbroken chain of custody; never dispose of evidence while a matter is pending or foreseeable; dispose only with counsel approval, after all proceedings and retention periods end, and document the destruction or return. Master these steps and you will handle both real-world evidence and CFE Exam questions on this topic with confidence.