Types of Evidence

1. Why Types of Evidence Matter for a Certified Fraud Examiner

Every fraud examination ultimately rests on evidence. A fraud examiner may have a strong suspicion, a clear motive, and a plausible theory, but none of that proves anything. What proves a case is evidence that is relevant, reliable, properly obtained, and legally admissible. Understanding the types of evidence is therefore foundational to the entire Investigation section of the CFE Exam and to the Collecting Evidence domain in particular.

Knowing the categories of evidence helps the examiner in several practical ways:
- It guides what to look for during an investigation (documents, testimony, physical items, electronic records).
- It shapes how evidence must be handled so that it survives legal challenge (chain of custody, authentication, best evidence rule).
- It helps the examiner evaluate strength of proof, for example recognizing that a case built entirely on circumstantial evidence is still valid but must be constructed carefully.
- It allows the examiner to communicate effectively with attorneys, law enforcement, and courts, who use these categories as a matter of routine.

On the exam, questions about types of evidence are among the most predictable and most frequently tested. They are largely definitional and conceptual, which means a candidate who learns the distinctions well can bank these points reliably.

2. What Is Evidence?

In the ACFE framework, evidence is anything perceivable by the five senses, together with any proof such as testimony, documents, records, or tangible objects, that is legally presented at trial to prove a contention and induce belief in the minds of the fact-finder (judge or jury). More simply, evidence is the material used to establish or disprove facts in dispute.

For evidence to be admitted in a legal proceeding it must generally be relevant (it tends to make a fact of consequence more or less probable), material (it relates to an issue that actually matters in the case), and competent (it is reliable and not excluded by a rule of law such as privilege or the hearsay rule). The exam expects you to recognize these three threshold requirements.

3. The Major Classifications of Evidence

Evidence can be classified along two separate dimensions. The first dimension concerns how the evidence proves a fact (direct versus circumstantial). The second dimension concerns the form the evidence takes (testimonial, documentary, real/physical, demonstrative). These classifications overlap: a single piece of evidence can be, for example, both documentary and circumstantial. Keep the two dimensions separate in your mind and you will avoid most exam traps.

3.1 Direct Evidence

Direct evidence proves a fact directly, without requiring any inference or presumption. If the evidence is believed, the fact is established. The classic example is eyewitness testimony: a witness who states, I saw the controller remove cash from the safe and place it in her purse, is offering direct evidence of the theft. A written confession is also direct evidence. A surveillance video showing the act itself is direct evidence.

The defining feature is the absence of an inferential step. The fact-finder does not need to reason from one fact to another; the evidence speaks to the disputed fact itself.

3.2 Circumstantial Evidence

Circumstantial evidence (sometimes called indirect evidence) proves a fact indirectly. It establishes one or more facts from which the fact-finder can infer the existence of the disputed fact. For example, evidence that the controller was the only person with the safe combination, that she was in the office alone when the cash disappeared, and that she deposited an identical amount of cash into her personal account the next morning does not directly show her taking the money, but it supports a reasonable inference that she did.

Important exam points about circumstantial evidence:
- It is fully admissible and legally sufficient to support a conviction or judgment. There is no rule requiring direct evidence.
- Most fraud cases are proven circumstantially. Fraud is a crime of concealment; perpetrators rarely act in front of witnesses, so the examiner typically assembles a chain of circumstances (altered documents, unexplained wealth, missing records, patterns of transactions) that collectively point to guilt.
- Because it depends on inference, circumstantial evidence should be corroborated and presented in an organized, cumulative fashion. Individually weak items can be collectively compelling.
- Evidence of motive, opportunity, and lifestyle changes (such as sudden unexplained wealth) is classic circumstantial evidence in fraud cases.

3.3 Testimonial Evidence

Testimonial evidence is oral or written statements made by witnesses under oath, whether at trial, in a deposition, or by affidavit. It includes the testimony of fact witnesses (people who perceived something relevant) and expert witnesses (people qualified by knowledge, skill, experience, training, or education who may offer opinions to assist the fact-finder). A CFE frequently serves as an expert witness and must understand that an expert can offer opinions whereas a lay witness is generally limited to facts personally observed.

Testimonial evidence can be direct (the witness saw the act) or circumstantial (the witness saw the suspect near the scene). Its reliability depends on the credibility of the witness, which the opposing side may attack through cross-examination and impeachment.

3.4 Documentary Evidence

Documentary evidence consists of documents and records, in any form, offered to prove their contents. In fraud examinations this is the single most important category and typically forms the backbone of the case. Examples include invoices, contracts, bank statements, canceled checks, general ledger entries, emails, text messages, computer files, and electronically stored information (ESI).

Key rules associated with documentary evidence:
- Authentication: The proponent must show the document is what it purports to be. This can be done through testimony of a person with knowledge, by comparison with authenticated specimens, by distinctive characteristics, or through self-authentication for certain public records and certified copies.
- Best Evidence Rule (Original Writing Rule): To prove the contents of a writing, recording, or photograph, the original is generally required. However, under modern rules a duplicate (such as a photocopy or electronic copy) is admissible to the same extent as the original unless a genuine question is raised about the authenticity of the original or it would be unfair to admit the duplicate. Secondary evidence (testimony about contents) may be admitted when the original is lost or destroyed without bad faith, cannot be obtained, or is in the opponent's possession.
- Business Records Exception to Hearsay: Records made at or near the time of the event, by or from information transmitted by a person with knowledge, kept in the course of a regularly conducted business activity, where making the record was a regular practice, are admissible despite being technically hearsay. This is why accounting records can be introduced without calling every bookkeeper who made an entry.
- Chain of custody: Documents collected during an investigation must be tracked from the moment of acquisition to presentation in court, showing who had possession, when, and what was done with them.

3.5 Real (Physical) Evidence

Real evidence, also called physical evidence or tangible evidence, consists of actual physical objects that played a role in the matter at issue. Examples include a forged check itself, a counterfeit product, a hard drive, a weapon, or fingerprints. In fraud examinations, items like a suspect's computer, a safe, altered inventory tags, or seized cash are real evidence.

Real evidence must be authenticated by showing it is the actual item and that it has not been altered. This is where chain of custody is most critical: each transfer of possession must be documented, and the item should be stored securely with tamper-evident packaging and identifying marks (initials, date, case number).

3.6 Demonstrative Evidence

Demonstrative evidence is not itself proof of the underlying fact but is created to illustrate, explain, or clarify other evidence. Examples include charts, graphs, timelines, summaries, diagrams, maps, models, and computer animations. For a CFE, a flowchart showing how funds moved through a series of shell companies, or a summary schedule totaling hundreds of fraudulent invoices, is demonstrative evidence.

Demonstrative evidence is admissible when it is a fair and accurate representation of the underlying evidence and will help the fact-finder understand the case. Summaries of voluminous records are specifically permitted under the rules of evidence, provided the underlying documents are made available to the opposing party. Demonstrative evidence must not be misleading or unduly prejudicial.

4. Other Evidence Concepts Frequently Tested Alongside Types of Evidence

Hearsay is an out-of-court statement offered to prove the truth of the matter asserted. It is generally inadmissible because the declarant was not under oath and cannot be cross-examined. Numerous exceptions exist, including business records, public records, excited utterances, statements against interest, and admissions by a party-opponent (a suspect's own statements offered against him are not treated as hearsay under the federal rules).

Privileged communications (attorney-client, work product, spousal, physician-patient, clergy) may be excluded even if relevant. Fraud examiners working under the direction of counsel may extend the attorney work product protection to their investigative materials.

Opinion evidence from lay witnesses is restricted to rationally based perceptions; expert opinion is permitted if the expert is qualified, the testimony is based on sufficient facts, uses reliable methods, and applies them reliably to the facts (the Daubert standard in U.S. federal courts).

Character evidence is generally inadmissible to show that a person acted in conformity with that character on a particular occasion, with limited exceptions. Evidence of other crimes, wrongs, or acts may be admissible to show motive, intent, plan, knowledge, identity, or absence of mistake, which is highly relevant in fraud cases where intent is the central issue.

5. How Types of Evidence Work Together in a Fraud Examination

In practice, a fraud examiner builds a case in layers. Documentary evidence (bank records, ledgers, emails) usually comes first and establishes the paper trail. Real evidence (the suspect's computer, the altered checks) is collected and preserved with strict chain of custody. Testimonial evidence from co-workers, vendors, and ultimately the suspect fills in context and may yield an admission. Demonstrative evidence is then prepared to present the complex pattern clearly to a fact-finder. Throughout, the examiner recognizes that most of the case is circumstantial and so organizes the evidence to make the inference of fraud compelling and the innocent explanations implausible.

The ACFE methodology also stresses that evidence should be gathered in a logical sequence, typically moving from the general to the specific and from neutral third-party witnesses to co-conspirators and finally to the subject. Documents are generally gathered before interviews so that interviewers can confront inconsistencies. All evidence, regardless of type, must be obtained legally; evidence obtained improperly may be excluded and may expose the examiner and employer to civil liability.

6. Exam Tips: Answering Questions on Types of Evidence

Tip 1: Separate the two dimensions. When a question asks you to classify evidence, first determine whether it is asking about the method of proof (direct versus circumstantial) or the form (testimonial, documentary, real, demonstrative). Do not confuse the two. A photocopy of a forged invoice is documentary evidence in form; whether it is direct or circumstantial depends on what fact it is offered to prove.

Tip 2: Look for the word inference. If the evidence requires the fact-finder to infer the disputed fact from other facts, it is circumstantial. If the evidence, if believed, establishes the fact by itself, it is direct. Eyewitness accounts of the act and confessions are the standard examples of direct evidence; motive, opportunity, and unexplained wealth are the standard examples of circumstantial evidence.

Tip 3: Remember that circumstantial evidence is sufficient. A common distractor suggests that fraud cannot be proven without direct evidence or that circumstantial evidence is inferior or inadmissible. Both are false. The exam wants you to know that most fraud cases are proven circumstantially and that circumstantial evidence can be just as persuasive as direct evidence.

Tip 4: Distinguish real from demonstrative. Real evidence is the actual object involved in the events. Demonstrative evidence is something created later to illustrate. The actual forged check is real evidence; a blown-up photograph of the check used at trial to point out the alteration is demonstrative. A summary schedule of fraudulent transactions is demonstrative; the underlying invoices are documentary.

Tip 5: Know the best evidence rule precisely. Questions often test whether a photocopy is admissible. Under modern rules, a duplicate is admissible to the same extent as an original unless there is a genuine question about the original's authenticity or admitting the duplicate would be unfair. Also remember when secondary evidence is allowed: the original is lost or destroyed without bad faith, unobtainable, or in the opponent's possession.

Tip 6: Connect documentary evidence to the business records exception. If a question describes accounting records, invoices, or routine business logs being offered in court, the likely issue is hearsay and the likely answer involves the business records exception. Know its elements: made at or near the time, by someone with knowledge, kept in the regular course of business, as a regular practice.

Tip 7: Chain of custody applies to all tangible evidence. Questions about real and documentary evidence frequently pivot to chain of custody. Remember the goal: to prove the item presented is the same item collected and that it has not been altered. Document every transfer, mark items for identification, and store them securely.

Tip 8: Watch for lay versus expert opinion. If a question involves a witness offering an opinion, determine whether the witness is a qualified expert. Lay witnesses are limited to what they perceived; experts may offer opinions within their field of expertise.

Tip 9: Read the question for the word except or not. Many CFE questions ask which item is NOT an example of a particular type of evidence. Slow down, classify each option, and eliminate systematically.

Tip 10: Apply the ACFE definitions, not local practice. The exam is based on the Fraud Examiners Manual. Where your jurisdiction's rules differ, answer according to the ACFE text. The exam uses U.S. federal rules of evidence as its general framework for the Law section but tests evidence types conceptually in the Investigation section.

7. Quick Reference Summary

- Direct evidence: proves a fact without inference (eyewitness, confession, video of the act).
- Circumstantial evidence: proves a fact by inference (motive, opportunity, unexplained wealth, pattern of transactions). Fully admissible; the basis of most fraud cases.
- Testimonial evidence: statements of witnesses under oath; includes lay and expert testimony.
- Documentary evidence: writings and records offered to prove their contents; subject to authentication, best evidence rule, and hearsay rules (business records exception).
- Real evidence: the actual physical objects involved; requires authentication and chain of custody.
- Demonstrative evidence: charts, summaries, timelines, and models created to illustrate other evidence; must be fair and accurate.
- Threshold tests for admissibility: relevant, material, competent.

Master these distinctions, practice classifying scenarios quickly, and the Types of Evidence questions on the CFE Exam will become some of the easiest points you earn.