In the CFE framework, evidence is any information presented to prove or disprove a fact at issue. A fundamental distinction under the Basic Principles of Evidence is between direct and circumstantial evidence, and fraud examiners must understand both because fraud cases are rarely built on one type alone.

Direct evidence proves a fact directly, without requiring any inference or presumption. If believed, it establishes the fact in question by itself. Classic examples include an eyewitness who saw the suspect alter a check, a signed confession admitting to embezzlement, a video recording of an employee removing cash from a safe, or a document that explicitly states the fraudulent act. The fact-finder need only decide whether the evidence is credible; no logical leap is needed to connect it to the conclusion.

Circumstantial evidence, by contrast, proves a fact indirectly. It establishes one or more facts from which the existence of the fact at issue can be reasonably inferred. In fraud examinations, circumstantial evidence is extremely common because perpetrators conceal their actions and rarely leave direct proof. Examples include an employee living far beyond their means, unexplained bank deposits coinciding with missing funds, altered accounting entries traced to a specific user login, destroyed records, or a pattern of vendor payments to a shell company owned by the suspect's relative. Each piece alone may be innocent, but together they create a chain of inference pointing to guilt.

Legally, courts generally give circumstantial evidence the same weight as direct evidence; a conviction can rest entirely on circumstantial proof if it excludes every reasonable hypothesis of innocence. For the CFE, this means building a case methodically: gather documentary and physical evidence, establish motive, opportunity, and concealment, corroborate each inference, and maintain a proper chain of custody. Strong circumstantial cases often prompt confessions, which then supply direct evidence. Understanding the interplay between the two helps the examiner present a persuasive, admissible case.

In the Certified Fraud Examiner (CFE) framework, the Basic Principles of Evidence govern how information gathered during an investigation can be used in legal proceedings. Three foundational concepts are admissibility, authentication, and chain of custody.

Admissibility refers to whether evidence may be considered by a court or tribunal. To be admissible, evidence must generally be relevant (it tends to prove or disprove a fact at issue), material (it relates to a significant issue in the case), and competent (it is reliable and not excluded by a legal rule such as hearsay, privilege, or illegal seizure). Fraud examiners must anticipate admissibility challenges when collecting documents, interviews, and digital data, because improperly obtained or unreliable evidence may be excluded regardless of how persuasive it appears.

Authentication is the process of proving that evidence is what it purports to be. A document, email, financial record, or recording must be shown to be genuine before a court will accept it. Authentication can be established through witness testimony (e.g., a records custodian verifying business records), distinctive characteristics, expert analysis such as handwriting or forensic accounting comparison, or metadata and hash values for electronic evidence. Without proper authentication, even relevant evidence may be deemed inadmissible.

Chain of custody is the documented, chronological record showing who collected, handled, transferred, stored, and analyzed each item of evidence from the moment it was obtained until it is presented in court. Each transfer should be logged with dates, times, names, signatures, and the purpose of the handoff. A complete chain of custody demonstrates that the evidence has not been altered, substituted, or contaminated. Gaps or inconsistencies invite challenges that can undermine authentication and lead to exclusion.

Together, these principles ensure that a fraud examiner's findings withstand legal scrutiny, protect the integrity of the investigation, and support fair adjudication.

Impeachment of witnesses is the process of attacking the credibility of a witness so the fact-finder (judge or jury) gives less weight to that witness's testimony. For Certified Fraud Examiners, understanding impeachment is essential both when testifying as an expert or fact witness and when evaluating the reliability of statements gathered during an investigation.

Under the Basic Principles of Evidence, any party—including the party that called the witness—may impeach a witness. Common methods of impeachment include:

1. Prior inconsistent statements: Showing that the witness previously said something that contradicts current testimony. This is why CFEs must document interviews carefully and ensure their reports are accurate and consistent.

2. Bias, interest, or motive: Demonstrating that the witness has a personal stake in the outcome, a relationship with a party, or a reason to shade the truth, such as a fee arrangement or prior employment.

3. Character for untruthfulness: Introducing evidence of the witness's reputation or opinion testimony that the witness is dishonest.

4. Prior convictions: Evidence of certain criminal convictions, particularly those involving dishonesty or false statements, or serious felonies within a specified time period.

5. Defects in perception or memory: Challenging the witness's ability to observe, recall, or communicate the facts accurately, including intoxication, poor eyesight, or the passage of time.

6. Contradiction: Presenting other evidence that disproves specific facts the witness asserted.

For expert witnesses such as CFEs, impeachment often focuses on qualifications, methodology, prior inconsistent reports or publications, and compensation. Opposing counsel may also attempt to show that the expert relied on incomplete data or exceeded the scope of expertise.

To withstand impeachment, a fraud examiner should prepare thoroughly, review all prior statements and reports, maintain objectivity, avoid overstating conclusions, and admit limitations candidly. Credibility, once damaged, is difficult to rehabilitate, though the calling party may attempt rehabilitation through prior consistent statements or evidence of truthful character.

In the CFE context, the Basic Principles of Evidence recognize that certain communications are protected from compelled disclosure through privilege. Two closely related doctrines are Legal Professional Privilege (sometimes called Attorney-Client Privilege in the United States) and Litigation Privilege.

Legal Professional Privilege protects confidential communications between a client and their lawyer made for the purpose of obtaining or giving legal advice. Its rationale is to encourage clients to speak candidly with counsel so they can receive sound legal guidance. For the privilege to apply, the communication must be (1) between a lawyer and client (or their agents), (2) made in confidence, and (3) made for the dominant purpose of seeking or providing legal advice. The privilege belongs to the client, who alone may waive it. Importantly, the privilege does not protect underlying facts, communications made in furtherance of a crime or fraud (the crime-fraud exception), or communications shared with unrelated third parties, which may constitute waiver.

Litigation Privilege is broader in one respect: it protects confidential communications between a lawyer, client, or third parties (such as fraud examiners, forensic accountants, or expert consultants) when the dominant purpose is preparing for existing or reasonably anticipated litigation. In the United States, the related concept is the work-product doctrine, which shields an attorney's mental impressions, strategies, and materials prepared in anticipation of litigation. This privilege is significant for CFEs because investigative reports, interview notes, and analyses may be protected only if the engagement is structured properly—typically when the fraud examiner is retained by counsel rather than directly by the organization.

Practical implications for fraud examiners include: documenting the litigation purpose of an engagement, routing communications through counsel, marking documents as privileged, limiting distribution, and avoiding inadvertent waiver by sharing findings with regulators, insurers, or auditors without legal advice. Understanding these privileges helps CFEs protect sensitive investigative materials and avoid compromising a client's legal position.

Waiver of privilege, within the CFE's Basic Principles of Evidence, refers to the voluntary or inadvertent surrender of a legally recognized protection that would otherwise shield certain confidential communications from compelled disclosure in litigation or investigations. The most common privileges encountered by fraud examiners are the attorney-client privilege, the work-product doctrine, the spousal privilege, and the physician-patient privilege. Because a privilege belongs to the holder (for example, the client rather than the attorney), only the holder, or someone authorized to act on the holder's behalf, can waive it.

A waiver may occur in several ways. The clearest is express waiver, where the holder knowingly agrees to disclose the protected communication. More troublesome is implied waiver, which arises when the holder's conduct is inconsistent with maintaining confidentiality. Classic examples include disclosing privileged communications to a third party who is outside the circle of confidentiality, placing the advice of counsel 'at issue' as a defense in litigation, or failing to object when privileged material is requested. Inadvertent waiver can occur when privileged documents are accidentally produced during discovery; depending on the jurisdiction and the precautions taken, courts may or may not restore the privilege. Many jurisdictions also recognize subject-matter waiver, meaning that disclosing part of a privileged communication can waive protection for all communications on the same subject, preventing a party from selectively revealing only favorable information.

For CFEs, waiver issues are critical. Examiners are frequently retained by counsel so that their work falls under the attorney-client privilege or work-product protection. Sharing reports, interview notes, or findings with outside auditors, regulators, insurers, or management outside the privileged relationship can destroy that protection. Fraud examiners should therefore limit distribution of findings, mark documents appropriately, communicate through counsel, and avoid discussing conclusions with unauthorized parties. Understanding waiver helps preserve the integrity and admissibility strategy of the investigation.