All copy and transmission rights reserved by the IICFIP USA, Incorporation

MODULE NO. 2
This module covers Introduction to Forensic
Investigation & Step 1 to 3 of the forensic
investigation process.

Introduction
‘Forensic Investigation’ covers a broad spectrum of activities, with terminology not strictly

defined in regulatory guidance or law books. The term forensic investigation refers to any

inquiry that is aimed at gathering evidence for either disciplinary action or court proceedings.

Forensic investigation touches on many areas including forensic accounting, fraud/corruption

investigation. Generally, the term ‘forensic accounting’ is used to describe the wide range of

investigative work which accountants in practice could be asked to perform to sort out disputes

of financial nature. The work would normally involve an investigation into the financial affairs

of an entity and is often associated with investigations into alleged fraudulent activity. Forensic

Investigation refers to the whole process of investigating a financial matter, including potentially

acting as an expert witness if the fraud comes to trial. Although this module focuses on

investigations into alleged frauds, it is important to be aware that forensic investigators/

accountants could be asked to look into non-fraud situations, such as the settling of monetary

disputes in relation to a business closure or matrimonial disputes under insurance claims.

The process of forensic accounting as described above includes the ‘forensic investigation’ itself,

which refers to the practical steps that the forensic accountant takes in order to gather evidence

relevant to the alleged fraudulent activity. The investigation is likely to be similar in many ways

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

to an investigation of financial information, in that it will include a planning stage, a period when

evidence is gathered, a review process, and a report to the client. The purpose of the

investigation, in case of an alleged fraud, would be to discover if a fraud had actually taken

place, to identify those involved, to quantify the monetary amount of the fraud, and to ultimately

present findings to the client and possibly to court.

Ultimately, it refers to the precise measures carried out to produce valid evidence. Various

investigation techniques are usually used to recognize and to put together evidence to establish,

for instance, the duration the fraud has taken place, alongside how the whole thing has been

conducted and concealed by the people involved. Evidence may also be gathered to support other

issues which would be relevant in the event of a court case. Such issues could include:

 The suspect’s motive and opening to commit fraud;

 If the fraud involved collusion between several suspects

any physical evidence at the scene of the crime or contained in documents;

 Comments made by the suspect during interviews and/or at the time of arrest and

attempts to destroy evidence. Forensic investigation involves fraud investigating. Fraud

investigation is the examination of fraud allegations using documents collected from the

suspected fraud area or obtained externally via external confirmations.

Fraud investigating is narrower than forensic investigation since it just concentrates on fraud

whereas investigation skills apply to all situations requiring investigation skills.

More definitions of forensic investigation are as follows:

 Forensic investigation is simply defined as a Systematic Inquiry or Examination

to know what is happening or what happened with an aim to collect evidence for
or against the allegation. In financial investigations an investigation will be
referred to as a forensic investigation. For example; they conducted an
investigation or investigation into financial irregularities.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

 According to IICFIP Inc (www.iicfip.org), forensic investigation is the systematic

application of financial accounting, forensic accounting, digital forensics and
investigative skills to the gathering of evidence for use in court in support of or
against an allegation.

 ‘Forensic Investigation attempts to establish what actually went wrong, Why,

How, When, and who was involved, If it is financial Investigation, a further
attempt would be to establish What Sum of Money, Where is the money, and who
are involved and How they are involved. All supported with forensically analysed
evidences and proofs beyond reasonable doubts.’ Charles Keshinro (FCA, FCTI,
CFA, CFE, AIPMN, MBA).

 A forensic investigation is an allegation resolution technique or methodology. The

forensic investigator is hired to find out whether or not the information gathered
supports the allegation.

 There are many types of forensic investigations but I will restrict myself to
forensic investigation i.e. investigations of crimes like Fraud, Corruption, money
laundering and cyber Crimes.

 The steps that I am discussing under this book are generalized for all white collar
crimes and also apply to other forms of forensic investigations.

Going by the definition above, a forensic investigation must be carried out in a very systematic

manner in order to gather evidence to support or dispel an allegation. The 9 steps of forensic

investigation therefore sets out the systematic approach to investigation

Types of Investigation

The forensic investigators may be asked to do the investigation of many different types of fraud.

Thus, it is crucial that they categorize these types into three categories to avail an overview of a

wide range of investigations that could be done. These three categories of frauds include

financial statement fraud, corruption, and asset misappropriation. Forensic Investigators are also

called upon to investigate money laundering, terrorism and general crimes. Many have argued

that certified forensic investigators cannot investigate violent crime. This is a very narrow

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

thinking since any person who is well trained in the investigation process can investigate any

crime given the opportunity and legal backing.

Corruption

Corruption fraud can be put in three categories: extortion, conflicts of interest, and bribery.

According to various researches, corruption is involved in around one third of all frauds.

 Bribery; is when money is offered in order to influence a situation. Bribery also involves

the receiving of something of value to influence an official decision. Both the giver and

receiver are culpable in a bribery case that can be substantiated.

 Extortion; this is the opposite of bribery. It happens when one demands money to secure

or influence a particular outcome. It usually involves some kind of threat to denial of

services or rights if the bribe is not given.

 Conflict of Interest

While in conflict of interest fraud; the fraudster puts their influence to obtain a personal

gain that ultimately affects the company. In some cases, though the fraudster may not

benefit financially, he/ she may receive an undisclosed personal benefit. For instance, a

manager may approve the expenses of an employee who is also a personal friend in order

to maintain that friendship, even if the expenses are erroneous. Conflict of interest may

also involve sitting together in the tender committee to discuss tenders where one of them

belongs to a relative.

Asset misappropriation

This is the most common type of frauds. In this category, there are several types of fraud which

can be listed as follows. The most known feature is the theft of cash or other assets from the

company, for example:

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

 Cash theft; this is basically the stealing of physical cash, such as the petty cash, from the

client’s company.

 Fraudulent disbursements; this happens when the company cash is being used to make

fraudulent payments. Examples include billing schemes. This is where minor/ major

payments are done to fictitious supplier. While payroll schemes is where payments done

to fictitious employees.

 Inventory frauds; this is the theft of inventory from the client company. This also

includes stock pilferages

 Misuse of assets; is committed when employees use company assets for their own

interest. Misuse of assets is the most subtle or all the types of assets misappropriation

since it does not necessarily involve taking the asset away.

Financial statement fraud

Also known as fraudulent financial reporting. It is a type of fraud which causes a material

misstatement in the financial statements. Fraudulent financial reporting includes deliberate

falsification of accounting records; balances or disclosures and omission of transactions from the

financial statements. It may also include the misapplication of financial reporting standards. It is

usually done with the intent of presenting the financial statements with a particular bias. For

instance, hiding liabilities to improve any analysis of gearing and liquidity.

Money laundering
What is money laundering?

Generally, each year large amounts of funds are earned from illegal activities like people

smuggling, arms trafficking, tax evasion drug trafficking, corrupt practices, people smuggling,

and theft. In most cases, these funds are usually in the form of cash. The perpetrators who

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

generate these funds want to bring them into the legitimate financial system without raising any

form of suspicion. To achieve this, they have to convert cash into other forms which makes it

more useable therefore less suspicious. In addition, it also puts a distance in between the

perpetrators activities and the funds.

It is the name given to the procedure by which an illegally obtained funds are made to

appearance legitimately.

General Crimes:

This refers to crimes like murder, robbery, theft for goods, rape and many others. Certified

Forensic Investigation Professionals (CFIPs) who understand the investigation steps well do a

good job in investigating those crimes also. In fact, the aim of thisModule is to develop a strong

systematic inquiry approach that can apply to any type of investigation.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Preliminary Review
Introduction

What is Preliminary Investigation?

Preliminary review is any inquiry carried out before the actual investigation to enable the

investigator to make a decision whether to take the assignments or not. This is also referred to as

pre-engagement assessment. This is step one in the forensic investigation process.

Nature and Purpose of preliminary investigation

The preliminary review is a pre-investigation engagement exercise that seeks to find out facts

about the following:

1. Complexity of the client’s operations.

2. The possibility of the perpetrators alleged wrong doing of the alleged case ending up in

court.

3. The objectives of the client in the investigations.

4. The client’s industry.

5. The regulations touching on the client.

6. The expectations of the client as to completion of the investigations.

7. The suspects of the alleged wrong doing if any.

8. The witnesses of the suspected wrong doing if any.

9. Know the client and the nature of his business.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

When is preliminary investigation required?

A preliminary investigation is required to be conducted before the signing of the contract so that

the investigator enters into the assignment agreement much aware of what is required of him and

his team. Preliminary review must be carried out every time a certified forensic Investigation

Professional (CFIP) is approached for forensic assignments so that he/she does not rush into

what he/she doesn’t understand well.

This is the first stage of the investigation

I call this stage 'Preliminary Review’. This comes before proper engagement. If one considers

himself not fully qualified to complete the investigation, he can either disqualify himself or

engage other qualified professionals to reinforce his team. ‘I would also add that you should find

out the client's objectives for the investigation - do they want to prosecute? Do they want to

terminate someone's employment? Is their focus on finding out exactly how and why the incident

happened so as to prevent a repetition? Do they want to try and recover lost or stolen assets or

cash? Or is it a combination of one or more of these things?’ Danny McLaughlin, 2013.

Preliminary review can safely be considered the initial stage of any investigation. Basically, in

this step, the investigator seeks to get basic information which will guide them in coming up with

a defendable quote proposal to the client. It is done both prior and at the start of the actual

assignment.

This step mainly reviews the area(s) which have been affected by the fraud or the respective

white collar crime thereby providing an opportunity for coming up with a rough estimate of the

time, and expertise needed to successfully execute the investigation. This step not only assists

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

the investigator get an understanding of the nature of the investigation it also helps them in

understanding the scope or extent of the assignment.

During preliminary step the Certified Forensic Investigation Professional may seek all

information to enable him/her develop better understanding of the client’s operations and nature

of business.

According to Livingstone Ochan, Director for Investigation, South Sudan Anti Corruption

Commission, and the initial step in forensic investigation understands the client's business

environment and all this information leads to the signing of the engagement contract letter.

Engagement contract letter is simply a letter showing a legal binding between two parties.

According to me, however, the discussion and signing of an engagement letter is the second step

in any investigation.

The process of conducting a forensic investigation is, in many ways, similar to the process of

conducting an investigation, but with some additional considerations.

Important information about the allegation(s)

During preliminary review, the Certified Investigation Professional (CFIP) will be in a position

to gather the following information:

 Time or period of the alleged wrong doing perpetrations.

 The types of alleged wrong doing.

 How the client got information about the alleged wrong doing i.e. how was the offense

detected and who reported it.

 The crime scene i.e. the location of the alleged wrong doing

 Does some evidence exist in the form of documents or tangible items indicating the

possibility of wrong doing? If some evidence is available, it has to be collected and be

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

examined by the investigator to establish the probability of the existence or otherwise of

the alleged offence.

Considerations When Accepting the Engagement.

1. Is the investigator up to the assignment
2. Does he/she have the capacity to have the nature of the investigation?
3. Does he/she have a team with the required skills and experience?
4. Does he/she have the time required to complete the job.
5. Does he/she have access to the special experts required for the perfect completion of the
assignment?
6. If the international /cross boarder operations are required, does he/she have the requisite
resources, experience and skills?
7. Experiences in similar assignments in the past
8. The objectives of the client

Accepting the investigation

The forensic investigator must initially consider whether their firm has the necessary skills and

experience to accept the assignment. All investigations in Forensics are specialist in nature.

Meaning, the work needs detailed knowledge of investigative skills alongside a legal framework.

Forensic Investigators have to have received training in interrogation and interview techniques,

and in maintaining the safe custody of evidence gathered/ collected.

Further considerations comprise whether or not the investigation is being requested by an

investigation client. Should it be, this poses extra ethical inquiries, since the investigating firm

would be potentially exposed to advocacy management and self-review threats to objectivity.

Except robust safeguards are used, the client must not provide investigation and forensic

investigation services to the same client/ firm. In most cases, commercial considerations are

crucial, and a high fee level ought to be negotiated to compensate for the specialist nature of the

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

duty, and the like hood of the involvement of senior and experienced members of the firm in the

investigation.

Factors to be considered in accepting a forensic assignment are;

1. Competence

This refers to relevant academic and professional training and qualifications. If the

investigator lacks the skills and qualifications required and cannot find professionals with

the right skills to employ, he or she has to decline from taking up the assignment and

recommend someone else.

2. Capacity

Does the investigator or his investigation team have capacity in terms of resources to

complete the assignment to the satisfaction of the client and within the time limits set by

the client? If not, then he or she does not have capacity to complete the assignment and

therefore must decline. Capacity here refers to the equipments, finance, and personnel

required for the completion of the assignment to professional standards.

3. Experience

Relevant experience in similar assignments.

4. Availability

Is the investigator available for the assignment? If he or she can not have the time

required to complete the assignment, he or she should let someone carry out the

assignment.

5. Independence.

Is there any semblance of conflict of interest? Is the investigator going to investigate

relatives or business associates or close friends? If so, then there exists conflict of interest

and therefore he or she must decline the assignment.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

How to prepare and Conduct a Preliminary review

This is how to prepare for and conduct a preliminary review.

1. Book appointment with prospective client

2. Attend the meeting and interview the illicit, seek a detailed account of the alleged

offence(s). Forensic investigator must request the client to agree to preliminary

enquiries about his business before an engagement contract is arrived at.

3. Examine the financial statements of the client.

4. Examine the external Investigator’s reports

5. Ask for the organization structure of the client’s organization.

6. Review the client’s business environment.

Based on my experience, step number one in a forensic investigation includes understanding the
client's business environment. The Client's business environment includes but not limited to the
following:
1. The structure of the Organization;

2. Internal controls and security systems;

3. Nature of business;

4. ICT systems in use and the extent of reliance on those systems;

5. The complexity of the organization's operations;

6. The Client's industry within which they operate;

7. Number of total staff in the area of investigation; and

8. The possibility of having the incident linking to the client's branches or subsidiaries or

suppliers and customers.

At this step, the investigator is mainly interested in knowing the extent of the incident. That is,

the complexity of the client's operations, which may have an impact on the effectiveness of the

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

investigation. In addition, the investigator seeks to know whether or not the organization is

working in a highly regulated industry.

The information gathered in this stage has a great bearing especially in planning and resource

allocation for the investigation. In fact, from my own experience, it is this information, which

determines the overall contract’s quote. Poor review of the client's environment would culminate

into under quotes and over estimation of the investigator(s) team's ability to deliver.

Certified Forensic Investigators like any other professionals are expected to engage specialized

experts to handle unique areas of the investigation. For instance the gathering of computer and

digital evidence. The need of a special expert is determined at this first and most important stage.

Interview with the witness(s)

The need to consider a video-recorded interview will not always be immediately apparent, either

to the first police officer who has contact with the witness or to other professionals involved

prior to the police being informed. Even where it is apparent, the need to take immediate action

in terms of securing evidence and making initial decisions about the criminal investigation plan

might be such that some initial questioning is necessary.

Any initial questioning should be intended to elicit a brief account of what is alleged to have

taken place; a more detailed account should not be pursued at this stage but should be left until

the formal interview takes place. Such a brief account should include where and when the

alleged incident took place and who was involved or otherwise present. This is because this

information is likely to influence decisions made in respect of the following aspects of the

criminal investigation plan:

 Forensic and medical examination of the victim;

 Scene of crime examination;

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

 Interviewing of other witnesses;

 Arrest of alleged offender(s);

 Witness support.

In these circumstances, any early discussions with the witness should, as far as possible, adhere

to the following basic principles:

 Listen to the witness.

 Never stop the witness who is freely recalling significant events.

 Should need be ask questions as far as possible in the circumstances be open-ended.

 Ask no more questions than are necessary in the circumstances to take immediate action.

 Create a comprehensive note of the discussion, taking care to record the timing, setting

and people present as well as what was said by the witness and anybody else present.

 Come up with a note of the demeanor of the witness and anything else that might be

relevant to any subsequent formal interview or the wider investigation.

 Record exclusively any comments made by the witness or events that might be relevant

to the legal process up to the time of the interview.

Make a decision whether to take up the assignment or not.

After all the considerations of Preliminary review, the Certified Forensic Investigation

Professional should make a decision to get started on the engagement or not. If he/she

decides that the assignment is well within his resources to complete it to the professional

standards, he/she must ask the client to sign an engagement contract.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

What if a decision is made to decline the assignment?

Some of my students have argued that it would be money lost in terms of time wasted in carrying

out the pre-engagement assessment if the assignment is not accepted. They therefore suggest

that, one enters into a pre-engagement agreement to carry out the preliminary review.

This cannot work with the majority of clients. I therefore recommend the following:

1. One should be prepared to incur the preliminary expenses. It after all protects his or her

integrity and professionalism since it is more risk and can cost more if the assignment is

taken up in hurry and then you later on discover that you undercharged the client due to

limited knowledge of his or her operations.

The client would like you to complete the job within the costs agreed to initially and also

within the timeline set. Anything like a variation that was not foreseen from the start of

the engagement will indicate that you are either incompetent or dishonest.

2. Plan to carry out the assessment in a very cost effective manner like using questionnaires

so that you will only spend time analyzing them instead of interviewing the client and the

top officers one by one in person.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Engagement Contract
Introduction
What is an Engagement Letter/Contract?

This is a written agreement promising to perform services in exchange for compensation. These

types of letters were traditionally made use of by certain professional service firms, chiefly in the

fields of finance, and consulting to come up with the specifications of the business relationships.

Usually, engagement letter is sent by the service firm to an officer of the engaging firm.

Immediately the officer has signed the letter, it begins to serve as a valid contract.

In forensic investigation/ accounting, engagement letter is the contract between the client and the

forensic investigator. In this letter, the dispute resolution procedures are agreed upon by both

parties.

The engagement contract drafting and signing is Step 2 of the forensic investigation process.

This involves the agreement on the following:

1. The engagement involves the stating of terms of reference; which mainly refers to the extent

of an investigation or to which it is relevant.

2. Compensation terms and reporting timelines/ deadlines; this in most cases refers to the total

compensation received by the investigator, which includes not only the base compensation

but some expense reimbursements

3. The person hiring and therefore the authority to report to.

4. Agreement as to the procedure for reviewing a draft report with the client before the final

report is reached.

5. Agreement as to time and costs escalation at the request of the client.

6. Dispute resolution procedure(s).

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Dispute may arise from either party to the engagement. The agreed dispute resolution

mechanism if follows settlements may be arrived at professionally.

Engagement Letter Basics

See to it that you and the client are working towards the same goal. The application of

accurately drafted engagement letters is not only critical as a risk management tool; it also acts

as a form foundation upon which the client communication and trust are based. Whilst your

authority may require the use of an engagement letters, it should be a must in your practice/

guidelines. According to a recent article by the ABA Standing Committee on Lawyers’

Professional Liability: “at least 16 percent of all claims had been caused by poor client

communications/ consultations.” (Karagiozis, 2005). This can equally apply in forensic

investigations.

Amongst the things that should be included in an engagement letter include; the client details,

subject matter, scope and objectives of the investigation. Reflection ought to be given to give a

requirement on what you will not do for the client in question, particularly in situations where

the similar facts give rise to recoveries on multiple theories/ explanations. Furthermore,

consideration must be given to setting forth any problems, or complications, or even the

weaknesses that have already been realized, and any special agreements concerning the inquiry.

However, the investigator must never guarantee specific results such as, in terms of currency in

the contract letter. Should the client require that one promise a specific outcome of the

investigation, then the investigator must resist such attempts discreetly since an investigation is

an inquiry that may lead to any result; recovery or not

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Deadline for such investigations must be agreed upon by the client and he or she must commit

himself to facilitate the investigation by providing all the required explanations, documents and

other items that may be required for the purposes of the investigation. All these must be clearly

recorded on the engagement letter.

The number of times in reviewing the draft report must be agreed with the client and all details

put in the engagement letter. Typically, the report drafted must be reviewed twice and then the

final report is submitted to the client.

Costs escalation clause; in the contract document, there should be a clause allowing the

escalation of costs. It must however be made very clear that the investigator(s) will try as much

as possible to make use of the available resources to accomplish the agreed tasks within the

allocated time and give report, nevertheless, the client has a right to inflate the extent of the tasks

to be covered by the investigator(s) if new information received necessitate this move, and then

concur to amend the completion date and the related costs must be reviewed accordingly.

The engagement letter is a very important document. It serves as a contract for the assignment

and may be required during dispute resolution process. It therefore goes, without saying, that

dispute resolution clause must be included in the engagement letter.

Types of Forensic Audit Engagements

1. Short Term Engagement

2. Long Term Engagement

This may either be external or internal engagements

Forensic audit is an investigative activity undertaken by an independent forensic practitioner, a

certified Forensic investigator, to provide opinion to a principal, the shareholders, over a subject

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

matter, financial statements, which is the primary responsibility of another person, directors,

against a given criteria or framework, whether any financial wrong doing occurred or not.

Forensic Investigation or Audit

Forensic Investigation combines the use of investigative skills to situations that may involve

legal end results. Forensic investigations are usually in instances like the ones below:

 Deception investigations involving misappropriation of funds. Alongside, tax

evasion, money laundering and insider trading.

 Quantification of loss in case of insurance claims.

 Establishing the profit share of business partners in case of a dispute.

The Engagement Scope and the Acceptance Considerations

The objective of the investigator, in applying International Standards of Investigation in an

investigation of a single financial statement or of a specific aspect, report or item of a financial

statement, is to address appropriately the special considerations that are relevant to:

 The acceptance of the engagement;

 The planning and performance of that engagement.

 Forming an opinion and reporting on the findings on the alleged wrong doing.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Planning and Resource allocation

Forensic investigation engagements are agreed-upon as procedures engagements, not assurance

engagements. Forensic investigation will not provide a view, but an opinion whether fraud or any

financial wrong doing occurred or not. Normally, this involves establishing a suitable value or

quantifying a loss as discussed here above. It is very distinct from an assurance engagement in

which the engagement team would review an amount determined by the client in question. In

forensic engagement the certified Forensic Investigation Professional (CFIP) determines or

estimates the amount of loss. Planning and resource allocation is step 3 of the forensic

investigation.

As an agreed-upon procedures engagement, forensic investigator will normally prepare a report

for the client that sets out their conclusions, founded on the scope agreed in the engagement

contract. The report may be addressed to administration, in most cases of a fraud, or to the

person insured. It may be that a witness report for submission to the court/arbitrator is required in

addition to or instead of a report to the client.

Nonetheless, planning for an investigation is almost similar to planning an investigation or any

other assurance engagement contact. It usually commences with preliminary review in which the

engagement team will develop an understanding of the events and actions taken by the client

since it occurred.

A major part of planning is to confirm exactly what format the output is required, and precise

matters required to be covered within it. During this step, any key documentation will be

obtained and scrutinized, for instance, insurance policies, partnership records, and the evidence

that led to the discovery of the fraud. The team will agree with the client in question, what access

to other information or personnel will be required and this will be arranged.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Based on the aforementioned, the team will design procedures that enable them to meet the

requirements of the client, as agreed in the engagement letter. In some instances, it may or may

not include test of controls, relying on the situations. There would be no need to test control

when valuing a business for a matrimonial dispute. Nonetheless, trying controls will be key to

establishing how a fraud occurred. The plan should not include sampling since sampling may

lead to the skipping of very important pieces of evidence. In this book, step three is chapter three.

The planning and resource allocation falls under step three of the forensic investigation process.

This is the most important step where the success or failure of the investigation is determined.

Failure to plan well here definitely leads to disastrous results and failure to complete the forensic

investigation satisfactorily.

Planning Information
Overview

The planning phase of an interview with a witness involves some consideration of three types of

information:

 Information about the witness;

 Information about the alleged offence(s); and

 Information important to the investigation.

At this stage, interviewers need to have differing amounts of knowledge about each type of

information. In a general sense, they need to know as much as is possible in the circumstances

about the witness and a little about the alleged offence and information important to the

investigation.

The kind of information needed and the decision making that surrounds it differs somewhat for

each category of witness considered in this guidance. For this reason, the information needed in

respect of each category of witness will be considered in turn before moving on to look at the

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

information that is needed about the offence and the information that may be important to the

investigation.

Use of Planning Information

The planning information should be used to:

 Set the objectives for the interview;

 Determine the techniques used within the phased interview and decide the means by

which the interview is to be recorded;

 Who should conduct the interview and if anybody else should be present.

 should anybody monitor the interview and who will operate the equipment;

 The location of the interview;

 The timing of the interview;

 The duration of the interview; and

 What might take place after the interview.

Objectives
Setting clear objectives is important because they give direction to the interview and contribute

to its structure. The interview objectives should focus on:

 The alleged incident or event(s); and

 Any case-specific information important to the investigation.

The aim of the interview should be to achieve all the objectives that are set for it while being as

concise as reasonably possible.

Planning the investigation

The lead investigator must carefully consider what he/she has been asked to achieve and plan

their work accordingly. The goals of the investigation will comprise the following:

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

 Locating the type of fraud that has been operating, how long it has been operating for,

and how the fraud has been concealed;

 Recognizing the fraudster involved;

 Finding the quantity of the financial loss suffered by the client;

 Putting together the evidence to be used in court proceedings;

 Availing advice to prevent the reoccurrence of the fraud;

The investigating team should also consider the best way to gather evidence, the application of

computer assisted investigation skills, for instance, is very common in forensic investigations

these days.

Assembling the Team

The greatest asset to the practitioner is the team he or she assembles to conduct the examination.

It is normal that, all of us may not be completely skilled in all areas of forensic investigation and

should rely on the competency of others to assist us when necessary. Think about the following

specialized areas for inclusion as part of the specialized areas requiring experts to assist the

investigation team.

Forensic Accountants

 The forensic accountants will assist in control reviews, data mining and root cause

analysis.

Legal Counsel

 This should offer the investigation team advice on what privileges and rights of suspects,

witnesses, and victims. They will also advice on employee rights as to privacy and how

to go about them.

Computer and Digital Forensic Experts

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

 These can assist in electronic evidence retrieval and review, hard drive imaging and

internet activity logs.

Company Security Personnel

 Security personnel will assist in physical access controls, records, and background reports

on employees.

Company Management

 Company management assists in facilitating the investigation by authorising access t

books and other records.

Human Resources Personnel

 These personnel provide employee files, motivation policies, background history, and

records of previous incidents of misconduct or disciplinary action.

The inclusion of specialists from each discipline provides significant benefits to the practitioner

throughout the investigation process. Introduction and conducting an investigation without a

competent team is like performing an operation without anaesthesiologist, nurses amongst other

medical staffs. Later, one could end up in serious problem.

Assembling other resources’

 Equipment’s;

 Cars;

 Travelling and accommodation allowances;

 Start and finish times of various tasks; and

 Line of attack- how to attack the investigation.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Establishing a Crime Scene

The Location
Select an area with limited access to intruders, for instance, if it’s a school environment, students

has to be kept at bay, such as a storage area or an extra room at school, so that the crime scene

can remain set up for continued observations and examination. One may also decide to have the

crime scene take place at another scene, thus leaving evidence indicating the area associated with

the body or other evidential objects found at the crime sight.

Storyline
Establish the victim and suspect and their relationship to each other. Determine a scenario where

all suspects have the object, chance, and means to be involved in the deception, except the

outcome is undetermined beforehand. It is hoped that the co-investigator will manage the

evidence.

Suspects
After establishing a group of suspects, make a decision whether to introduce them in into the

interview process. The suspects identified will assist in the suspects interviewing process in step

7 or chapter 7. Every suspect must have the motive, opportunity, and means to be involved in the

crime. Sketch evidence may link a number of different suspects to the crime scene.

 Motive. This is a reason for committing the evil activity. Potential motives could

include, revenge, passion, and greed. Such motive is usually determined through

interviews and research.

 Opportunity: This is a suspect who can be placed at the crime scene, or was capable

of getting into the crime scene within a particular timeline, can be counted to have

had opportunity to perpetrate the crime.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

 Means: A suspect considered by investigators to have been able to commit the crime

can be counted to have had means. As an extension, one may want to add a witness or

suspect who has been seen fleeing the crime scene.

Alibis

Determine alibis for some or all of the suspect(s). These statements may be presented to clients/

firm/ organization in written format. It is similar to the law enforcer’s interview with the suspect.

During the time when the investigation proceeds, the suspects may be subjected to several

interviews where they might add new information. The investigator might choose to distribute

information from the interviews at specific intervals. The investigator may avail the suspects

with a written script and allow the forensic investigative teams to interview the suspect(s).

Suspect Files

The investigator may wish to establish “suspect files” within the client’s premises, on which

information can be added during the investigation.

Evidence
Evidence can be defined as a statement or material object from which reasonable conclusions can

be done. In a criminal trial, evidence concerns the motive, intent, means, and opportunity to

commit a crime. Generally, it can be is divided into two categories: these are circumstantial and

physical.

 Circumstantial evidence consists of information gleaned from witnesses, the

computer/internet and documents that point to an individual as the perpetrator of a crime.

A good example of this is an e-mail indicating the intention to meet the victim at a place

and time of the crime scene.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

 Physical evidence consists of actual objects, bodies, weapons, written checks, and

fingerprints associated with the crime and may be linked to the perpetrator.

It is the responsibility of forensic experts to examine the physical evidence/ such as the checks

by using an appropriate method of science in reconstructing the events that constituted the crime

at hand. The investigator must then combine this data with statements of witnesses and evidence

from documents, like the telephone records, correspondence, and credit card receipts, to develop

an overall theory of the crime that can be presented in court.

Collecting and Storing Evidence

A good plan must be in place to ensure that labelling, collecting, preserving of any evidence

connected with a crime activity is well done. The forensic investigators must be able to prove

that the evidence has always been in their possession from the time it was taken at the crime

scene until the time it appears in a court of law.

Anybody who has access to the material must be documented and presented to court. Certified

Forensic investigator must prove that the object shown in court is the same object that was tested

in the forensic laboratory or is the object that was collected from the crime scene. In case this

cannot be certified, the court may rule that the chain of custody has been broken and the object

may not be admitted into evidence/ confirmations. Once an object is found, it is placed in a

container, or a seal, and then sealed, and labelled. In the seal, the places where the object was

found and when it was found are noted by the officer who also initials the labelled seal. Should

the evidence go to the police station or forensic lab, the evidence must be placed in a locked

evidence room to which only a few people have access to. On the same note, a similar record is

has to be maintained of everyone who has had the evidence in his or her custody. The chain of

the custody is discussed in details in chapter 5.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

The following must be laid out for the collection of evidence

 Purchase gloves for collecting evidence.

 Purchase zippered plastic bags to store evidence gathered at the crime scene and from the

suspect(s). You must also Label bags with a code for which you maintain the key and/ or

with the suspect’s name and address.

 Arrange a box labeled Evidence Locker. To ensure safety, the investigative teams must

sign out the evidence stored in this box before examining it

Forensic Investigation Log Book

Plan to procure a forensic investigation log book for keeping the information collected by the

forensic investigative teams.. The investigator may wish to have the individual team members

initial their work to see to it that each member is contributing to the investigation process. The

investigator may choose to allow them access to this information at any time, even during the

final examination. Investigators are encouraged to keep their database or log books neat and to

organize the information in a manner that allows them to retrieve information speedily.

Crime Scene Kit

Criminal investigators apply a variety of materials and instruments in collecting evidence from a
crime location. Some of the materials could include the following

 Crime scene tape  String

 Chalk  Measuring tools

 Hand-held magnifying glass  Colored evidence flags

 Flashlight  Adhesive lint pick-up roller

 Tweezers  Portable alternative light source

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

 Swabs (infrared, ultraviolet, laser)

 Tape lifts  Fingerprinting kit (powder, brushes,

 Trace evidence vacuum Lifting tape, cards, stamp/ink pad)

 Sketchpad, logbook, pen  Casting kit (casting powder, mixing

 Camera Bowl, fixative)—for tire prints or

 Video recorder Footprints

 Evidence bags  Laser trajectory kit

 Seals  Gunshot residue kit

 Paper bags  Blood-detection reagents

 Envelopes  Serology kit

 Disposable clothing  Insect specimen jars

 Gloves  “hazmat” kit—to Assess composition

 Masks of toxic materials

Table 1: Crime Scene Kit ( Courtesy of Forensic investigation of stolen-recovered and other crime-related vehicles 2006)

Crime Lab Equipment

Crime labs may include equipment such as the following:

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

 Beakers  Spectrograph

 Flasks  Spectrometer

 Burets  Spectrophotometer

 Pipets  Electron microscope

 Graduated cylinders  Ultraviolet lighting

 Test tubes  Gas chromatograph

 Watch glasses  Mass spectrometer

 Stereoscopic microscopes  Electrophoresis chamber

 Compound microscopes  Nuclear reactor

 Phase contrast microscopes  Refract meter

 Spectroscope  Liquid chromatography apparatus

Table 2: Crime Lab Equipment ( Courtesy of Forensic investigation of stolen-recovered and other crime-related vehicles 2006)

Sketches and Investigative Notes

While there are controversies over whether Sketches are important, based on most investigators

opinions, a properly prepared sketches and notes are useful to you as reference when questioning

witnesses, suspects, and victims; in preparing a report of investigation; and to refresh your

memory when appearing in court.

They are also valuable sources of information for both trial and defence counsel. Sketches are

frequently introduced in court as evidence and used to acquaint the court with crime scenes and

help witnesses orient themselves as they testify. Notes or sketches used to refresh your memory

during a court appearance maybe reviewed by the court. Appropriate attention is given to ensure

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

that all notes and sketches are legible and project clear, meaningful facts. Lack of organization in

notes or sketches could adversely influence the weight given to your testimony by a court.

Sketches

A sketch graphically portrays the scene of a crime and items within the crime scene that are of

interest to the investigation. The sketch, which includes the crime scene photographs, and the

investigative notes are complementary and are all necessary to effectively process the crime

scene.

The sketch provides the best means of portraying distances between objects at the scene. There

are two basic kinds of sketches, the rough sketch and the finished sketch. Both types of sketches

contain the same general information, but differ according to the technique of presenting the

information.

Outline sketches, which generally indicate the dimensions and shape of crime scenes and which

are used as interview aids, will not be discussed here.

To cover items of interest to the investigation, crime scene sketches should, at a minimum, depict

the following:

1. Locations of approaches, such as roadways, paths, entrances, exits, windows, and

skylights.

2. Size of the area.

3. Exact locations and relative positions of all pertinent evidence found at the scene.

4. Camera locations

In depicting the foregoing, the sketch should do the following:

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

1. Reflect accurate measurements verified by another person.

2. Indicate compass direction of north.

3. Designate the scale. If no scale is used, state this fact.

4. Use a conventional system of measurement. Paces or steps are not used.

5. Contain a legend that explains all symbols or letters used to identify objects on

the sketch. Military symbols are used where practical.

List the report or incident number, offense alleged, name of victim, designation of scene,

location of the scene, date and hour the sketch was started and the name of the persons who

made and verified the sketch.

Rough Sketch: The rough sketch is drawn at the scene of the crime and is not changed after

leaving the scene. It is not usually drawn to scale but depicts accurate distances, dimensions, and

proportions through use of one of the methods discussed below. The rough sketch is filed with

the copy of the report retained by the originating office.

More than one sketch can be made of a particular scene. One may reflect measurements; another

may show camera positions; and a third maybe required to show locations of items of physical

evidence at the scene. In some instances, separate sketches maybe the best way to record

multiple scenes contained within a larger area of investigative interest, or to provide detailed

depictions of isolated locations within a relatively small crime scene. It may be necessary, for

example, to sketch separate, limited areas within the scene. The following are items necessary to

prepare a rough sketch:

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Figure 1: Rough sketch showing evidence measurement and triangulation (courtesy of tpub.com)

 Soft lead pencil.

 Unlined or graph paper.

 Clipboard large enough to form a back for the paper.

 Steel tape (at least 100 feet long).

 Ruler.

 Compass.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Finished Sketch.

When possible, the finished sketch is drawn to scale from information on the rough sketch.

When drawn to scale, the sketch need not include figures to show distances. If it is not drawn to

scale, this fact should be indicated on the sketch and distances should be shown as on a rough

sketch. A copy of the finished sketch is appended to each copy of the report of investigation.

The investigator need not prepare the finished sketch, but must verify its accuracy. It is

recommended that the finished sketch be prepared by personnel skilled in such work. The public

works officer of the command may be able to provide a qualified person for this task.

Figure 2: Finished sketch (courtesy of tpub.com)

The name of the person who prepared the sketch is indicated in the report and on the sketch.

If the finished sketch is prepared by personnel of the investigative unit, the following materials

are considered necessary: l Drawing board or table, 2 Draftsman's T-square, 3 Pencil and ink, 4

drawing compass, 5 Ink ruling pen.,6 Lettering and drawing pens 16-51, 7 Black India ink, 8

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Drawing and tracing paper 9 Architect scale 10 Art gum and ink erasers, 11 Engineer or architect

triangles 2, drawing pencil, 13French curve

A projection drawing may be used as the scaled drawing. The projection drawing adds another

dimension and in some cases is necessary to effectively portray the scene. Figure above is a

sample of a projection drawing. All measurements to a point on a movable object are made from

at least two immovable reference points:

Indoor areas

The triangulation method is used for all indoor sketches. In this method, objects are located and

depicted by creating a triangle of measurements from two or more fixed points to a single

identifiable part of the object to be fixed ideally, each object is fixed by two separate triangles

related to two different points on the same object. If movable items are to be used as fixed

reference points, they must first be fixed themselves.

Outdoor areas
Outdoor areas are considered in two categories-inhabited and uninhabited or remote. The reason

for this separate consideration is that inhabited areas normally have easily defined fixed

reference points, and the triangulation method can be used for establishing the location of other

objects. Uninhabited or remote areas may not have easily defined fixed points within reasonable

proximity and objects will have to be located through use of the intersection/resection method

taught in map reading.

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Progress Test 2

1. The Client's business environment includes but not limited to the following EXCEPT:
A. The structure of the Organization

B. Internal controls and security systems

C. Nature of business

D. Chain Of Custody

2. The planning phase of an interview with a witness involves consideration of three types of
information which one is not?
A. Information about the witness.

B. Information about the alleged offence.

C. Information important to the investigation.

D. Information to be reported to the court.

3. The preliminary review is a pre-investigation engagement exercise that seeks to find out facts

about the following EXCEPT:

A. Complexity of the client’s operations

B. The objectives of the client in the investigations.

C. The client’s industry.

D. The amount of Money in the suspects account

4. Which one is not a general objective of forensic investigation?

A. Assess activities for the recent twelve-month period.

B. Evaluation of the in-house controls and security systems of the client.

C. Advice the company on their financial stand.

D. Interview the employees.

5. The following are the factors to be considered in accepting or declining a forensic assignment.
Which one is not?

We are the global leaders in forensic investigation skills training

 All copy and transmission rights reserved by the IICFIP USA, Incorporation

A. Availability.

B. Competence.

C. Fear.

D. Experience.

6. A sketch graphically portrays the scene of a crime and items within the crime scene
that are of interest to the investigation.

A. True

B. False

7. Crime scene sketches should, at a minimum, depict the following except one.

A. Size of the area.

B. Exact locations and relative positions of all pertinent evidence found at the scene.

C. Camera locations.

D. Interview location.

8. In an investigation, motive is the reason for committing the evil activity.

A. Yes
B. No

9. An Engagement letter is a written agreement to carry out services in exchange for

compensation.
A. True.

B. False.

10. Engagement contract signing involves the following.

A. Terms of reference or scope of the investigation;

B. Remuneration terms and reporting timelines;

C. Setting the date of arresting the suspect.

D. Evaluating the costs escalation clause.

We are the global leaders in forensic investigation skills training