Evidence and Legal Systems Flashcards

During a fraud investigation, a Certified Fraud Examiner (CFE) interviews an employee who states, "My manager, Sarah, told me yesterday that she saw the controller altering invoices after hours." In a court of law, this employee's statement would most likely be considered what type of evidence?

Answer: Hearsay evidence

Hearsay is an out-of-court statement offered to prove the truth of the matter asserted. The employee is repeating what Sarah (the declarant) said outside of court to prove that the controller was altering invoices. This is a classic example of hearsay and is generally inadmissible unless it falls under a specific exception.

A fraud case against a company is being tried simultaneously in both criminal and civil court. Which of the following correctly describes the difference in the burden of proof required for each case?

Answer: The burden is "beyond a reasonable doubt" for the criminal case and "preponderance of the evidence" for the civil case.

In criminal law, the prosecution has the high burden of proving the defendant's guilt "beyond a reasonable doubt." In civil cases, the plaintiff's burden is lower, typically requiring proof by a "preponderance of the evidence," which means it is more likely than not that the claim is true.

A CFE seizes a laptop believed to contain evidence of an embezzlement scheme. To ensure the digital evidence is admissible in court, which of the following is the MOST critical initial step for the CFE to take?

Answer: Immediately create a forensic image of the hard drive and calculate its hash value.

The most critical initial step is to preserve the integrity of the original evidence. Creating a bit-for-bit forensic image (a copy) of the hard drive and then calculating a cryptographic hash value of both the original and the copy ensures that the original data is unaltered. All analysis is then performed on the copy. This process is fundamental to maintaining the chain of custody for digital evidence.

A fraud examiner, testifying as a fact witness in a criminal trial, is asked by the prosecutor for their opinion on whether the defendant's actions were intentionally deceptive. How should the fraud examiner respond?

Answer: State that they cannot answer because the question calls for an opinion, which is beyond the scope of a fact witness's testimony.

A fact witness testifies about what they have seen, heard, or personally experienced. They are not permitted to offer opinions, interpretations, or conclusions about the facts. Providing an opinion on the defendant's intent (deception) is the role of an expert witness, who has been qualified by the court based on specialized knowledge.

In preparation for a fraud trial, an attorney asks a CFE to create several charts and graphs that summarize complex financial transactions to help the jury understand the flow of funds. This type of evidence is best classified as:

Answer: Demonstrative evidence

Demonstrative evidence is evidence that illustrates or helps explain a fact or the testimony of a witness. It is not the actual object from the event (real evidence) but a representation, such as a chart, diagram, or model, created to aid understanding.

A corporation's general counsel hires a CFE to conduct an internal investigation into a suspected kickback scheme in anticipation of litigation. The CFE's final report and related communications would MOST likely be protected from disclosure to opposing counsel under which legal doctrine?

Answer: The work product doctrine

The work product doctrine protects materials prepared by or for a party or their representative (including an attorney or consultant like a CFE) in anticipation of litigation. Because the CFE was hired by legal counsel specifically in anticipation of litigation, their work product, including reports and communications, is generally shielded from discovery.