Keeping a chain of custody over evidence
How a forensic team keeps a chain of custody over documents and data from the day they arrive, so the evidence can withstand challenge later.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A firm is asked to look into suspected supplier fraud at a client. In the first week, the financial manager hands over a box of invoices, the IT department e-mails a payments extract, and a junior staff member saves a copy of the creditors listing to a shared drive "to work on". Months later, the client's attorneys ask a simple question: can the firm show that the invoices in its report are the ones it received, and that nobody changed the extract?
If the answer is "probably", the investigation is in trouble. Evidence that cannot be traced from source to report invites challenge, however good the analysis built on it.
Why custody gaps matter
ACCA's technical article on forensic accounting puts the risk directly: forensic investigators must keep a clear chain of custody over evidence, because inconclusive evidence or gaps in the chain of custody may lead to the evidence being challenged in court or becoming inadmissible.
ACCA describes forensic accounting as the whole process of investigating a financial matter, including potentially acting as an expert witness if a fraud comes to trial. The purpose of an investigation into alleged fraud, it explains, is to discover whether a fraud took place, identify those involved, quantify the client's loss and present findings to the client and potentially to court. Every one of those steps relies on evidence. If the evidence can be attacked, so can the findings.
Not every engagement ends in court. Plan as if it might. Custody is very hard to rebuild after the fact.
Receiving and logging originals
The chain starts the moment something arrives. For each item received:
- Record what it is, in enough detail that someone else could identify it: a description, the number of pages or files, and any reference numbers.
- Record where it came from: who handed it over, in what role, and how it was obtained.
- Record when, with the date and time.
- Record who received it, and where it was put.
- Keep the original untouched. Work on copies; store originals separately.
For paper, that means a sealed or labelled container with a log entry for every time it is opened. For electronic files, it means keeping the file exactly as received and working on a copy.
Versions rather than overwritten files
The danger with electronic evidence is quiet change: a spreadsheet re-sorted and saved, a column deleted, a file renamed. Each change may be innocent, but together they make it impossible to say what was received.
Achekam's Document Centre is a vault with a folder per client, where staff upload files and folders, keep versions, tag, archive and restore with a reason, and search. Files sent for intake are filed as originals in the client's "Uploads for processing" folder. For a forensic team, the practical rules are:
- upload what was received, as received, before anyone works on it;
- tag received items so they can be told apart from working copies;
- let new versions accumulate rather than replacing files;
- record a reason whenever something is archived or restored.
Where documents are signed through Achekam, such as an engagement letter or a confirmation from a witness, the signed PDF comes with a completion certificate listing each signer's e-mail, times, IP address and browser and the document's fingerprint, and is filed in the client's "Signed documents" folder. That fingerprint lets the firm show later that the signed document has not changed.
Who did what: the governance log
Custody is about people as much as files. Achekam's Record Governance keeps a log of changes to governed records showing who did what, when and with what result, which can be filtered and checked for an unbroken chain. Viewing it needs the audit log permission.
Be clear about its scope: it covers records under record governance, not every screen in the application. It is a valuable part of the trail, but it does not replace the team's own custody log for physical items, conversations and anything handled outside Achekam.
Data extracts: keep the fingerprint and the count
Large data sets, such as payments, journals or vendor master files, are often the heart of a fraud investigation. Two numbers protect them: a hash of the file as received, and its row count.
Achekam's journal entry testing shows the idea at work. Staff load a whole-population journal extract as CSV and map its columns, and Achekam flags entries such as manual, weekend, after-hours and post-close postings for staff to select and test. The CSV itself is not stored by that feature; its hash and row count are. So the team must keep the original extract separately, in the client's vault folder, as received. The stored hash then lets anyone confirm later that the analysed file and the kept file are the same, and the row count shows nothing was dropped.
The same discipline applies to any extract analysed elsewhere: record how it was produced, by whom, from which system and for what period, with its hash and row count, before analysis starts.
A custody log in words
A simple custody record for each item might read like this, in plain sentences:
- The creditors payment extract for the investigation period was produced by the client's systems administrator from the payments module on the stated date, at the team's request.
- It was e-mailed to the engagement manager, who saved it unchanged to the client's vault folder and recorded its hash and row count.
- A working copy was made for analysis; the original was not opened again.
- The journal extract for the same period was loaded for testing, and the stored hash agreed to the kept file.
- Supplier invoices were received in a sealed box from the financial manager, logged item by item, scanned, and the originals locked away.
Each sentence names the item, the person, the action and the place. That is what a challenge will probe.
For practical detail on folders and versions, see client vault folders and versions, and the record governance log explains what the governance trail covers. Before the next investigation starts, agree a custody procedure with the team in writing and use it from the first item received.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
