Evidence handling, employee discipline, criminal referrals, privacy, device access and insurance claims may require qualified legal, HR, forensic or law-enforcement guidance.
The evidence file should tell a reviewer what happened, what is known, what is still unresolved and which source records support each conclusion. Keep it factual, organized and access-controlled.
Core evidence categories
- Initial concern — allegation, anomaly, date discovered and person who identified it.
- Transaction records — invoices, receipts, payments, bank activity, credits, refunds, payroll and journal entries.
- Approvals and access — approval logs, system permissions, user activity, password or role changes and override records.
- Communications — emails, messages, vendor communications and explanations connected to the transaction timeline.
- Physical or inventory records — counts, receiving documents, shipping support, camera references and custody notes where applicable.
- Interview planning — topics, documents to show, neutral questions and follow-up items.
- Open questions — missing support, inconsistent explanations and records still requested.
Build a timeline
A chronology helps prevent the investigation from becoming a folder of disconnected documents. Record transaction date, source document, actor, approver, system event, explanation and evidence location.
Preserve originals
When possible, preserve original source files and work from copies. Avoid editing spreadsheets, emails or reports that may later be needed to show what existed at the time of discovery.
Separate facts from conclusions
An evidence file should distinguish verified transactions from assumptions, hypotheses and unresolved questions. That discipline protects the business and helps outside advisers assess the matter quickly.
Track red flags, records and follow-up in one place.
The Small Business Fraud Toolkit includes practical files for documenting the first response without jumping straight to accusation.
Related small-business fraud resources
Helpful references
Educational information only; not legal, HR, forensic-accounting, insurance or law-enforcement advice.