This article deliberates on obtaining evidence in a legal and authorised manner, obtaining evidence directly from the identified and relevant sources, and establishing and following a proper chain of custody during corporate forensic investigations.

Obtaining evidence in a legal and authorised manner

Evidence obtained during corporate investigations may be used in disciplinary hearings, court proceedings or by the relevant regulatory bodies and enforcement authorities, on provision that such evidence complies with the relevant requirements for admissibility in respect of those proceedings. Therefore, investigators must ensure that evidence is obtained legally and through properly authorised channels. This is embodied in section 35 (5) of the Constitution which governs the exclusion of evidence obtained unconstitutionally. The section specifically provides that:

“Evidence obtained in a manner that violates any right in the Bill of Rights must be excluded if the admission of that evidence would render the trial unfair or otherwise be detrimental to the administration of justice.”

Even though the Code of Good Practice: Dismissal, drafted in accordance with Schedule 8 of the Labour Relations Act 66 of 1995, outlines that a disciplinary hearing should be conducted with less legal formality in the court of law, evidence obtained during internal corporate investigations should still follow the rules of admissibility. The court in S v Mphala [1986] (1) SACR 368 (W) highlighted that exclusion of evidence must be favoured where it would have a detrimental effect on the administration of justice. Therefore, evidence obtained in an illegal and unauthorised manner jeopardises the interests of justice in that it may render the proceedings undertaken by the court, relevant regulatory bodies and enforcement authorities in the matter unconstitutional.

Obtaining evidence directly from the identified and relevant sources

Forensic evidence in the context of investigations conducted internally may include documentary evidence and electronic devices provided by an employer to its employees. In some cases, when the requests for information are directed to the employees who are under investigation, the employees adopt tactics to delay or obstruct the investigation. These actions may also be motivated by the aim of altering information which is required for the investigation.

Due to the fact that all company information in the possession of the employee ultimately belongs to the employer, the employer is therefore also best placed to intervene and provide the requested information in the event that the employee withholds such information. Forensic investigators must be able to rely on the employer to ensure that employees who are under investigation comply with the requests for information as soon as possible. Contracts of employment must make it clear that employees are required to co-operate with all investigations and provide the required information.

Maintaining a proper chain of custody

It is imperative that a proper chain of custody is maintained when collating information and collecting forensic evidence. Obtaining the information directly from the employer would allow for a proper chain of custody to be followed that accounts for the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. Following a proper chain of custody allows the investigators to adhere to section 35 (5) of the Constitution and to establish that the relevant evidence was collected directly from the relevant sources, in its original form without any alterations.

To prove that no one else could have obtained or possessed the evidence without authorisation, the chain of custody must record each transmission of the evidence from one person to another from the moment it is collected. Forensic investigators in charge of the evidence should regard maintaining the chain of custody as a high professional and ethical standard.

Conclusion

In conclusion, maintaining the integrity of evidence is critical to the investigative process. Therefore, once it has been obtained in a legal and authorised manner, it is equally important that the forensic investigators preserve its originality and authenticity. The fact that the evidence would have been obtained in compliance with section 35 (5) does not negate the importance of maintaining the chain of custody as it proves the integrity of such evidence. At all times during the forensic investigation process, evidence must be handled in a conscientious manner to avoid altering, tampering and non-compliance with the relevant requirements of obtaining evidence in a constitutional manner. It is imperative that corporate investigators handle evidence in a procedurally appropriate manner to ensure the successful outcome of cases that rely on such information.