Obtaining and managing evidence in corporate forensic investigations: Legality, sources and integrity

The manner in which evidence is obtained and relied upon during forensic investigations plays a critical role in the whole investigative process, especially in establishing investigation findings and making recommendations that can be acted upon. In the context of internal corporate investigations, it is often challenging to obtain the required information from employees who are subjected to the investigation processes where such information is not known or accessible to the employer. While it is known that forensic investigators have the capabilities to obtain the necessary information, in order to maintain the integrity of the evidence, information must be obtained legally and directly from the relevant sources. 

22 Feb 2024 4 min read Corporate & White Collar Investigations Article

At a glance

  • The success of an investigation and resultant outcomes can depend on how evidence is obtained and managed.
  • It is important for investigators to collect evidence in a legally sound manner from credible sources and maintain the chain of custody to ensure that its integrity is not compromised during the investigative process.

This article deliberates on obtaining evidence in a legal and authorised manner, obtaining evidence directly from the identified and relevant sources, and establishing and following a proper chain of custody during corporate forensic investigations.

Obtaining evidence in a legal and authorised manner

Evidence obtained during corporate investigations may be used in disciplinary hearings, court proceedings or by the relevant regulatory bodies and enforcement authorities, on provision that such evidence complies with the relevant requirements for admissibility in respect of those proceedings. Therefore, investigators must ensure that evidence is obtained legally and through properly authorised channels. This is embodied in section 35 (5) of the Constitution which governs the exclusion of evidence obtained unconstitutionally. The section specifically provides that:

Evidence obtained in a manner that violates any right in the Bill of Rights must be excluded if the admission of that evidence would render the trial unfair or otherwise be detrimental to the administration of justice.”

Even though the Code of Good Practice: Dismissal, drafted in accordance with Schedule 8 of the Labour Relations Act 66 of 1995, outlines that a disciplinary hearing should be conducted with less legal formality in the court of law, evidence obtained during internal corporate investigations should still follow the rules of admissibility. The court in S v Mphala [1986] (1) SACR 368 (W) highlighted that exclusion of evidence must be favoured where it would have a detrimental effect on the administration of justice. Therefore, evidence obtained in an illegal and unauthorised manner jeopardises the interests of justice in that it may render the proceedings undertaken by the court, relevant regulatory bodies and enforcement authorities in the matter unconstitutional.

Obtaining evidence directly from the identified and relevant sources

Forensic evidence in the context of investigations conducted internally may include documentary evidence and electronic devices provided by an employer to its employees. In some cases, when the requests for information are directed to the employees who are under investigation, the employees adopt tactics to delay or obstruct the investigation. These actions may also be motivated by the aim of altering information which is required for the investigation.

Due to the fact that all company information in the possession of the employee ultimately belongs to the employer, the employer is therefore also best placed to intervene and provide the requested information in the event that the employee withholds such information. Forensic investigators must be able to rely on the employer to ensure that employees who are under investigation comply with the requests for information as soon as possible. Contracts of employment must make it clear that employees are required to co-operate with all investigations and provide the required information.

Maintaining a proper chain of custody

It is imperative that a proper chain of custody is maintained when collating information and collecting forensic evidence. Obtaining the information directly from the employer would allow for a proper chain of custody to be followed that accounts for the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. Following a proper chain of custody allows the investigators to adhere to section 35 (5) of the Constitution and to establish that the relevant evidence was collected directly from the relevant sources, in its original form without any alterations.

To prove that no one else could have obtained or possessed the evidence without authorisation, the chain of custody must record each transmission of the evidence from one person to another from the moment it is collected. Forensic investigators in charge of the evidence should regard maintaining the chain of custody as a high professional and ethical standard.


In conclusion, maintaining the integrity of evidence is critical to the investigative process. Therefore, once it has been obtained in a legal and authorised manner, it is equally important that the forensic investigators preserve its originality and authenticity. The fact that the evidence would have been obtained in compliance with section 35 (5) does not negate the importance of maintaining the chain of custody as it proves the integrity of such evidence. At all times during the forensic investigation process, evidence must be handled in a conscientious manner to avoid altering, tampering and non-compliance with the relevant requirements of obtaining evidence in a constitutional manner. It is imperative that corporate investigators handle evidence in a procedurally appropriate manner to ensure the successful outcome of cases that rely on such information.

The information and material published on this website is provided for general purposes only and does not constitute legal advice. We make every effort to ensure that the content is updated regularly and to offer the most current and accurate information. Please consult one of our lawyers on any specific legal problem or matter. We accept no responsibility for any loss or damage, whether direct or consequential, which may arise from reliance on the information contained in these pages. Please refer to our full terms and conditions. Copyright © 2024 Cliffe Dekker Hofmeyr. All rights reserved. For permission to reproduce an article or publication, please contact us cliffedekkerhofmeyr@cdhlegal.com.