Case Management System: Audit Trails

Chapter 3: 5 Ways to Build Stronger Cases

Posted by Dawn Lomer on July 25th, 2011

Chapter 1: Investigative Standards Chapter 2: Case Management System: Labels and Notices

Chapter 3: Case Management System: Audit Trails

Extensive, secure audit trails built into i-Sight software help to establish that (a) the evidence collected in an investigation is trustworthy, and (b) the enterprise's legal team was engaged in the investigation to an extent that was appropriate for meeting legal standards, while also being efficient and economical. i-Sight software is rich with metadata, audit trails and time stamps that document each step of case development. The history section of the software records who opened a case and when. Like a meticulous filing clerk, it documents when particular items of evidence were incorporated into the case and by whom. It records precisely who looked at which parts of the case and when. These time stamps and data points are credible because they are created by a neutral third party, that is, i-Sight itself. If a question were to arise about when evidence was collected or reviewed, the software will provide an authoritative answer. Such detailed chronology adds immeasurable value to an investigation Documenting Attorney Engagement This paper introduced above "attorney-client privilege" and "attorney work product." When there is question whether attorney-client privilege or attorney work product applies to a matter, the degree of direct attorney engagement can be relevant. Attorney engagement can be documented in i-Sight. The software can remind an attorney to look at a case and then note when the attorney did examine or take action in the case. Security of Evidence1. Deters Evidence Tampering i-Sight's time stamps and other metadata deter fabrication and manipulation of evidence. In any given set of facts and circumstances, if date and time can be established with assurance, then proof of many other facts (such as who created evidence, where and how) can be established by inference. 2. Authentication of Evidence The trustworthy timekeeping in i-Sight helps investigators authenticate their work. An investigator can incorporate periodically into the investigative record an affidavit that affirms the evidence and notes collected as of that time. An affidavit is a formal attestation by a witness (the investigator) about evidence. The affidavit helps in case the investigator becomes unable or unwilling to support the investigation at some time into the future. (Might an investigator collect evidence on a case, and then refuse, or be unavailable to explain or authenticate the evidence later at trial? Yes. See "Investigator Refuses to Testify," Observer-Reporter (Washington, Pa.) - Jan 16, 1982 Page B3. The story tells of a former county medical investigator who had conducted an autopsy, but then refused to testify at trial because he was no longer being compensated.) Traditionally, an affidavit is in writing, signed and notarized, stating essentially, "I John Doe, investigator, hereby sign and affirm the evidence stored as of this time in this case record as my authentic work. The date is … and the time is …" One way to incorporate an affidavit into i-Sight is for the investigator to sign and notarize a paper affidavit, scan it as a pdf, and store as a unit of evidence in the investigative case. i-Sight's time stamp on the scanned document lends it credibility. An alternative would be for the investigator to create and sign an affidavit by webcam on his or her computer. The investigator can save into the case evidence a webcam clip of the event, stating, "I Jane Doe Investigator hereby sign and affirm the evidence stored as of this time in this case as my authentic work. The date is … and the time is …" For more on webcam legal signatures see, https://bit.ly/a0X9kZ. Either way, the affidavit reinforces the credibility of the investigator's evidence and work as of the time of the affidavit. Chapter 4: Case Management System: Software as a ServiceChapter 5: Case Management System: Flexibility

Dawn Lomer

Manager of Communications

Dawn Lomer is the Manager of Communications at i-Sight Software and a Certified Fraud Examiner (CFE). She writes about topics related to workplace investigations, ethics and compliance, data security and e-discovery, and hosts i-Sight webinars.