Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Due Diligence, Investigation & Forensic Accounting

A forensic accountant, CA Meera, is engaged by the board of Orion Steels Ltd to investigate suspected diversion of funds by a divisional head. She copies the divisional head's laptop data for analysis. To keep the evidence admissible and reliable in later proceedings, which step is most important?

She should keep a documented chain of custody and analyse a forensic image while preserving the original device unaltered. This protects the integrity and authenticity of digital evidence, so it can withstand challenge later. Handling the original loosely, involving the suspect's staff or cherry-picking records would compromise admissibility and objectivity.

  1. AMaintain a documented chain of custody and work on a forensic image, preserving the original unalteredCorrect
  2. BAnalyse the original laptop directly to save time and then overwrite the files after review
  3. CHand the laptop to the divisional head's assistant to organise the files first
  4. DPrint only the entries that support the suspicion and discard the rest

Explanation

Digital evidence must be preserved in its original state, with a documented record of who handled it and when. Working on a forensic image protects the original from alteration. Altering the original, involving the suspect's staff or selectively picking records undermines integrity and objectivity.

Did you get it right without looking?

One question tells you little. A timed set on Due Diligence, Investigation & Forensic Accounting shows your real accuracy, how long you take and where you lose marks.

Practise Due Diligence, Investigation & Forensic AccountingFree diagnostic mock

More Due Diligence, Investigation & Forensic Accounting questions