Skip to content

ACCA Strategic Professional · Advanced Audit and Assurance (International) · Specific assignments

During a forensic investigation of suspected payroll fraud at Brightwell Group, the investigator takes a copy of the finance director's email mailbox. Later the defence argues the evidence is unreliable. Which action would best have protected the admissibility of the electronic evidence?

The best protection is to create a forensic image of the data and keep a documented chain of custody. This shows the original evidence was preserved unaltered and traceable, which supports admissibility in court. Using live data, suspect selection or discarding originals undermines reliability.

  1. AReviewing the live mailbox and deleting irrelevant emails to avoid confusion
  2. BAsking the finance director to select and send the relevant emails
  3. CSummarising the emails in a report and discarding the originals
  4. DCreating a forensic image of the data and documenting a chain of custody showing who handled it and whenCorrect

Explanation

Forensic imaging preserves the original data unaltered, and a documented chain of custody shows it has not been tampered with. Working on live data, relying on the suspect to select items, or discarding originals undermines integrity and reliability in court.

Did you get it right without looking?

One question tells you little. A timed set on Specific assignments shows your real accuracy, how long you take and where you lose marks.

Practise Specific assignmentsFree diagnostic mock

More Specific assignments questions