Skip to content

CS Professional · Internal and Forensic Audit · Audit and Investigations

During an investigation of suspected payroll fraud at Bharat Engineering Ltd., the investigator finds that the HR system holds the only record of ghost employees and that the system administrator is a suspect. What is the most appropriate immediate action to protect evidence?

The investigator should independently secure a forensic copy of the data and document the chain of custody. This preserves the evidence in unaltered, admissible form. Relying on the suspect administrator, delaying, or deleting records would risk tampering or destruction of the evidence.

  1. AAsk the system administrator to prepare a report of the ghost employees
  2. BWait until the end of the investigation to copy the data
  3. CSecure a forensic copy of the data independently and preserve the chain of custodyCorrect
  4. DDelete the suspicious records to stop further payments

Explanation

Evidence must be preserved in original form by an independent forensic image with documented custody, so it is admissible and untampered. Relying on the suspect or deleting records destroys integrity, and delay risks alteration.

Did you get it right without looking?

One question tells you little. A timed set on Audit and Investigations shows your real accuracy, how long you take and where you lose marks.

Practise Audit and InvestigationsFree diagnostic mock

More Audit and Investigations questions