c Sations and vuinerabi Fecognized for redefi ‘ices econd edition of the ‘Security Management. Principles, Technigusd ons.” In authoring the book about investigation, his main purp rofessionals to have knowledge about conducting investigat orts properly. As observed, many security professionals are not vestigating and writing their reports abo vironment. This book about corporate Investigations » are two (2) things that are technical for a se ctor: (1) Condueting a Security survey and writ aan investigation and also writing the results of that inves many professionals have failed the grade. His experience hae 1g a book such as this one, wishes to dedicate this book to some “hose investigative knowledg® y great Capt. Conrado Guerrero Du # Detectives in the priva ie in the Philippines g \sferring it to peor : Ee 3 a8 C Q ZA oh i meyernyeCer ta. (et (iil dd Yd ‘OID! “ ISO Ad DR. EDUARDO M, FULGENCIO, Ph, \ Les d eyTHE PROCESS OF INVESTIGATION Dr. Eduardo M. Fulgencio, Ph.D, Cpp. CFE, Cs| 7 CPP, + CSPTHE PROCESS OF INVESTIGATION Copyright © 2020 By Eduardo M. Fulgencio, Ph.D, CPP, CFE,CSP All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Printed in the Philippines by: KADENA PRESS-ASIA FOUNDATION, INC. Email: kpi_asia@[Link] any form or by any means, electronic,. CONTENTS Preface and Acknowledgements Becoming an Investigator Investigator Attributes Traits of a Competent Investigation Learning Practicum Developing an Investigation Plan Elements of a Case Management File Investigation Plan Managing the Investigation Report Writing The Five C’s of Report Writing Field Notes Incident Scene Sketching Report Types Report Format Collecting and Documenting Evidence Sources of Information Information Filing System Information Sources Government Sources Surveillance Basic Photography and Equipment Understanding Photography Digital Photography Video Photography Specialized Investigations ‘Computer Crime Financial and Lifestyle Due Diligence Theft 1 2 6 8 10 14 18 21 2 23 28 29 31 35 41 41 43 46 72 94 94 96 99 101 104 105 11 114 117ee a ee a is vi | The Process of Investigation Con Games Fraud Forgery Arson and Bomb Investigations Assault and Battery Death Investigation Undercover Investigations Traffic Accident Investigations Workplace Investigations Employment Investigations Employee Theft Drugs and Alcohol Sexual Harassment. Legal Issues Interviewing Conducting Searches and Performing Survei Invasion of Privacy ince Negligence Organizing a Corporate Investigative Group Technology for Investigators Developing an Investigation Plan Specialized Investigations Legal Issues .es for Developing an Investigation Policy Interview and Interrogation Questioning Techniques Testifying in Court Photography in Investi igations id in Investigation The Collection of Known Writings Polygraph Testing as an Questioned Documents ee Techniques 118 119 120 121 128 129 133 136 145 146 151 156 157 163 163 165 167 169 174 181 186 192 193 195 196 202 209 219 227 232 237 242 Preface and Acknowledgments | vii PREFACE AND ACKNOWLEDGMENTS Sheena Se ee ‘After dedicating twenty eight years of my career as a security professional, I realized that not all aspiring security practitioner had the opportunity to attend the same courses that Ihave attended. Today's rising security professional is a college graduate who has the desire to jeam, but often times does not have the time and resources to attend courses offered by different organizations, or the ability to travel to major countries to gain the knowledge required to be an investigator. I wrote this book with two important objectives in mind. The first one is to give security professionals a text to follow that will help them achieve their aim of becoming good investigators. Not because Thave the monopoly of knowledge, which is obvious from the list of reference materials I have listed and taken the liberty to incorporate into this book, but because I owe a deep amount of gratitude to the very people who have helped me along the way. The second one is, as a resource speaker in security management courses, seminars and conventions. I have discovered that the management of investigation unit often lacks guidance on the process of managing the investigation and leading people. It is my hope that this text will help them meet their goals. This book was developed by researching the latest information available, both through written sources (private and public) and personal interviews with successful people in the field both here and abroad. I quickly discovered several topic specific sources on different types of investigations or techniques, but I found few publications that put the information together in one investigation handbook. Other sources of information which may be of assistance as you put together an investigation are cited throughout the book, as well as staan en reference section of each chapter, i uated in foevili | The Process of Investigation This book is designed to be an aid in the leaning process. It offers security professionals the ability to establish habits based on Step-by-step procedures. By following the processes presented, and adding your personal desire to work and apply the techniques, you can assure your success in achieving the aims of your investigation. What this book cannot provide is the experience of conducting your first investigation. It does not stop you from making bad decisions, or tap you on the back when you have done a good job. 1 wish to give advice to the new and even seasoned security Practitioner: “Seek out mentors, people whom you can trust, who have experience and are willing to teach.” And to the experienced security professional who has the potential to be a mentor, I offer this advice: “Seek out those with a desire to learn (even if it’s hidden); teach what you know; show them how to do it; and after awhile, let them go.” I wish to thank those people who have helped me in writing this book whose names I cannot mention one by one but deep in my heart, my special recognition goes to all of them. Becoming an Investigator | 1 BECOMING AN INVESTIGATOR GOAL The goal of this chapter is to provide a basic understanding of the requirements to become a good investigator and to perform a successful investigation. OBJECTIVES: 1. Identify the attributes an investigator should possess. 2, Identify the traits of a competent investigation. The term investigation is defined as an inquiry into allegations or circumstances in order to acquire factual information. This text is to be used as a guide for people wanting to learn more about the investigative process, the various types of investigations, and the techniques used by successful investigators. What attributes should someone possess to become a successfull investigator? The late great Capt. Conrado G. Dumlao, MBA, CPP, CFE, President of Truth Verifier Systems, Inc. believes that the successful investigator should possess qualities that compensate for him law enforcement tools not available to a private-sector company. First, he believes the investigator should possess a high level of curiosity. This instinct for seeking out more information should nd the obvious. Secondly; the techniques. Although the though assignment may sound glamorous, real boring and monotonous work. Lastly, the investigat; Wha Wh Rind sechoeh Yo Hae ator should know the invactinatnr « want omen ———2 | The Process of Investigation hours knocking on doors, asking questions around the community; or ‘calling people by phone. Today’s investigator must be equipped with the ability to conduct on-line searches and gather data quickly and efficiently. Background investigations once required the investigator to visit the various reference locations, actual physical sites where individuals listed as references live or work, but now such inquiries can be made via the Internet or social media. __ The basic point is that the investigator should be prepared and. skilled to deal with a wide variety of situations. Each investigation may require a specific area of subject knowledge that the investigator needs to learn, or the acquisition of such subject matter knowledge through an expert opinion. The investigator works in an environment that is continuously changing. An ity to change quickly leave behind the unskilled and untrained, INVESTIGATOR ATTRIBUTES When I assess someone’s ability to be an investigator and evaluate his or her potential for success, there are several general guidelines that I follow: These are not absolutes, of course, but knowing and understanding these guidelines enhance @ person’s ability to perform the investigative tasks. These characteristics have been adapted into a self-evaluation format, included inthis chapter allow you, as an investigator, to evaluate your own areas of eng : ss well as identify areas needing improvement. This va ei you develop your own skills improvement plan. This fons may «useful tool for the security manager during the Biting Pros: ‘An investigator should have: ‘An investigator needs sation. ers of observ. ch of the + Highly developed pow keenly developed and employ ea observation skills that are jnvestigator’s senses. Becoming an Investigator | 3 + Innate curiosity. An investigator needs a natural curiosity that keeps the investigator asking questions, even if the answers appear to be obvious at first. + Writing skills to ensure that every reader clearly understands the investigator's message. Successful writers develop a Five Ps (pre- planning-prevents-poor-performance) strategy to their writing. + The ability to-talk with strangers and gain their confidence. The investigator must develop effective skills of communication and an ability to interpret responses as truthful or deceptive. + The ability to work without close supervision. Investigators are self-motivators, They can’t afford to wait to be told what to do next. They are responsible for developing information and following up on the information they receive. + The ability to be open-minded, It is important that investigators do not jump to conclusions. It is often difficult to ignore our prejudices and not assume that what we perceive is reality. + Patience. Investigators need great patience to handle stakeouts details, and long court proceedings, Patience is a virtue that every investigator must possess and learn to cultivate as some as: : me assignments + The ability to logical ly reconstruct the sequence of an investi; y g investigatic Successful investigators acquire the ability to organize infocrnue and assemble it in report form for future reference i + Above average intelligence ° igence, memory, and i identify the value of evidence and ndeation ye + The ability to collect evidence and , conduct investi artalty. The investigator must understend win, eons without jerstand what physical evide,4 | The Process of Investigation Would aid the investigator’s client, * The ability to determine why a private investigator i being retained ‘0 conduct the inquiry. This is particularly important in the event thet criminal activity may be involved in the investigation. The private investigator will want to identify early on any potential contact that might exist between the investigator and law enforcement personnel, * The ability to identify the goals and objectives of the investigation and any parameters that may exist. This will help the investigator identify any areas that the client may not want investigated or disclosed publicly. The investigator is obligated to provide all information discovered to the legal authorities if asked, as well as testify to any such information if called into a court of law. + The desire to act ethically and seek the truth, even though it may not compliment the client. The client has the prerogative to accept or reject the findings of the investigation. Remember that the investigator’s reputation is critical to future success. Never present circumstances or information in any way that would allow people to question your integrity. + The ability to respond to the needs of the investigation. Interview questions should be prepared prior to the interview. The results w be worth the long hours spent in preparation. Jed by what they see; an open id be maintained. Preconceived investigation and cause the + Objectivity. People are often foo! mind and unbiased perception = i hinder the progress of the ideas yim verlok pei invesignv Poses invest investigator shouldn’t i The interview process. . . + Control over the inKrTAN Fesides wasting time, the focus of allow others 10 12k¢ CON OO Becoming an Investigator | 5 the investigation may be deterred and cause embarrassment for the investigator. A chronological timetable of factual events. When prepared as quickly as possible, a timetable will help the investigator maintain the focus of the investigation. The ability to be an effective liaison with local authorities. These contacts can be invaluable. Be willing to share information should criminal ‘activity become part of the investigation. Reliable sources of information. Develop reliable sources of information that include people, public records, law enforcement agencies, and financial institutions. The people involved. Identify; as soon as possible, the people involved in the investigation and their relationship to the client, employee, relative, etc.). Competence. Develop competence through hard work, attention to detail, sacrifice, devotion, study, and continuous education, Lastly, the investigator must be knowledgeable about the rw and legal proceedings. The investigator must keep abreast of latest laws affecting criminal act its, elements of an and other skills needed You are not adequately trained in of these areas? What then? Th, i eas? | 2 The question bee, willing to spend the time it takes to lea and bepin te aval ae skills? People with years of experience will find the 1 oP HOSe this text helpful in them to be in identifying potent investigators and how to6 | The Process of Investigation Successful. Many of the prerequisites for a successful investigator are gained from prior security patrol experience in conducting preliminary investigations. TRAITS OF A COMPETENT INVESTIGATION In general, each investigation should possess the same five traits The investigation should be objective, thorough, relevant, accurate, and current. For an investigation to be objective, investigators must recognize their own set of prejudices and be willing to accept facts as presented without the influence of their own experiences and fe because an investigator will form opinions about the information and editorialize on matters in which the investigator has a personal feeling or position, Personal opinions should not normally be a part of the official investigation, unless asked, and if'so, it should then be clearly annotated on the report. The thoroughness of an investigation requires checking each piece of information, not once but several times to ensure accuracy and relevance. For example, a statement taken during an interview requires that the investigator review the facts on the statement with the subject who is being interviewed. People often write differently than they speak, Their level of education may not allow them to effectively express their thoughts in writing. Clarity i at importance, especially when a civil or eriminal action ey eos against a subject of the investigation. Facts those are distorts! ot even undiscovered the investigation can be damaging 0 presented by the opposing counsel in cour turing the course of the investigation ‘The investigator should ask, how does mat i ificant i .) Is the information so sign is i relate to the case? fi i supporting evidence, or does itrequire additional that itis the primary “htiate its relevance to the case? Caution must 7 stantis 5 weno i oe = Information gathered di should be relevant to the case. Becoming an Investigator | 7 irrelevant to the situation, Each data point is analyzed to determine its effect on the case and what direction the follow-up inquiry should take, Relationships among the data collected are established and tied together to strengthen the accuracy of the case. Accuracy of information is often distorted by our own senses. ‘A technique used to train aspiring investigators deals with the accuracy of witness information. Student investigators are instructed to interview other members of the class, who have just witnessed an incident that has occurred outside the classroom. The student witnesses are instructed to give the student investigator only factual information that they personally witnessed. The results, as one can imagine, are often skewed according to each individual witness’s perception of what took place. Witnesses and informants may color the information based on their motivations. Individuals may lie to Soest Sond noenigiine Saute eee Cena for verification. The daveniioe sbonld nicasure al eee presented, such as distances traveled sti Tie the person possibly travel the dist: Re ee one ance in the time stated? Currency of information is critical to the ‘mnetiznion Circumstances change overtime, and old eilleoet tn champ canto formulate the outcome ofan investigation: ae Present ee oveT® are often reluctant to contdlet an applinnes sere sales Bars as current information. The potenti i Grad nea edible work history, so winy iba person's oer superiors, Other eam neo TAY NOt agree with the be taken8 | The Process of Investigation Becoming an Investigator | 9 LEARNING PRACTICUM. [- e 5 4 3 2 1 The following Liker scale self-evaluation can be used to personal biases determine your personal attributes for becoming an investigator. It is and adjust not intended to discourage anyone but rather should be used to identify accordingly. areas for improvement and additional education or training that may 3. liked taking s | 4 Beeline [ted be needed. Using the numeric key, answer each question by circling notes in school. the number that most closely reflects you. 9. work best on a 5 4 3) 2 1 regular schedule. 1 = Strongly Disagree 10. I think Twould 3 | 4 3 uaatil aad enjoy searching 2 = Disagree the Internet, Tm 3] 4 Bis[se2ra eae satel ee uncomfortable talking to others 7 on the phone. to Agree 12. [become 3s | 4 36152 al eal 5 = Strongly Agree pnt =. 13. Workin; g 1, like to take wants doesn’t % 2 fi 3 the time to get the | Bother ms details of a story. 14, Tusually don’t aeal# 3 > Tusually miss plan my acti Filed the things that uf others see. Once you have completed the 3, L enjoy talking “Practicum Review,” and transfer your sein 8, Appentix 4. to other people. : ZF, Talways follow SUMMARY my intuition, even if the facts don’t support my position. Tan known for my honesty and my character. investigativ relevant, accurate, and ove and ensure that the information isa 10 | The Process of Investigation DEVELOPING AN INVESTIGATION PLAN SEASON FUE GOAL The goal is to understand the importance of developing and documenting the investigative process, OBJECTIVES: 1. Define the elements of a case management file. 2. Identify the elements of an investigation pla 3. Describe techniques used to manage an investigation. The success of an investigation largely depends on the investigator's ability to formulate data, analyze the information, and report it accurately. A consistent investigation plan and subsequent case management file affords the investigator the best opportunity for completing an investigation in a timely and efficient manner. The client or supervisor responsible for the investigation activity can influence an investigation, This chapter focuses on management of the investigation through the use of a plan. ELEMENTS OF A CASE MANAGEMENT FILE ve i i yf a larger organization Whether the investigation unit is part o! or a privately owned firm, a Case Management File (CMF) should be opened. How this file is administered depends on the unit's policy statement and set objectives. An effective policy statement ich items as who is responsible for supervising investigations, Hove t ship to be maintained wi ction, and the relationship : toad wns ‘or clients, Procedures outline how parila : ‘be requested, conducted, reported, and terminated. ‘ment outline and procedural instructions are er ‘A sample policy statet fisted in Appendix B, “Forms. ee ee Developing An Investigation Plan | 11 ‘When opening a CMF, the investigative unit should establish a system to track files for coordination and future reference. A common filing system used by an investigative unit is a six-digit identification system. The first two numbers represent the month the case was opened, the next two numbers represent the sequence in which the case was received, and the last two numbers represent the year. Case number 01-01-99, for example, indicates that the case was opened in January, it was the first case of the year, and the year is 1999. Of course variations to this system could include letter designators for different locations, such as 01-01-99-ABQ, which could represent the Albuquerque office. The location of investigative files should be secure, making files available only to those individuals with a valid need-to-know status, Administrative staff personnel should not be allowed total access to the files, unless they need to perform specific tasks. Computers are widely used in creating CMFs, as well as maintaining investigat records. Computer access to files should also be restricted, as well se areca fom the possibility of destruction by intentional meres = disasters such as fire and water dat um ieee eee ‘age from storms or floods. The unit ovel i suffer damage. *Y plan in place in the event that records + the incident/complaint form, + interview statements * results of records res * financi With investi, earch, information, * surveillance and evidey len + a case summary © logs, and ‘gator summaries eae aaa42 | The Process of Investigation Additional elements may be included but are dependent on the nature of the investigation. For example, the investigator may want to separate his surveillance file iftwo separate individuals were under surveillance. Multiple file classification folders are well suited for maintaining the Various records required for a single case. These folders have divi that can be labeled for each element. eit ___ The initial incident/complaint form is used to gather initial investigative information. The form depicts the general information about what has occurred that has caused an investigation to be opened. The form (see Appendix B) contains information about the Client or subject, the date the incident took place, the particulars of what occurred, contact information for those involved, a description of the subject(s) of the investigation, and the facts surrounding the investigation. An appropriate deadline for completing the investigation should be negotiated with the client or supervisor and annotated on the incident form Interview statements with investigator summaries are used to ascertain information from those involved in the incident. Interviewees typically provide their statements in written format, whether they write the statement themselves or it is transcribed from a recording. This statement is the person’s record of how they perceived what occurred. ‘The form (Appendix B) should contain the CMF number, the date and time of the interview, the name of the person being interviewed, and the interviewer’s information. A list of potential interviewees and their relationship to the matter under investigation should be identified. The in whi i nducted should be decided, and order in which interviews are to be cot he i ‘itnesses to ith direct knowledge or who are wit u pe aanisaed first. The interviewer/investigator should summarize “hat took place in the interview. Specific information on interviewing ie niques will be covered in Chapter 4, “The Interviewing Process. cl ofrecords research form cpopeniix 3) my depending on into several sub-files, ‘ oe sper ‘cxample, if the investigator needs to obtain pie ie information ‘en several people, the investig: employment The results Developing An Investigation Plan | 13 choose to establish a separate sub-file on each person, rather than file all the information under one sub-file. Additionally, research results could be filed by type, such as court records, Internet searches, or criminal record checks. Regardless of how the file is maintained, all records should be annotated to depict the date of the record, where the original record is maintained, who the record was received from, who received the record, and, if the record is too lengthy for the CMF. How it is indexed and where it can be located. The financial sub-file contains financial information about the subject of the investigation. The type of information found in this file includes the release of financial information form, financial statements, records of assets (stocks bonds/mutual funds, etc.), and real-estate holdings. The specific type of financial information is dependent on the kind of investigation being conducted, For example, a new employee background check, by policy, only requires that a credit report be obtained, whereas a due diligence investigation will require a full financial inquiry including an analysis of income versus style of living The surveillance reportfile should include th data, such as home and work addresses, person(s), vehicle information, and daily activity sheets. Surveil in Chapter 6, “Basic Surveilla maintained to ensure that an checks, calendars, je is controlled. The chain of custody is a record not was discovered, by whom, and what was done handling the evidence is nx e subject(s) pertinent a physical description of the association or contact descriptions, lance forms will be described later ince Techniques.” Evidence logs are fographs, canceled the chain of custody ing where evidence EEENN OE ee ay eS 14 | The Process of Investigation The case summary identifies the final results of the investigation and the disposition of the case. Closing a case should not be the sole lity of the investigator. The unit supervisor or, ata minimum, Peer investigator should review the file for completeness and accuracy as best as possible. Closed-case index files are established, in the event that a similar case occurs or subjects of the investigation are involved in future incidents requiring investigation. Cross-index information includes pertinent data on the subject(s), businesses or organizations involved, the CMF number, information on the investigator(s), dates, and the nature of the investigation fraud, workplace violence). This type of index information can be maintained through a simple index card system or a computer database. INVESTIGATION PLAN ‘There are four elements in an investigation plan: Preparation, Learning the facts, Analyzing the information, and Notifying the in the process could degrade the quality of the investigation, rendering the final report inaccurate and questionable. In the preparation phase, the first responsibilty of the i i igor i termine the type of investigation investigation supervisor is to determine the t is be conducted. Later in Chapters 8, “Specialized Investigations and 9, “Workplace Investigations,” each type of investigation wi be defined, but for the purpose ofthis discussion, the various éypes of investigations could include employment Deckard ings ili i ‘SEXt rasst L. due diligence, loss prevention, or erent, Ons ee s determined, specific resour Or nvtive project. These resources include personnel, nancial sree ysical, The types of requirements fr each resouree wi! sche and pifeeds of the investigation. For example, medica) Fa et involving employees wo 2° fn el are needed od, Several investiga : ae a pe vellance ‘vrort around the clock. This could include to work the 8 Developing An Investigation Plan | 15 the involvement of several automobiles for transportation and radio equipment (physical). Investigators may need readily available cash (financial) in the event that surveillance activity demands that they follow the individual to another state on short notice. ‘The learning phase of the plan involves the gathering of information pertinent to the case. The investigator determines the type of subject matter knowledge that may be required during the investigation and begins to seek resources to help. Everyone has areas that could be improved upon; the key here is to personally identify those areas and find someone to help or become smarter about the subject by conducting research and study. The problem is that the investigator usually does not have the luxury of learning about the specialty area on the client’s time. Sources of information will be discussed in Chapter 5, but the investigator should understand some general principles of how to conduct research. The first principle of research calls for the investigator to assess his/her own knowledge concerning the type of investigation to be conducted. The following questions are designed to help evaluate personal background knowledge. * What experience do I have in conducti lucting thi investigation? sehr te * What has occurred in Past cases investigations? + _TeT'm not sure what I know is curent information, where I 80 to receive up-to-date information and possibly find sesso tc assist? ly find someone (history) dealing with similar As the learning step contin _ ues, the i interview expert {he invest in the field. igator may want ‘pert (SME) Subject matter ex interviews can be extremely helpful. 5 investigator what they know and ontheir personal views. Taking i i depending . ‘Pr > dependi is advisable. Once the investigator has dovelascg SME ae a subject NN Ee Ee ee ee ee16 | The Process of Investigation base, further research or inquiry into documentation is required. Chapter 5, “Sources of Information,” outlines literally hundreds of information centers that can be used to gather detailed intelligence for the investigation. The availability of so many sources is an excellent resource. To keep track of information, the investigator can use the standard bibliography card to identify where it came from, who developed and wrote the reference, and what points the source gave that were applicable to the case. The all--purpose bibliography card (Appendix B) is designed to allow a single card to serve for all types of entries: books, periodicals, newspapers, bulletins, police records, and so on. The bibliography card, usually 3 x 5, is kept in the CMF for reference as needed. Once the data is gathered, the investigator begins the process of analyzing the information and developing a series of factual conclusions. In general, the investigator will use two types of reasoning in determining what is right or wrong: deductive and inductive reasoning. Deductive reasoning has two features that distinguish it from inductive reasoning. Deductive reasoning involves reasoning from general rules to a new piece of information. For example, all accountants at the ABC Company have access to corporate records; Tim is an accountant at ABC Company; therefore, Tim has access to corporate records. Since deductive reasoning goes from general rules to specific information, it is sometimes called “top-down” reasoning. The second feature of deductive reasoning is that if the premises are true and our reasoning is logical, then we can be 100 pereent sive about our conclusion. The usefulness of a deduetive argument can be described by two properties: validity and truth. Jers to whether or not the argument ght follows the rules of logic. An example of an inealid srgunen! mig be: all ducks have legs, I have Tess, = ected es ao argument is i the conclusi fom he Te apie eps ea eee bout the duck state r Te jly to conducting i Gorn false conclusion. So, how does this app'y premises, ‘The validity of an argument re Developing An Investigation Plan | 17 an investigation? Think back to Tim, the ABC Company accountant. What if he told you during an interview that he did not have access to corporate accounts, but after interviewing other people you decided he did? It was deductive reasoning that led you to that conclusion. Inductive reasoning has two characteristics. First, inductive reasoning involves observing specific events, and then trying to form general laws that explain those events. These general laws are then applied to similar events. Inductive reasoning is moving from specific cases to general rules, just the opposite of deductive reasoning. For example, you know that all employees are issued badges so that they can enter the facility. You know of no employees who have not been issued badges. Therefore, since witnesses toa crime state that the person who committed the act of theft was not wearing a badge; the person must not be an employee. Obviously; an employee could remove his or her badge so as not to be recognized, but the chance still exists that it may not have been an employee who committed the crime. This illustrates the second characteristic, that inductive reasoning never fehepem ih 0) Percent cerain. The usefulness of an ibed by two properties: plaus: reasoning can be trusted. A conclusion is plausible irtsconclceeaty be correct in a high proportion of individual cases. The investiaee, refers o this as a high level of confidence. Truth in inductive eit has the same meaning as it does in deductive arguments and applies V ‘oning, it stil doesn’t In completing the analysis, the type of reasoning used to de ning (faulty logic) that may belief, or em ; the fallacies the investi gator must velop conel Hy18 | The Process of Investigation such terms as cause and effect, Th i f oa - The moral of the story is basically this: be prepared to critically evaluate informati rather than simply believe what others say, mormation The last step in the investigative plan is to notify the client or Eupervisor about the completed investigation. The investigative report ‘has been a standard and will probably continue to be the primary means of communication. That’s not to say those periodic reports through the E-mail system or fax (non-sensitive only) won't be used, but that the Written format is the acceptable norm, The report reflects the complete investigation, and should be written in easy-to-read and understandable language. An “executive summary” section is provided at the front of the report. This gives the reader a brief synopsis of what the investigation was about, who the main characters were, and what the results were. When distributing the report, the investigator will want to ensure that copies of the report go only to those with a need-to-know status. Distributed reports should be accompanied by a letter of transmittal that indicates the level of privacy and instructions on how to handle the document when it is out of the direct control of the investigator or security department. Reports can be transmitted via secure Email (internal) lines, but i ‘pi and that they are responsible for again, the recipient must unders See ee cevelipal maintaining security. Itis suggested that formal policy be dere ‘on the safeguarding and distribution of reports, As always, Monae ili stions concerning report discovery is a possibility, so quest a directed to the appropriate legal cor MANAGING THE INVESTIGATION ion plan is in place, it becomes the .e investigation | n ae ae vo the investigation supervisor of mana zi come se responsibility © "staying on track. In an effort ws Sr following that the project een management and leadershi. oer the follow differences Pete the oversight process WO nee juld meet with the investigator and outline sho The case manager of the investigation the goals and objectives ee a os Developing An Investigation Plan | 19 * Critical deadlines are established that coincide with the client’s or organization’s needs. The manager ensures that the investigator has developed an investigative plan before the inquiry begins. This is especially true if the investigator has little or no experience in the type of investigation being conducted. Regularly scheduled feedback meetings are established and support provided to the investigator as needed. The investigator submits periodic reports to the manager, usually ona weekly basis, depending on the type of investigation. ‘The manager should maintain activity files on each investigation and record all information discovered about the case and how the investigator dealt with situations as they occurred. As simple as these may seem, most new investigation supervisors and managers are not clear on what their role really is during the investigative process. LEARNING PRACTICUM Review the following scenario then prepare an investigation plan, After you have prepared your plan turn to Appendix A, “Practicum Reviews,” and compare it with the example provided. Investigation ‘Scenario: You have been contacted by a major building contract ‘sho has requested your assistance in investigating the disappearance of materials from job sites. The amount stolen so far exceeds $25,000, Tocal law enforcement is understaffed and unable to conde thorough investigation. The contractor would like to Ria on ‘would do to investigate his case, Yo 1u have told him t ‘would be to develop an investigation plan. SUMMARY Documenting the ‘Investigation in a fc understand based on factual information is the mort est, €85Y_ to of the investigative process. Regardles s of t collected and no matter how well it was aaa ortant aspect of information iean’t be put into cL cau sisI De 20 | The Process of Investigation words that are factual and make sense, the investigation was a waste of time. Developing a consistent report format and maintaining it can be difficult. People have their own way of doing things. Following investigation policies and procedures will help eliminate fears that new investigators have about doing the right thing, but it also helps ensure that no areas of the investigation were overlooked. Managers and supervisors have the responsibility of assisting the investigator to ensure that the client's expectations are being met. The obvious outcome in failing to meet those expectations could result ina loss of business. (CHECK FOR LEARNING 1. Define the elements of a case management file (CMF). 2. Identify the elements of an investigation plan. 3. Describe techniques used to manage an investigation. REFERENCES Basic Guidelines, ASIS International, : ‘i Security Investigation The Bridge by Rodrigo V. Lorenzo, CSP, Arlington, VA: Author, 1991. CFE, 2009 ee eee Report Writing | 21 REPORT WRITING GOAL To understand the importance of producing complete reports from field notes and incident scene sketches. OBJECTIVES: 1. List the five C’s of report writing. 2. Identify the purpose of field notes. 3. Identify the importance of incident’s scene sketches. 4, Identify the three different types of reports. 5, Identify the report format most commonly used in investigative important for the private investigator to collect and document evidence. Theability to develop facts in a logical sequence and present them ‘on paper is probably one of the most important, investigator can possess. The investigator must be able to communicate, through writing, in such a way that the reader can understand what the case is about, who is involved, and the facts that led to the outcome. Report writing is defined by J. Horgan in Criminal Investigation as “a written account of something seen, heard, read, done, or considered,” Reports serve as a permanent record of the events that occur, and can be called on years later as evidence tothe facts as they existed at the time th, report was writen, This chapter will discuss how to accurately develon and record field notes, to be transferred later into report form. THE FIVE C’s OF REPORT WRITING Investigative reports should contain five be considered professionally accomplished. essential ingredients to These five clements are ————— EES22 | The Process of Investigation often Cien referred to as the five Cs: completeness, conciseness, cleamess, rrectness, and courteousness (or fairness). 2 First, a report must be complete: it should cover all the details ‘cerning the situation and contain all the facts of the case. A complete Teport offers the reader the ability to visualize what has occurred. Details missing from the report can cause confusion for the reader and make it difficult, over time, for even the investigator to accurately recreate what actually took place. Completeness means that the report contains all necessary details and omits unnecessary ones. Negative results in the investigation should be reported, as well as positive results. Information in the report should be supported by facts and evidence. The investigator’s opinion should be stated as an opinion, even if the facts of the case support the investigator’s opinion. Jargon should be left out of the report, unless it relates to a direct quote taken from the subject interviewed. The investigator should follow general writing style rules pertaining to grammar and sentence structure. Next, a report must be concise. A concise report is not necessarily a brief report, but it gets to the point without adding unnecessary information. A concise report states as much as possible with as few words as possible. Unnecessary words, technical phrases, clauses, and sentences should be eliminated. “The third C is clearness. A report must clearly explain to the reader what was seen, heard, and done. As in conciseness, well- structured short sentences are better than long confusing ones. Words must be spelled correctly and used appropriately. Proper punctuation, spelling, and capitalization rules should not be neglected. Someone Gise besides the investigator should proofread reports and content Should be discussed to ensure understanding. Its recommended that sentences not exceed twenty words, and if technical terms are to be cod, then these words should be defined, Words that can be interpreted differently by different people should be avoided. ‘A report must be correct. The accuracy of a report cannot be underestimated. A-common problem that can occur is the ES ——— eee eee Report Writing | 23 investigator’s interpretation of the facts. An investigator may assume that the information received from an informant is accurate based on past experience, and therefore reports the informat the report as factual. The problem occurs when the information is not correct, and the investigator must explain the misinformation in the report. Information must relate only to those things that have transpired and been verified by the investigator and should not include conclusions. Information related to names, dates, addresses, phone numbers, subject descriptions, and other critical information should be recorded correctly. Errors or omissions can raise doubts as to the thoroughness, ,, and personal ability of the investigator. An individual’s fate often hinges upon the accuracy and completeness of the information in a report. Facts are reported without prejudice or exaggeration to enhance the credibility of the investigator. One common mistake an investigator makes is to report information that has not been verified. Accurate reports are best achieved through limiting the data in the report to sensory observations: sight, hearing, and touch. The report reflects the integrity of the investigator, and every effort should be made to maintain accuracy. Courteousness or fairness must be adhered to at all times. Fair reports lack personal antagonisms or subjective opinions that alter the objectivity of the report. Any attempt to judge or otherwise use theories to replace facts must be avoided. A well-written report, developed with faimess in mind, does not contain speculation, hypothesis, or the investigator’s opinion. If an opinion or speculation is to be made, it should be accomplished in a different form, such as a memorandum te the client and/or managing investigator. oa FIELD NOTES Field notes are the single most important technique that an investigator can use to record vit notes are a permanent record ofthe events that took p formation-gathering formation. Field lace, as well ases 24 | The Process of Investigation who was involved. Field notes aid the investigator in remembering the information gathered during the interview and the observations made during the investigation. Field notes are an important reference tool to be used during follow-up interviews with subjects. An investigator can refer back to accurate field notes to establish changes in a subject’s story. Good field notes can enhance the investigator's credibility, as, well as the report, There are three styles of note taking that the investigator can use: narrative, question and answer, and chronological. The narrative style reflects the language used by the subject being interviewed. It offers the subject the opportunity to express his or her story freely. A disadvantage associated with this style is that it can become burdensome for the investigator and it is time-consuming. The question and answer technique is designed to gather specific information concerning an individual incident, such as a traffic accident. In conducting security investigations questions developed for the interview often come from previous reports or other subject interviews. The primary advantage of this style is that specific information can be gathered quickly. The disadvantage of this style is that pertinent information could be inadvertently omitted, ‘The chronological style is used to record information when facts concerning time are important. An example of the chronological style being helpful would be when the investigator is trying to establish the dates and times that someone last saw a person who has been missing for awhile. In preparing to take field notes the investigator should acquire juipment. The first tool selected is a good everal pieces of simple eq sotebook, usually a 3 x S-inch spiral. It should be easy to carry and fit Wall into most pockets. Spiral notebooks make it difficult to remo\ wrose pages, and once the case is closed the notebook can be e SKored with the file. Investigators should place their name and contact tion in the notebook in the event the notebook is lost. An informat i vmvgitional statement referring to a reward offer if found should be _ paginated, and investigator contact inform: EEE EEE=E_e Report Writing | 25 included. A list of phone numbers relevant to the case should be placed at the front of the book for easy access. Notebooks should be filed according to the case being worked. Tt may be difficult to switch out notebooks, and if cases are mixed in notebooks it may be difficult to remember which facts were associated with which case as well as what notebook they were noted in, so it is suggested that separate notebooks provide the best means to find case-specific information. Notebook pages should be numbered and entries dated for reference. To keep notebook pages clean and crisp, only one side of the page should be written on. Additional marks and doodles are not appropriate in the case notebook; only information related to the case is annotated. All details, regardless of insignificant appearance, should be recorded. What may not seem important at the time can become a crucial piece of information later. Water-resistant notebooks are now available, as well as writing instruments that use ink that is not susceptible to water. In addition to a good notebook, an investigator should possess ‘a mini tape recorder, with enough micro tapes available to change for ceach separate case. Having a 1/4-inch 50-foot steel tape measure allows the investigator to take and record accurate measurements, Having to possess a compass as available aid in orientating maps and describing the relationship of items annotated in field sketches. The investigator should obtain local maps to identify streets and major sites of interest. When drawing sketches, graph paper will help the non-art investigator. As with the notebook, graph paper sheets should be placed on each sheet. ‘To make annotating contact information easier, a rubber stamp could be made and used. Other types of paper available to the investigator __ include paper for tracing pictures and objects and preformatted report forms. When taking notes, which eventually become the basis for the report, there are six key words that the investigator needs to remember