Systematic Methods and Steps for Fixing Evidence in Anti-Fraud Investigations of Enterprises

Introduction

In the practice of anti-corruption in enterprises, what truly holds decisive significance is not whether the issue of fraud is "discovered", but whether the abnormal facts that have been identified can be fixed as a complete and stable evidence system in a legal, standardized, replicable, and acceptable manner to the judicial authorities. Anti-corruption investigations are essentially a systematic project centered on evidence. The core objective lies in constructing an evidence chain that can support qualitative determination, liability attribution, and subsequent handling based on the admissibility, completeness, and logical consistency of the evidence. Therefore, there is no simple linear path for enterprise anti-corruption investigations; instead, various means such as electronic evidence analysis, relationship investigation, document material sorting, and personnel compliance interviews need to be comprehensively utilized to promote the investigation in a coordinated manner under the premise of compliance. This article systematically summarizes the overall methods, core principles, and standardized execution steps for evidence fixation in anti-corruption investigations, aiming to provide a practical reference framework for enterprises to achieve "evidence fixation + legal usability" in actual investigations.

I. The "Four Pillars" for Fixing Anti-Fraud Investigation Evidence

The anti-corruption investigation is not a linear process of "identifying the fraud issues → searching for and securing the evidence", but a systematic project centered on the feasibility of the evidence and the integrity of the evidence chain. The overall approach to discovering and securing evidence in an enterprise's anti-corruption investigation can be summarized into the following four main pillars:

Sub-item 1: Electronic Forensic Analysis. Specifically refers to the process of extracting, preserving in its original state, and analyzing the data generated and stored during the process of fraud occurrence, which is located on electronic devices or information systems.

Subpillar 2: Investigation of Interrelationships. Specifically refers to: Revealing interrelationships including but not limited to close relatives, interested parties, affiliated companies, and actual controllers, explaining the causes and background of the fraudulent behavior, and clearly establishing the logical loop of "power - interest - transaction object" as a whole.

Sub-Item 3: Review of Documentary Evidence. Specifically, it involves: Through the analysis and evaluation of written materials, embedding the fraudulent behavior within the company's systems and processes, identifying anomalies in the company's management and business procedures, and constructing a logically coherent and clearly narratable evidence framework and chain.

Pillar 4: Interviews with Key Personnel. Specifically refers to: Through communication and written records with personnel involved in the fraudulent behavior, solidify the facts of the fraudulent behavior that have been obtained, verify the logical evidence of the fraudulent behavior, and obtain the confirmatory statements of the relevant personnel regarding the fraudulent behavior, or have the opportunity to obtain additional clues.

The "four pillars" mentioned above do not have a simple sequential or parallel relationship in the practical operation of anti-corruption investigations. Instead, based on the nature and specific manifestations of the fraud, the investigators carry out coordinated progress according to factors such as the investigation rhythm, investigation resources, and personnel division, ultimately achieving the ultimate goal of "evidence fixation + legal availability", so that all the evidence can become the basis for the company or judicial authorities to determine the nature and responsibility of the fraud.

II. Core Methods for Fixing Evidence in Anti-Corruption Investigations

(1) Electronic Forensic Analysis: Preserve the most original and crucial evidence of fraud

Electronic evidence is currently the most powerful and irreplaceable type of evidence in anti-corruption cases. Its core value lies in: restoring the true path of the fraud, fixing the key evidence of "subjective intent", and providing the underlying support for subsequent judicial authorities to file cases. The main objects of electronic evidence collection include: employees' work computers, mobile hard drives, enterprise email, cloud storage, ERP, financial systems, approval system logs, instant messaging tools (under compliance conditions), external public network information (social media, platform accounts). In summary, the requirements for fixing key evidence include: 1. First, perform a non-destructive image and verify the HASH value. 2. Seal the original: prevent the original device from being overwritten or destroyed. 3. Prohibit direct operation on the original disk. 4. Record the entire process (audio and video recording). The practical operation norms for fixing evidence directly affect the admissibility of electronic evidence in criminal and civil procedures in the later stage.

(2) Investigation of Affiliated Relationships: Establishing "Motivation" and "Pathway for Benefit Transfer"

In judicial practice, clear evidence of the relationship is an important factor in initiating criminal cases (the specific criteria shall be determined by the judicial authorities). The types of evidence that can be fixed during the investigation of the relationship include: 1. Business registration and internal documents. 2. Evidence of shareholding proxy, actual control. 3. Family relationship, long-term social relationship. 4. Cross-traces of the involved employees and the transaction counterparties. From an operational perspective, the operational principles for fixing evidence during the investigation of the relationship are as follows: 1. Prioritize the use of public information + legal access paths. 2. Interact with electronic forensics and documentary materials for mutual verification. 3. Avoid "conducting interviews and conversations first, then conducting investigation and evidence collection", which may lead to the loss of evidence.

(3) Review of documentary evidence: Converting scattered facts into an "evidence chain"

Documentary evidence is the crucial link that transforms the facts of fraud from "clues" to "determination". During the process of sorting out documentary evidence, the following objects need to be given special attention and fixed: contracts, approval forms, quotation sheets, project initiation and bidding materials, financial vouchers, payment records.

Personnel files, job responsibility descriptions. For documentary evidence materials, the key points for preserving evidence include: 1. Prioritize the preservation of original documents. 2. Establish records of the source and transfer of the materials. 3. Avoid merely retaining scanned copies or photocopies.

(4) Personnel Compliance Interviews: Strengthening Evidence Rather Than Starting from Evidence

From the perspective of sound practical experience, compliance interviews are not the starting point of anti-corruption investigations. Instead, they are "plus points" or "extension items" after the basic fixation of the evidence materials listed in (1), (2), and (3). In simple terms, the fixed requirements for personnel compliance interviews mainly include: 1. There must be an interview outline and strategy. 2. Full audio and video recording or the formation of a standardized record. 3. The content must be mutually corroborated with electronic evidence, documentary evidence, and the investigation results of the relationship. 4. Avoiding illegal situations such as inducement for confession or coercion that lead to the invalidation of the evidence.

III. Standard Operating Procedures for Fixing Evidence in Anti-Fraud Investigations

From the practical process of collecting evidence in anti-corruption case investigations, it can be generally summarized as a six-step execution closed-loop process. Specifically as follows:

(1) Information Reception and Preliminary Risk Assessment

The core of this step lies in: Before the investigation process is officially initiated, conduct a rapid, rational and structured assessment of the clues obtained through internal reports, audit findings, or other channels, focusing on determining whether the clues point to specific individuals, specific behaviors, and verifiable facts, whether there are initial abnormal signs and potential company risks. Through the initial screening of the authenticity, severity, investigability, and possible legal boundaries of the clues, distinguish between "management issues", "compliance risks" and "fraud suspicions", thereby avoiding mistakenly initiating the investigation due to unclear information, hasty judgment, and wasting resources, and providing a solid basis for subsequent decisions on whether to launch the investigation, the depth and path of the investigation.

(II) Design of the Investigation Plan

The core of this step lies in: Before formally launching the investigation operation, based on the basic logic of "first evidence, then action", a pre-planning and risk control for the overall investigation path should be carried out. The investigators need to first clarify the possible evidence collection directions and types of evidence, reasonably arrange the sequence of the investigation, and avoid losing evidence or causing risks to spread due to hasty actions; at the same time, make a preliminary judgment on the nature of the case, assess whether it may touch upon criminal legal boundaries, and accordingly calibrate the standards and procedures for evidence fixation in reverse. As the handling path progresses from internal accountability to civil claims and then to criminal transfer, the requirements for the authenticity, completeness, and procedural legality of the evidence also increase progressively. Therefore, the essence of this step is to, through pre-design, integrate the investigation target, evidence standards, and legal risks into the same framework, laying a controllable, compliant, and clearly directed foundation for the subsequent investigation work.

(3) Prioritize the collection of electronic evidence

The core of this step lies in: Before any compliance interviews, internal communications, or the release of information outside the organization, prioritize, promptly, and in a compliant manner, complete the identification, extraction, and fixation of key electronic evidence. Transform the time advantage during the investigation initiation stage into an advantage in evidence. Given that fraudulent behaviors often highly rely on electronic system traces, once the investigated party or relevant stakeholders detect the risks, they are likely to evade responsibility by deleting, overwriting, or tampering with electronic data. Therefore, the essence of this step is to maximize the preservation of original electronic traces within the window period when "information has not spread and evidence has not been interfered with". Through standardized evidence collection and original state sealing of core carriers such as computers, email accounts, system logs, and business data, provide a reliable and stable evidence foundation for subsequent relationship analysis, document review, and personnel interviews, fundamentally reducing investigation uncertainty and controlling the overall evidence collection risk.

(4) Strengthening the connection between relationships and documentary evidence simultaneously

The core of this step is to establish a closed loop of fraud logic and construct an evidence network. Specifically, based on the already fixed key electronic evidence and abnormal facts, a simultaneous investigation of the relationship between them and the sorting out of documentary evidence materials should be carried out. The personnel - authority - transaction - result should be organically connected. By proving the abnormal interest relationship between the personnel and the transaction counterpart, and embedding these relationships into specific business processes such as contracts, approvals, finance and projects, the "why this person, why this transaction, why the loss" can be systematically explained. Thus, the scattered evidence points can be integrated into an evidence network that is mutually corroborating and causally consistent, completing the fraud logic loop and laying a solid foundation for subsequent personnel interviews, responsibility determination and legal handling.

(5) Personnel Compliance Interviews and Evidence Strengthening

The core of this step lies in: Given that the fraud logic loop and evidence network have basically taken shape, legally and prudently initiate personnel compliance interviews, and clearly position these interviews as tools for verifying, confirming, and strengthening the existing evidence, rather than the starting point for obtaining evidence. By focusing on the electronic evidence, related relationships, and documentary materials already obtained, and requiring the interviewees to explain or confirm specific objective facts, the personnel's statements are made to correspond one-to-one with the objective evidence, and mutually confirm each other. This further solidifies the boundaries of the facts, reduces the space for reasonable explanations, and, without undermining the validity of the evidence or triggering procedural risks, strengthens the overall evidence system, providing stable and usable support for responsibility determination, handling decisions, and subsequent judicial paths.

(6) Evidence Integration and Legal Path Selection

The core of this step lies in: After the aforementioned evidence collection, analysis, and interview work are completed, the fixed electronic evidence, documentary materials, related relationships, and personnel statements should be systematically integrated and comprehensively evaluated. From an overall perspective, it is necessary to determine the completeness, stability, and the degree to which the evidence can be used in different legal procedures of the evidence system. Investigators should be evidence-oriented and carefully select the subsequent processing path: For evidence that can clearly support violations of discipline and regulations but is not yet sufficient to enter the judicial process, internal disciplinary actions should be carried out in accordance with laws and regulations; for those that already have facts of damage and a basis of responsibility, civil compensation should be advanced through evidence solidification to recover company losses; and when the evidence is clear in facts, large in amount, the nature of the behavior is serious, and it meets the legal constitutive requirements, adequate preparations should be made for criminal accusations and judicial transfer (specifically as determined by the judicial authorities). The essence of this step is to achieve precise matching between processing paths and evidence strength under the same set of evidence system, avoiding "excessive evidence" or "insufficient evidence", and ensuring that the investigation results can truly be transformed into implementable and executable legal and management outcomes.