Evidence, interviews and tracing funds

Findings are only as strong as the evidence behind them. This lesson covers the kinds of evidence forensic accountants gather, the rules that affect whether evidence can be used, the conduct of interviews, the privacy limits on collecting information, and the methods used to trace where money went when the direct records are incomplete. It continues the Saltmarsh Industrial Supply Inc. investigation through the interviews of March 2026 and the analysis of R. Calloway's finances.

Kinds of evidence

Documentary evidence includes contracts, invoices, purchase orders, receiving reports, bank statements, emails, messages, corporate registry filings and property records. It is usually the backbone of a forensic case, because documents are created at the time of events and do not change their story. Testimonial evidence comes from people, in interviews, statements and testimony. Digital evidence includes system logs, metadata, deleted files and device data, recovered by digital forensics specialists. Physical evidence includes items such as stolen inventory or forged stamps. Analytical evidence is the result of the forensic accountant's own work, such as reconstructed accounts, data analyses and schedules of losses, which must be traceable to the underlying records.

Courts and tribunals apply rules that affect how evidence can be used. Evidence must be relevant to an issue in dispute and authentic, meaning it is what it claims to be. Original documents or reliable copies are preferred; when only copies exist, the investigator documents where they came from. Hearsay, a statement made out of court offered for the truth of its contents, is generally excluded, but business records made in the ordinary course of business are usually admissible under exceptions in both countries, which is why ledgers, invoices and bank statements are central to forensic cases. Evidence obtained unlawfully may be excluded or may expose the organization to liability. These are legal questions for counsel, but forensic accountants must gather and document evidence in ways that preserve its usefulness.

In the United States, the Federal Rules of Evidence and state equivalents contain the business records exception and rules on authenticating electronic records, which can often be self-authenticated by a certification from a qualified person.

Every item of evidence needs a documented chain of custody: who collected it, when, from where, how it was stored and who has handled it since. For electronic evidence, hash values computed at collection prove that the copy examined later is identical to what was collected. For documents, the investigator logs each item, keeps originals secure and works from copies. Questioned documents, such as suspected forgeries or altered invoices, should be referred to a qualified forensic document examiner rather than judged by eye.

Gathering information lawfully

Investigators can obtain much information from public sources: corporate registries, property records, court files, bankruptcy records, news reports and social media that is publicly available. This open-source intelligence is valuable, but it must be gathered lawfully and ethically. Investigators should not use false pretences to obtain information (pretexting), access accounts without authorization, or collect more personal information than the investigation needs.

In the United States, there is no general federal private-sector privacy law. The Fair Credit Reporting Act can apply when an employer uses a third party to compile reports on employees, although amendments in 2003 relaxed some requirements for investigations of suspected misconduct. The Gramm-Leach-Bliley Act prohibits obtaining customer financial information from financial institutions by false pretences. State laws add requirements, and recording rules vary: federal law and most states permit recording with one party's consent, but some states require the consent of all parties, so open recording with notice is the safer practice.

Bank records and other private records of the subject are usually obtained through legal process rather than by investigators directly. In civil cases, counsel can seek orders requiring banks and others to produce records; in some urgent cases, courts can grant orders to freeze assets or to require disclosure before the defendant is notified. In criminal cases, police obtain records by warrant or production order. For Saltmarsh Industrial Supply Inc., counsel obtains orders for the records of Northfield's bank account and of R. Calloway's personal accounts in April 2026, as part of a civil claim to recover the payments.

Interviews

Interviews serve two purposes. Information-gathering interviews collect facts from witnesses who know how processes work or what they saw. Admission-seeking interviews, used only when the evidence reasonably indicates that the subject is responsible, give the subject the opportunity to explain or to admit what happened. Both should be planned: the interviewer reviews the documents, decides what to ask and in what order, and prepares exhibits to show. Two people normally attend, one to lead and one to take notes, and the interview is recorded where policy and law allow.

Good interviewing is a skill built on rapport and open questions. Many organizations now train investigators in the PEACE model, developed in England in the early 1990s: Planning and preparation; Engage and explain (introduce the purpose and the process); Account, clarification and challenge (obtain the interviewee's account in their own words, clarify it, and then challenge inconsistencies with evidence); Closure; and Evaluation. PEACE emphasizes obtaining reliable information rather than a confession, in contrast to accusatory techniques such as the Reid technique, which has been criticized for increasing the risk of false confessions. Interviewers avoid threats, promises of leniency and misleading statements about the evidence, which can make statements unreliable and expose the organization to claims.

Interviewees in workplace investigations have rights that vary by setting. Employees may have a duty to cooperate with their employer's investigation, but they may refuse, and the consequences are employment questions for counsel. Unionized employees may be entitled to a representative. A private employer's investigator is generally not subject to the cautions that police must give, but if the investigation becomes a joint effort with police, constitutional protections may apply, and public sector employees in the United States have specific protections against compelled self-incrimination in internal investigations. Counsel should be consulted before interviews of subjects.

At Saltmarsh Industrial Supply Inc., R. Calloway is interviewed on March 12, 2026 by the two senior forensic accountants, with his consent to recording. He explains how vendors are added and how he approves invoices below 5,000 dollars. Asked about Northfield, he says the vendor provides courier and freight coordination, that a warehouse manager requested it, and that he has never met anyone from the company. Shown the vendor creation record entered under his user ID and the registry filing listing G. Pellerin at 14 Ferncliff Drive, he says that many people use that address and that he does not recall entering the vendor. The interview ends without an admission. A week later, G. Pellerin, interviewed with his own lawyer present, says that Calloway asked him to register the company, that Calloway keeps the company's bank card, and that Pellerin received small payments for his help. The warehouse managers say they never requested logistics services from Northfield and have no record of any delivery.

Tracing funds: direct and indirect methods

Direct methods trace specific transactions: payments from the victim to the shell account, then transfers out to identified accounts and assets, using bank records. When records are complete, direct tracing is the strongest evidence. When they are incomplete, for example because funds were withdrawn in cash, moved through accounts the investigator cannot access, or spent on untracked items, indirect methods estimate the subject's income from unknown sources by comparing what the subject acquired and spent with what the subject legitimately earned. Tax authorities have used these methods for decades, and courts in both countries accept them when properly prepared.

The net worth method computes the subject's net worth (assets less liabilities) at the end of each year, adds known living expenses, and subtracts known income; what remains is income from unknown sources. The expenditures method, also called the source and application of funds method, compares all applications of funds (asset purchases, debt repayments, living expenses) with all known sources; it suits subjects whose assets do not change much but who spend heavily. The bank deposits method totals deposits to the subject's accounts, removes transfers between the subject's own accounts and non-income items such as loan proceeds, adds cash spent without being deposited, and compares the result with known income.

The two programs below apply the net worth and bank deposits methods to R. Calloway's finances, using figures assembled from the bank, property, vehicle and investment records obtained through the civil process, his payroll records and an estimate of living expenses based on statistical data and his own spending records. All figures are invented.

# Net worth method: estimating income from unknown sources for a subject (invented figures).
# Unexplained income = increase in net worth + known spending - income from known sources.
years = [2021, 2022, 2023, 2024, 2025]
assets = {      # year-end balances, dollars
    2021: {"bank": 8200, "home equity": 61000, "vehicles": 14000, "investments": 3000},
    2022: {"bank": 21400, "home equity": 72000, "vehicles": 14000, "investments": 9500},
    2023: {"bank": 30800, "home equity": 98000, "vehicles": 52000, "investments": 26000},
    2024: {"bank": 24100, "home equity": 131000, "vehicles": 47000, "investments": 61000},
    2025: {"bank": 38900, "home equity": 166000, "vehicles": 66000, "investments": 88000},
}
liabilities = {2021: 22000, 2022: 19000, 2023: 31000, 2024: 27000, 2025: 24000}
spending = {2022: 51000, 2023: 63000, 2024: 68000, 2025: 74000}       # living expenses and travel
known_income = {2022: 64100, 2023: 66300, 2024: 68500, 2025: 70900}   # after-tax salary and other declared income
nw = {y: sum(assets[y].values()) - liabilities[y] for y in years}
print(f"{'Year':<6}{'net worth':>11}{'change':>10}{'spending':>10}{'known income':>14}{'unexplained':>13}")
print(f"{2021:<6}{nw[2021]:>11,}")
total = 0
for y in years[1:]:
    chg = nw[y] - nw[y - 1]
    unexpl = chg + spending[y] - known_income[y]
    total += unexpl
    print(f"{y:<6}{nw[y]:>11,}{chg:>10,}{spending[y]:>10,}{known_income[y]:>14,}{unexpl:>13,}")
print(f"\nIncome from unknown sources, 2022-2025: {total:,}")

Year    net worth    change  spending  known income  unexplained
2021       64,200
2022       97,900    33,700    51,000        64,100       20,600
2023      175,800    77,900    63,000        66,300       74,600
2024      236,100    60,300    68,000        68,500       59,800
2025      334,900    98,800    74,000        70,900      101,900

Income from unknown sources, 2022-2025: 256,900

# Bank deposits method: deposits to the subject's accounts compared with known income (invented).
# Transfers between the subject's own accounts and loan proceeds are removed before comparison.
deposits = {2023: 128400, 2024: 146900, 2025: 158300}         # total deposits to all personal accounts
transfers = {2023: 22000, 2024: 30500, 2025: 26000}           # between own accounts
loans = {2023: 18000, 2024: 0, 2025: 0}                       # vehicle loan proceeds
cash_spent = {2023: 4800, 2024: 6100, 2025: 5900}             # cash spending not deposited (estimated)
known = {2023: 66300, 2024: 68500, 2025: 70900}
print(f"{'Year':<6}{'net deposits':>13}{'+ cash spent':>13}{'= receipts':>11}{'known':>9}{'unexplained':>13}")
tot = 0
for y in deposits:
    net = deposits[y] - transfers[y] - loans[y]
    rec = net + cash_spent[y]
    u = rec - known[y]; tot += u
    print(f"{y:<6}{net:>13,}{cash_spent[y]:>13,}{rec:>11,}{known[y]:>9,}{u:>13,}")
print(f"\nUnexplained receipts, 2023-2025: {tot:,}")

Year   net deposits + cash spent = receipts    known  unexplained
2023         88,400        4,800     93,200   66,300       26,900
2024        116,400        6,100    122,500   68,500       54,000
2025        132,300        5,900    138,200   70,900       67,300

Unexplained receipts, 2023-2025: 148,200

The net worth method estimates 256,900 dollars of income from unknown sources from 2022 to 2025; the bank deposits method, which covers only 2023 to 2025 and only money deposited to his own accounts, estimates 148,200. Over the same periods, Saltmarsh Industrial Supply Inc. paid Northfield 449,955 dollars (2022 to 2025) and 365,375 (2023 to 2025). The estimates are lower than the payments for understandable reasons: Pellerin kept part of the money, some funds went directly from Northfield's account to the jointly owned property and the investment account without passing through Calloway's bank accounts, which the bank deposits method misses, and the estimates of spending are conservative. The indirect methods do not prove that the unexplained income came from Saltmarsh Industrial Supply Inc.. What they show is that Calloway acquired far more than his salary could explain, in the same years that Northfield was paid, which corroborates the direct tracing and the documentary evidence.

Indirect methods are open to challenge, and a careful forensic accountant anticipates the challenges. The opening net worth must be established reliably, because unrecorded assets at the start (cash hoards, gifts, inheritances) would overstate later unexplained income. Defenses such as gambling winnings, loans from relatives or gifts must be investigated. Living expenses must be estimated on a reasonable, documented basis. The report should present the method, the sources for each figure, and the effect of reasonable alternative assumptions.