ASIS CPP - Investigations Flashcards
What is an Investigation?
A systematic & thorough examination or inquiry into something or someone (the collection of facts & information) and the recording of that examination in a report)
What is a fact-finding process, ideally separated from the decision-making process?
Workplace Investigation
Facts of an effective workplace investigation
- Must be fair & impartial
- Must be factual & objective
- Must be thorough
- Must be well documented
- Must protect the rights of suspected violators & witnesses
- Must not violate the law, company policy, labor agreements, or anyone’s right to privacy
- Must be confidential - evidence findings, notes, reports & conclusions should only be shared with those who need to know
- Should always involve upper-management & HR
Primary Purposes of any Investigation
- Documenting incidents
- Identifying the cause of undesirable situations
- Documenting & correlating facts
- Identifying suspects
- Compiling information to prove/disprove allegations or implicate/exonerate suspects
- To make a decision about suitability
What is a lack of solid, ethical standards that can seriously damage the effectiveness of an investigative unit & can leave the organization open to civil or criminal liability?
Ethics
Two Key Decisions for Outsourcing and Investigation
- Size of the preferred vendor
- Whether services will be bundled
5 Attributes of an effective & reliable investigation
- Objectivity
- Thoroughness
- Relevance
- Accuracy
- Timeliness
5 Principle resources of an investigation unit
- People
- Information
- Credibility
- Physical assets
- Financial assets
4 Phases of the investigative life cycle
- Initiation of the investigation & its source
- The investigation itself
- Reporting
- use of the information (includes adjudication)
3 Tools of an investigator (“the 3 I’s”)
- Information
- Instrumentation
- Interrogation (principal tool)
3 Definition or foundation documents for the unit
- Functional charter (usually produced in the suite)
- Policy statement
- Objectives
When should an employer determine whether the employee conduct is a legitimate subject of discipline & inquiry under state & federal laws?
Prior to conducting an investigation
Principle characteristics of internal theft
- diversion
- conversion
- disguise
- divergence
Incident investigations may also be referred to as…
Complaint Investigations (which is the most common type of investigation in many organizations
An Incident Reporting System does 2 things that could not otherwise be done
- Provides a history of events occurring to the organization
- Provides a basis for professional efforts at asset recapture, recovery or incident reduction or termination
4 Categories of Security Data Analysis
- Claims avoided
- Proofs of loss
- Recovery of physical assets
- Uninsured claims or causes of action
The purpose of an Incident Report is to…
Provide data on which to base security decisions
Benefits of an Incident Reporting System
- Identifies the item targeted for theft
- Determines which counter-measures were effective
- Classifies events that are high-probability / low-criticality to low-probability / high-criticality
- Provide an overview of where security personnel are spending their time
- Plot event trends
- Facilitate protection or recovery of assets and apprehension of thieves
3 Steps to recommended reporting progression
- All employees must notify their immediate supervisor of any incidents or known or suspected asset losses
- First-line supervisors should be responsible for completing reports of losses within their areas of responsibility
- The Security Manager is responsible for reviewing the report
3 Types of Incident Database Reports
- General management distribution reports
- Corrective action reports
- Loss status report
Predictive Modeling
By tracking & analyzing incidents, the security manager can determine countermeasures that may prevent future losses
What is a common mistake of inexperienced investigators
Failing to corroborate evidence
3 Forms of evidence
- Oral
- Documentary
- Physical
Spoken statement regarding person’s knowledge which may be direct or indirect & gained in any manner
Oral Evidence
Information usually in the form of documents or writing impressions
Documentary Evidence
Evidence that is tangible
Physical
Evidence that is first-hand knowledge
Direct Evidence
Evidence that is highly informed inference (aka: circumstance evidence or hearsay evidence)
Indirect Evidence
The rule that applies most often in determining the importance of evidence & its ability to prove a point
Materiality
In the majority of inquiries who the most available and valuable sources of information?
The persons involved
What evidence in its natural state, cannot be seen what is contained in the physical object that holds our evidence; equipment & software are required to make the evidence visible (i.e. fingerprints, electronic evidence)?
Latent Evidence
Categories of Physical Evidence
- Corpus Delicti
- Associative
- Identifying
Evidence that proves a crime has been committed
Corpus Delicti
Circumstantial evidence; links a suspect with the scene of the crime
Associative
Associative evidence that establishes the identity of suspect & found at the scene
Identifying
When does success in the use of evidence increase?
When an incident scene search is planned, coordinated, and executed by knowledgeable security employees
* A search may be either a cautious search of visible areas (avoiding evidence loss or contamination or a vigorous search of concealed areas)
2 Main tasks that the on-site team should perform
- Secure & protect the scene
- Take control of the scene immediately
In evidence searches what do you focus on first?
Evidence that could be lost
What OSHA standard says to utilize universal precautions that require all blood, body fluids or other potentially infectious materials to be treated as if infected with blood-borne diseases?
Blood-born pathogens standard
What are 3 things all explosive materials sensitive to?
heat, shock, friction
What can result from direct or indirect exposure to laser beams
Irreversible eye damage
* Prolonged exposure to the skin should also be avoided
What present hazards including toxic gases, explosive or oxygen-deficient atmospheres electrical dangers, or materials that can engulf personnel entering the space
Confined Spaces
PPE - what provides protection from acids, alkaline solutions, hydraulic fluid, photographic solutions, fuels, lubricants, aromatics, petroleum and chlorinated solvents.?
Nitrile
What offers resistance to oil, grease, acids, solvents, alkalies, bases & most refrigerants?
Neoprene
What is resistant to alkalies, oils & limited concentrations of nitric & chromic acids?
Polyvinyl Chloride (PVC)
What resists mild acids, caustic detergents, germicides & electronic solutions
Latex (natural rubber)
What material swells & degrades if exposed to gasoline or kerosene?
Latex
What is a running description of the incident scene?
The Narrative
What type of approach should be used in the narrative
Systematic
What should be used to supplement, not substitute, for the narrative?
Photographs & Sketches
What can be caused by an incorrect point of view, improper perspective & deceptive tones like shadows?
Distortion
What parts of the incident scene should be photographed first
The most fragile areas
In what positions (twice - first) should the important pieces of the evidence be photographed?
A medium distance view that shows the evidence & its position to other evidence A close view that includes a scale and fills the frame
Before releasing the incident scene ensure that the evidence is:
- Collected according to legal requirements
- Documented
- Marked for identification
Who is the only person to release the scene?
The person in charge
What is the most critical point of the incident scene investigation and is the time when errors occur?
Collection of physical evidence
What is the most common type of physical evidence?
Fingerprints
How many people should observe the evidence in place during recovery & being marked
Two
Where to mark evidence
Directly on the evidence when necessary
* The best way to certify a piece of evidence is with investigators initials
What establishes the actual chain of custody
Proper marking of evidence at the time of seizure & transfer
Adhesives - If possible submit the item to which the adhesive, caulk or sealant has adhered
If not possible remove a sample of the material with a clean sharp instrument & transfer it to a resealable plastic bag or leak-proof container, such as a film canister or plastic pill bottle
Steps for proper anthropology
- Clean & air-dry bones if possible
- Pack in paper bags & wrap in protective material, such as bubble wrap or paper
- If the tissue is present in the skeletal material, refrigerate until mailing & then ship in a foam cooler
- Collect insect samples found on the remains in leak-proof containers such as film canisters or plastic pill bottle
- Call the laboratory for additional instructions or contact an entomologist
Handling Blood Evidence
- Collect at least two 5ml tubes of blood in purple-top tubes, w/ EDTA as an anticoagulant for DNA analysis
- Collect samples for drug-or-alcohol testing in gray-top tubes
- Refrigerate (do not freeze) blood samples - use cold packs, not dry ice, during shipping
How to dry bloodstained garments
Air-dry
Bloodstains
- Do not place wet or dried garments in plastic or airtight containers
- Pack in a clean paper - do not use plastic containers
- Air-dry the cloth or swab & pack in clean paper or an envelope with sealed corners - do not use plastic containers