Inv Flashcards
In a cognitive interview, what is the purpose of the reverse order technique
To help the witness recall events in a different sequence
What is the main disadvantage of using forensic accounting in investigation
High cost, Time consuming nature, Complexity of the process
What is the primary role of a forensic document examiner
To analyze handwriting and documents
What is the primary function of a forensic accountant in an investigation
Analyzing financial records
Which of the following is the primary goal of evidence collection at a crime scene
To preserve the evidence for analysis
Which of the following is a method for preserving evidence
Proper documentation and storage
A person may effect an arrest without warrant when he/she
Has reasonable grounds to believe that the individual will fail to attend court
Which of the following best describes the concept of saturation in surveillance operations
Ensuring continuous coverage, Overlapping surveillance efforts, Maximizing observer presence
In digital forensics what is the significance of a system log file
It records system and user activities
What is the role of a forensic anthropologist
To analyze human remains for identification
What is the primary role of a surveillance operation in an investigation
Gathering direct evidence of activities
What is the primary purpose of surveillance in an investigation
To gather evidence
What of the following is not typically a part of the cognitive interview process
Asking Leading Questions
Which type of surveillance involves following a subject
Mobile Surveillance
What is the primary function of a forensic pathologist
Conducting autopsies
What is the primary goal of a security investigation
To identify and address security threats
What is the main purpose of a root cause analysis in investigation
Identifying the cause of the incident , Preventing recurrence of incidents
Which of the following is not a common type of investigation in the business context
Market research
In the context of forensic interviews, what is the primary purpose of the Reid technique
To obtain a confession
Which of the following is not a common method of analyzing financial statements in fraud investigations
Probability Analysis
During a buy-bust operation what is the primary risk to undercover agents
Exposure and potential physical harm
Which of the following is a not primary consideration in the planning of a buy-bust operation
The financial cost of the operation
During an interrogation using the REID technique, what is the primary goal of the theme development phase
To create a psychological environment conducive to confession
In a cognitive interview, what is the purpose of using varied recall techniques
To trigger different aspects of memory
Which of the following is a key component of a risk assessment in investigations
Identifying potential threats
Evaluating the probability of occurrence
Determining potential impact
Which of the following is not a benefit of using video surveillance in investigations
Privacy Protection
What is the primary function of a forensic lab
To analyze physical and digital evidence
What is the main goal of an internal investigation
Identifying policy violations, Determining the cause of incidents, Implementing corrective actions
What is the primary objective of an undercover operation
To gather information covertly
Which of the following is not a typical step in the investigation process
Closing the investigation without reporting
What is the main objective of conducting a root cause of analysis in an investigation
To identify the underlying reason for an issue
Which of the following is not a component of the fraud triangle
Detection
Which of the following best describes the concept of beyond a reasonable doubt
The standard of proof in criminal cases
What is the main difference between a control hire and cold hire in undercover investigations
Control hires are pre planned. Cold hires are spontaneous
Which of the following best describes Lima Syndrome
Captors develop sympathy for their hostages
Which of the following is not an investigative interview principle
Leading Questions
What is the main purpose of a risk assessment in an investigation
Identifying potential threats and vulnerabilities
What is the primary objective of an employee background check in an investigation
To verify the accuracy of the employees resume
Which of the following is a primary benefit of using the cognitive interview technique
Enhanced recall of detailed information
What is the primary goal of an internal investigation
Identifying policy violations
What is the primary purpose of a chain of custody in an investigation
To document the timeline of the investigation
To ensure evidence integrity
What is the role of a crime analyst
To analyze crime data and trends
This process should be reserved for individuals whose involvement in the issue under investigation is reasonably certain
Confrontational interview
Which of the following is not a characteristic of an effective interview environment
Distraction
What is the first step in conducting an investigation
Establishing objectives
In an investigation what is the primary purpose of a polygraph test
To detect lies
What is the main objective of conducting a forensic audit
To identify financial discrepancies
Which of the following is not an effective way to maintain the integrity of digital evidence
Allowing multiple people to handle the evidence
Which of the following is not a benefit of using open source intelligence (OSINT) in investigations
Ensuring evidence integrity
What is the primary objective of a interview in an investigation
To obtain information and verify facts
Which of the following is not typically included in an investigation report
Detailed financial analysis
In the context of investigations what does the term modus operandi refer to
The suspects method of operation
Which factor is most important in witness credibility
Consistency of testimony
Which of the following best describes a subpoena
A legal order to compel testimony or the production of evidence
Which of the following best describes a lead in an investigation
A potential source of information or evidence
In digital forensics, what is the primary purpose of network traffic analysis
To identify unauthorized access
Which of the following best describes the concept of reasonable suspicion
A belief based on facts that a crime may have been committed
Which of the following is not a typical step in the fraud investigation process
Marketing
What is the main disadvantage of physical surveillance
High cost
What is the primary function of an investigative plan
To outline the steps and objectives of an investigation
Which of the following best describes the primary purpose of an undercover operation
To gather evidence without detection
Which of the following is not a typical step in the investigative process
Making assumptions
What is the purpose of an undercover agent
To gather information without being detected
In the context of interview techniques, what is the primary advantage of using cognitive interviewing
It enhances the interviewees memory recall
What is the main purpose of litigation hold
To prevent evidence destruction
Which of the following is not an essential characteristic of a well conducted investigation
Expediency
Which of the following best describes lock in effect
Data migration difficulty
What is the purpose of an investigative report
To document findings and support conclusions
Which of the following is not a typical step in the evidence collection process
Manipulation
Which of the following best describes a sting operation
An operation where suspects are tricked into committing a crime
Which of the following best describes Stockholm Syndrome
Hostages develop positive feelings towards their captors
What is the importance of maintaining confidentiality during an investigation
To protect the integrity of the investigation and the privacy of involved parties
What is the main disadvantage of relying solely on digital evidence in an investigation
Potential for data manipulation
What is the primary disadvantage of using physical surveillance in invesgitations
High Cost
Risk of detection
Which of the following is not a preservation method for digital evidence
Encrypting
What is the main disadvantage of using covert surveillance in investigations
Risk of detection
Which of the following statements about the Reid technique is True
It involves direct confrontation and accusation
In an investigation what is the primary benefit of using forensic imaging software
It ensures data integrity
In the context of interviews, what does rapport building refer to
Establishing a connection to facilitate communication
Which of the following is not a common error in digital evidence collection
Using write blocking tools
Which of the following methods is not typically used to conceal embezzlement
Performing routine audits
During an interrogation using the REID technique, what is the primary goal of the theme development phase
To create a psychological environment conducive to confession
What is the primary function of an interview in an investigation
To gather information from witness and suspects
Which of the following best describes the term forensic analysis
A scientific examination of evidence
Which of the following is a defining feature of Stockholm Syndrome
Hostages develop positive feelings for their captors
Which of the following is a common technique used in investigations
Interviewing witnesses
Which of the following best describes the concept of reasonable doubt
A standard of proof in criminal cases
Which technique is most effective for interviewing witnesses
Establishing rapport
Which of the following is not typically included in the principles of due diligence during investigations
Immediate confrontation with suspects
Which of the following is not a standard technique in digital forensics
Conducting interviews
What is the primary disadvantage of using biometrics in investigations
Hight cost, Legal and privacy concerns, Technical Complexity
What is the purpose of a forensic lab in an investigation
To analyze physical and digital evidence
Which of the following is not typically considered a red flag for financial fraud
Frequent travel for business purposes
Which of the following is not an essential quality of an effective investigator
Bias
The principle of Unity of command is most relevant to which aspect of investigations
Organizational structure
What is the primary disadvantage of using open source intelligence (OSINT)
Legal and Ethical Issues
What is the purpose of a witness statement in an investigation
To document firsthand accounts of an incident
What is the purpose of an surveillance operation
To monitor activities for evidence gathering
In the context of cognitive interviews, what is the context reinstatement technique used for
Enhancing witness memory recall by recreating the original context
In an investigation what is the primary function of an evidence locker
To secure physical evidence
Which of the following is not a method used to validate the authenticity of digital evidence
Physical examination of the hardware
In the context of undercover investigations what does the cold hire imply
The agent has not prior relationship with the target
In an interrogation using the Reid technique. What is the primary purpose of the theme development stage
To suggest reasons why the suspect committed the crime
What is the primary purpose of a sting operation
Evidence gathering
Which of the following is not a method for ensuring the integrity of investigative files
Allowing unrestricted access
In an interrogation using the Reid technique. What is the primary purpose of the minimization strategy
To reduce the suspects perceived consequences of confessing
In cognitive interviews why it is important to allow the witness to recount events in their own words
To avoid influencing the witnesses memory
The Law of Tort deals with
Torts against person and property
In digital forensics what is the primary purpose of creating a forensic image of a storage device
To replicate the contents exactly for analysis without altering the original
What is the primary challenge of using mobile forensic in investigation
Legal implications
What is the main objective of a forensic interview
To gather detailed information
Which of the following is common challenge in conducting undercover operations
Maintaining the undercover agents cover
Which of the following best describes the chain of custody in evidence building
A record of all individuals who have handled the evidence
What is the key benefit of OSINT
Public information access
Which of the following is the primary purpose of a surveillance operation
Gathering Evidence, Deterring criminal activity, Protecting Assets
Which of the following is not a typical source of open source intelligence (OSINT)
Confidential informants
What is the primary purpose of a root cause analysis in investigations
Identifying the underlying reasons for an incident
What is the key to effective report writing in investigations
Being, Clear, Concise and Objective
In the context of digital forensics, what is the purpose of using a disk image
To replicate the contents of a disk for analysis
What is the main purpose of a audit trail
To document financial transactions
Thefts of this nature are held to be impulsive acts committed by persons operating alone who pick up an item or two that is readily available when there is small risk of detection
Theft of opportunity
What is the primary goal of a preliminary investigation
Crime determination
Which of the following best describes the term substantial evidence
Evidence that is reasonable mind might accept as adequate
In the context of PEACE model, what does Account refer to
Allowing the suspect to tell their story uninterrupted
Which of the following is not a common symptom of financial statement fraud
Increased capital expenditures with no significant business expansion
In forensics accounting what is the primary purpose of a Benfords law analysis
To identify unusual data patterns in financial statements
Which of the following best describes the purpose of a forensic analysis
Analyzing evidence in a laboratory setting
In a digital forensic investigation what is the primary reason for creating a forensic image of a harddrive
To preserve the original data
What is the significance of probable cause in investigation
Reasonable grounds for making a search or pressing a charge
Which of the following is not a characteristic of a well conducted surveillance operation
Immediate confrontation of a the suspect
What is the primary goal of an asset search in a fraud investigation
To locate hidden assets
In the context of digital forensics, what is the purpose of using a disk image
To replicate the contents of a disk for analysis
In digital forensics what is the purpose of a write blocker
To prevent alterations to the original data
what is the primary benefit of using multiple investigators in a complex case
Enhanced expertise
Increased resources
Faster resolution
Which of the following statements about chain of custody is incorrect
It is only necessary for physical evidence
Which of the following is an example of testimonial evidence
A witness statement
In the context of investigations what does the term due diligence refer to
The thoroughness of the investigation
Which of the following is not a typical sign of data tampering in digital forensics
Regular file backups
What is the main disadvantage of using witness statements in an investigation
Potential for bias and inaccuracies
What is investigation
Investigation is a systematic and through examination or inquiry into something or someone (the collection of facts and information) and the recording of that examination in a report
Define investigation from management perspective
Management is defined as the act of conducting or supervising something or “the judicious use of means to accomplish an end
What are the primary purposes of an investigation
The primary purpose of any investigation thoroughly documenting incidents -identifying cause of undesirable situations - documenting and correlating facts surrounding any situation or allegation - identifying suspects involved in a crime or act of misconduct - completing information that proves or disproves an allegation or that implicates or exonerates an individual suspected or committing a crime or misconduct - allowing a decision to be made, often with respect to a level of trust or suitability determination, regarding an individual
What is defalcation
Failure to properly account for money held in a fiduciary capacity
What are the considerations for an investigation
Investigation Considerations:
(a) The case level
(b) The strategic levels
Define the investigative functions at case level
At the case level: the purpose sets the context within which the investigation will be conducted and help keep the people working or the particular case focused
Define the investigative at the strategic level
Dictates the necessary planning, organizing, equipping, staffing and preparation
What are the qualities of an effective investigation
Objectivity, thoroughness, relevance, accuracy and timeliness
Who will ensure that the investigations are present at the case and strategic level of investigation?
It is management’s role to ensure these qualities are present at both level of investigation
The most difficult requirements for the investigator is to maintain
Objectivity
Many investigations are founded or working……….
Hypothesis
The hypothesis is appropriately used as a tool as long as it remains within……….
The bounds of objectivity
What is the common mistake of inexperience investigation
Failure to corroborate evidence is a common mistake of inexperienced investigations, but it can happen to anyone
What shall an investigator do to aid in maintaining objectivity
To aid in maintaining objectivity, every investigator should consciously recognize his or her personal prejudice and neutralize the effects of those prejudices on investigative activities, including the formation of the hypothesis
What is crucial for successful outcome of a case
Investigators’ approach and demeanor is of critical importance to the successful outcome of a case
The investigation accomplishes an air of objectivity by choosing
Words and phrases carefully and avoiding facial expression and body language
During investigation, the first and foremost, the investigator must project
An air of objectivity
Corroborating important aspects through different sources is a proven means of………….
Achieving thoroughness
In the interest of thoroughness, a balance must be drawn between
An effort to follow every possible lead to its logical conclusion and gathering so much information
What is the key determinant of relevance
The spectrum of details pertains, the depth of details and cause and effect
What can arise and become extremely relevant in any type of investigation
Cause and Effect relationship
What is the least accurate forms of investigative information
Eyewitness accounts are among the least accurate forms of investigative information
In the corporate environment, most credible information on losses, several harassment and other reportable incidents come from
Employee tips
Sound investigative technique dictates
Frequent tests for verification
If an informant is the only source of key data, the informant should be tested at least for
Consistency
Who should carefully evaluate all investigative input
All investigative input should be carefully evaluated by the investigative management team
Accuracy is also a key element in
Personal background and reemployment investigation
Three things important for an investigation
In investigation it is important to: Open an investigation as soon as possible -Complete an investigation as quickly as possible - Avoid closing an investigation prematurely
Why it is important to conduct an investigation as soon as an incident is reported
The important reason for conducting an investigation as soon as incident is reported or discovered because the value of physical or electronic evidence diminishes rapidly and witnesses others who possess relevant information provide the best information when the incident in fresh
Once an investigation is under way it should be completed in …………… to conserve resource, allow operations to return normal as soon as possible, and deter other potential wrongdoers.
Expedient manners
What reflect the professionalism of the investigation
Quick and decisive
What is the impact of rush investigation
Rush investigation leads towards adverse impact including the possibility of increased liability risk
In which type of case resolution can be achieved
Resolution cannot be achieved in all cases
What can help to minimize the problem of unrealistic expectation as an outcome of investigation
Regular and timely communication between senior security or investigative managers corporate or organizational decision makers will help minimize the problem of unrealistic expectations
A crime scene investigation is an example of ………….
Reactive measures
The primary purpose of a private sector security organization is to…….
Protect the interests of the employing enterprise
Why in many cases, the public law enforcement agency having jurisdiction decides not to investigative an incident
Because of its workload and other priorities
What are points that distinct private sector and public sector investigation
The distinction between the public sector and private sector has implication for- legal authority - resource allocation - program management – investigative outcome
The value of private sector investigative capabilities are frequently measured in terms of …………………………
Recovery, restitution and risk reduction
The interest of the private sector enterprise may be best served by some combination of………………
Accepting restitution or taking administrative or employment action
Which investigation is broader in scope? Public or corporate
Corporate investigation tends to be broader in scope than those initiated by public law enforcement.
What are the points that must be consider in determining investigation outcomes
In determining investigation outcomes of the case must consider - the legal requirements in the jurisdiction - organized labour contracts in force or pending -public and investor relations - the past practice of the enterprise in similar cases
Who should be always consulted before making any decision regarding the outcome of the investigation?
Legal counsel should always be consulted in making decision about the outcome of investigation
In private sector, a formal relationship should be formed between the
Investigator and appropriate legal counsel
What are the basic functions of management
Planning, organizing, directing, coordinating, and controlling
What are the three levels of investigation in which it should be managed
Investigation can be managed at the strategic, operational and case levels
At which level of investigation legal counsel should be involved
Legal counsel must be involved at strategic level to ensure the proper focus of the investigation as it relates to company policy and procedures or civil or criminal states.
What are the issues at strategic level
Issues at strategic level include: - Who will head the investigate function - Where it will fit in the organizational structure - What its strategic goals and objectives will be - Where it will focus its efforts - How financial and personal resources will be allocated to the function
What are the functions of operations level
The operational level deals with the technical aspects of the investigative function and how the function works within its department
What are the issues at operational level
Issues at operational level include: - Case load, case assessment, quality control, investigative policies and procedures, reporting formats, liaison, composition, supplies and equipment, evidence management, and outside contracts are considered at this level.
What are the issues at case level
Issues at case level involves: - Individual investigations, the particular investigators. - Investigative technique - Case management protocols associated with them.
Goals and objectives are critical to the investigations functions at which level of investigation
All three levels of investigations
Objectives are based on
The goals but more specific and may be more short –
Objectives can be used to gauge
The progress, success or achievement of a unit
Specific, measurable goals are also known as
Metrics in modern organizations
How investigation metrics can be used
Metrics can be used to evaluate the performance of individuals, teams and organizations.
Any investigative strategies developed must be compatible with the
Organization’s overall strategic business plan.
When developing the tactical objectives for an investigative project, the IU Chief should consult
The organization’s tactical business plan to ensure compatibility
A significant issue that transcends the three levels of investigation management is that of ……………..(
Ethics
What can seriously damage the effectiveness of an IU?
A lack of solid ethical standards can seriously damage the effectiveness of an IU or individual investigators
In order to be effective in gathering, corroborating, and integrating facts, investigators and IU rely on their………
Credibility and respectability
A reputation for unethical behaviour has a significant adverse impact on the ……………
Trust relationship
For small organizations with infrequent investigative needs, the use of an outside agency or contract service (outsourcing) is
A logical choice
The primary goal of a compliance investigation is to…..
Provide guidance regarding possible or potential violations of regulatory requirements.
In almost all situations, what is a major factor in the decision to outsource or maintain an internal investigative capability?
Cost
What is included in investigative cost elements
It include personnel expenses, contracts and retainers, equipment, consumables, and office expenses.
What can be used to determine whether to outsource the investigative unit
The cost-benefit analysis is a useful tool to
To predict investigative budget, what is the best approach
The best approach is to base budget estimates on historical data, quantitative estimates of risk avoidance, support of organizational goals and factor in projected changes
What are the advantages of internal investigation sources
The advantages of internal investigative sources are:
1- company exercise complete control of the investigative process and people,
2- ability to maintain closer liaison with local agencies and internal contacts,
3- better ability to protect sensitive information and keep it inside the organization
What are the advantages of outsourcing
The advantages of outsourcing are:
1- ability to expand or reduce workforce according to actual need,
2- responsibility for equipment, supplies and training can be transferred to the contractor,
3- specialists and experts can be called in as needed,
4- can be more cost-effective,
5- minimize overhead costs,
6-investigators may have a broader base of expertise and experience, 7- gives independent, outside objective appearance to investigation.
What are the disadvantages of outsourcing
The disadvantages of outsourcing are :
1-quality control is largely in the hands of the contractor,
2- investigators may not be as familiar with the client’s company, mission, organization, and culture
What are the disadvantages of internal investigative resources
The disadvantages of internal investigative resources are:
1- high cost of maintaining an internal investigative capability,
2- need to maintain equipment that may not be used for a lengthy period,
3- need to maintain an investigative staff, including training, licensing, and personnel management,
4- especially if there is litigation, the investigation may be tainted as it has been conducted under company direction;
Optimally, the structure of an investigative function is
The result of a need assessment and a cost-benefit analysis
Investigative needs generally arise on…..
Short notice and on surge basis
How the investigative mission fits into an organizations
The reporting chain, physical location of the investigative capability
The chain between source of investigation and investigation decision maker should be long or short
The shortest reporting chain between the sources of information and the final decision maker is the best
If litigation is expected or some culpability of the company is suspected, the investigator should deliver the report directly to and only to the….
Legal counsel of record for the company
The reporting chain for investigative information or results is critical and can affect……….
Both outcome of specific cases and the effectiveness of the unit itself
Does the reporting chain requires to follow the day to day organization chart
The reporting chain does not necessarily need to follow the day-to-day organization chart or supervisory chain
What are the key considerations in selecting the physical location and layout of IU
The key considerations in selecting the physical location and layout of the IU:
1-access to key information and people,
2- privacy,
3- the need to call people in or access them for interviews,
4- the need to move quickly around the facilty,
5- the possible need to store large amounts of information or evidence,
6- secure storage space for equipment and supplies, and 7- communications needs
Define the space of an IU
Ideally, the IU would have a soundproof room with ample space for the investigation team to work together and post exhibits. The room should have internet access, telephones, and whiteboards, and it should be secured when not in use. Some teams refer such a location as a war room
A corporate investigative function, outsourcing can mean……..(
Complete outsourcing of the investigative function to an outside under contract, contracting out for selected or specialized investigative support services as needed;
The decision to outsource and the outsourcing approach are usually based on…
A cost-benefit analysis and projected overall investigative needs
The specialized services that are commonly called on to support corporate investigation are………….
1- Computer forensics,
2- forensic auditing,
3- handwriting analysis,
4-questioned document examination,
5- statement analysis,
6-forensic psychology,
7- forensic polygraph,
8- technical surveillance or counter surveillance to provide a deterrent to criminal activity.
It is recommend that vendors be preapproved through a………
Vetting process
What are the responsibilities of IU Chief after being selected the vendor
Once vendor is selected, the IU chief should ensure that key provisions or clauses of the contract pass through to any consultants or subcontractors the vendor may use
Ultimately, the responsibility for ensuring the proper training, and licensing of contract investigators lies with the………..
Hiring organizations (company issuing the contract).
The structure and operation of an organization’s investigative function can have a great impact on………..
The financial and operational health of the organization
The IU is given credibility and authority through a functional charter issued by………
The CEO or an equivalent officer
What is outlined by the policy statement
The policy statement outlines procedures for initiating and conducting investigations and it addresses reporting channels, coordination mechanisms, and disposition.
To estimate the appropriate size of the unit, what is necessary to consider
It is necessary to consider the projected case load, nature of cases, geographic area covered, and administrative or other support needs
What is considered to determine the unit size
The expected type of cases is a key determinant in unit size
Selecting professional personnel is an important aspect of setting up a …
Proprietary IU.
Which skill is considered as the most critical for an investigator?
Communication skills are one of the most critical skills needed by an investigator.
The core of any investigation is….(
The ability to elicit information from all sorts of people, both cooperative and uncooperative, with many different perspectives and at different levels is absolutely essential.
What are the skills that make a man good investigator
People with excellent observation, interpretation and correlation skills often make good investigators
The best investigators are people who have ………(
Good math skills
In many respect, an investigation is………
An analytical process
What are the consideration that should be given to prepare temporary or long term evidence storage
The consideration should be given to preparing for either temporary or long-term evidence storage which are: keys or locks combinations to the evidence storage are should be given to only a few individuals,
Budgets and financial management are always important issues, particularly when………
Establishing a new function or unit
The lifeblood of the investigative mission is…….
Information
An employee hot line is…….
A cost effective way to obtain information with regard to employee malfeasance;
What are the four key areas of managing an investigation
1- investigative function,
2- investigative resource,
3- unit management,
4- case management
What is meant by lapping
Lapping means crediting one account with money from another account
What is meant by embezzlement or defalcation
Embezzlement or defalcation mean appropriation of property by a person to whom it has been entrusted
What is meant by skimming
Skimming means keeping some of the cash
One particularly important but often neglected type of investigation is ……
The due diligence investigation
What are the principle resources of an investigation unit
The principal resources of an IU are people, information, credibility, physical assets, and financial assets
Why investigative funding needs are often difficult to project
Investigative funding needs are often difficult to project because they can be drastically affected by one or a few major cases as well as new regulatory requirement sort legislation.
Justifying investigative budget requests is a…..
Daunting task
What can significantly improve the response to funding requests
Carefully tracking and managing operational and overhead costs can significantly improve the response to funding requests
What represents the largest budget items for an IU
Costs for personnel and outside services generally represent the largest budget items for an IU
Define the investigative life cycle
The investigative life cycle are:
1-initiation,
2- investigation,
3- reporting,
4-results/follow-up
Most credible information on losses, sexual harassment, and other problems comes from
Employee tips
What are the management responsibilities in investigation phase
Management responsibilities in the investigation phase include implementation of a case management systems and appropriate administrative control
Case assignment in larger units(with several investigators) may be based on….
caseload, experience, specialization, geography, or a combination of these factors
What is the ultimate consequence of poor case assignments
Poor case assignment can quickly lead to investigator disenchantment and degrade the IU’s effectiveness and its ability to resolve cases successfully
Whose function is to manage an investigation assignment ledger?
Managing an investigative assignment ledger falls under the function of the controller or manager
What are the factors that affect an investigation production
Investigative production is affected by the temperament, competence, and working pace of the investigator, by the complexity of the case, and by the availability of informants and other sources of information
Documentation and record keeping are tedious but important aspect of……
Investigative management responsibility
What are the key issues in managing the IU
Three key issues in managing the IU are:
1- setting objectives,
2- motivating the investigative staff,
3- training.
What are the some investigation responsibilities that often neglected but important for effective operation of the unit
Setting objectives and monitoring progress toward them is a responsibility that is often neglected but is important for effective operation of the unit as well as demonstrating value to the organization
Investigative objectives must be
Specific and measurable
When a case file should be established
At the outset of each investigation and upon the approval of the IU manager, a case file should be established
In investigation, best idea often result from …
Collaboration
What are the tasks that needed to be undertaken by the lead investigator
1- track liaison contacts and information provided,
2- maintain surveillance logs,
3- maintain evidence logs,
4- file original written statements and documentary evidence,
5- where applicable, track investigative costs by case,
6-maintain the suspense log,
7- report to regulatory agencies when required;
Typically, investigative results are conveyed in……..
A formal report of investigation
In investigation, legal matters must be considered for two reasons, what are the reasons
Legal matters must be considered for two reasons:
1- to protect the company against liability and,
2- to ensure that an appropriate conclusion can be reached if the case goes to court or another legal forum
What is invaluable in operation of an effective IU?
Professional working relationships are invaluable in the operation of an effective IU.
For organization that requires frequent, large, or more complex investigations, what is advisable?
A criminal intelligence analysis function may be advisable
An important aspect of investigative management, which often receives less attention than is warranted, particularly in the private sector, is that of …..
Protecting case-specific investigative information
What is the consequence of improper handling of investigative information
Improper handling of investigative information can energize the rumor mill, harming the investigation, stock prices, market share, and corporate reputation
What is OPSECC
Operational security is the totality of all security and planning measures employed to ensure a successful outcome for a particular operation or activity as well as the safety of the investigators involved
What are the five cyclical steps included in OPSEC
The OPSEC process includes five cyclical steps :
1- identify assets (critical information),
2- define the threat(collectors, capabilities, motivations),
3- assess vulnerabilities,
4- analyze the risk(impact, priority, existing counter measures, etc;),
5-develop and implement countermeasures
An important rule of thumb is never to underestimate the lengths to which………
Adversaries will go to get what they want
During investigation process vulnerabilities can be ……….
Be direct or indirect
What are the factors an investigative risk analysis based on
Investigative risk analysis based on :
1- the nature of the critical information,
2-the credible threats,
3- the identified vulnerabilities,
4- the consequences of an information compromise-assigns levels or priorities to the information risks;
A countermeasure against information risk is……
Anything that effectively negates or reduces an adversary’s ability to exploit information or vulnerabilities
Do you think culture is an issue in investigation
Cultural issues can become a factor in an investigation in almost any type of company, industry, or organization
What is the difference in multinational and international investigation
The differences in multi-national and international investigations
Multinational investigations :These investigations can involve crimes such as terrorism, drug trafficking, money laundering, child pornography, intellectual property offenses, and corruption. Multinational investigations must consider the company’s strengths and vulnerabilities, as well as the different laws, regulations, and enforcement powers in the jurisdictions involved
International investigations : These investigations can cross multiple jurisdictions, countries, states, or borders. They can be for business, personal, litigation, or financial reasons. International investigations can take two to four weeks to complete, depending on the country being investigated
What are effect of working relationship with foreign counterpart or supporting agencies
In most cases, a close working relationship with foreign counterpart or supporting agencies can have immense benefits and greatly expedite successful resolution
If you are paying for information who should be consulted first
Legal counsel should be consulted before payments are offered for information
What is the most significant problem in international investigation
Cultural differences are the most challenging problem in international investigations
What is the best way to help in ensuring an appropriate case conclusion
The best way to help ensure an appropriate case conclusion is to focus on the basic qualities of an investigation: objectivity, thoroughness, relevance, accuracy, and timeliness;
In every case effective and reliable investigations are…
Timely and accurate
What are the types of investigation
The types of investigation are :
1- incident investigation,
2- misconduct investigation,
3- compliance investigation
The initiation event in a private sector incident investigation is
Generally a security force incident report
Which investigation is one of the most common type of investigation
Incident investigation is the most common type of investigation in many business and organizational settings
Who usually performs the incident investigation inquiry
The inquiry of incident investigation is often performed by a security supervisor or the security director rather than a full-time professional investigator
What is the most common form of workplace embezzlement
During an embezzlement investigation, cash disturbances are the most common form of workplace embezzlement
Who should approve the investigation protocol
Investigative protocol should be approved by executive management in order to lend credibility and authority to the process
The inquiry report of incident investigation is often a ……
Standardized from
An important subcategory of constructive incident investigations is
The misconduct investigation
Write an important characteristic of workplace investigation
An important characteristic of workplace misconduct investigations is that they leave the employer particularly open to legal action by employees or former employees who feel they have been treated unfairly
What is the best way to prepare for misconduct investigation
The best way to prepare for misconduct investigations is to coordinate the matter as soon as possible with the human resources director and corporate legal counsel (or equivalent officials).
Does an experienced corporate investigator use techniques to induce an innocent person to confess guilt
Experienced corporate investigators do not use techniques that may induce an innocent person to confess to guilt
What are the suggested practices in misconduct investigation
The suggested practices in misconduct investigation include :
1- determine the proposed outcome or disciplinary action at the outset of the investigation,
2-use information sources both internal and external to the organization to help prove or disprove allegations,
3- gather relevant information from previous employers of the individual in question,
4- consider collecting electronic evidence
What can significantly impair the reputation of fairness in a corporate setting and thus damage the credibility of and confidence in the IU and individual investigator
The use of coercive interview techniques can significantly impair the reputation of fairness in a corporate setting and thus damage the credibility of and confidence in the IU and individual investigator
What is the main goal of an overt surveillance
The main goal of an overt surveillance is to prevent crime or misconduct
What are the focusing points of misconduct investigation
Misconduct investigations often focus on conflict of interest, corporate resource abuse, employee theft, workplace violence, and substance abuse
If you are owner of a company, what are the decision you should take before misconduct investigation is initiated
Once a misconduct investigation has been initiated, the company must make several decisions. These decisions include:
1- whether any offense or infraction actually occurred,
2- whether reporting to law enforcement is required or appropriate, 3- how the employee will be notified of the findings and action to be taken
What are the principal characteristics of internal theft
Principal characteristics of internal theft include diversion, conversion, disguise and divergence
What is the significant source of loss worldwide
Motivated by economic conditions, internal theft remains a significant source of loss worldwide.
Workplace violence investigation is generally considered one component of…….
An overall prevention/response/recovery program for workplace violence
The best prevention of exposure to workplace violence is ……
Pre-employment background investigation program
What are the results of substance abuse
On-the –job substance abuse costs include absenteeism, reduced productivity, accidents, theft, and increased healthcare costs
Security and investigative professionals should remain alert to the …….
Possibility of false allegations regarding substance abuse and be prepared to take appropriate action in response
What is the purpose of corporate compliance program
The purpose of corporate compliance program is to protect the organization against violations of law, lapses in business ethics, and concomitant legal sanctions
A corporate compliance program encourages ……..
Enforcement, monitoring, and employee training
What is the key element of compliance program
Key element of compliance program is an effective reporting mechanism
What can significantly reduce losses in most corporate and organizational environment
An effective hot line can significantly reduce losses in most corporate and organizational environments
The efficacy of the hot line can be enhanced through …
An on-going awareness program
Records and database checks represent a………….
Key element of almost any investigation
What are the key component of an investigation
The collection, handling, processing, and use of evidence are a key component of investigation
What is meant by surveillance
Surveillance means observing the behaviour of another, usually secretly
The primary purpose of surveillance is to …
Obtain information about the identities or activities of those under investigation
What are the categories of surveillance
Surveillance can be broken down into three broad categories which are
Direct : Direct is covert
Preconstructive : Preconstructive is more public
Reconstructive : Reconstructive is reviewing information and evidence gathered from the other two techniques.
What is ABC method
ABC method is conducted for foot surveillance and checkpoints in mobile surveillance
Write about computer forensic
Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media
Define force multiplier in investigation
For investigative purpose, a force multiplier is any activity, capability, or resource that enhances the effectiveness or efficiency of the investigative function
What are the three important force multiplier in investigation
Three important force multipliers in investigations are
Human,
Environmental, and
Organizational.
What are the major cautions needed to be consider during online research
Three major cautions must be respected by the investigators while doing online research. These are:
1-investigators and staff members may go off on a tangent, spending a great deal of time inefficiently by searching online for the sake of searching online,
2- there is a natural tendency to assume that information extracted from database or online sources is credible,
3- while most investigators enjoy searching the internet that may not be the best use of their time.
Define liaison in investigation
Liaison in investigations comes in many forms: internal and external, formal and informal, and individual and organizational
Professional relationships are established through
Introductions, references, contacts(both formal and social), and mutual assistance.
An excellent opportunity for establishing liaison contacts is through…
Professional and civic associations
In the global business environment, liaison relationships are …
Critical to effective investigations
What is required after a liaison is established
Once established
A key asset of any investigator or IU is…
A good reputation
One high structured form of liaison is the
Task force
When parochialism can occur
Parochialism can occur when joint task force members arrive with varying agendas, either individual or organizational
What is the result of parochialism
Parochialism inevitably causes conflict, whether explicit or subtle, and canseriously detract from the effectiveness of the unit.
Is there any effect in reporting chain when JTF is established
Reporting chains can be confusing in the joint task force environment
What is the result of reporting chain confusion
Reporting chains confusion can lead to the dissemination of fragmented and apparently contradictory information regarding task force progress, successes, needs, and relationships
Can intelligence information play role of force multiplier
Intelligence information is a key force multiplier for IUs in almost in any settings.
Define the term “Operative”
The sub‐rosa aspects of the investigation centre on the true identity of the investigator, called the operative
What does the term “cold hire”
A cold hire means the investigator applies for a position and is processed just like any other applicant. This type of entry is preferred but is the least practical
What is the first task of an investigator after beginning of an undercover investigation?
relationship building
What is the most critical component of the entire undercover investigation
Interviews are the most critical component of the entire undercover investigation
What is the chief distinction between undercover and other types of investigations
The chief distinction between undercover and other type of investigations is that the undercover investigator neither conceals his or her presence nor attempts to operate unnoticed.
What is buy bust
The buy‐bust is nothing more than arresting the perpetrator at the moment he or she is either buying or selling the property and question
What is mean by conversion in terms of UI
Conversion means receiving money or property of another and fraudulently withholding or applying it to one’s own use
What is the most important activity for an undercover operative?
The most important activity for an undercover operative is learning the job and becoming familiar with surroundings.
Who oversees the actual investigative casework
The project management team oversees the actual investigative casework
Who should be included in an undercover investigative team
Undercover investigative team should include:
1‐ a corporate decision maker,
2‐represenative from human resources,
3‐ a corporate security professional,
4‐ an attorney familiar with state and local employment law
What plays an important role in almost every successful theft investigation
Strategy and tactics play important roles in almost every successful theft investigation.
What is the requirement of undercover investigation (in short)
Undercover investigation requires a highly structured process and flawlessly executed plan
Who shouldn’t be used to play an undercover role
An employer should not use existing union employees in an undercover role
What is the most fundamental form of communication used in undercover assignments?
Written reports are the most fundamental form of communication used in undercover
What is critical to success of an undercover investigation
Knowing when and how to employ undercover investigation
What quality is essential for an undercover investigation
A qualified investigator from a reputable agency should be selected to conduct the fact-finding and drive the process of undercover investigation
How to avoid many problems during an undercover investigation
With proper planning and the necessary resource allocation many problems encounter during undercover investigation can be avoided
What is the potential problem in an undercover investigation
The main potential problem in an undercover investigation is the possibility that the investigation will be exposed or communicated
What is the result of if employee made aware about undercover investigation before its completion?
If employees are made aware of an undercover investigation before its completion through some form of communication by management, morale and productivity may be adversely affected;
Who should be informed about undercover investigation in an organization
Only those with absolute need to know should be involved in or told of the undercover investigation
For what undercover investigation is preferred
Undercover investigation is the preferred method of investigating substance abuse and criminal activity in the workplace
Which investigation is least understood and most underused
Undercover is the least understood and most underused form of investigation
What is the chief distinction between undercover and other type of investigations
The chief distinction between undercover and other type of investigations is that the undercover investigator neither conceals his or her presence nor attempts to operate unnoticed.
Undercover investigation should only be conducted when………
No other options are available
What is the requirement of an undercover investigation
Undercover investigation requires a highly structured process and flawlessly executed plan.
During undercover investigation, what is the result of professional pursuit of information?
The professional pursuit of information can lead to entrapment and may collide with personal need for safety, immunity, and privacy
Conversion means………
Receiving money or property of another and fraudulently withholding or applying it to one’s own use
Is it permissible to use an existing a union employee for undercover role?
An employer should not use existing union employees in an undercover role.
What are the five distinct phases of undercover investigation?
Successful workplace undercover investigations unfold in five distinct phases:
1- planning and preparation,
2- information gathering,
3- verification and analysis,
4- disciplinary and corrective action,
5- prevention and education.
What is the key to an undercover investigation
Planning is the key to an effective undercover investigation
The risk embezzlement may be greater in an organization where……
The culture’s predominant value is economic
The objectives of an undercover investigation could include………
1-To identify the nature, scope, and perpetrators of a plan
2- to gather information so management can enforce its policies and take corrective action
3- to collect information in a way that is the least disruptive to the organization and its operations
4- to ensure the process provides the best return on investment
For the most part, today’s professional corporate undercover investigators are…….
Well educated, properly trained, and highly trained
Undercover investigators come in ………
All shapes, sizes, and colors
What are the personal factors to consider whether the undercover investigator fits to conduct the investigation
To ensure that the investigators fits in with the target audience, a number of personal factors should be considered, including sex, age, job experience, education, and ethnicity. In addition, the investigator should easily fit into the socioeconomic background and lifestyle of the workers he or she will be joining.
What are crucial for the successful outcome of an undercover investigation
Proper placement of the operative in undercover investigation is crucial to the investigation because the job selected must be one from which the mission’s objectives can be achieved.
The most important activity for an undercover operative is ………..
Learning the job and becoming familiar with surroundings
What are some best internal positions for the undercover operative
Departments:
1-material handling
2- shipping and receiving
3- mailroom
4-customer service
5- uniformed security.
The investigator can be placed into a cover position in two ways. These are……..
1- a cold hire
2- a controlled hire.
What is meant by cold hire in undercover investigation
A cold hire means the investigator applies for a position and is processed just like any other applicant. This type of entry is preferred but is the least practical
What is meant by controlled hire in undercover investigation?
A controlled hire means the employment process is manipulated covertly so that the operative is hired in the desired capacity and placed in the targeted location
When can information gathering phase begin
Once the client, the investigative agency, and the operative have agreed to the specifics of the undercover assignment, the information-gathering phase can begin
Who are included in the project management team of an undercover investigation
The project management team include:
1- the undercover investigator,
2- the project manager,
3- the client representative
Who can break the undercover investigation
The undercover investigator can make or break the investigation
Once undercover investigation begins, the investigator will first engage in …….
Relationship building
In which type of cases law enforcement can play a critical role (Undercover Investigation)?
Law enforcement agencies play a critical role in most workplace undercover investigations, in cases involving illegal drugs
What is the most fundamental form of communication during an undercover investigation?
Written reports are the most fundamental form of communication used in undercover assignments
One of the most popular formats for investigates reports today is ….
The structured narrative
How narrative reports are written
During undercover investigation, the narrative report is written in the third person, using descriptive text or “the operative” instead of in the first person using the pronoun “I”.
The undercover investigative summary is written in the ……….
Third person
The frequency of undercover investigative summaries depends upon the needs and desire of ………….
The user
Does there any requirement of conventional or wireless communication in undercover investigation in these days?
Telephone communications, whether conventional or wireless, are a necessary component of today’s modern undercover investigations
The person designated to maintain and archive the closed case file of undercover investigation is called the…………
Custodian of record
What is the most critical component of the entire undercover investigation
Interviews are the most critical component of the entire undercover investigation
Interviews that follow an undercover investigation often begin with……….
Interviews that follow an undercover investigation often begin with those involved and work toward those less involved. This is done for a number of reasons, the most obvious being the perpetrators has already been identified by the operative and interviews of others before the interrogation of the suspect may tip him/her off.
Once the discipline and corrective actions have been taken after undercover investigations, all files, records, tapes, and evidence should be provided to ……………
The case file custodian of record for storage and safekeeping
No discussion regarding employee misconduct is complete without…………
Mentioning prevention
Generally, workplace crime is a function of three fundamental elements, these are………
1- the quality of people the organization hires
2- the environment in which those people are placed
3- the quality of supervisor managing that environment and those people
Frequently, supervisor and manager are not equipped with the skills or tools necessary to prevent problems from recurring. What can help in this case
In this instance, education and training is the answer
What is the most frequently debated subject in undercover investigation
The timing of the removal of the operative from undercover operations is one of the most frequently debated subjects among undercover supervisors
The best time to remove the operative from undercover operations is ………..
Once he or she has been named as an offender
To remove undercover operative sooner from undercover operation sooner……….
Would only raise suspicions. If removed before the interviews begin, it will be clear to everyone that the person in question was an informant
Following a highly visible workplace investigation, communication should be open with…………
All levels of the organization
While undercover investigations can reveal a host of loss prevention issues, two types have become common in recent years, what are these two types?
1- drug investigations
2- theft investigation
Define entrapment?
Entrapment is best defined as including a person to commit a crime
During the undercover operations, to overcome from any potential allegation of entrapment, what the operative should do?
The operative should qualify each person from whom he intends to purchase drug.
During undercover operations, the operative can qualify themselves from any potential allegation of entrapment through……
A simple report covering two points:
1- the operative should establish that behaviour or activity in question was pre-existing, or that the dealer has sold drugs previously
2- the operative should establish why the dealer wants to sell to him or her.
During the undercover operations, what are the guidelines for workplace drug purchases
The guidelines for workplace drug purchases to the operatives are:
1- qualify the dealer
2- coordinate with law enforcement
3- Buy down not up
4-make purchase on company time
5-avoid actual drug use.
To avoid any allegation of entrapment, what the operative should do
The operative should never invite another employee to commit criminal activity
All workplace drug buys should be done under the control and supervision of …..
Law enforcement
In the workplace drug investigations, the operative should purchase the small quantity the dealer willing to sell. The employer must only demonstrate that …….
The dealer committed a policy violation
During workplace drug investigations, best or larger buys of drugs should be made……..
Near the conclusion of the undercover operation
The focus of the workplace investigation should be workplace issues and misconduct, not the ……..
Enforcement of public law
How to preserve the operative’s credibility while working during an substance abuse undercover investigation?
To help preserve the operative’s credibility in the eyes of the client, routine drug testing should be done
How you can prove an investigator is not a substance abuser
The result of periodic hair and urine testing can demonstrate that the investigator is not a substance abuser and has not used an illegal drug
Does employee prosecution provides any return to the company
Surprisingly, employee prosecution rarely provides any return on the company’s investment. Disciplinary action is a preferred recours
Can undercover investigation be used to determine theft in workplace
Undercover investigations are often used to determine if theft is occurring at the workplace
Which investigation is mirror to any other undercover investigation
Theft investigations mirror any other undercover investigation
What can play a significant role in any theft investigation
Strategy and tactics play important roles in almost every successful theft investigation
In one of the most basic tactics used to investigate employee theft is
The operative appears to already be involved in some form of criminal activity
A well-known undercover axiom says that where one finds substance abuse one will also find…………..
Theft
The prudent undercover investigator looking to solve a theft problem should first look for a…………
Substance abuse problem
What is buy bust
The buy-bust is nothing more than arresting the perpetrator at the moment he or she is either buying or selling the property n question
What is meant by sting operations
Sting operations usually involve elaborate setups and buy-busts. They might include the actual setup and operations of a business as a front or place where stolen goods are sold or traded.
How invisible evidence markers are used
Invisible evidence markers are interesting products allow the user to surreptitiously mark property so that if it is stolen and then recovered its rightful owner can be identified
The most common and most economical form of corroborating evidence is……..
Videotape
What makes a drug investigation stronger
As in drug investigations, multiple buys from the thief makes the theft investigations make a stronger case
In theft investigation, the operative should purchase a…………
Minimal amount
In theft investigations, how multiple purchase helps
Multiple purchases help:
1- eliminate the claim that the activity was spontaneous or an anomaly
2-help to prove that perpetrator is a true offender and not just someone who made a one-time mistake
What could be result of failing to exercise due diligence
Liability
Where is the origin of Due diligence
In the security industries
What is not a type of due diligence investigation?
Overt
Among the below which statement is incorrect about due diligence
Due diligence is a critical requirement for save time particularly transaction with OI parties
What is critical to creating unbiased due diligence investigation
Verification of information from primary sources
What is not included in the primary sources of information for due diligence investigation
News and media sources
What is critical for a successful due diligence investigation
Communication between client and investigation firm
Which type of due diligence considers an acquisition in the context of its industry
Strategic due diligence
The due diligence report should be
Coherent
Easy To Read and
Comprehensive
The demand for international due diligence is heightened by ……….
a. Global economy
b. Terrorism
Common business usage defines due diligence as the investigative process for evaluating
A target company or a company’s assets for the purpose of acquisition
One of the most important reasons for conducting due diligence investigations is
To protect assets
Verification information from primary sources is critical to creating unbiased due diligence. While a target may attempt to provide accurate data it is often skewed – sometimes inadvertently so. Information may be omitted – if a target wants a deal to reach a conclusion it will attempt to provide the most favourable information possible
One common error in due diligence investigations is relying on information
Comprehensive cohesive due diligence investigations are not only effective but also critical in weighing the advantages and disadvantages of mergers, recruitment, acquisitions investments and other deals
Comprehensive cohesive due diligence investigations
The first step in any due diligence investigation is to examine the issue at hand – the deal, the individual and the investment and understand what factors to focus on in order to find a solution
There is no single objective criterion for a due diligence investigation – the investigator must look at the question in hand and determine what is important for the particular problem
There are numerous investigative resources for conducting due diligence investigations
Primary and secondary sources
Communication between the client and the investigating firm is critical for a successful investigation. The client and the investigator should collaborate effectively to discuss the issues and determine what is the most important issue for the client
The client and the investigation firm should collaborate and discuss the issue what is important for the client.
Traditional financial, legal and environmental due diligence is crucial to the success of any acquisition
This alone is not sufficient to predict long‐term success of any transaction. Instead a multi‐disciplinary approach is recommended
Strategic due diligence considers an acquisition in the context of its industry and asks – does it make sense to make this acquisition
This is the first step in the due diligence process. Strategic due diligence will provide the organization with the information to drive change and improve profitability
Financial due diligence analyses both quantitatively and qualitatively how an organization has performed financially in order to get a sense of their earnings in normal circumstances
It is crucial to look at the anticipation performance of a business as by the sense of there earning in normal circumstance’s
What is due diligence investigation
Due diligence is” a measure or activity that is to be expected from a reasonable and person under the particular circumstances; not measured by an absolute standard, by dependent upon circumstance
What is the result if failure to exercise due diligence
A failure to exercise due diligence may sometimes result in liability
Common business usage defines due diligence as …..
The investigative process for evaluating a target company or a company’s assets for purpose of acquisition by a potential buyer/ acquirer
Due diligence loosely means………
Doing one’s homework on a particular subject
Due diligence is originated in …….
The securities industry
What are the types of due diligence investigation
The types of due diligence investigations are financial, operational, covert, cultural, intellectual property, mergers and acquisition, human resources, legal information technology, and environmental
When due diligence investigations are valuable
Due diligence investigations are valuable in any situation where one or more parties deciding future actions or non-actions based on existing conditions or on represent a made by another party
The standard of due diligence investigation depends on…
The type of investigation, the goals of the investigation, the individual conducting the research, and the available information
What is emphasized in due diligence investigation
Diligence emphasizes the positive aspect of due care, while negligence describes the failure to exercise due care
Failure to exercise due diligence-due care in investigation can result in….
Enormous costs to all parties involved, including the loss of money, and opportunities
One of the most important reasons for conducting due diligence investigation is………
To protect assets
Does due diligence investigation has effect while transaction with other parties
Due diligence is a critical requirement for the protection of enterprise assets, particular transactions with outside parties
Wider due diligence investigations may also examine……
A company’s strategy, information technology, operations, human capital, and culture
In due diligence investigation, the difficulty of obtaining the information depends on…….
The type of deal, and the type of information sought
One common error in due diligence investigations………
Is relying on information from the target
Verification of information from primary sources is critical to…….
Creating unbiased due diligence investigation
Comprehensive, cohesive due diligence investigations are not only effective but also critical in……….
Weighing the pros and cons of mergers, hiring, alliances, acquisitions, investments and other deals
A good due diligence investigation is the necessary cornerstone for…….
Making a decision
A poorly executed due diligence can………
Completely mislead parties
While due diligence investigation does not guarantee the success of a venture, it provide ………
Valuable insights
How a strong due diligence investigation can raise issues
At a minimum, a strong due diligence investigation can raise issues for further research verify or contradict given information, and point parties to new directions of information
If the best practices are followed, the due diligence report serves as…..
A foundation for further consultation and negotiation
What is the first step in any due diligence investigation
The first step in any due diligence investigation is to examine the issue at hand the person, the investment, etc and then understand what factors to focus on to answer problem
The key to a good diligence investigation is to …
Understand the needs of the client and the transaction at hand
What are the secondary sources of due diligence investigation
The secondary sources of information for due diligences investigation include:
1-government-maintained public records,
2-commercial record sources,
3- annual report other company records,
4- news and other media sources
To receive the right type of service, the client of a due diligence company should provide ………….
Detailed background information and work closely with the firm.
For a successful outcome of investigation what is critical
Communication between the client and the investigating firm is critical for a success investigation
How should be the report of due diligence
The due diligence report should be coherent, easy to read and comprehensive
The demand for international due diligence is heightened by…..
The global economy and terrorism
What is crucial to the success of any acquisition
Traditional financial, legal, and environmental due diligence is crucial to the success acquisition.
What considers an acquisition in the context of its industry
Strategic due diligence
What is key component of merger and acquisition activities
Technology is a key component of merger and acquisition activities
About 75 percent of all mergers and acquisitions fail to live up to expectations, this is often due to lack of ……………
An effective integration plan
What are the facts that should be considered when conducting due diligence
It is crucial that when conducting due diligence, organizations consider all aspects to financial, operational, IT, and human capital – to assure a successful transaction
Who can weak and havoc with an enterprise
A dishonest employee
How a pre‐employment screening program benefits a business
1‐ it discourages applicants with something to hide and encourage applicants to be honest during the interview process,
2‐it demonstrate that a company has exercised due diligence, which may provide legal protection in a lawsuit and may also encourage good candidates to apply,
3‐ it ensures that a job candidate has the background, education, experience, and skills that he or she claims
What are the factors that vary screening program from organization to organization?
1‐ Access to information,
2‐ nature of the position,
3‐ potential liability associated with incorrect performance of a job,
4‐ industry regulations
Where is the focus of background investigation
A background investigation initially focuses on information provided by the applicant, which is typically found in the employment application, personal history questionnaire, résumé, and other biographical documents
What is the goal of background investigation
A background check is a confirmatory type of investigation. This would include verification of information provided by an applicant, such as education and job history. The goal of background investigation or screening is to uncover information that an applicant might try to hide, such as criminal activity
What are the resources required for any department in an organization assigned to conduct pre‐ employment investigation?
If any department in an organization assigned to conduct pre‐employment investigation, that department will need certain resources:
1‐ experienced and well‐trained investigative personnel,
2‐sufficient reference materials,
3‐ adequate communication
What are the primary loss prevention strategies
Applicant screening and employee socialization are primary loss prevention strategies.
What is the primary purpose of a background investigation
Prevent losses and mitigate damages
What are common foundations of pre‐employment screening program
1‐ data collection,
2‐background investigation and screening,
3‐ data analysis and hiring decision.
What is the standard of proof necessary to refuse to hire the applicant
Good faith
What are the categories of application falsification? Write down the names where the red flags are putted in early application review
Application falsifications generally fall into two categories:
1‐wilful omissions of materials,
2‐misrepresentations of materials facts.
Red flags in early application review :
1‐ unsigned forms,
2‐incomplete addresses or post office box number,
3‐ conflicting dates of employment, education, or military service,
4‐ gaps in employment,
5‐ changes of occupation,
6‐ social security number variance(USA only),
6‐ommission of reasons for leaving
What is the primary purpose of psychological test? Write down the names of psychological tests using in pre‐employment program
Make an employer informed hiring decision, Psychological test include:
1‐personality test,
2‐integrity testing
During pre‐employment screening process, when all the screening results are returned the process of analysis of data begins
The process of analysis of data begins
Write down in brief about a comprehensive, legally permissible, fairly executed background and pre‐employment screening program
A comprehensive, legally permissible, fairly executed background investigation and pre‐employment screening program is confirmatory and investigative in nature finds the most appropriate person of a particular job and can go a long way toward preventing losses and mitigating the damage caused by a bad hiring decision
What is the most extreme form of workplace violation
Homicide, the most extreme form of workplace, is the fourth leading cause of fatal occupational injury
Why legal counsel must review and endorse a pre‐employment screening and background program
Because of the myriad judicial and compliance issues associated with collecting and using personal information, legal counsel must review and endorse the program
Write down the names of seven steps to a comprehensive pre‐employment screening policy?
- create clearly written, well defined job descriptions for all positions,
2‐ assess the risk of each job classification in terms of reasonable(or foreseeable) potential for problems,
3‐based on the preceding risk assessment, determine the scope of pre‐employment screening for each jobclassification,
4‐ work with human resources and legal personnel to develop an appropriate hiring packet,
5‐ establish criteria for evaluating information,
6‐ communicate the pre‐employment screening policy and its purpose to the workforce,
7‐ periodically review policy compliance
What is the main source for data gathering? Where is the basic starting point for pre‐employment screening
The employer’s own application form must be the main source for data gathering and should be reviewed prior to conducting the pre‐hire investigation. Employment applications are the basic starting point for pre‐employment screening
A background check is
Confirmatory type of investigation
Why legislation in many countries is restricting pre‐employment evaluation
The main concerns are privacy and data protection.
What is the best way to reduce internal theft?
Hire employees with integrity
What are the primary things an organization shall do prior drug testing
Any organization conducting drug testing of any kind should have a clear, written policy outlining when testing will be conducted, how it will be conducted, and what the ramifications of test results are
What are the categories of integrity or honesty test
a. Overt or direct testing
b. Indirect test
Which test is considered as the most effective and quickest method of verifying background information
Polygraph testing
Most common resources to conduct pre‐employment screening investigation
a. Security or asset protection department
b. Human resource department
c. Outside consumer reporting and investigative agency
Quid pro quo
Give something in exchange for something else one receives
Informants
Persons providing information, publicly or confidentially
Suspect
A person who is believed to have committed an offense based on accumulated evidence, proximity to incidents etc
Confrontational Interview
Confrontational questioning of a person suspected of committing an offense or serious breach of corporate policy
Witness
Any person, other than a suspect, with information concerning an incident
Pygmalion effect
A persistently held belief in another person such that the belief becomes a reality
Stockholm syndrome
Emotional bond formed between hostages and their captor
Define background investigation
A comprehensive, legally permissible, fairly executed background investigation and pre-employment screening program is confirmatory and investigative in nature finds the most appropriate person of a particular job and can go a long way toward preventing losses and mitigating the damage caused by a bad hiring decision
Why legislation in many countries is restricting pre-employment evaluation and screening
The main concerns are privacy and data protection
What are the primary loss prevention strategies
Applicant screening and employee socialization are primary loss prevention strategies
The best way to reduce internal theft is to……..
Inventory management. Implement strict inventory management procedures, including regular stock checks and audits to ensure that all items are accounted for and that there are no discrepancies. This can help identify any missing items and deter employees from attempting to steal anything
What can help minimize the risk of liability for improper hiring?
Pre-employment screening and investigation can help minimize the risk of liability for improper hiring
Who will be held responsible for the on- duty or job-related negligence of employees?
It has been established that an employer will be held responsible for the on-duty or job-related negligence of employees
Workplace violence is a serious concern for………
Security practitioners
What is the fourth leading cause of fatal occupational injury
In the United States, homicide, the most extreme form of workplace, is the fourth leading cause of fatal occupational injury
Everyone involved in a business- whether an owner or employee – is harmed by ……………
Workplace alcohol and drug abuse
In the United States, the vast majority of current illicit drug users are…….
Employed
The primary purpose of a background investigation is to…….
Prevent losses and mitigate damages
From a legal perspective, pre-employment investigations provide organizations mitigation from…………
Negligent hiring and discrimination
A pre-employment screening program benefits business in ……….
1- it discourages applicants with something to hide and encourage applicants to be honest during the interview process,
2-it demonstrate that a company has exercised due diligence, which may provide legal protection in a lawsuit and may also encourage good candidates to apply,
3- it ensures that a job candidate has the background, education, experience, and skills that he or she claims
To develop effective background investigation and pre-employment screening program…………….
Upper management must first sanction and support the policy
Ideally a team of security and human resource professionals should be tasked with ……………..
Developing and implementing the policy of background and pre-employment program.
Because of the myriad judicial and compliance issues associated with collecting and using personal information, legal counsel ………………….
Must review and endorse the program
Screening program vary from organization to organization, depending on few factors…………………
1- access to information,
2- nature of the position, and
3- potential liability associated with incorrect performance of a job,
4- industry regulations
In today’s global business environment, security practitioners face unique challenges in ……………….
Obtaining and verifying applicant information
What makes employee screening more complex
Global customs and compliance issues vary tremendously, making screening even more complex
In the United States, access to personal information, such as credit, insurance and criminal history is governed by ………..
The Fair Credit Reporting Act
What are the common functions of Pre- employment screening program
Pre-employment screening program have a common foundation:
1- data collection,
2-backgroundinvestigation and screening,
3- data analysis and hiring decision
Write the seven steps of a comprehensive pre-employment screening policy
Seven steps to a comprehensive pre-employment screening policy :
1-create clearly written, well-defined job descriptions for all positions,
2- assess the risk of each job classification in terms of reasonable(or foreseeable) potential for problems,
3-based on the preceding risk assessment, determine the scope of pre-employment screening for each job classification,
4- work with human resources and legal personnel to develop an appropriate hiring packet,
5- establish criteria for evaluating information,
6- communicate the pre-employment screening policy and its purpose to the workforce,
7- periodically review policy compliance
What described in job description
The job description describe:
1- the duties to be performed in a position,
2- the personal qualification required for the successful completion of those duties.
What is crucial to the success of the pre-employment screening program
Because the requirements set out in the job description are the standards for preliminary screening of the applicant, an accurate, well-written job description is crucial to the success of the program
The standard of proof necessary to refuse to hire the applicant is……..
Good faith
A background investigation initially focuses on ……..
Information provided by the applicant, which is typically found in the employment application, personal history questionnaire, résumé, and other biographical documents
What provides the first indication of whether an applicant is qualified for a position?
A résumé provides the first indication of whether an applicant is qualified for a position.
It is important for a company not to accept a résumé in lieu of …….
An employment application or complete work history.
What should be the main source of data gathering for employers
The employer’s own application form must be the main source for data gathering and should be reviewed prior to conducting the pre-hire investigation
What is the basic starting point for pre-employment screening
Employment applications are the basic starting point for pre-employment screening.
Who could be an excellent source of reference during pre-employment screening
During pre-employment screening, a former employer who still knows the subject would provide an excellent source of reference
What is the most common pre-employment screening method
A criminal records check is the most common pre-employment screening method.
What is an important tool in pre-employment screening process
The initial application review is an important tool in the pre-employment screening process
What are the categories of application falsification
Application falsifications generally fall into two categories:
1- willful omissions of materials,
2-misrepresentations of materials facts
What are the red flags in early application review
Red flags in early application review :
1- unsigned forms,
2- incomplete addresses or post office boxnumber,
3- conflicting dates of employment, education, or military service,
4- gaps in employment,
5-changes of occupation,
6- social security number variance(USA only),
6-ommission of reasons for leaving
What length of gap in employment history should be investigated
All gaps in employment or life history, if more than one month should be investigated
The initial interview during pre-employment screening provides
A chance to clarify any omissions
A cooperative effort within the organization will result in……….
The optimum employee selection process
What type of investigation a background check is
A background check is a confirmatory type of investigation. This would include verification of information provided by an applicant, such as education and job history.
Background investigation or screening actively searches for……..
Information, performing such tasks as developing references or searching criminal records
What is the goal of a background investigation
The goal of background investigation or screening is to uncover information that an applicant might try to hide, such as criminal activity
Define pre-employment screening
Pre-employment screening is a process for determining whether a prospective employee is trustworthy or capable of performing the functions required for a particular job
What you will include as the process of pre-employment screening
Pre-employment screening may include:
1- drug or alcohol screening,
2- psychological testing(personality and integrity testing),
3- general intelligence or aptitude testing,
4- medical screening and physical abilities tests, 5- polygraph tests
The policy regarding drug testing must be communicated to…
All applicants and employees
The main goal of psychological test is to………..
Help an employer make informed hiring decisions
What are the types of psychological test
Psychological test include:
1-personality test,
2-integrity testing
The personality test is particularly helpful in determining……
An applicant’s compatibility with a position
Personality tests provide a psychological measure of an individual’s basic characteristics such as……….
Attitudes, emotional adjustment, motivations, interpersonal skills, and interests
Define integrity or honesty testing
Integrity or honesty testing measures an applicant’s propensity toward undesirable behaviours such as lying, stealing, and drug or alcohol abuse
Integrity or honesty testing is generally broken into…..
Two categories:
1- overt or direct testing,
2- indirect test
Overt or direct integrity testing asks explicit questions about………
An applicant’s past dishonest acts or behaviours
Indirect integrity testing examines concepts such as ……
Dependability and respect for authority
The result of psychological testing should be used as only one of the factors in ………
Making a hiring decision
What are the intelligence tests
Intelligence tests could consist of logic problems, word problems, pattern identification, or other kinds of questions
What is aptitude test?
Aptitude test measure cognitive ability in a particular area, such as recall, vocabulary, or numerical perception
What is the quickest method of background investigation
The polygraph testing is considered the quickest and most effective method of verifying background information on applicants
To conduct pre-employment screening investigation, the three most common resources are ………..
1- security or asset protection department,
2- human resource department,
3- outside consumer reporting and investigative agency.
If any department in an organization assigned to conduct pre-employment investigation, that department will need………
Certain resources:
1- experienced and well-trained investigative personnel,
2- sufficient reference materials,
3- adequate communication
During pre-employment screening, when data analysis begins
During pre-employment screening process, when all the screening results are returned, the process of analysis of data begins
The employment application should state that material omissions and misstatements are grounds to……
Terminate the employment process whenever discovered
What will affect the future of background investigation
Privacy legislation will significantly affect the future of background investigations and pre-employment screening
Pre-employment screening is an essential component of…….
Any good security program
Purpose of an investigation
Objectively developing a reasonable conclusion based on the facts learned through the investigative process
How to mark the nonverbal responses
Nonverbal responses include body movement and position changes, gestures, facial expressions, and eye contact. Nonverbal behaviour is internally motivated to reduce anxiety
Does investigator want a second person in the interview room? Answer with the reason
The investigator may want to have a second person in the person in the room who can insulate the interviewer from potential accusations the interviewee and corroborate statements against interest, confessions, etc
What is the key difference between an interview and an interrogation
In summary, a key difference between an interview and an interrogation is in the person being interview
If you are conducting an interview is it permissible to record it without the consent of the interviewee?? What will you do under this circumstance?
When an interview needs to be recorded without the interviewee’s knowledge, prior consultation with legal counsel is critical
Where the interview may be
An interview may be conducted in a private residence, on a street corner, or in a formal interview room
What helps to demonstrate the financial ability of person who will be interviewed
Payroll files are helpful for evaluating the person’s financial stability
When interviews become interrogation
A general rule of thumb is when the interviewee becomes a subject, target or the accused person in the interview, it becomes an interrogation.
What the interviewer should do who is in doubt as to the proper course of action? What are the factors the interviewer should consider for planning the interview
An interviewer who is in doubt as to the proper course of action should consult with legal counsel
What about the suspect who offers an evasive answer
A suspect who offers an evasive answer or an objection in response to a direct question does so because of an attempt to avoid the internal anxiety associated without right denial
Who shouldn’t be considered for a long interview
A person who is physically debilitated or psychologically stressed should not be subjected to a lengthy interview
Distinct the activities of truthful person and deceptive person during the course of interview
During the interview, the truthful person :
1‐ make general, sweeping denials,
2‐ offers unqualified, direct, and spontaneous answers,
3‐ exhibits a reasonable memory,
4‐responds to questions in a rational manner and a clear tone of voice
What are the postures of truthful and deceptive people during an interview
The posture of truthful people during interview which are:
1‐ sits upright but not rigid,
2‐ positions himself or herself in front of the questioner,
3‐ leans toward the questioner when making a point,
4‐ appears relaxed and casual.
The posture of a deceptive people which are :
1‐ slouches or leans back in the chair,
2‐ sits unnaturally stiffly,
3‐ sits off to the side, not directly in front of the questioner,
4‐ pulls elbows close to the side, arms folded and locked in front, with legs crossed,
5‐ exhibits rapid and erratic posture changes
According to chapter Interview & Interrogation what can have a serious effect on interview process
Age
Give an example of cultural influence in interview
In Western cultures, eye‐to‐eye contact indicates sincerity. In Asian cultures, however ,eye contact with a person in a superior position is considered impolite. A person from an Asian culture might appear to be insincere in avoiding eye contact, but he or she may actually intend politeness
What is key to a successful interview
Enlisting the cooperation of the interviewee is the key to a successful interview
If you record information obtained from a person under the influence of alcohol or another substance is it reliable? If not then how you will validate it?
Information obtained from a person under the influence of alcohol or another substance is unreliable to some degree. A statement taken from such a person may be invalidated in a judicial proceeding
What types of questions generally asked during an interview
In interviews, the two types of questions generally asked are open and closed
What consisted theft triangle
The theft triangle consists of:
1‐ need or want (desire),
2‐ rationalization (motive), and
3‐ opportunity.
The interviewer should consider a number of factors in planning the interview which is:
1‐ location,
2‐ time factors,
3‐questioning order,
4‐ questions to ask, and
5‐ persons present
What are the indicators of lying
Lie Signs:
1‐Tension‐relieving gestures, weak tone of voice, shifts in the chair, drops eye contact, crosses arms and legs into a closed posture, leans back in chair,
2‐ Quick and sudden movements or leaving the room while questioned,
3‐ Grooming gestures,
4‐ Placing hand over the mouth or eyes, crossing arms or legs, hiding hands or feet, holding forehead with hand, or placing the hands under or between the legs,
5‐Sits unnaturally stiffly,
6‐Avoids eye contact
What happens if the interviewer and interviewee are of different sexes
It may be wise to include in the interview a witness of the same sex as the interviewee.
How to accomplish rapport between interviewer and interviewee during an interview
During interview, the rapport between interviewer and interviewee can be accomplished by using hidden persuaders initiating a general discussion before direct questioning. During interview, maintaining eye contact with the interviewee by the interviewer promotes rapport
If you are conducting an investigation how what will be your initial question
The initial question in the interview is normally a request for the interviewee to relate the events in the matter under investigation
What do you understand by grooming gesture and cosmetic adjustment
Such gestures include rubbing and wringing the hands; stroking the back of the head; touching the nose, earlobes, or lips; picking or chewing fingernails; shuffling, tapping, swinging, or arching the feet; rearranging clothing or jewellery; dusting, picking lint from, or pulling threads on clothing; adjusting or cleaning glasses; and straightening or stroking the hair
What are the three tools an investigator uses
The three tools that an investigator uses during an investigation are referred to as the three “I”s:
1- information,
2- interrogation,
3- instrumentation
The principal tool of obtaining information is …….
The interview /interrogation
What is considered as the most critical aspect of an investigation
Interviews of victims, witnesses, informants and confidential informants are considered the most critical aspect of an investigation as they are primary source of information
The value of each interview or interrogation is based on ………..
The investigator’s knowledge, skills in eliciting information, and ability to evaluate the veracity of the information obtained
The most prize talent an investigator can have is the……..
Ability to obtain information from individuals through questioning
Throughout the process of interview or interrogation, it is vital to conduct interviews in accordance with ………
Statutes, regulations, and standards of fairness
Information obtained from investigations can be used to…….
Improve loss prevention
When an interview become an interrogation
A general rule of thumb is when the interviewee becomes a subject, target or the accused person in the interview, it becomes an interrogation
Define an non-accusatory interview
An informational interview is non-accusatory, while the confrontational interview can be accusatory and is generally highly structured
An undercover investigation in the workplace uses the terms
Administrative interview
Define an investigatory interview
The investigatory interview is a complex, structured process used when the subject is known to have committed the offense alone or with others and the investigator has reason to believe the subject committed the offense
What is an interview
An interview is a non-accusatory conversation in which both investigative and behaviour-provoking questions are asked in order to develop investigative information.
What is an interrogation
An interrogation is an accusatory process designed to persuade the subject to tell the truth about his or her involvement in, or guilty knowledge of, the issue under investigation
What is the key difference between an interviews and interrogation
In summary, a key difference between an interview and an interrogation is in the person being interview
Define interrogation , confrontational interview or investigatory interview
An interrogation, confrontational interview, or investigatory interview is a very direct and sometimes accusatory session with a person suspected of committing an offense.
Does general interview is a non-accusatory interview
General interview is a non-accusatory questioning of a person to gather information that pertains to the matter under investigation. All persons in an investigation should be interviewed- victims, witness, and suspects
What is a confrontational interview
Confrontational interview is a questioning of a person suspected of committing an offense or serious breach of corporate policy. Also known as an interrogation. This process should be reserved for individuals whose involvement in the issue under investigation is reasonable certain
Who is a suspect
Suspect is a person who is believed to have committed an offense based on accumulated evidence, proximity to the incident, motive, access to restricted areas, witness statements, etc
In the most basic sense, the purpose of an interview is to……….
Aid an investigation into the truth
In interview, questioning techniques should be ……….
Objective, factual questions focused on obtaining evidence
The lease four objectives in an interview
1- to obtain valuable facts,
2- to eliminate the innocent,
3- to identify the guilty,
4- to obtain a confession
The characteristic of general interview are
1-non-accusatory,
2- dialogue,
3- variable environment,
4-private/semiprivate,
5- guiltunknown,
6- no rights warning,
7- not lengthy,
8- cooperation,
9- unstructured,
10- some planning,
11- note taking acceptable
The characteristics of confrontational interview
1-accusatory,
2- monologue,
3- controlled environment,
4- absolute privacy,
5- guilt indicated,
6- rights warning,
7- lengthy,
8- hostility,
9- structured,
10- extensive planning,
11-note taking inhibits
To achieve the goal of the interview- truthful information-the interviewer must recognize……………..
The emotions and feeling of the interviewee
What are the Maslow’s human needs
Maslow human needs are:
1- physiological or survival needs,
2- safety or physical and emotional needs,
3-affection needs,
4- esteem needs,
5- self-fulfillment needs.
The theft triangle consists of
1- need or want (desire),
2- rationalization (motive), and
3- opportunity
A major factor in obtaining a confession is the……….
Interviewer’s ability to help the offender form a socially acceptable rationalization for having committed the offense
What sets the tone of the interview
The interviewer’s demeanor sets the tone of the interview
What indicates professionalism and expectation of a successful interview
Making positive comments on the investigation, and the interview indicates professionalism and expectation of a successful interview
By utilizing the floating point strategy of continuously re-evaluating a hypothesis as information is obtained, an investigator can…….
Adjust questions accordingly
Give a characteristic of an inexperienced investigator
Inexperienced investigators often neglect the skill of listening when interviewing suspects.
What are the characteristics of active listening
Active listening includes:
1- attentiveness,
2-concentration,
3-acceptance,
4-detachment,
5- and patience
Enlisting the cooperation of the interviewee is the key to a…….
Successful interview
The most important factor of a successful interview is…….
The ability of the interviewer to establish a favourable rapport with the interviewee.
A good interviewer does not assume………….
An adversarial role but should remain an objective and neutral fact finder
Untruthful interviewees often experience a ………..
High degree of stress during interviews
An investigator should take a number of actions in preparation for an interview. What is the most critical of these preliminary actions
The most critical of these preliminary actions is to learn the case information thoroughly
Optimally, before the interview ,the interviewer knows few elements in detail, what are these elements
1- who will be interviewed,
2- what the interview is about, and
3- the conditions under which the interview will be conducted
How an interviewer can establish a rapport easily
With knowledge of some personal characteristics of the interviewee, the interviewer can establish rapport more easily with interviewee.
What aids in accurate evaluation of the interviewee’s truthfulness
A proper understanding of the personal characteristics aids in accurate evaluation of the interviewee’s truthfulness
Which type of investigator can go to great lengths to conduct a personality profile to identify an individual’s mental, emotional and psychological characteristics
Criminal investigators go to great lengths to conduct a personality profile to identify an individual’s mental, emotional and psychological characteristics
What included in investigation action plan
Investigative action must be planned with the end in mind; possible civil or criminal actions should always be considered
An interviewer who is in doubt as to the proper course of action should consult with ………….
Legal counsel
The interviewer should consider a number of factors in planning the interview which is…………………
1- location,
2- time factors,
3-questioning order,
4- questions to ask, and
5- persons present
The choice of interview site depends on…………
The nature and phase of the investigation, the apparent involvement of the interviewee, the issue of interviewee confidentiality, and the desired level of formality.
A witness who has no other apparent involvement in the matter under investigation may be interviewed in………….
The office or at home
Which location would be preferred for a subject who is expected to be uncooperative
For an interview with a subject who is expected to be uncooperative, a security office or interview room is the preferred location
Flexibility and adaptability are required in…………
The selection of interview locations
The need for interviewee confidentiality may dictate that the interview be conducted in…………
A discreet location
Describe an interview room
The interview room should be free of unnecessary, distracting objects. A straight chair with a padded seat and back, and without rollers, should be provided for the interviewee
Generally, during the interview the distance between the subject and the investigator should be………………
About five feet
Why the interview subject should always have a clear path to the room’s exit
The interview subject should always have a clear path to the room’s exit. Otherwise, allegations of coercion or false imprisonment might be made and sustained
To obtain accurate information, interviewers should interview only……
One interviewee at a time
Write about time issues during an interview
Several time issues must be considered in interviews:
1- time since the incident,
2-time scheduled for interviews in other investigations,
3- availability of the interviewee,
4- availability for the interviewer,
5- anticipated length of the interview
In an incident investigation, when should be the interview conducted
The interviews should be conducted as soon as possible after the event to capture witnesses recollections while they are fresh
In a business situation, the interview should be conducted during ……..
Business hours when the interviewee is expected to be working
Write the descending priority of questioning witnesses
Witness who should be questioned are, in descending priority : 1- persons who are not likely to be readily available later, 2- persons believed to have the most pertinent information concerning the matter under investigation, 3-pesons who are likely to be hostile witnesses.
The offender or offending group or hostile witnesses is interviewed
Last.
Can random questioning bring success to an interview
In general, random questioning is not productive and indicates a lack of professionalism, which the interviewee can readily observe
Why the investigator may want to have a second person in the interview room
The investigator may want to have a second person in the person in the room who can insulate the interviewer from potential accusations the interviewee and corroborate statements against interest, confessions, etc
If a witness to interview is present, he or she should sit to……..
The side of both the interviewee and interviewer and at a reasonable distance from them.
If the interviewer and interviewee are of different sexes, it may be wise to include in the interview a witness of………….
The same sex as the interviewee
If interviewee confidentiality is concern, the interviewee should sit…………
Facing away from the door
Write about the use of audio or video tool during an interview
An audio or video recording of the interview is a valuable tool for confirming statements made by all persons present. It helps confirm the voluntary participation of the interviewee and preclude charges of coercion
When an interview needs to be recorded without the interviewee’s knowledge, prior consultation with…………..
Legal counsel is critical
If the interviewee does not consent and discreet recording is not feasible, the interviewer must take……….
Notes
Write few elements an interview recording should capture
An interview recording should capture at least few elements :
1- consent of the interviewee at the beginning,
2- date, time, and place of the interview,
3- complete identification of the interviewee,
4- identification of all persons present,
5- statement of possible uses of the information furnished,
6- identification of persons leaving the room and time of exit,
7- identification of persons entering the room and time of entry,
8- start time, stop time, and purpose of any breaks,
9- reaffirmation of the interviewee’s consent to the interview and recording
What are the primary question an interviewer should ask an interviewee before the interview begins
Before the interview commence, the interviewee should be questioned as to alcoholic beverages consumed within the last 24 hours and as to any medication taken. The interviewer should note the quantity of alcohol and the name and dose of any medication
Someone who is excessively active, has dilated pupils, hasn’t eaten or slept in days may be under the influence of ………..
Amphetamines and at best unreliable
Does they physical and psychological condition of the interviewee have an effect
The physical and psychological condition of the interviewee can have a profound effect on the reliability and admissibility of the information obtained
What is Stockholm Syndrome
Hostage may form an emotional bond with their captors (known as the Stockholm syndrome) that render their interview suspect
What is Pygmalion effect
An interviewer could have a Pygmalion effect on the interviewee influencing the behaviour. The Pygmalion Effect is a persistently held belief in another person such that the belief becomes a reality
What is the main concept of Pygmalion effect
The main concept of Pygmalion Effect is that if you believe that someone is capable of achieving greatness, then that person will indeed achieve greatness
A person who is physically debilitated or psychologically stressed should not be subjected to a ………
Lengthy interview
Effect of prejudice in an interview
An interviewee’s prejudice toward an individual or group can contaminate the interview process and prejudice on the part of the interviewer will harm the entire process
Give an example of tort of slander
It is tort of slander if an investigator deliberately and knowingly makes a false and damaging statement about the subject of an investigation
Does age have any effect on interview process
Age can have a serious effect on the interview process. The investigator who spends a few extra minutes in friendly conversation may be rewarded with unexpected cooperation and detailed information
What are the key steps to take at beginning of an interview
There are key steps to take at the beginning of an interview which are:
1- identifies the interviewee,
2- identify the interviewer,
3- clarify the interview topic, and
4- establish rapport
The function of the interviewer is to ……….
Elicit information from the interviewee.
What is essential to establish rapport during an interview
To establish rapport during interview, clear communication is essential, so a good rapport must exist between the interviewer and interviewee. A haughty or superior approach by the interviewer will to establish rapport between interviewer and interviewee.
What should an interviewer do if an interviewee verbally attacks him / her
If an interviewee verbally attacks an interviewer, the interviewer should remain controlled, understanding, and non-judgmental
What is “Yes Conditioning
Yes conditioning”, generally elicits an affirmative response and facilitates the cooperation of the interviewee
During interview, the rapport between interviewer and interviewee can be accomplished by using………..
Hidden persuaders initiating a general discussion before direct questioning
During interview, maintaining eye contact with the interviewee by the interviewer promotes……..
Rapport
The interviewer should begin with what type of questions
Broad, general questions and then ask more specific ones
The initial question in the interview is normally …………
A request for the interviewee to relate the events in the matter under investigation
What are the common two types of questions asked during an interview
In interviews, the two types of questions generally asked are open and closed
To put an interviewee at ease, the beginning of the interview should contain what type of question
“Closed” questions, which are specific questions that offer a limited number of possible responses
In the primary phase of interview, what type of question can occur
A narrative type of question should occur
The basic interrogatives (who, what, where, why, and how) are most useful in formulating………
Open-ended questions
The open ended questions elicit a……….
Narrative answer, not a simple yes or no
During the interview, the leading questions should be……..
Avoided.
What are the verbal responses
Verbal responses include both spoken and gestures and also vocal characteristics a stone, speed, pitch, and clarity
What are the non-verbal responses
Nonverbal responses include body movement and position changes, gestures, facial expressions, and eye contact
Write few cautions that need to be respected during an interview process
During the interview process, few note of cautions need to be respected in regard to the verbal and nonverbal behaviour which are
1- no single word or nonverbal behaviour automatically means a person is lying or telling the truth,
2-the assessment of a subject’s truthfulness should be based on the overall behavioural pattern displayed, not on any single observation,
3- evaluation of behaviour symptoms should consider the subject’s intelligence, sense of social responsibility, and maturity,
4-some behavioural characteristics that suggest deception may also be displayed by a truthful subject who feels fear, anxiety, anger, or mistrust
What are the indicators of truth
Indicators of Truth :
1- Answers are direct and spontaneous,
2-One answer for a given question,
3- Harsh, realistic words, such as rob, rape,
4-Speak clearly,
5- Exhibits a reasonable memory,
6- Offers general denials
What are the lie signs
Lie Signs :
1- Delays response or repeats question,
2-Evasive answers,
3-Irrational,fragmented sentences,
4- “memory problems”,
5- Use verbal “coatings”,
6- Overly factual answers,
7-Façade of religion or oaths,
8- Nervous laughter or wisecrackcamouflage,
9- Likely to challenge minute details of factual information offers very specific denials.
Deceptive subjects respond to questions with…….
Complicated, detailed explanations that include factual information and are overly broad for the questions
What are the characteristics of pathological liars
Pathological liars are likely to invent stories when relating the actual facts would be simpler and more convenient
A verbal response coupled with nervous laughter or a wise crack is a common attempt to………….
Camouflage deception
What are the signs of truthful person
During the interview, the truthful person :
1- make general, sweeping denials,
2- offers unqualified, direct, and spontaneous answers,
3- exhibits a reasonable memory,
4-responds to questions in a rational manner and a clear tone of voice;
What are the signs of deceptive person
During the interview, the deceptive person :
1- offers very specific denials,
2- avoids realistic words,
3- makes seemingly irrelevant comments,
4- gives delayed, evasive, or vague answers,
5- exhibits an unusually poor, selective, or remarkable memory,
6-qualifies answers or users religion or oaths to supports statements, and
7- speaks in an irrational, fragmented, mumbled, or subdued manner
Nonverbal behaviour is responsible for…….
More than half of the information and meaning of a message communicated in a conversation
Physical activities of the deceptive person may be categorized into the general types…………
1- significant posture change,
2-grooming gestures and cosmetic adjustments,
3-supportive gestures
Physical deceptive activities grooming gestures and cosmetic adjustments include………
1- rubbing and wringing the hands,
2- stroking the back of the head,
3- touching ,the nose, earlobes, or lips,
4-picking or chewing fingernails,
5- shuffling, tapping, swinging, or arching the feet,
6- rearranging clothing or jewelry,
7- dusting, picking lint from, or pulling threads on clothing,
8- adjusting or cleaning glasses,
9- straightening or stroking the hair.
Physical deceptive activities supportive gestures include ……..
1- placing a hand over the mouth or eyes when speaking,
2- crossing arms or legs,
3-hiding the hands or feet,
4- holding the forehead with a hand,
5- or placing the hands under or between the legs
The posture of truthful people during interview which are…….
1- sits upright but not rigid,
2- positions himself or herself in front of the questioner,
3-leans toward the questioner when making a point,
4- appears relaxed and casual
The posture of a deceptive people which are……..
1- slouches or leans back in the chair,
2- sits unnaturally stiffly,
3- sits off to the side, not directly in front of the questioner,
4- pulls elbows close to the side, arms folded and locked in front, with legs crossed,
5- exhibits rapid and erratic posture changes.
An important nonverbal sign is……….
The suspect’s degree of eye contact with the interviewer
Deceptive people generally do not look directly at the interviewer; they look……
Down at the floor, over to the side, or up at the ceiling
What is the cornerstone of any investigation
Evidence is the cornerstone of any investigative decision
The interviewer who shows respect for the culture of the interviewee will establish ………..
Rapport more easily
who developed BAI
The Behaviour Analysis interview (BAI) was first developed about 40 years ago by the John E. Reid, founder of John E Reid & Associates
Define BAI
A BAI is a systematic evaluation of a subject’s verbal and nonverbal behaviour during the course of a structured interview in which both investigative and behaviour provoking questions are asked
Common investigation questions are
Investigative questions are who, what, when, where, why, and how of the incident
How you will define behaviour provoking question
Behaviour-provoking questions in a BAI are designed to draw out specific verbal responses or behaviour that can be studied to distinguish between a truthful person and a person who is lying
Write few examples of behaviour proving questions
More than 30 behaviour-provoking questions have been developed and used during BAI’s.
The examples of these questions which are used in credit cards stolen investigation:
1- purpose question,
2- you question,
3- knowledge questions,
4-suspicion question,
5- vouch question
Give an example of purpose question
Purpose question: what is your understanding of the purpose of this interview? The truthful response provides an accurate description of events. The deceptive subject’s response is a vague and nonspecific description of events
Give an example of you question
It is the shortest distance to identifying the offender. The example is “over the past several weeks we have had a number of credit cards disappear from the bank and specifically the mail room. If you had anything to do with stealing these missing cards, you should tell us”.
Give an example of knowledge question
Knowledge question: the example “do you know for sure who did steal any of the missing credit cards?” The truthful subjects often volunteer suspicion and the deceptive subject gives a brief, unemotional denial.
Give an example of suspicion question
Suspicion question: the example “who do you suspect may have stolen these missing credit cards?” The truthful subject gives the question careful thought and a deceptive response without giving the question any careful thought
Give an example of vouch question
Vouch question: the example “is there anyone with whom you work who feel is above suspicion and would not do anything like this? “The truthful subject will give the question thought and typically eliminate possible suspects and the deceptive one, will not vouch for others. This question is also known as a “trust question
What is considered the most effective process for persuading a deceptive suspect to tell the truth
The Reid Nine Steps of interrogation process is considered the most effective process for persuading a deceptive suspect to tell the truth.
The Reid Nine Steps of interrogation process is generally conducted only when……
The investigator is reasonably certain about the suspect’s involvement in the fact
What are the steps of Reid Nine
The Reid Nine Steps of Interrogation process are :
1- Positive Confrontation,
2- Theme Development,
3-Handling Denials,
4-Overcoming Objections,
5-Keeping a Suspect’s Attention,
6-Handling a Suspect’s Passive Mood,
7-Presenting an Alternative Question,
8- Having the Suspect Relate Details,
9-Converting an Oral Confession
Define positive confrontation phase
During positive confrontation phase, after an exchange of greetings, the interrogator confronts the suspect with an accusation of guilt. This type of accusation is made only when the suspect’s guilt seems very clear. Otherwise, the statement should be less direct. During positive confrontation phase, following the confrontation, the interrogator pauses to evaluate the suspect’s reaction to the statement and then repeats the initial statement of involvement. Then the interrogator sets the investigation file aside, sits down directly opposite the suspect, and makes a transition to a sympathetic and understanding manner.
How to handle denials
In handling denials, the interrogator should interject a blocking statement whenever the suspect inters an “I didn’t do it plea because the more often the suspect denies guilt, the more difficult it becomes to admit later
How innocent suspect reacts during interview
The innocent suspect generally will not ask to make a statement but will, instead, without any display of etiquette, promptly and unequivocally maintain innocence
Most suspect’s objection statements can be categorized in two general groups……….
1- trait objections,
2- factual objections
Give example of trait objections
“I wasn’t brought up the way” or a person who would do something like that is really stupid” are example of trait objections
Give examples of factual objections
“I don’t even have the safe combination, “I didn’t even know him”, or “I don’t need the money” are the examples of factual objections
While converting an confession into written, what are the formats that can be used?
One of four formats can be used:
1- statement written by the suspect,
2- statement authored by the interrogator but read and signed by the suspect,
3- statement taken down by a secretary or stenographer and transcribed into a typed document for the suspect to read and sign, 4- recorded statement (audio or video) by the suspect
How to reduce false confession
Provide alternate scenario & refrain suggesting answers and providing details
What are other suspect Interviewing techniques
- The PEACE model ,
- The WZ non-confrontational method,
- The Kinesic Interview
What is evidence
Evidence is that which provides proof or an indication of an assertion
What are the forms of evidence appearance
Evidence appears in
1- oral,
2- documentary, and
3- physical forms
What are the classifications of evidence that court considers
There are three classifications of evidence that the courts will consider, they are
Oral
Documentary
Physical form
What are the basic categories of evidence
Testimonial - statements or the spoken word from the victim(s) or witness(es).
Physical - also referred to as real evidence, consists of tangible articles such as hairs, fibers, latent fingerprints, and biological material
What is the fundamental difference between direct and indirect evidence
Direct evidence is first-hand knowledge and by contrast, indirect evidence is a highly informed inference
Why indirect evidence also called circumstantial evidence
Indirect evidence is also called circumstantial evidence where something is inferred to have happen because testimony given on a series of events leads one to believe that it did have happened
Whether hearsay evidence is direct or indirect? Does it admissible during trial
Hearsay evidence falls into the category of indirect evidence. Hearsay evidence is normally not admissible in a trial.
What is “Materiality”? What does mean by it
The rule that applies most often in determining the importance of evidence and its ability to prove a point is called “Materiality”. Materiality means:
1- what are the quality and substance of evidence,
2- connection of evidence to the incident or case
Write an exception to hearsay rule
An exception to the hearsay rule is when a person making the statement about what another person said made statements against self-interests
What is “Res Gestae”
Res gestae (things done) is an exception to the rule against hearsay evidence
What is the underneath belief of “res gestae”
Res gestae is based on the belief that because certain statements are made naturally, spontaneously and without deliberation during the course of an event, they leave little room for misunderstanding/misinterpretation upon hearing it by someone else and thus court believe that such statements carry a high degree of credibility.
Which evidence can be admitted under the “Res Gestae”
Evidence which can be admitted into evidence as Res gestae fall into three headings:
1- words or phrases which either form part of, or explain a physical act,
2-exclamations which are so spontaneous as to belie concoction and, 3- statements which are evidence as to someone’s state of mind
Why it is important to gather the evidence after an incident
After an incident, security practitioners should gather evidence carefully so that such evidence can be used to establish a timeline, resolve the issue, analyze how the incident occurred, and if necessary modify security measures to prevent future incidents.
When the defense side is entitled to the information in criminal and non-criminal cases?
In both criminal and non-criminal cases the defense is entitled to the information during discovery
What is the procedure of marking evidence
Evidence should be marked with the investigator’s initials at the time it is gathered
What is the procedure of maintaining the chain of custody of evidence that was seized to present at trial
Limiting the individuals who handle the evidence to the smallest number possible and properly documenting each transfer will maintain the chain of custody and assist the prosecution when introducing in at trial as the same evidence that was seized.
What is oral evidence? Is it direct or indirect?
Oral evidence is a spoken statement regarding a person’s knowledge, which may be direct or indirect and gained through any manner.
What are the key points to remember during preliminary scene investigation?
During the preliminary scene investigation, it is necessary to preserve and document the scene, including information from witnesses and physical assets.
During investigation after securing the scene what is the next step the investigator should take?
After securing the scene the investigators first calm the victim and attend to any injured persons
During investigation after securing the scene what is the next step the investigator should take is to calm the victim and attend to an injured persons and what is the next step
Then investigator should do :
1-identify any perpetrators and detain them if still present at the scene,
2-determine what type of incident has occurred,
3- broadcast an updated description of incident, perpetrators, and vehicles,
4- verify the identityofwitness,
5- separate witnesses, and instruct them to avoid discussing details of the incident with other witnesses, 5- canvass the area for other witnesses
What affect the accuracy of that information obtained by an investigator during the course of investigation
The manner in which the preliminary investigating officer obtains information from a witness affects the amount
When interviewing a witness, the preliminary investigating officer should consider some approaches. What are these approaches?
These approaches are:
1- establish rapport with the witness,
2- inquire about the witness’s condition,
3-use open-ended questions, augmented with closed-ended questions, and avoid leading questions,
4- clarify the information with the witness,
5-document information obtained from the witness, including the witness’s identity,
6-encourage the witness to contact investigators with any further information,
7-encourage the witness to avoid contact with the media or exposure to media accounts concerning the incident,
8-instruct the witness to avoid discussing details of the incident with other potential witnesses .
In the course of developing rapport with witness, the investigator can learn about the witness’s…………
Communication style.
What is the key to collect more information from a witness
If the preliminary investigating officer can establish rapport with the witness, then witness will be then more comfortable during the interview and will likely provide more be then more comfortable during the interview and will likely provide more
What happens when the investigator inquire about the witness’s condition
When the investigator inquire about the witness’s condition, it helps to contributes to rapport and also alert the investigator to physical or mental conditions
What allows for an unlimited response from the witness in his or her own words, thereby generating a greater amount of unsolicited information
An open-ended question
Which type of questions tends to be more accurate and promote more effective listening on the part of the investigator
Open-ended responses Source
What limits the amount or scope of information that the witness can provide
Close-ended question
What should the investigator do if the witness is unresponsive to open-ended questions or provides imprecise responses?
The investigator should follow with more directed questions.
What is the procedure for questioning witness during the beginning of every new topics?
For each new topic, the investigator should begin with open-ended questions and augment them with closed-ended questions if necessary
Which of the below type of investigative question method suggest an answer and may distort the witness’s perception or memory
Leading Questions
Why the independence of witnesses is important
So that investigators can judge whether the information they provided is consistent with other witness’s statements and other evidence developed in the investigation
What maximizes the effectiveness of witnesses’ participation and interviewer efficiency
Preparing for an interview
What the investigator should do before conducting interview
The investigator should:
1- review available information,
2- plan to conduct interview as soon as the witness is physically and emotionally capable,
3- select an environment that minimizes distractions and is comfortable for the witness,
4-obtain key materials,
5- determine the nature of the witness’s prior law enforcement, security, or corporate contacts
Which type of statements can be used for corroboration
Independent witness statements
What are the principles that underlie the interviewing of cooperative witnesses
1- social dynamic between the interviewer and witness,
2- facilitation of the witness’s memory and thinking,
3- communication between the interviewer and witness.
How an interviewer can personalize an interview
The interviewer can personalize the interview by treating the witness as an individual.
How to develop social dynamics
Social dynamic can be developed if the interviewer shows understanding and concern by asking about the witness’s health, empathizing with the witness
A rapport between the interviewer and witness is especially helpful when ………….
The investigator seeks personal or intimate information from a witness
To encourage the witness to volunteer information without prompting, what the interviewer should do?
The interviewer should do:
1- state expectations,
2- ask open-ended question,
3-avoid interruptions, and
4- allow pauses.
During the interview, what discourage the witness from playing an active role and disrupt his or her memory
Interruptions
Much of the information about an incident is stored in the …………..
Witness’s mind
How the interviewer can promote information retrieval from witness
In several ways:
1- minimize distractions,
2- encourage the witness to mentally recreate the incident,
3- tailor questions to the witness’s narrative
If the witness is thinking or talking about the perpetrator’s face, the interviewer should ask the questions about the……….
Face and not other aspects of the incident, such as license plate
During the interviewing process, what are the issues that an interviewer is concerned
With many issues, such as resolving an incident, enforcing corporate rules, and preparing for civil litigation.
For the most productive interview, both the interviewer and witness should
Communicate their needs and information to each other.
Oral evidence is given great weight by……………
Jurors and judges alike
It is important that investigator make no promises or offers of a reward to encourage a witness to make a statement, this will void the statement if discovered. What else could be result of this
It may also lead to a charge of witness tampering against the investigator
What can sometimes determine the origin or authenticity of questioned writing
Examination of handwriting characteristics
While examining handwriting characteristics, some factors can lead to inconclusive results. What are these factors
1- insufficient quantities of questioned or known writing,
2- lack of contemporaneous questioned and known samples,
3- distortion or disguise in the questioned or known writing,
4- insufficient identifying characteristics,
5-submission of photocopies evidence instead of original evidence
In obtaining a known sample of handwriting , what the investigator should do
1- give instruction( oral or written) only concerning the text to be written,
2- ensure that all exemplars are on separate pieces of paper,
3- ensure that the writer and witness initial and date each pages of writing,
4- do not allow the writer to see the previous exemplars or the questioned writing,
5- obtain exemplars from dictation until normal writing has been produced,
6- obtain exemplars from the right and left hands,
7- obtain hand printing exemplars in both uppercase and lowercase letters,
8-obtain exemplars written rapidly, slowly, and varied slants,
9- obtain a sufficient quantity of exemplars to account for natural variation in the writing,
10- obtain un-dictated writing, such as business records, personal correspondence, and cancelled checks.
What are the types of false signature
1- traced signature,
2- simulated signatures, and
3- freehand signature
While sipping documentary document, what the investigator should do
1- protect the evidence from inadvertent indented writing,
2- mark documents unobtrusively by writing the collector’s initials, date, and other information in pencil,
3-whenever possible, submit the original evidence to the laboratory,
4- refrain from storing or shipping photocopies in plastic envelopes
How many categories, as an security investigator you can divide physical evidences? What are these categories
Physical evidence can be divided into five categories,
1- corpus delicti,
2-associative,
3-identifying,
4- tracing,
5- trace
Corpus delicti relates to which types of evidence
The evidences that prove a crime has been committed, such as the body at a homicide scene.
Associative evidence (also known as circumstantial evidence) links a suspect with the ………
Scene of a crime, such as fingerprints, or DNA
What is tracing evidence
Tracing evidence are those article that assist in the possible identification and location of a suspect, such as a credit card receipt or a laundry mark or tag on a piece of clothing.
Trace evidence that will undergo examination in the criminalities section or a crime lab includes……..
Fibers, paints, dyes, glass, and similar elements
What is included as impression evidence
Impression evidence includes firearms, tool marks, bite impressions, and footprints.
Success in the physical evidence increase when an incident scene search is planned, coordinated, and executed by knowledgeable security employees. What is required to coordinated, and executed by knowledgeable security employees
Must keep in mind:
1- the best search options are usually the difficult and timeconsuming,
2- physical evidence cannot be over documented,
3- a search may either a cautions search of visible areas or a vigorous search of concealed areas,
4-searches must be timely so that they are conducted while evidence may still be available.
During scene search, the security professional in charge should take some steps first. What are the steps
1- discuss the search with involved personnel before arrival at the scene, if possible,
2- ensure that personnel are aware of the types of evidence usually encountered and the proper handling of the evidence,
3- make preliminary personnel assignments before arriving at the scene, if possible.
What are the combinations of scene search team
The combination of scene search team are :
1- person in charge,
2- photographer,
3-sketch preparer,
4- evidence recorder,
5- scene supervisor
What are the responsibilities of person in charge during a scene search
During the scene search, the responsibilities of person in charge are:
1- ensures scene security,
2- prepare administrative log,
3- conduct preliminary survey (initial walkthrough),
4- prepare narrative description,
5- resolve problems, and
6- make final decisions.
What are the responsibilities of scene supervisor during a scene search
During the scene search, the responsibilities of scene supervisor are : 1- establish communication with the appropriate corporate executives,
2- obtain evidence collection and packaging material s and equipment,
3- prepare the paperwork to document the search,
4-provide appropriate protective clothing, communication, lighting, shelter, transportation ,equipment, food, water, medical assistance, and security for search personnel,
5- take extensive notes,
6- consider the safety of all personnel,
7- be alert for evidence.
To secure and protect the scene, what the on-site team should perform
1- take control of the scene immediately,
2- determine the extent to which the scene has been protected,
3- designate one person to be in charge of final decision making and problem resolution,
4- take extensive notes,
5- keep out unauthorized personnel,
6-records who enter and leaves
What is a tool for planning search
The preliminary survey is a tool for planning a search
While producing narrative of the incident scene, what are the key points it should include
It should include key points which are:
1- case identifier,
2- date, time, and location,
3- weather and lighting conditions,
4- identity and assignments of personnel,
5-condition and position of evidence
While doing incident scene search, photograph the most…………………
Fragile areas of the incident scene first.
In incident scene search, the sketches are used to record
Location of items, conditions, and distance and size relationships.
While making sketch during incident scene search, what it should include
It should include:
1- case identifier,
2- date, time, and location,
3- weather and lighting condition,
4-identity and assignment of personnel,
5- dimensions of rooms, furniture, doors, and windows,
6- distance between objects, persons, bodies, entrances, and exits,
7- measurements showing the location of evidence(in reference to two unmovable items),
8- key, legend, compass, orientation, scale, scale disclaimer, or combination thereof.
Why the actual collection of evidence is most critical
The actual collection of evidence is most critical because during the time of physical evidence collection process most errors occur. That is why it is important to teach the proper process of securing a crime scene in any basic law enforcement or security officer training course
The most common type of physical evidence is …………………
Fingerprints, so care should be taken to collect and preserve them first
Two suggestions for physical evidence collection
During physical evidence collection process use a search pattern (grid, strip or lane, spiral) and search from general to specific
During physical evidence collection process, photograph……………
All items before collection and notate the photographic log
During physical evidence collection process, why it is required to arrange two persons in the place
To observe evidence in place, during recovery, and being marked for identification. Mark directly on the evidence when necessary, but first attempt to place identifying marks on evidence containers
As a minimum, the best way to certify a piece of evidence is with…………
With the investigator’s initials
What can establish the actual chain of custody for evidence collection
The proper marking of evidence at the time of seizure and transfer establishes the actual chain of custody
For evidence to be admissible, what it must prove
It must be proven that the evidence was not tampered with, thus the chain of custody must be maintained and documented throughout the process to identify all the individuals whom came in contact with the evidence
After the incident scene search, what should be done
Release the incident scene after the final survey
On completion of the incident scene search, what should be noted in the release documentation
Note in release documentation:
1- the time and date of the release,
2-to whom the scene was released, and
3- by whom it was released
On completion of the incident scene search, what is required to be ensured
Ensure that the evidence is:
1- collected according to legal requirements,
2-documented,
3- marked for identification
On completion of the incident scene search who is the only person to allow to release the scene?
Only person in charge is allow to release the scene
Why it is required to call the laboratory before packaging and shipping evidence
For specific instructions
While shipping evidence completely seal the outer container, why
So that tampering with the container would be evident
While shipping evidence, affix “EVIDENCE” and “BIOHAZAR” labels, if appropriate, on the inner container. If any of the evidence needs to be examined for latent prints, the inner container. If any of the evidence needs to be examined for latent prints, affix a……………
“LATENT” label on the inner container
According to the U.S department of transportation regulations 49CFR 172.101, a trained and qualified evidence technician must assist with………….
Typing, labelling, packaging, and shipping of all hazardous materials
What are the guidelines must be followed when shipping live ammunition
1- package and ship ammunition separately from firearms,
2- label the outside of the container “ORM-D, Cartridge, Small Arms, 3- note on the declaration of dangerous goods the number of packages and gross weight of the completed packages in grams.
The process for determining whether a material is a hazardous waste should be done by ………………
Qualified personnel
Hazardous materials that are removed from incident scene are considered evidence and would not fall under ……………….
RCRA waste provision
What can be used to determine the general rifling characteristics such as calibre and physical features of the rifling impressions and the manufacturer of the bullets?
Fired bullets can be examined to determine
What can be used to determine the calibre or gauge, the manufacturer, and whether there are marks of value for comparison
Examination of cartridge cases or shot shell casing
What is used for estimating muzzle-to – garment distances during an investigation where bullet is fired
Pattern of gunshot residue can be duplicated using a questioned firearm and ammunition combination fired into test materials at known distance. These patterns serve as a basis
Clothing with blood must be air-dried and labelled on the inner and outer containers. What should be written in the label
“BIOHAZARD”
What can be used to determine the calibre or gauge and whether there are marks of value for comparison
Examination of unfired cartridges or shot shells can
Examination of what can also determine whether the ammunition was loaded in and extracted from a specific firearm
Examination of unfired cartridges or shot shells can
Examination of what can determine the gauge and the manufacturer
Wadding components
During computer forensic examinations, generally submit only the
Central processing units and the internal and external storage media
Two sources of DNA are used in forensic analysis. What are these two
These are:
1-Nuclear DNA,
2-Mitochondrial DNA
As there are classifications of DNA, which type of DNA is typically analysed in evidence containing blood, semen, saliva, body tissue, and hairs that have tissue at their root ends
Nuclear DNA
Which type of DNA is analysed in evidence containing naturally shed hairs, hair fragments, bones, and teeth
Mitochondrial DNA is typically analyzed
The appropriate methods for collecting, packaging, and preserving DNA evidence depends on the……………..
Liquid or solid state and the condition of the evidence. The more the evidence retains its original integrity until it reaches the laboratory, the greater the possibility of conducting useful examination
For DNA analysis, what amount of blood should be collected by the medical personnel?
Medical personnel shall collect at least 5 milliliter tubes of blood in purple-top tubes with EDTA as an anticoagulant
What a blood examination request letter should contain
A blood examination request letter should contain:
1- brief statement of facts relating to the case,
2- claims made regarding the source of the blood,
3- whether animal blood is present,
4- whether the stains were laundered or diluted with other body fluids,
5-information on the victim’s medical condition or that of any persons of interest, such as AIDs, hepatitis, or tuberculosis
What can determine whether particles of glass originated from a broken source of glass
Glass comparison examinations
What can determine the direction and type of the breaking force and the sequencing of shots.
Glass fracture examinations
Why Hair analysis is used? What can be found from human hair analysis?
Hair analysis can determine whether hairs are animal or human. Race, body area, method of removal, damage, and alteration can be determined from human hair analysis.
How many hairs are required for hair analysis
For hair analysis, collect at least 25 known hairs from different parts of the head or public region.
Write about photogrammetry? Differentiate between a photogrammetry request and facial comparison request
Dimension can be derived from photographic images through the use of mathematical formulas or on-site comparison. Examples of photogrammetry include If a facial comparison is requested, ensure that the face or head fills more than half the frame. If photogrammetry is requested, include the dimensions of the scene to the nearest 1/8 inch and include a diagram or print from the surveillance film indicating the location of the measurements.
What is the ideal place to develop latent prints
The laboratory is the best place to develop latent prints.
Write down two considerations for taking photographic latent prints
While taking photographic latent prints use a 35 mm or medium-format camera with a macro lens capable of half-size to full-size reproduction and use T-Max 400 film, set the aperture of f/11 and use the metering system to select a suitable speed
To investigate which types of incident lubricant examinations are conducted
Lubricant examination may be conducted in sexual assault, vehicular homicide, and heavy equipment sabotage cases
Why metallurgical testing are used
Metallurgical testing of materials can determine whether inferior components were substituted in contracting frauds
Why metal fragmentations examinations are used during investigation
Metal fragmentations examination can determine how metal fragmentations were formed. If fragments were formed by impulsive (short duration, high-strain rate)loading, it can be determined whether an explosive was detonated and what the magnitude of the detonation velocity was
When product tampering are occurred
Product tampering occurs when a commercial product is internationally distorted to harm someone or for extortion purposes
What are the considerations while taking incident scene photographs
While taking incident scene photographs, images should be taken using a 35mm or medium-format film camera. Color film may be preferable to black-and- white. In most ambient light situations, use 100 ISO film
Impressions in snow are difficult to photograph, why? And what is can be the solution?
Because of lack of contrast. It is best to attempt to photograph the impressions as if in soil.
If the evidence itself cannot be submitted to the laboratory
It can be cast with dental stone and the cast submitted to a laboratory
A file of shoe manufacturers’ designs and a file of tire tread and the reference material can be searched to determine ……………
Brand names and manufacturers
Which types of examination are used to disclose the presence of drugs and poisons in biological specimens
Toxicology examinations can disclose the presence of drugs and poisons in biological specimens and food products. The examinations can determine the circumstances surrounding drug- or poison –related incidents and accidents
Biological evidence in drug-facilitated assaults must include a………….
Urine sample. The urine must be collected as soon as possible after the assault and not more than 96 hours after the alleged drugging
What are determined by the authenticity examinations
Authenticity examinations are conducted to determine whether video recordings are original, continuous, unaltered, and consistent with the recording device used to make the recording
Which types of examinations are used to maximize the clarity of the video signal through video processors and time base correctors
Enhancement examinations are conducted to maximize the clarity of the video signal through video processors and time-base correctors
Special effects such as a mosaic can be added to video recordings to protect……….
A person’s identity
During incident scene investigation, personnel operating in or around contaminated environments must be aware of the various ways in which hazards may enter and harm the body. These are …………..
Inhalation, skin contact, ingestion and injection
How to avoid contamination during evidence collection process
In the evidence collection process, while personnel operating in or around contaminated environments, by applying proper work practices and by ensuring adequate ventilation it possible to minimize the risk of airborne contaminant inhalation.
When respiratory protection is required during evidence collection
In the evidence collection process, while personnel operating in areas with airborne contaminants, respiratory protection must be worn. Only certified personnel are allowed to wear respiratory protection
What are the consequence of contamination while evidence collection
In the evidence collection process, contamination through the skin can result from direct contact or by absorption. Systemic effects, such as dizziness, tremors, nausea ,blurred vision, liver and kidney damage, shock, or collapse, can occur when the substances are absorbed through the skin and circulated throughout the body
Fundamental to the blood borne pathogens standard is the concept of
Universal precautions
Under the blood borne pathogens standard, it is required to treat all blood, body fluids, or other potentially infectious materials as if infected with blood borne diseases. What are the example of blood borne diseases?
Hepatitis B virus (HBV), hepatitis C Virus (HCV), and human immunodeficiency virus(HIV).
What is engineering control against contamination while evidence collection
As part of the universal precautions on blood borne pathogen safety engineering controls and prudent work practices can reduce or eliminate exposure to potentially infectious materials. Some examples of engineering controls include puncture-resistant containers used for storage and disposal of sharps and paints stirrers and long-handled mirrors for use in locating and retrieving evidence in confined or hidden spaces
What can be done with Pyrophoric materials
Pyrophoric materials, such as phosphorus, sodium, and barium, can be liquid or solid and can ignite in air temperatures less than 130 degrees F (54 degrees Celsius) without an external source.
What are Oxidizers and function
Oxidizers, such as nitrates, hydrogen peroxide, and concentrated sulfuric acid, are a class of chemical compounds that readily yield oxygen to promote combustion. They should not be stored with flammable and combustible materials or substances that could rapidly accelerate their decomposition
What is the function of Material Safety Data Sheets
In the United States, Material Safety Data Sheets on various chemicals provide guidance on hazardous properties, disposal techniques, personal protection, packaging and shipping procedures, and emergency preparedness
What is confined space
A confined space is an enclosed area that is large enough for personnel to enter and work but that has limited or restricted means of entry and exit.
Nitrile provides protection from…….
Acids, alkaline solutions, hydraulic fluid, photographic solutions, fuels, lubricants, aromatics, petroleum, and chlorinated solvents. It also offers some resistance to cuts and snags
Neoprene offers resistance to
Oil, grease, acids, solvents, alkalies, bases, and most refrigerants
Polyvinyl chloride (PVC) is resistant to
Alkalies, oils, and limited concentrations of nitric and chromic acids
What can lower the risk of developing latex allergies
Powder free gloves with reduced protein content will lower the risk of developing latex allergies. Personnel allergic to latex can usually wear nitrile or neoprene.
When face shields offer better protection
Face shields offer better protection when there is a potential for splashing or flying debris. Face shields must be worn in combination with safety glasses or goggles
Protective eyewear should be worn ………..
Over prescription glasses
What include critical elements for the safe use of respiratory
Critical elements for the safe use of respirators include a written program, training, medical evaluation, fit testing, and a respirator-maintenance program
From eye of a security employee what is describe the journey of testimony
Security employees can view testimony as a journey that begins with an incident; depends on procedures and reports; features judges, counsel, and witnesses, requires pre-testimony review, and ends with testimony given with full knowledge of the techniques of testifying and traps of opposing counsel
Acceptance as an expert witness typically requires such measures as……..
Experience, education, teaching, research, and publication of articles in the field
Lawyers are trained to look for inconsistencies in testimony and exploit them to their advantage. There are some types of inconsistencies that could lead a jury to believe witness is dishonest. What are these inconsistencies?
1- inconsistencies in the witness’s own statement,
2- inconsistencies between the witness’s different statements,
3- inconsistencies between the witness’s statement and what others said,
4- inconsistencies between the witness’s statement and other evidence.
In the process of testimony, regarding body language and answering strategy issues, what witness should do
Witnesses should do :
1-look comfortable but do not slouch, rest head on hand, chew gum, play with earnings or moustache, or move around in the chair,
2- ask for a reason break or drink of water if needed,
3- speak authoritatively but not arrogantly,
4- answer questions directly but volunteer nothing,
5-be aware of time and distance distortions, as few people estimate accurately,
6- admit to meeting with counsel,
7- admit discussing the case with others, if the discussions are notprivileged,
8- keep an even temper even if opposing repeats the question numerous times with increasing incredulity,
9- make opposing counsel ask simple questions, not multiple questions within a question.
During the process of testimony, when answering questions, witnesses should
Emphasize self-confidence, speak clearly and give positive, direct, and definitive answers whenever possible
What are the elements security employees should be aware of while giving testimony
1-Counsel might try to gauge the witness’s ability to withstand serious crossexamination,
2-an attorney might summarize a witness’s answer in the attorney’s words,
3- counsel might violate rules of evidence and seek hearsay, conversation information, rumors, and opinions,
4- the attorney might ask for witness’s notes,
5- the attorney might ask trick questions
What can help the security employee testify more effectively
Knowing what to expect of the opposition can help the security employee testify more effectively
What is the dress Code for the Security Employees during testimony
While witness present to the court to give testimony, to be effective witnesses, security employees should dress appropriately for the jury and jurisdiction
While giving testimony, security employee should strive to be …………..
Personable, charming, professional, polite, earnest, and knowledgeable and must also emphasize self-confidence
When witnesses reveal their opinions in front of other witnesses, they raise the risk of ………………..
Impeachment problems (possibly due to a misinterpretation of their words) and may prematurely reveal their testimony to the opposition
Write few notes about security witness incident site visit
The security witness should visit the incident site-ideally, in conditions similar to those prevailing when the incident occurred (time of day, time of year, lighting, either etc).
Who is responsible for gathering of the evidence and chain of custody of the evidence?
The security employee should also be prepared to testify on the gathering of the evidence and the chain of custody
What is the only way to ensure the evidence exists in its entirety as noted in exists in its entirety as noted in descriptive documents and evidence taps?
If physical evidence will be used in court, the security employee should physically examine it during the pre-trail conference. This is the only way to ensure the evidence exists in its entirety as noted in descriptive documents and evidence tags
What is examined by pre-testimony review examination
The proper pre-testimony review examines:
1- notes and reports on the incident,
2- evidence that is advisable, accessible, and retrievable,
3- documentary evidence from any subsequent actions or hearing
What security employees must do before review their notes and discuss their testimony?
Before testifying, in any venue, security employees should review their notes and discuss their testimony with counsel including any concerns they have about a weak point in the case
How witnesses can often detect how jurors view them and their answer
Through casual glance, witnesses can often detect how jurors view them and their answer
How people experience in their life
People experience life through their sense(neurological); communicate primarily through spoken language(linguistic); and organize information and actions through a self-ordered mechanism called a program(programming);
What is Neuro-linguistic programming
Witnesses may be able to communicate better with juries by using an interview technique called Neuro-linguistic programming
For whom cross-race effect is especially important
The cross-race effect may make it especially important for security witnesses to build a rapport with the jurors and show themselves as knowledgeable
Like most people, jurors are influenced by………..
Their personality, culture and life experience
What is meant by voir dire
Juries consist of jurors, selected citizens required to render a decision based on the facts presented to them. Jurors are not professional arbiters of fact. Typically their names are drawn from the voter rolls in a jurisdiction. Once sworn in the jury candidates are put through a legal process known as voir dire where the attorneys and /or judge ask questions to determine their suitability to be on the jury for the trail in question.
Who are the court room participants
The courtroom participants are judges, juries, counsel and witnesses
What is meant by decess tecum
It is also important to have a pre-trial meeting were opposing litigants get together to exchange information that each believes is necessary to their position. They will request a deces tecum (produce all tangible evidence) from each other as well as written questions called interrogatories.
The testimonial evidence the security professional will be presenting in court is call
” parole” or “ spoken word” and the attorney will want to make sure that It supports the case
Shortly before testimony to the court, there is a need of preparation which may consist of …………
A site visit and a review of notes, reports, photos, and diagrams
Why a incident has a better credibility than a mental recollection
An accurate and timely capture of facts and impressions of the incident in a report or notes is much credible than mental recollection, which is diminished and altered by time and events
The testimony preparation starts with…………….
The accurate and timely capture of facts and impressions of the incident in a report or notes.
The preparation of testimony begins………….
Long before thoughts of litigation.
Who should provide relevant reports and notes to counsel?
Security employees should provide all relevant reports and notes to counsel
Why witnesses (security employees)should examine the evidence first
Witness (security employees) should examine the evidence before taking the stand because its appearance may have changed and it may appear in a different order than expected.
How security employees should mark evidences?
Security employees should mark evidence with their initials, the date, and a tracking or report number, in the same location whenever possible.
Every security incident should be treated as …………….
If it could result in a courtroom appearance
From the first day on the job, security employees should realize that their
Observations, reports, or findings, coupled with their demeanour and their ability to articulate events may be the key to the verdict.
What is the basis of opinion by an opinion witness
An opinion witness may provide an opinion on the matter at hand, based on analysis of the evidence according to accepted scientific standards and scholarly research methods
What are the skill / qualification to be accepted as an opinion witness(expert witness)?
To be accepted as an opinion witness, also known as an expert witness or forensic witness, one must demonstrate training, education, and experience in a specific subject
What is hearsay witness? What is the exception associated with hearsay witness
Hearsay witness- relating what some other person may have said-may or may not be admissible
Fact witness testimony is typically restricted to matters that……………..
The witness actually saw, heard, smelled, touched, or tasted
Who should give a testimony
A person who gives testimony- a witness- is usually either a fact witness or an opinion witness. Security employees could be either
How should be the testimony of security employees
Security employees’ testimony must always be truthful and at the same time follow court guidelines and counsel’s strategy
Why security employees should learn the rules and processes related to giving testimony?
Because the experience of testifying in a courtroom can be intimidating
When Security employees called for testify they should be paired with whom
Security employees called to testify are usually paired with legal counsel
Security employees are often called to give testimony because of the incidents they encounter……………..
In their work
Testimonial evidence generally represents………………….
Major portion of the evidence presented in court
What is the main goal of an overt surveillance
The main goal of an overt surveillance is to prevent crime or misconduct
What are the focusing points of misconduct investigation
Misconduct investigations often focus on conflict of interest, corporate resource abuse, employee theft, workplace violence, and substance abuse
If you are owner of a company, what are the decision you should take before misconduct investigation is initiated
Once a misconduct investigation has been initiated, the company must make several decisions. These decisions include:
1- whether any offense or infraction actually occurred,
2- whether reporting to law enforcement is required or appropriate, 3- how the employee will be notified of the findings and action to be taken
What are the principal characteristics of internal theft
Principal characteristics of internal theft include diversion, conversion, disguise and divergence
What is the significant source of loss worldwide
Motivated by economic conditions, internal theft remains a significant source of loss worldwide
Workplace violence investigation is generally considered one component of……..
An overall prevention/response/recovery program for workplace violence
The best prevention of exposure to workplace violence is ……….
Pre-employment background investigation program.
What are the results of substance abuse?
On-the –job substance abuse costs include absenteeism, reduced productivity, accidents, theft, and increased healthcare costs.
Security and investigative professionals should remain alert to the …….
Possibility of false allegations regarding substance abuse and be prepared to take appropriate action in response.
What is the purpose of corporate compliance program?
The purpose of corporate compliance program is to protect the organization against violations of law, lapses in business ethics, and concomitant legal sanctions.
A corporate compliance program encourages ……..
Enforcement, monitoring, and employee training.
What is the key element of compliance program?
Key element of compliance program is an effective reporting mechanism
What can significantly reduce losses in most corporate and organizational environment
An effective hot line can significantly reduce losses in most corporate and organizational environments
The efficacy of the hot line can be enhanced through…….
An on-going awareness program
Records and database checks represent a………….
Key element of almost any investigation
What are the key components of an investigation
The collection, handling, processing, and use of evidence are a key component of investigation
What is meant by surveillance
Surveillance means observing the behaviour of another, usually secretly
The primary purpose of surveillance is to …….
Obtain information about the identities or activities of those under investigation
What are the categories of surveillance
Surveillance can be broken down into three broad categories which are
Direct,
Preconstructive, and
Reconstructive.
Direct is covert, Preconstructive is more public, and reconstructive is reviewing information and evidence gathered from the other two techniques
What is ABC method
ABC method is conducted for foot surveillance and checkpoints in mobile surveillance
Write about computer forensic
Computer forensic science is the science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media
Define force multiplier in investigation
For investigative purpose, a force multiplier is any activity, capability, or resource that enhances the effectiveness or efficiency of the investigative function.
What are the three important, force multiplier in investigation
Three important force multipliers in investigations are
human,
environmental, and
organizational.
Can intelligence information play role of force multiplier
Intelligence information is a key force multiplier for IUs in almost in any settings
What is the result of reporting chain confusion
Reporting chains confusion can lead to the dissemination of fragmented and apparently contradictory information regarding task force progress, successes, needs, and relationships
Is there any effect in reporting chain when JTF is established
Reporting chains can be confusing in the joint task force environment
What is the result of parochialism
Parochialism inevitably causes conflict, whether explicit or subtle, and can seriously detract from the effectiveness of the unit
When parochialism can occur
Parochialism can occur when joint task force members arrive with varying agendas, either individual or organizational
One high structured form of liaison is the…..
Task force
A key asset of any investigator or IU is…..
A good reputation
What is required after a liaison is established
Once established
In the global business environment, liaison relationships are ……
Critical to effective investigations
An excellent opportunity for establishing liaison contacts is through…….
Professional and civic associations
Professional relationships are established through……..
Introductions, references, contacts (both formal and social), and mutual assistance
Define liaison in investigation
Liaison in investigations comes in many forms: internal and external, formal and informal, and individual and organizational
What are the major cautions needed to be consider during online research
Three major cautions must be respected by the investigators while doing online research.
These are:
1-investigators and staff members may go off on a tangent, spending a great deal of time inefficiently by searching online for the sake of searching online,
2- there is a natural tendency to assume that information extracted from database or online sources is credible,
3- while most investigators enjoy searching the internet that may not be the best use of their time.
What is the main challenge when analyzing audio recordings in a noisy environment during an investigation
Audio enhancement software may be unable to filter background noise effectively
Which of the following is not a preservation method for digital evidence
Encrypting
What is the primary limitation of using encrypted messaging services in a covert investigation
It can be difficult to establish the authenticity of decrypted messages
What is the most significant limitation of using private surveillance footage as evidence in a criminal investigation
There may be privacy concerns about how the footage was obtained
What is the primary challenge when interviewing a suspect who is a sociopath
Their tendency to lie easily and convicingly
What is the primary risk associated with using undercover agents in corporate espionage investigations
They may become compromised and forced to reveal their true identity
Which of the following is not a common method of fraud scheme
Phishing
In complex financial fraud investigations, why is the collection of metadata often essential
It helps to establish the origin of digital communications
Which type of evidence is considered that most reliable in a court of law
Physical evidence
What is the primary legal concern when using location tracking apps as evidence in an investigation
Location data may require a warrant or consent to be admissable
Why might suspects deliberately engage in overt communication during counter surveillance efforts
To overwhelm investigators with irrelevant information
In a fraud investigation which tool is most effective for tracking illicit transaction across multiple jurisdictions
Data analytics
What is the primary effect of opiates on the human body that makes them a focus of narcotics investigations
They function as depressants, often leading to abuse and overdose
When analyzing digital evidence, how might a suspect use steganography to evade detection
By embedding hidden messages within seemingly benign images or files
Which of the following is not a common method for ensuring the integrity of physical evidence
Immediate analysis
In a sting operation, which of the following techniques is most likely to result in the successful prosecution of a suspect
Allowing the suspect to initiate all illegal activities
Which of the following is not an element of criminal liability
Intention
What is the primary benefit of using network analysis in fraud investigations
Mapping relationships between suspects
During an interrogation, which of the following techniques is associated with the Reid technique
Offering alternative explanations for the suspects actions
What is the primary objective of a forensic interview with a child witness
To gather accurate and reliable information
In a cognitive interview what is the purpose of a using varied recall techniques
To trigger different aspects of memory
In complex investigations, what is the most significant risk of using multiple cooperating witnesses
Witnesses may contradict each other, weakening the credibility of the case
Which of the following is not a very digital evidence authenticity
Encryption
In an internal investigation, which of the following factors is most likely to invalidate the findings
Conflict of interest by the investigator
Which of the following best describes corroboration in investigations
Verifying information through multiple sources
Which of the following would be the most effective technique to use during a sensitive interview with a traumatized witness
The cognitive interview technique
Which of the following is a not a typical method of surveillance
Direct confrontation
Which type of evidence is typically most reliable in a corporate investigation involving employee misconduct
Documentary evidence
Which interrogation technique is most likely to produce false confessions from vulnerable individuals
REID technique
In which type of operation is it critical to ensure that the suspect initiated all illegal actions to avoid claims of entrapment
Sting Operation
What is the main disadvantage of using narco analysis as part of a legal investigation
It may result in unreliable of fabricated information
It is legally inadmissible in most courts
Some facts about drug users that may assist in recognizing problem areas during a drug investigation are set forth as follow. Indicate the one that is erroneous
Chronic abuse of drugs is generally not considered a symptom of mental or emotional illness
Which of the following best descries a major challenge of conducting interviews with children using the cognitive interview technique
Heightened risk of false memories
In the context of evidence collection what does contamination refer to
The introduction of foreign materials or tampering with evidence
Which of the following is not a standard procedure for handling digital evidence
Analyzing the evidence on the original device
In an interview based on the PEACE model, which phase is dedicated to summarizing and reflecting on the information gathered
Engage
Plan
Evaluate
When conducting a financial investigation, why is it essential to understand the placement stage of money laundering
To detect when illegal funds are first introduced into a financial system
Which of the following methods is most appropriate for protecting the integrity of digital evidence during the collection process
Creating a forensic copy, using write blocking technology
Which of the following it the best way to manage investigation risks
Conducting a risk assessment
Implementing mitigation strategies
Monitoring investigation progress
Which of the following is a potential drawback of undercover investigations
Legal entrapment claims
How can a suspect use digital dead drops to evade detection in an investigation
By posting seemingly harmless files in public forums for later retrieval
Which of the following is not a typical method for verifying the authenticity of a digital signature
Encrypting the signed document
Which of the following is not a common method for analyzing financial statements in fraud investigations
Probability analysis
When analyzing digital evidence which tool is often used to extract information from encrypted devices
EnCase
In an internal investigation, which of the following actions could be considered an ethical violations by the investigator
Sharing confidential information with unauthorized individuals
Failing to disclose conflicts to interest
Leading the witness to a particular conclusion
Which of the following is an example of physical evidence
A security camera recording
Why is it important to secure any wireless networks in proximity to a target during a surveillance operation
To prevent the suspect from intercepting surveillance communications
What is the most effective countermeasure to avoid being tracked via digital surveillance tools
Avoiding interaction with digital networks entirely
In complex investigations, what is the most significant risk of using multiple cooperating witnesses
Witnesses may contradict each other, weakening the credibility of the case
What is the primary purpose of root cause analysis in an investigation
Preventing future incidents
Which of the following is not a common technique for collecting digital evidence
Conducting physical surveillance
In the surveillance operation, what is the primary risk of relying exclusively on one surveillance technique
It limits the ability to collect evidence from diverse perspectives
In digital forensics what is the primary purpose of a hash function
To generate a unique identifier for data integrity verification
Which type of interview technique is most effective in eliciting accurate memories from a witness with cognitive
The cognitive Interview Technique
The PEACE model
In the context of investigations, what does the term chain of custody refer to
The documentation of evidence handling
How might deep packet inspect (DPI) technology be used during a cyber investigation
To analyze the content of data packets transmitted across a network
During a financial investigation, how might shell corporations be used to obscure illicit activity
They are used to funnel money through layers of legitimate business transactions
Which of the following is not a method for validating the integrity of digital evidence
Chain custody of documentation
How does the Gramm Leach Bliley Act (GLBA) affect the handling of financial information in investigations
It mandates financial institutions to protect consumer information, limiting access without consent
Which of the following is not a type of forensic analysis used in investigations
Behavioral analysis
What is the primary role of an interviewer in the PEACE model
To facilitate the open and honest dialogue
Which of the following best describes the concept of a cold hire in undercover investigations
A suspect is hired without knowing they are under investigation
In drug investigations, what is a primary challenge when identifying hallucinogenic mushrooms (psilocybin)
They metabolize quickly and may not show up in standard drug tests
Which of the following best describes the principle of corroboration in investigations
Using multiple sources to verify information
What is the main challenge of using social engineering techniques in security investigations
Legal implications
Which investigative method is most likely to prevent bias
Using multiple sources of evidence
Blind interviewing techniques
Which is one potential limitation of mobile surveillance apps in investigations
They might drain the battery, alerting the suspect to the surveillance
What is the main disadvantage of relying solely on physical evidence
Susceptibility to environmental conditions
Which of the following is the most effective method for protecting digital evidence from tampering during transport
Sealing it in a tamper evident bag
Which of the following legal risks is associated with sting operations
The suspect might could claim entrapment in court
What is the primary function of an investigative audit
Verifying the accuracy of financial records
What is the main purpose of conducting a control hire in an undercover operation
To test the reliability of informants
Which of the following is not a fraud triangle component
Detection
What is the primary purpose of using root cause analysis in a workplace incident investigation
Understand the systematic reasons for the incident
Evidence of truthfulness relates to what specific words
Reference to rape, kill, steal
The greatest problem in investigation is
Objectivity
In a simple case what report may be the final and opening report
Initial report
What test determines a job candidates numerical perception
Aptitude test
An enquiry into the history and behaviour of an individual under consideration for access to sensitive assets is
Background screening
What enquiry can help recruit the right person to do a job
Pre-employment screening
What testing is recommended for applicant whose responsibility will be the haulage to distant trips in a company
Integrity test
What interviewee will give a specific denial
Deceptive interviewee
What type of questioning is recommended at the primary phase of an interview
Narrative types
Initiating a general discussion before direct questioning in order to accomplish rapport is achieved through
Hidden persuaders
What critical consensus must be made when operating a JTF from the onset
Defining critical information
What is best defined as inducing a person to commit a crime
Entrapment
What is the most misunderstood form of Investigation
Undercover
During an interview, what should generally be the distance between subject and the investigator
5 feet
The key difference between an interview and an interrogation is
The person being interviewed
All gaps in employment history, if more than what period should be investigated
30 days
Why are pre-employment and background screening conducted
Prevent looses and mitigate damages
What are the principle tool of obtaining information during an investigation
Interviews/Interrogation
How does thoroughness affect an investigation
Drawing a balance between an effort to follow every possible lead to its logical conclusion and gathering so much information
What are the three ‘‘I’’s that are referred to as the tools of the investigator
Information,
Interrogation,
Instrumentation
The…………………….. report can be a supplement to a progress report but it must be able to stand separately from the progress report
Special report
What is entailed in the theft triangle
Desire, rationalization opportunity
How does a security manager ensures he gets support in establishing the proprietary investigative unit
Show value to the organization and demonstration that the unit pays for itself
What makes a woman to continue to stay in an abusive relationship
Economic assistance
If a suspect made a sweeping statement during an interview what is he insinuating
Truthfulness
What is the usefulness of an investigation report in relation to corporate future planning
Points to systematic features the represent significant causal factors
Assist in taking informed decision to correct conditions that allowed the incident to occur in the first place
Creates synergy as results are used to resolve issues at hand
How can an investigator maintain good liaison relationship
Make sure each party derives some benefits without taking advantages of each other
Follow legal limits and agency regulations on maximum value of liaison gifts
Maintain contact regularly even when there is no specific information to exchange
Never violate the trust of a liaison contact
If during a theft investigation an issue of fraud was discovered what is the recommended action of the investigator
Focus on the initial objective of the theft investigation
In an applicant’s screening which process should be done last
Back grounding
A useful tool to determine whether to maintain or outsource the investigative unit is
Cost benefit analysis
The main source of data gathering in conducting a pre-hire investigation is
Application form
The theft triangle concept is
An explanation of why people steal
In retail investigation a negative variance between the book count and actual count of various items in inventory
Shrinkage
What is the cornerstone of any investigative decision
Evidence
A report written in the case of an investigation that gives an investigator update and the detail lead is
Progress report
What is the biggest challenge in investigating compliance issues in any organization
Getting employees to come forward and report wrong doing at all levels of investigation
In what way should background investigation be carried out
Covertly
The science of acquiring, preserving, retrieving and presenting data that have been processed electronically and stored is
Computer forensic
When should an investigator be taking notes during an interview
When it will have minimal distraction on the interview process
List the verbal behaviour of a truthful person
Makes general denial
Makes sweeping denials
Offers unqualified answers
The surreptitious placement of a property trained and skilled investigate in a workplace is
Undercover investigation
What is the situation where abductees develop interest in his or her kidnapper called
Stockholm syndrome
A suspect who uses very definitive statement is a sign of what
Truthfulness
What is the most critical attribute of an investigator
Communication skills
The first step the investigator should take before the interview is
Learn the case information thoroughly
In the U.S what legislation governs the process of background screening
F C R A
What is the major factor in the decision to outsource or maintain an internal investigative capability is
Cost
List the best approach to base investigation budget due to its difficulty to accurate prediction is
Basing budget estimates on historical data
Quantitative estimates of risk reduction
Support of organizational goals
Restitution figures in an investigative unit can help in demonstrating
Units return-on-investment
Providing guidance regarding possible violation of regulatory requirements is the primary goal of
Compliance investigation
What is the objective of an interview
To obtain valuable fact
To obtain a confession
To identify the guilty
To eliminate the innocent
In the most basic sense what is the purpose of an interview
Aid an investigation into the truth
The main purpose of an investigation is
Determine the truth in a matter under question
Which is considered the most priced talent an investigator can have
Ability to obtain information from individuals through question
This simple yet sophisticated format still presents information in chorological orders, but includes more details. It is note-worthy for its simplicity and reliability as its conversational in tone’’ what is been described
Structured narrative
What report documents events observed by the operative other than the normal happening in the course of the investigation
Special report
What are the basic steps in report writing
Gather the facts
Record the facts
Organise the facts
Write the report
A particularly important but often neglected type of investigation in the corporate arena is
Due diligence
The key to a successful interview is
Enlisting the cooperation of the interviewee
The most important factor of a successful interview
The ability of the interviewer to establish a favourable rapport with the interviewee
Adjusting questions during the interview accordingly by continuously re-evaluating a hypothesis as information is obtained is called
Floating point strategy
Which informant is most likely to provide false or biased information
Anonymous informant
List the most important resources required for background and pre-employment screening
Asset protection department
Human resource department
Outside consumer reporting and investigative agency
This is used to exclude suspects from an investigative pool of subjects so as to conserve investigative resources. this is called
Profiling
A key but often overlooked step by the investigator in the protection of the investigation information is
Realistically determining what information at what phase of the investigation is sensitive and therefore warrants protection
The best way to reduce internal theft in an organization is
Hire employees with integrity
List the verbal behaviour of a deceptive person
Offers very specific denials
Avoids realistic words
Qualifies answers
Any activity, capability or resource that enhances the effectiveness or efficiency of the investigative function is called
Force multiplier
What in future will significantly affect the background investigation and pre-employment screening
Privacy legislations
What report details any leads that remains to be followed in an investigation
Progress report
In the U.S what percentage of illicit drug users are employed
74.9%
List red flags in the early job application review
Unsigned form
Gaps in employment
Changes of occupation
In an investigative interview, who should be interviewed last
The offender or offending group
Before conducting an interview what is required of the investigator
Become familiar with all available historical information
A book keeper who works excessive hours and seldom takes a vacation may be engaged in what
Dishonesty
The most available and valuable source of information in an investigation is
Persons involved in the matter
An interview conducted with an employee who has defrauded the company of a large sum of money is
Interrogation
Why are interviews of interviews of victim, witness, and informant considered the most critical aspect of an investigation
They are the primary source of information
An effect on the interviewee influencing behaviour is referred to as
Pygmalion effect
A technique generally used to elicit an affirmative response and facilitate the cooperation of the interviewee is known as
Yes conditioning
The most cost-effective way of corroborating evidence is
Videotape
A report given at the beginning that every major points covered by the report requires at least one sentence and permits a quick assessment by the reader is
Synopsis
For ease of understanding the narrative portion of an undercover operative report should be written in
First person
What serves as the basis for post-investigation administration action
Written report
What are important force multipliers in investigation
Online-information sources
Liaison
Intelligence information
The best prevention of exposure to workplace violence is
Pre-employment background investigation
What is the principal characteristics of internal theft in a corporate arena
Conversion,
Diversion,
Disguise,
Divergence
What represents a key element of almost any investigation is
Records and database checks
The success of an investigator is sometimes measured by
Ability to interview/Interrogate people
ABC technique in investigation is adopted in which type of investigation
Foot surveillance
What category of investigation is a misconduct investigation
Constructive
A key element of any compliance program within an organization is
An Effective reporting mechanism
An important aspect of investigative management which often receives less attention than is warranted particularly in the corporate sector is
Protecting case-specific investigative information
Activities in the investigative functions that are often among the first items to become neglected especially when caseloads increase and time pressure is experienced is
Formal documentation
Most credible information on losses, sexual harassment and other problems comes from
Employee tips
In the U.S which law requires publicly traded companies to have as an integral part of the organization an effective compliance and ethics program
Sarbane-oxley Act of 2002
Most investigation units focus on a particular function or sets of functions these functions are generally referred to as
Types of investigation
The lifeblood of the investigative mission in any corporate sector is
Information
What is crediting one account with the money from another account
Lapping
The appropriation of property by a person to whom it has been entrusted is referred to as
Embezzlement
List where an undercover operative can be positioned
Uniform security
Customer service
Shipping and receiving
List the advantages of maintaining an internal investigative capability
Company exercise complete control of the investigative process
Better ability to protect sensitive
Much greater familiarity with the organization’s mission
The primary purpose of a private sector security investigator is
Protect the interest of the employing enterprise
This investigation should be the exception and not the rule and the technique should only be contemplated when no other options are available, which type of investigation is being referred to
Undercover investigation
Which is among the least accurate forms of investigative information
Eye witness account
A collection of photography’s taken of criminals and incorporated into a criminal database for future criminal identification by victims is called
Mug photo
An investigator who is corroborating important aspects of an investigation through different sources is trying to achieve what
Thoroughness
A credit card receipt is which type of physical evidence
Tracing
Tool mark is which type of evidence
Associative
A voucher a witness observed being forged by a book keeper is an example of which evidence
Real evidence
Fingerprints, bite mark or blood found at the scene are which type of evidence
Identifying
What type of evidence is finger print?
Impression evidence
What establishes the chain of custody of an evidence
The proper marking of evidence at the time of seizure and transfer
List the correct sequence of evidence collection?
Search
Photographing,
Recovery,
Marking,
Packaging
In collection of evidence most errors occur during
Collection of physical evidence
What supplements photography
Sketch
Whose responsibility is it to record the method of shipment and tracking numbers on the chain-of-custody form?
Security staff
Photographing the condition of evidence is done before
Recovery
A highly informed inference about an incident is an example by
Circumstantial evidence
That which provides proof or an indication of an assertion is an example of
Evidence
Information usually in the form of letters, figures and other marks are examples of POA
Documentary evidence
The best search options are usually
The most difficult
This is neither an asset nor liability of an organization but ownership stake. What is so being described
Corporate good will
