Investigations Flashcards
What are the three main tools of an investigator?
INFORMATION;
INTERROGATION; AND
INSTRUMENTATION
WHAT IS THE TRIAD OF MISSION?
VERIFY THE ACCURACY OF FACTS;
REGULATE AND CONTROL THE CASE WORK;
ASSURE ALL COURT JUDGEMENTS ARE FAIR
WHAT IS DIRECT EVIDENCE?
REAL AND MATERIAL
FIRST HAND KNOWLEDGE
Testimony from someone who experienced an event personally.
WHAT IS INDIRECT EVIDENCE?
HIGHLY INFORMED INFERENCE;
CIRCUMSTANTIAL AND HEARSAY
WHAT ARE THE THREE MOST COMMON RESOURCES FOR PRE-EMPLOYMENT SCREENING?
SECURITY OR ASSETS PROTECTION DEPARTMENT;
HR DEPARTMENT; AND
OUTSIDE CONSUMER REPORTING AND INVESTIGATIVE AGENCY
WHAT ARE THE 5 PHASES OF A WORKPLACE UC INVESTIGATION?
PREPARATION AND PLANNING;
INFORMATION GATHERING;
VERIFICATION & ANALYSIS;
DISCIPLINARY & CORRECTIVE ACTION; AND
PREVENTION AND EDUCATION
WHAT ARE SCATTER GRAPHS?
THEY IDENTIFY WEAKNESSES IN MANUAL OR COMPUTERIZED SYSTEMS.
WHAT IS A LINK ANALYSIS?
GRAPHICALLY AND LOGICALLY PORTRAYS INTERCONNECTIONS AMONG PEOPLE, PLACE AND ACTIVITIES TO REVEAL PATTERNS OR OTHER USEFUL INFORMATION OF INVESTIGATIVE VALUE.
CORPORATE RESOURCE ABUSE AND EMPLOYEE THEFT?
DIVERSION, CONVERSION,
DISGUISE AND
DIVERGENCE
A TYPICAL CRIMINAL INTELLIGENCE CYCLE HAS 5 STEPS?
REQUIREMENTS;
COLLECTION;
INTEGRATION AND ANALYSIS;
DISSEMINATION; AND
EVALUATION
STEP 3 OF THE CRIMINAL INTELLIGENCE CYCLE - INTEGRATION AND ANALYSIS - IS THE HEART OF THE PROCESS, WHERE …….
INFORMATION AND DATA ARE CONVERTED TO ACTIONABLE INTELLIGENCE.
INVESTIGATOR TOOLS AND TECHNIQUES INCLUDE?
INTERVIEWING;
RECORDS AND DATABASE CHECKS;
EVIDENCE COLLECTION & HANDLING;
SURVEILLANCE; AND COMPUTER FORENSICS
A CLEARLY DEFINED INVESTIGATIVE SCOPE INCLUDES?
WHAT IS IN AND WHAT IS OUT OF THE INVESTIGATION, INCLUDING THESE FIVE PARAMETERS: ORGANIZATIONAL; PHYSICAL; OPERATIONAL; LOGICAL AND LOGISTICAL
ISSUES AT THE CASE LEVEL OF INVESTIGATIVE MANAGEMENT?
-INDIVIDUAL INVESTIGATIONS AND THEIR INVESTIGATORS;
-INVESTIGATIVE TECHNIQUES;
-CASE MANAGEMENT PROTOCOLS
THE REID TECHNIQUE HAS 5 TYPES OF BEHAVIOR-PROVOKING QUESTIONS?
-PURPOSE;
-YOU;
KNOWLEDGE;
SUSPICION; AND
VOUCH
EXAMPLES OF LIAISONS?
-INTERNAL AND EXTERNAL;
-FORMAL AND INFORMAL; AND
-INDIVIDUAL AND ORGANIZATIONAL
WHAT ARE SUBJECT FACTORS IN AN INTERVIEW?
-INTOXICATION;
-PHYSICAL AND PSYCHOLOGICAL CONDITION;
-PREJUDICE;
-PERCEPTION; AND
-AGE
DOCUMENT CONTROL PROCEDURES PROTECT THE S….THE C…..AND THE I OF RECORDS?
-SENSITIVITY;
-CONFIDENTIALITY; AND
-INTEGRITY OF RECORDS
PUBLIC INVESTIGATIONS VS. PRIVATE INVESTIGATIONS DIFFER IN THESE WAYS:
-POWER OF ARREST;
-SEARCH AND SEIZURE;
-TESTIMONY;
-PROSECUTION;
-DUE PROCESS; AND
-CONSEQUENCES.
ALSO, PRIVATE/CORPORATE INVESTIGATIONS TEND TO BE BROADER AND THE DESIRED OUTCOME DICTATES THE REQUIRED BURDEN OF PROOF
THE INVESTIGATIVE TEAM LEADER BASES THE INVESTIGATION PLAN ON WHAT?
THE OBJECTIONS, SCOPE AND CRITERIA OF THE INVESTIGATIVE PROGRAM AND THE DOCUMENTATION AND INFORMATION PROVIDED BY THE CLIENT.
A new investigative unit needs what four things?
A Functional charter; a policy statement; a set of objectives and resources (human, physical, other).
What is a Functional Charter for an investigative unit?
It’s one page from the CEO;
- provides credibility, authority, purpose and direction;
- strategic goals & primary emphasis;
- the unit’s relationship to the organization.
What is an investigative unit Policy Statement?
- It outlines procedures & reporting channels;
- It provides coordination mechanisms and disposition;
- It advises other units how to access the investigative unit.
What is an investigative unit’s set of objectives?
- Performance metrics and improvement targets;
- revised often, at least annuallly
Res Gestae
“Things done.”
- Words or phrases that form part of or explain a physical act;
- exclamations that are so spontaneous they belie concoction;
- statements that are evidence of someone’s state of mind.
What are the two types of criminal intelligence analysis according to Interpol?
Operational or tactical - a specific investigation that aims to achieve a specific outcome;
- strategic analysis - overall crime threat or trend, for higher level people and benefits are seen over the long-term.
An investigator’s code of ethics should include:……?
- treat people with respect and dignity;
- conduct business w/objectivity, honesty and integrity;
- conflicts of interest & impartiality risks are divulged
- the focus is on the scope of the investigation; and
- the confidentiality & integrity of information is respected.
5 threats to investigator impartiality are….?
- Self interest
- self review
- familiarity
- cognitive bias; and
-intimidation
Due diligence in market entry focuses on….?
1) protection of intellectual property and information assets;
2) ensuring compliance with laws, regulations & policies in local jurisdictions.
Preemployment screening programs vary based on….?
1) Access to information;
2) Nature of the position; and
3) industry regulations.
What is the WZ non-confrontational interview technique?
A structured, conversational approach that results in fewer denials and objections and eliminates conflict in the interview.
What are pertinent issues at the operational level of case management?
1) Case load;
2) case assessment;
3) quality control;
4) Investigative policies and procedures;
5) reporting formats;
6) Liaison;
7) team composition;
8) supplies and equipment;
9) evidence management; and
10) outside contracts
What are the 5 types of physical evidence?
Associative;
Identifying;
Tracing;
Trace; and
Impression
What is the PEACE interview technique?
Preparation and planning;
Engage and Explain;
Account;
Closure; and
Evaluate
The technique puts the focus on fairness, openness, accountability and fact finding to reduce the number of false confessions
What occurs in phase 3 (verification and analysis) of a UC operation?
- Employee’s are interviewed; and
- Information is compiled
Support for an IU budget can be demonstrated by:
1) The focus supports the organizational mission and its business and strategic goals;
2) there is accurate tracking of costs;
3) there is effective implementation of cost management and efficiency measures;
4) there are demonstrated restitution and recovery benefits; and
5) there is an estimation of risk avoidance in monetary terms.
What actions are document control procedures designed to control?
- (ISP RRD)
- Identify, storage Protection
-Retrieval, retention and disposal
In a Union environment, an employer investigator can not require confidentiality from employees who are being interviewed except when:
1) Witnesses are in need of protection;
2) Evidence is in danger of being destroyed;
3) Testimony is in danger of being fabricated; and
4) When there is a need to prevent a cover up.
Pre-employment screening programs have a common foundation in 3 ways?
1) data collection;
2) background investigation and screening; and
3) data analysis & hiring decisions.
Hearsay
- Indirect evidence
- not admissible in court except for dying declaration;
- an exception to the hearsay rule is when a person making the statement about what another person said makes statements against self interest.
What are 10K, 10Q quarterly reports?
It provides information on a company, on business activities, finances, legal activities and company management.
Exploratory investigations include?
1) Personnel background;
2) Level of trust determination;
3) Due diligence; and
4) Root cause analysis.
OSINT (open source intelligence) happens in the following ways:
1) gathered online, in person, in print; and
2) through direct observation and surveillance.
An investigative unit’s objectives should be:
1) specific and measurable;
2) documented and updated at least annually;
3) financial management;
4) case resolution;
5) unit performance;
6) Information flow; and
7) the numbers of inquiries, complaints and leads handled
What is ethical behavior by an investigator?
1) Protect the rights of those under investigation;
2) Obey the law;
3) Respect organizational policies and procedures; and
4) Protect the integrity of the process.
What should be considered when planning the investigative process?
1) The risks associated with the industry and organizational processes;
2) The internal and external operating environment;
3) The internal and external stakeholders who add to the risks;
4) The internal and external stakeholders who are impacted by the investigation;
5) Factors around the acceptance of risk in the organization and by stakeholders.
What factors should the post-investigation meeting address?
1) findings and conclusions;
2) the method of reporting;
3) the handling of findings and possible consequences;
4) Implications for improved management of risk;
5) Post investigation activities including recommendations for risk treatments and corrective actions.
What are common tasks undertaken to start an investigation?
1) Set objectives;
2) ID stakeholders;
3) ID internal context, variables and assumptions;
4) Define scope and a statement of work;
5) Policy and management commitment;
6) Commitment of resources
What records and documents should be created, maintained, and stored for the investigations program?
1) Program objectives, criteria and scope;
2) Risk assessment and treatment measures;
3) Evaluation of achievement of objectives; and
4) Investigation program effectiveness and opportunities for improvement.
What typically happens in the follow-up phase of an investigation?
1) Determine - disciplinary, administrative or judicial action;
2) Implement - corrective measures to practices or policies; and
3) File retention - for data analysis
What 2 assets are involved in the 2nd phase - information gathering - of a UC investigation?
1) People in the project management team; and
2) Processes - how information will be communicated, reported and preserved in case files.
What occurs in the 1st phase - preparation and planning - of a UC investigation?
1) Form a team;
2) set objectives;
3) select an agency and an operative; and
4) Plan the remaining phases.
Associative evidence
Links a subject with the scene of a crime - fingerprints and DNA
Identifying evidence?
Is a form of associative evidence that establishes the identity of a suspect.
- fingerprints
-bite impressions and
-blood
Tracing Evidence?
Assists in the possible identification and location of a suspect;
- credit card receipt;
-tag on a piece of clothing
The tasks that should happen at a pre-investigation meeting, include….?
- Confirm the plan;
- introduce the team;
- confirm communication channels;
- verify clearances and approvals;
- verify feasibility; and
- Let the client ask questions.
Operational Security vs. OPSEC
Operational security - the totality of all security and planning measures taken for a particular operation and the safety of involved investigators.
OPSEC - simple and systematic method of employing safeguards to protect critical information.
What investigative method = the collection and examination of information from both public and private sources?
Information review.
The S…..S and N of the investigation determines the C…..?
Size, scope and nature determines the cost.
O = E = F witness
An opinion witness = an expert witness = a forensic witness.
The EPS’s RCRA?
The resource conservation and recovery act, known as the cradle to grave act, tracks chemicals from manufacturing to disposal and was enacted in 1976.
What is an interview?
A non-accusatory conversation. It generally starts with closed questions and then proceeds to more open questions to allow a narrative answer.
Misconduct investigations are a subcategory of ?
Incident investigations
Private sector investigations are measured in……?
Restitution;
Recovery;
Risk reduction; and
Mitigation of litigation
What are the three categories of surveillance?
-Physical - human observation/tracking;
-Psychological - behavioral analysis; and
-Data - technical or electronic
What is needed to make physical surveillance effective?
1) A clear purpose and goals;
2) No interference with what is being observed;
3) Records and documents; and
4) Support the objective of the investigation.
A person is a suspect based on what 5 reasons?
1) evidence;
2) proximity;
3) motive;
4) access to restricted areas; and
5) witness statements
What are the three types of false signatures?
1) Tracing;
2) Simulated; and
3) Freehand
What happens if DNA is not properly handled?
1) origins are in question;
2) there is potential to lose biological activity;
3) there is potential for contamination; and
4) decomposition and deterioration
Two methods of lifting two-dimensional impressions?
Electrostatic lifts and gelatin; and
adhesive lifts
The assessment phase of an individual investigation includes the E & E of the facts regarding a problem or allegation?
The examination and evaluation of the facts to say yes or no to an investigation.
What are the goals of administrative controls in an investigative unit?
Make sure:
1) all investigations are authorized;
2) all work assigned to each investigator is known; and
3) what remains to be done on each investigation
A background check of a new hire mitigates risks of claims of…?
1) negligent hiring;
2) discrimination; and
3) costly hiring mistakes
The team developing a pre-employment screening process should include….?
1) Upper management to sanction and support;
2) Security and HR to develop and implement; and
3) Legal to review and endorse.
An incident investigation protocol should include a…..?
Decision logic matrix to make clear:
1) who has responsibility for the inquiry;
2) who needs to know; and
3) whether immediate referral to law enforcement or the legal department should occur.
Key considerations for international investigations are….?
Laws,
Liaison,
Culture and
approaches
Who should be part of the UC investigation management team?
1) the UC investigator;
2) the project manager;
3) the client representative;
4) a corporate attorney; and
5) possibly law enforcement
3 benefits of online information sources?
1) amount of available information;
2) ease of access; and
3) low cost
What is an accurate truism about employee dishonesty?
Employees involved in theft have usually been involved in other prior misconduct at the company.
These are based on the investigative goals but are more specific and may be more short lived. They are generally measurable and can be use to gauge the progress, success, or achievement of an investigative unit. What are they?
Objectives.
A metric which measures how an organization or individual is performing against defined goals and objectives are called a…..?
Key Performance Indicator
What is spoliation of evidence?
Evidence that is intentionally or negligently destroyed.
What are the three theoretical identification views of the video system?
Subject, scene and action.
Observing the behavior of another, usually secretly is?
Surveillance
True or false, an investigator must cease an investigation if it diminishes workforce productivity?
False
Trace evidence
Usually goes to a crime lab. Consists of fibers, paints, dyes and glass.
The purpose and objectives of an investigation drive the A & M
Approach and methodology
What is needed to maintain a liaison relationship?
- Professional Trust;
- Periodic Exchange; and
- Mutual benefit
Goals vs. objectives vs. metrics
GOALS - Long-term and over-arching end states;
OBJECTIVES - based on goals, but more specific and may be more immediate. Tend to be tactical and specific to the short term expectations of the project.
METRICS - Specific measurable goals.
An OIP is?
An organizational investigations policy …..a way for organizations to proactively prepare for events that may require investigation.
The IUM is and his responsibilities are?
The investigative unit manager
- planning
- management
- conduct of the investigative program
- professional and ethical behavior of investigative team members
The ITL is and his responsibilities are?
The investigative team leader.
- the conduct of individual investigations
- professional and ethical behavior of investigative team members
The initiative event in a private sector incident investigation is generally ?
A security force incident report.
Misconduct investigations are a subcategory of ?
Incident investigations
Misconduct investigations can leave employers open to legal action from employees who generally sue for these five reasons?
- discrimination
- wrongful termination
- sexual harassment,
- defamation, and
-false arrest
Compliance investigations share many characteristics with?
Incident and misconduct investigations…..and can actually be put into either of those categories.
Types of evidence include?
- Testimonial
- Documentary and
- Physical
Testimonial evidence is?
Derived from interviews
Documentary evidence is?
Derived from documents and other writings - hard copy or electronic
Physical evidence is?
Derived from physical objects….computers, phones, tools, vehicles etc.
The information and evidence collected drive the?
Findings and conclusions. Evidence is the foundations from which the investigation moves forward.
Forensic evidence ?
Information obtained by scientific methods.
Hearsay evidence?
Information provided by a person who does not have direct knowledge of the fact asserted but knows it only from being told by someone else or from a secondary source.
Electronic evidence is latent evidence, explain?
Just as fingerprints or DNA evidence are latent….equipment and software are required to make the evidence visible.
Visual assessment is?
Refers to having visual information of an identifying or descriptive nature during an incident.
Visual documentation is?
Refers to having visual information stored in a format that allows for the study or review of images in a sequential fashion…..and embedded authenticity points like time/date stamp.
The three theoretical identification views of a video surveillance system are?
- Subject identification
- Actions identification, and
- Scene identification
The six crimes most relevant to asset protection include?
- unauthorized entry or presence;
- theft;
- force or threats of force against people’
- property damage or threats of property damage;
- computer-related crimes; and
- environmental crimes
Theft is?
The dishonest appropriation of property belonging to another with the intention of permanently depriving the owner of rightful possession or use of it.
Fraud is?
Intentional deception perpetrated for the purpose of unlawfully taking another’s property or, more simply, theft by deception.
