Collection and Preservation of Evidence

Last Updated: January 2025

  1. General Evidentiary Considerations.

    1. Accountability for Electronic and Physical Evidence. EBSA investigations require the collection and preservation of evidence including plan records, company and union records, bank records, reports of interview (RIs), signed statements, and related work papers.

      To assure that the value of electronic and physical evidence is not impaired or destroyed, the Investigator/Auditor must ensure that the evidence meets the test of admissibility. To pass this test, the evidence must be authentic, relevant, unaltered, and untampered with. In short, the Investigator/Auditor must be able to testify, under oath, that the particular document is the one obtained from a reliable source in the investigation; that it has since been in the Investigator/Auditor's personal or accountable custody; and has not been altered.

    2. Federal Rules of Evidence. All Investigators/Auditors should be generally familiar with the Federal Rules of Evidence, which appear in Public Law 93-595. Special attention should be devoted to Article VIII, “Hearsay,” Article IX, “Authentication and Identification,” and Article X, “Contents of Writings, Records and Photographs.” Investigators/Auditors should address questions concerning evidentiary matters to the Office of the Solicitor (SOL).

    3. Admissibility of Duplicates. Rule 1003 of the Federal Rules of Evidence provides:

      A duplicate is admissible to the same extent as an original unless: (1) a genuine question is raised as to the authenticity of the original or (2) in the circumstances it would be unfair to admit the duplicate in lieu of the original.

      Based on this rule, in most situations, a copy of a document is sufficient if the Investigator/Auditor can testify that the origin of the document is a reliable source, that the document has remained unaltered while in their possession, and that the duplicate is an accurate copy of the original.

    4. Receipts for Original Books, Records, and Documents Obtained. When it is necessary to take possession of originals of documentary evidence or property, the Investigator/Auditor must give the organization or individual a signed, itemized, and correctly dated Document Receipt, EBSA Form 220A for the material. Such documentary evidence or property includes books, records, canceled checks, bank statements, receipt books, invoices, vouchers, letters, memoranda, or other materials either provided pursuant to a subpoena or furnished voluntarily by an organization or individual (even if only to photocopy and immediately return).

      The Investigator/Auditor will retain a copy of the Document Receipt signed by the individual who provided the materials in the case file.

    5. Return of Original Books, Records, and Documents Obtained. When returning original documents, the Investigator/Auditor will ask for the original Document Receipt, Form 220A. In addition, the Investigator/Auditor will have the party receiving the documents acknowledge in writing on the Return of Documents, EBSA Form 220B that they received the items described on the form.

      The Investigator/Auditor will retain a copy of the Return of Documents signed by the individual who received the materials in the case file.

    6. Custody of Evidence. Investigators/Auditors must maintain a clear chain of custody of documentary evidence. All original materials and duplicates, as described in (c) above, must be preserved in their original state in the case file.

      See EM section on Subpoenas, paragraph 13, for guidance related to subpoenaed documents.

      Under the following circumstances, documents received during an investigation require additional safekeeping.

      1. Documents Obtained from the IRS. Tax returns and return information received from the IRS pursuant to IRC section 6103 must be maintained in a secured manner. See EM section on Release of Information, paragraph 7, for a discussion of how to handle tax returns and return information obtained from the IRS. See EM section on Relationship with IRS, paragraph 31.d, and EBSA Notice 19-005 Security of Federal Tax Information.
      2. Documents Covered by the Right to Financial Privacy Act. The Right to Financial Privacy Act, 12 U.S.C. §3401 et seq. (RFPA), preserves the confidentiality of financial records while allowing access for legitimate law enforcement activities. Because there are certain prohibitions against giving the documents to others, including other government agencies, documents obtained pursuant to the RFPA should be segregated from other documents produced during the investigation. See EM section on Subpoenas, paragraph 14, for guidance on obtaining documents pursuant to the RFPA.
      3. Documents Covered as Protected Health Information (PHI). The HIPAA Privacy Rule, 42 C.F.R. part 2, and associated regulations preserve the confidentiality of health records that contain PHI while allowing access for legitimate law enforcement activities. Because there are certain requirements about how we request, maintain, retain, and destroy these records, documents obtained with PHI should be segregated from other documents produced during the investigation and labeled as containing PHI and/or Substance Use Disorder Records Subject to 42 C.F.R. part 2. Additionally, PHI involving reproductive health information is requested and handled in accordance with HIPAA Privacy Rule 45 CFR Parts 160 and 164. See EM section on Subpoenas, paragraph 15, for guidance on obtaining documents that contain PHI.
      4. Documents and Information Obtained from the Grand Jury or During a Criminal Investigation. Investigators/Auditors must exercise caution when handling parallel civil/criminal investigations. Documents related to a Grand Jury investigation should remain in a secure place and not be disclosed to anyone who is not entitled to access to the evidence under Rule 6(e) of the Federal Rules of Criminal Procedure (the 6(e) order). See EM sections on Release of Information, paragraph 8.b.; Subpoenas, paragraph 17; and Criminal Investigations Program.
      5. Materials under an FOIA Exemption Claim for Commercial Confidential Information. The Investigator/Auditor should identify materials provided with a submitter's request for FOIA Exemption 4 protection. The case file must keep such materials in a manner to maintain their identity. In addition, the case file should be clearly marked that there is an Exemption 4 claim. See EM section on Release of Information, paragraph 4.
      6. Confidential Complaints. Special procedures are necessary when a Regional Office (RO) receives a confidential complaint. See EM section on Complaints, paragraph 4.
      7. Working Documents. During the course of the investigation, the Investigator/Auditor may keep a set of “working documents,” that is, a duplicate set of documents that can be written on and rearranged in any order. Investigators/Auditors should clearly identify these documents as working copies. Investigators/Auditors should destroy these working documents when the investigation is completed and the Report of Investigation (ROI) written, unless there is a compelling reason, such as a legal requirement, to keep them.
    7. Transmission of Evidence. All documents and other material that are or may become evidence will transmit between offices in a secure manner, which will maintain a clear chain of custody. The transmittal memorandum will identify in detail the documents or other material so transmitted. Physical evidence (e.g., paper evidence, removable media, CD/DVD, USB drives) must be logged and tracked in accordance with EBSA policy and processes.
    8. Storage of Evidence and Documentation. Investigators/Auditors shall save all civil/criminal evidence and related documentation to an internal EBSA shared network. EBSA shall limit access to these materials to active enforcement staff. The lead Investigator/Auditor and/or case supervisor may limit and control access to records for their own cases, though the Regional Director (RD) and Deputy RD will have access to all civil case files in their RO.
      1. Once the RO closes a civil case not subject to a litigation hold, the Investigator/Auditor shall destroy all physical documentation (paper files, CD/DVDs, USB Drives, external hard drives, etc.) that has been verified as saved to EBSA's network, if there is no parallel criminal case. ROs can securely ship external drives to National Office for destruction. The Investigator/Auditor shall record destruction of these materials according to established EBSA policy and processes.
      2. Once the RO closes a criminal case that has never been referred for prosecution, the Investigator/Auditor shall destroy all physical documentation (paper files, CD/DVDs, USB Drives, etc.) that has been verified as saved to EBSA's network, if there is no parallel civil case and after consultation with the RO’s Senior Advisor to Criminal Investigations (SACI). The Investigator/Auditor shall record destruction of these materials according to established EBSA policy and processes.
      3. Once the RO closes a criminal case that has been referred for prosecution, the Investigator/Auditor shall destroy all physical documentation (paper files, CD/DVDs, USB Drives, etc.) that has been verified as saved to EBSA's network, if there is no parallel civil case, after consultation with the RO’s SACI and only with the approval of the prosecutor. The Investigator/Auditor shall record destruction of these materials according to established EBSA policy and processes.
    9. Investigative Documentation. This consists of the use and accumulation of completed or otherwise indexed and identified forms, ROI, RIs, signed statements, exhibits, and other related documents as prescribed in other sections of this manual. Investigators/Auditors record all on-site record examinations on Report of Records Examination, EBSA Form 202C. As noted above, documents received from the original source (EBSA's “originals”) should not be altered in any way. When Investigators/Auditors receive records through email, a secured server, or other electronic forms of correspondence, they do not need to complete an EBSA Form 202C. Upon receipt of electronic documents, or hardcopies of records from any source, the Investigator/Auditor shall note in the case file table of contents the date they obtained those documents, and identify the source.

    10. Administrative Documentation. Administrative documentation generally consists of written communications drafted by EBSA enforcement personnel for internal or external distribution, such as memoranda to file, letters, and emails that are specific to the investigation.

      Investigators/Auditors shall save all memoranda, letters, and other written communications, including emails, to the electronic case file.

      1. External emails. Investigators/Auditors often communicate via email with plan officials, service providers, witnesses, or other parties during an investigation about matters pertaining to the investigation. Any external email that involves any material aspect of the investigation should be maintained in the electronic case file.
      2. Internal emails. Investigators/Auditors may communicate internally with other EBSA employees regarding an investigation. Internal emails that include material discussions about the investigation, decisions that were made in the investigation, and guidance that was given related to the investigation should be maintained in the electronic case file.
      3. Telephone Conversations. Investigators/Auditors should memorialize all telephone conversations with plan officials, service providers, witnesses, and other parties related to the investigation in a log or memorandum. The log or memoranda must be maintained in the electronic case file.

      4. Internal Discussions. Investigators/Auditors should memorialize in a memorandum to file any internal discussions in the RO, with NO, and with SOL or a prosecutor that are material to the investigation. Decisions that were made or guidance that was provided specific to the investigation are material. The memorandum must be maintained in the electronic case file.

        Memos memorializing material discussions with SOL or a prosecutor should be maintained separately and labeled so as to preserve attorney-client privilege, attorney work product, or deliberative process privilege.

    11. Confidentiality of Information. Active case investigative information will be discussed with or made available only to EBSA personnel, the Department of Labor, or under proper circumstances, to other governmental agencies. The EM section on Release of Information describes circumstances under which material will be made available to other agencies.
    12. Recording the Dissemination of Investigative File Information. If the RD authorizes, orally or in writing, providing any information in an investigative file to any recipient outside the RO, the Investigator/Auditor prepares a memorandum to that effect, including specific information and/or documents released, date of release, and the initials of the employee releasing the data, and places the memo in the file.
    13. Multiple Copies of Investigative File Material. While Investigators/Auditors may make and use copies of documents, memoranda, exhibits, workpapers, or other related materials during the course of an investigation, these documents should generally be destroyed at the conclusion of the investigation unless there are compelling reasons, such as a legal requirement to retain them. See EM sections on Conducting and Documenting Interviews and Subpoenas.

  2. Workpapers. From time to time, the Investigator/Auditor may need to testify in court or at a deposition concerning certain facts obtained during the investigation. When this occurs and to refresh their recollection, the Investigator/Auditor may need to use workpapers and other documents compiled during the investigation. Recollection refreshed by written material produced at or near the time an event occurred (such as books, papers, accounts, letters, affidavits, notes, workpapers, spreadsheets, and similar writings) can be more persuasive than a witness's testimony unrefreshed long after an event has occurred. Consult SOL before reviewing documents for this purpose.

    For review, operational, and management purposes, the Investigator/Auditor must maintain uniformity in the systematic presentation or storing of records and financial data examined during the investigation. This applies to all materials that form the basis of reports produced by the Investigator/Auditor. All documents, records, and workpapers must be maintained in the electronic case file.

    1. Basic Role of Workpapers. The investigative workpapers serve as a connecting link between the Investigator's/Auditor's report and the underlying financial and other data which led to the findings contained in that report.
    2. Purposes of Workpapers. The investigative workpapers serve a number of necessary purposes such as:
      1. Preservation of Significant Facts and Relationships. Unless these matters are set down in writing when observed, they are likely to be forgotten before they can be properly appraised in the light of information disclosed by other phases of the investigation. As each phase is completed, the workpapers are filed, expanded, and supplemented as additional information is obtained.
      2. Preparation and Verification of the Report of Investigation. The workpapers substantiate, explain, and justify the facts, recommendations, and findings included in the ROI.
    3. Design of Workpapers. There are any number of workpapers including schedules and spreadsheets used by an Investigator/Auditor. When establishing the design of the workpaper or schedule, the Investigator/Auditor should determine its adequacy by testing it to see if it will accomplish the desired purpose. Otherwise, much time can be lost through “false starts” resulting from hasty use of untested workpapers or schedules.
    4. Types of Workpapers. Figure 1 is a listing of some categories of workpapers, illustrating the natural flow of the investigation and the sequence of indexing/referencing of workpapers.
    5. Workpaper Preparation.
      1. Workpapers should be neat, legible, and orderly in appearance. It is best to use only commonly understood abbreviations. Avoid generalities and unsupported conclusions, and keep all comments and exceptions factual. State the final disposition of all exceptions and questions.
      2. For each workpaper, every Investigator/Auditor working on it should indicate the date of their work. This is important to fix the responsibility for work, to show the sequence in which work was done, and the completion date in case questions arise later. In addition, the Investigator/Auditor should catalog the source for each workpaper. Including the source allows the reviewer to follow the investigative trail to the original source documents.
      3. All workpapers and schedules should be indexed, and related workpapers and schedules should be carefully cross-referenced. Unless the supervisor gives directions to the contrary, each Investigator/Auditor will select the method of indexing so long as the method is consistent throughout the workpapers. The purpose of indexing is to make the finding of data in the workpapers easy and to show the interrelationship of related workpapers.
      4. The following rules must be observed in the preparation of schedules:
        1. Each schedule should provide for an analysis or summary of the data making up the item and should describe the audit steps performed in determining the reliability of the information.
        2. Each schedule should be complete and understandable in itself. This rule is to save the reviewer time and ensure schedules contain sufficient information to constitute effective evidence of the work done. To be complete and understandable, the schedule should have a complete title of the information analyzed, or application of the test, the source of the data used, and the date or period covered by the test. Describe any test procedures applied in terms of their nature and extent, including methodology employed.
        3. The following example demonstrates the interrelationship between schedules. In conducting an analysis of the balance of the accounts receivable account, it is determined that certain accounts must be written off as uncollectible and charged against the “provision for doubtful accounts” (or the “reserve for bad debts,” as it is still commonly called), a cross- reference should be made between related schedules so that the reviewer can follow the relationships. Likewise, an explanation should be included on the reserve for bad debts analysis indicating that the entry ties into the accounts receivable schedule. The reviewer has a complete explanation of the adjustment and an identification of the related schedule to examine to confirm the analysis.
    6. Control of Workpapers. Investigators/Auditors should secure workpapers and supporting documentation when they leave the work area at all times. Investigators/Auditors should save and maintain such documentation in accordance with EBSA policy and procedures.
    7. Screening and Storage of Notes and Workpapers. After ROI completion and approval, all relevant original workpapers prepared by the Investigator/Auditor during the course of the investigation should be retained with the case file. (This workpaper file may be used later to refresh the Investigator's/Auditor's recollection as a trial witness). The Investigator/Auditor should exercise care to ensure that no personal memoranda or other extraneous notations are included among the workpapers.
  3. Case File Arrangement. Electronic case files must contain evidence collected in an orderly, retrievable fashion, and in accordance with EBSA's case file procedures.

(Figure 1) Listing of Some Categories of Workpapers

Employee Health and Welfare Benefit Funds

  1. Contributions
  2. Payroll Audits
  3. Bonding
  4. Premium Deposits and Refunds
  5. Insurance Premium and Related Liabilities
  6. Claim Payments
  7. Liability for Claims
  8. Liability for Accumulated Eligibility Credits
  9. Actuarial Reports
  10. Restrictions on Fund Balance and Contingencies
  11. Administrative Expenses
  12. Other Audit Considerations
    1. Review of tax returns
    2. Collective bargaining agreements

Pension Funds

  1. Contributions
    1. Multiemployer Funds
    2. Single Employer Funds
  2. Payroll Audits
  3. Bonding
  4. Investments
  5. Assets held by an Insurance Company
  6. Actuarially Determined Present Value of Accrued Benefits
  7. Benefit Payments
  8. Administrative Expenses
  9. Other Audit Considerations
    1. Review of tax returns
    2. Collective bargaining agreements

The list illustrates how easily the program may be expanded or contracted as deemed necessary in the judgment of the Investigator/Auditor.