1. General Evidentiary Considerations.

    1. Accountability for Electronic and Physical Evidence. EBSA investigations require the collection and preservation of evidence including plan records, company and union records, bank records, reports of interview (RIs), signed statements, and related work papers.

      To assure that the value of electronic and physical evidence is not impaired or destroyed, the Investigator/Auditor (I/A) must ensure that the evidence meets the test of admissibility. To pass this test, the evidence must be authentic, relevant, unaltered, and untampered with. In short, the I/A must be able to testify, under oath, that the particular document is the one obtained from a reliable source in the investigation; that it has since been in the I/As personal or accountable custody; and has not been altered. The I/As should save electronic case documents in the electronic case evidence folder using Department approved methods to ensure cyber security.

    2. Federal Rules of Evidence. All I/As should be generally familiar with the Federal Rules of Evidence, which appear in Public Law 93-595. Special attention should be devoted to Article VIII, "Hearsay," Article IX, "Authentication and Identification," and Article X, "Contents of Writings, Records and Photographs." I/As should address questions concerning evidentiary matters to SOL.

    3. Admissibility of Duplicates. Rule 1003 of the Federal Rules of Evidence provides:

      "A duplicate is admissible to the same extent as an original unless: (1) a genuine question is raised as to the authenticity of the original or (2) in the circumstances it would be unfair to admit the duplicate in lieu of the original."

      Based on this rule, in most situations, a copy of a document is sufficient if the I/A can testify the origin of the document is a reliable source, that the document has remained unaltered while in his/her possession, and that the duplicate is an accurate copy of the original. During interviews where exhibits are used, I/As should verify authenticity of the documents with the witness. In the Report of Interview, I/As should clearly identify any documents shown to the interviewee or provided by the interviewee to the I/A during the interview.

    4. Receipts for Original Books, Records, and Documents Obtained. When it is necessary to take possession of original documentary evidence or property, the I/A must give the organization or individual a signed, itemized, and correctly dated EBSA Form 220A, "Document Receipt," for the material. Such original documentary evidence or property includes books, records, canceled checks, bank statements, receipt books, invoices, vouchers, letters, memoranda, or other materials either provided pursuant to subpoena or furnished voluntarily by an organization or individual (even if only to photocopy and immediately return). The I/A will retain a copy of the Document Receipt signed by the individual who provided the materials.

      Upon returning the described documents to the owner or responsible individual, the I/A will ask for the original EBSA Form 220A, "Document Receipt" and have the party receiving the documents acknowledge in writing on EBSA Form 220B, "Return of Documents" that they received them. Both Forms should be retained in the case file.

    5. Custody of Evidence. In order to maintain a clear chain of custody of documentary evidence, original materials and duplicates described in (c) must be preserved in their original state in the RO/DO electronic evidence file. See Subpoenas, paragraph 13, for guidance related to subpoenaed documents.

      Under the following circumstances, documents received during an investigation require additional safekeeping.

      1. Documents Obtained from the IRS. Tax returns and return information received from the IRS pursuant to IRC section 6103 must be maintained in accordance with IRS Publication 1075 requirements. When EBSA-requested Federal Taxpayer Information (FTI) is received via the IRS Secure Data Transfer (SDT) tool (an IRS developed and approved secure file transfer methodology), the EBSA Help Desk will store the FTI in the appropriate office-specific secure FTI network folder and inform the office's IRC 6103 Custodian of receipt and FTI location. A sub-folder named for the Case Number associated with the FTI request will be created and access will be granted to personnel identified by the IRC 6103 Custodian in the FTI Request Letter submitted to the IRS. The IRC 6103 Custodian will inform the I/As of FTI availability for online review. If the need arises to print these files, they should be secured following existing paper-based FTI documentation and handling requirements until they are no longer needed. At that time, they should be given to the Regional IRS 6103 Custodian to be destroyed using the paper shredder meeting IRS 1075 specifications provided to each EBSA office. For additional guidance on how to handle tax returns and return information obtained from the IRS, see Relationship with IRS, paragraph 31.d, and EBSA Notice NO 19-005 Security of Federal Tax Information.

      2. Tax returns and return information received from the IRS pursuant to IRC section 6103 must be maintained in a secured manner. When these documents are received via secure file transfer, I/As should view these documents online. If the need arises to print these files, they should be secured until they are no longer needed. At that time, they should be given to the Regional IRS 6103 Custodian to be destroyed. See Release of Information, paragraph 7, for a discussion of how to handle tax returns and return information obtained from the IRS. See Relationship with IRS, paragraph 31.d, and EBSA Notice 19-005.

      3. Documents Covered by the Right to Financial Privacy Act. The Right to Financial Privacy Act (RFPA), 12 U.S.C. §3401 et seq., preserves the confidentiality of financial records while allowing access for legitimate law enforcement activities. Because there are certain prohibitions against giving the documents to others, including other government agencies, documents obtained pursuant to the RFPA should be segregated from other documents produced during the investigation. See Subpoenas, paragraph 14, for guidance on obtaining documents pursuant to the RFPA.

      4. Documents and Information Obtained from the Grand Jury or During a Criminal Investigation. I/As must exercise caution when handling parallel civil/criminal investigations. Documents related to a Grand Jury investigation should remain in a secure place and not disclosed to anyone who is not entitled to access to the evidence under Rule 6(e) of the Federal Rules of Criminal Procedure (the 6(e) order). Electronic case documents should be saved in the electronic case evidence folder using Department approved methods to ensure cyber security. Grand Jury documents should only be accessed from the EBSA network while teleworking. Hard copies should not be removed from the RO for use at a remote location. See Release of Information, paragraph 8.b.; Subpoenas, paragraph 17; and Criminal Investigations.

        Personal devices may not be used during the course of an investigation. If a device is required, one should be requested from the EBSA Help Desk.

      5. Materials under an FOIA Exemption Claim for Commercial Confidential Information. The I/A should identify materials provided with a submitter's request for FOIA Exemption 4 protection. The case file must keep such materials in a manner to maintain their identity and confidentiality. In addition, the case file should be clearly marked that there is an Exemption 4 claim. See Release of Information, paragraph 4.

      6. Confidential Complaints. Special procedures are necessary when a RO receives a confidential complaint. See Complaints, paragraph 4.

      7. Working Documents. During the course of the investigation, the I/A may keep a set of "working documents," that is, a duplicate set of documents that can be written on and rearranged in any order. I/As should destroy these working documents when the investigation is completed and the ROI written, unless there is a compelling reason, such as a legal requirement, to keep them. Any draft electronic working documents should be maintained in the electronic working papers folder. All drafts should be deleted once the working papers are approved.

    6. Transmission of Evidence. All documents and other material that are or may become evidence will transmit between offices in a secure manner, which will maintain a clear chain of custody. The cover memorandum will identify in detail the documents or other material so transmitted. Physical evidence (e.g., paper evidence, removable media, CD/DVD, USB drives) must be logged and tracked via policy and processes established by EBSA/OTIS. Any passwords associated with the materials transmitted should be sent to the recipient via email.

    7. Storage of Evidence and Documentation. I/As shall save all civil/criminal evidence and related documentation to an internal EBSA shared network. EBSA shall limit access to these materials to active enforcement staff. The lead I/A and/or case supervisor may limit and control access to records for their own cases, though the RD, DRD and ARD will have access to all civil case files in their RO.

      1. Once the RO closes a civil case not subject to a litigation hold, the I/A shall shred all physical documentation (paper files, CD/DVDs, USB Drives, external hard drives, etc.) that has been verified as saved to EBSA’s network, if there is no parallel criminal case. ROs can securely ship external drives to OTIS for destruction. The I/A shall record destruction of these materials according to established EBSA/OTIS policy and processes.

      2. Once the RO closes a criminal case that has never been referred for prosecution, the I/A shall shred all physical documentation (paper files, CD/DVDs, USB Drives, etc.) that has been verified as saved to EBSA’s network, if there is no parallel civil case and after consultation with the RO’s Senior Advisor to Criminal Investigations (SACI). The I/A shall record destruction of these materials according to established EBSA/OTIS policy and processes.

      3. Once the RO closes a criminal case that has been referred for prosecution, the I/A shall shred all physical documentation (paper files, CD/DVDs, USB Drives, etc.) that has been verified as saved to EBSA’s network, if there is no parallel civil case, after consultation with the RO’s SACI and only with the approval of the prosecutor. The I/A shall record destruction of these materials according to established EBSA/OTIS policy and processes.

    8. Investigative Documentation. This consists of the use and accumulation of completed or otherwise indexed and identified forms, ROI, RIs, signed statements, exhibits, and other related documents as prescribed in other sections of this manual. I/As record all on-site record examinations on Report of Records Examination, EBSA Form 202C. As noted above, original documents should not be altered in any way. Upon receipt of electronic documents, or hardcopies of original records, the I/A shall note in the case file table of contents the date they obtained those documents, and identify the source. The I/A shall also record the receipt of these electronic or hardcopy documents according to established EBSA/OTIS policies and processes.

    9. Administrative Documentation. Administrative documentation generally consists of written communications drafted by EBSA enforcement personnel for internal or external distribution—e.g., memoranda, letters, or spreadsheets. I/As shall save all memoranda, letters, and other written communications to their respective electronic case files maintained on the EBSA shared drive. Emails will be saved to the electronic case files in accordance with OTIS policies. All final documents should be saved in PDF format. Any other instructions or administrative data received personally or by telephone, recorded via a handwritten notation will be scanned to the electronic case files. I/As shall record any action orally requested in a case by another EBSA Office, the NO, SOL, or other office.

    10. Confidentiality of Information. Active case investigative information will be discussed with or made available only to EBSA personnel, the Department, or under proper circumstances, to other governmental agencies. The Release of Information section describes circumstances under which material will be made available to other agencies.

    11. Recording the Dissemination of Investigative File Information. If the RD authorizes, orally or in writing, providing any information in an investigative file to any recipient outside the RO, the I/A will prepare a memorandum to that effect, including specific information and/or documents released, date of release and the initials of the employee releasing the data, and place the memo in the file.

    12. Multiple Copies of Investigative File Material. While I/As may make and use copies of documents, memoranda, exhibits, workpapers, or other related materials during the course of an investigation, these documents should generally be destroyed at the conclusion of the investigation unless there are compelling reasons, such as a legal requirement to retain them. See Conducting and Documenting Interviews, and Subpoenas.

  2. Workpapers. From time to time, the I/A may need to testify in court or at a deposition concerning certain facts obtained during the investigation. When this occurs and to refresh his or her recollection, the I/A may need to use work papers and other documents compiled during the investigation. Recollection refreshed by written material produced at or near the time an event occurred (such as books, papers, accounts, letters, affidavits, notes, workpapers, spreadsheets, and similar writings) can be more persuasive than a witness’s testimony unrefreshed long after an event has occurred. For review, operational, and management purposes, the I/A must maintain uniformity in the systematic presentation or storing of records and financial data examined during the investigation. This applies to all materials that form the basis of reports produced by the I/A.

    1. Basic Role of Workpapers. The investigative workpapers serve as a connecting link between the I/As report and the underlying financial and other data which led to the findings contained in that report.

    2. Purposes of Workpapers. The investigative workpapers serve a number of necessary purposes such as:

      1. Preservation of Significant Facts and Relationships. Unless these matters are set down in writing when observed, they are likely to be forgotten before they can be properly appraised in the light of information disclosed by other phases of the investigation. As each phase is completed, the workpapers are filed, expanded, and supplemented as additional information is obtained.

      2. Preparation and Verification of the Report of Investigation. The workpapers should substantiate and explain the facts and recommendations included as well as justify the findings in the report.

    3. Design of Workpaper. There are any number of workpapers including schedules and spreadsheets used by an I/A. When establishing the design of the workpaper or schedule, the I/A should determine its adequacy by testing it to see if it will accomplish the desired purpose. Otherwise, much time can be lost through "false starts" resulting from hasty use of untested workpapers or schedules.

    4. Types of Workpapers. Figure 1 is a listing of some categories of workpapers, illustrating the natural flow of the investigation and the sequence of indexing/referencing of workpapers.

    5. Workpaper Preparation.

      1. Workpapers should be neat, legible, and orderly in appearance. It is best to use only commonly understood abbreviations. Avoid generalities and unsupported conclusions, and keep all comments and exceptions factual. State the final disposition of all exceptions and questions.

      2. For each workpaper, the I/A that prepared the workpaper should initial and indicate the date of the work. This is important to fix the responsibility for work, to show the sequence in which work was done, and the completion date in case questions arise later. In addition, the I/A should catalog the source for each workpaper. Including the source allows the reviewer to follow the investigative trail to the original source documents.

      3. All workpapers and schedules should be indexed, and related workpapers and schedules should be carefully cross-referenced. Unless the supervisor gives directions to the contrary, each I/A will select the method of indexing so long as the method is consistent throughout the workpapers. The purpose of indexing is to make the finding of data in the workpapers easy and to show the interrelationship of related workpapers.

      4. The following rules must be observed in the preparation of workpaper schedules:

        1. Each workpaper schedule should provide for an analysis or summary of the data making up the item and should describe the audit steps performed in determining the reliability of the information.

        2. Each workpaper schedule should be complete and understandable in itself. This rule is to save the reviewer time and ensure schedules contain sufficient information to constitute effective evidence of the work done. To be complete and understandable, the schedule should have a complete title of the information analyzed, or application of the test, the source of the data used, and the date or period covered by the test. If other documents were used as sources for the workpapers, hyperlinks to these documents should be used to the extent possible. Describe any test procedures applied in terms of their nature and extent, including methodology employed.

        3. The following example demonstrates the interrelationship between workpaper schedules: In preparing an analysis of the balance in an accounts receivable account, the I/A might first calculate the amount that must be written off as uncollectible and charged against the "reserve for bad debts." The I/A should cross-reference related schedules so that the reviewer can follow the analysis. Likewise, the I/A should note on the reserve for bad debts analysis that some entries tie into the accounts receivable schedule. The reviewer has a complete explanation of the adjustment and an identification of the related schedule to examine to confirm the analysis.

    6. Control of Workpapers. I/As should secure Workpapers and supporting documentation when he/she leaves the work area at all times and maintain such documentation in accordance with EBSA/OTIS policies and procedures.

    7. Screening and Storage of Notes and Workpapers. After ROI completion and approval, all relevant original workpapers prepared by the I/A during the course of the investigation should be retained with the case file in accordance with established EBSA/OTIS policies and processes. (This workpaper file may be used later to refresh the I/As recollection as a trial witness). The I/A should exercise care to ensure that no personal memoranda or other extraneous notations are included among the workpapers.

  3. Case File Arrangement. File evidence collected in an orderly, retrievable fashion and in accordance with EBSA’s case file procedures.


(Figure 1)
Listing of Some Categories of Workpapers

Employee Health and Welfare Benefit Funds

  1. Contributions
  2. Payroll Audits
  3. Bonding
  4. Premium Deposits and Refunds
  5. Insurance Premium and Related Liabilities
  6. Claim Payments
  7. Liability for Claims
  8. Liability for Accumulated Eligibility Credits
  9. Actuarial Reports
  10. Restrictions on Fund Balance and Contingencies
  11. Administrative Expenses
  12. Other Audit Considerations
    1. Review of tax returns
    2. Collective bargaining agreements

Pension Funds

  1. Contributions
    1. Multiemployer Funds
    2. Single Employer Funds
  2. Payroll Audits
  3. Bonding
  4. Investments
  5. Assets held by an Insurance Company
  6. Actuarially Determined Present Value of Accrued Benefits
  7. Benefit Payments
  8. Administrative Expenses
  9. Other Audit Considerations
    1. Review of tax returns
    2. Collective bargaining agreements

The list illustrates how easily the program may be expanded or contracted as deemed necessary in the judgment of the I/A.