1. General Evidentiary Considerations.

    1. Accountability for Electronic and Physical Evidence. EBSA investigations require the collection and preservation of evidence including plan records, company and union records, bank records, reports of interview (RIs), signed statements, and related work papers.

      To assure that the value of electronic and physical evidence is not impaired or destroyed, the Investigator/Auditor must ensure that the evidence meets the test of admissibility. To pass this test, the evidence must be authentic, relevant, unaltered, and untampered with. In short, the Investigator/Auditor must be able to testify, under oath, that the particular document is the one obtained from a reliable source in the investigation; that it has since been in the Investigator/Auditor's personal or accountable custody; and has not been altered.

    2. Federal Rules of Evidence. All Investigator/Auditors should be generally familiar with the Federal Rules of Evidence, which appear in Public Law 93-595. Special attention should be devoted to Article VIII, "Hearsay," Article IX, "Authentication and Identification," and Article X, "Contents of Writings, Records and Photographs." Investigator/Auditors should address questions concerning evidentiary matters to SOL.

    3. Admissibility of Duplicates. Rule 1003 of the Federal Rules of Evidence provides:

      "A duplicate is admissible to the same extent as an original unless: (1) a genuine question is raised as to the authenticity of the original or (2) in the circumstances it would be unfair to admit the duplicate in lieu of the original."

      Based on this rule, in most situations, a copy of a document is sufficient if the Investigator/Auditor can testify the origin of the document is a reliable source, that the document has remained unaltered while in his/her possession, and that the duplicate is an accurate copy of the original.

    4. Receipts for Books, Records, and Documents Obtained. When it is necessary to take possession of documentary evidence or property, the Investigator/Auditor must give the organization or individual a signed, itemized, and correctly dated Document Receipt, EBSA Form 220A for the material. Such documentary evidence or property includes books, records, canceled checks, bank statements, receipt books, invoices, vouchers, letters, memoranda, or other materials either provided pursuant to subpoena or furnished voluntarily by an organization or individual (even if only to photocopy and immediately return). The Investigator/Auditor will retain a copy of the Document Receipt signed by the individual who provided the materials.

      Upon returning the described documents to the owner or responsible individual, the Investigator/Auditor will ask for the original Document Receipt and have the party receiving the documents acknowledge in writing on EBSA Form 220B Return of Documents that they received them.

    5. Custody of Evidence. In order to maintain a clear chain of custody of documentary evidence, original materials and duplicates described in (c) must be preserved in their original state in the Regional Office/District Office file. See Subpoenas, paragraph 13, for guidance related to subpoenaed documents.

      Under the following circumstances, documents received during an investigation require additional safekeeping.

      1. Documents Obtained from the IRS. Tax returns and return information received from the IRS pursuant to IRC section 6103 must be maintained in a secured manner. See Release of Information, paragraph 7, for a discussion of how to handle tax returns and return information obtained from the IRS. See Relationship with IRS, paragraph 31.d, and EBSA Notice 97-2.

      2. Documents Covered by the Right to Financial Privacy Act. The Right to Financial Privacy Act, 12 U.S.C. §3401 et seq. (RFPA), preserves the confidentiality of financial records while allowing access for legitimate law enforcement activities. Because there are certain prohibitions against giving the documents to others, including other government agencies, documents obtained pursuant to the RFPA should be segregated from other documents produced during the investigation. See Subpoenas, paragraph 14, for guidance on obtaining documents pursuant to the RFPA.

      3. Documents and Information Obtained from the Grand Jury or During a Criminal Investigation. Investigator/Auditors must exercise caution when handling parallel civil/criminal investigations. Documents related to a Grand Jury investigation should remain in a secure place and not disclosed to anyone who is not entitled to access to the evidence under Rule 6(e) of the Federal Rules of Criminal Procedure (the 6(e) order). See Release of Information, paragraph 8.b.; Subpoenas, paragraph 17; and Criminal Investigations.

      4. Materials under an FOIA Exemption Claim for Commercial Confidential Information. The Investigator/Auditor should identify materials provided with a submitter's request for FOIA Exemption 4 protection. The case file must keep such materials in a manner to maintain their identity. In addition, the case file should be clearly marked that there is an Exemption 4 claim. See Release of Information, paragraph 4.

      5. Confidential Complaints. Special procedures are necessary when a Regional Office receives a confidential complaint. See Complaints, paragraph 4.

      6. Working Documents. During the course of the investigation, the Investigator/Auditor may keep a set of "working documents," that is, a duplicate set of documents that can be written on and rearranged in any order. Investigators/Auditors should destroy these working documents when the investigation is completed and the ROI written, unless there is a compelling reason, such as a legal requirement, to keep them.

    6. Transmission of Evidence. All documents and other material that are or may become evidence will transmit between offices in a secure manner, which will maintain a clear chain of custody. The transmittal memorandum will identify in detail the documents or other material so transmitted. Physical evidence (e.g., paper evidence, removable media, CD/DVD, USB drives) must be logged and tracked via policy and processes established by EBSA/OTIS.

    7. Storage of Evidence and Documentation. Investigators/Auditors shall save all criminal/civil evidence and related documentation to an internal EBSA shared network. EBSA shall limit access to these materials to active enforcement staff. The lead Investigator/Auditor and/or case supervisor may limit and control access to records for their own cases, though the Regional Director and Deputy Regional Director will have access to all civil case files in their Regional Office.

      1. Once the Regional Office closes a civil case not subject to a litigation hold, the Investigator/Auditor shall shred all physical documentation (paper files, CD/DVDs, USB Drives, external hard drives, etc.) that has been verified as saved to EBSA’s network, if there is no parallel criminal case. Regional Offices can securely ship external drives to OTIS for destruction. The Investigator/Auditor shall record destruction of these materials according to established EBSA/OTIS policy and processes.

      2. Once the Regional Office closes a criminal case that has never been referred for prosecution, the Investigator/Auditor shall shred all physical documentation (paper files, CD/DVDs, USB Drives, etc.) that has been verified as saved to EBSA’s network, if there is no parallel civil case and after consultation with the Regional Office’s Senior Advisor to Criminal Investigations (SACI). The Investigator/Auditor shall record destruction of these materials according to established EBSA/OTIS policy and processes.

      3. Once the Regional Office closes a criminal case that has been referred for prosecution, the Investigator/Auditor shall shred all physical documentation (paper files, CD/DVDs, USB Drives, etc.) that has been verified as saved to EBSA’s network, if there is no parallel civil case, after consultation with the Regional Office’s SACI and only with the approval of the prosecutor. The Investigator/Auditor shall record destruction of these materials according to established EBSA/OTIS policy and processes.

    8. Investigative Documentation. This consists of the use and accumulation of completed or otherwise indexed and identified forms, ROI, RIs, signed statements, exhibits, and other related documents as prescribed in other sections of this manual. Investigators/Auditors record all on-site record examinations on Report of Records Examination, EBSA Form 202C. As noted above, original documents should not be altered in any way. When Investigators/Auditors receive records through email, a secured server, or other electronic forms of correspondence, they do not need to complete an EBSA Form 202C. Upon receipt of electronic documents, or hardcopies of original records, the Investigator/Auditor shall note in the case file table of contents the date they obtained those documents, and identify the source.

    9. Administrative Documentation. Administrative documentation generally consists of written communications drafted by EBSA enforcement personnel for internal or external distribution—e.g., memoranda or letters. Investigators/Auditors shall save all memoranda, letters, and other written communications, with the exception of emails , to their respective electronic case files maintained on the EBSA shared drive. Any other instructions or administrative data received personally or by telephone will be recorded by handwritten notation, dated, and initialed by the recipient , or by dated memoranda by or to the RD, covering such details. Investigators shall record in the case file any action orally requested in a case by the NO, SOL, or other office.

    10. Confidentiality of Information. Active case investigative information will be discussed with or made available only to EBSA personnel, the Department, or under proper circumstances, to other governmental agencies. The Release of Information section describes circumstances under which material will be made available to other agencies.

    11. Recording the Dissemination of Investigative File Information. If the Regional Director authorizes, orally or in writing, providing any information in an investigative file to any recipient outside the Regional Office, the Investigator/Auditor prepares a memorandum to that effect, including specific information and/or documents released, date of release and the initials of the employee releasing the data, and place the memo in the file.

    12. Multiple Copies of Investigative File Material. While Investigators/Auditors may make and use copies of documents, memoranda, exhibits, workpapers, or other related materials during the course of an investigation, these documents should generally be destroyed at the conclusion of the investigation unless there are compelling reasons, such as a legal requirement to retain them. See Conducting and Documenting Interviews, and Subpoenas.

  2. Workpapers. From time to time, the Investigator/Auditor may need to testify in court or at a deposition concerning certain facts obtained during the investigation. When this occurs and to refresh his or her recollection, the Investigator/Auditor may need to use work papers and other documents compiled during the investigation. Recollection refreshed by written material produced at or near the time an event occurred (such as books, papers, accounts, letters, affidavits, notes, workpapers, spreadsheets, and similar writings) can be more persuasive than a witness’s testimony unrefreshed long after an event has occurred. For review, operational, and management purposes, the Investigator/Auditor must maintain uniformity in the systematic presentation or storing of records and financial data examined during the investigation. This applies to all materials that form the basis of reports produced by the Investigator/Auditor.

    1. Basic Role of Workpapers. The investigative workpapers serve as a connecting link between the Investigator's/Auditor's report and the underlying financial and other data which led to the findings contained in that report.

    2. Purposes of Workpapers. The investigative workpapers serve a number of necessary purposes such as:

      1. Preservation of Significant Facts and Relationships. Unless these matters are set down in writing when observed, they are likely to be forgotten before they can be properly appraised in the light of information disclosed by other phases of the investigation. As each phase is completed, the workpapers are filed, expanded, and supplemented as additional information is obtained.

      2. Preparation and Verification of the Report of Investigation. The workpapers should substantiate and explain the facts and recommendations included as well as justify the findings in the report.

    3. Design of Workpaper. There are any number of workpapers including schedules and spreadsheets used by an Investigator/Auditor. When establishing the design of the workpaper or schedule, the Investigator/Auditor should determine its adequacy by testing it to see if it will accomplish the desired purpose. Otherwise, much time can be lost through "false starts" resulting from hasty use of untested workpapers or schedules.

    4. Types of Workpapers. Figure 1 is a listing of some categories of workpapers, illustrating the natural flow of the investigation and the sequence of indexing/referencing of workpapers.

    5. Workpaper Preparation.

      1. Workpapers should be neat, legible, and orderly in appearance. It is best to use only commonly understood abbreviations. Avoid generalities and unsupported conclusions, and keep all comments and exceptions factual. State the final disposition of all exceptions and questions.

      2. For each workpaper, every Investigator/Auditor working on it should initial and indicate the date of the work. This is important to fix the responsibility for work, to show the sequence in which work was done, and the completion date in case questions arise later. In addition, the Investigator/Auditor should catalog the source for each workpaper. Including the source allows the reviewer to follow the investigative trail to the original source documents.

      3. All workpapers and schedules should be indexed, and related workpapers and schedules should be carefully cross-referenced. Unless the supervisor gives directions to the contrary, each Investigator/Auditor will select the method of indexing so long as the method is consistent throughout the workpapers. The purpose of indexing is to make the finding of data in the workpapers easy and to show the interrelationship of related workpapers.

      4. The following rules must be observed in the preparation of schedules:

        1. Each schedule should provide for an analysis or summary of the data making up the item and should describe the audit steps performed in determining the reliability of the information.

        2. Each schedule should be complete and understandable in itself. This rule is to save the reviewer time and ensure schedules contain sufficient information to constitute effective evidence of the work done. To be complete and understandable, the schedule should have a complete title of the information analyzed, or application of the test, the source of the data used, and the date or period covered by the test. Describe any test procedures applied in terms of their nature and extent, including methodology employed.

        3. The following example demonstrates the interrelationship between schedules. In conducting an analysis of the balance of the accounts receivable account, it is determined that certain accounts must be written off as uncollectible and charged against the "provision for doubtful accounts" (or the "reserve for bad debts," as it is still commonly called), a cross-reference should be made between related schedules so that the reviewer can follow the relationships. Likewise, a word of explanation should be included on the reserve for bad debts analysis indicating that the entry ties into the accounts receivable schedule. The reviewer has a complete explanation of the adjustment and an identification of the related schedule to examine to confirm the analysis.

    6. Control of Workpapers. Investigator/Auditors should secure Workpapers and supporting documentation when he/she leaves work area at all times. In accordance with EBSA/OTIS policy and procedures, save to/maintain such documentation.

    7. Screening and Storage of Notes and Workpapers. After ROI completion and approval, all relevant original workpapers prepared by the Investigator/Auditor during the course of the investigation should be retained with the case file. (This workpaper file may be used later to refresh the Investigator's/Auditor's recollection as a trial witness). The Investigator/Auditor should exercise care to ensure that no personal memoranda or other extraneous notations are included among the workpapers.

  3. Case File Arrangement. File evidence collected in an orderly, retrievable fashion and in accordance with EBSA’s case file procedures.


(Figure 1)
Listing of Some Categories of Workpapers

Employee Health and Welfare Benefit Funds

  1. Contributions
  2. Payroll Audits
  3. Bonding
  4. Premium Deposits and Refunds
  5. Insurance Premium and Related Liabilities
  6. Claim Payments
  7. Liability for Claims
  8. Liability for Accumulated Eligibility Credits
  9. Actuarial Reports
  10. Restrictions on Fund Balance and Contingencies
  11. Administrative Expenses
  12. Other Audit Considerations
    1. Review of tax returns
    2. Collective bargaining agreements

Pension Funds

  1. Contributions
    1. Multiemployer Funds
    2. Single Employer Funds
  2. Payroll Audits
  3. Bonding
  4. Investments
  5. Assets held by an Insurance Company
  6. Actuarially Determined Present Value of Accrued Benefits
  7. Benefit Payments
  8. Administrative Expenses
  9. Other Audit Considerations
    1. Review of tax returns
    2. Collective bargaining agreements

The list illustrates how easily the program may be expanded or contracted as deemed necessary in the judgment of the Investigator/Auditor.