Skip to page content
Employee Benefits Security Administration
Bookmark and Share

Collection And Preservation Of Evidence

1. General Evidentiary Considerations

a. Accountability for Physical Evidence. EBSA investigations require the collection and preservation of evidence consisting of, but not limited to, plan records, company and union records, bank records, reports of interview (RIs), signed statements, and related workpapers.

To assure that the value of physical evidence is not impaired or destroyed, the Investigator/Auditor must ensure that the evidence meets the test of admissibility. To pass this test it must be positively identified as authentic, relevant, unaltered, and untampered with. In short, the Investigator/Auditor must be able to testify, under oath, that the particular document is one obtained in the investigation; that it has since been in the Investigator's/Auditor's personal or accountable custody; and that it has not been accidentally or purposely altered.

b. Federal Rules of Evidence. All Investigators/Auditors are expected to be generally familiar with the Federal Rules of Evidence, which appear in Public Law 93-595. Special attention should be devoted to Article VIII, "Hearsay," Article IX, "Authentication and Identification," and Article X, "Contents of Writings, Records and Photographs." Questions concerning evidentiary matters can generally be addressed to SOL.

c. Admissibility of Duplicates. Rule 1003 of the Federal Rules of Evidence provides:

"A duplicate is admissible to the same extent as an original unless: (1) a genuine question is raised as to the authenticity of the original or (2) in the circumstances it would be unfair to admit the duplicate in lieu of the original."

Based on this rule, in most situations, a copy of a document will be sufficient provided that the Investigator/Auditor is able to testify that the original of the document was obtained from a reliable source and that the document has not been altered during the time it was in the Investigator's/Auditor's possession.

d. Receipts for Books, Records, and Documents Obtained. When it is necessary to take possession of documentary evidence or property such as books, records, canceled checks, bank statements, receipt books, invoices, vouchers, letters, memoranda, or other materials provided pursuant to subpoena or furnished voluntarily by an organization or individual (even if only to photocopy and immediately return), the Investigator/Auditor will give the organization or individual a signed, itemized, and correctly dated Document Receipt, EBSA Form 220A for the material. A copy of the Document Receipt signed by the individual who gave the materials to the Investigator/Auditor will be retained in the case file.

Upon return of the described documents to the owner or responsible individual, the Investigator/Auditor will ask for the return of the original Document Receipt and have the party receiving the documents acknowledge in writing such return. EBSA Form 220B Return of Documents may be used for this purpose.

e. Custody of Evidence. In order to maintain a clear chain of custody of documentary evidence, original materials and duplicates described in (c) must be preserved in their original state in the RO/DO file. A History and Custody of Documents record, EBSA Form 219 will be prepared for all documentary evidence and maintained in the case file. See also Chapter 33, paragraph 13, for guidance related to subpoenaed documents.

Under the following circumstances, documents received during an investigation require additional safekeeping.

1) Documents Obtained from the IRS. Tax returns and return information received from the IRS pursuant to IRC section 6103 must be maintained in a secured manner. See Chapter 20, paragraph 7, for a discussion of how to handle tax returns and return information obtained from the IRS. Also see Chapter 12, paragraph 31.d., and EBSA Notice 97-2.

2) Documents Covered by the Right to Financial Privacy Act. The Right to Financial Privacy Act, 12 U.S.C. 3401 et seq. (RFPA), preserves the confidentiality of financial records while at the same time allowing access for legitimate law enforcement activities. Because there are certain prohibitions against giving the documents to others, including other government agencies, documents obtained pursuant to the RFPA should be segregated from other documents produced during the investigation. See Chapter 33, paragraph 14, for guidance on obtaining documents pursuant to the RFPA.

3) Documents and Information Obtained from the Grand Jury or During a Criminal Investigation. Caution must be exercised when handling parallel civil/criminal investigations. Criminal investigations cannot be used to produce civil evidence. Documents related to a Grand Jury investigation must be maintained in a secure place and may not be disclosed to anyone who is not entitled to access to the evidence under Rule 6(e) of the Federal Rules of Criminal Procedure (the 6(e) order). See Chapter 20, paragraph 8.b.; Chapter 33, paragraph 17; and Chapter 52, paragraph 22.

4) Materials for which a FOIA Exemption for Commercial Confidential Information Has Been Claimed. The Investigator/Auditor should identify materials that have been provided with a submitter's request for FOIA Exemption 4 protection. These materials should be maintained in a manner that will maintain their identity. In addition, the case file should be clearly marked that an Exemption 4 claim has been made. See Chapter 20, paragraph 4.c.

5) Confidential Complaints. Special procedures are necessary when an RO receives a confidential complaint. See Chapter 30, paragraph 4.

6) Working Documents. During the course of the investigation, the Investigator/Auditor may keep a set of "working documents," that is, a duplicate set of documents received which can be written on and rearranged in any order. These working documents should be destroyed when the investigation is completed and the ROI is written, unless there is a compelling reason to keep them.

f. Transmission of Evidence. All documents and other material, which are or may become evidence will be transmitted between offices in a secure manner, which will maintain a clear chain of custody. The transmittal memorandum will identify in detail the documents or other material so transmitted.

g. Investigative Documentation. This consists of the use and accumulation of completed or otherwise indexed and identified forms, ROIs, RIs, signed statements, exhibits, and other related documents as prescribed in other sections of this manual. All on-site record examinations will be recorded on Report of Records Examination, EBSA Form 202C. As noted above, original documents should not be altered in any way. When retaining copies of documents, each copy should be initialed and dated upon receipt by the Investigator/Auditor. The document should also be annotated to reflect the number of pages it contains.

h. Administrative Documentation. This is achieved by filing in respective investigative files all memoranda, letters, teletypes, and other written communications received. Any other instructions or administrative data received personally or by telephone will be recorded by handwritten notation, dated, and initialed by the recipient, or by dated memorandum by or to the RD, covering such details. Any action orally requested in a case by the NO, SOL, or other office will be so recorded in the case file.

i. Confidentiality of Information. Active case investigative information will be discussed with or made available only to personnel of EBSA, the Department, or under proper circumstances, to other governmental agencies. Circumstances under which material will be made available to other agencies are discussed in Chapter 20.

j. Recording the Dissemination of Investigative File Information. When any information in an investigative file is furnished to any recipient outside the RO by authority of the RD, either orally or in writing, a memorandum to that effect, including specific information and/or documents released, date of release and the initials of the employee releasing the data, will be made and placed in the file.

k. Multiple Copies of Investigative File Material. While Investigators/Auditors may make and use copies of documents, memoranda, exhibits, workpapers, or other related materials during the course of an investigation, these documents should generally be destroyed at the conclusion of the investigation unless there are compelling reasons to retain them. See Chapter 31, paragraph 5, and Chapter 33, paragraph 13.

2. Workpapers

From time to time, it is necessary for the Investigator/Auditor to testify in court or at a deposition concerning certain facts obtained during the investigation. When this occurs, the Investigator/Auditor must rely on the workpapers compiled during the investigation. Contemporaneous books, papers, accounts, letters, affidavits, notes, workpapers, spreadsheets, and like writings are regarded highly by the courts. What witnesses say long after an event has occurred may not be nearly as persuasive as what they said in writing at or near the time the event occurred. For review, operational, and management purposes, it is necessary that the Investigator/Auditor maintain uniformity in the steps and procedures utilized in the systematic presentation or storing of records and financial data examined during the investigation. This applies to all materials which form the basis of reports produced by the Investigator/Auditor.

a. Basic Role of Workpapers. The investigative workpapers serve as a connecting link between the Investigator's/Auditor's report and the underlying financial and other data which led to the findings contained in that report.

b. Purposes of Workpapers. The investigative workpapers serve a number of necessary purposes such as:

1) Preservation of Significant Facts and Relationships. Unless these matters are set down in writing when observed, they are likely to be forgotten before they can be properly appraised in the light of information disclosed by other phases of the investigation. As each phase is completed, the workpapers are filed, expanded, and supplemented as additional information is obtained.

2) Preparation and Verification of the Report of Investigation. The workpapers should substantiate and explain the facts and recommendations included as well as justify the findings in the report.

c. Design of Workpaper. There are any number of workpapers including schedules and spreadsheets that may be used by an Investigator/Auditor. When establishing the design of the workpaper or schedule, the Investigator/Auditor should determine its adequacy by testing it to see if it will accomplish the desired purpose. Otherwise, much time can be lost through "false starts" resulting from hasty use of untested workpapers or schedules.

d. Types of Workpapers. Figure 1 is a listing of some categories of workpapers, illustrating the natural flow of the investigation and the sequence of indexing/referencing of workpapers.

e. Workpaper Preparation

1) Workpapers should be neat, legible, and orderly in appearance. It is best to use only commonly understood abbreviations. Generalities and unsupported conclusions should be avoided and all comments and exceptions should be factual. Final disposition of all exceptions and questions should be stated.

2) Each page of each workpaper should be initialed by every Investigator/Auditor working on it and the date of the work should be indicated. This is important in fixing the responsibility for work and in showing the sequence in which work was done and the date of completion in case questions are raised later. In addition, each workpaper should include the source. Including the source allows the reviewer to follow the investigative trail to the original source documents.

3) All workpapers and schedules should be indexed, and related workpapers and schedules should be carefully cross-referenced. Unless the supervisor gives directions to the contrary, each Investigator/Auditor will select the method of indexing so long as the method is used consistently throughout the workpapers. The purpose of indexing is to make the finding of data in the workpapers easy and to show the interrelationship of related workpapers.

4) The following rules must be observed in the preparation of schedules:

a) Each schedule should provide for an analysis or summary of the data making up the item and should describe the audit steps performed in determining the reliability of the information.

b) Each schedule should be complete and understandable in itself. This rule is directed at saving the time of the reviewer and at ensuring that schedules contain sufficient information to constitute effective evidence of the work done. To be complete and understandable, the schedule should have a complete title of the information analyzed or of the test being applied, the source of the data used, and the date or period covered by the test. Any test procedures applied should be described in terms of their nature and extent, including methodology employed.

c) The interrelationship between schedules is illustrated by the following example: If, in making an analysis of the balance of the accounts receivable account, it is determined that certain accounts must be written off as uncollectible and charged against the "provision for doubtful accounts" (or the "reserve for bad debts," as it is still commonly called), a cross-reference should be made between related schedules so that the reviewer can follow the relationships. Likewise, a word of explanation should be included on the reserve for bad debts analysis indicating that the entry ties into the accounts receivable schedule. The reviewer has a complete explanation of the adjustment and an identification of the related schedule, which may be examined to determine how it has been taken into consideration.

f. Control of Workpapers. Workpapers and supporting documentation should be secured whenever an Investigator/Auditor leaves his or her work area. The extent of such security measures is that considered necessary in light of existing circumstances in the judgment of the Investigator/Auditor.

g. Screening and Storage of Notes and Workpapers. After the ROI has been prepared and approved, all relevant original workpapers prepared by the Investigator/Auditor during the course of the investigation should be retained with the case file. (This workpaper file may be used at a later date to refresh the Investigator's/Auditor's recollection as a trial witness). The Investigator/Auditor should exercise care to ensure that no personal memoranda or other extraneous notations are included among the workpapers.

3. Case File Arrangement. Evidence collected should be filed in an orderly, retrievable fashion and in accordance with RO case file procedures.


(Figure 1)

Listing Of Some Categories Of Workpapers

Employee Health and Welfare Benefit Funds

  1. Contributions
  2. Payroll Audits
  3. Bonding
  4. Premium Deposits and Refunds
  5. Insurance Premium and Related Liabilities
  6. Claim Payments
  7. Liability for Claims
  8. Liability for Accumulated Eligibility Credits
  9. Actuarial Reports
  10. Restrictions on Fund Balance and Contingencies
  11. Administrative Expenses
  12. Other Audit Considerations
    1.  Review of tax returns
    2.  Collective bargaining agreements

Pension Funds

  1. Contributions
    1.  Multiemployer Funds
    2.  Single Employer Funds
  2. Payroll Audits
  3. Bonding
  4. Investments
  5. Assets held by an Insurance Company
  6. Actuarially Determined Present Value of Accrued Benefits
  7. Benefit Payments
  8. Administrative Expenses
  9. Other Audit Considerations
    1.  Review of tax returns
    2.  Collective bargaining agreements

The list illustrates how easily the program may be expanded or contracted as deemed necessary in the judgment of the Investigator/Auditor.