When an internal fraud case collapses, the reason is rarely that the facts were wrong. More often the evidence could not be relied upon. Emails were copied by a well-meaning manager, database logs were exported without a record of who touched them, or CCTV footage was overwritten before anyone secured it. This article sets out a practical approach to fraud investigation evidence preservation under the SAMA Counter-Fraud Framework (SAMA CFF), written for fraud managers, internal audit heads and legal counsel at Saudi banks and payment firms.
A note on references: the SAMA Counter-Fraud Framework expects institutions to investigate fraud in a way that supports disciplinary, regulatory and legal action. The four steps below describe how that expectation is normally met in practice. Confirm the exact article wording against the current framework text with your legal counsel before relying on it in a formal procedure.
Why chain of custody decides the outcome
Chain of custody is the documented, unbroken record of who collected evidence, how, when, and who held it afterwards. If that record has gaps, the other side can argue the evidence was altered, planted or incomplete. The consequence is practical: a disciplinary decision may be overturned, a referral to authorities may be weakened, and the institution may be unable to show it acted properly.
The risk is highest in the first hours. Staff under suspicion may still have system access, logs rotate, devices get reassigned, and well-intentioned colleagues start looking through mailboxes. Preservation has to come before analysis.
Step 1: Forensic imaging with hash verification
Never work on the original. Take a forensic image of each relevant source, such as a laptop, mobile device, mailbox, server volume or database extract, using write-blocking where the source is a physical device.
Then compute a cryptographic hash of the original and of the image, and record both values. Matching hashes demonstrate that the copy is a faithful, unaltered duplicate. Re-compute the hash whenever the image is moved or reopened, and note the result.
Typical gaps:
- Files dragged and dropped to a shared folder, which changes metadata.
- Screenshots used in place of exports, with no source record.
- Hash values calculated but not written into the case record.
- Log and CCTV retention windows not checked, so material is lost while approvals are pending.
Step 2: Access logs for every examiner
Every person who handles evidence should be recorded: name, role, date and time, purpose, and what they did. This applies to the forensic examiner, but also to the IT administrator who helped retrieve a device and the manager who handed it over.
Work should be carried out on copies of the verified image, never the master. Keep the master untouched and log any occasion it is opened. Limit access to named individuals, which also protects confidentiality and the integrity of the investigation if the subject is a senior employee.
Typical gaps:
- Informal handling by line managers before the investigation is formally opened.
- Shared examiner accounts that cannot show who did what.
- No record of why an examiner accessed an item.
Step 3: Tamper-evident storage
Store master images and physical items so that any interference is visible. In practice this means:
- Sealed, uniquely numbered tamper-evident bags or containers for physical media.
- A locked, access-controlled location with entry records.
- For digital masters, restricted storage with access controls, logging and integrity checks against the recorded hash values.
- A written retention rule, so evidence is neither destroyed early nor kept indefinitely without reason.
Label each item with a unique reference, a description, the source and the collection date, and tie that reference to the case record.
Step 4: Documented handover to legal or regulatory authorities
Evidence often leaves the investigation team: to internal legal counsel, to external lawyers, to SAMA, or to law enforcement. Each transfer needs a signed record showing what was handed over, the item references and hash values, who released it, who received it, and when. The receiving party should confirm the hashes on receipt.
Record the purpose of the handover as well. If a copy is released and the master retained, say so. A clean handover record closes the chain and lets counsel present the evidence with confidence.
Building the evidence file as you go
The four steps work best when they produce one consolidated record rather than four separate ones. A well-kept evidence file normally contains:
- An index of every item with its reference, source and hash values.
- The collection record for each item.
- The examiner access log.
- Storage and movement records.
- Handover receipts.
- A short note of decisions taken, such as why one source was imaged and another was not.
Review the file at the end of the case as if you were an opposing party. Any unexplained gap is a gap someone else will find.
Decisions to make before the next case
Fraud investigation evidence preservation is much easier when the decisions have already been made. Agree in advance who has authority to order a preservation hold, which systems have log retention long enough for an investigation, who may handle evidence, and how legal counsel is brought in. Test the process on a small scenario, such as a single mailbox and a set of transaction logs, to find where it breaks.
Independence matters too. Where the subject is senior, or where the control owner is also a witness, an independent investigator reduces the risk of challenge.
How we can help
Our Fraud Investigation and Forensic Accounting service is an independent investigation of suspected internal or external fraud, with evidence handling suitable for disciplinary, regulatory and legal action. The work follows four stages: contain, analyze, establish and report. The first stage covers scoping, preserving evidence and protecting the investigation. Later stages cover transactions, records and digital evidence, then interviews and fact-finding, then findings, root cause and recommendations.
The deliverables are an investigation report, an evidence file and recommendations to prevent recurrence. On confidentiality, access is limited to named people and every piece of evidence has a recorded chain of custody. On timing, we usually start within one to two business days of engagement, and faster for urgent cases.
If you are facing a suspected case now, or want to test your preservation procedure before one arises, speak to our team about Fraud Investigation and Forensic Accounting.
