When data analytics confirm an active fraud event, internal auditors transition from standard system testing to formal forensic investigation protocols. This phase requires structured interviewing techniques and strict compliance with legal chain-of-custody standards to ensure collected evidence remains admissible in court.

[Secure Raw System Mirror Backups] ──► [Run Analytical Forensic Audit] ──► [Execute Information Interview]

Forensic interviews move through a planned timeline, starting with informational and exploratory questions to establish a operational baseline before moving to confrontational questions once evidence is confirmed. The investigator tracks non-verbal behavioral cues, monitors for logical inconsistencies, and uses structured disclosure steps to present evidence to the subject.

Simultaneously, all digital and physical evidence must be logged in a chain-of-custody register:

Evidence Record = Device Serial ID + Secure Hash Value + Custodian Signature Timeline

This tracking maps every individual who accessed, transferred, or analyzed the evidence, protecting the asset from contamination or challenges during litigation.