5wh Logo

Forensic Services                                                                   5wh Investigative Reports Guide

Investigative Reports of Factual Findings


  1. Overview
  2. Purpose and Importance of Reports
  3. Planning and Writing Reports
  1. Final Reports

1  Overview

This manual relates to our investigative reports. The manual provides guidance necessary to write a clear and concise investigative report. The following is discussed in this manual:

    • Purpose and Importance of Reports
    • Planning and Writing Reports
    • Final Reports

2  Purpose and Importance of Reports

  1. The results of all completed investigations together with conclusions and recommendations are expressed in written reports. The purpose of a report is to present all pertinent facts relating to a matter in order to support appropriate action to be taken.
  2. To have value, a report must be written so that the reader comprehends the full significance of its contents, is convinced of its thoroughness, and is willing to take action based on the facts presented.
  3. It is an official document and may not be furnished to any person outside 5wh without proper authorization. In a criminal investigation, a report ultimately serves as the basis for the preparation and presentation of the investigation for trial.

3  Planning and Writing Reports

It is not an easy matter to write a report which will clearly convey the essential facts disclosed as the result of an investigation. Report writing is an art which requires study, practice, and persistent effort. Since there are no hard and fast rules uniformly applicable to reports, investigators must use their experience and common sense to develop the facts necessary to support complete reports. The essentials of a good report are fairness, accuracy, completeness, uniformity, conciseness, and logical presentation.

3.1  Fairness

  1. Reporting the facts with fairness is as important as procuring them with impartiality. An investigator should always be an unbiased fact-finder and not partisan to a particular cause or action. All material facts and evidence should speak for themselves and require little or no explanation of their significance. Any distortion of the significance of the evidence materially diminishes the value of the report.
  2. The subject’s explanations should be presented fairly. When an investigator quotes, he or she should quote exactly. Hearsay and rumours, properly identified as such, may be included in the report, but only if relevant and material to the matter being discussed.
  3. Reports should reflect an impersonal attitude and should contain no offensive remarks regarding the subject.

3.1.1  Accuracy

  1. Reports are the basis for administrative and legal actions of the utmost importance, including the assessment of substantial amounts of penalties or damages and/or criminal action which may result in imprisonment. Accuracy is essential, therefore, facts must be reported with exactness.
  2. The writer should present facts in such a manner that he or she will not have to state opinions and conclusions except in the portion of the report provided for that purpose.
  3. The distinction between fact and opinion should be clearly shown when it is necessary to explain the theory of investigations based largely on circumstantial evidence. Avoid using statements such as: “The suspect could give no plausible explanation”. That is a conclusion, and others may find that the explanation is plausible. State what the subject said and let the evidence show whether the statement is worthy of belief.
  4. Avoid the phrase “conclusively proved”. Do not allow conclusions to surpass the evidence. A conservative statement that is consistent with the facts is stronger than an exaggeration. Exaggerations tend to raise doubt against all the evidence presented in the report.
  5. Inaccuracies, carelessness in detail, errors in computation, and incorrect dates materially affect the value of a report. Discrimination in the choice of words, punctuation which clarifies the meaning and a correct application of the rules of grammar are essential to accurate reports. Errors in these essentials have an unfavourable effect on the mind of the reader.
  6. Avoid using slang and technical terms, including those used in accounting. However, in some instances, slang terms may be necessary for clarity in reporting the results of investigations. In such instances, the meaning of the term should be explained when it is first used in the report. For example, it may be advantageous in a report concerning digital/computer crime to describe the nature thereof, including the technical terms used therein, before presenting evidence of the violation[1]. If numerous slang or technical terms are necessary, it may be advisable to prepare a glossary.

3.1.2  Completeness

  1. An investigator should present the material in a report from the viewpoint of a reader having no knowledge of the investigation. The investigator must exercise good judgment in selecting the facts that are material to the matter and take care that nothing essential to a complete understanding of the investigation will be omitted. All statements of material facts bearing on the proof of alleged violation should be supported by the evidence necessary to establish its truth and accuracy. The source of the evidence should also be reported.
  2. Likewise, explanations from the subject and important facts developed by the investigation that point to weaknesses in the investigation should not be omitted. Subsequent disclosure of facts indicating weaknesses that were known to the report writer reflects unfavourably on him or her. Moreover, any weaknesses in an investigation should be made known before action is taken relative to criminal prosecution or settlement of the civil liability in order to prevent surprise in the course of conferences or legal actions and to give reviewers an opportunity to suggest means of overcoming the weak points.
  3. However, speculation and conjecture of investigators concerning possible defence theories have no place in a factual report. The reader is primarily interested in knowing what happened and how the events can be proved. The difficulties met by the investigator in securing the information, or in the ingenuity used in making the investigation, are of no interest.
  4. The writer should always remember that the report is about a violation or other obscured situation and not about the investigation. However, where certain pertinent evidence was not obtained, the investigator should state the avenues of inquiry pursued in attempting to procure the evidence in order that no doubts may arise in the reader’s mind regarding whether the investigation was thorough.
  5. Important matters in exhibits generally should be narrated briefly in the report unless the exhibits are adequately described in an appendix and do not require any further explanation. The use of an appendix is discussed in Sub-section 3.5 below.
  6. Finally, in order to ensure completeness, the report should be read and revised as often as necessary before it is submitted for review. An investigator should strive to submit a report in final form for initial review. The investigator should not rely upon reviewers to complete the report by resolving the difficulties encountered in the investigation.

3.1.3  Uniformity

Reports should be as uniform as possible for each type of investigation investigated. An investigator in one area should report the results of an investigation in the same sequence as an investigator in another area who has conducted an investigation of the same type. In order to promote uniformity, Section 4 below contains suggestions for guides in report writing.

3.1.4  Conciseness

  1. Conciseness suggests the removal of all that is elaborate or not essential. If a report contains a mass of irrelevant data, the important matters will not be clear to the reader.
  2. When you have something to say, say it in as few words as you can. The rule of conciseness applies to individual sentence construction as well as to the whole report. Repetition and unnecessarily lengthy descriptions of documents should be avoided. It is not necessary to copy into the report entire statements, letters, and exhibits when concise reference to the principal points and brief explanation will suffice.
  3. Tabulations and schedules in the form of appendices to the report frequently may be used to reduce narrative and emphasize important facts relative to matters such as schedules, summaries of net worth or omitted sales and analyses of bank accounts, etc.
  4. An investigator should not indulge in attempts to use wit or sarcasm. The designations, ‘the undersigned’, ‘the writer’, or ‘your investigator’ should be avoided. Do not hesitate to state, “Mr Mubi Mukuru informed me that…”, or “He gave me (documents or books)……”, if that information is material. However, in view of the necessity for maintaining an impersonal attitude, the personal pronouns “I” and “we” should be used sparingly.
  5. Avoid superfluous statements such as: “The following report is submitted..”, or “…as the result of investigation, I have to report as follows…”. The phrase, “This investigation relates to an investigation of alleged fraudulent activities by John Jones” may be better stated as, “This report relates to the alleged fraudulent activities of John Jones”. “The statement attached hereto as Exhibit 6 is an affidavit of John Jones wherein he testified. . .”, contains unnecessary words. Merely say, “John Jones stated that. . .(Exhibit 6, affidavit)”. Avoid trite and superlative phrases, and use the word “very” only on rare occasions.
  6. Use of the active voice promotes conciseness and accuracy in writing. It is also more forceful. For example, the statement, “Information obtained from Mr. Witness disclosed that the proceeds of the sale were given by him to the suspect on 14 May 2011”, may be reduced in length and made more forceful by revision to, “Mr. Witness said that he gave the proceeds of the sale to the suspect on 14 May 2011”. Use of the active voice also will eliminate the possibility that the report writer will omit stating who gave the proceeds to the suspect.

3.1.5  Logical Presentation

  1. A report otherwise well written may lose its effectiveness for want of logical arrangement. A mass of data thrown promiscuously into the report is an imposition on the reader and an adverse reflection upon the writer. Effective presentation is largely dependent upon adherence to the principles of style, namely unity, coherence, harmony, and emphasis.
  2. The principle of unity requires adherence to the single main idea or proposition and exclusion of all matter that does not tend to prove that idea or proposition. Each sentence, paragraph, and division should help to establish the main point of the report.
  3. Coherence is defined as sticking together. This principle counsels logical sequence of thought. No one is likely to achieve coherence by chance or inspiration. It demands careful planning, critical review, and frequent revision by the report writer. Words, phrases, and clauses should be so placed in a sentence that their relationship is clear and the meaning of the sentence is obvious.
  4. Sentences should be so arranged so that the progress of thought is clear and continuous from beginning to end. Each paragraph must bear an unmistakable relation to the whole composition, especially to the paragraph immediately preceding it.
  5. The most common fault in the presentation of evidence is the failure to show precisely what part it plays in the whole argument. This failure is sometimes due to the fact that secondary matters are not properly subordinate to the principal facts. Much evidence has only a casual connection with the main proposition, but the connection must be made evident. If the bearing of the evidence is not felt at the point where it is presented, it usually is not felt at all. Each violation, event, or circumstance, and all facts in support thereof should be narrated in full before passing on to the next feature of the report.
  6. Phrases and sentences which merely introduce an exhibit may interrupt the reader’s train of thought. In many instances, that difficulty may be avoided by parenthetical insertion of exhibit numbers during discussion of the contents of the exhibit. Insofar as possible, references to other sections of the report should be avoided because the arrangement of the report will show the relationship between the various facts and events.
  7. Emphasis requires careful placement of words, phrases, and sentences for the purpose of calling attention to the important facts. If the writer does not emphasize the more significant information, the reader will not retain the essential facts.
  8. Important words or phrases should be placed in important positions, usually at the beginning of a clause or sentence, or at the end. The same rule applies to the arrangement of sentences within a paragraph. A new topic or idea should be the subject of a new paragraph. A sentence or short passage requiring special emphasis may be paragraphed separately. Important matters can be emphasized by using concrete terms and terse sentences, by numbering and indenting a series of important and related facts, and by using schedules and tabulations. The last mentioned technique is particularly valuable in showing comparisons.

3.2  Planning the Report

  1. Before an investigator starts to write a report, he or she should have in mind a definite outline of the arrangement in which the facts and evidence may be presented in the most effective manner. The best arrangement rarely is the order in which the facts were developed during the investigation.
  2. A good general plan is to-
    • state the problem,
    • present the results of the investigation, and
    • set forth the conclusions and recommendations.
  1. Details under the various headings should be arranged in paragraphs, each confined to a particular topic. An investigator may use the method of assembling the facts and evidence into a coherent and logical presentation which he or she finds most effective. Keep in mind the witness who will produce, identify, and/or testify about each item of evidence. The use of either an outline or an arrangement based on appendices and exhibits is suggested to assist in assembling material for the report.
    1. In using the above method, prepare an outline of the topics or events considered essential to prove the violation, or, with respect to reports not relating to violations, to accomplish the purpose of the report. List under each topic the pertinent facts and evidence. New investigators may find it helpful to list the evidence in detail. The amount of detail can be reduced with the acquisition of experience and facility in writing reports. When the outline is finished, study it and make any revisions necessary to ensure compliance with the principles of completeness, conciseness, unity, coherence, and emphasis. Since each topic ordinarily will be the subject of a paragraph, the investigator can direct his or her attention to the writing of each paragraph on the basis of the topical outline.
    2. In lieu of an outline, effective presentation can be accomplished by arranging appendices, exhibits, and work papers in logical order based on the above-mentioned principles of good writing and discussing each fact and event in that order. Consideration also should be given to the order desirable for presentation of the evidence in court.
  2. One of the first steps in getting ready to write a report regarding a fraud investigation is to prepare the summaries of the major findings and supporting schedules.
  3. In investigations based on specific items, the criminal items should be segregated from the civil items. The civil items are technical adjustments based upon:
    1. Mere clerical errors.
    2. Mistaken ideas relative to some regulation or policy requirement.
    3. Adverse decisions on controversial questions.
    4. Erroneous legal or accounting advice on which the subject honestly relied.
    5. Items which the subject is unable to substantiate.
  4. When appropriate, technical adjustments should be grouped into summary topics. With respect to criminal investigations, the investigator should determine before beginning the report which criminal items are to be proposed for use in the criminal proceedings and whether there are any technical adjustments favouring the subject that should be offset against the total potential prejudice.
  5. During all stages of an investigation, from planning the investigation through conducting a final review of the report, the investigator should be familiar with the expectations of the manager and other reviewers of the report.

3.3  Reports on Related Investigations

  1. As a general rule, a separate report shall be written for each investigation. However, if the facts and events concerning two or more related suspects or investigation classifications are the same or are intermingled, the results of the related investigations shall be set forth in the report regarding the principal violator or classification. For example, when an investigation discloses evidence of fraud by a company and its principal officers, the report on the CEO of the company may serve as the focal point for assembling and presenting the facts and evidence regarding all the players involved, including the company.
  2. When consolidating two or more suspects in one report, consideration should be given to ensuring that a sound basis for a joint trial exists. The absence of evidence of a conspiracy to commit crime, lack of a common crime to be charged, problems of place of occurrence, or other factors may indicate that the suspects are entitled to separate trials. If so, separate reports should be written with duplication of exhibits where appropriate.

3.4  Format of Reports

Reports shall be addressed to the person(s) who engaged us.

3.4.1  Subject

The subject of the report is the headline. Your headline should be a brief statement of the most important or vital fact of your report.

3.4.2  Assembly of a Report

  1. A report should be assembled in the following manner, although it is recognized that all reports will not include each of the listed parts:
    1. Transmittal letter
    2. Table of Contents.
    3. Body of Report.
    4. List of Witnesses and Exhibits.
    5. Appendices.
    6. Exhibits.
  2. The page number, in the form page x of y, shall be on the right at the bottom of each page.

3.4.3  Identification of Principals, Witnesses, Etc.

The names of the targets of the investigation[2] will be typed in capital letters when appearing for the first time in the report of investigations as well as in correspondence relating to investigations.

3.5  Appendices and Exhibits

  1. In investigations involving detailed computations, bank transactions, or expenditures, or numerous fraudulent items, clarity in reporting may best be accomplished by presenting the details in appendices and including in the body of the report only brief summaries thereof, together with a general discussion of the related evidence.
  2. Narrative in the report may be reduced by including on the appendix, in addition to the pertinent figures, a brief description of each item, a reference to exhibits containing the documents supporting each item, and the name of any witness who will produce documents and testify regarding each item.
  3. It is not necessary to discuss in the body of the report each item on the appendix. However, the report shall contain a description of the appendix; a brief summary or restatement of totals, if such is applicable; and an explanation of any significant particulars or details that are not made evident by inspection of the appendix.
  4. Since appendices are essential to a complete understanding of any investigation wherein they are used, they shall be typed or reproduced in sufficient quantities for inclusion with each copy of the report. With respect to investigations involving the tabulation of numerous items which can be assembled into groups, a clear and concise presentation may require placing on the basic appendix only the total amount for each group and tabulating the items comprising the group on supporting appendices or schedules.
  5. The appendices should be attached as part of the report and should be listed in the table of contents.

3.6  Exhibits

  1. Exhibits are an essential part of a report. They may consist of originals or copies of statements and documents, such as:
    1. Affidavits
    2. Transcripts of interviews
    3. Contemporaneous memorandums
    4. Vouchers, such as cancelled cheques, invoices, receipts, etc.
    5. Bank records
    6. Books of account
    7. Transcripts or analyses of accounts and records and related workpapers
  2. When it is not feasible to provide extra copies of exhibits consisting of cheques, invoices, bank records, account books, long detailed transcripts, and similar documents, the control file which is retained at the office should include a copy of each exhibit if such is available. Original documents not easily retrievable, such as affidavits, memoranda of interview, and workpapers, should be maintained in the investigation control file with a copy of the report. Only copies of these documents should be used or included with the report to prevent the loss of these records.
  3. The body of the report should contain reference to the exhibits and appendices, and the appendices should contain reference to exhibits which consist of supporting documents. Such reference may be to individual exhibits or groups of related exhibits. For example, the report may state; Appendix A is a summary of the unreported receipts from sales, and Exhibits 8 through 25 are copies of documents in support thereof, including cancelled cheques, invoices and affidavits.
  4. Important matters in exhibits generally should be explained in the report. However, in many instances, documents, such as invoices, cheques, and other vouchers require only a brief description. If a document of that nature is adequately described on an appendix, no further explanation may be necessary.
  5. When mentioning or referring to a document that is submitted as an exhibit, including the written statement of a witness, insert the exhibit number in parentheses immediately following the reference. In most instances, it is unnecessary to state that the document is submitted as Exhibit 1. The page, paragraph and line numbers should be included when citing multi-page exhibits.
  6. Appendices and exhibits are bolded (thus Appendix A or Exhibit 1) the first time they are mentioned in the report so the reader will know when he or she sees an exhibit or appendix whether it is being discussed for the first time or has previously been referred to.
  7. It is suggested in Sub-section 3.2 above that the investigator, before beginning a report, arrange the proposed appendices and exhibits in the order of planned presentation of facts and evidence, and that he or she prepare the report by discussing the appendices and exhibits in that order. In many instances, the investigator will find it necessary to rearrange those documents for a more effective presentation.
  8. When the report is completed, the exhibits should be assembled in the order in which they are originally mentioned in the report, and they should accordingly be numbered for easy reference. If a number of documents, such as cancelled cheques, are included in one exhibit, give each document a sub-exhibit number. For example, if Exhibit 11 consists of 16 cancelled cheques, the cheques should be numbered from 11-1 to 11-16, or the page should be numbered if multiple cheques are exhibited on a page.
  9. Each exhibit should be properly authenticated. The exhibits may be assembled in binders, put in folders, or any other method which is practical so long as the exhibit is identified so it can be associated with the pertinent folder should it be removed. Index tabs may be used to facilitate reference.
  10. The report should include a list of exhibits containing the number and a description of each exhibit. It is suggested that a copy of the list of exhibits be mounted immediately under the cover sheet for the exhibit file itself. This will eliminate having to use the investigator’s report as the index.
  11. Where the statement of a witness or subject is lengthy, it may be helpful to prepare a synopsis of the important answers and attach this as a cover sheet to the exhibit. The summary should be quite brief, desirably not more than one line for each point and should be referenced to the appropriate question or page and line numbers.

3.7  List of Witnesses

  1. The list of witnesses is an essential part of a report on a criminal investigation. It is especially important to the public prosecutor and to any investigator, e.g. the police officer, who assists in the preparation of the investigation for trial, particularly in instances where the investigator who conducted the investigation and wrote the report is not available. The list of witnesses frequently is used by the public prosecutor as the basis for issuing subpoenas.
  2. The witnesses should be listed in the order in which they are mentioned in the report. The name, address, telephone number, and title or other identification of each witness should be set forth, together with a reference to any exhibit or appendix that is pertinent to his or her testimony and to the records and other evidence he or she may be expected to produce or identify. The use of such references will eliminate the need for a summary of each witness’s probable testimony as part of the list of witnesses.
  3. In some instances it may be necessary to list one witness who will produce and identify certain records and another who will testify relative thereto. Listing the name of a person who can be expected to appear as a witness is preferable to showing only the name of a company, bank, or other organization, especially where an individual has custody of records or has an intimate knowledge of the records and transactions involved.
  4. The investigator may prepare the list of witnesses as the report is written. The use of appendices containing names of witnesses and the procedure of capitalizing names of witnesses, as explained in 3.4.6 above, will assist in the preparation of a complete list of witnesses. When the report has been written, the investigator should review the facts and evidence to determine whether a witness has been listed for each item of evidence.

3.8  Table of Contents

A table of contents showing subject matter and page numbers should be submitted with any report exceeding ten pages. It should be designed to provide quick reference to important features of the investigation, and the amount of detail will be determined by the length of the report and the circumstances of the investigation. Any appendices to the report should be listed and described in the table of contents.

 4   Final Reports

  1. This Section relates to reports on investigations relating to fraud and miscellaneous criminal law violations. The following suggestions and samples are provided, not as inflexible rules which must be followed in all reports, but as guides to assist investigators in writing reports.
  2. Whenever a prosecution recommendation is contemplated, the investigator should discuss findings and proposed recommendations with the immediate superior prior to preparing the final report. The investigator should obtain the superior’s opinion as to the sufficiency of the investigation conducted.
  3. In writing the report, the investigator is responsible for using clear and correct language, for its mathematical accuracy, for proper descriptions of each exhibit and for presenting all material facts in an impartial manner. An experienced investigator is expected to attain report writing proficiency which will permit him or her to submit reports in final typed form to the superior for review and processing.

4.1  Report of Factual Findings

  1. In many cases the report is a witness-oriented report. Thence, witnesses are numbered chronologically as they are introduced, thus W1, W2, W3, and so forth. Each exhibit pertaining to a given witness is likewise numbered chronologically. For example, the exhibits relating to witness number 3 would be designated as W3-1, W3-2, and W3-3.
  2. The pertinent facts and circumstances of the investigation should be thoroughly discussed in the narrative and fully documented with appropriate witness-exhibit references.
  3. As pointed out in Sub-section 3.6 above, the exhibit reference should be bolded and explained the first time it is mentioned in the report in order to facilitate review and pre-trial use of the report. Subsequent references to the exhibit should not be bolded or explained.
  4. The report has a standard format (see Annexure A), but additional sub-headings may be used to add clarity to the report and facilitate review. Additional sub-headings should be used liberally to highlight any significant issues.
  5. The report makes maximum use of appendices which may eliminate the need for a detailed explanation of each of the supporting exhibits and minor details of the investigation. When appendices are used, each should contain complete references to all relevant testimony and documentary evidence.
  6. The report contains, when necessary, details of the investigator’s recommendations and a reconciliation of the civil and criminal adjustments.
  7. Annexure A is the standard form of a Report of Factual Findings.

[1] The term ‘violation’ is used in this manual to denote both criminal acts and civil wrongs in terms of the laws of Zimbabwe.

[2] The term ‘target of the investigation’ is used interchangeably with the term ‘suspect’.


What do you think? What strategies do you, or your company, use to manage the risk of fraud and error in your organisation? Are you primarily proactive or reactive in your approach to risk management? Share your experience in the Comment box below.

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s