Use project management processes for forensic examination

On Tuesday, February 12, I delivered a presentation to the Inland Empire chapter of Project Management Institute (PMI). The title of the presentation was, “The forensic examiner is a project manager.” The essence of the presentation was applying project management skills and techniques to a forensic examination. This essay is focused on forensic document examination as this is the discipline I practice.

A project is defined in the Guide to the Project Management Body of Knowledge Fifth Edition as, “A temporary endeavor undertaken to create a unique product, service, or result.” Each case worked by a forensic document examiner is unique. The result is an opinion and/or a report describing the methodology used to culminate in the opinion.

A forensic examination follows the project management process groups. The examination project must be initiated, planned, executed, monitored, and controlled, then finally closed.

A forensic examiner is essentially a detective. They apply project Management tools and techniques to examine the evidence to learn what the evidence says. It is often in an iterative process as an initial examination may uncover new evidence that needs to be explored.

Initiate the project

The examination is initiate by a client’s request for services. Initiation is formalized by receiving a retainer agreement and payment of the retainer or for internal examinations, by receiving a service request from the requesting agency.

Typically at project initiation, the initial evidence is received from the retaining party. The evidence is the questioned document and contemporaneous exemplars. Typically, contemporaneous exemplars are produced when handwriting or signatures are being compared. In the case of potentially altered documents, the original document is usually required for the examination.

Once the evidence is received by the forensic examiner, the examiner determines whether the evidence is sufficient in quantity and quality to perform the work of the project. The evidence is both sufficient and the forensic examiner can perform the work, the planning process group is started. In the PMBoK Guide, the process groups do overlap. Therefore, planning the project may be started before completing the project initiation phase.

Plan the project

In planning the project, all stakeholders must be identified and understood. The primary stakeholders in a forensic examination are the requesting party, often an attorney or government agency. Other stakeholders are the requesting party’s client, the opposing party and their attorney, and people and organizations associated with the primary stakeholders. For the forensic examiner, the real stakeholder is the evidence since the examiner is a neutral party in the case. Although the examiner is hired by one side in a legal matter, the examiner’s loyalty is to the evidence.

Each stakeholder may have a different stake in the outcome of the examination. My experience as a private examiner has been the retaining attorney has a desire to know the truth shown by the evidence. The attorney’s client has a desire for the evidence to support their theory of the case. The forensic examiner’s communication is typically only to the retaining attorney or agency. If the case goes to deposition, trial, or arbitration the forensic examiner will communicate with other parties. If the question is about the authenticity of the document owned by the attorney’s client, it may be necessary for the examiner to communicate directly with the attorney’s client so the attorney’s client can state directly their knowledge of the authenticity of the exemplars used for comparison with the questioned document.

Once the stakeholders are identified and interviewed and the evidence is received, the project scope must be defined. Both the in-scope statement and out-of-scope statements are beneficial to focus the examination.

The next step is determining the requirements for the project. PMI defines requirement as, “A condition or capability that is required to be present in a product, service, or result to satisfy a contract or other formally imposed specification.” Some requirements may be knowing how the evidence will be collected, determining whether the evidence is sufficient to perform the examination, meeting mandatory milestone dates, etc. All participants for the examination team must be identified. This is especially true when specialists were required.

The plan also must identify necessary communication and how communications are to be managed and effected among stakeholders.

Execute the project

Once the requirements are defined, the schedule and budget are set, in the project team is in place, the project can be executed. The execution includes all activities to collect and examine the evidence. For a forensic document examiner, this means conducting a detailed analysis of the document in question, and if there is handwriting to be compared, learning the details of the known exemplars.

Execution of a forensic document examination project requires proper examination of both the questioned and known documents. Often this includes using a microscope to look for details of the document and writing. For printed documents, it may include observing details about the font used to print, the manner in which the toner is laid down on the document, the type of printer used to print the document, and other attributes. The forensic examiner must have access to all necessary tools to perform the work. Sometimes, this requires outsourcing to a laboratory that has the specialized equipment, or a specialist such as an ink chemist or paper chemist.

Executing the project also includes creating demonstrative exhibits showing how the work was performed and the results of executing the project.

Proper project execution requires communication between the forensic examiner in the retaining party.

Monitoring and controlling the project

As the project is being executed, the results of each task in the execution are examined to determine whether there was sufficient data to perform the work. The examiner must determine whether the task was complete and close that task or whether the task must be marked as incomplete followed by a request for whatever materials or personnel are necessary to complete the task.

A method I use is putting the project aside for a few days and moving on to other projects. Upon return to the project, is important to determine whether the results of revisiting the work and the work product are the same or different. Viewing the project with a fresh set of eyes is important to discover whether the evidence was misinterpreted or overlooked.

An aspect of executing and monitoring the project is often a requirement to revise the project plan as new knowledge is learned during project execution. This may cause refining the scope of the project as new details are uncovered.

Closing the project

The forensic examiner will report the results of the examination to whoever retained the examiner to perform the work. Depending upon the requirements, the report may be required if the results of the examination support the retaining party’s theory.

If the case settles after a report is produced, the project is closed. Otherwise, a trial or other proceeding may result where the forensic examiner is required to deliver sworn testimony regarding the method of examination and the results of the examination. Once the case is fully adjudicated the project can be closed.

Project Management Institute. (2013). A Guide to the project management body of knowledge. Project Management Institute: Newtown Square.