Chapter 1

Part A: Principles of evidence

Basic principles of evidence

Last updated November 20267 sectionsabout 11 min read

Key takeaways

Evidence is any material, testimony or document presented to a court to prove or disprove a fact in issue; under the Evidence Act (Cap 80) it reaches the court as oral or documentary evidence.
Information becomes evidence only once it is gathered, preserved and presented in a manner the rules of evidence recognise, so an investigation's job is to convert the one into the other.
Test every item for relevance, then reliability, then admissibility: admissibility is a gatekeeping question decided before the evidence is weighed, and relevant, reliable evidence can still be excluded by a specific rule such as hearsay.
Direct evidence proves a fact without inference; circumstantial evidence needs an inference, and in fraud it is often the only evidence available.
Section 63 of the Evidence Act requires oral evidence to be direct, the statutory root of the hearsay rule, and an examiner must document exculpatory evidence as well as inculpatory evidence.

A forensic examiner can trace every shilling and identify exactly who took it, and still lose the case, if what was gathered cannot be presented to a court in a form the law of evidence accepts. This chapter is the threshold every finding must cross: what evidence is, how it differs from mere information, the tests a court applies before admitting it, and the categories that classification sorts it into.

Framework for this chapter

The Evidence Act (Cap 80), Kenya's governing statute for what evidence is and how it may be proved: section 63 (oral evidence must be direct, the source of the hearsay rule), Part III, sections 64 to 66 (primary and secondary documentary evidence) and section 48 (expert opinion, developed fully in the chapter on presenting evidence in court).

What is evidence

Evidence is any material, testimony or document presented to a court to prove or disprove a fact in issue, the raw substance a forensic examiner's investigation must produce in a form the trial process can actually use. The Evidence Act (Cap 80) is Kenya's governing statute on what counts as evidence and how each kind of it may be proved: oral evidence (Part II, section 63 onward) and documentary evidence (Part III, sections 64 to 66) are its two broad channels, and every category this chapter classifies, direct or circumstantial, testimonial, real or demonstrative, is a way of describing evidence that must still, in the end, come to the court through one of those two channels.

Information versus evidence

Information becomes evidence only once it is gathered, preserved and presented in a manner the rules of evidence recognise; useful investigative information, a tip from a whistleblower, an internal audit report, a rumour among staff, can be entirely true yet remain inadmissible as evidence if it was not properly obtained, if the person who could speak to it is not called as a witness, or if it falls foul of an exclusionary rule such as hearsay (see Character and hearsay evidence, below).

This is the single most consequential distinction a fraud examiner learns in this paper: the investigation's job is to convert information into evidence, by identifying who can testify to a fact firsthand, by preserving the document that proves it in its original or a properly authenticated secondary form (real evidence, held to the Evidence Act's own primary and secondary document rules), and by doing so in a way that survives the admissibility test.

Relevance, reliability and admissibility

Relevance

The evidence must have some logical connection to a fact in issue, tending, in itself or together with other facts, to make that fact more or less probable; evidence about a matter the case does not actually turn on, however interesting, is not relevant and a court has no reason to receive it.

Reliability

The evidence must be trustworthy, accurately reflecting what it purports to show: a document that has been altered, a witness whose account keeps changing, or a chain of custody with an unexplained gap all raise reliability concerns that go to the weight a court gives the evidence even where it is technically admitted.

Admissibility

The evidence must satisfy the legal rules, relevance and a threshold of reliability, plus clearing any specific exclusionary rule (against hearsay, against evidence obtained in breach of a constitutional right, against an unqualified opinion) before a court may consider it at all; admissibility is a gatekeeping question the judge or magistrate decides before the evidence is weighed, weight is a question decided only once admission has already been granted.

Worked scenario: applying the three-part test (not a decided case)

An investigator into Mwangi's Bakery Limited's supplier fraud obtains: (i) the original signed supplier contract; (ii) a colleague's account of what the finance manager told them the finance manager had said to the supplier; (iii) a printout of an email between the finance manager and the supplier, recovered from a backup server after the finance manager deleted the original.

(i) is relevant, reliable (an original signed document) and admissible without difficulty, real, documentary evidence going straight to a fact in issue.

(ii) is a double hearsay problem: the colleague did not hear the finance manager speak to the supplier directly, only heard the finance manager's own account of it, so it is unlikely to be admissible for the truth of what was said, though it might still be relevant to show the colleague's own state of knowledge at the time.

(iii) raises a reliability and authentication question rather than a relevance one: the investigator must be able to show the printout is an accurate secondary copy of a genuine email, per the Evidence Act's documentary evidence provisions, and, separately, that recovering it from the backup server did not itself breach any right that would make a court exclude it, before its content can be relied on.

Direct and circumstantial evidence

Direct evidence

Evidence that, if believed, proves a fact without any need for inference, an eyewitness who saw the fraudulent transaction take place, or a signed confession.

Circumstantial evidence

Evidence that requires an inference to connect it to the fact in issue, a suspect's fingerprint on a document later found altered, an unusual pattern of transactions timed to a suspect's known movements; it is still capable of proving a case, and, in fraud matters, is often the only evidence available at all, since a person committing fraud rarely leaves a witness to watch them do it or confesses on request.

Testimonial, real and demonstrative evidence

Testimonial evidence

Oral or written statements given by a witness under oath, the account a witness gives of what they perceived or, for an expert, what they concluded from their examination.

Real evidence

Physical objects or documents themselves, a forged cheque, a hard drive, the falsified ledger, evidence the court can examine directly rather than through a witness's description of it.

Demonstrative evidence

Material created to illustrate or explain other evidence, a chart summarising a transaction trail across dozens of bank statements, a timeline of events; it is not evidence of the underlying facts itself but an aid to understanding evidence that is, and it must accurately represent the underlying evidence or it risks being misleading and excluded.

Exculpatory and inculpatory evidence

Inculpatory evidence

Evidence tending to establish guilt or liability, the evidence an investigation is most often looking for and most naturally documents.

Exculpatory evidence

Evidence tending to establish innocence or reduce liability; a forensic examiner must document and disclose this even where it undermines the case being built, since concealing it is itself professional and, in a criminal matter, potentially legal misconduct (the prosecution's disclosure duty, covered in the chapter on the criminal trial, sentence and appeal, exists precisely to guarantee the defence sees it).

Character and hearsay evidence

Character evidence

Evidence of a person's general disposition or reputation, generally restricted since it risks prejudice (a court convicting because the accused seems the type to do it) outweighing its genuine probative value on the specific facts in issue.

Hearsay evidence

An out-of-court statement offered to prove the truth of what it asserts; section 63 of the Evidence Act requires oral evidence in all cases to be direct, meaning the witness must have themselves seen, heard or perceived the fact they testify to, which is the statutory root of Kenya's hearsay rule, since a witness repeating what someone else told them is not giving direct evidence of the underlying fact, only direct evidence that the statement was made.

Hearsay is generally inadmissible because the original speaker cannot be cross-examined on it, subject to recognised exceptions (a dying declaration, an admission by a party, certain business records) the Evidence Act and case law separately allow.

Relevance, reliability, admissibility, in that order, every time

The three-part test of relevance, reliability and admissibility is the single most reusable framework in this paper: for any piece of evidence a case study describes, ask first whether it is relevant to a fact actually in issue, then whether it is reliable enough to be trusted, then whether it clears every specific admissibility hurdle (hearsay, privilege, unlawfully obtained evidence). A fact can be relevant and reliable yet still inadmissible for a specific legal reason, which is exactly what the hearsay rule illustrates.

Self-check

(a) Distinguish information from evidence, and explain what an investigator must do to convert the one into the other. (5 marks)

(b) Explain the three-part relevance/reliability/admissibility test, and give one example of evidence that is relevant and reliable but still inadmissible. (6 marks)

(c) Distinguish direct from circumstantial evidence, and explain why circumstantial evidence is often the only evidence available in a fraud case. (4 marks)

(d) State the statutory source of Kenya's hearsay rule in the Evidence Act, and explain in your own words what section 63 requires. (4 marks)

(e) Explain why a forensic examiner must document exculpatory evidence even where it weakens the case being built. (3 marks)

Show worked answer

(a) Information is any fact or material an investigator learns of; it becomes evidence only once gathered, preserved and presented in a form the rules of evidence recognise. The investigator converts it by identifying a witness who can testify to it firsthand, preserving the original or a properly authenticated document, and ensuring no exclusionary rule bars it (5 marks).

(b) Relevance: a logical connection to a fact in issue. Reliability: trustworthiness. Admissibility: satisfying the legal rules including any exclusionary rule. Example: a relevant, reliable out-of-court statement offered for the truth of what it asserts is still inadmissible as hearsay unless an exception applies (6 marks).

(c) Direct evidence proves a fact without inference (an eyewitness); circumstantial evidence requires an inference to connect it to the fact in issue (a fingerprint, a suspicious transaction pattern). Fraud is deliberately concealed and rarely witnessed directly or confessed to, so circumstantial evidence is frequently all that is available (4 marks).

(d) Section 63 of the Evidence Act, requiring oral evidence in all cases to be direct; a witness must have themselves seen, heard or perceived the fact testified to, so repeating what someone else said is not direct evidence of the underlying fact (4 marks).

(e) Concealing exculpatory evidence is professional and, in a criminal matter, potentially legal misconduct; the prosecution's disclosure duty exists to ensure the defence sees such evidence, and an examiner's credibility and the integrity of the whole process depend on documenting what was found regardless of which side it helps (3 marks).