Chain of Custody Audit Checklist: What to Review

What a Chain of Custody Audit Checks

A chain of custody audit is a systematic review of the recorded history of an evidence item's movement and handling, from collection through storage or submission to a laboratory, court, or other custodian. The purpose is to prevent substitution of, tampering with, mistaking the identity of, damaging, altering, contaminating, misplacing or falsifying the evidence. [2] An audit does not re-examine the physical evidence itself; instead, it examines the documentary and digital record that shows each person who touched the evidence identified themselves, noted the date, documented the condition, and transferred custody to a named successor.

Evidence custody audits operate at two levels. At the operational level—often within a crime laboratory, police evidence room, or investigator's office—supervisors may conduct regular reviews to confirm that handlers are following procedure. At the institutional level, laboratories holding ISO/IEC 17025 accreditation (for example, from ANAB, which absorbed the former ASCLD/LAB accreditation program in 2016) or those adhering to standards issued by the American Bar Association, the National Forensic Science Technology Center, the International Organization for Standardization, or the American Society for Testing and Materials generate audit reports and maintain records of their findings. [6] Accredited laboratories and other custodians of evidence establish quality assurance expectations for tracking and auditing evidence in their possession.

Core Elements of an Audit Checklist

A written chain of custody record must include the signature or initials of each individual receiving or transferring evidence, with the corresponding date for each transfer, and a corresponding identifier which specifies each evidentiary item. [1] An audit checklist verifies that these four elements—who, when, what, and sometimes where and why—appear consistently and completely throughout the custody record.

Transfer Documentation: Each person who receives or transfers an item of evidence must make a log entry, sign for its possession, and note the date. [1] As the item passes from person to person—from a collection site to a police station, from an evidence room to a laboratory, from an examiner to a storage vault—a chain of receipts is created. The audit must confirm that there is no point in this sequence where a person handled the evidence but did not document the receipt.

Item Identification: Each evidence item must bear complete identification tags and labels. [1] The audit verifies that each item identifier resolves uniquely—that the label on a container corresponds to one specific item and no other, and that descriptive information (such as item type, source, date of collection, or case number) is consistent across all transfers and custody documents. If the same item is re-labeled or split into sub-samples, the audit must trace the relationship between original and derivative identifiers.

Condition Documentation: Evidence items must be bagged, packaged, or otherwise handled in such a fashion that evidentiary value is not destroyed. [1] Audits should confirm that condition notation—such as whether a package was sealed, photographed, or marked as disturbed—is recorded at each receipt point. If an item shows signs of compromise, the audit must verify that the breach was documented and that appropriate remedial steps were taken.

Temporal Documentation: A chain of custody checklist includes, where applicable, the field location and the geographical location where the item was found or observed, the date and time of collection, and any gaps in the record. [1] The audit must verify that there are no unexplained intervals in which the item's whereabouts or handler are unknown. Under NIST and OSAC standards for initial response at scenes by law enforcement, an item shall be recorded prior to movement as well as who moved the item, why, and to where. [5]

Integrity Values and Digital Records: For items with calculated integrity measures—such as hash values for digital evidence, forensic seals, or bar-code identifiers—the audit verifies that these values are recorded and, if the custody record is electronic, that the computerized data are sufficiently secure, detailed, and accessible for review and can be converted to a hard copy when necessary. [1]

Who Audits Evidence Custody Records

Auditing responsibility flows through several institutional roles and levels.

Laboratory and Custodial Staff: All laboratories that have access to evidence must maintain accurate accountability of the chain of custody. [6] The laboratory bears primary responsibility for auditing its own records and those of items in its care. Best practice requires laboratories to maintain evidence in safe, properly controlled storage facilities and to limit the number of people who come in contact with evidence. [2]

Accreditation Bodies and Standards Organizations: Laboratories holding ISO/IEC 17025 accreditation (for example, from ANAB) or those adhering to recommendations issued by the American Bar Association, the National Forensic Science Technology Center, the International Organization for Standardization, and the American Society for Testing and Materials are measured for compliance through audits. [6] Failure to comply with chain of custody standards may result in revocation of accreditation or other institutional consequences until deficiencies are remedied.

Law Enforcement Agencies: Police departments and investigative agencies are responsible for auditing the custody records of evidence in their evidence rooms or under their control prior to submission to a laboratory. This responsibility extends to electronic records maintained through evidence management software or digital-evidence platforms.

Quality Assurance Functions: Larger laboratories and law enforcement agencies often employ dedicated quality-assurance staff or designate supervisory personnel to conduct periodic audits and to recommend corrective actions when gaps are identified.

Frequency of Evidence Inventory Reconciliation

No federal rule sets how often evidence custody records must be audited. Frequency is set by agency policy, accreditation requirements, or, for particular regulated programs, the rules that govern them.

Guidance and accreditation programs call for continuous or regularly scheduled physical and documentary audits, commonly conducted quarterly or annually. [4] Critical infrastructure owners and operators should routinely audit chain of custody processes to demonstrate that the authenticity of data collected has been maintained across all stages and to ensure there are no gaps in custody. [4] The frequency of audits may be set by institutional policy, accreditation requirements, or legal mandate depending on the nature of the evidence, the crime, the jurisdiction, and the laboratory's accreditation status.

What Happens When an Audit Identifies a Gap

When an audit discovers that a custody record is incomplete—for example, when a transfer was not signed, dated, or documented—the institution must respond through assessment, documentation, and quality-system review.

Assessment and Documentation: The organization must develop and implement appropriate activities in response to the detected breach. [7] These measures allow the organization to determine the impact and consequences of the gap. For instance, if a chain is broken for 48 hours and the handler is unknown, the assessment might include interviews with relevant staff, a review of laboratory access logs, and a determination of whether the evidence could have been substituted, contaminated, or damaged during that interval.

Evidentiary Consequences: Without proof of an intact chain of custody, the evidence may be excluded from trial or afforded less weight by the trier of fact. [2] Under the Federal Rules of Evidence, one way to authenticate an item is testimony that it is what it is claimed to be. [8] A broken or incomplete chain of custody can render it impossible for a witness to testify credibly that the item now in court is the same item that was collected at the scene—and, in consequence, the evidence may be deemed inadmissible or unreliable.

Quality System Review and Remediation: The audit report and gap findings are directed to the quality manual and standard operating procedures used by the laboratory. [7] Audit findings provide the basis for changes to policies, training, and monitoring. A gap in one custody record may prompt a laboratory to revise its form design, add mandatory fields, provide additional training to evidence handlers, or implement new check-in and check-out protocols in its evidence room.

Laboratory Compliance Status: Laboratories that fail to remedy chain of custody deficiencies may face suspension of accreditation or other institutional consequences.

An audit is thus not a one-time judgment that evidence is "good" or "bad"; it is a control mechanism that identifies breakdowns in procedure, prompts institutional response, and generates a record that can be presented to a court as evidence of the care (or lack thereof) with which evidence was handled.