The Difference Between a Fact, an Allegation and Evidence

An allegation is a claim that something happened. It may be completely accurate. It may be partially accurate. It may be based on a misunderstanding. It may contain both accurate and inaccurate information. In some cases, it may ultimately prove to be unsupported.

At the beginning of an investigation, however, the investigator should not assume any of those possibilities. An allegation identifies an issue that needs to be examined. It gives the investigator somewhere to begin.

Suppose an employer receives a complaint that an employee improperly used company funds. The allegation is important and may warrant an investigation, but the complaint itself does not establish that the employee committed misconduct. The investigator must determine what evidence exists.

That distinction is critical because an investigation that begins with a predetermined conclusion can quickly become an exercise in finding information that supports what someone already believes. A professional investigation should work in the opposite direction: start with the allegation, gather the evidence, determine how the evidence fits together, test it against other information, and then determine what conclusions the evidence supports.

Evidence is information that can help establish whether an allegation is true, false, partially true, or cannot be determined. It can take many forms, including witness statements, photographs, surveillance video, text messages, emails, financial records, receipts, public records, telephone records, electronic data, business records, physical evidence, social media activity, policies and procedures, or other documentation. The person making the allegation is also a source of evidence.

But there is an important distinction: evidence is not necessarily proof. Consider a witness who says, “I saw John take the money.” That statement is evidence. But an investigator should not simply stop there. Where was the witness standing? What exactly did the witness observe? How long did the observation last? Could the witness clearly see what was happening? When did the witness first report it? Has the witness’s account changed? Does the witness have any relationship with the people involved? Are there documents, video, electronic records, or other witnesses that support or contradict the account? Those questions do not mean the investigator distrusts the witness. They mean the investigator is investigating.

Corroboration Matters

One of the strongest tools available to an investigator is corroboration — independent information that supports another piece of evidence. Imagine someone reports receiving a threatening telephone call at 8:15 p.m. The person’s statement is evidence. Telephone records showing an incoming call from the alleged caller at approximately 8:15 p.m. provide corroboration that a call occurred. A voicemail preserving the actual threat provides additional evidence. A text message sent immediately afterward referencing the call may provide contemporaneous evidence of the person’s reaction. Individually, these pieces tell us something. When placed together — and in the proper sequence — they may tell us considerably more. This is why experienced investigators continually look for independent sources of information and examine how those sources relate to one another.

Credibility and Corroboration Are Not the Same Thing

Investigators are frequently asked a seemingly simple question: “Who do you believe?” Sometimes that is the wrong question. A witness can be sincere, confident, and completely convinced about what they remember — and still be mistaken. Human memory is not a recording. People can misunderstand what they see or hear. Memories can fade. Details can become confused. Subsequent conversations can influence recollections. Likewise, an inconsistency in someone’s account does not automatically mean that person is being deceptive.

The investigator must look beyond demeanor. Does the person’s account remain reasonably consistent? Is it supported by independent evidence? Does it fit the known sequence of events? Is the person describing something personally observed or repeating something heard from someone else? Are important portions contradicted by reliable records or other evidence? Credibility is important. Corroboration is often more important.

Firsthand Information Versus “Someone Told Me”

Another common investigative problem involves secondhand information. Consider the difference between “I saw him put the envelope in his pocket” and “Someone told me he put the envelope in his pocket.” Both statements may be relevant, but they are not equivalent. The second statement immediately raises another question: who actually saw it? Whenever possible, an investigator should attempt to trace information back to its original source. Rumors and repeated stories can gradually acquire the appearance of established fact, particularly in workplaces, families, organizations, and close-knit communities. By the time an investigator becomes involved, several people may confidently repeat the same information even though every version originated with a single person. Multiple people repeating the same allegation does not necessarily constitute independent corroboration. Finding the original source matters.

Documents Don’t Always Speak for Themselves

Documentary evidence can be extremely valuable, but documents also require context. A photograph may accurately depict something, but when was it taken? A screenshot may show a message, but what came immediately before and after it? A bank record may establish that money was withdrawn, but it may not establish who ultimately received the money or why. A surveillance recording may capture part of an incident while missing what happened moments earlier outside the camera’s view. A report may contain information attributed to a witness without establishing whether the report writer personally observed anything. Good investigative work does not simply collect documents. It asks what those documents actually establish, what they do not establish, and where they fit among the other information obtained during the investigation.

One of the most important parts of an investigation is sequencing. Investigators rarely receive information in the order in which events actually occurred. A witness interviewed late in the investigation may provide information about something that happened at the very beginning. A document obtained early may not become significant until another witness is interviewed weeks later. A text message, photograph, financial transaction, telephone call, or surveillance recording may initially appear unremarkable until it is placed alongside other evidence. The investigator’s job is to take these separate pieces of information and determine where they fit.

Sequencing is more than simply creating a timeline. A timeline tells us when things happened. Sequencing helps us understand how the pieces relate to one another and what those relationships may tell us about what happened. For example, an investigator may determine that a particular event occurred at 2:15 p.m. That is useful. But the investigation becomes more informative when we establish that a telephone call occurred at 2:07 p.m., a text message was sent at 2:11 p.m., the event occurred at approximately 2:15 p.m., a photograph was taken at 2:19 p.m., and the first report of the incident was made at 2:32 p.m. Individually, each piece of information tells us something. Placed in sequence, they may tell us a story.

Why Sequence Matters

Sequencing allows an investigator to compare what people say happened with what independently documented information shows happened. Who knew what first? When did they know it? What happened immediately before the incident, and immediately afterward? When did the people involved communicate with one another? Was a statement made before or after a witness spoke with someone else? Did an action occur before the person claims to have learned about the event? Does a document support the sequence described by a witness, or does it create a conflict that needs to be explained?

These questions can become extremely important. A witness may accurately remember the individual events but remember their order incorrectly. Someone may attribute a decision to one event when records establish that the decision was actually made before that event occurred. A person may say they immediately reported an incident when telephone or electronic records establish a significant delay. Sometimes the sequence supports a person’s account. Sometimes it challenges it. And sometimes it identifies the next question the investigator needs to ask.

Information Often Becomes Important Later

Another reason sequencing matters is that investigators frequently collect information before knowing its significance. During an interview, a witness might casually mention receiving a telephone call that afternoon. At the time, the call may appear unrelated to the allegation. Later, another witness describes a conversation that occurred immediately after that call. A subsequent review of text messages identifies a communication sent minutes later. Suddenly, information collected at three different stages of the investigation becomes connected. This is why good investigators continually revisit what they have already learned. An investigation is not simply a process of collecting one piece of evidence after another and placing each into a file. It is an ongoing process of comparing new information against what is already known, and as the investigation develops, earlier evidence may take on an entirely different significance.

Building the Sequence, and Finding the Missing Pieces

The investigator begins with what can be reliably established and gradually fills in the spaces between those points. Dates and times are particularly valuable when they can be independently verified through records such as emails, text messages, photographs, surveillance systems, access-control records, financial transactions, telephone records, reports, receipts, electronic metadata, or other contemporaneous documentation. Witness accounts can then be placed alongside those records. When several independent sources point to the same sequence of events, the investigator may have meaningful corroboration. When they do not, the differences deserve examination — not automatically as proof that someone is being dishonest, since memory is imperfect, clocks may not be synchronized, records may be incomplete, and witnesses may have observed different portions of the same event, but as something the investigator is responsible for identifying and determining whether it can reasonably be explained.

Sequencing can also reveal something that is not there. Once the known information is placed in order, gaps become visible: perhaps a 45-minute period that no witness has explained, a text-message conversation that suddenly stops immediately before an important event, a document referenced by several people that cannot be located, a person who appears repeatedly in the sequence but has never been interviewed, or a surveillance recording that begins five minutes after the event under investigation. These gaps can generate investigative leads. In that sense, sequencing doesn’t merely organize the evidence already collected — it can help tell the investigator what still needs to be investigated.

Seeing the Investigation as a Whole

A complex investigation may involve dozens or even hundreds of individual pieces of information. Looking at each one separately can make the case appear confusing or even contradictory. Sequencing brings structure to that information. The investigator begins to see what happened before the central event, what happened during it, what happened afterward, who was involved at each stage, what information each person possessed at the time, and which portions of the sequence can be independently established. That larger picture can also prevent an investigator from placing too much importance on a single statement or document — one piece of evidence may appear compelling when viewed alone, but placed into the complete sequence, it may become even more significant, or considerably less so.

This is one of the reasons experienced investigators don’t simply ask, “What evidence do I have?” They also ask, “Where does this piece fit?” Because in many investigations, understanding the order of events is what ultimately allows the evidence to make sense.

Facts emerge when reliable evidence allows certain circumstances to be reasonably established. Some facts may be undisputed: a transaction occurred on a particular date, a vehicle entered a parking lot at a documented time, an email was sent from a particular account, a person was scheduled to work, a photograph was taken. Other issues may remain disputed even after an extensive investigation — and that is not necessarily a failure of the investigation. Sometimes the available evidence simply does not permit a responsible investigator to determine exactly what occurred, and a professional investigator should be willing to say that. There is an enormous difference between “It did not happen” and “The available evidence is insufficient to establish that it happened.” Those conclusions are not interchangeable.

Evidence Can Support an Allegation — and It Can Contradict One

Investigators should not look only for evidence that supports the original complaint. Contradictory evidence can be equally important. Suppose someone alleges that a particular person was present during an incident. The investigator discovers surveillance footage showing that person’s vehicle leaving the location an hour earlier, and additional records place the person somewhere else when the incident occurred. That evidence deserves the same attention as evidence supporting the allegation. A fair investigation follows the evidence in both directions — which is one reason professional investigators must guard against confirmation bias, the tendency to give greater weight to information that supports an existing belief while overlooking information that challenges it. The investigator’s responsibility is not to prove the allegation. It is to investigate it.

Sometimes the Smallest Detail Changes the Investigation

Major investigative developments do not always come from dramatic discoveries. Sometimes they come from a timestamp, a receipt, a photograph in the background of another photograph, an email written months earlier, a statement that conflicts with an established sequence, a person mentioned almost casually during an interview, or a record that should exist but doesn’t. Good investigators learn to recognize those details, determine where they fit, and ask the next question. That is often where an investigation changes direction.

Clients understandably come to investigators with beliefs about what happened. Sometimes those beliefs ultimately prove correct. Sometimes the investigation produces a different answer. That is why the role of an independent investigator is so important.

A professional investigator should not begin an investigation by asking, “How can I prove my client’s theory?” The better question is, “What does the evidence establish?” That distinction protects everyone involved — including the client. An investigator who simply confirms what a client already believes may provide reassurance, but not necessarily the truth. An investigator willing to challenge assumptions, identify weaknesses, pursue contradictory evidence, determine how the pieces fit together, and explain what cannot be established provides something considerably more valuable.

From Allegation to Finding

A sound investigation follows a disciplined progression: Allegation → Investigation → Evidence → Sequencing → Corroboration → Analysis → Findings. The process may appear straightforward, but doing it well requires experience, patience, objectivity, and attention to detail. Evidence must be gathered, but it must also be organized and understood in context. Individual pieces must be compared against one another. Their sequence must be established whenever possible. Gaps and inconsistencies must be identified. New information must continually be compared with information obtained earlier in the investigation. Eventually, the separate pieces begin to form a larger picture.

The ultimate goal is not to produce the answer someone hoped to receive. It is to develop the most accurate understanding possible from the available evidence. That is the difference between simply gathering information and conducting an investigation.