Interviewing, Inquiry and Confession Evidence

Introduction and Context

Interviewing is one of the most important evidence-gathering activities in forensic accounting and fraud examination. Financial records may show that an unusual payment occurred, but an interview may explain who authorized it, why it was made, and whether the explanation is consistent with the documentary evidence. A well-conducted interview can identify witnesses, reveal undisclosed relationships, clarify accounting entries, preserve admissions, and direct further investigation. A poorly conducted interview can contaminate recollections, produce unreliable statements, create legal exposure, or cause an innocent person to appear deceptive.

Forensic interviewers therefore require more than conversational skill. They must understand evidence, human memory, professional ethics, applicable law, organizational policy, and the distinction between fact-finding and accusation. The central purpose is not to obtain a confession at any cost. It is to obtain reliable, relevant, and fairly documented information while respecting the rights and dignity of participants.

This chapter uses “interview” broadly to include conversations with witnesses, informants, complainants, employees, customers, suppliers, and suspects. Legal rules governing compelled statements, privilege, recording, admissibility, and confession evidence differ across jurisdictions. Professional practice must therefore be adapted to local law and reviewed with qualified legal counsel where necessary.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Distinguish interviews of witnesses, informants, and suspects.
2. Plan an ethical and evidence-led interview.
3. Use open, probing, clarification, and challenge questions appropriately.
4. Evaluate verbal statements against documents and other evidence.
5. Recognize the limitations of body language and deception indicators.
6. Document statements accurately and distinguish quotation from summary.
7. Assess admissions and confessions without coercion or confirmation bias.
8. Apply professional, legal, privacy, and governance safeguards.

1. The Nature and Purpose of a Forensic Interview

A forensic interview is a structured process for obtaining information that may be relevant to an investigation, dispute, regulatory inquiry, disciplinary process, or litigation. It differs from an ordinary workplace conversation in four ways:

• Purpose: the interviewer seeks reliable facts relevant to defined issues.
• Method: questions are planned, sequenced, and documented.
• Impartiality: the interviewer must remain open to information that supports or weakens the working hypothesis.
• Consequences: statements may affect employment, reputation, legal proceedings, or financial recovery.

An interview is not itself proof that a person is truthful or untruthful. It produces evidence that must be assessed with records, independent testimony, digital evidence, and the surrounding circumstances. A statement may be accurate, mistaken, incomplete, intentionally misleading, or technically true but presented in a way that creates a false impression.

Witnesses, informants, and suspects

A witness is a person believed to possess relevant information, usually without being the primary subject of suspicion. A witness may have observed an event, processed a transaction, approved a payment, or designed a control.

An informant supplies information, sometimes confidentially and sometimes anonymously. Informants may have direct knowledge, hearsay, a personal grievance, or a motive to obtain a reward or harm another person. Their information should be corroborated, and their identity should be protected only to the extent legally and organizationally possible.

A suspect is a person about whom there is a reasonable investigative basis for considering possible involvement in wrongdoing. A suspect interview requires particular care concerning rights, representation, voluntariness, recording, and the risk of contamination or coercion. In many jurisdictions, formal criminal questioning is subject to rules that do not apply to an ordinary internal interview.

The classification can change. A witness may become a suspect when new evidence emerges. That transition should be recognized, documented, and managed in accordance with applicable procedures.

2. Ethical and Legal Foundations

Voluntariness and non-coercion

Information should be obtained voluntarily unless a lawful authority provides otherwise. Coercion includes physical force, threats, unlawful detention, intimidation, deprivation of basic needs, abusive pressure, or promises that the interviewer cannot honor. Less obvious forms of coercion can also undermine reliability: repeated questioning after a clear refusal, exploiting a person’s vulnerability, threatening career consequences unrelated to policy, or implying that silence proves guilt.

An interviewer may explain the purpose of the interview, the expected process, confidentiality limits, and applicable organizational duties. The explanation must be truthful. For example, an interviewer should not promise absolute confidentiality if information may need to be disclosed to management, auditors, regulators, courts, or law enforcement.

Fairness and due process

A fair interview gives the participant a reasonable opportunity to provide an account, correct misunderstandings, identify supporting evidence, and explain apparent inconsistencies. The interviewer should not begin with the assumption that an allegation is established. A useful discipline is to write down competing explanations before the interview and identify what evidence would support or weaken each one.

Privilege and representation

Attorney–client privilege, work-product protection, accountant privilege, and employee representation rights vary by jurisdiction. An investigator must not describe a communication as privileged merely because a lawyer is present. Privilege generally belongs to the client or legally protected relationship, not automatically to the investigator. Before interviewing, the team should determine who commissioned the work, who controls the file, whether counsel is directing the investigation, and what warnings or representation rights are required.

Privacy and data protection

Interview notes may contain personal, health, employment, financial, or confidential business information. Collection should be relevant and proportionate. Access should be restricted, retention periods defined, and transmission secured. Recording requires attention to consent and local law; some jurisdictions require consent from all participants, while others apply different rules.

Professional conduct

Core professional principles include integrity, objectivity, professional competence, confidentiality, and due care. The interviewer should disclose conflicts of interest, avoid discriminatory treatment, and use an interpreter when language or disability creates a communication barrier. An interpreter should translate faithfully rather than summarize or answer for the participant.

3. Planning the Interview

A reliable interview begins before the first question. Planning should create a clear connection between the allegation, the evidence, the information gap, and the interview strategy.

Define the investigative purpose

The interviewer should state the issue in neutral terms. “Determine whether supplier bank details were changed without authorization” is preferable to “prove that the finance manager stole money.” The first formulation identifies an issue; the second embeds a conclusion.

Build an evidence map

An evidence map links propositions to sources. For a suspected fictitious supplier, relevant propositions may include:

The map prevents the interview from becoming a general conversation and identifies which documents should be shown, if any.

Research the participant

Review only information relevant to the inquiry. Understand the person’s role, responsibilities, likely knowledge, language needs, reporting relationships, and possible conflicts. Do not prejudge credibility based on status, accent, age, nervousness, or personality.

Select the interview order

A common sequence is to interview the complainant or reporting person, independent witnesses, process owners, and then the primary subject. This can preserve uncontaminated accounts and allow the interviewer to test explanations with known evidence. The order is not universal; safety, evidence-preservation risks, or the possibility of collusion may justify a different sequence.

Prepare the setting and logistics

Choose a private, neutral, accessible location. Allow adequate time, water, breaks, and appropriate support. For remote interviews, use an approved secure platform, confirm who is present, prevent unauthorized recording, and check that the participant can communicate privately. Record the date, start and end times, attendees, location, and any interruptions.

Prepare a topic guide

A topic guide is preferable to a rigid script. It should list issues, documents, chronology points, and follow-up questions. The interviewer should know the evidence well enough to listen actively rather than read mechanically.

4. Interview Structure and Questioning Techniques

A practical structure is the PEACE-informed sequence: Planning and Preparation, Engage and Explain, Account, Clarification and Challenge, and Evaluation. The framework is compatible with ethical, non-coercive interviewing because it emphasizes information gathering rather than confession seeking.

Engage and explain

Begin by introducing participants, explaining roles, describing the purpose and confidentiality limits, and confirming whether the participant understands. Establish rapport through professional respect, not manipulation. Explain that accuracy is more important than speed and that the participant may say “I do not know,” “I do not remember,” or “I need to check.”

Obtain a free account

Start with broad, open questions:

• “Please describe your role in the payment process.”
• “Tell me everything you recall about the supplier-bank change.”
• “What happened next?”

Do not interrupt unnecessarily. A free account reveals the participant’s vocabulary, sequence, confidence, omissions, and areas requiring clarification. Silence can be useful when it is respectful and not threatening.

Clarify and probe

After the free account, move from general to specific questions:

• Open: “What did you observe?”
• Focused: “Which system did you use?”
• Specific: “Was the approval completed before or after the invoice was posted?”
• Clarifying: “When you say ‘they approved it,’ who do you mean?”
• Evidence-linked: “The system log records a change at 14:32. What were you doing at that time?”

Avoid compound questions, leading questions, jargon, and questions that assume disputed facts. “Why did you falsify the invoice?” is leading and accusatory. “What was the basis for preparing the invoice?” preserves the opportunity for explanation.

Challenge carefully

Challenge is necessary when an account conflicts with reliable evidence, but it should be specific and non-conclusive. Present one issue at a time, allow the participant to respond, and record the explanation. For example: “You said the bank details were never changed by you. The audit log shows your user ID made a change on 6 March. How do you explain that entry?” Possible explanations include shared credentials, system errors, delegated work, or misuse of the account. The interviewer should investigate each possibility rather than treating the log as self-explanatory.

Close the interview

Ask whether the participant has anything to add, who else should be interviewed, and what documents may confirm the account. Summarize key points and invite corrections. Explain next steps without promising a particular outcome. Thank the participant and preserve the notes promptly.

5. Memory, Credibility, and Deception

Human memory is reconstructive rather than a perfect recording. Stress, time, repetition, leading questions, organizational narratives, and exposure to other accounts can alter recall. A confident statement is not necessarily an accurate statement, and uncertainty is not proof of dishonesty.

Interviewers should distinguish:

• Accuracy: whether the account corresponds to events.
• Honesty: whether the person believes the account is true.
• Completeness: whether relevant information has been omitted.
• Reliability: whether the person had the opportunity, ability, and motivation to know and remember.

Avoid body-language myths

There is no dependable universal gesture that proves deception. Avoiding eye contact, fidgeting, sweating, pausing, or changing posture may result from anxiety, culture, fatigue, disability, trauma, or the formality of the interview. Behavioral observations may guide neutral follow-up questions, but they should never substitute for corroborating evidence.

Assessing an account

A disciplined assessment considers:

1. Opportunity: Could the person perceive or know the fact?
2. Detail: Does the account contain relevant, coherent detail, while recognizing that genuine memory varies?
3. Consistency: Is it consistent internally and with independent evidence?
4. Corroboration: Can records or other witnesses support it?
5. Motive: Are there reasons to exaggerate, conceal, or misremember?
6. Alternative explanations: Could the discrepancy arise from system design, timing, misunderstanding, or ordinary error?

These factors are aids to professional judgment, not a mechanical credibility score.

Cognitive interviewing techniques

For cooperative witnesses, techniques such as context reinstatement, asking the witness to report everything without guessing, and recalling events in a different order may improve retrieval. They must be used carefully. Repeatedly asking a person to reconstruct an uncertain detail can increase confidence in an error. The interviewer should not suggest names, amounts, or sequences unless independently established and necessary for clarification.

6. Documentary Inconsistencies and Evidence Integration

An inconsistency is a difference between accounts or between an account and another source. It is not automatically fraud. Categories include:

• Temporal: dates or sequence differ.
• Quantitative: amounts, quantities, or percentages differ.
• Identity: different people, accounts, vendors, or user IDs are named.
• Procedural: the described process differs from policy or system records.
• Semantic: the same word is used with different meanings.
• Omission: a material event is absent from one account.

A method for evaluating inconsistencies

First, preserve the original records and verify their provenance. Second, define the exact proposition in dispute. Third, compare the reliability and context of each source. Fourth, ask the participant about the difference without revealing more information than necessary. Fifth, seek independent corroboration and document the resolution or remaining uncertainty.

For example, an employee says that an invoice was approved on 10 April, while the workflow log records approval on 12 April. The difference could reflect a draft approval, a time-zone issue, a corrected record, an inaccurate memory, or unauthorized use of credentials. The investigator should examine system time settings, workflow status, email metadata, and access logs before concluding that the employee lied.

Documentary evidence should be introduced strategically

Showing every document at the beginning can contaminate recall and allow a participant to tailor an account. A better approach is often to obtain an initial account, identify relevant gaps, and then introduce selected documents. However, preservation and fairness matter: the interviewer must not misrepresent a document, hide a material qualification, or use a selectively edited excerpt that creates a misleading impression.

7. Admissions, Confessions, and Statement Documentation

An admission is a statement that acknowledges a fact relevant to an inquiry, such as receiving an unauthorized benefit or changing a supplier record. A confession is generally an acknowledgment of responsibility for wrongdoing. The legal distinction and admissibility requirements vary by jurisdiction.

A confession is not automatically reliable merely because it is detailed or incriminating. False confessions may arise from coercion, exhaustion, fear, impaired cognition, misunderstanding, desire to protect another person, or a belief that confession will produce a benefit. The investigator should therefore seek corroboration for important details that were not supplied to the participant.

Documentation standards

Notes should distinguish among:

• exact words placed in quotation marks;
• a close paraphrase identified as such;
• the interviewer’s interpretation; and
• independently verified facts.

A good record includes the participants, date, time, location, purpose, warnings or consents, questions and answers or a reliable summary, documents shown, breaks, interruptions, emotional or physical conditions relevant to reliability, and corrections made by the participant. Notes should be contemporaneous or prepared promptly, dated, signed or electronically authenticated, and stored securely.

If recording is lawful and consent requirements are satisfied, audio or video may preserve tone and sequence more accurately than memory-based notes. Recording does not eliminate the need for notes: the interviewer should record metadata, equipment issues, consent, and any material event off camera. If recording fails, document the failure and reconstruct the interview transparently rather than silently replacing it with a polished account.

Statement review and sign-off

Where policy and law permit, provide the participant with an opportunity to review a written statement and identify corrections. A signature confirms that the statement was reviewed or adopted; it does not by itself prove truth. If the participant refuses to sign, record the refusal and the reason given, if any. Do not pressure a person to adopt wording they dispute.

8. Bias, Confirmation, and Quality Control

Investigators are vulnerable to confirmation bias, the tendency to seek and interpret evidence in ways that support an existing hypothesis. Related risks include anchoring on the first allegation, treating senior employees as more credible, assuming that a financial anomaly proves intent, and interpreting ordinary nervousness as deception.

Controls include:

• writing the allegation and alternative hypotheses before interviews;
• separating fact collection from final evaluation;
• using a second reviewer for important interviews;
• maintaining an evidence matrix that records both inculpatory and exculpatory information;
• avoiding unnecessary disclosure of prior allegations to witnesses;
• documenting changes in the investigative theory;
• testing whether a conclusion depends on a single statement.

A useful quality-control question is: “What evidence would cause us to change our conclusion?” If the answer is “none,” the process has become advocacy rather than investigation.

9. Technology, Digital Interviews, and Artificial Intelligence

Technology can improve consistency but also create new risks. Secure digital platforms support remote interviews, access controls, time stamps, and searchable transcripts. Automated transcription can mishear names, numbers, negations, accents, or technical terms. Every transcript used as evidence should therefore be checked against the recording by a competent reviewer, especially around amounts, dates, account numbers, and admissions.

Artificial intelligence may assist with transcription, translation, topic indexing, chronology extraction, and comparison of statements. It should not independently decide whether a person is deceptive or guilty. Facial-expression analysis, voice-stress claims, and automated “truth scores” lack a sufficiently reliable universal basis for high-stakes conclusions and may reproduce cultural, linguistic, or disability-related bias.

Organizations using AI should establish rules for approved tools, confidentiality, data retention, human review, audit logs, model limitations, and disclosure where required. Sensitive interview material should not be uploaded to public systems without authorization and appropriate safeguards.

10. Applied Case: The Changed Supplier Bank Account

The following is a fictional illustrative case.

Background

A manufacturing company discovered that three payments totaling $84,000 had been sent to a bank account different from the supplier’s usual account. The enterprise resource planning system showed that the supplier master record was changed using the credentials of Maya, an accounts-payable analyst. Maya denied making the change and stated that her supervisor, Daniel, had approved the payments by email.

Problem

The investigation had to determine whether Maya changed the record, whether her credentials were misused, whether the supplier request was genuine, and whether the payments were authorized. The risk of premature accusation was significant because the user ID pointed to Maya but did not necessarily identify the person physically operating the system.

Analysis and approach

The investigator first preserved system logs, email headers, approval records, access-control data, and the original supplier correspondence. Interviews were conducted in the following order: the reporting manager, the procurement officer, the supplier contact, Maya, Daniel, and the system administrator.

Maya gave a free account. She said she processed ordinary invoices but did not recall changing bank details. She explained that analysts sometimes left their workstations unlocked, although policy prohibited this. When shown the master-file log, she acknowledged that the user ID was hers but maintained that another person could have used the session.

The investigator then interviewed Daniel without disclosing Maya’s full account. Daniel stated that he approved the payments after receiving a supplier email. The supplier contact later stated that the company had not sent that email. Email metadata showed that the message originated from a look-alike domain. Access logs showed Maya’s workstation was active, but building records showed Daniel entered the accounts-payable area shortly before the change. This did not prove that Daniel made the change, but it generated a further line of inquiry.

The system administrator explained that the application recorded the authenticated user but not the person at the keyboard. Camera footage, obtained under applicable policy, showed Daniel using Maya’s workstation during the relevant period. A subsequent search of authorized records identified a personal account connected to Daniel, but the financial tracing required separate procedures.

Outcome

The evidence supported a conclusion that Maya’s credentials were used from her workstation, but the access-control design prevented the log from proving who entered the change. The video and timing evidence materially strengthened the case against Daniel, while also demonstrating that Maya’s policy breach—leaving a workstation accessible—was not equivalent to authorizing the payment. The investigative report separated established facts, reasonable inferences, unresolved issues, and allegations requiring further legal action.

Learning points

1. A user ID is an attribution clue, not necessarily proof of physical authorship.
2. An inconsistency should be tested through independent evidence rather than treated as deception.
3. Interview order can preserve uncontaminated accounts.
4. A suspect should be given a fair opportunity to explain significant evidence.
5. Control weaknesses and intentional fraud may coexist but must not be conflated.
6. A conclusion should identify limitations instead of overstating certainty.

11. Practical Interview Checklist

Before the interview, confirm authority, purpose, legal requirements, privilege issues, recording rules, participant needs, evidence preservation, and interview order. Prepare an evidence map and alternative hypotheses.

During the interview, explain the process, obtain a free account, listen without unnecessary interruption, ask neutral follow-ups, distinguish “I do not know” from “I do not remember,” introduce documents carefully, record explanations, and provide reasonable breaks.

After the interview, secure notes and recordings, verify important quotations, identify new evidence, document inconsistencies, separate fact from interpretation, update the evidence matrix, and assess whether another interviewer should review the result.

Chapter Summary

Forensic interviewing is an evidence-gathering process designed to obtain accurate and relevant information ethically. Witness, informant, and suspect interviews differ in purpose, risk, and procedural safeguards. Effective practice begins with a neutral investigative purpose, an evidence map, careful planning, and attention to legal authority, voluntariness, privacy, and representation.

A PEACE-informed structure—planning, engagement, account, clarification and challenge, and evaluation—supports non-coercive inquiry. Open questions should normally precede focused questions, and documentary challenges should be specific, fair, and followed by investigation of alternative explanations. Body language and supposed universal deception cues are unreliable; credibility must be evaluated through opportunity, consistency, corroboration, motive, and competing explanations.

Admissions and confessions require careful documentation and independent corroboration. Exact quotations, paraphrases, interpretations, and verified facts must be distinguished. Confirmation bias can be controlled through alternative hypotheses, balanced evidence matrices, peer review, and explicit consideration of exculpatory evidence. Digital tools and AI can assist transcription and organization, but they cannot replace human judgment or provide a reliable automatic truth score. The professional objective is not to secure a confession, but to produce a fair, accurate, transparent, and defensible evidentiary record.

Key Terms

Admission: A statement acknowledging a fact relevant to an investigation.

Alternative hypothesis: A plausible explanation competing with the investigator’s initial theory.

Cognitive interview: A memory-supporting approach using techniques such as context reinstatement and free recall.

Confirmation bias: The tendency to favor information supporting an existing belief.

Confession: A statement generally acknowledging responsibility for wrongdoing.

Corroboration: Independent evidence that supports or tests a statement.

Documentary inconsistency: A conflict between a statement and a record or between records.

Evidence map: A structured link between investigative propositions, sources, and interview targets.

Free account: An uninterrupted initial narrative provided by the interviewee.

Informant: A person who supplies information about an issue or suspected wrongdoing.

Interview guide: A planned set of topics and questions used flexibly during an interview.

Leading question: A question that suggests its desired answer or assumes a disputed fact.

Non-coercion: Obtaining information without unlawful force, threats, intimidation, or improper pressure.

Privilege: A legal protection that may restrict disclosure of certain communications.

Reliability: The degree to which information is likely to be accurate and dependable.

Suspect: A person with a reasonable investigative connection to possible wrongdoing.

Verbatim quotation: The participant’s exact words, recorded as accurately as possible.

Voluntariness: The condition in which a statement is made freely rather than through improper pressure.

Witness: A person believed to possess relevant information about an event or process.

Review Questions

Short Answer Questions

1. What is the principal difference between an ordinary workplace conversation and a forensic interview?
2. Why is a user ID not necessarily proof of the identity of the person who performed a system action?
3. Define an admission and distinguish it from a confession.
4. Identify three categories of documentary inconsistency.
5. Why should body language not be treated as proof of deception?

Long Answer Questions

1. Explain how an investigator should plan and conduct an ethical interview of a suspected employee while preserving fairness and voluntariness.
2. Discuss the PEACE-informed interview structure and explain how each stage contributes to reliable evidence.
3. Explain how memory limitations, confirmation bias, and leading questions can affect interview evidence.
4. Describe appropriate standards for documenting, reviewing, correcting, and storing interview statements.
5. Evaluate the advantages and risks of recording, automated transcription, and artificial intelligence in forensic interviews.

Analytical / Application Questions

1. An employee denies changing a supplier’s bank details, but the system log shows the employee’s credentials were used. Develop an interview plan and identify at least four alternative explanations that should be tested before reaching a conclusion.
2. A witness changes the amount remembered for a payment after reviewing an email. Analyze whether the change necessarily indicates dishonesty and specify the corroborating evidence you would seek.
3. During an interview, a manager says, “I approved the transaction because the finance director told me it was legitimate,” while the approval workflow shows no finance-director action. Formulate neutral follow-up questions and explain how you would evaluate the inconsistency.

Multiple Choice Questions with Answers

Question 1

Which approach best reflects an ethical forensic interview?

A. Begin by stating that the suspect is known to be guilty

B. Obtain a free account before asking focused questions

C. Use repeated pressure until the participant confesses

D. Treat nervousness as proof of deception

Correct Answer: B. Obtain a free account before asking focused questions

Question 2

What does an evidence map primarily connect?

A. Employee personalities and interview styles

B. Legal penalties and compensation amounts

C. Investigative propositions, sources, and interview targets

D. Body-language observations and truth scores

Correct Answer: C. Investigative propositions, sources, and interview targets

Question 3

Which statement about a system user ID is most accurate?

A. It always proves who physically entered the data

B. It is irrelevant to attribution

C. It is an attribution clue but may not identify the person at the keyboard

D. It proves that the transaction was authorized

Correct Answer: C. It is an attribution clue but may not identify the person at the keyboard

Question 4

Which is an open question?

A. Did you approve the payment at 10 a.m.?

B. Was Daniel present when the record changed?

C. You changed the bank details, correct?

D. Please describe everything you recall about the bank-detail change.

Correct Answer: D. Please describe everything you recall about the bank-detail change.

Question 5

Why should an interviewer avoid relying on eye contact or fidgeting as deception indicators?

A. They are always caused by deliberate lying

B. They have no possible relationship to human behavior

C. They may result from anxiety, culture, disability, or other factors

D. They are admissible only in civil cases

Correct Answer: C. They may result from anxiety, culture, disability, or other factors

Question 6

Which documentation practice is most appropriate?

A. Present the interviewer’s interpretation as an exact quotation

B. Distinguish quotations, paraphrases, interpretations, and verified facts

C. Delete notes that do not support the working hypothesis

D. Allow unsigned statements to be silently rewritten

Correct Answer: B. Distinguish quotations, paraphrases, interpretations, and verified facts

Question 7

What is confirmation bias in a fraud investigation?

A. A legal requirement to record every interview

B. The tendency to favor evidence supporting an existing hypothesis

C. A method for authenticating digital records

D. A memory technique for witnesses

Correct Answer: B. The tendency to favor evidence supporting an existing hypothesis

Question 8

Which statement about a confession is correct?

A. A confession is automatically reliable because it is incriminating

B. A confession never requires corroboration

C. A confession should be assessed for voluntariness and corroborated where possible

D. A confession eliminates the need to preserve documentary evidence

Correct Answer: C. A confession should be assessed for voluntariness and corroborated where possible

Question 9

What is a major risk of automated interview transcription?

A. It prevents any form of searching

B. It may mishear names, numbers, negations, or technical terms

C. It guarantees an objective credibility assessment

D. It makes privacy obligations disappear

Correct Answer: B. It may mishear names, numbers, negations, or technical terms

Question 10

Which question is the fairest challenge to a disputed system record?

A. Why did you falsify the record?

B. You lied about the record, didn’t you?

C. The log shows your user ID made the change; how do you explain that entry?

D. Who else should we accuse?

Correct Answer: C. The log shows your user ID made the change; how do you explain that entry?