Court-ready evidence: what survives a disciplinary hearing and a prosecution

What makes evidence court-ready in South Africa?

Court-ready evidence is evidence that can be handed to a legal team or a disciplinary panel and still hold when someone motivated to break it tests every part of it. That last clause is the whole test. Internally, nobody argues with you. In a hearing, a representative is paid to find the weakest link and pull it.

Four things decide whether it holds. The account is corroborated by more than one independent source. The origin and handling of every item is documented in an unbroken chain. The material was gathered lawfully. And the process built around it is fair and consistent. Miss any one of them and the other three may not save the case.

The stakes are not abstract. A South African peer-reviewed study of retail SMMEs in the City of Tshwane found that stock spoilage and internal theft are the strongest predictors of profitability and sales volume loss (Tabane, Phume and Retief, South African Journal of Economic and Management Sciences, 2024). That study sampled retail SMMEs in one metro. It is not a national figure and we do not present it as one. What it does show is that where internal theft takes hold, it is not a marginal concern.

Balance of probabilities or beyond reasonable doubt: which bar does your evidence have to clear?

These are two different standards, and confusing them is the most expensive mistake in workplace investigation.

A disciplinary hearing or a CCMA arbitration works on the balance of probabilities. Your version must be more likely than not. Under the Labour Relations Act the employer carries the onus of showing the dismissal was both substantively and procedurally fair, so it is your evidence that has to do the work, not the employee's denial.

A criminal prosecution requires proof beyond reasonable doubt. That is a materially higher bar, and it is not reached by adding more of the same weak material. A doubt that a panel would shrug off can end a prosecution.

There is a third standard that people apply without noticing, and it is not a standard at all: internal comfort. The moment everyone in the room agrees who did it, the investigation tends to stop. That is precisely the point at which the evidentiary work should start.

The practical trap is sequencing. A matter that begins as a dismissal often becomes a criminal referral, a civil recovery, or an insurance claim months later. Evidence built only to the internal bar cannot be retro-fitted to the higher one. By then the exhibit has passed through several hands, the footage has been overwritten, and the witness has left the company. You cannot go back and collect it properly. That opportunity existed once.

What is a chain of custody, and how does it break?

A chain of custody is the documented, unbroken record of who held an item, when, and what they did with it, from the moment it was collected to the moment it is presented. It applies to physical exhibits, original documents, digital records, footage, and the statements themselves.

It rarely breaks dramatically. It breaks like this:

• A manager removes the item and keeps it in a drawer for a fortnight before telling anyone
• Footage is copied to a phone and the original is left to overwrite itself on schedule
• A laptop is examined by internal IT, with no record of what was opened or changed
• Items are stored unlabelled, so nobody can later say which is which
• Statements are taken months after the event, once accounts have hardened and drifted

Here is why a broken chain sinks an otherwise true case. It does not prove that nothing happened. It removes your ability to prove that the item in front of the panel is the item you collected, and that it is unchanged. The other side does not have to prove that anyone tampered with anything. It only has to raise a real possibility that your record cannot exclude. On the balance of probabilities that possibility damages you. Beyond reasonable doubt, it is often fatal.

This is the part clients find hardest to accept. The case can be true and still be unprovable. The chain is what converts truth into proof, and it can only be built while the evidence is being collected.

Why does uncorroborated suspicion fail?

Most matters do not begin with proof. They begin with a tip. In the ACFE's Report to the Nations (2024), 43% of occupational frauds were first detected by tips, the single largest detection category, with every other detection method combined accounting for the remaining 57%. That figure describes how fraud comes to light and nothing more. But it explains the position most employers actually start from: an allegation from a person, not an evidence file.

A tip tells you where to look. It proves nothing on its own, and it carries risks a file does not. It is a single source. It is untested. It sometimes has a motive behind it, a grudge, a rivalry, or someone positioning ahead of a retrenchment. Occasionally it is deliberately false and pointed at the wrong person.

Suspicion also does something quiet and damaging to the investigation. Once you have a name, everything ambiguous starts to look like confirmation. The late arrival becomes evasion. The stock variance becomes theft. A disciplined investigation tests the alternative explanations rather than collecting agreement, because a representative will raise every one of those alternatives, and the panel will want to know why you did not.

Is a polygraph result enough to prove misconduct?

No. A polygraph result corroborates, it does not convict. A dismissal cannot rest on a failed test alone, because the result does not prove the misconduct and the employer still carries the onus of proving it under the Labour Relations Act. We set out the case law and the conditions that give a result weight in our piece on polygraph evidence and CCMA admissibility. Where stock is the issue, the same standard applies to a stock loss investigation.

The sequencing is what most employers get wrong. A polygraph pointed at a suspicion produces a suspicion. A polygraph pointed at a case you have already built produces corroboration a commissioner can weigh. Run the investigation first, then use the test to narrow or confirm.

Does evidence still count if it was gathered unlawfully?

Lawfulness is not a compliance formality bolted on afterwards. It is a precondition of the evidence being usable.

Two statutes govern most of this ground. POPIA requires that personal information be processed lawfully, for a defined purpose, and no more widely than that purpose needs. An investigation touches personal information constantly, and the fact that you suspect someone does not suspend their rights. RICA governs the interception of communications. Intercepting without proper authority is a criminal offence, not a technicality.

Evidence obtained improperly can be excluded. But exclusion is not the worst of it. Unlawful collection creates a second matter with the organisation as the respondent, and hands the other side something better than a defence: an argument about your conduct rather than theirs. A case that should have been about the theft becomes a case about how you read someone's messages. We deal with the detail in POPIA and workplace investigations, and our broader position is set out on our compliance page.

The discipline is simple to state. If a method cannot be explained openly to a panel without embarrassment, it does not belong in the investigation, however tempting the shortcut looks at the time.

Can a dismissal be unfair even when the employee is guilty?

Yes, and this is where sound cases die quietly.

Consistency of treatment is the first exposure. If comparable employees who did comparable things were treated differently, and there is no defensible reason for the difference, the dismissal can be found unfair even where the misconduct is proven. The employee does not have to show they are innocent. They only have to show that someone else was not dismissed. Sanction history is evidence too, and it is evidence the other side will assemble whether you have or not.

Procedural fairness is the second. The employee must be told the case against them with enough particularity to answer it, given reasonable time to prepare, allowed representation, and heard by someone impartial. An investigator who also chairs the hearing is not impartial, whatever their intentions.

Both of these are decided before the evidence is ever weighed, which is why we build the process record alongside the evidence rather than reconstructing it afterwards.

What do you receive at the end of a court-ready investigation?

A documented, corroborated account of what happened, with the chain preserved and the process defensible. In practice that is:

• A written account tracing the conduct, with each finding tied to the evidence supporting it
• Corroboration from independent sources, so no finding rests on a single voice
• An indexed exhibit set with an unbroken, recorded chain of custody
• Statements taken close to events, while recollection is still worth something
• A record of how each item was obtained, so lawfulness can be demonstrated rather than asserted
• An investigator available to testify and to be cross-examined on the work

That last point is a test worth applying to any investigator you appoint. Work that cannot be defended under cross-examination by the person who did it was never court-ready. It was only ever a report.

We prepare this evidence to the same standard whether the matter ends in a hearing, a settlement, or a prosecution, because you do not know at the outset which one it will be. That decision is usually made months later, by people reading what you collected today.

Related reading: our approach to forensic investigations, and specialist fraud investigations for procurement and asset matters.

This page is general information about evidentiary standards, not legal advice. Specific matters should be taken to your legal representatives.