Which document helps prove the handling of evidence collected during an incident?

• A. Incident Report
• B. Training Schedule
• C. Communications Record
• D. Evidence Chain of Custody

Answer: (B)

The essential idea is that proving how evidence was handled relies on a documented, chronological record that tracks every step the evidence goes through. This is the evidence chain of custody—the log that notes who took custody, when, where the evidence was stored or transferred, how it was secured (seals, packaging), and any analyses or dispositions. This continuous trail protects the integrity of the evidence and supports its admissibility in investigations or legal proceedings.

An incident report records what happened and the sequence of events, but it doesn’t systematically track the physical or digital evidence itself. A training schedule shows who was trained and when, not how evidence was managed. A communications record logs messages and decisions, not the custodial history of the evidence.