Bearing in mind that the court here is dealing with circumstantial evidence, the question is: which of the two possible versions is the more probable: Mothlang hacked the employee’s passwords or the employees were involved.
The common cause facts alone showed that there was sufficient prima facie evidence that the employees were involved in the fraud.
• Their persal profiles were used
• Although they changed their passwords monthly, Mothlang continued to access their accounts
• The one employee signed a form appointing a ghost employee
• The fraud occurred in their functional area, using their access rights
• The fraud was sustained over a long period.
In deciding whether an employee is guilty or not, there are two types of burdens of proof. Firstly, there is the evidentiary burden which shifts between the parties as they present their evidence. In this case, the common cause facts alleviated the employer of its evidentiary burden because the evidence (albeit circumstantial) showed it was more probable that the employees were involved than the possibility of Mothlang having hacked their passwords.
The evidentiary burden then shifted to the employees to provide credible evidence to counter the evidence of the employer which they were unable to do.
• They could not explain how Mothlang repeatedly obtained their updated passwords.
• They could not explain why their profiles were used for the fraudulent appointments.
• They could not explain why one of them signed a form appointing a ghost employee.
• They could not explain why the fraud was concentrated in their unit and linked to their access rights.
Because there was no probable evidence to counter the common cause facts, the employer succeeded in discharging its overall burden of proving that the employees were guilty.
