Intelligence management

Research and analysis

Analysis is an important tool for policing. It is used to understand crime and disorder issues, to investigate criminal incidents and to support the development of knowledge in increasingly diverse specialist areas.


Intelligence cycle

Analysis forms part of the intelligence cycle. Together with research, it is a method of processing material in order to support and assist decision making. The intelligence cycle is a cyclical and sequential process that allows information to be developed into intelligence.

The following information outlines how research and analysis is applied within the intelligence cycle. It also explains the roles of the analyst and researcher, data sources, analytical techniques, output reports, dissemination of output reports and the role of the analyst within major incidents.


The direction phase involves setting tasks and actions at both the strategic and tactical level. Practitioners should discuss the exact requirements and objectives of the task with the customer to create the terms of reference for the output.


  • Before directing a task, it should be decided whether the output is a summary of fact, ie, what is known or what has happened and knowledge gaps related to these, or whether it is supposition or an assessment of what may happen. This is important as it distinguishes if research or analysis is required and determines the appropriate allocation of the task.
  • The timing that a task or action is given. The greater the delay between an issue being identified and the commission of research and analysis, the less useful and relevant the research and analysis may be.


Once the practitioner has agreed terms of reference, data is collected according to the scope, parameters and methods decided on. Not all data sources may be computerised and alternative sources may be appropriate, for example, audiovisual data or scene visits.

Scene visits can be useful to understand and interpret more accurately the detail in data sources (for example, crime reports, statements or interview transcripts). A visit can also provide the context of the subject matter, whether this be a homicide or a location affected by antisocial behaviour.


  • Does permission need to be sought and from whom, are there any health and safety matters, and what preparation is required to achieve the best benefit from attending the scene? The practitioner should be aware of the timing of their visit and whether other people are attending at the same time and how their visit may affect the collection of evidence or an ongoing search.


Collation involves organising material into a variety of formats that best facilitate research and analysis. This stage may also involve summarising material such as statements or interviews. It is important that this is conducted accurately and that exact words and phrasing are used where possible.


  • At the start of collation, compiling a schedule of all the material used can provide a reference point for noting what data sources are related to specific topics and when and where data was acquired (its provenance). Annotation and categorisation at this stage can also assist evaluation and may be particularly useful in complex cases.
  • Ways of presenting material to help evaluate and analyse the material collected. Commonly used collation tools and how they may be used are described below.
  • During the course of a live investigation, it may be possible that the collation, evaluation, analysis and dissemination phases occur many times prior to the completion of the terms of reference. Where this is the case, version control is critical to record which information was used to support which decisions and when.
  • During the course of a live investigation, material gathered as a direct consequence of the investigation could be the prime source of information, however, practitioners should be aware of other material from in-force databases, partner agencies and open sources which may be available and relevant. Researchers and analysts should have access to the range of technology that supports them in conducting their role effectively.
Commonly used collation tools
Association/network charts

These charts depict links between people, groups, companies, vehicles, communications data and addresses, and highlight the nature of those associations. Association/network charts can be used in evaluation and analysis to identify intelligence gaps, disruption opportunities and intervention points.

Timeline/sequence of events

A timeline or sequence of events chart portrays a chronology of events. These are based around themes which can include people, vehicles, groups, addresses, telephones and general non-specific types of events (eg, suspicious sightings). These ‘theme lines’ run in parallel and can be used in evaluation and analysis to understand what and who were where at any point in time, and any gaps or discrepancies in accounts.

Comparative case charts

A comparative case chart organises data in a tabular format where descriptive details of a number of people, objects, locations or events are compared to identify similar and dissimilar characteristics. This is particularly useful for evaluation and analysis to identify potentially linked series.


Collating material onto maps is appropriate where material is sufficiently geographically referenced (for example, an address, postcode or geographic reference numbers such as eastings and northings). Maps can be used in evaluation and analysis where geography can be a linking factor between events, or to show routes travelled. Maps that overlay time elements can be particularly useful to show, for example, the position of key subjects at specific times.

Flow charts

There are numerous potential applications, but at its simplest a flow chart shows a direction of travel of an entity against criteria of time or place. Typical flow charts include commodity flow (eg, drugs, property, people) financial flow and communications. Where communications data is the subject, directional arrows should be used to show the originator and receiver and to distinguish the type of communication used (eg, phone call, voicemail, text, email). Flow charts are used in evaluation and analysis to understand movement, patterns, associations or conversations, and can indicate intelligence gaps, disruption opportunities and hierarchies among groups.

Frequency charts

Frequency charts can indicate the strength of a relationship between entities, for example, the link between telephone numbers or social media pseudonyms and how many times each entity has contacted another. They can be used alongside other collation tools such as association charts to evaluate and analyse hierarchies or controlling influences within an organisation or network.

Story boards

These can be used for intelligence purposes but are normally requested at the evidential stage of an investigation. They are a popular visual method for displaying all the evidence gathered (not solely analytical evidence) and displaying it in a chronological order of events. They are often produced in a presentation format and are especially useful in major incident and organised crime investigations.


The evaluation stage in the intelligence cycle represents the translation of material from its collated format into meaningful information. In order for this information to be accurate and objective, the collection and collation stages must have been completed thoroughly.

During evaluation, value is added to the raw data through summary, assessment and/or interpretation. Seeing all the information together provides an overview of the issue at hand.


This is the process of forming creative interpretations of, or solutions to, an issue, often in a group setting. This evaluation technique can be applied within the 5WH matrix where those who have knowledge of the subject matter apply their knowledge to document what is known versus what is not known for each of the 5WH variables: who, what, where, when, why and how.


The purpose of analysis is to gain an understanding of issues in order to prioritise them and inform the development of problem-solving responses.

Analysis identifies patterns in information enabling the analyst to draw inferences from them so that operational decisions can be made on further actions to take. This might include enforcement activity, additional information gathering or a crime and disorder reduction strategy. It supports strategic decision making and the tactical deployment of resources to prevent, reduce and detect crime and disorder. It also identifies effective practice and lessons learnt through a review of tactical and strategic activity.

Analysis is necessary when the task requires supposition or an assessment of what may happen. This type of judgement is made using a process of development which is based on one or more inference:

  • hypothesis
  • conclusion
  • prediction
  • estimation.
Inference development

Inference development is used to make judgements by interpreting statements of facts drawn from the evaluation phase (premises) and drawing conclusions based on it.


  • Objective thought is essential when developing inferences. Analysts need to be aware of cognitive bias and how this may affect their findings. As such, consideration should always be given to the value of information and whether other material can support or contradict the premise or inference.
  • Disclosure must be considered when making inferences. The formulation of each inference should be underpinned by premises that demonstrate how the inference has been drawn. This should be documented together with any decisions made.

A hypothesis is a theory that requires testing through collection, collation and evaluation of further data. A number of hypotheses may be posed relating to a single issue, all of which will need testing. This process is useful to anticipate a number of circumstances, such as lines of defence, that may be used in court or during an interview.

It may be necessary to appoint a specialist where a hypothesis is developed around aspects of a case that require a level of knowledge outside the analyst’s role. For example, a behavioural psychologist may advise on motive and a geographic profiler may advise on key locations within homicide investigations.


As a result of the process of testing hypotheses, a confirmed inference can be made in the form of a conclusion.


Prediction is an inference about something that may happen.


This is an inference that makes a quantitative proposition about an issue, based on a sample of the statistical population.


The dissemination of output is critical to the intelligence cycle, and the timely delivery of output is important to drive decisions and maintain momentum in investigations. The appropriate method of dissemination may vary according to the time available, the users’ requirements and the nature of the material itself. A collation tool (such as a chart).

During the course of a live investigation, the practitioner may be invited to participate in operational briefings and management meetings. Their contribution towards this is a form of dissemination and should be recorded appropriately.

Research or analytical output may form part of the evidential case in a prosecution. Here output will be in the form of an exhibit and will be in an evidential format rather than an intelligence format. In the court setting, the analyst or researcher is considered a professional witness. A professional witness presents factual evidence that has been produced by them within their professional role. This is distinct from an expert witness who offers opinion based on skills, experience and knowledge.

The analyst or researcher may be asked to work with the CPS and barristers to prepare for court. Early involvement is particularly effective and can help with:

  • providing a logical structure for the court file
  • explaining the analytical or research output
  • agreeing to further material being presented in a specific manner to the jury, eg, to simplify complicated information or to assist with clarification of key issues or facts
  • deciding on the best format to use to present the material
  • anticipating lines of defence.

While the court is sitting, and providing the practitioner is not also a witness, the analyst or researcher may attend court to support the entire prosecution team by using their knowledge to highlight discrepancies in witness testimonies in court.

The role of the analyst

Analysts are deployed in support of problem solving and to inform those making decisions through tasking and coordination processes. Analysis supports this by identifying and developing an understanding of problems to help decide which of these problems should be prioritised.

The policing professional framework provides national rank profiles for officers and level profiles for staff, based on national occupational standards (NOS). To carry out this role, analysts must be competent to level 1 – plan and manage own workload. They must also be able to:

  • discuss and develop terms of reference for an intelligence analysis product
  • obtain and evaluate information for intelligence analysis
  • apply analytical techniques to interpret information for intelligence analysis
  • use inference development to make judgements based on intelligence analysis methods
  • develop recommendations based on the results of the intelligence analysis methods
  • create an intelligence analysis product to support decision making
  • disseminate the intelligence analysis product
  • review the effectiveness of the intelligence analysis product.

Personal qualities for this role include:

  • decision making
  • leadership
  • professionalism
  • public service
  • working with others.

All analysts need to undertake professional training as detailed in the Intelligence Professionalisation Programme.

The role of the researcher

The researcher is responsible for:

  • searching and retrieving information
  • synthesising intelligence and other material
  • establishing facts
  • compiling reports and presenting their findings.

It is not always possible or necessary to employ an analyst and a researcher together. While an analyst is able to undertake their own research, a researcher cannot undertake analysis.

To carry out this role researchers must be competent to level 1 – plan and manage own workload. In addition, an intelligence researcher must be able to:

  • obtain and evaluate information for intelligence analysis
  • disseminate the intelligence analysis product
  • research, prepare and supply information.

Personal qualities include:

  • decision making
  • leadership
  • professionalism
  • public service
  • working with others.

Crime theories and approaches

There are six questions that any research and analysis should seek to answer: what, when, where, why, who and how. The 5WH questions can be applied to most situations, although some, such as what and where, are usually easier to answer than who and why.

These questions can be used to support the collection process by organising what is already known and where information is required to answer what is unknown. The figure below shows how this information can be presented in a table to identify gaps in information.

Crime thories table with the headings: Question? What is already known? What is not yet known?

Academic study of crime and criminal behaviour seeks to identify factors that may shape criminal behaviour, and how these factors can impact on different crime types and patterns of crime. There are a number of relevant theories and approaches.

Rational choice theory

Making process in committing a crime, how to perpetrate it, and the preference to carry out a crime which is easy, rewarding, and safe. A number of decisions are made by a potential offender in relation to the opportunity, such as the desirability of a particular commodity or the likelihood of being caught. A common acronym used to describe the desirability of items is CRAVED:

  • Concealable
  • Removable
  • Available
  • Valuable
  • Enjoyable
  • Disposable.

This acronym helps to understand why one type of item may be stolen frequently, or is more vulnerable than another.

Routine activity theory

This theory suggests that a person may choose to offend if they have the motivation to attack a target, have the right kind of target to attack, and if a target does not have a guardian (Cohen L. and Felson M. (1979) Social Change and Crime Rate Trends: A Routine Activity Approach). By identifying and understanding these three elements of an offence or series of offences, it is possible to determine options for reducing crime either by providing protection or removing the motivation or target. Routine activity theory relates mainly to acquisitive crime.

Problem analysis triangle

For a crime or incident to occur, an offender and a suitable target must come together in a specific location without an effective deterrent. The figure below shows how these three elements: victim, offender and location, form the problem analysis triangle (PAT). When developing a description and understanding of a particular crime or disorder problem or individual, analysis should consider each of the elements of the triangle. Further, when developing solutions to that problem, the three elements should again be considered as a focus for activity.

Problem analysis

Scanning, analysis, response and assessment model

This model is used to support problem-solving policing. Scanning, analysis, response and assessment model (SARA) can be used to manage problems of all types, including crime, disorder and substance misuse.

The four stages of SARA are:

  • Scanning – identifying issues or problem areas using basic data
  • Analysis – identifying the nature of the problem, including the identification of trends and series of crimes and disorder, and problematic locations, and further, suggesting the potential causes
  • Response – developing a solution for the problem, with partners and the community
  • Assessment – reviewing the success of the solution and identifying learning.

Problem, cause, tactic/treatment, output and result

Problem, cause, tactic/treatment, output and result (PROCTOR) emphasises the importance of analysis throughout the SARA process, rather than as a discrete step.

Terms of reference

The direction of any piece of research and analysis work is set through terms of reference. This should describe the task, define the scope of work and explain what methods and techniques will be used. Terms of reference ensure that the resulting product:

  • sets a clear direction
  • is in line with current priorities
  • focuses on the questions that need to be answered
  • is agreed with the customer.

Terms of reference are usually prepared in direct consultation with the customer. The recommended minimum content for terms of reference is:

  • aims and objectives
  • data sources
  • scope and methods
  • parameters
  • limitations
  • timescales
  • reporting mechanism and audience.

The discussions to build terms of reference may be aided by a mindmapping exercise. This will expose all aspects of the issue to be assessed and prevent important areas being missed. It will also help to identify the information required, give an indication of the feasibility and the likely time needed to complete.

Once prepared and agreed, the terms of reference should be retained so that it can be referred to, both during and at completion. The terms of reference will also require review and possible amendments during the analysis.

Checklist: developing terms of reference

To create and negotiate useful terms of reference, it is necessary to

  • be aware of the tools and techniques that can be employed to meet the tasking
  • identify data sources to build an awareness of the information that is available and can be accessed within the timeframe
  • communicate what can and cannot be achieved, based on information sources
  • estimate an appropriate timescale for completion.

Data sources

Practice is based on an extensive variety of data, information (including intelligence) and knowledge drawn from a wide range of sources. The breadth of sources grows continually as new sources are identified and awareness  of the importance of understanding context increases. Collection, collation and evaluation are three inter-linking steps of the intelligence cycle, however, evaluation can occur at every stage.

Practitioners should maintain their knowledge of potential sources of information as well as a description of the information available, its reliability, validity and accuracy. They must also be aware of the procedures for acquiring that data. A collection plan should be used to manage the information. This will ensure that the information collection remains focused on the terms of reference. It will assist in identifying gaps in information, or where barriers exist that require action from managers.

Performance data can be used when compiling analytical reports and intelligence products to assist in priority setting. This data can be provided by performance teams and should be used where it is appropriate to do so. It is important to understand the different roles carried out within intelligence and performance, and for each to recognise where their roles overlap, and to support each other.

Before requesting data, it is important to be familiar with the current force or organisational policy and protocols for applying for communications data. The following should be understood:

  • Who can apply for data – this is usually carried out by an SIO, investigating officer or intelligence officer, and is not the analyst’s role. The analyst will provide supporting detail for the application.
  • The impact of the grading of enquiries and what effect this has on how quickly the data may be returned.


Analysis is not a statistical function, but the ability to interpret statistics and understand how they can support analysis is necessary. The basic techniques within this section describe:

  • how to work out how much a specific crime or disorder has risen or decreased between two time periods
  • calculating upper and lower control limits
  • the correlation coefficient (Pearson method)
  • using averages.

These techniques allow the analyst to describe data effectively and make basic inferences.

Describing increases and decreases

It is usual to start pieces of analysis with an overview of any increases or decreases over a given period of time. Crime statistics can be influenced by a range of factors with some increases and decreases being a matter of pure chance or coincidence. Understanding what has influenced the levels of recorded crime, and if this is due to random factors or special events is not always easy. Statistical methods look for significant differences (statistically significant) rather than random effects. Any interpretation of data is carried out objectively in order to avoid making assumptions gained by experiences and influences. Statistically significant findings need to be interpreted and analysed to identify interest and relevance.

The period of time used for comparison should be carefully considered and clearly defined within the terms of reference. If the time period is too long, recent patterns may be diluted by longer-term trends. If the time period is too short, seasonal trends may not be taken into account. Practitioners should always use actual numbers when describing a change, followed by the percentage change identified.

The percentage increase or decrease can be worked out using a simple calculation which requires two time periods: the earliest time period and the most recent time period:

percentage change = after – before x 100


Incidents can also be described per household or per resident within a geographical area. Increases and decreases per household or per resident can be calculated by using the same equation.


Averages are used to describe the central tendency of a set of numbers. The types of averages that can be used are the mean, mode and median, and tend to be used in slightly different circumstances.

The mean is calculated by adding a set of numbers together and dividing this sum by the number of items in the set. The mean is the most commonly used average, although it is adversely affected by an extreme number in the set.

The median is the middle number in a set of ranked numbers and is not significantly affected by extreme numbers in the set. If the set of numbers is an even number, the mean average of the two middle numbers is used as the median.

The mode is the most frequently exhibited number in the set. In a very large set of numbers there may be more than one mode in the set. The mode is not affected by extreme numbers.

Upper and lower control limits

These limits are calculated to identify typical variations. They are based on standard deviations from the mean average of the data. The standard deviation is a measure of the average distance of a set of numbers from the average.

Any data falling outside the control limit is displaying a figure outside the expected variation and is, therefore, statistically significant. The extent of this significance depends on the upper and lower limits used. Typically, these are two standard deviations from the mean, giving a confidence value of 95%.

Description of information

When considering the inclusion of statistical information (whether tabular or graphical) within analytical products, the added value that they give should be assessed. Only graphs and tables that contribute to the communication of the analysis should be included, and perhaps only as an appendix. Where they are used they must be clearly labelled with a legend, and their interpretation added to the text.

The use of colour to highlight key figures and distinguish between categories should be limited. Scales should be used consistently within reports, unless this is clearly explained.

Analytical techniques

There are nine traditional analytical techniques that can assist in answering the 5WH. Analytical techniques can be used to understand and predict threat, harm, risk and opportunities. A combination of these techniques can be used to identify prevention, reduction and disruption opportunities. Their practical application is outlined below.

Crime pattern analysis

Crime pattern analysis (CPA) identifies the nature and scale of emerging and current crime and disorder trends, linked crimes or incidents, hot spots of activity and common characteristics of offenders and offending behaviour. Useful tools for CPA are maps, graphs and tables.

Those undertaking analysis should have a general awareness of the types of crime and disorder within their geographical or specialist scope. This makes it easier to identify patterns as they emerge as well as any unusual or developing event factors.

There are four main types of CPA:

  • hot spot identification
  • crime and incident trend identification
  • crime and incident series identification
  • general profile analysis.

Hot spot identification

Hot spots are locations that display significantly higher than usual levels of crimes and/or incidents. They may be identified as priority locations for problem-solving responses. Hot spots develop as a result of increasing targets, increasing offenders or decreasing controls. They can be short term, such as an area with a low burglary rate experiencing a sudden increase, or long term, for example, a problem residential estate. Short-term hot spots can be reduced using intervention tactics such as intelligence gathering and disruption methods. Long-term hot spots require intervention that is more focused on problem solving, and usually takes place in partnership with other organisations.

Hot spot analysis can provide early indications of where to focus attention. Useful comparisons with hot spot areas can be made by examining crime neutral areas (cold spots), which have relatively few crimes, to establish why the hot spot area is affected by crime and if there is anything within the cold spot that can be copied within the hot spot.

Continuing analysis can help to maintain an understanding of the nature of offending and offence levels within identified hot spots.

Crime and incident trend identification

This type of analysis looks at trends in crime or incidents. A crime or incident trend is a broad direction or pattern that specific types or general crime and/or incidents are following.

Three types of trend can be identified:

  • overall trend – highlights if the problem is getting worse, better or staying the same over a period of time
  • seasonal, monthly, weekly or daily cycles of offences – identified by comparing previous time periods with the same period being analysed
  • random fluctuations – caused by a large number of minor influences, or a one-off event, and can include displacement of crime from neighbouring areas due to partnership activity or crime initiatives.

Crime and incident series identification

A series is where a number of similar crimes or incidents are identified as probably being committed by one offender or group of offenders because they are linked by modus operandi (MO), signature behaviour, intelligence or forensic evidence.

A series can also occur where the offenders are able to locate temporarily vulnerable targets and places, or where offenders are new to a crime type or area. The controllers of these targets and places may act to prevent future attacks, but offenders move on to other similar targets and places. The method of analysing crime series or linked events is called comparative case analysis (CCA).

It is used to find patterns within the detail of an incident or crime event that will potentially link them because they are distinct enough from other events.

General profile analysis

This type of analysis identifies and examines the characteristics of victims, or common characteristics of offenders displaying particular offending behaviour. It is strategic in nature and is based on large information sets and statistical analysis. Examples of general profiles are the examination of the characteristics of serial rapists, or the characteristics of repeatedly attacked individuals or groups of individuals.

The general profiling of victims may help to identify which people are most at risk and when they are most at risk. Victim profiles can be based on categories, for example, occupation, relationship with the offender, demographic group or general description or characteristics. Analysis of previous repeat victims within these general profiles may give an indication of the average time between crimes. This could then be used to focus crime prevention efforts on specific repeat victims.

Demographic and social-trend analysis

Demographic and social-trend analysis (DSTA) examines how demographic and social changes within an area or within a demographic group can affect levels and types of crime and disorder.

These changes may be due to an individual incident such as a live music event, or may, for example, be because of a long-term change in either the ethnic make-up or age profile of a geographical area. DSTA is often used to develop an understanding of a particular problem which has been identified by crime pattern analysis.


  • can be used to make decisions about resources at a strategic level
  • highlights where future pressures on resources are likely to arise
  • identifies current or emerging problems
  • can be used to improve knowledge in relation to partnership working
  • aids the planning process for seasonal or tactical operations in response to emerging social phenomena or movements of people
  • helps to focus intelligence gathering
  • predicts criminal activity.

DSTA usually depends on the collection of information from openly available sources and organisations outside policing. Examples of information used for DSTA include:

  • unemployment levels
  • truancy rates
  • homelessness levels
  • details of socio-economic status
  • population growth
  • inward and outward population migration
  • family size
  • types of domestic, business and community premises
  • ethnic origin of the population
  • the age of individuals living in an area
  • media publication of forthcoming events
  • details of new housing estates, schools, businesses and transport routes.

The vulnerable localities index (VLI) is a method that uses DSTA to identify specific locations within an area which may require extra resources to protect it from the impact of crime and disorder.

Network analysis

This provides an understanding of the nature and significance of the links between entities. It also assesses the strengths and weaknesses of criminal groups or organisations. Network analysis:

  • provides a detailed picture of the roles played by individuals, including their rank in a hierarchy and level of control
  • supports the identification of intelligence gaps and subjects to target
  • gives an understanding of the scale and seriousness of the threat posed by criminal groups
  • shows associations within and outside the network
  • identifies key areas and possible tactics for investigation and disruption
  • focuses intelligence gathering
  • will often be developed using graphical software to demonstrate the links between people, objects, communications data, locations and events
  • can be used to examine the type of links between entities, including between people who are not believed to be committing criminal offences, for example, links between victims or family associations and relationships.

Market analysis

The purpose of market analysis is to identify the criminal market around a commodity or service, and can be used to describe a criminal market at any level. Market analysis is used to:

  • outline the level of activity of a market
  • identify emerging market trends
  • understand and explain how and why the market operates
  • assist the selection of subjects for targeting
  • highlight potential new sources of information.

Criminal business analysis

Criminal business analysis (CBA) is used to develop an understanding of how criminal activity, businesses and techniques work. It is especially useful for technical, complicated and new criminal activity. CBA is used to:

  • develop knowledge and understanding about the way criminals work
  • identify key points for disruption
  • provide information to focus intelligence gathering
  • predict criminal activity
  • facilitate investigative techniques
  • identify requirements for alterations in resource levels to meet unprecedented threats.

CBA shows the various activities required to achieve a specific criminal aim. The analysis should identify the logical order of these activities and their interdependency. Interdependent activities are those which cannot be achieved without the completion of others, such as the theft of a vehicle to escape the scene of an incident. These activities are often the points where intervention will have the greatest disruptive effect.

A flow chart is a useful tool for CBA, and can be used to show business and financial processes.

CBA is often used in conjunction with market and subject analysis to provide a comprehensive picture of criminal activity, people and other entities involved.

Risk analysis

This is one of a number of techniques that can be used to support threat assessment. It can be applied to a range of different situations in order to identify the likely impact of law enforcement action or inaction, and to predict criminal activity. Risk analysis supports the assessment of the scale of the risk posed by individual offenders, organisations or crime types to potential victims, the public generally, law enforcement agencies or the criminal justice system.

Risk analysis should include a SWOT analysis (strengths, weaknesses, opportunities, threats) of an offender, criminal organisation, or crime or disorder type.

Subject analysis

This provides detailed analysis of an individual identified as a victim or witness, suspect or offender. It can be used to initiate or support an ongoing operation or investigation or to produce a subject profile.

A subject profile includes a number of sections which are compiled by the intelligence unit and are not the analyst’s responsibility. These include personal record, criminal record, communication and financial data, physical description/appearance and lifestyle information. This information may be gathered by research resources or other intelligence staff.

Subject analysis develops an understanding of the scale and seriousness of the threat posed or harm suffered by the individual(s). It also provides a picture of the subject’s lifestyle.

Results analysis

Results analysis evaluates the effectiveness of an activity. This could include:

  • enforcement tactics
  • intelligence gathering
  • impact of activity
  • cost benefit analysis
  • cause and effect analysis.

It also includes whether the crime or incident levels have changed in the way expected as a result of the operation or initiative.

Results analysis:

  • identifies effective practice and highlights areas for improvement
  • recommends the discontinuance of ineffective strategies
  • ensures investment in what works
  • facilitates knowledge management
  • provides valuable input to the knowledge products and organisational memory database
  • supports resource decisions
  • aids the development of skills and knowledge levels of personnel
  • monitors the progress of plans
  • assesses the effectiveness of pilot projects
  • aids and refines professional development
  • identifies unintended consequences.

For this type of analysis to be successful, the operation or initiative must have specific objectives and a process to measure them by, which are agreed at the outset. Results analysis should be considered within the terms of reference. Any results analysis carried out before a trial or appeal is subject to the rules of disclosure.

Operational intelligence assessment

Operational intelligence assessment (OIA) is a method of ensuring that medium to long-term investigations remain focused on their original objectives. It is not solely the analyst’s responsibility to complete an OIA. An operational intelligence assessment:

  • assists the prevention of mission creep
  • identifies priorities for the intelligence effort involved in the investigation or operation
  • focuses decisions about resources
  • guides investigative activities
  • verifies that protocols such as the correct authorisations are present
  • aids the review of compliance with Human Rights Act 1998, Regulation of Investigatory Powers Act 2000 and other legislation.

Case analysis

Also known as incident analysis, this examines an incident or series of events in order to support the investigation. Case analysis:

  • identifies new lines of enquiry
  • corroborates witness accounts with those of possible offenders or subjects linked to a major inquiry
  • identifies gaps, similarities and discrepancies in statements
  • identifies new or potential witnesses
  • visualises the movements of suspects, observations of witnesses and routes travelled
  • outlines the entire time span of an incident or a specific period within it
  • shows the sequence of events prior to, during and after an incident
  • shows the links between individuals involved in the event.

Structured analytical techniques and critical thinking

In addition to NIM techniques, there are a number of critical thinking and structured analytical techniques which can be applied. These techniques complement and augment existing traditional tools and techniques.

Based on Jerry Ratcliffe’s 3i model, structured analysis helps to:

  • interpret the criminal environment by supporting and encouraging better structure, greater rigour and more critical, explanatory products
  • influence decision makers by creating greater confidence in products for decision makers, through a clearer argument and fuller picture, allowing them to be more fully and consistently translated into action
  • impact on the criminal environment through decision makers generating action based on a clearer understanding of the problem and any opportunities for action.

Examples of structured analytical techniques include:

  • key assumptions check
  • analysis of competing hypothesis
  • team a/team b structured debate
  • force field analysis
  • SWOT analysis
  • cone of plausibility
  • back-casting
  • structured brainstorming
  • issue re-definition (refining the question).

Which analytical technique should be used?

Different analytical techniques work with different types of crime and criminality. The following examples demonstrate this but are not prescriptive. Where analysts feel that alternative techniques meet their specific needs then these should be used.


Analysts will be aware of the problem analysis triangle where, for an incident to happen, the following factors will be present:

  • victim
  • offender
  • location.

This can be shown graphically as follows:

Problem analysis triangle

The analytical techniques which can be applied to each of the factors of victim, offender, location and a case/incident are given below:

Diagram showing analytical techniques

The analytical techniques can interrelate as the example below displays:

Relationship between analytical techniques

Output reports

These written reports are essential for disseminating key findings. They should add value and may be accompanied by charts, maps and graphs as necessary. The table below shows the recommended content for a report.

Output reports table

Once a report is complete, peer review can help to establish that the product is clear and concise and responds to the original terms of reference.

Output reports can contribute to each of the intelligence products outlined in APP on intelligence management.


All recommendations should be SMART.

  • Specific – recommendations should be clear, detailed and unambiguous.
  • Measurable – recommendations should make it clear exactly what needs to be achieved. They should help to set operational objectives and objectives for results analysis.
  • Achievable – all recommendations should be achievable and focused on what can be done with available resources.
  • Realistic or relevant – the recommendations should be within the scope of the original terms of reference for the analysis and be realistically achieved if adopted.
  • Timely – recommendations should be presented as short, medium or long-term options. Alternatively, they could be prioritised and given a schedule.

The recommendations that are found in analytical reports should be outcome focused and based on the findings.

There are a number of methods that can be used to develop recommendations for problem solving. These include:

  • mindmapping
  • reverse mindmapping
  • SWOT analysis
  • impact analysis.

Recommendations within intelligence products focus on the operational activity required to meet those set out in the analytical report. Intelligence product recommendations are listed under the headings of prevention, intelligence, enforcement and reassurance.

If an analyst is given responsibility for compiling recommendations for an intelligence product, these must be developed in collaboration with subject specialists. The specialists should be staff members with knowledge of the specific geographical area, area of crime, or colleagues who are experienced in crime reduction and enforcement techniques.

Impact of recommendations

The consideration of the impact of recommendations identifies the possible negative and positive consequences of solutions. This can help to spot unexpected consequences of a solution or decision in advance. The process of problem solving is likely to lead to the development of a number of solutions. When deciding which recommendations to make, the following should be considered:

  • required outcome
  • potential benefits (short, medium or long term)
  • potential risks
  • affordability
  • cost effectiveness.

Dissemination of output reports

The output needs to be disseminated so that it can be used by others to make decisions. Dissemination should be agreed and set out as part of the terms of reference, based on who needs the information and the most appropriate format for dissemination. The amount of information disseminated will vary, depending on the audience.

The practitioner must ensure that the:

  • Government security classification (GSC) (previously the government protective marking scheme) grading is properly shown and that the report is disseminated accordingly
  • output is version controlled
  • most appropriate media for dissemination is chosen
  • recipient is able to access the report and has any graphical or mapping software necessary to read attached charts or maps
  • recipient is aware of any restrictions on the storage of the report.

Ongoing review of analysis

Once the analysis has been disseminated, any subsequent action should test the identified inference. The inferences that have been included should be reviewed to establish whether or not they were correct, and that resources are being deployed effectively. Once they have been tested, available options include:

  • if the inference is assessed to be correct but the problem persists, further direction may be required to address the issue and the intelligence cycle may need to start again
  • if the inference is correct and the problem no longer persists, the next stage is to end operational activity and begin a review of all activity to date
  • if the inference is assessed to be incorrect and the problem persists, further information collection will need to be initiated and additional analysis tasked.

Results analysis is a structured review of action that should be tasked at the outset and documented in the terms of reference. This enables the development of an efficient system of information collection required for the analysis.

Results analysis evaluates the effectiveness of resource deployment and identifies good practice and any issues that hindered the outcome. Once a final review has begun, whether formal or informal, it should concentrate on the value of the information gathered, the processes used to obtain information, the contribution of colleagues who collaborated on the work, as well as the final content of the analysis.

The role of the analyst in major incidents

This reference material applies to researchers and analysts, irrespective of the nature of their task. However, in major incident analysis, there are unique considerations that need to be taken into account. Considerations:

  • In order to synthesise intelligence with other material gathered during the enquiry and afford communication between the analyst, SIO and other staff, the analyst should sit in the major incident room (MIR).  Where this is not possible, the impact on the analyst’s task and outputs should be considered.
  • In order to work effectively within a HOLMES 2 environment, the analyst should: 
    • be aware of the processes, structures and governance of major incidents as detailed in the major incident room standardised administrative procedures (MIRSAP) and APP on investigation
    • be able to search and retrieve material from HOLMES 2
    • maintain close liaison with the researcher(s) and any external analytical services (such as those employed by the Serious Crime Analysis Section (SCAS))
    • maintain an awareness of the force and basic command unit intelligence requirements, informing the SIO of issues in the investigation that may impact on these (and vice versa).

SCAS analyst

These analysts are specifically trained in the behavioural analysis of serious and sexual crime. The remit of the SCAS analyst includes:

  • searching the national database to identify potentially linked offences
  • conducting QUEST/VODS searches to identify potential nominals of interest
  • liaising with force analysts to offer advice on the relevant importance of the offender’s behaviour to assist searching in-force systems
  • production of comparative case charts and analysis of these – in linked enquiries it is good practice for SCAS to take the lead on this
  • providing similar fact evidence on appropriate cases.

Page last accessed 16 January 2019