Managing investigations

The Criminal Procedure and Investigations Act 1996 Code of Practice under part 2 states that:

All investigators have a responsibility for carrying out the duties imposed on them under this code, including in particular recording information and retaining records of information and other material.

The successful management of an investigation requires planning, organisation, control and motivation.

Strategy development

Adopting an investigative mindset, using investigative evaluation and developing and testing case theory helps the investigating officer to understand the material that has been gathered. It also defines the additional material needed to make progress in an investigation. An investigative strategy is needed to locate and gather this material effectively.

The purpose of an investigative strategy is to:

  • identify the most appropriate line(s) of enquiry to pursue
  • determine the objective of pursuing particular lines of enquiry
  • identify the investigative action(s) necessary to efficiently achieve the objectives, taking into account resources, priorities, necessity and proportionality
  • direct and conduct investigative actions to gather the maximum amount of material which may generate further lines of enquiry
  • understand and manage community impact.

Identifying actions

Investigator should use their knowledge and experience to decide which investigative actions are the most appropriate in the circumstances. They should also be aware of the legal and ethical considerations relating to the conduct of any investigative action.

Investigators must prioritise and determine the proportionality of the investigative process in accordance with force policies. The final decision about which investigative actions to undertake must be driven by the investigation itself and not just by completing a checklist. A standard method of developing the elements of the investigative strategy should be adopted.

Standard methodTable describing standard methods for investigators

Investigative actions

This is any activity which, if pursued, is likely to establish significant facts, preserve material or lead to the resolution of the investigation. The volume of actions should be proportionate to the type of investigation.

Types of action

1. General trawls for information

These can be undertaken in any investigation irrespective of the circumstances of the case, but usually take place in the early stages when information about the offence is likely to be vague. Examples of general trawls include:

  • crime scene investigation
  • victim and witness interviews
  • media appeal
  • house-to-house
  • area search
  • intelligence searches
  • tasking covert human intelligence sources (CHIS).

2. Specific lines of enquiry

These are generated throughout the investigation. They are evidence-specific, and some information about the crime is needed in order to identify the most appropriate action. Examples of specific lines of enquiry include:

  • tracing a named suspect
  • identifying and locating potential witnesses to interview
  • pursuing significant information that requires further information.

3. Actions during the initial investigative phase

These are mostly determined by the circumstances of the allegation. Examples include:

  • obtaining initial accounts from the victim(s) and witnesses
  • locating and securing material (eg, CCTV footage)
  • identifying and preserving scenes or routes to and from scenes
  • arresting the offender(s).

Investigative strategies

Investigating officers should consider the following when appropriate and proportionate to the case:

Managing resources

Planning and foresight are key to effective resource management. Investigators must identify the resource needs of an investigation at the earliest opportunity. These will vary depending on the crime type and whether it is a volume crime or a major investigation.

When deciding on the resources required, the investigator must consider the appropriate level of investigative response, the availability and cost of the required resources and whether their use is necessary and proportionate.

Resource types

Table describing various resource types available to investigators.

Prioritisation and proportionality

Some resourcing decisions in volume crime investigations are outside the investigator’s control, and the use of specialist or technological resources will primarily be driven by local force policies and budgets. Tactical tasking and coordination (TT&C) meetings and/or local tasking meetings will often dictate the level of response and resources which are allocated to volume crime investigations, in line with local policing priorities. See ACPO (2009) Practice Advice on the Management of Priority and Volume Crime (The Volume Crime Management Model), Second Edition. The use of experts will need to be considered carefully, as part of the overall use of resources. Investigators must prioritise the needs of the investigation against the available resources where resources are limited.

For further advice on resource management during major investigations, see NPCC (2021) Major Crime Investigation Manual (MCIM) and Major Incident Room Standardised Administrative Procedures (MIRSAP).

Under the Criminal Procedure and Investigations Act 1996 (CPIA), emphasis is placed on accurately recording resource use within an investigation.


Expert advisers (EA) are independent of the police service, but can assist an investigation by using their specialist knowledge and expertise to give an opinion on a particular matter. The National Crime Agency (NCA) Major Crime Investigative Suport (MCIS) maintains a database containing the details of EAs. In the first instance, investigators should contact MCIS to obtain the services of an EA. The facility is available 24/7 on 0345 000 5463. MCIS can also provide further investigative support. For more information on the services offered, see the MCIS poster (which should be treated as official).

If MCIS cannot identify a relevant EA, investigators can also use the following sources:

  • personal recommendations from other investigators
  • academic institutions
  • other professional registers.

The investigator needs to identify and manage the most appropriate EA to support their investigation.

Managing expert advisers

When engaging an EA, it is the investigator’s responsibility to:

  • security clear the EA as per force policy where they will be involved in a sensitive investigation, or where appropriate
  • agree terms of reference and a contract with the EA before they start work
  • provide the EA with the necessary material or information needed for them to perform their role
  • respect the objectivity and independence of the EA and not pressurise them to give a particular answer
  • ensure that the EA gives opinions on facts and hypotheses for which they are properly prepared
  • ensure that the EA understands their
  • develop and maintain clear lines of communication with the EA and provide guidance or updates throughout the investigation which may impact upon their work
  • quality assure and appraise the EA’s work at regular intervals.

Managing people

Managing people, including victims and witnesses, is integral to any investigation.

There are two components to people management: managing colleagues within the police service, and managing relationships with individuals who may assist the investigation or provide material to the investigation.

Depending on the nature and complexity of the investigation, an investigator has to manage and interact with various diverse individuals. Besides victims, witnesses and suspects, they may also include:

  • colleagues (including their welfare considerations)
  • experts and subject specialists
  • CHIS
  • solicitors or legal representatives (defence and prosecution) (see working with legal advisers)
  • representatives of partner agencies (eg, social services, the probation service, UK Border Agency (UKBA)).

Investigators need to develop positive behavioural traits to help them manage themselves and all the other individuals that they have to interact with.

Behavioural traits

The following list details some behavioural traits which may assist investigators to manage themselves and others. This is not a definitive list, nor is it in any particular order of priority.

Table describing various behavioural traits.

Welfare considerations

The welfare of all staff should be a primary concern for the police service. Some police officers and staff who deal with unpleasant incidents over a period of time may suffer adverse effects as a result. On an emotional or behavioural level, people react differently to traumatic situations or incidents.

Investigators and senior officers should ensure that staff welfare needs are identified as soon as possible and that support is available to reduce the potential damage suffered by an individual. These procedures should apply to all investigations, whether large or small, and to all police officers and police staff.

Specific risk assessments may also help police officers and staff to prepare for encountering disturbing images or situations.

Welfare needs

Types of reaction to trauma usually fall within a defined and normal cluster of responses. These include:

  • tearfulness
  • anxiety
  • shaking hands, arms and/or body
  • racing heartbeat
  • increased breathing rate
  • agitation
  • over alertness
  • being over talkative or becoming mute
  • difficulty in concentrating
  • feelings of guilt, self-blame or anger at self and others
  • feeling emotionally detached, emotionally blunt or numb.

It is important to note that someone who is displaying signs of distress may not necessarily be experiencing a trauma reaction. The above reactions should be seen as normal and acceptable responses to abnormal and upsetting situations or events.

Supporting individuals

The ability of a person to make an appropriate emotional and behavioural adjustment in the long term depends on the way in which they are managed when experiencing distress or a normal trauma reaction.

Where an individual is obviously distressed or suffering physical symptoms the following techniques may be used to alleviate their anxieties:

  • respond to them as an individual, in a calm, sensitive manner
  • take the person to a quiet, private location
  • acknowledge the person’s thoughts and feelings about the event and timescales, no matter how bizarre they may seem
  • allow them to express their distress openly
  • allow them to talk and do not attempt to pacify them or change the subject
  • normalise the person’s experience by reinforcing common-sense reactions
  • encourage them to be with and speak to colleagues.

Other practical options may include:

  • ensuring that individuals take a longer break before continuing their duties
  • temporarily moving them to another role, and allowing them to speak to a colleague who has experienced a similar event
  • considering other longer-term options such as taking time off and/or seeking support from other sources and agencies
  • referring the individual to occupational health.

Serious/long-standing enquiries

The welfare of staff involved in serious or long-standing enquiries should be a priority for SIOs when establishing the investigation team. Force systems and procedures should include compulsory counselling and team briefings and debriefings, or staff screening before their inclusion on investigations which may be particularly traumatic, eg, child deaths.

Consideration should be given to the following:

  • the duty of care to staff involved in the investigation
  • linkage with force occupational health provision (eg, psychological support interviews)
  • exit strategy for staff.

Managing risk

Investigators constantly make decisions about situations, based on incomplete information and in uncertain conditions. All areas of policing are susceptible to the risk of harm. There is an obligation on the police to identify, assess and manage risk to prevent or reduce the likelihood and impact of harm, damage to property or reputation, and to protect people’s human rights. Using risk assessment tools, eg, impact versus likelihood, could assist the police to assess the level of risk, thereby potentially reducing the amount of harm caused.

Risk areas

Particular risk areas relating to investigations involve decisions relating to:

  • victims
  • witnesses
  • suspects
  • the general public
  • police employees and the police service
  • the emergency services
  • the local community
  • local businesses
  • the parameters of the investigation (eg, failing to keep the big picture in mind and taking too narrow a focus, or failing to assign sufficient time or resources)
  • evidence collection/presentation (eg, accepting information at face value, allowing evidence to be corrupted, weaknesses in taking statements or verifying particulars)
  • individuals or groups of individuals (eg, exposing them to harm through not providing them with timely advice or information, failing to ensure that they attend court on time).

Quality assurance

Forces should have their own quality assurance processes to ensure that the minimum standards of investigation are complied with, and that an effective investigation has taken place.

Crime investigation standards assist supervisors to measure the performance of individual investigators and the quality of the investigation.

The charging process also provides quality assurance to the investigation process. Following a review of the case file, and to ensure that the case against the offender is evidentially robust, the Crown Prosecution Service (CPS) can direct the investigator to undertake further investigative actions as required.

QA processes

To ensure that a focused and good quality investigation takes place, supervisors review each crime and allocate it appropriately, setting and agreeing a clear investigative plan. The supervisor also reviews the crime report to ensure that all positive lines of enquiry have been identified and tasked, to promptly resolve the investigation. Regular supervisor checks must also be completed to check the progress of the investigation, offer support to the officer in charge (OIC) and to ensure that all investigative opportunities are considered and completed.

Supervisors should:

  • ensure that each member of their team is maximising enforcement, prevention and intelligence gathering opportunities at each stage of the investigations in which they are involved
  • ensure that victim contact is an integral part of any crime review
  • address areas of weakness within individual investigations
  • support the development of investigative skills within their team
  • identify generic weaknesses in investigative performance so that they can be addressed
  • ensure that any indicators inferring that the crime is a hate crime are investigated.

Supervisors are required to document on the review any further enquiries that are necessary. This means that they take responsibility for directing crime investigations and supervising staff effectively and with transparency, in line with local force policy for the duration of workload reviews.

Once the review is completed, the supervisor returns the crime report to the investigator or forwards it to a crime support unit (CSU).


The functions of a CSU can vary between forces. If the CSU contacts the investigator following the review of a crime report or enquiry, the investigator may be required to take further action.

CSU may:

  • manage and supervise the investigation of reported crimes which do not warrant the initial attendance of a police officer
  • provide an investigative function in addition to the administrative element required to manage the process, from the receipt of the crime report through to disposal and filing
  • identify crime reports of an unacceptable standard and notify supervisors accordingly
  • identify common areas of strength and weakness in crime investigation standards throughout the force
  • review crime reports received to determine the scope for further investigation and if necessary forward them on to investigators and/or enquiry teams as appropriate
  • review all undetected crime enquiries and file as undetected when the minimum standards of investigation have been met and no further lines of enquiry are viable.

Further action

The investigator may be directed to undertake the following further action:

  • re-contact the victim(s) for confirmation/clarification and enhancement of initial crime
    report details
  • interrogate crime recording and intelligence systems for repeat victim status and similar victims in the same locality
  • identify linked incidents using force mapping systems, and create the links on force crime recording systems
  • establish the existence of additional witnesses and arrange for interview/contact.
  • use community beat profiles as a good summary of criminality
  • establish the existence of further available evidence
  • review forensic opportunities and action by crime scene investigators (CSI)/scenes of crime officers (SOCO)
  • check that all police national computer (PNC) actions have been completed
  • prepare a handover package for further investigation by another unit
  • date file or ensure cancellation of incidents recorded as crimes that have been shown not to be a recordable offence.

Crime investigation standards

These are designed to support performance improvement in investigations and should underpin effective enquiries at each stage of the investigative process. Each force sets their own crime investigation standards, which are disseminated to staff. They should be interdependent with the national intelligence model, to ensure that they support the deployment of appropriate resources to areas of identified priority at the correct time.

Police officers exercise a high level of discretion when dealing with situations on the street. This is not directly overseen by sergeants and inspectors, and this makes the supervision of frontline officers challenging. Crime investigation standards are, therefore, useful to monitor and measure the performance of individual investigators and the quality of the investigation.

Managing actions

The nature and complexity of an investigation, to some extent, dictates the investigative actions that investigators must manage. Force policies may also specify the level of investigative response and activity.

Most volume crime investigations are conducted by a sole investigator, assisted in varying degrees by crime scene examiners or other specialists. In these cases the investigator has to prioritise their investigative actions, some of which will be evident from the initial attendance to the victim or at the crime scene.

Other investigative actions entail developing and completing lines of enquiry, and recording the decision-making process which underpins this action in the crime report or associated documents. This assists colleagues, supervisors and managers to verify the progress of the investigation and to advise on prioritisation issues to support it.

In major or serious criminal investigations, more than one investigator may need to be deployed. These investigations are also likely to generate multiple investigative actions and require the collation of numerous documents.

Record keeping

The investigator should keep an auditable record of the reasons for taking a particular investigative action. Recording this information demonstrates the accountability and integrity of the investigative process, and provides an invaluable resource for the initial or subsequent investigator and for the organisation. It also provides an overview of the investigation and can be used to record:

Records are kept in different formats depending on the seriousness and complexity of the crime under investigation. Common formats include:

  • crime reports for most types of volume crime investigations
  • decision logs or policy files for serious or complex investigations.

Auditable decision making

This means:

  • making decisions in a timely and proportionate way
  • recording what has been done and why it was necessary
  • the reasons for taking particular investigative actions and what the outcome was
  • providing an audit trail that can be followed in the event of review, scrutiny or new material coming to light.

Investigators should be able to justify why a decision was made and be confident that others will be able to understand why they took it. Auditable decision making enables investigators to recall a particular investigation long after the event has taken place. An individual’s recollection of events may become inadvertently distorted, even over a short period of time. Access to a record of decisions made at the time of the investigation is more likely to provide accurate and credible information.

New information

If new information subsequently comes to light, the original investigative actions can be reviewed, documents and exhibits can be located and the investigation can progress without delay.

Keeping full and accurate records may also reduce the risks of a case collapsing where doubt can be cast on the integrity of the evidence, or there are technical faults in the evidence gathering process. It also avoids unsafe convictions and the costs involved, as well as negative publicity associated with appeals and re-trials.


This refers to the manner in which the responsibility for an investigation passes from one investigator to another. The initial investigator must record the full extent of their actions. The point of handover should be explicit and documented, and investigators must ensure that all available information about the conduct of the investigation has been fully communicated to any new investigator, and that it is understood by them. This should ensure that all investigative opportunities are progressed. When a handover takes place and a new officer is in charge, it is important that the victim(s) is informed of this.

Recording handovers

The principle of ‘passing the baton’ applies. In the majority of volume crime cases, the handover can be recorded on the crime report or associated document. In serious cases a verbal briefing/debriefing may be necessary to fully update the new investigator. This allows information to be disseminated and/or the physical transfer of documents or exhibits. The initial investigator is also able to communicate to the new investigator any actions that need to be finalised. A full record should be made of the handover process.

Policy files

Policy files should mainly be used to record strategic policy decisions, operational priorities, and strategic, critical and investigative issues. Although these files are not action books, they should be used to document the progress of an investigation. The use of policy files is subject to ACPO Crime Committee (1999) Revised Guidelines for the Use of Policy Files.

Policy files are sequentially numbered, bound books. Each entry is signed and dated by the SIO or anyone directed to make an entry. Care should be taken when making entries regarding sensitive matters which could be subject to public interest immunity (PII). SIOs should anticipate future challenges to their decisions when constructing a policy file.

Use of policy files

The SIO’s approach to planning the investigation should be recorded in the policy file. Financial issues and resources are important strategic considerations that should be reflected in the policy file. To avoid a lack of focus, care should be taken to avoid including routine administrative and logistical issues in the policy file.

Individuals with management responsibilities in an investigation can also maintain records. The SIO should be aware of this so that they can periodically review them to ensure that they reflect the investigative strategy recorded in the SIO’s policy file.

Exhibits management

The investigator gathers material in a physical, documentary or biological format. This material is referred to as exhibits and requires collation, examination and storage to maintain its integrity and provenance. The investigator must keep accurate and comprehensive records of all exhibits throughout an investigation. As each exhibit is recovered, a record should be compiled detailing the:

  • precise description of the material recovered
  • precise location of recovery
  • time, day and date of recovery
  • individual who recovered it
  • location and method of storage.

The continuity of all exhibits must be maintained, and every movement and transfer accurately recorded. If the material is removed from storage for any reason, or transferred, for example, for forensic examination, this should be recorded. The record should detail the reasons for the movement, the name of the person who removed it, when it was removed and to whom it has been transferred. Advice on recovery, handling and storage of exhibits can be obtained from crime scene investigators, crime scene managers or supervisors.

Large-scale enquiries

In large-scale enquiries a dedicated exhibits officer may be appointed. They should maintain a close working relationship with the investigating officer to ensure that they are aware of all developments in the investigation and bring significant items to the attention of the investigator at the earliest opportunity.

Responsibilities of the exhibits officer

These include liaising with CSIs and forensic service providers to ensure that the recovery, handling, storage and submission of all relevant exhibits is undertaken, and that the integrity of exhibits is preserved to avoid contamination.

They should maintain a close working relationship with the investigating officer to ensure that they are aware of all developments in the investigation. In addition, information concerning submissions and the results of forensic examinations should be brought to the investigating officer’s attention.


In large and complex enquiries, records of relevant material are maintained on indexes. ACPO (2005) Major Incident Room Standardised Administrative Procedures (MIRSAP) gives guidance for indexing material gathered during the course of an investigation. This guidance can be followed using the HOLMES 2 database or on what are commonly known as ‘proper indexing systems’. Investigators should familiarise themselves with the systems available to them.

Managing scenes

The way in which a crime scene is managed affects the quality, quantity and integrity of the material gathered. It is, therefore, essential that investigators identify and prioritise crime scenes, as they may contain material vital to the successful outcome of the investigation.

Once investigators have identified a scene or multiple scenes, they should make an initial assessment of its potential to provide material. The assessment and subsequent formulation of a scene strategy (which should include necessary resource allocation) should have due regard to forensic strategy considerations. Undue delay or failure to consider forensic issues at this stage may lead to valuable material being contaminated, overlooked or lost.

Investigators should be mindful of the impact that securing and managing a scene can have on a community. They should consider community engagement strategies.

CSIs and managers

The extent to which investigators are responsible for managing a crime scene and developing crime scene strategies is influenced by the complexity or seriousness of the investigation and local force policy.

When gathering material, investigators should liaise with CSIs and managers to ensure that they use the most appropriate method for examining the scene.

Identifying scenes

The crime scene can present itself in a number of ways and may not be immediately obvious to the investigator or initial attending officer. There may also be multiple crime scenes which relate to the offence. Scenes could include:

  • the victim
  • witnesses
  • routes to and from the scene
  • the suspect
  • weapons (including live and spent ammunition)
  • the suspect’s home address or other premises associated with the suspect or the commission of the offence
  • vehicles (including boats and caravans)
  • deposition or dump sites (including victim, clothing, weapons or stolen property).

The scene of the offence is usually relatively easy to identify, and this should be considered a fast-track action (see initial investigation). Multiple scenes may need to be prioritised. Victims or witnesses may be able to tell investigators precisely where and how the offence was committed. This helps investigators to secure, search and preserve the scene at the earliest opportunity, and to recover the best possible material in a manner which preserves its integrity.

Securing the scene

The purpose of securing a scene is to maintain the integrity and provenance of any material which may be recovered from it. This simple and important action reduces the opportunities for the material to become contaminated or inadvertently cross-contaminated.

There are a number of methods the investigator can use to secure and manage crime scenes. They include:

  • using tape to prevent access to or from the scene
  • deploying officers to guard the scene (care should be taken to ensure that officers attend only one individual scene in order to prevent cross-contamination)
  • using vehicles as barriers to prevent entry
  • setting up road blocks to protect wider scenes
  • erecting temporary fencing
  • using road diversions
  • ensuring that persons entering the scene are wearing suitable protective clothing to prevent contamination of the scene, and to ensure that they are protected from any hazards present
  • using a scene log to manage and record all activities within the crime scene.


The techniques of crime scene management are based on Locard’s principle of exchange. Anyone who enters the scene both takes something of the scene with them and leaves something of themselves behind. This means that every contact leaves a trace, however miniscule. This could be:

  • fingerprints
  • DNA
  • fibres
  • footwear marks.

Particular care should be taken regarding DNA anti-contamination procedures due to the ease with which DNA may be transferred (coughing, sneezing etc.). Force DNA anti-contamination protocols must be followed.

These traces provide valuable material that can link a suspect to the crime. The techniques for recovering this material are highly specialised and CSIs have the necessary training and equipment to carry them out.

Equally, the movement of police officers or staff between scenes may cross-contaminate the available material, and confuse or mislead the investigation. If in doubt, officers should seek advice from CSIs or crime scene managers.

Preserving the scene

The investigator should seek advice from CSIs or managers to determine the appropriate level and method of protection required. This may include covering or lighting the scene and identifying and protecting access routes to or from the scene.

Risks to the scene which may need to be managed include:

  • damage being caused by exposure to the elements
  • animal disturbance
  • disturbance by material being moved from its original position (eg, during initial attendance of paramedics)
  • microbiological activity causing decay to material
  • disturbance by items being taken into it
  • disturbance by material being removed from it
  • cross-contamination by transference between scenes.

If scenes are not properly managed, this can distort initial findings and prolong subsequent efforts to identify offenders.

Managing the media

Where the media attend the location of a crime, access to the scene should be carefully managed, both to protect the scene and for health and safety reasons. The investigating officer must decide when access to the scene should be allowed, but in some circumstances they may wish to consult their press office for advice and help. Media access should be under direct police supervision and media representatives should wear high-visibility jackets while at the scene. The media should be encouraged to obtain the information they want as quickly as possible, and their equipment, eg, high powered lighting, must not be allowed to endanger others.

Searching and examining the scene


It may be necessary to search the scene before examination takes place. Protection of life always takes primacy over the preservation and recovery of forensic material.


A thorough examination of the scene is essential. As there is usually only one chance to do this, scene examination should not be made in haste unless a delay would result in the decomposition of evidence. Relevant experts should be consulted, where necessary, before commencing the examination.

Investigators should be clear about what they require from the examination of a scene. This usually includes identifying:

  • material taken to or from the scene by the offender or the victim
  • access and egress routes to and from the scene
  • any passive data generators which may be of use to the investigation.

In major or complex scenes where several crime scene investigators are required, a crime scene manager should play an active role in managing all aspects of the scene examination.

As soon as examination is complete, the investigator should consider releasing the scene.

Releasing the scene

Investigators should not release a scene until they are satisfied that all expert advice has been considered and that a police search adviser (PolSA) team has conducted a full and final search, if appropriate.

Once areas which have been covered by crime scene tents and stepping plates have been searched, the scene can be cleaned and released. In some cases, this may need to be conducted in liaison with the environmental health department or the local health authority, eg, where chemicals or biological substances may have been found.

Page last accessed 20 January 2022