Investigation process

This page is from APP, the official source of professional practice for policing.

First published

23 October 2013

Updated

20 February 2023

Latest changes

Written by College of Policing

Investigation

12 mins read

The type of activity investigators engage in and the material gathered varies depending on whether investigations use the reactive or proactive method. However, they all go through similar stages, as shown in the process of investigation diagram.

Every investigation is different and may require a different route through the process, for example, in some cases the identity of the offender is known from the outset and the investigation quickly enters the suspect management phase. In others, the identity of the offender may never be known or is discovered only after further investigation.

Process of investigation diagram

Instigation

A criminal investigation can be instigated using either a reactive or proactive approach.

Reactive investigations can start with:

reports from the general public
referral by other agencies
intelligence links to other crimes (linked series)
re-investigation as a result of new information
a consequence of other police actions

Force policy guides call takers, public counter staff and patrol officers on the information that they need to gather and subsequent action to take. When receiving reports, staff should ensure that they record, retain and reveal all material and pass it to the investigating officer. Investigators should be familiar with the investigative strategies relating to victims and witnesses, as this enables them to exploit early opportunities to gather material by questioning the person reporting the crime.

Proactive investigations can start from an intelligence package identifying groups or individuals who are assessed as being involved in ongoing criminal activity. They are often generated as a result of the tasking and coordination (T&C) process, and allocated for further investigation. Intelligence packages may include:

crime pattern analysis
network analysis
operational intelligence assessment
problem profiles
market profiles
subject analysis
tactical assessment
criminal business analysis
tactical profiles

Call takers

Initial telephone contact between victims and witnesses with the police service should be regarded as the start of the investigative process. The call is an opportunity to obtain accurate and relevant information, collect evidence, ascertain if a crime has occurred and give reassurance and guidance to the caller, for example, about the preservation of forensic evidence. This process can be enhanced by the use of scripts, drop-down menus and other prompts which may assist call handlers to deal with initial reports of a crime (see also material).

Crime screening

The call handler, at the point of initial report, determines the response to a crime. They must decide whether it warrants the deployment of a response unit, referral to a crime recording bureau, or if it should be recorded as an incident requiring no further action (NFA).

For further information see Quality assurance.

Jurisdiction and ownership

It is important that forces and investigators know who is responsible for investigating a crime, particularly where jurisdiction and/or ownership may be unclear.

Section G of the Home Office Counting Rules for Recorded Crime states that when a crime is reported, the crime recording location will be determined by the location of the suspect at the time they committed the offence. This will also usually determine which police force will be responsible for conducting the investigation.

There are exceptions to this rule. See section G of the Home Office Counting Rules for Recorded Crime for further information.

In some cases, it may not be clear which force should investigate a crime, or further crimes or allegations, for example, a breach of bail conditions.

This may be because, for example, the victim:

lives outside the force area where the offence was committed
may have moved to a place of safety in another force area

If a call taker or investigator believes that a crime should be recorded and/or investigated by another force area, they must contact that force, on behalf of the reporting person, to ensure that recording and ownership of any subsequent investigation is agreed.

Acceptance of ownership must be confirmed in writing by the receiving force, before the case is transferred to them.

The person reporting and/or victim should be updated about which force will be responsible for the investigation and for any further action.

Initial investigation

Most crimes reported to the police are not major incidents and usually the officer who first attends is the only resource that is required. This officer may be the investigator throughout the enquiry.

The quality of the investigation, whether carried out in person or over the telephone, is a significant factor in gathering material that leads to the detection of a crime. There may be limited opportunities to locate and gather material and it is vital that those who conduct the initial investigation ensure that material is not lost. Once a crime has been allocated to an investigator, it is important that they gather material from whoever took the initial report. Investigations should be conducted thoroughly, and investigators should not assume that a crime cannot be solved or that someone else will carry out an investigation at a later stage.

Officers initially deployed to an incident are likely to have a number of competing demands placed on them. These demands include:

dealing with a violent situation
providing first aid and calling for medical assistance
reassuring victims and witnesses
preventing public disorder

For information on dealing with reports of sudden unexpected death see:

Fast-track actions

These are defined as:

any investigative actions which, if pursued immediately, are likely to establish important facts, preserve evidence or lead to the early resolution of the investigation.

Fast-track actions can be applied to reactive or proactive investigations, irrespective of when the crime was committed.

The first chance to obtain material may be the last. Identifying these actions during the initial investigation stage produces the most effective outcome. A delay in protecting, preserving or gathering material may result in evidence being contaminated or lost.

In larger enquiries SIOs should establish strategies to ensure that new information is brought to their attention quickly, so that fast-track actions can be taken when they are needed.

Once these immediate priorities are dealt with, officers should plan how best to conduct the investigation and should consider a number of key factors. Having done so, it is then appropriate to consider concluding the initial investigation.

Initial investigation factors

The following factors should be considered at the initial investigation:

scene management (identify and preserve)
material (identify other potential evidence sources)
who is the investigating officer?
risk management
what is the limit of the initial attending officer’s role?
communication
record keeping
handover and briefing
community impact
initial fast track actions
investigative interviewing (witness, victim and offender)
initial search (access routes, exit routes, places where offenders are likely to have been)

Officers should call for assistance from supervisors where it appears that a major crime has been committed, such as homicide or rape. While officers wait for assistance their priorities should be to:

preserve life
preserve scenes
secure evidence
identify victims
identify suspects

Initial investigation conclusion

The initial investigation phase is concluded when a number of actions have been completed. These include:

the investigator obtaining an account from the victim and any witnesses who are immediately available (individual force policy will determine whether this a witness statement (MG11), notebook entry or verbal account)
the immediate needs of victims and witnesses have been met
the crime scene examination has been instigated
all fast-track actions indicated by the material to hand have been taken
all records required by the Criminal Procedure and Investigations Act 1996 (CPIA) and individual force policy have been made
all intelligence gathered during the initial investigation has been submitted

Comprehensive records

A comprehensive record of all enquiries completed during the initial investigation enhances the overall efficiency by:

assisting the investigator to carry out an investigative evaluation
contributing to the intelligence picture of crime in the area
enabling supervisors to assess the quality of the investigation
facilitating the handover of the investigation if it is allocated to another investigator

Further investigation

Where a crime or intelligence package is allocated for further investigation, investigators should develop a clear plan for how they intend to bring the investigation to a successful conclusion.

The investigative plan should be based on a rigorous evaluation of the material that has been gathered to date and should include the following factors.

Specific objectives of the investigation – these depend on the unique circumstances of the crime and the material that has been gathered.
Investigative strategies that are used to achieve those objectives.
Resource requirements of the investigation which in many cases is limited to the investigator, crime scene examination, and forensic analysis of the material recovered from the scene or suspect. It is part of an investigator’s responsibility to articulate their resource requirement to managers.

In circumstances where the initial investigation and evaluation have led to the identification of a suspect, and there is sufficient material to justify interviewing the suspect under caution, the investigation is likely to move straight into the suspect management phase.

Suspect management

Where a person is suspected of committing an offence, Guidance 10A of Code C of the Codes of Practice to the Police and Criminal Evidence Act 1984 requires there to be some reasonable, objective grounds, based on known facts or information, which are relevant to the likelihood that the offence has been committed and the person to be questioned committed it.

The identification of a suspect provides an opportunity to use a range of investigative strategies that focus on that individual.

For further information see Working with suspects.

Case management

Once the suspect has been charged, there are a number of matters which investigators must manage before a case goes to court. The Crown Prosecution Service (CPS) and police are jointly responsible for the prosecution of the case after a suspect has been charged.

If further investigative action is required, investigators will liaise closely with the CPS.

For further information see Charging and case preparation.

Material

Paragraph 2.1 of the Code of Practice issued under s 23(1) of the Criminal Procedure and Investigations Act 1996 (CPIA) defines material as:

Material of any kind, including information and objects, which is obtained in the course of a criminal investigation and which may be relevant to the investigation; Material may be relevant to an investigation if it appears to an investigator, or to the officer in charge of an investigation, or to the disclosure officer, that it has some bearing on any offence under investigation, or on the surrounding circumstances of the case, unless it is incapable of having any impact on the case.

Sources of material

Criminal investigations must comply with the CPIA. Investigators should familiarise themselves with the provisions of the Act and the Code of Practice issued under it when making enquiries and gathering material. Investigators must:

pursue all reasonable lines of enquiry
identify all relevant material (whether or not it is in the investigator’s possession)

A consistent approach and an investigative mindset should be applied whether or not the material or enquiry points towards or away from the suspect.

Potential sources

Material can be gathered from various different sources. These include:

victims
witnesses
suspects
scenes (which includes scenes of crime, the victim, suspects and their premises)
passive data generators, for example, CCTV, telephone records, banking and credit card records
intelligence databases
communications between the police and experts

Formats of material

Material generated by the offence may present itself in a number of different formats, and the investigator will aim to gather as much material as possible. However, as the investigation progresses, the amount of material that will be capable of being used as evidence in court will be less than that gathered by the police.

Any tangible object could be material. Intangible objects such as sound or images can be converted and reproduced into a format (for example, video or audio recordings) that can be used as evidence.

Common formats of material include:

statements
documents
reports
physical exhibits
fingerprints
images
audio or video recordings

Material generated

The amount of material that is generated by a criminal investigation depends on a number of factors such as:

whether a crime is spontaneous or planned
the offender’s criminal experience
the number of people who know the offender and the victim

Each crime has a unique mix of material. It is impossible to gather all the material generated by the offence, but the investigator must gather as much as possible.

Reasonable and relevant enquiries

Reasonable and relevant enquiries depend upon the unique nature of the incident under investigation. If there is dispute over what is believed to have taken place, it may be a reasonable line of enquiry to locate further witnesses or to recover relevant material which may have been identified from a search or forensic examination. Material includes verbal information which is due to be recorded.

What an investigator considers reasonable or relevant may need to be justified later. It is, therefore, essential that they record their decisions and supporting rationale.

When investigators conduct reasonable enquiries and gather relevant material, it is important that they remember the following points:

Review – consider further relevant lines of enquiry or more relevant material
Record – keep a log of material and enquiries made
Retain – keep material in a durable format and/or copy
Reveal – if a prosecution takes place the relevant material will be scheduled for the prosecutor

For further information see:

Towards or away

In conducting an investigation, the investigator should pursue all reasonable lines of enquiry, whether these point towards or away from the suspect (Code of Practice to the Criminal Procedure and Investigations Act 1996 s.3.5).

What is reasonable in each case depends on the particular circumstances. For example, where material is held on a computer, the investigator must decide which material it is reasonable to enquire into and in what manner.

Example

If four out of five witnesses report that the suspect was in a red car and the remaining witness’s report contradicts this, the investigator should not assume that the majority are right and must investigate further to ascertain the exact colour of the suspect’s car.

Investigators should expect to be challenged by the defence in relation to the enquiries that were made to ascertain any discrepancies in statements.

Relevant material

The golden hour principle will assist investigators to maximise the quantity of relevant material gathered. However, it is not always possible to collect all of the material generated by the offence as some:

physical evidence may be lost or destroyed
witnesses may not be traceable
material is known only to the offender, who does not reveal it to others

Determining relevance

To determine whether material or enquiries are relevant to the investigation, investigators need to ask ‘does this have the capacity to impact on the case?’

In the early stages of an investigation, it may be difficult to determine what is or is not relevant, what happened in the case or what the issues are likely to be.

Officers should not confuse relevance with the test for disclosure.

Example of relevant material

The identity or identification of a suspect may no longer be an issue and so the material held regarding this line of enquiry may no longer be relevant. This could include CCTV footage which was held in the hope of identifying a suspect in the vicinity.

In some circumstances the CCTV footage might still be relevant for other reasons, therefore, investigators have to justify its retention to themselves and others.

If investigators are in any doubt about the relevance of material, they should seek advice from line managers or the CPS, or review the NCALT e-learning package Fair Investigations for Fair Trials.

Golden hour

The golden hour is the term used for the period immediately after an offence has been committed, when material is readily available in high volumes to the police.

Positive action in the period immediately after the report of a crime minimises the amount of material that could be lost to the investigation, and maximises the chance of securing the material that will be admissible in court.

Golden hour considerations

Victims	Identify, support and sensitively preserve evidence
Scenes	Identify, preserve, assess and commence log
Suspects	Identify, arrest and preserve
Witnesses	Identify, support and sensitively preserve evidence
Log	Decisions and rationale, circumstances, resources and conditions
Family/community	Identify, inform, primary support (needs, concerns, expectations, sensitivity)
Physical evidence	Preservation (CCTV, public transport, escape routes, ambulances, hospitals)
Intelligence	Identify, prioritise, maximise, exploit, consider, community and open source
Prevent contamination	Victims, scenes, witnesses, suspects
Lines of responsibility	Identify, inform, brief, coordinate and review

These considerations can also be applied to investigators when they make reasonable enquiries.

Back to Investigation overview

Page contents