Criminal Investigation Management Training Course

Duration 10 days 19 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Criminal Investigators, Detective Supervisors and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-SLE-022

Before you join: Participants should have practical exposure to investigations, case handling, security enquiries, fraud reviews, safeguarding work or related law-enforcement duties.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Criminal investigations fail when early decisions do not protect evidence, witness accounts are obtained poorly, records cannot explain investigative choices, or material that assists the defence is missed. These failures can lead to unsafe charging decisions, inadmissible evidence, collapsed prosecutions, complaints, civil claims and reduced public confidence. Investigators and supervisors need a disciplined method for planning enquiries, interviewing lawfully, testing competing accounts and presenting a defensible case file.

This course develops the practical management skills required to achieve reliable evidence from first report through case review and file submission. Participants apply the PEACE interview model, Achieving Best Evidence principles, the cognitive interview, investigative decision logs, evidence matrices, suspect and witness strategies, digital evidence handling controls, disclosure schedules and case review methods. Particular attention is given to vulnerable and intimidated witnesses, child witnesses, interpreters, identification evidence, investigative bias, disclosure duties and the management of complex or high-risk enquiries.

Teaching combines short technical briefings with structured case work, interview-planning tasks, simulated investigative decisions, peer reviews and supervisor-led case conferences. Participants progressively build an investigation file from a realistic criminal case, using the same planning and quality-control documents expected in professional investigative work. They leave with a reusable investigation management pack containing an investigation plan, evidence matrix, interview plan, decision log, disclosure checklist and case review framework.

The course is suited to investigators, detective supervisors, prosecutors, compliance investigators and security professionals who manage criminal, fraud, safeguarding or serious misconduct enquiries. It is designed for practitioners who already understand basic investigative responsibilities and need stronger control over evidence quality, investigative direction and case-file readiness.

What you will be able to do

  • Develop a structured investigation plan using hypotheses, lines of enquiry and risk controls
  • Apply PEACE and Achieving Best Evidence principles to plan lawful witness interviews
  • Construct an evidence matrix linking allegations, evidential requirements, sources and actions
  • Conduct case reviews that test hypotheses, investigative bias, gaps and proportionality
  • Manage exhibits and digital material through documented continuity and preservation controls
  • Prepare disclosure schedules identifying unused material, relevance and review decisions
  • Assess witness vulnerability and create appropriate special-measures and communication plans
  • Present a complete investigation management file for supervisory and prosecutorial review

Benefits of attending

For you

  • Produce investigation plans that withstand supervisory, prosecutorial and audit scrutiny
  • Conduct better planned witness and suspect interviews using recognised interview models
  • Identify evidential gaps before they become charging or trial weaknesses
  • Manage vulnerable-witness issues with clearer safeguards and documented decisions
  • Build a professional case-file portfolio for investigative leadership roles

For your organisation

  • Improves evidence quality and reduces avoidable case-file rework
  • Creates more consistent investigation planning across teams and locations
  • Strengthens disclosure discipline and reduces risks from missed material
  • Supports defensible decisions on investigative priorities, resources and proportionality
  • Reduces complaints arising from poor interviewing, documentation or evidence continuity

Course modules

19 modules over 10 days

Participants can define an investigation’s purpose, evidential requirements and management controls.

  • Criminal investigation objectives distinguished from intelligence collection and administrative fact-finding
  • Elements of proof mapped against allegations, offences and available evidential sources
  • Burden and standard of proof considered during investigative decision-making
  • Reliability, credibility and admissibility assessed before committing investigative resources
  • Investigative proportionality balanced against harm, urgency, intrusion and resource constraints
  • Decision logs record rationale, authority, actions, reviews and outstanding risks

Participants can make and record sound early decisions that protect investigative opportunities.

  • First-report assessment captures immediate risks, safeguarding concerns and evidential opportunities
  • Golden-hour actions prioritise victims, scenes, suspects, witnesses and volatile material
  • Scene preservation controls protect physical, digital and documentary evidence
  • Initial accounts recorded without contaminating later formal witness interviews
  • Triage criteria distinguish urgent enquiries from actions requiring further authority
  • Early case strategy identifies likely complexity, specialist support and review points

Participants can build a proportionate investigation plan that tests competing explanations.

  • Hypothesis testing separates reasonable lines of enquiry from unsupported assumptions
  • The ABC model frames allegations, background and corroboration requirements
  • Investigative plans assign actions, owners, deadlines, dependencies and review triggers
  • Alternative suspect, accident and fabrication hypotheses receive documented consideration
  • Action prioritisation uses evidential value, risk, urgency and likelihood of loss
  • Plan revisions preserve an auditable record of changed investigative direction

Participants can construct an evidence matrix that exposes strengths, gaps and corroboration needs.

  • Evidence matrices connect each allegation to required facts and sources
  • Direct, circumstantial, real and documentary evidence classified for case analysis
  • Corroboration plans test key assertions through independent witnesses, records or forensics
  • Case theory states how evidence supports guilt and alternative explanations
  • Evidence gap analysis identifies missing proof, weak links and priority actions
  • Chronologies organise events, disclosures, decisions and evidential developments accurately

Participants can create a witness strategy that protects welfare and evidence quality.

  • Witness assessment considers vulnerability, intimidation, communication needs and evidential value
  • Achieving Best Evidence principles guide planning for vulnerable and intimidated witnesses
  • Special-measures requests link witness needs to participation and evidential quality
  • Witness strategy separates welfare support from evidential questioning responsibilities
  • Contact plans prevent unnecessary repeat interviews and avoid witness contamination
  • Intermediaries, interpreters and appropriate adults selected through documented needs assessments

Participants can prepare structured, lawful and purposeful investigative interviews using PEACE.

  • PEACE stages structure preparation, engagement, account, closure and evaluation
  • Interview objectives distinguish information needs from assumptions about expected answers
  • Topic plans sequence rapport, free recall, clarification and challenge appropriately
  • Disclosure strategy determines what evidence is put and when
  • Risk assessments address welfare, safeguarding, security and interview contamination
  • Interview plans record exhibits, timings, attendees, breaks and communication adjustments

Participants can plan witness interviews that obtain detailed, reliable and uncontaminated accounts.

  • Cognitive interview techniques support context reinstatement and uninterrupted free recall
  • Open questions elicit accounts without introducing facts, assumptions or suggested answers
  • TED questioning uses tell, explain and describe prompts effectively
  • Focused prompts clarify sequence, sensory detail, source knowledge and uncertainty
  • Witness memory limitations explained through encoding, retention, retrieval and post-event information
  • Closure confirms accuracy, explains next steps and records further contact arrangements

Participants can adapt interview planning for children and vulnerable adults while protecting reliability.

  • Ground rules establish truthfulness, uncertainty responses and correction of interviewer mistakes
  • Rapport-building avoids promises, inducements and discussion of disputed events
  • Developmental capacity informs language, pacing, sequencing and communication aids
  • Registered intermediaries advise on communication needs and question formulation
  • Achieving Best Evidence planning addresses visually recorded interviews and special measures
  • Repeated interviews require clear justification, safeguards and recorded supervisory approval

Participants can plan suspect interviews that fairly test accounts against available evidence.

  • Suspect interview objectives test accounts, explanations, defences and evidential inconsistencies
  • Account-based interviewing seeks explanation before confrontation with incriminating material
  • Disclosure packages distinguish strategic questioning material from material requiring later disclosure
  • Challenge sequences test contradictions using chronology, detail and corroborative evidence
  • Silence, denials and prepared statements assessed without adverse assumptions
  • Interview evaluation identifies further enquiries, evidential admissions and disclosure implications

Participants can manage identification evidence using controls that reduce suggestion and contamination.

  • Description-first protocols record witness recollection before suspect exposure or image viewing
  • Sequential identification procedures reduce relative judgement and administrator influence
  • Blind administration prevents investigators from signalling expected identification outcomes
  • Confidence statements capture witness certainty immediately after an identification decision
  • Contamination risks include co-witness discussion, media exposure and investigator feedback
  • Identification records document procedure, images, instructions, responses and anomalies

Participants can preserve, package and account for physical exhibits through defensible continuity records.

  • Exhibit registers assign unique references, descriptions, locations and responsible custodians
  • Continuity records document every transfer, examination, storage movement and return
  • Packaging choices protect biological, trace, fragile and hazardous material
  • Contamination controls separate exhibits, use protective equipment and document exceptions
  • Forensic submissions state agreed questions rather than seeking unsupported conclusions
  • Quality checks reconcile exhibit registers against case files and forensic reports

Participants can direct the preservation and examination of digital evidence without compromising integrity.

  • Digital evidence sources include devices, cloud services, CCTV and communications platforms
  • ISO/IEC 27037 principles guide identification, collection, acquisition and preservation
  • Volatile data risks require prompt decisions on isolation, capture and specialist support
  • Hash values verify forensic image integrity during storage and subsequent review
  • Examination requests specify dates, users, artefacts, search terms and evidential questions
  • Digital material reviews distinguish relevant evidence from privacy-sensitive unrelated data

Participants can plan reliable acquisition and analysis of financial, documentary and open-source material.

  • Document provenance assessed through source, creation, custody, metadata and alteration indicators
  • Financial transaction analysis links accounts, entities, dates, values and counterparties
  • Link charts reveal associations, communications, transfers and unexplained relationship patterns
  • Open-source intelligence preserves URLs, timestamps, captures and collection methodology
  • Records requests define date ranges, identifiers, formats and legal authority
  • Analytical products separate verified fact, inference, intelligence and unresolved questions

Participants can identify, record, review and disclose material using defensible controls.

  • Disclosure schedules record unused material, descriptions, locations and reviewer decisions
  • Reasonable lines of enquiry include material assisting or undermining either case
  • Materiality assessments distinguish relevance, sensitivity, privilege and disclosure obligations
  • Retention plans protect notes, drafts, recordings and negative enquiry results
  • Disclosure decision logs record rationale, legal advice and review dates
  • Sensitive material handling restricts access while preserving accountability and audit trails

Participants can recognise cognitive bias and apply safeguards to improve investigative decisions.

  • Confirmation bias distorts evidence selection, hypothesis testing and interview interpretation
  • The red-team review challenges assumptions, missed alternatives and weak inferences
  • Disclosure obligations counteract tunnel vision through active consideration of contrary material
  • Ethical decision records identify authority, necessity, proportionality and foreseeable harm
  • Conflict declarations address personal relationships, prior involvement and perceived impartiality
  • Supervisor reviews test reasoning quality rather than merely action completion

Participants can conduct structured case reviews that maintain direction, quality and accountability.

  • Milestone reviews reassess hypotheses, risks, evidence gaps and resource requirements
  • The 5WH method tests who, what, when, where, why and how
  • Supervisory review notes record decisions, challenge, actions and follow-up dates
  • Escalation thresholds address safeguarding risk, media interest, complexity and public confidence
  • Case conferences coordinate investigators, prosecutors, analysts and specialist advisers
  • Closure decisions document evidential sufficiency, outstanding material and victim communication

Participants can assemble a clear, indexed and review-ready investigation case file.

  • Case-file indexes provide logical access to evidence, statements, exhibits and schedules
  • Witness statements distinguish observation, recollection, opinion and information received
  • Investigation summaries explain allegations, methods, evidence and unresolved issues
  • Chronologies reconcile interview dates, exhibits, forensic results and procedural decisions
  • File quality assurance checks consistency, completeness, disclosure status and legibility
  • Prosecutorial briefings identify charging issues, anticipated defences and evidential risks

Participants can coordinate complex investigations while maintaining clear authority and evidence controls.

  • Terms of reference define scope, authority, reporting lines and information boundaries
  • RACI matrices assign responsibility, accountability, consultation and information responsibilities
  • Joint investigation protocols address information sharing, ownership and decision authority
  • Tasking meetings convert intelligence gaps into accountable collection actions
  • Information-sharing agreements specify purpose, lawful basis, security and retention
  • Major incident logs preserve strategic decisions, resource deployments and command rationale

Participants can build, review and present a complete investigation management file for a complex case.

  • Case facts converted into allegations, elements of proof and hypotheses
  • Investigation plans integrate actions, risks, ownership, deadlines and review points
  • Evidence matrices identify corroboration, gaps, disclosure issues and forensic requirements
  • Interview strategies address witnesses, suspects, vulnerabilities and communication needs
  • Case review applies red-team challenge to decisions, assumptions and proportionality
  • Final presentation defends file readiness before supervisory and prosecutorial scrutiny

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Investigation planning template
  2. Evidence matrix model
  3. PEACE interview planning checklist
  4. Witness vulnerability assessment form
  5. Disclosure decision log
  6. Case review and file-quality checklist

Who should attend

  • Criminal Investigators — need disciplined methods for directing enquiries and preserving evidence
  • Detective Supervisors — need consistent controls for reviewing investigations and case files
  • Police Intelligence Officers — need to convert intelligence into lawful, proportionate investigative actions
  • Fraud Investigators — need stronger evidence plans for complex financial and documentary cases
  • Prosecutors and Case Officers — need clearer files, disclosure records and evidential reasoning
  • Safeguarding Investigators — need appropriate approaches for vulnerable witnesses and sensitive material

Skills and tools covered

Investigation planningEvidence managementForensic interviewingDisclosure managementCase-file qualityInvestigative decision-making

Tools and standards

PEACE Interview Model, Achieving Best Evidence Guidance, Cognitive Interview, ISO/IEC 27037

How the course runs

Training methodology

The course uses short instructor briefings to establish legal, ethical and procedural principles, followed by realistic case material drawn from criminal, fraud, safeguarding and security investigations. Participants work individually and in groups to build plans, assess evidence, prepare interviews, make disclosure decisions and conduct structured case reviews. Simulations test decision-making under time pressure and competing investigative priorities. Facilitated feedback links each task to recognised methods, while application planning helps participants adapt the documents and controls to their own investigative setting.

Requirements and prerequisites

Participants should have practical exposure to investigations, case handling, security enquiries, fraud reviews, safeguarding work or related law-enforcement duties. They should understand the difference between information, intelligence and evidence, and be familiar with basic report writing and confidentiality requirements. Experience of conducting interviews is useful but not essential. The course does not require prior training in forensic science, digital forensics, criminal procedure or law. It does not qualify participants to perform specialist forensic examinations, act as legal counsel or exercise statutory police powers.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should have some exposure to investigations, case handling, security enquiries, fraud reviews or safeguarding work. Prior interview training is helpful but not required, and no forensic science qualification is needed.

Bring a laptop or tablet if your organisation permits it, plus any non-sensitive investigation templates you currently use. Do not bring live case files, protected personal data or restricted evidence.

It is intended for investigators and supervisors who manage criminal or serious misconduct enquiries. Prosecutors, case officers, intelligence staff and fraud investigators also benefit from the case-file and disclosure content.

Basic courses commonly focus on introductory enquiry steps or interview questioning alone. This course concentrates on managing the full evidential process, including planning, vulnerability, exhibits, digital material, disclosure, supervision and file readiness.

Participants leave with reusable planning, evidence, interview, disclosure and review documents. These can be adapted to current investigations subject to local law, policy, evidential rules and supervisory approval.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first week establishes planning, interviewing and evidence controls; the second week develops disclosure, review, file construction and a final capstone case presentation.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.