Intelligence-Led Policing and Criminal Profiling Training Course

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Police Intelligence Officer, Criminal Investigator and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-SLE-042

Before you join: Participants should have basic experience handling incident reports, case files, intelligence submissions, security information or investigative records.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Police and security agencies must turn fragmented reports, calls for service, digital material and partner information into decisions that reduce harm. Intelligence-led policing provides the operating discipline for setting priorities, directing collection, assessing threats and allocating resources. Criminal profiling can support investigations when it is evidence-based, transparent about its limits and never substitutes for lawful investigative work or individualised evidence.

This course develops the practical skills required to produce defensible intelligence products and behavioural assessments. Participants work through the National Intelligence Model, intelligence requirements, collection plans, source evaluation, the 5x5x5 handling code, Analysis of Competing Hypotheses, link analysis, crime pattern analysis and threat, risk and harm assessment. They learn to distinguish information, intelligence and evidence; identify behavioural indicators without discriminatory assumptions; build investigative hypotheses; prioritise suspects and lines of enquiry; and communicate findings to operational decision-makers.

Instruction combines short practitioner briefings with case-based analysis, group work, intelligence simulations and structured review of sample products. Participants apply tools from the first week to a continuing serious-crime case, then deepen the work through collection planning, analytical assessment, profiling limits, briefing and tasking. Each participant leaves with an intelligence-led investigation portfolio: a requirements framework, collection plan, source evaluation record, analytical chart, threat assessment, profiling report and decision briefing.

The course suits personnel who already work with crime, security, investigations, intelligence or safeguarding information and need a repeatable method for converting it into lawful operational action.

What you will be able to do

  • Apply the National Intelligence Model to strategic, tactical and operational policing decisions
  • Write intelligence requirements and collection plans linked to threat, risk and harm
  • Evaluate intelligence using source reliability, information validity and 5x5x5 handling codes
  • Construct analytical assessments using Analysis of Competing Hypotheses and link analysis
  • Produce crime pattern and threat assessments that support resource prioritisation
  • Develop behaviour-based criminal profiling hypotheses within legal and ethical boundaries
  • Prepare intelligence reports, briefing products and tasking recommendations for decision-makers
  • Present a complete intelligence-led investigation portfolio for a serious-crime case

Benefits of attending

For you

  • Produce intelligence assessments that clearly support operational decisions
  • Recognise weak inferences, source limitations and confirmation bias
  • Use behavioural profiling without overstating its evidential value
  • Brief senior decision-makers using concise threat and risk products
  • Build a reusable portfolio of intelligence-led investigation documents

For your organisation

  • Improves consistency between intelligence collection, analysis, tasking and review
  • Reduces unsupported profiling and discriminatory decision-making risks
  • Strengthens audit trails for intelligence handling and operational decisions
  • Supports better prioritisation of serious crime, fraud and safeguarding resources
  • Creates common analytical language across investigators, analysts and supervisors

Course modules

20 modules over 10 days

Participants can explain how intelligence-led policing directs lawful operational priorities and decisions.

  • Intelligence-led policing principles, decision cycles and problem-oriented policing relationships
  • National Intelligence Model roles: strategic, tactical and operational coordination
  • Distinguishing information, intelligence, evidence and investigative hypotheses under legal rules
  • Setting intelligence requirements using priority threat, risk and harm criteria
  • Decision logs linking intelligence products to authorised operational action
  • Professional scepticism, source reliability and confirmation-bias controls in assessment

Participants can apply legal, ethical and human rights controls to intelligence activity and profiling.

  • Human rights, privacy and necessity principles governing intelligence activity
  • Lawful authority checks for collection, retention, sharing and dissemination
  • Proportionality tests documented before intrusive intelligence-gathering decisions are made
  • Data minimisation and purpose limitation applied to personal information
  • Disclosure duties, exculpatory material and audit-trail preservation requirements
  • Ethical profiling boundaries: behaviour-based indicators, not protected characteristics

Participants can create intelligence requirements and collection plans for a defined operational problem.

  • Priority intelligence requirements framed as decision-focused intelligence questions
  • Key intelligence gaps identified from case facts and threat indicators
  • Collection plans assigning sources, methods, deadlines and responsible officers
  • Collection matrices balancing intelligence value, legality and operational risk
  • Requirements review triggers following new incidents, arrests or disclosures
  • Tasking requests written with clear collection parameters and handling instructions

Participants can record, protect and share intelligence according to handling and reliability requirements.

  • Human, open-source, technical and partner information source categories
  • 5x5x5 handling codes applied to intelligence grading and dissemination
  • Source protection measures, sanitisation rules and need-to-know decisions
  • Recording provenance, acquisition date, collector identity and handling restrictions
  • Information-sharing agreements governing partner access and onward disclosure
  • Retention schedules, review dates and secure disposal of intelligence records

Participants can assess source reliability, information validity and analytical confidence.

  • Reliability grading separates source history from information validity
  • Corroboration checks compare independent reporting, records and observable facts
  • Evaluating hearsay, rumour, deception, coercion and source motivation
  • Confidence statements distinguish assessed judgments from confirmed facts
  • Intelligence gaps and collection priorities recorded within assessment products
  • Quality assurance reviews test accuracy, relevance, timeliness and legality

Participants can use structured techniques to test hypotheses and reduce analytical bias.

  • Analysis of Competing Hypotheses tests evidence against alternative explanations
  • Key assumptions checks expose untested beliefs within investigative assessments
  • Chronologies establish sequences, gaps, trigger events and opportunity windows
  • Indicators and warnings identify observable signs of escalating criminal activity
  • Devil's advocacy challenges dominant theories before operational decisions
  • Red-team review identifies adversary adaptations and overlooked vulnerabilities

Participants can identify crime patterns and formulate intelligence-led problem assessments.

  • Repeat victimisation analysis identifies recurrent targets, locations and offending methods
  • Hotspot analysis compares incident concentration, time periods and harm levels
  • Crime triangle analysis links offender, target and place conditions
  • Modus operandi indicators distinguish series offences from coincidental incidents
  • Problem profiles define scope, drivers, affected communities and intelligence gaps
  • Pattern assessments separate reporting artefacts from meaningful crime changes

Participants can build link charts and assess criminal network relationships.

  • Entity lists identify people, locations, vehicles, accounts and communications
  • Association matrices distinguish confirmed links from inferred relationships
  • Link charts show relationships, events, transactions and information sources
  • Temporal analysis tests contact patterns before and after key incidents
  • Network roles assessed through access, influence, capability and dependency
  • Chart annotations record confidence levels, provenance and unresolved questions

Participants can produce threat assessments that prioritise harm reduction and resource deployment.

  • Threat assessments describe intent, capability, opportunity and likely targets
  • Risk matrices rate likelihood, impact, imminence and control effectiveness
  • Harm-based prioritisation considers victim vulnerability, scale and repeat offending
  • Scenario analysis compares plausible adverse outcomes and warning indicators
  • Control measures assign prevention, disruption, investigation and safeguarding actions
  • Review cycles update threat ratings after intelligence or operational changes

Participants can define appropriate uses and limitations of criminal profiling in investigations.

  • Behavioural investigative advice distinguishes inference from offender identification
  • Profiling questions focus on behaviour, offence dynamics and decision points
  • Evidence-based profiling avoids typologies presented as individual proof
  • Base-rate awareness prevents exaggerated conclusions from rare behavioural features
  • Investigative utility assessed through testable hypotheses and new enquiries
  • Profiling reports state limitations, alternatives and required corroboration clearly

Participants can develop cautious behavioural hypotheses from offence conduct and decision-making.

  • Behavioural sequence analysis reconstructs preparation, approach, offence and exit
  • Victim-offender interaction assessed through control, communication and resistance
  • Signature versus modus operandi distinguished using repeated behavioural features
  • Staging indicators examined alongside investigative, forensic and contextual evidence
  • Offender decision points identify planning, risk tolerance and situational adaptation
  • Alternative behavioural explanations documented before drawing investigative inferences

Participants can integrate victimology and crime-scene information into investigative hypotheses.

  • Victimology examines routines, relationships, vulnerabilities and recent life changes
  • Lifestyle and exposure factors assessed without blaming victims
  • Crime-scene actions separated from assumptions about offender personality
  • Geographic context considers access routes, familiarity and guardianship conditions
  • Forensic findings integrated with witness accounts and digital evidence
  • Missing information identified before behavioural conclusions are communicated

Participants can assess geographic and temporal patterns to guide investigative enquiries.

  • Journey-to-crime concepts assess likely travel, familiarity and target selection
  • Temporal patterns compare offence timing, victim routines and offender opportunity
  • Anchor-point hypotheses identify possible residence, work and activity locations
  • Geographic profiling limitations stated where incident numbers remain insufficient
  • Map-based analysis combines locations, routes, events and confidence ratings
  • Search priorities reflect evidence, safety requirements and lawful authority

Participants can prioritise suspects and lines of enquiry using documented intelligence criteria.

  • Suspect prioritisation criteria combine opportunity, capability, linkage and risk
  • Elimination factors prevent resources targeting weakly supported individuals
  • Investigative matrices compare hypotheses, enquiries, owners and deadlines
  • Risk assessments identify flight, violence, witness interference and evidence loss
  • Lines of enquiry sequenced by urgency, evidential value and legal constraints
  • Review boards challenge unsupported prioritisation decisions and task allocation

Participants can use intelligence to plan lawful, information-gathering interviews.

  • PEACE framework structures planning, engagement, account, closure and evaluation
  • Interview plans distinguish known facts, intelligence leads and disclosure strategy
  • Cognitive interviewing principles support detailed witness memory retrieval
  • Question sequences test accounts without revealing protected intelligence unnecessarily
  • Inconsistencies assessed against alternative explanations, not assumed deception
  • Post-interview evaluation updates hypotheses, risks and collection requirements

Participants can write and brief clear intelligence products for operational decision-makers.

  • Intelligence report structure separates facts, assessment, confidence and recommendations
  • Executive summaries state decisions required, urgency and assessed risk
  • Analytical judgments linked explicitly to supporting and contradicting evidence
  • Visual products use charts, maps and timelines without obscuring uncertainty
  • Briefing techniques address operational implications, contingencies and authorisations
  • Decision records capture actions, owners, deadlines and review points

Participants can translate intelligence assessments into coordinated tasking and response plans.

  • Tasking meetings align priorities, intelligence gaps, resources and accountability
  • Tactical options compare disruption, investigation, prevention and safeguarding responses
  • Operational plans define objectives, intelligence support and decision thresholds
  • Partner coordination clarifies roles, information exchange and escalation routes
  • Contingency planning anticipates displacement, retaliation and media interest
  • Post-operation debriefs capture outcomes, intelligence gains and unresolved risks

Participants can evaluate whether intelligence activity improves decisions, outcomes and compliance.

  • Performance measures track collection quality, timeliness, use and operational outcomes
  • Outcome reviews distinguish activity volumes from harm-reduction evidence
  • Quality assurance audits test grading, handling, reasoning and documentation
  • Governance boards review legality, proportionality, bias and resource allocation
  • Lessons-learned processes update requirements, products and operating procedures
  • Professional development plans identify analytical capability and supervision needs

Participants can integrate intelligence, behavioural assessment and operational planning for a complex case.

  • Case files consolidated into verified facts, intelligence and evidential material
  • Competing offender hypotheses tested against behavioural and network indicators
  • Collection priorities refined after gaps emerge from analytical assessment
  • Threat assessment links immediate safeguarding needs with investigative strategy
  • Profiling advice translated into testable enquiries and suspect prioritisation
  • Decision brief prepares tasking options, constraints and accountable actions

Participants can build, review and present a complete intelligence-led investigation portfolio for a serious-crime case.

  • Intelligence requirement defines the decision, threat and priority information gaps
  • Collection plan assigns lawful sources, handling restrictions and review dates
  • Source evaluation record grades reliability, validity, corroboration and confidence
  • Analytical assessment combines chronology, links, competing hypotheses and threat ratings
  • Behavioural profiling report presents bounded inferences, alternatives and investigative value
  • Operational briefing recommends tasking, safeguarding actions, owners and decision points

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. National Intelligence Model requirements template
  2. 5x5x5 intelligence evaluation record
  3. Collection planning matrix
  4. Analysis of Competing Hypotheses worksheet
  5. Behavioural investigative advice report template
  6. Intelligence-led investigation portfolio

Who should attend

  • Police Intelligence Officer — needs defensible products for tasking and investigation decisions
  • Criminal Investigator — needs structured intelligence to prioritise suspects and lines of enquiry
  • Crime Analyst — needs analytical methods linking patterns, offenders, victims and locations
  • Security Intelligence Analyst — needs lawful threat assessments for protective security decisions
  • Investigations Supervisor — needs consistent standards for directing intelligence-led casework
  • Safeguarding or Anti-Fraud Officer — needs risk-based methods for complex harm investigations

Skills and tools covered

Intelligence requirementsSource evaluationCrime pattern analysisBehavioural profilingThreat assessmentOperational briefing

Tools and standards

National Intelligence Model, 5x5x5 Intelligence Handling Code, Analysis of Competing Hypotheses, PEACE Interview Framework

How the course runs

Training methodology

The course uses short instructor briefings followed by case work, group analysis, simulations and application planning. Participants interpret intelligence submissions, assess source material, identify competing hypotheses, build charts and prepare decision products from a continuing serious-crime case. Facilitated reviews test reasoning, legality, proportionality and communication quality. Trainers adapt scenarios to policing, security, fraud, border, safeguarding or regulatory enforcement contexts while retaining the same analytical standards and documentation methods.

Requirements and prerequisites

Participants should have basic experience handling incident reports, case files, intelligence submissions, security information or investigative records. They should be familiar with their organisation's reporting lines, confidentiality duties and applicable legal authorities. Prior work in policing, investigations, security, fraud, border management, safeguarding or regulatory enforcement is useful. No previous training in intelligence analysis, criminal profiling, statistical analysis, specialist software or forensic science is required. The course does not assume authority to conduct intrusive surveillance, intercept communications or access restricted databases.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should have basic familiarity with incident, case, security or intelligence information and your organisation's confidentiality duties. Previous formal intelligence analysis or profiling training is not required.

Bring a laptop if your delivery venue permits it, plus any non-sensitive examples of reporting formats or intelligence products used by your organisation. Do not bring restricted case files, personal data or classified material.

It is designed for police intelligence personnel, investigators, crime analysts, security analysts, fraud teams and supervisors directing complex casework. It also suits safeguarding and regulatory enforcement personnel handling risk-based investigations.

This course focuses on directing and analysing information before and during an investigation, then turning assessments into tasking decisions. It covers the PEACE framework as an intelligence-planning tool, but it is not a specialist investigative interviewing or forensic evidence course.

Participants can use the templates for intelligence requirements, collection planning, source evaluation, threat assessment and operational briefings. The methods apply to serious crime, organised crime, fraud, safeguarding, border security and protective security cases.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first week builds core intelligence products, while the second week develops behavioural assessment, tasking and a complete case portfolio.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.