Intelligence-Led Policing Training Course

Duration 10 days 19 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Intelligence Officers, Crime Analysts and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-SLE-017

Before you join: Participants should have basic experience of policing, public safety, investigations, security operations, crime analysis or related information-handling work.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Intelligence-led policing (ILP) provides a disciplined way to turn information into decisions about crime, harm, risk and resource deployment. Without clear intelligence requirements, tested source material and structured analysis, policing teams can be driven by anecdote, urgent incidents or untested assumptions. This can produce misplaced patrols, weak targeting decisions, duplicated investigations and preventable harm to communities.

This course develops the operational intelligence skills needed to support strategic, tactical and investigative decisions. Participants apply the National Intelligence Model, the intelligence cycle, 3x5x2 source evaluation, intelligence requirements, tasking processes, crime pattern analysis, link analysis and risk assessment. They learn how to build strategic assessments, tactical assessments, problem profiles and subject profiles; distinguish intelligence from evidence; test analytical judgements; and present assessed findings to decision-makers.

Teaching combines focused instructor briefings with policing cases, analyst-led group work, tasking simulations and structured review of intelligence products. Cases may include organised acquisitive crime, repeat violence, county-lines activity, public-order threats, cyber-enabled fraud and safeguarding risks. Participants progressively build components of an intelligence package during the course and leave with a completed intelligence-led policing portfolio, including an assessment, profile, collection plan, tasking recommendation and briefing structure.

The course suits policing, public safety and security professionals who already work with incident, crime, investigation or intelligence information and need a repeatable method for directing action. It is relevant to staff working in police services, border agencies, customs, regulatory bodies, municipal enforcement, transport security and corporate security teams that work alongside public authorities.

What you will be able to do

  • Apply the National Intelligence Model to strategic, tactical and operational policing decisions
  • Formulate priority intelligence requirements, indicators and collection plans for defined threats
  • Evaluate information reliability and content validity using the 3x5x2 system
  • Produce strategic and tactical intelligence assessments from crime, incident and partner data
  • Construct problem profiles and subject profiles using structured analytical techniques
  • Conduct crime pattern, network and link analysis to identify actionable interventions
  • Deliver defensible tasking recommendations using risk, harm, threat and opportunity assessments
  • Present a complete intelligence package to a tasking and coordination group

Benefits of attending

For you

  • Produce intelligence assessments suitable for tasking and command decisions
  • Apply a recognised source-evaluation method with greater professional confidence
  • Identify crime patterns and repeat harm from fragmented operational information
  • Write clearer intelligence requirements for analysts, investigators and partner agencies
  • Present assessed judgements and recommended actions to senior decision-makers

For your organisation

  • Improves prioritisation of limited patrol, investigation and safeguarding resources
  • Creates more consistent intelligence products across teams and geographical commands
  • Strengthens audit trails from information receipt through tasking decisions
  • Reduces decisions based solely on anecdote, volume or untested reporting
  • Supports earlier intervention against repeat offenders, victims and high-harm locations

Course modules

19 modules over 10 days

Participants can explain how intelligence-led policing directs decisions, resources and operational activity.

  • Intelligence-led policing principles linked to harm, risk, threat and opportunity
  • National Intelligence Model products and decision levels
  • Distinguishing information, intelligence, evidence and operational knowledge
  • Intelligence cycle stages from direction through dissemination
  • Decision-making roles within strategic, tactical and operational command
  • Threat, harm and vulnerability as resource-prioritisation criteria

Participants can apply lawful, ethical and accountable controls to intelligence activity.

  • Legality, necessity and proportionality tests for intelligence activity
  • Purpose limitation and data minimisation in personal-data handling
  • Human rights considerations in targeting, surveillance and information sharing
  • Disclosure obligations separating intelligence handling from evidential processes
  • Audit trails for collection, assessment, tasking and dissemination decisions
  • Managing confirmation bias, discriminatory assumptions and unsupported targeting

Participants can translate command priorities into clear intelligence requirements and collection questions.

  • Priority intelligence requirements derived from command objectives
  • Specific intelligence requirements framed as answerable decision questions
  • Indicators and warnings linked to emerging threat hypotheses
  • Collection gaps identified against known facts and assumptions
  • Requirements matrix assigning owners, deadlines and intended decisions
  • Review triggers for changing priorities, risks and operational demand

Participants can plan proportionate collection and record information for later assessment.

  • Collection plans matching sources to intelligence requirements
  • Open-source intelligence boundaries, verification and evidential preservation
  • Incident reports, crime records and calls-for-service as source material
  • Partner-agency information sharing through agreed lawful protocols
  • Structured information reports capturing who, what, when, where and why
  • Collection logs recording gaps, actions, returns and outstanding enquiries

Participants can assess source reliability and information validity using a documented method.

  • 3x5x2 evaluation codes for source, information and handling
  • Reliability assessed from access, history, motive and corroboration
  • Validity tested against internal consistency and independent evidence
  • Separating observed facts, reported claims, inference and judgement
  • Corroboration plans for significant allegations and operational decisions
  • Evaluation statements recorded without overstating confidence or certainty

Participants can protect, share and disseminate intelligence according to need and risk.

  • Handling codes matched to sensitivity, source risk and disclosure needs
  • Need-to-know distribution lists for operational intelligence products
  • Sanitisation techniques protecting sources while retaining decision value
  • Dissemination records showing recipients, purpose, restrictions and review dates
  • Information-sharing agreements defining lawful use and retention controls
  • Breach escalation procedures for misdirected, compromised or inaccurate intelligence

Participants can use structured methods to produce transparent and challengeable analytical judgements.

  • Key assumptions check before building an intelligence assessment
  • Analysis of Competing Hypotheses for contested threat explanations
  • Evidence matrices distinguishing supporting, contradicting and missing information
  • Confidence statements calibrated to source quality and corroboration
  • Alternative explanations considered before recommending operational action
  • Peer challenge questions exposing gaps, bias and analytical overreach

Participants can identify repeat patterns, hotspots and series requiring focused policing responses.

  • Crime series identification using modus operandi, time and location
  • Repeat victimisation analysis for safeguarding and prevention priorities
  • Hotspot mapping using incident density, harm and temporal patterns
  • Near-repeat analysis identifying displacement and contagion risks
  • Problem definition using victim, offender, location and behaviour factors
  • Temporal analysis separating seasonal variation from emerging escalation

Participants can build a problem profile that supports targeted prevention and enforcement decisions.

  • Problem profiles defining scale, harm, drivers and affected groups
  • SARA model stages: scanning, analysis, response and assessment
  • Problem statements bounded by geography, timeframe and recurring behaviour
  • Contributory-factor analysis covering opportunity, guardianship and capability
  • Response options balancing prevention, disruption, enforcement and safeguarding
  • Measures of success linked to harm reduction and displacement checks

Participants can develop proportionate subject profiles from assessed intelligence and verified associations.

  • Subject profiles combining identity, associates, activity, capability and risk
  • Entity resolution checks preventing mistaken identity and duplicate records
  • Association mapping distinguishing contact, kinship, business and criminal links
  • Lifestyle indicators assessed without treating stereotypes as intelligence
  • Target selection criteria based on harm, influence and intervention opportunity
  • Profile review dates reflecting changing intelligence and legal authority

Participants can map relationships and identify significant actors, connections and vulnerabilities within networks.

  • Link charts representing entities, relationships, events and attributed sources
  • Network roles identified through brokerage, centrality and dependency patterns
  • Association strength graded by frequency, reliability and corroboration
  • Timeline charts connecting communications, incidents, movements and transactions
  • Network vulnerabilities identified at facilitators, assets and communication points
  • Chart annotations preserving source references, dates and analytical caveats

Participants can produce a strategic assessment that informs medium-term priorities and resource decisions.

  • Strategic assessments addressing future threats, demand and capability gaps
  • PESTLE scanning for political, economic, social, technological and legal drivers
  • Trend analysis using multi-period crime, harm and service-demand data
  • Scenario planning for plausible escalation, disruption and resource pressures
  • Strategic risk registers ranking likelihood, impact, velocity and ownership
  • Executive judgements linked to choices, investment and prevention priorities

Participants can produce tactical assessments that direct near-term interventions and operational activity.

  • Tactical assessments focused on current threats, offenders and locations
  • Weekly intelligence picture integrating incidents, investigations and partner reporting
  • Target packages identifying objectives, risks, tactics and intelligence gaps
  • Operational opportunities assessed against urgency, feasibility and expected harm reduction
  • Control strategies assigning disruption, enforcement and safeguarding actions
  • Review cycles measuring results, unintended consequences and emerging displacement

Participants can prepare and run intelligence-informed tasking decisions with accountable follow-through.

  • Tasking and coordination groups structured around decisions and actions
  • Meeting agendas separating information updates from decision items
  • Decision logs recording rationale, authority, owner and completion date
  • RACI assignments clarifying responsibility for intelligence and operational actions
  • Escalation thresholds for high-harm, cross-border and multi-agency threats
  • Post-tasking reviews testing whether actions answered intelligence requirements

Participants can develop proportionate recommendations that account for operational, legal and community risks.

  • Risk matrices scoring likelihood, impact, vulnerability and control effectiveness
  • Threat assessments distinguishing intent, capability, opportunity and target exposure
  • Operational recommendations linked to assessed intelligence and decision authority
  • Safeguarding considerations embedded within enforcement and disruption planning
  • Community impact assessment before high-visibility or intrusive interventions
  • Contingency actions prepared for intelligence failure, escalation and displacement

Participants can brief assessed intelligence clearly to operational and senior decision-makers.

  • BLUF structure stating bottom line, judgement and required decision
  • Briefing narratives separating facts, assessment, uncertainty and recommended action
  • Visual exhibits using maps, timelines, charts and risk matrices
  • Confidence language aligned with evidence quality and analytical limitations
  • Question handling that distinguishes intelligence gaps from unsupported speculation
  • Written executive summaries tailored to command-level decision requirements

Participants can assess whether intelligence activity improved decisions, outcomes and learning.

  • Logic models linking intelligence inputs, actions, outputs and outcomes
  • Performance measures tracking timeliness, relevance, quality and action completion
  • Outcome evaluation separating activity counts from harm-reduction evidence
  • After-action reviews identifying intelligence successes, failures and missed indicators
  • Lessons logs assigning improvements to products, processes and training
  • Quality assurance checklists for assessments, profiles and tasking submissions

Participants can coordinate intelligence work with partner agencies while protecting information and accountability.

  • Multi-agency threat assessments aligning partners around shared priorities
  • Information-sharing protocols defining purpose, permissions, retention and accountability
  • Joint tasking arrangements coordinating police, safeguarding and regulatory actions
  • Partner intelligence gaps translated into collection and referral actions
  • Conflict resolution when agency priorities, authorities and risk tolerances differ
  • Shared outcome measures for prevention, disruption and victim protection

Participants can build, review and present a complete intelligence package for a defined policing threat.

  • Case brief interpreted into priorities, intelligence requirements and decision questions
  • Source material evaluated using documented 3x5x2 assessment codes
  • Problem or subject profile built from verified information and analysis
  • Strategic or tactical assessment drafted with tested analytical judgements
  • Tasking recommendation specifies actions, owners, controls and review measures
  • Peer review challenges assumptions, legality, proportionality and evidential gaps
  • Command briefing presents findings, uncertainty and recommended decisions

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Priority intelligence requirements template
  2. 3x5x2 source-evaluation worksheet
  3. Strategic and tactical assessment templates
  4. Problem and subject profile models
  5. Tasking and coordination meeting pack
  6. Intelligence package quality-assurance checklist

Who should attend

  • Intelligence Officers — strengthen assessment, collection and tasking practice
  • Crime Analysts — convert crime data into operationally useful intelligence products
  • Police Supervisors — set intelligence priorities and direct resources against harm
  • Investigators — use intelligence to develop lines of enquiry and targeting decisions
  • Tasking Coordinators — run structured decision forums with clear actions
  • Public Safety Analysts — support multi-agency responses to recurring threats

Skills and tools covered

Intelligence requirementsCrime pattern analysisSource evaluationTasking coordinationAnalytical judgementIntelligence briefing

Tools and standards

National Intelligence Model, 3x5x2 Intelligence Evaluation, Analysis of Competing Hypotheses, SARA Problem-Solving Model

How the course runs

Training methodology

The course uses short instructor briefings to establish methods, followed by case work based on realistic policing and public-safety material. Participants assess reports, define intelligence gaps, evaluate sources, map associations, identify patterns and prepare products for tasking meetings. Group exercises compare analytical judgements and challenge assumptions. Simulations place participants in analyst, investigator, supervisor and tasking-chair roles. Application planning helps participants adapt templates, decision points and governance controls to their own service.

Requirements and prerequisites

Participants should have basic experience of policing, public safety, investigations, security operations, crime analysis or related information-handling work. They should be familiar with incident reports, case records, crime data or operational briefings and be comfortable discussing realistic operational scenarios. Prior experience as an intelligence analyst is not required. The course does not require statistical software, programming, advanced data science, covert source handling authority or knowledge of a particular national police system. Participants should bring an understanding of their own agency's intelligence, data-protection and disclosure procedures where possible.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should have experience of policing, investigations, security, public safety, crime analysis or operational information handling. No prior analyst qualification or advanced statistical background is required.

Bring knowledge of your agency's current intelligence process, reporting formats and information-sharing rules where permitted. Participants should not bring restricted operational files, personal data or classified material into the classroom or online sessions.

It is suited to intelligence officers, crime analysts, investigators, supervisors, tasking staff and public-safety professionals. It is also relevant to corporate and transport security staff who coordinate with law-enforcement bodies.

Investigation management focuses on case strategy, evidence, suspects and lines of enquiry. This course focuses on assessed intelligence, threat prioritisation, collection, analysis and tasking decisions that may support multiple investigations or prevention activity.

Participants can use the requirements matrix, source-evaluation worksheet, profile structures and tasking templates with current operational priorities. The methods support daily briefings, weekly tasking meetings and periodic strategic assessments.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first part establishes ILP foundations and core products, while the later part develops analysis, tasking, review and the final integrated intelligence package.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.