Law Enforcement Investigation Skills Training Course

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Police Investigators, Criminal Investigation Officers and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-SLE-018

Before you join: Participants should have practical exposure to incident reporting, enforcement activity, security operations, compliance enquiries or investigation support work.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Investigations fail when initial reports are poorly assessed, legal powers are misunderstood, evidence is not preserved, witnesses are mishandled, or case decisions cannot be explained. These failures can compromise prosecutions, expose agencies to complaints, waste scarce operational resources and damage public confidence. Investigators need a disciplined process that moves from first report to case-file submission while protecting rights, maintaining evidential integrity and recording defensible decisions.

This course develops the practical investigation skills required for criminal, regulatory and public-sector enforcement cases. Participants learn to assess allegations, set an investigative strategy, identify lines of enquiry, manage scenes, obtain witness accounts, conduct ethical suspect interviews, handle exhibits, review digital material and prepare a clear case file. The course also addresses disclosure duties, intelligence handling, investigative decision-making, safeguarding, inter-agency coordination and supervision of active investigations.

Teaching combines concise instructor briefings with case-based analysis, role-play interviews, scene-management simulations, evidence-review tasks and structured case conferences. Participants build an investigation plan and associated records during the first week, then test and improve them through more complex evidence, interview and disclosure scenarios. They leave with a completed investigation case pack containing a strategy, enquiry plan, evidence log, interview plan, disclosure schedule and case-file structure adapted for use in their own service.

The course suits personnel who already work with incidents, allegations, intelligence or enforcement referrals and now need stronger end-to-end investigation practice. It is relevant to police services, anti-corruption bodies, customs agencies, financial-crime units, regulators, inspectorates, municipal enforcement teams and corporate security functions with formal investigative responsibilities.

What you will be able to do

  • Assess allegations using a structured initial-investigation decision model
  • Construct an investigation strategy with proportionate lines of enquiry
  • Preserve scenes, exhibits and digital material through documented continuity procedures
  • Plan and conduct ethical witness and suspect interviews using the PEACE model
  • Evaluate evidential reliability, relevance, admissibility and disclosure implications
  • Produce investigation records, case summaries and evidential schedules for review
  • Apply intelligence-analysis techniques to prioritise suspects, links and investigative actions
  • Present a complete, defensible investigation case pack for supervisory review

Benefits of attending

For you

  • Greater confidence structuring investigations from first report to case-file review
  • Practical interview planning skills for witnesses, victims and suspects
  • Clearer judgment when prioritising enquiries and recording investigative decisions
  • Stronger ability to identify evidential gaps before supervisory or prosecutorial review
  • Reusable investigation documentation for immediate workplace application

For your organisation

  • More consistent investigation planning and supervisory oversight across case teams
  • Fewer avoidable evidential gaps, continuity failures and incomplete case records
  • Better-quality witness accounts and suspect interview records
  • Earlier identification of disclosure, safeguarding and legal-risk issues
  • Improved readiness for prosecutor, regulator, audit or disciplinary scrutiny

Course modules

20 modules over 10 days

Participants can explain the investigation lifecycle and define their responsibilities within it.

  • Investigation lifecycle from allegation receipt through disposal, charge or referral
  • Investigator roles, supervisory accountabilities and decision-making authority defined
  • Criminal, regulatory, disciplinary and intelligence functions distinguished clearly
  • Objectivity, impartiality and confirmation bias risks in investigative work
  • Procedural fairness, human rights and proportionality guiding investigative actions
  • Case theory developed without treating assumptions as established facts

Participants can assess an initial report and determine immediate investigative priorities.

  • Initial allegation assessment using source, information, risk and urgency
  • 5WH questioning clarifies what happened, who knows, and immediate risks
  • Threat, harm, risk, investigation, vulnerability and engagement factors assessed
  • Preserving perishable evidence before assigning routine follow-up enquiries
  • Jurisdiction, legal authority and referral thresholds checked at intake
  • Initial decision rationale recorded in concise, chronological case notes

Participants can produce a proportionate investigation strategy and enquiry plan.

  • Investigation strategy links allegations, hypotheses, objectives and decision points
  • Lines of enquiry prioritised by evidential value, risk and urgency
  • Action plans assign owners, deadlines, dependencies and review dates
  • Hypothesis testing considers inculpatory, exculpatory and alternative explanations
  • Resource requirements, specialist support and escalation triggers identified
  • Strategy reviews document changed facts, decisions and outstanding risks

Participants can plan investigative actions within applicable authority and ethical safeguards.

  • Legal authority verified before searches, seizures, interviews or data requests
  • Necessity and proportionality tests applied to intrusive investigative measures
  • Voluntariness, legal representation and interpreter needs assessed before interviews
  • Safeguarding obligations identified for children, vulnerable adults and victims
  • Conflicts of interest declared, managed and recorded promptly
  • Ethical decision logs explain difficult choices and rejected alternatives

Participants can secure a scene and establish reliable physical-evidence continuity.

  • Scene objectives established before entry, movement or evidence collection
  • Inner and outer cordons control access and contamination risks
  • Contemporaneous scene notes capture conditions, persons and actions
  • Photography sequence records overall, mid-range and close-up observations
  • Exhibit identifiers link item, location, collector, date and time
  • Continuity records document every transfer, storage location and examination

Participants can assess evidence against competing case theories and evidential tests.

  • Relevance, reliability, admissibility and weight assessed for each evidential item
  • Evidence matrices map facts in issue against available proof
  • Direct, circumstantial, documentary and testimonial evidence distinguished accurately
  • Corroboration needs identified without assuming identical accounts equal truth
  • Alternative hypotheses tested against contradictions, omissions and independent evidence
  • Evidential gaps converted into focused, proportionate investigative actions

Participants can plan lawful, respectful and evidentially useful witness engagement.

  • Witness needs assessment considers safety, vulnerability, trauma and communication
  • Contact plans set purpose, timing, privacy and safeguarding arrangements
  • Memory contamination risks reduced through neutral pre-interview communication
  • Witness accounts separated from investigator interpretation and opinion
  • Victim updates record information provided, concerns raised and agreed actions
  • Protection measures considered where intimidation, retaliation or disclosure risks arise

Participants can plan and conduct witness interviews using the PEACE framework.

  • PEACE framework structures planning, engagement, account, closure and evaluation
  • Rapport-building establishes roles, purpose, ground rules and communication needs
  • Open invitations obtain free narrative before focused clarification questions
  • TED prompts encourage Tell, Explain and Describe responses
  • Cognitive interview prompts support recall without introducing suggested information
  • Interview evaluation identifies new enquiries, inconsistencies and welfare actions

Participants can prepare a legally compliant suspect interview plan based on evidence.

  • Suspect interview objectives derived from facts in issue and evidence
  • Disclosure strategy balances fairness, investigative integrity and local legal requirements
  • Question sequences progress from account, clarification, challenge and explanation
  • Interview topics distinguish known facts, reasonable inferences and unresolved issues
  • Potential defences anticipated through evidence-led, non-assumptive questioning plans
  • Legal safeguards, breaks, welfare needs and recording arrangements documented

Participants can conduct ethical, structured suspect interviews and evaluate the account obtained.

  • PEACE interview stages applied to suspect questioning and account testing
  • Active listening identifies admissions, denials, explanations and new lines
  • Evidence presented strategically without deception, coercion or oppressive conduct
  • Challenge questions test inconsistencies against reliable, disclosed evidence
  • Interview records distinguish exact responses from investigator summaries
  • Post-interview evaluation determines verification actions and further interviews

Participants can identify, obtain and analyse documentary evidence for investigative use.

  • Document requests specify custodians, date ranges, formats and preservation requirements
  • Original records distinguished from copies, extracts, summaries and translations
  • Provenance checks establish document creator, source, date and integrity
  • Transaction timelines connect payments, approvals, communications and relevant events
  • Benford's Law limitations understood when screening potentially anomalous numerical records
  • Document schedules identify relevance, evidential purpose and outstanding verification

Participants can preserve and request digital material without compromising evidential integrity.

  • Digital evidence triage identifies devices, accounts, platforms and volatile data
  • First responder actions prevent alteration, remote access and data loss
  • Device seizure records capture condition, power state and connected peripherals
  • Hash values verify digital-file integrity during transfer and review
  • Preservation requests identify accounts, date ranges and relevant data categories
  • Specialist examination requests state investigative questions, not assumed conclusions

Participants can convert intelligence into assessed, lawful and actionable investigative leads.

  • Intelligence differentiated from evidence, rumour, inference and unverified allegation
  • Source evaluation records access, reliability, motive and corroboration opportunities
  • 3x5x2 intelligence grading applied where organisational procedures require it
  • Link analysis maps people, entities, communications, assets and events
  • Timeline analysis reveals sequences, gaps, opportunities and conflicting accounts
  • Analytic judgments state confidence levels, assumptions and information gaps

Participants can identify, record and manage material requiring disclosure assessment.

  • Unused material identified from notes, recordings, exhibits and digital returns
  • Disclosure schedules describe material accurately without argumentative characterisation
  • Potentially exculpatory information flagged early for supervisory assessment
  • Sensitive material handled through access controls and documented decision routes
  • Data minimisation limits collection, retention and circulation of personal information
  • Disclosure review points scheduled after significant evidence or theory changes

Participants can create clear, chronological and review-ready investigation records.

  • Contemporaneous notes separate observation, action, information and professional judgment
  • Decision logs record authority, rationale, alternatives and review dates
  • Chronologies integrate incident facts, evidence events and investigative activity
  • Case-management entries use precise dates, times, sources and references
  • Corrections preserve original entries, reasons and author identification
  • Record quality checked against completeness, accuracy, clarity and traceability

Participants can conduct structured case reviews that improve investigative quality.

  • Case conference agenda reviews objectives, evidence, risks and outstanding actions
  • Supervisory reviews test proportionality, legality, progress and investigative direction
  • Peer challenge exposes confirmation bias, unsupported assumptions and missed enquiries
  • Action registers capture decisions, owners, deadlines and escalation points
  • Stop, continue or redirect decisions justified against case objectives
  • Review records preserve accountability for strategic investigative decisions

Participants can manage investigation-related risks and coordinate appropriate partner actions.

  • Risk assessments identify threats to victims, witnesses, staff and evidence
  • Safeguarding referrals distinguish immediate protection from longer-term support needs
  • Information-sharing decisions apply purpose, necessity, authority and proportionality tests
  • Multi-agency roles clarified through tasking, escalation and communication protocols
  • Operational security controls protect sensitive case information and investigative tactics
  • Contingency plans address witness withdrawal, media interest and evidence loss

Participants can assemble a logical case file for prosecutorial, regulatory or disciplinary review.

  • Case summaries state allegation, key facts, evidence and outstanding issues
  • Evidential schedules organise exhibits, statements, reports and digital material
  • Witness lists identify relevance, availability, vulnerabilities and contact restrictions
  • Chronologies present material events without speculation or argumentative language
  • File review checks continuity, disclosure, legal authority and document consistency
  • Submission recommendations distinguish evidential sufficiency from public-interest considerations

Participants can prepare to explain investigative actions and evidence in formal proceedings.

  • Professional evidence separates observed facts, records, inference and expert opinion
  • Court or hearing preparation reviews statements, exhibits and disclosure obligations
  • Cross-examination readiness requires accuracy, candour and disciplined answer boundaries
  • Investigative decisions explained through contemporaneous records and lawful rationale
  • Challenges to continuity answered using exhibit logs and transfer records
  • Post-hearing learning captures procedural issues, evidential weaknesses and improvements

Participants can build, review and present a complete, defensible investigation case pack.

  • Case scenario assessed from initial allegation, risks and immediate evidence
  • Investigation strategy sets hypotheses, objectives, priorities and review points
  • Enquiry plan allocates actions, owners, deadlines and legal authorities
  • Evidence matrix tests proof, reliability, gaps and alternative explanations
  • Interview plans address witness, suspect, safeguarding and disclosure requirements
  • Case pack presentation defends decisions before structured supervisory review

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Investigation strategy template
  2. Lines-of-enquiry action plan
  3. Evidence continuity register
  4. PEACE interview planning template
  5. Disclosure assessment schedule
  6. Complete investigation case pack

Who should attend

  • Police Investigators — strengthen case management, interviewing and evidential decision-making
  • Criminal Investigation Officers — organise complex enquiries from report through case submission
  • Anti-Corruption Investigators — build defensible cases involving allegations, records and financial evidence
  • Regulatory Enforcement Officers — apply investigation discipline to statutory and administrative breaches
  • Customs and Border Investigators — manage seizures, interviews and intelligence-led lines of enquiry
  • Corporate Security Investigators — improve workplace, fraud and misconduct investigation practice

Skills and tools covered

Case strategy developmentInvestigative interviewingEvidence continuityDigital evidence handlingDisclosure managementCase-file preparation

Tools and standards

PEACE Interview Model, 5WH Questioning, 3x5x2 Intelligence Grading, Benford's Law

How the course runs

Training methodology

The instructor uses short technical briefings to establish common methods, followed by case work based on theft, corruption, fraud, safeguarding and regulatory-enforcement scenarios. Participants assess reports, develop lines of enquiry, examine evidence records, plan interviews and make documented decisions in small groups. Simulations are used for scene control, witness interviewing, suspect interviewing and case conferences. Facilitated reviews compare alternative decisions against evidential, ethical and procedural requirements. Each participant adapts the course templates to a current or representative workplace investigation.

Requirements and prerequisites

Participants should have practical exposure to incident reporting, enforcement activity, security operations, compliance enquiries or investigation support work. They should be able to read official records, write clear factual notes and discuss evidence-based decisions in English. Familiarity with their own agency’s legal powers, reporting requirements and evidence rules is helpful because local procedures differ. This is not an entry-level introduction to public safety work. No law degree, police qualification, forensic science background, specialist digital-forensics training or prior interviewing certification is required.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should already work with incidents, allegations, enforcement referrals, security enquiries or investigation support. They do not need a law degree, police qualification or prior formal interview-training certificate.

Participants should bring their agency's relevant investigation forms, evidence procedures and interview or reporting guidance where permitted. They may also bring a sanitised example of a current case type for application planning; no confidential case files should be brought without authorisation.

It is designed for investigators and enforcement personnel with existing operational responsibilities who need a more disciplined investigation process. It also suits supervisors who review case decisions, evidence records and case-file quality.

This course focuses on managing the full investigation: assessment, planning, evidence, interviewing, disclosure, records and case submission. It uses forensic and intelligence material from an investigator's perspective but does not train participants to conduct laboratory examinations or advanced intelligence production.

Participants leave with reusable templates for strategies, enquiries, interviews, evidence continuity and disclosure review. These can be adapted to local legislation, agency policy and case-management systems with supervisory approval.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first week establishes investigation planning, evidence and interviewing foundations; the second week addresses digital material, disclosure, case review, case-file preparation and the final capstone.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.