The Anatomy of a Criminal Investigation

A criminal investigation is not a fixed case waiting to be uncovered. It is a developing account of what may have happened, assembled from incomplete information and repeatedly changed by decisions.

That distinction matters. A complaint is not proof. A crime report is not the original allegation. A seized device is not an incriminating device. A police interview is not a trial. Even a substantial investigation file is not the event itself. Each is a stage in the process by which information becomes an evidential narrative.

For the person under investigation, the process often feels as though it has already reached a conclusion. An arrest, a search or an invitation to interview can create the impression that the authorities must possess a complete case. Usually they do not. Those powers and procedures are often used precisely because facts remain uncertain and enquiries remain unfinished.

THE CONTROLLING IDEA A criminal investigation is a sequence of decisions. Each decision is based on the information then available, creates new evidence or risk, and changes what can sensibly be done next.

1. The formal process and the real investigation

On paper, the process appears linear: an allegation is received, evidence is gathered, a suspect is identified, an interview takes place and a decision is made. That outline is useful for orientation, but it does not describe how serious investigations actually develop.

In practice, information arrives in fragments. A witness gives a partial account. A message is recovered without its surrounding conversation. A payment is identified before the commercial records explaining it are obtained. A device reveals another person or another allegation. An interview exposes a gap. A prosecutor asks for further work. An expert changes the apparent meaning of material already collected.

The investigation therefore moves in a cycle:

1. Information is received or recovered.
2. Someone interprets what it may mean.
3. A working hypothesis is formed.
4. Enquiries are selected to test that hypothesis.
5. The results support, weaken or reshape the theory.
6. A decision is made, or the cycle begins again.

The legal system recognises this need for testing. Investigators governed by the Criminal Procedure and Investigations Act 1996 Code of Practice must pursue reasonable lines of enquiry whether they point towards or away from the suspect. What is reasonable depends on the circumstances. That duty is important, but it does not remove judgment: somebody must still decide which enquiries are reasonable, how far to pursue them and what the results mean.

2. Start with the source, not the label

Investigations begin in different ways: a complaint, an intelligence report, a referral from another authority, a workplace disclosure, suspicious financial activity, an internal audit, media material or evidence found in another case. The route by which information enters the system affects how it is framed from the outset.

A detailed first-hand complaint supported by documents presents different questions from an anonymous report. An internal corporate investigation may provide extensive material, but also an interpretation shaped by its own purpose. Information from a co-suspect may be detailed and self-serving at the same time. An allegation arising during family, employment or commercial conflict may be true, false, mistaken, exaggerated or some combination of them.

The first task is therefore not merely to ask, ‘What is alleged?’ It is to ask:

• Who first supplied the information, and on what basis could they know it?
• What were their original words?
• What document, recording or communication preserves that account?
• Who later summarised, categorised or reinterpreted it?
• What material accompanied it, and what was absent?
• Did the account change after contact with other witnesses or new information?

PRACTICAL POSITION Recover the earliest available account before responding to the latest summary of it. The difference between them may be evidentially important.

3. How uncertainty becomes apparent fact

Once information is recorded in an official system, it acquires authority. A call may become an incident log; an allegation may become a crime report; a workplace concern may become an investigative referral. Necessary summarisation can remove uncertainty without anyone acting dishonestly.

A witness may say, ‘I think he may have known.’ A later summary may state, ‘He probably knew.’ A case description may then read, ‘He knew.’ By the time the file reaches a new decision-maker, the original uncertainty may have disappeared.

The same process occurs with labels. A disputed payment becomes ‘fraudulent’; a difficult interaction becomes ‘harassment’; an unexplained injury becomes ‘an assault’. The label may eventually prove accurate. The danger lies in allowing it to substitute for analysis.

The disciplined approach is to separate five layers:

1. Source material: what was actually said, recorded, recovered or observed.
2. Proposition: what that material reliably establishes.
3. Interpretation: the meaning attributed to it.
4. Inference: the conclusion drawn from that meaning.
5. Decision: the power exercised or course adopted because of it.

An error at an early layer can travel through the whole case. Missing context produces a weak interpretation; a weak interpretation produces an unsafe inference; an unsafe inference can shape the next search, interview or charging decision.

4. A hypothesis is necessary, but it must remain provisional

No investigator can pursue every conceivable explanation with equal intensity. A working hypothesis gives the enquiry direction: a transfer was dishonest; contact formed a coercive pattern; deletion was intended to conceal; possession was knowing; an injury was deliberately caused.

The existence of a hypothesis is not a defect. The risk begins when a proposition to be tested becomes the assumed answer. Material supporting the theory may then appear more significant; inconsistent material may be treated as peripheral; and the absence of an expected fact may be explained away rather than investigated.

Defence analysis should not simply assert an alternative story. It should identify the precise proposition under examination and test the route by which the evidence is said to prove it:

• What must be established legally?
• Which evidence is said to establish it?
• What inference connects the evidence to the proposition?
• What alternative explanation fits the same material?
• What enquiry could distinguish between the competing explanations?

COMMON ERROR Treating a police theory as evidence that the theory is correct. A theory organises the enquiry; it does not prove itself.

5. Evidence does not interpret itself

A message may appear threatening in isolation and defensive in the surrounding exchange. A payment may look suspicious until the underlying agreement and accounting records are examined. Location data may place a telephone near a scene without proving who held it or what occurred. A search term may be deliberate, automatically generated or part of legitimate research. A file on a device may establish presence on the device without resolving knowledge, authorship or purpose.

For every important item, ask two different questions: what does the material itself establish, and what additional conclusion is being invited? The second question is often where the real dispute lies.

This also prevents overcorrection by the defence. A delayed complaint does not prove fabrication. Nervousness does not prove dishonesty, but neither does it prove innocence. Deleted material may be suspicious, innocent or incapable of reliable interpretation without technical context. Strategic analysis requires disciplined uncertainty on both sides.

6. The investigation file is a constructed product

An investigation file is not a neutral container holding everything that exists. It is the result of selection. Someone decides which witnesses to approach, which devices to examine, which extraction method or search terms to use, which documents are relevant, which expert disciplines are required and how the case should be summarised.

Selection is unavoidable. The relevant question is whether the selection was sufficient to test the case fairly and intelligently.

A file can be very large and still miss the decisive material. It may contain the incriminating extract but not the surrounding conversation; identify inconsistency in the suspect’s account while overlooking inconsistency elsewhere; or state that no supporting evidence was found without revealing whether anyone searched in the right place.

Quantity should therefore never be confused with completeness, and completeness should never be confused with strength. A vast file may still depend on one contested inference.

7. Chronology before narrative

Chronology is one of the most reliable ways to test an investigative narrative. It can show whether an event was possible, whether a person possessed particular knowledge at the relevant time, whether a commercial decision preceded the alleged dishonest intent, whether records were contemporaneous, and whether accounts changed after exposure to new information.

People under investigation often want to produce a long written explanation immediately. That instinct is understandable and sometimes dangerous. Memory is reconstructive. Dates migrate, separate incidents merge and information learned later can be unconsciously inserted into earlier recollection.

The safer sequence is usually to preserve the records, establish the objectively supported timeline, identify gaps honestly, and only then settle the account that the available material can properly support.

In one professional investigation, the apparent issue was whether the client should answer questions. The deeper issue was whether the client had possessed particular knowledge at the time of the alleged conduct. Contemporaneous records indicated that the information was supplied later. The chronology did not prove every part of the client’s account, but it challenged the factual premise of the proposed inference. The interview strategy followed from that analysis, rather than the other way round.

8. Different decisions require different thresholds

An allegation, an arrest, a search, a charge and a conviction are not different labels for the same conclusion. They are decisions made for different purposes under different legal tests.

For an arrest under section 24 of the Police and Criminal Evidence Act 1984, there must be the required involvement or reasonable suspicion and reasonable grounds for believing arrest is necessary. Arrest is not justified merely because an interview would be convenient; practicable, less intrusive alternatives must be considered under Code G.

Search powers do not share one universal threshold. The lawful basis, conditions and permitted scope depend on the specific power, warrant or consent relied upon. A search may be intended to discover whether relevant evidence exists, not demonstrate that it has already been found.

For a charge under the Full Code Test, prosecutors assess whether there is a realistic prospect of conviction and, if so, whether a prosecution is required in the public interest. The Threshold Test is a separate, limited route used only where its conditions are met. At trial, the prosecution must make the court or jury sure of guilt.

The practical lesson is simple: the use of an investigative power may be serious and disruptive without amounting to a finding that the allegation is true.

9. Momentum, timing and the next decision

Investigations acquire momentum. Witnesses are interviewed, devices queued for examination, specialists engaged and summaries prepared. Each step represents institutional work and may narrow the practical opportunity to correct an incomplete account before it becomes embedded.

That does not justify constant defence intervention. Premature disclosure may expose a witness, reveal a defence unnecessarily, create inconsistency or direct attention to material not yet understood. Delay can be equally damaging where footage, messages, logs or metadata may disappear.

The strategic question is not, ‘What can we do?’ It is:

• What is the next material decision?
• Who will make it?
• What information will that person receive?
• What is missing, disputed or at risk of being misunderstood?
• Can lawful intervention improve that decision, and what risk would intervention create?

Sometimes the answer is to act immediately. Sometimes it is to preserve evidence quietly. Sometimes it is to wait. Inaction should be deliberate rather than accidental.

10. The Chapter One method

When first confronted with an investigation, work through this sequence:

1. Locate the process. Identify the investigator, current stage, suspected offence or issue, and the next decision.
2. Recover the source. Find the earliest account and distinguish it from later summaries and labels.
3. Separate the layers. Identify source material, proposition, interpretation, inference and decision.
4. Test the hypothesis. Ask what supports it, what undermines it and what reasonable enquiry could distinguish competing explanations.
5. Build the chronology. Preserve contemporaneous records before relying on memory or producing a detailed account.
6. Map what is missing. Do not assume the file is complete because it is large or professionally presented.
7. Choose the intervention. Act, preserve, represent or wait according to the next decision and the risks of disclosure.

MASTER INVESTIGATION MAP SOURCE → RECORD → INTERPRETATION → HYPOTHESIS → ENQUIRY → EVIDENCE → DECISION → REVIEW. At every stage ask what changed, what remains uncertain and what decision comes next.

What to do now

• Preserve potentially relevant documents, messages, footage, logs and metadata lawfully and without altering them.
• Do not contact witnesses, delete material, conduct informal searches of another person’s accounts or attempt to coordinate explanations.
• Avoid detailed public or workplace statements until the evidence, audience and cross-process consequences are understood.
• Record dates, requests, searches, seizures, conditions and communications while events are fresh.
• Obtain specialist legal advice early where liberty, reputation, employment, professional status or business continuity may be affected.

Chapter conclusion

A criminal investigation is not a single event and not a finished story. It is a developing evidential narrative shaped by what is reported, recorded, searched for, found, overlooked and inferred.

The strategic task is not simply to answer an allegation. It is to understand how information is becoming a case, identify the next decision and protect the quality of that decision without creating avoidable risk.

The next chapter examines the people carrying out that work: how experienced investigators formulate hypotheses, assess credibility, seek corroboration and decide which explanation requires further pursuit.

Legal sources and update note

Law and procedure checked to 3 August 2026. Principal public authorities used for this chapter:

• Police and Criminal Evidence Act 1984, section 24, and PACE Code G (statutory arrest power and necessity).
• Criminal Procedure and Investigations Act 1996 Code of Practice, paragraph 3.5 (reasonable lines of enquiry towards and away from the suspect).
• Code for Crown Prosecutors, sections 4 and 5 (Full Code Test and Threshold Test).
• Crown Court Compendium, Part I (March 2026 update), direction that the tribunal must be sure of guilt.