The importance of knowledge management in investigations

Tips for improving knowledge management in your organization

1. Differentiate hierarchies of data

All data is different, so categorizing it can greatly reduce complexity when running investigations. The three important types of data to consider are:

• Metadata: This is data that describes other data, but not its content. For example, metadata might describe the time and date that a file was created, the author of a piece of information, and the relationships between several data items.
• Information: This is the raw content of data, such as an image of an object of interest, the text of an incriminating email, or a transcription of a phone call. It can also include less tangible observations such as tone of voice, character, and so on.
• Knowledge: This refers to existing information gained through research, such as a previously written report or the notes of an analyst.

2. Prioritize different types of data

Another critical part of knowledge management is the prioritization of data. Categorizing information in terms of importance can prevent resources from being wasted, helping investigators focus on the most relevant information first, but without completely disregarding other data. For example, information can be categorized as:

• High priority: Any data that is vital to an investigation and should be urgently reviewed
• Medium priority: Data that is necessary for the investigation but does not need to be reviewed immediately
• Low priority: Data that may not be needed for the investigation but could still provide useful contextual information to analysts

3. Classify permission levels of data

Restricting access to certain information is crucial in many investigations. If access is unrestricted, it can compromise the integrity of investigations. Information should therefore be categorized by permission levels, ranging from “Unclassified” level up to a heavily restricted “Top Secret” level, if necessary. Clearance for access to each level can then be carefully controlled, and leaks can be traced more easily.

4. Differentiate static and dynamic data

Static data is anything fixed, whereas dynamic data may change over time. Determining whether data is static or dynamic is another fundamental part of good knowledge management. This becomes even truer for investigations taking place over a long period, where information is more liable to change and accumulate.

It’s also important to define static and dynamic attributes of data. For example, it may be permissible to make previously top-secret data available to the public once an investigation has been completed.

A simple way to differentiate static and dynamic data is to create a profile for each object of interest (such as a person, piece of evidence, or event). Within these profiles, you can include one editable space for dynamic data and one uneditable space for static data.

5. Always state the credibility of data

Not every piece of information in an investigation is as credible as another, and it’s vital that this is made clear to reduce the likelihood of unreliable data influencing outcomes. Therefore, good knowledge management should always involve credibility checks, such as assessing the reliability of sources, cross-checking information whenever possible, referring to existing knowledge, and so on.

A good way to implement this as standard practice is to use a credibility checklist to assess all information used as part of an investigation.

6. Consistently verify sources

In a similar vein, it’s important that investigators always carefully evaluate all sources. For example, this can involve background checks, analyzing a source’s beliefs/interests/biases, monitoring sources over time, and looking at the past reliability of a given source, if possible. 

Developing a strong organization-wide protocol for source evaluation can simplify this process and ensure good practices are adhered to. Ideally, this should not just be done for isolated investigations but rather be an ongoing process.

7. Consistently review data

If you never, or rarely, review your data, it's easy for some of it to become outdated, inaccurate, or otherwise unreliable. To prevent this, regularly review all of your organization’s data to assess its accuracy, whether it’s factual, if there are duplicates, if it is categorized correctly, and so on. If possible, assign individuals with expertise in relevant areas to review specific types of data.

8. Record everything

Recording everything should be standard practice in any investigation. It’s impossible to know if a thought or piece of evidence could be critical at a later date, and things can be easily forgotten if not immediately recorded. Any recorded data should then be categorized, stored, and reviewed, as discussed above. Additionally, nothing should ever be deleted, but rather archived for possible future reference.

9. Audit to keep track of all data

Finally, any data used in an investigation should be tracked diligently at all times. For example, you should record who accesses data when, when copies are made, who edits data and why, who archives it, and so on.