What should be recorded about specialist advice?¶

Specialist advice should be recorded as part of the decision trail, not reduced to a vague note that someone was consulted.

Avoid this assumption: Writing “forensics advised” is sufficient. The value of the advice depends on who gave it, what information they received and the question they were asked.

Record the specialist’s name, role, organisation, contact route and relevant area of expertise.

Document the date, time and circumstances of the consultation.

State the facts, device state, account position, operational risk and identifiers supplied to them.

Record the exact question or decision for which advice was sought.

Summarise the advice accurately, including conditions, limitations, alternatives and any need for further information.

If the advice was verbal, make a contemporaneous note and confirm it where appropriate.

Record whether the advice was followed, partly followed or not followed.

Where it was not followed, document the reason and who made that decision.

Preserve emails, messages, tickets, call references and written instructions.

Do not attribute a broader conclusion to the specialist than they actually gave.

Advice based on incomplete or inaccurate information should be treated accordingly.

Where the situation changes materially, record whether fresh advice was obtained.

Specialist advice supports the investigator’s decision; it does not remove the need to document authority, proportionality and operational responsibility.

Record any action the specialist expressly advised against, because that may be as important as the action they recommended.

Operational takeaway¶

Record who advised, what they were told, the exact question, the advice and its limitations, and how that advice affected the final action.