3.

ANALYSIS GUIDELINES
 C O N F I D E N T I A L

CONTENTS

1. INTRODUCTION
1.1. What is Analysis?
1.2. What is the Purpose of Analysis?
2. ANALYSTS AND EXPECTATIONS
2.1. Recruitment of Analysts
2.2. Development of Analysts
2.3. Customer/Client/Sponsor Expectations of Analysis
2.4. Analyst Expectations of the Customer/Client/Sponsor
3. INTELLIGENCE CYCLE AND ANALYSIS CYCLE
3.1. Planning & Direction (including project or programme management and planning)
3.1.1. Tasking Definition and Terms of Reference
3.1.2. Conceptual Modelling & Scoping
3.1.3. Working Hypotheses and Indicators
3.2. Collection
3.3. Processing
3.3.1. Evaluation
3.3.2. Collation
3.4. Analysis and Peer Review
3.4.1. Analysis
3.4.2. Integration
3.4.3. Interpretation
3.4.4. Peer Review/Management Review
3.5. Analysis Products and Dissemination
3.6. Review/Feedback
4. BIBLIOGRAPHY
5. APPENDIXES
Appendix 1: Example Job Profile – Intelligence Analyst
Appendix 2: Task Form
Appendix 3: The placement of the analysis unit in the organisation
Appendix 4: Analysis Products

3-2 3. ANALYSIS GUIDELINES 

 C O N F I D E N T I A L
1. INTRODUCTION
T he purpose of this guidance is to provide
members of the World Customs Organisation
with a set of standard guidelines for intelligence
analysis.
The methodology that is used for analysis can be
employed in both risk assessment and profiling
and targeting work. However, it should be noted
that the advice and best practice contained within
this guidance provide basic guidance only. If more
in depth guidance is sought in relation to analyt-
ical concepts and methodology, the reader may
need to undertake further research rather than
relying solely upon the guidance contained herein.
1.1. What is Analysis?
Analysis is the process by which information is
evaluated, integrated and interpreted. It is the
process whereby information becomes intelli-
gence and serves to guide decision-making or
action. The analyst contextualises information
to create actionable intelligence about threats.
Analysis, thus, creates knowledge.
1.2. What is the Purpose of Analysis?
Intelligence analysis increases an organisation’s
knowledge of the threats it is facing. It also iden-
tifies information gaps that the organisation may
need to fill.
In order to understand how analysis can support
the aims of a Customs organisation, one must
have a greater understanding of some key terms –
risk, threat and vulnerability.
An example of how threat, risk and vulnerability
are seen together in context can be described in
this analogy:
A castle has high, thick stone walls and is
guarded by armed personnel – knights.
 3. ANALYSIS GUIDELINES
One of the walls however has a hole in it
(a breach) and there are invaders trying to
attack the castle in order to take control
of it and overwhelm the knights who are
protecting the inhabitants of the castle. The
castle is threatened by the invaders and
there is a particular risk to the castle and
its inhabitants due to the hole in the wall
making the castle vulnerable. The ruler of
the castle can protect the inhabitants of it,
by ensuring that there are enough knights
deployed around the castle to fend off the
attack however the risk to the castle can
be minimised further by deploying enough
knights to guard the vulnerability the castle
has – the hole or breach in its wall. To further
mitigate the risk, the ruler should ensure
that repairs are made to the hole in the wall
as soon as possible so that the knights can
be deployed elsewhere in the castle where
there may be other perceived weaknesses.
Of course if there were no invaders present
around the castle, there would be no threat
to the castle, just vulnerability (the hole
in the wall) and a potential risk that the
castle is likely to be invaded at some point
in the future.
Understanding these concepts of threat, risk and
vulnerability means that an analyst can, by under-
taking an assessment of threat and risk, identify
weaknesses in control or be aware of and allow a
Customs service to react to the threats.
An analyst can also assist in highlighting where
an organisation may wish to make changes
to lower the risk of harm through making key
judgements, identifying intelligence or informa-
tion gaps and by reaching conclusions that can
be reported upon.
3-3
 C O N F I D E N T I A L
2. ANALYSTS AND EXPECTATIONS
2.1. Recruitment of Analysts
A nalysts produce useful intelligence reports
that enable the Customs organisation to
achieve its objectives.
All analysts, in line with international best prac-
tice, should be recruited on the basis of compe-
tence and merit – applicants for analyst vacancies
should therefore meet the required published
selection criteria – normally provided in the form
of an agreed Job Profile/Description (Appendix 1:
Example Job Profile – Intelligence Analyst).
Analysts need to be recruited according to
comprehensive, special criteria to ensure that
they meet the benchmark standards of analytical
competence expected of them. Analysts should be
recruited from diverse backgrounds to ensure an
even mix of skills and attributes. Diversity brings
in a wider range of perspectives and insights,
and improves the quality of intelligence analysis.
Analysts are required to remain objective, but
their worldview is shaped by their experience. By
employing a diverse mix of analysts, some of this
natural bias can be evened out.
Organisations should seek diversity in recruit-
ment, but promote standardization in training.
Each analyst must be able to access training in
analytical techniques, skills and concepts that are
common to all analysts across the organisation.
All recruitment for analyst positions must follow a
careful selection process to ensure that the candi-
dates have the skills and attributes that meet the
needs of the organisation, and to improve the
of quality of intelligence assessment. In some
organisations, this is achieved through a series
of psychometric and occupational psychological
testing exercises followed by presentations and
interviews.
Organisations should seek candidates with the
proper skills and attributes – intellectual curiosity,
acuity in perception, critical thinking, writing abili-
ties – rather than specialised knowledge, which is
easier to inculcate.
The placement of the analysis unit in the organi-
sation is explained in appendix 3.
3-4 3. ANALYSIS GUIDELINES
2.2. Development of Analysts
Analysts should have access to a structured
training and development programme. The
programme should train new analysts and offer
continuous education as they progress through
their career. It should provide the analyst with an
in depth understanding of analytical techniques
and concepts, such as the principles of the intel-
ligence cycle, evaluation of data, negotiation
skills (in order to agree customer requirements),
conceptual modelling, brainstorming techniques,
collection, visualisation techniques like link and
event charting, assessment writing, and data
manipulation.
The training programme should allow time
for the  analyst to consolidate any learning
through  the practical application of techniques
back at the analyst’s normal place of work. Once
sufficiently competent in basic analytical tech-
niques, the analyst should then be allowed to
move on to more complex and specialised training
to meet any further training needs they may have.
Analysts should be allowed time and financial
support for their continuous professional devel-
opment. Training an analyst can be costly, but
competent analysts help organisations to improve
their knowledge or threats and risks, and to allo-
cate resources more effectively.
2.3. Customer/Client/Sponsor
Expectations of Analysis
Analysis supports decision-making and action
by reducing uncertainty about threats. Analysts
work to meet the needs of Customers or Clients
(some organisations prefer the terms Sponsor or
Partner).
Customers and clients include senior managers
who generally want strategic level analysis that
helps them understand the broader perspective.
Analysts can also serve operations by highlighting
current trends in, say, smuggling and conceal-
ments methods. Analysis also serves targeting by
identifying indicators of risk.
Customers/Clients/Sponsors have certain ex-
pectations of what they want the analysis to

 C O N F I D E N T I A L
consider and report upon. Some of these expec-
tations are:
Timeliness – Analytical products should be
available in a timely fashion – there is little point
in receiving the final analysis after the need to
make an operational or tactical decision has
passed.
Focus –­ Analysis must concentrate on the issues
that need to be addressed. The analysis should
make key judgements and answer questions such
as what, why, where, when and how (how certain
smuggling activity is increasing, why an organised
crime group is operating in this way, when is a
certain target likely to travel etc.).
Forward Looking – the analysis must look beyond
the obvious and consider what may lie ahead.
Depending on the context, analysts may be expect
to forecast – to precisely predict the future or to
conduct horizon scanning – exploring a number
of alternate futures without assigning probability
to them.
Clarity – the structure of an argumentation should
be clear and logical. The analysts must clearly
present the evidence and the reasoning behind
their inferences and conclusions. The customer
must be able to understand what elements of the
analysis are facts and what are judgments.
Make Key Judgements – the analysis should make
key judgements and answer questions such as
what, why, where, when and how (how certain
smuggling activity is increasing, why an organised
crime group is operating in this way, when is a
certain target likely to travel etc.).
Make Recommendations – Certain organisations
will expect analysts to provide recommendations
to decision-makers on possible measures to
address threats, mitigate risks or improve intel-
ligence collection. Other organisations, however,
prefer to keep a wall between intelligence analysis
and policy prescription, on grounds that policy
prescription might interfere with the objectivity of
the analytical process.
 3. ANALYSIS GUIDELINES
2.4. Analyst Expectations
of the Customer/Client/Sponsor
In order for an analyst’s time and expertise to
be used productively, the analyst has certain
expectations:
Direction – When Customers/Clients/Sponsors
clearly articulate their needs, analysts are better
able to produce focussed and relevant products.
Sources & Data Quality - Analysts must have
appropriate access to sources relevant to their
role and the analysis they are undertaking. Any
data that they collect and utilise needs to be of
sufficient quality so as to not call into question
the integrity of their analysis. Any data or infor-
mation collected should be evaluated in accord-
ance with that organisation’s evaluation criteria
(for example the 4x4 evaluation system). The data
should be made available in a readily accessible
format that can be readily retrieved and analysed
by the analyst using appropriate software pack-
ages if required.
Support – Analysts should have the freedom to
produce intelligence analysis reports without
the interference of management, as long as the
intelligence products are rigorous and evidence-
based. Managers should ensure that analysts
have access to continuous professional develop-
ment opportunities so that they can keep abreast
of current analytical thinking and techniques.
Analysts should have access to the right IT tools.
Analysts perform best when they are allowed time
and space to think, when they have access to the
right data and analytical tools, and when they are
allowed to interact freely with their counterparts
in other law enforcement agencies. Managers of
analysts should create a workplace culture that
respects analytical dissent, imagination and crea-
tivity, while maintaining high standards of integrity
and rigour.
An example of a task form that can be used as a
starting point for the delivery of tasks from the
customer to the analyst unit (Appendix 2: Task form).
3-5
 C O N F I D E N T I A L
3. INTELLIGENCE CYCLE AND ANALYSIS CYCLE
Figure 1: An Example Intelligence and Analysis
Cycle
Results
Evaluation Detection
Planning and
direction
Dissemination Collection
Analysis and
Processing
peer review
I n the following sections the steps when under-
taking intelligence analysis using an Intelligence
Cycle model as a guide will be examined, including
a brief Customs related example in each step. The
upper part of the cycle – detection, results and
evaluation - is the operational part of the process
of managing law enforcement by the means of
intelligence and knowledge production. I.e. after
the information has been collected, processed,
analysed and disseminated it needs to be put
into the decision making process. If the decision
makers choose to act upon the recommendations
given as a result of the lower part of the circle,
then action is undertaken (e.g. detection), which
yields results, which are in turn evaluated and fed
back into the planning and direction of further
intelligence or detection work.
3.1. Planning & Direction
(including project or programme
management and planning)
3.1.1. Tasking Definition and Terms
of Reference
When clients tasks analysts, they should define,
by way of negotiations, the terms of reference for
the work. The terms of reference should establish
the scope of the work, its objectives and timelines
for completion. Should unexpected delays arise,
3-6 3. ANALYSIS GUIDELINES
analysts should inform clients and revise the
terms of reference accordingly.
3.1.2. Conceptual Modelling & Scoping
During the planning and direction stage of the
cycle, analysts might undertake “Conceptual
Modelling” to gain a clearer understanding of
the task/concept being looked at. Conceptual
modelling is especially important if analysts have
no prior knowledge of the issue they have been
tasked to consider. It allows them to gain a basic
insight into the issue – identifying who, what, why,
where and when factors:
• What is happening?
• Who is involved?
• Where is it occurring?
• How it takes place?
• Why it is happening?
• When is it likely to/will happen
In devising the conceptual model, analysts have to
scope the issue they have been asked to consider,
through a variety of means, such as structured
brainstorming and mind-mapping exercises;
reading policy material or guidance conferring
with colleagues such as other analysts conferring
with experts on the specific issue reading back-
ground research material.
Collaboration between analysts allows for a greater
stream of ideas to be generated than perhaps one
person working on their own. By working together,
a team can come up with more and smarter ideas.
However, collaborative teams can fall into “group
think”, a well-know analytical pitfall.
“Group think” is a process by which a group can
make bad or irrational decisions as each member
of the group feels a compulsion to conform to the
collective opinion of others in the group in order to
achieve a consensus of thought.
“Group think” can be negative in that it reduces
the willingness of those working in a group to:
• come up with alternative ideas;
• gather information that may contradict the
group consensus;
• be critical of hypotheses.

 C O N F I D E N T I A L
A way to overcome “group think” and other forms
of collective analytical biases is to use structured
analytical techniques, such as:
Analysis of Competing Hypotheses (ACH) – Analysts
identify at least two mutually exclusive hypotheses
and review systematically all available evidence
to see if it confirms or contradicts each hypoth-
esis. The analysts are actively looking to invali-
date hypotheses, not confirm them. In the end, the
analysts may realise that the same set of evidence
confirms a series of mutually exclusive hypotheses.
ACH is useful to counter “satisficing”, a cognitive
bias that leads analysts to stick with their favourite
hypothesis and neglect alternative explanations.
Red teaming – An exercise where a team of
analysts take on the role of the opposition and
actively seeks vulnerabilities and weaknesses
in their organisations. By insufflating a spirit of
competition, red teaming stimulates the creativity
of analysts and ensures that they consider a wider
range of possibilities in their analysis.
Devil’s advocacy – A technique where some analysts
systematically seeks arguments to contradict
the consensus. This technique may be useful
when analysts are discouraged by their peers or
management to contradict common wisdom.
Once you have an idea of the issue or concern as
a result of the conceptual modelling process, an
analyst will then try to develop what are regarded
as working hypotheses and indicators.
3.1.3. Working Hypotheses and Indicators
Working Hypotheses and Indicators are scenarios
that explain what has happened or may happen.
These hypotheses can be subjected to testing
through the identification, collection and analysis
of evidence. This technique allows the analysts to
avoid confining their data collection on the basis
of assumptions or preconceptions (bias).
The analysts must also identify indicators for each
working hypothesis. The more indicators confirm
one hypothesis, the more confidence the analyst
is likely to have that the hypothesis itself is likely
to be true. The indicators for the hypotheses form
the information or intelligence requirement to test
each hypothesis and therefore provide the analyst
with the basis for their data collection plan.
 3. ANALYSIS GUIDELINES
Table 1: Example part 1: Scope, working
hypothesis and indicators
Scope:
Perform an analysis on an OCG suspected of smuggling
drugs through your international airport.
Working hypothesis:
OCG named “X” has infiltrated the airport personnel and
uses this to facilitate drug mules’ way through the airport.
(The hypothesis includes the what, who, why and where,
the when will be identified as a result of the analysis)
Indicators:
• We need to collect information regarding previous
seizures at the airport to establish whether there is a link
to OCG “X”.
• Seizures at other airports domestic or abroad are also
interesting.
• Also get an overview of personal at the airport and their
criminal records.
• Gather intelligence about OCG “X”.
  – Where do they operate
  – Flights from these destinations, etc.
3.2. Collection
Collection is the process of identifying, planning and
gathering information and intelligence to support
a tasking. Efficient collection should support the
indicators for the working hypotheses identified
for testing – this is also known as the Intelligence
Requirement. The better the collection, the more
confident the analysts will be about their conclu-
sions. If data sources are insufficient, the analysts
may need to revisit the collection phase to identify
possible alternative sources of information.
The information collected may be anecdotal, descrip-
tive, quantitative or qualitative. The best analysis is
undertaken by the analyst seeking out the widest
possible range of sources and then considering
their relative strengths and weaknesses as well as
the potential for contradictions and corroboration.
This disciplined approach will ensure that informa-
tion collection is comprehensive but focussed. A
formally recorded data collection plan keeps track
of how data collection is progressing.
3.3. Processing
Processing encompasses evaluation and collation.
3.3.1. Evaluation
Evaluation is the assessment of the truthfulness
and reliability of the source of the information. It
is also the measurement of the validity of a partic-
ular piece of information. Evaluated information
can then be considered to be intelligence.
3-7
 C O N F I D E N T I A L

Law Enforcement Agencies tend to evaluate data
using either a 4x4 or 5x5 evaluation coding system.
This ensures that the information is tested appro-
priately and takes into account:
• the motives of the source in providing the
information;
• the dangers of deliberately false or misleading
information;
• using information that is second hand or out of
date; and
• other biases that may be present that could in
turn skew any analysis of the intelligence at a
later stage.
The reliability of the source is indicated by a letter
(normally “A” most reliable to “X” unknown or
untested) and there is a separate grading for the
assessed validity of the information using a numeric
scale (where 1 is usually “confirmed” down to 4).
Evaluation systems are tiered so a 4 x 4 system
has four layers, a 5 x 5 system has five layers (so
A, B, C, D, X may be the alphabetic values for the
source reliability and 1 through to 5 may be the
numeric values for the validity of the data).
The example that follows represents a simple
4x4 evaluation system which is commonly used
internationally but this does vary from country
to country.

4x4 evaluation system

Evaluation of the source

Completely Usually Not usually Reliability
reliable in reliable reliable cannot be
all instances judged

A B C X

Accuracy not in doubt 1 A1 B1 C1 X1

Evaluation of the information

Known personally to the source but not

known personally to the official passing 2 A2 B2 C2 X2
it on

Not known personally to the source but

3 A3 B3 C3 X3
corroborated by other information held

Accuracy cannot be judged or corrobo-

4 A4 B4 C4 X4
rated in any way (at this time)

3.3.2. Collation Collation is the process of gathering all relevant

Table 2: Example part 2: Collected and processed
information
Collected and processed information:
• We have found that several previous seizures can be
linked to OCG “X”.
• There have also been related seizures at other airports.
• There are a number of employees at the different
companies operating at the airport that have a crimi-
nal record.
• We have information about the working shift for most
of the companies working at the terminal.
• OCG “X” originates from a city “Y” abroad.
• Our airport has several arrivals from the airport “Y” a
week.
information and sifting out irrelevant and incor-
rect information. Collation also involves storing
information in a logical manner to find relation-
ships between sets of data.
3.4. Analysis and Peer Review
3.4.1. Analysis
The aim of analysis and the analyst carrying out the
analysis is to draw an inference or conclusion from
the information available. Without analysis, infor-
mation remains just that – information, whereas by
analysing the information, one can draw conclusions

3-8 3. ANALYSIS GUIDELINES 

 C O N F I D E N T I A L
from it and make it into valuable intelligence for the
organisation to act upon. There are primarily two cate-
gories of analysis – STRATEGIC and OPERATIONAL,
although in some organisations/administrations
there is also a third category – TACTICAL.
STRATEGIC analysis takes a range of data sources
to produce an informed judgement or judgements
(often referred to as Key Judgements) about a
targeted group’s capabilities, vulnerabilities, trends
or patterns seen. STRATEGIC analysis considers the
major issues of concern to an organisation (some-
times regarded as the higher level). This allows the
organisation to plan for interventions to prevent
criminal activity becoming a significant problem or
if it is a significant issue already, the best ways to
tackle that issue with a view to reducing the harm it
is causing the organisation or state/country.
TACTICAL analysis is used to identify ways of
providing a co-ordinated response to a linked series
of targets or organised crime groups (OCGs) that
are threatening an organisation/state due to their
illegal activity. It is aimed at minimising or removing
the risk of threat to an organisation that the linked
series of targets or OCGs poses to that organisation.
OPERATIONAL analysis is used to specifically target
a known objective such as disrupting a single organ-
ised crime group or a known criminal target and it
is aimed at removing the threat that that group or
person poses to the organisation or state/country.
The aim of the analysis is to identify patterns or
trends in the person’s modus operandi with a view
to disrupting or dismantling their activity.
Operational analysis takes many forms but is usually
made up of an intelligence file that contains as a
minimum a written briefing or report, association
or networking charts and spreadsheets containing
schedules for things like travel undertaken, telephone
calls made and received or a schedule of events that
have taken place involving the target/suspect.
Within Customs administrations, the type of anal-
ysis may be blurred with combinations of opera-
tional/tactical and tactical/strategic being seen
within the same product. In order to make stra-
tegic decisions, it is important to know the tactical
and operational level.
The Analysis stage of the intelligence cycle has
essentially two parts – integration and interpretation.
 3. ANALYSIS GUIDELINES
3.4.2. Integration
The aim here is to combine, manipulate and
compare available relevant information, from the
many different sources, in formats that help the
analyst both understand the information but also
highlight gaps where additional information may
be required to be collected.
At this stage of the analysis, the analyst may
use a variety of methods such as pivot tables
in Microsoft Excel, link/association/ANACAPA
charts, plot maps to help them visualise the data
and organise it in such a way for them to identify
trends, patterns or anomalies and make compari-
sons with other data they may hold.
Table 3: Example part 3: Integrated information
which will be interpreted and peer reviewed
Integrated information:
• Each seizure both domestic and abroad has been made at
times when only one or two Customs officers are on duty.
• The drug mules carried the drug on their body or in
their baggage.
• Many of the mules came from airport “Y”.
• At the time of almost all seizures person “Z”, working for
a company in the baggage claim area, has been on duty.
• Person “Z” has a criminal record, and comes origi-
nally from city “Y” abroad.
3.4.3. Interpretation
The critical element of analysis is the applica-
tion of sound reasoning to infer meaning from
the information about the nature and extent of
the threat. Analysts interpret the information
received, refine their working hypotheses and
develop new ones. Using tested evidence-based
hypotheses, analysts can produce a justifiable
briefing or report that provides key judgements,
a level of confidence, proposes further collection
of data/information/intelligence or makes recom-
mendations for further action.
3.4.4. Peer Review/Management Review
In some Intelligence Cycle models, review comes
after Dissemination/Production. However, before
any product issued by an analyst is sent out to the
Customer/Client/Sponsor, the quality and integ-
rity of the analysis should be subject to robust
review by fellow analysts and where appropriate
the line manager of the analyst.
3-9
 C O N F I D E N T I A L
The Peer Review allows for sufficient challenge to the
findings of the analyst to be made that will allow the
analyst to back up any arguments put forward and
ensure that there is sufficient evidence to support
their findings. It also acts as a buffer to analyst bias
and “group think” bias that may have crept into the
analysis during the production process.
3.5. Analysis Products
and Dissemination
This is where the conclusions of the analysis
carried out are made known and published either
by way of written report with supporting charts,
tables, graphs or other visual support or by way of
oral briefing and presentation – depending upon
both the type of analysis carried out and the crit-
ical timescales involved.
The conclusions should include the answers to the
Who, What, Where, How, Why and When questions
previously identified as Working Hypotheses and
Indicators. Where findings are inconclusive this
needs to be explained in the report including the
need for intelligence gaps to be filled and further
analysis to be carried out.
Where written reports are published these may
be given different titles depending upon the type
of analysis agreed at the start of the intelligence
cycle process – in the Planning and Direction
Phase.
Published product types include:
• information reports
• risk/intelligence assessments
• intelligence alerts
• intelligence bulletins & briefings
• target, methodology & problem profiles
• operational analysis findings reports
Methods of dissemination of a product inherently
rely on the intended purpose and audience. The
most efficient and effective method of dissemina-
tion should be identified because frequently the
easiest method is not the most effective.
The most effective way to disseminate information
depends on the current specific circumstances of
the department, and the analyst should continually
pay attention to what is appropriate and effective.
3-10 3. ANALYSIS GUIDELINES
Table 4: Example part 4: Dissemination
Dissemination:
• Hypothesis: OCG named “X” has infiltrated the airport
personal and uses this to facilitate drug mules’ way
through the airport. This is done by person “Z” giving
information about when Customs have few officers on
duty. The mules are coming from airport “Y”.
• Premises: The hypothesis is based on the premises
stated under integrated information.
• Further intelligence requirements/gaps: We need more
information before ruling out the possibility that person
“Z” or other persons also performs traditional “rip-
offs” by deviating baggage from Customs’ inspection.
• Recommendations:
  – Put person “Z” under surveillance while on duty at
the airport.
  – Extra staff without uniform on flights from airport
“Y” and when person “Z” is on duty.
  – Extra profiling on these flights.
  – Identify probable contact between person “Z” and
passengers on these flights.
3.6. Review/Feedback
Following dissemination of the product, the analyst
or analyst manager should ensure that feedback
from the Customer/Client/Sponsor has been
obtained and any other views of others that have
received the product should also be sought. In
addition the analyst should take time to consider
what went well during all stages of the process and
what they would prefer to do differently given an
opportunity to undertake similar work in the future.
This ensures that future assessments and reports
issued are of a better quality or resources are
more adequately used because lessons have been
learned. In some instances there may be a need to
review previously published analytical reporting in
a year or more’s time to see what if anything has
changed since the previous report was published).
Table 5: Example part 5: Review/Feedback
Review/Feedback:
• The standard of recommendations meets the require-
ments as reflected in the agreed Terms of Reference/
Tasking request
• The judgements behind the recommendations are well
supported by the evidence presented
• The Analytical Product has been presented at the end
of the process that meets the intended needs
• The Analytical Product has contributed, directly or
indirectly, to an improvement in successful targeting
or interception, further law enforcement activity or
changes in legislation or policy
• Has helped enhance the reputation of the Customs
organisation

 C O N F I D E N T I A L
4. BIBLIOGRAPHY
––Revised Kyoto Convention, General Annex,
Guidelines, Chapter 6 Customs Control,
WCO
––Revised Kyoto Convention, General Annex –
Guidelines, Chapter 7, Application of Informa-
tion and Communication Technology
––WCO Global Information and Intelligence
Strategy
––WCO Handbook for Commercial Fraud In-
vestigators; Chapter V (Updated); Intelligence,
Information Collection, Analysis and Dissemi-
nation
––Data Mining in the Risk Management Pro-
cess, WCO Electronic Crime Expert Group,
December 2007, Annex IV to Doc. EC0215
––CEN Manual
––Trade Compliance Risk Management Pro-
cess, US Customs Service, Washington, DC,
March 1999
 3. ANALYSIS GUIDELINES
––Risk Analysis in the Field of Commercial Ope-
rations, Version 02, April 2000, École Nationale
des Douanes - Neuilly, French Customs & Excise
––IEC/ISO 31010, Risk Management-Risk As-
sessment Techniques, Edition 1.0, 2009-11
––Crime Analysis Booklet, Interpol
––Crime Analysis: From First Report to Final
Arrest, Steven Gottlieb, 1994
––Introduction to Crime Analysis, Basic Re-
sources for Criminal Justice Practice, Debo-
rah Osborne, MA, Susan Wernicke, MS, The
Haworth Press, 2003
––McDowell, Don. Strategic Intelligence: A Hand-
book for Practitioners, Managers, and Users,
Scarecrow Press 2009.
––Introductory Guide to Crime Analysis and
Mapping, Rachel Boba, Ph.D., Community
Oriented Policing Services, U.S. Department of
Justice, 2001
3-11
 C O N F I D E N T I A L

5. APPENDIXES
Appendix 1: Example Job Profile – Intelligence Analyst
Appendix 2: Task Form
Appendix 3: The placement of the analysis unit in the organisation
Appendix 4: Analysis Products

3-12 3. ANALYSIS GUIDELINES 

 C O N F I D E N T I A L
Appendix 1: Example Job Profile – Intelligence Analyst
Job Profile of and Intelligence Analyst
Overall responsibilities
1. Identifying, interpreting and evaluating all
relevant data, information and intelligence to
highlight current and future risks and threats
through the delivery and use of intelligence
assessments to an agreed standard.
2. Ensure the use and development of analytical
skills, tools and methodologies to enable
sound judgements and recommendations
in the provision of high quality, customer
focused products that inform management
decisions.
3. Demonstrate at all times a comprehensive
working knowledge of all legislation, policy and
procedures relating to intelligence handling.
4. Provide professional advice, assistance and
effective guidance so that the required stand-
ards and timescales for products are met in
order to inform fully local and national tactical
and strategic priorities, tasking and opera-
tional or policy activity.
5. Apply professional standards when dealing
with individuals, external organisations/agen-
cies and other colleagues at all times.
Key Responsibilities
1. Produce Intelligence Assessments, Problem
Profiles, and analysis on specific operations
and targets as required.
2. Within your business area support the produc-
tion of regional tactical and national strategic
threat assessments in support of business
planning.
3. Establish and develop relationships with
both internal and external stakeholders and
respond to requests for information.
4. Support the Professional Head of Intelligence
Analysis in the organisation in the develop-
ment of intelligence analysis capability in
accordance with intelligence principles and
priorities.
 3. ANALYSIS GUIDELINES
Work Involves
1. Work will primarily be concerned with the
production of assessments and reports
through the collection, interpretation and
evaluation of all relevant data and information.
Taking the initiative in formulating ideas and
recommendations.
2. Required to develop and maintain an expert
level knowledge of analytical methodology,
legislation and specific subject matter
3. Required to maintain and develop intelli-
gence flows and relationships with internal
and external stakeholders in order to inform
product development.
4. Will provide peer review on other analyst’s
product, and seek and act on feedback on own
product.
5. Ensure that data gathered is managed and
stored lawfully and appropriately and in
accordance with agreed procedures.
Professional Skills
Communication
1. Persuade and Influence: persuade others
of the benefits of proposals or the value of a
particular interpretation.
2. Write effectively: produce written informa-
tion which sets out key issues options and
actions.
Analysis and use of information
1. Gather & manage information: actively share
information with colleagues and apply infor-
mation management best practice
2. Generate & evaluate options: produce and
evaluate a range of useable options for
resolving problems.
People Management
1. Set Direction: Ensure others understand their
roles, objectives and how they contribute to
team/unit performance
3-13
 C O N F I D E N T I A L
2. Develop good working relationships: Build
co-operative relationships and encourage
participation
Project and Program Management (PPM)
1. Establish and maintain good stakeholder rela-
tionships: maintain strong relations with stake-
holders internal and external, ensure that the
project plan and key delivery dates are main-
tained to ensure efficient use of resources.
Where project plan is faltering, a revised plan
should be devised {to rectify – rephrase}
2. Apply PPM tools: Understand and apply PPM
techniques relevant to delivery of business
objectives in my work area
3-14 3. ANALYSIS GUIDELINES
Development Opportunities
1. The role will offer the successful candidate
the opportunity to directly contribute to strate-
gies for lowering the level of unmitigated risk
currently facing the organisation.
2. These posts will offer the opportunity to
develop new skills in a highly specialised role.
Successful applicants will undergo a compre-
hensive training programme which will
include analytical techniques, intelligence and
relevant IT training. Continual professional
development will be encouraged to provide
the successful candidate with opportunities to
develop their analytical career.

 C O N F I D E N T I A L

Appendix 2: Task Form

Sample Task Form

TASK FORM

TITLE
(Working hypothesis)

OPERATIVE TACTICAL STRATEGIC

PURPOSE OF ANALYSIS

ANALYSTS COMMENTS

DATE, TASK RECEPTION:

DATE, INITIATION OF ANALYSIS:

DATE, DELIVERY OF ANALYSIS:

COMMENTS
(E.g. resources, participants in the task group, financial frame, update meetings between client-analyst)

CLIENT/SPONSOR ANALYST

Name: Name:

Date: Date:

Signature: Signature:

 3. ANALYSIS GUIDELINES 3-15

 C O N F I D E N T I A L
Appendix 3: The placement
of the analysis unit in the organisation
The placement of the analysis unit
in the organisation
Careful thought and consideration should be given
when deciding where to place an analysis unit
within the Customs organisation. Naturally each
country has its own organisational model, and it
is therefore difficult to give a blueprint of how this
should be solved. Nevertheless, there are some
Example of organisational hierarchy and the analysis unit’s location in the organisation
Analysis Unit
Administration Customs
Department Department
In the example above, the Analysis Unit serve both
the top level management and the Departments
related to Customs and excise matters, which
in this case are the Customs Department and
the Enforcement Department. This solution
makes it easier for the top level Management to
use the Analysis Unit as an unbiased source of
information concerning the different operational
departments. In such a system it is critical that
the Analysis Unit has recruited experts from all
different fields they are serving. In this model,
the Analysis Unit will both be used as a tool for
the Top level Management, and for the depart-
ment managers. Tasks can therefore be given to
the Analysis Unit by both top level and mid level
management.
3-16 3. ANALYSIS GUIDELINES
common issues that need to be addressed when
considering this matter. The most important issue
within an effective risk management system is the
relationship between the Analysis Unit and the top
management. Ideally the Analysis Unit should be
placed right beneath the top level management,
which secures its independence from the different
custom fields they are supposed to serve. In the
example below the Analysis Unit is placed right
beneath the top level management and serves
therefore all departments related to Customs and
excise matters.
Management
Information
Center
Controller Unit
Customs
Enforcement Legal
Treasurer’s
Department Department
Department
When it comes to the placement of the intelli-
gence functions in the organisation there are two
main solutions. The more conservative one is that
the intelligence is located in each department,
which makes it specialized towards that partic-
ular departments main tasks. The more radical
solution, and maybe the most effective in terms of
an integrated risk management system is to place
the intelligence together with the analysis unit,
covering all the different areas of detection and
enforcement. This solution also makes it easier
for the management in the Customs organisation
to secure that the organisations intelligence work
is focused in accordance with the risk assess-
ments in order to at all time be able to fill the
intelligence gaps that are identified.

 C O N F I D E N T I A L
Appendix 4: Analysis Products
Analysis Products and Decision-Makers:
Analysis products are used primarily by Customs
decision-makers at all levels to support their deci-
sion-making processes.
Policy makers in Headquarters advise Ministers
and officials in other Ministries and take decisions
about the overall aims and objectives of Customs
Administrations and about the policies required to
implement them.
Managers of front-line units and Investigation
Services and operational policy divisions within
Headquarters take decisions on planning and
the deployment of front-line resources to achieve
operational objectives in the most effective and
efficient way.
Front-line units, on the other hand, constantly take
decisions about whom to deal with and how.
 3. ANALYSIS GUIDELINES
Some Analysis Products:
• Alerts are warning messages highlighting, for
example, a new trend involving an unusual modus
operandi, new itinerary for drug trafficking,
etc., and are accompanied by visual supports,
where appropriate (Such as the WCO Customs
Enforcement Network (CEN) Alerts which are
regularly uploaded onto the WCO CEN-Website).
• Bulletins are short documents that describe a
tactical/operational short-term trend or pattern.
• Periodical Reports convey the same informa-
tion at regular intervals (weekly, monthly or
quarterly) about activities and enable problems
to be identified.
• Annual Reports provide information aggregated
by year and are published on a yearly basis
(Such as the WCO Annual Reports on Drugs,
Tobacco and IPR which are regularly uploaded
onto the WCO CEN-Website).
3-17