Dr Marc Bailey, Gary Pugh and Matt Gantley.

Q94 The Chair: Good morning to our witnesses, and welcome to this session of the House of Lords Science and Technology Committee inquiry on forensic science. Thank you very much for joining us today. We have three witnesses in front of us this morning. We have Dr Marc Bailey, the Forensic Science Regulator, Gary Pugh OBE, the former Forensic Science Regulator, who held the office until July this year, and Matt Gantley, CEO of the UK Accreditation Service.

Before we start, I would just like to remind you that the session is being broadcast live on the net. A transcript of today’s session will be sent to you in a few days’ time for you to check and send in minor corrections. If there is anything that you do not say that you would like to, or something that you want to clarify, please feel free to contact the team after this. If that is clear with you, I will start with the first question.

As you know, this inquiry is following up on our 2019 inquiry, which recommended that the Forensic Science Regulator be given statutory powers. This happened in 2021 and, in 2023, the first statutory code of practice was published. There has been much change in the forensic science landscape since this committee last conducted its inquiry and produced its report. Could you, by way of introduction, outline the changes that you have seen in forensic sciences in England and Wales since our last inquiry, and the challenges that the sector currently faces? Previous regulators warned of a crisis. Are there signs of improvement? Can we ask Marc Bailey?

Dr Marc Bailey: Can I defer to Gary?

The Chair: Yes, certainly.

Gary Pugh: Thank you very much. I should point out that I retired in May 2018, so I was not around for your last report, I am afraid. I took up this post in May 2021, initially as the non-statutory regulator. The most useful thing that I can do by way of setting out the changes and challenges is perhaps to very briefly set out the main basis on which the statutory regulation of forensic science works.

It falls under four categories in terms of the provisions of the Act. There is the code, the admissibility provisions, investigation and enforcement, and my broader powers under Section 9 to issue reports and give advice. These have resulted in significant change in the way that forensic science is regulated.

I will briefly go through those, which will, I hope, set the scene reasonably well. I will not dwell on the detail of the code of practice, but what is clear from the Act is that forensic science should be regulated as forensic science activities. This is a theme that runs through the Act. It is not forensic science as a whole. It recognises the broad range of science and technology that is used in forensic science for different purposes and in different ways.

In the first statutory code, I defined 51 forensic science activities, 34 of which were subject to the code when it came into force in October 2023, as you set out, and a further two forensic science activities came under the code in October of this year. There were 15 that were not subject to the code when it came into force.

What was important to me was to set out the full scope of regulation. For example, one of the forensic science activities, or FSAs, is case review, which includes work for the defence, and post-conviction review for the CCRC. It seemed to me important that we send a clear signal that this area was to be regulated, albeit we have not yet worked through specific regulatory requirements for that area.

The code is largely based on the non-statutory code, or certainly on the underlying model, which is now pretty much globally accepted, that forensic science is based on an effective system working. No one person generates a DNA profile. No one person determines the level of drugs in blood in a drugs-driving case. This relies on a system working effectively. That requires validation, demonstration of competence by the practitioners, and documented and controlled procedures.

I introduced into the code a requirement for there to be a senior accountable individual reflecting that accountability for a system rather than the very important individual responsibilities that forensic practitioners have in the criminal justice system, and particularly those who give expert evidence. A senior accountable individual must be effective and committed to the leadership of a quality culture in an organisation and be accountable for the strategic leadership or the unit’s compliance with the code, and for risks related to FSAs. That is, broadly, in terms of change, what is in the code.

The admissibility provisions again bring a very significant change here. In the Act, it says that the code is admissible in criminal proceedings and, if a person is not acting in accordance with the code, there can be an admissibility challenge. This is the route by which forensic science regulation gets into the courtroom, because that admissibility challenge is now set in the Act.

What I did in the code was introduce the requirement for a binary declaration. You are either compliant with the code or you are not. If you are not compliant, you must set out the mitigating steps, and they reflect the underlying model. Is your method validated? Have you demonstrated competence? Do you have documented procedures? That is the mechanism by which the courts can scrutinise whether quality standards have been met, and that is an important provision.

We have seen admissibility challenges since the code came into force, but there have been relatively few, and that is due in part to the backlogs in the criminal justice system. We have not yet seen admissibility challenges become part of the landscape in the criminal justice system in that way. They will when the legal profession and others get their head around this and start to use the admissibility provisions in that way.

In doing that, I work very closely with the Criminal Procedure Rule Committee, which issues the criminal practice directions, so there is an alignment between what it says about reliability and requirements of disclosure and what is in the code. That, again, is really important.

On investigation and enforcement, the provisions are interesting. They are not based on a simple compliance with the code. The regulator can conduct an investigation if it believes that there may be a substantial risk to criminal investigations or proceedings. It can take enforcement action if it believes that there is a substantial risk, and issue a compliance notice.

This is entirely right. Simple compliance is not the way to do it. We need to be focused on understanding risk. Probably the largest quality failure that I dealt with while I was in office related to an organisation undertaking drugs-driving analysis. My investigation into that and the outcome was that 1,700 prosecutions were rescinded, but, on the face of it, that company was compliant with the code and fully accredited. Forensic science is complex, and accreditation and compliance with the code are important, but there are still inherent risks in something as complex and challenging as forensic science.

Traditionally, the investigation of incidents by the regulator has been very reactive. We wait for things to happen and then investigate them. Prior to the code coming into force, I took a more proactive approach. When I came into this role and I asked the question, “Who do I regulate?”, no one knew—“There is no list. There is no register. We do not know who is undertaking forensic science activities”—so I set about surveying those organisations to find out about their compliance to the code. That was the first time that this had been done. That proactive approach helped me understand the risk that is out there in different forensic science activities.

We did some data analysis and came up with an indicative compliance. We found that, of the 34 forensic science activities that were subject to the code when it came into force, 22 had high or very high compliance. There were some in the middle, and then there were seven with low or very low compliance, so there was quite a variation across that. That proactive approach to understanding risk, in the sense that prevention is better than cure, is the route that certainly I went down in terms of my approach to regulation.

The final thing that I would mention on enforcement, which has now come to the fore—and I have not seen it referred to before in this type of discussion—are the requirements under the Legislative and Regulatory Reform Act and the regulators’ code produced by the Government. That code applies to me as a regulator. This has had great interest recently, as you may have seen, in terms of regulators and regulation being scrutinised in relation to promoting economic growth. Although it does not touch my core role, there are some interesting targets in there, one of which, for example, is to reduce the administrative burden of regulation by 25% in this Parliament. I would just lodge that regulators are influenced by other parts of Government.

Finally, just to keep this brief—I am sure that you will want to explore these issues—the final set of provisions in the Act under Section 9 allows me to prepare guidance and reports and to give advice and assistance. It says that the regulator can do anything apart from borrow money. Under those provisions, I have introduced and published reports.

The significant ones, of course, are the two annual reports that I produce, which I am required to provide to the Secretary of State, who lays them before Parliament. Interestingly, the Secretary of State does not approve those reports, so perhaps the regulator has a direct communication with Parliament. In those two annual reports, you will find all of the information about the statutory consultation and compliance. You will also find where I have highlighted areas that I think need to be addressed, where the legislation could be strengthened or improved, particularly around territorial extent and Crown bodies. I will pause there, because I am conscious that I have given quite a long introduction.

Q95 The Chair: Thank you very much indeed for that very full reply. It will not surprise you to find that you are already beginning to stray into some of the follow-up questions that we have in detail. This is just, as I say, an introductory answer to the broad question that I put at the beginning. There have been these changes, and there are challenges. We have been warned of a crisis. What comments do you have to make? Mr Bailey, you are new to the role. What would you like to say by way of introduction?

Dr Marc Bailey: Thank you very much, Chair, and thank you for allowing me to defer. I felt it important that Mr Pugh had a chance to give historical context.

Coming in, I have been able to bring a fresh set of eyes. My background is not forensic science. Instead, it comes most recently from medicines regulation, where many of the scientific disciplines overlap, such as toxicology, DNA testing or biometrics. I also have a background in digital standards and digital standardisation.

Looking with fresh eyes, I was very pleased to see that we have a young but well-established regulatory framework. It really is extremely young compared to the work in medicines, which is coming up to about 30 [1] years old, but I have explored and used a lot of that learning to set up the basic principles.

Coming into place, I am most engaged at first in understanding the area. I have been going out to forces and talking directly to practitioners, both in companies and others, to understand what the code, the accreditation and everything looks like to the people who are dealing with this day in, day out.

What you would expect is a large complaint about bureaucracy, but what I have been really struck by is the sheer enthusiasm. The police are absolutely motivated to help the victims of crime, and that comes through. They are pushing for a change, as they see it, to make sure that it works. I know that there is a lot to do to grow this young regulatory framework into a mature one, some of the features of which have been listed already, but I am looking forward to driving that forward.

In terms of specifics in the past four months, there have been various forensic science activities that have needed corrective work and ongoing investigations, which I will talk about. I just want to highlight the interface with the criminal justice system. The Act states that the regulator regulates the forensic science practitioners through forensic science activities but provides information to support the criminal justice system.

That information, of course, is the code, but it is also a declaration of compliance. That has highlighted a real interface question, which is that a declaration of compliance as defined by the police has proven not to be the same as a declaration of compliance as defined by the law. We have been doing a lot of work in crossing that boundary to come up with language that the police can write and understand, and the courts can use. It is going to be very important to consider the impact on the criminal justice system of any changes to the forensic services. I will pause there.

Q96 The Chair: Thank you very much indeed. Mr Gantley, you have heard the question twice. Please feel free to introduce yourself and make your first attempt at answering it.

Matt Gantley: Thank you very much. Good morning, everyone. I am the chief executive of UKAS. I have been the CEO of UKAS for just over seven years. My background is in conformity assessment. I have spent 25 years in different organisations involved in testing, inspection and certification.

If I can, I just want to give a very brief overview of the work, remit and scope of UKAS, and then come to the key questions relating to changes in the period of time since the last committee hearings. UKAS is the United Kingdom Accreditation Service. Our role is to ensure that conformity assessment bodies undertake their activities in a competent, impartial and consistently reliable way, particularly focused on those aspects of international standards or relevant requirements such as the forensic science code of practice.

Those conformity assessment bodies are very broad in nature. They include testing, inspection, certification, calibration, validation and verification. They sound like the same thing, but they have very precise meanings in terms of scientific discipline and the methodology of quality assurance for those aspects of conformity assessment. Those disciplines are clearly defined in relevant international, European or British standards. UKAS does not define those standards. We ensure that those conformity assessment bodies fulfil those requirements.

A key specific requirement relating to forensic science is compliance with the forensic science code of practice. That is the primary objective of the work that we do as an accreditation body, ensuring that the conformity assessment body meets the requirements of the relevant international standards and also of the forensic science code of practice.

We are a not-for-profit, non-profit distributing organisation. The model of accreditation is self-financing, in that we do not receive government funds for the accreditation activity. That is entirely financed through the accreditation fees that we charge for those accredited entities. In its broader sense, UKAS delivers around 38,000 assessment days per year. We accredit around 3,000 accreditations. That includes 2,500 organisations in the UK and abroad. Specifically in relation to the forensic science section, it is around 92 organisations, and we have 10 going through the process of application.

We are a company limited by guarantee. We do not have shareholders. We are non-profit distributing. We have 26 guarantor members, and they include members of government departments and ministries—for example, the Ministry of Defence, the Department of Health and Social Care, and the Department for Business and Trade—as well as professional groups and users of accredited conformity assessment. I need to be clear that we are not a regulator. We support the work of the Forensic Science Regulator.

What has changed? In that period of time, the numbers of accreditations have increased. In the period from 2020 to date, the number of accredited bodies has gone from 71 to 92. As part of that process, we also evaluate compliance against the code; Gary has highlighted the critical importance of that. The percentage compliance level has not changed significantly. It has gone from 68% to 67% of those accredited organisations.

We see that, in the traditional areas of conformity assessment or forensic science activity, particularly relating to those areas covered by traditional scientific evidence, such as physical and chemical analysis—for example, bloodstain pattern analysis, handwriting analysis, body fluid identification and DNA recovery—they are well-established areas of accredited conformity assessment.

What we have seen as a challenge in terms of achieving compliance to the code as well as achieving accreditation is incident scene examination. The lowest levels of compliance are particularly in the areas of digital forensics, data capture, processing, analysis and digital storage devices. That is where we have seen the lowest levels of compliance, and that is where there is the greatest priority to address the challenges to those organisations reaching compliance with the code and reaching accreditation.

The Chair: Thank you very much indeed. We have a committee bursting with questions and we are going to cover a lot of areas.

Q97 Lord Burnett of Maldon: Perhaps I should first declare an interest, or at least a past interest. As Lord Chief Justice, I was responsible for the new criminal practice direction, which included quite a lot on forensic science and much else, and also the Criminal Procedure Rules, which were revised quite substantially concerning forensic science.

My question is primarily to the two regulators. How have the new statutory powers under the Act and the 2023 code changed your ability to ensure quality in forensic science? We would quite like to have some examples of where improvements have flowed from both the Act and the code, and also the challenges that you have faced.

Mr Pugh, you mentioned a challenge over the drugs-driving cases and the fact that the provider appeared to be in compliance with everything, but it was a really big issue at the time. What challenges do you have in enforcing the code? More broadly, are the powers that you have adequate to do the job that you are required to do?

Gary Pugh: My starting point in this was that I had to get the code written and approved and through the processes that it is required to go through in order for it to come into force to get people’s attention. That took two years from the day I arrived to both Houses of Parliament approving it.

It clearly caused a change in the culture and outlook of all of the providers. If they had not taken notice before, they started to. Some of them started too late and, of course, as Matt has outlined, we are now still seeing that there are organisations that are not compliant with the code.

What we did in the compliance survey was look at whether they had the structures in place. Have they validated their methods? Did they have a means of their practitioners demonstrating competence? In general, we found that that work was well in hand, so there was risk mitigation there in the system. Accreditation will come when an organisation has a track record and can be assessed by UKAS. What I wanted to know was whether people were on track to do this, and the Act and the code spurred organisations to do that.

Having said that, we have some problem areas, which Matt has touched on, particularly in digital. In that area, it is interesting. We first went out and asked about compliance, and we got a response. Particularly within police forces, there were digital forensic units that had embraced the regulation and were progressing towards that.

Interestingly, in their response to the survey, they told us where they were and whether they were compliant, but also made reference to the fact that there were other people in the police force who were not taking any notice at all. It was very good of them to do that. I was not expecting them to tell a regulator that.

The next time I wrote out, I wrote to the senior accountable individual, saying, “I want to know about everyone who is doing this”, so that we flush out all of the units. The end product of that was that overall compliance went down, because we now had visibility of all of the units in police forces undertaking digital forensic work.

This is massively challenging because of the scale of it. In forensics, even DNA profiling is small compared to the scale and impact that digital forensics will have. We have some real challenges there because of the organisational structures and the multiplicity of organisations that are involved.

I also made reference to the annual report. At the time I wrote the first report, there were 59 organisations. They were all independently validating methods and developing competency frameworks, so I was really responding to the criticism that forensic science regulation is very bureaucratic and so on. We seem to be investing a lot of time and energy in doing things many times over.

You will see in our report that there have been improvements, which Matt touched on, in terms of compliance in the lowest forensic science activities. Not all organisations are there yet. My primary focus in that first two or three years was to understand the risks, because the risk is the basis on which I can use the enforcement powers in the Act.

You will see, in the second annual report, how we approached some particularly challenging areas in an FSA that has the lowest compliance. This was determining speed from CCTV footage, which turned out to be a significant and major investigation that I passed on to Marc when he took over. The interesting thing there was that, when I wrote to organisations to highlight those risks, 15 police organisations immediately stopped doing that work. We are having an impact. I will not pretend that we have got there yet. As Marc says, this is not fully bedded-in business as usual, but we are having that impact.

If I can just go back to your background, we have not yet seen the use of admissibility challenges in the criminal justice system. When that starts to happen, what the judiciary tell me is, “We need to see what happens in the Court of Appeal, Gary”, from their perspective. We will see that, and that will really bring home to people the potential impact of not complying with the code, and that is the right way to do it.

Lord Burnett of Maldon: Could I just follow up on the example that you gave about determining speed from CCTV footage? It sounds like a niche thing, but it is quite widespread. Having learned that, as you said, 15 police forces immediately stopped doing it, are you aware of any follow-through to look at the cases in which they had been doing it and where the evidence had been admitted?

Gary Pugh: Part of my response to those organisations that stopped doing it was, “You now need to review all of the previous cases in which you have undertaken this”, which they did. Clearly, there is a potential legacy there of cases that may be unreliable, but that was tasked to the relevant police forces. When I was regulator, it was the first area in which we used the investigative powers under Section 5 to require information. This has become a very large-scale investigation for the regulator.

What I also did very early on, recognising the way that the Act is constructed, was to produce some detailed guidance for the criminal justice system. It did not go down very well in some quarters, but, basically, I set out what all of the potential risks were, so that a barrister or the courts could understand what the risks were and why or where this type of examination could go wrong.

Lord Burnett of Maldon: Dr Bailey, do you have anything to add to that?

Dr Marc Bailey: To take forward the investigation over speed, Gary pointed out what had been done about police forces. What happened is that a large number of the ongoing cases by those forces were taken up by other forces, but also by the private sector. The investigation has continued to look at the private sector and to look at what the level is. We have received additional levels of compliance information out of the private sector to understand how they are doing in comparison to the police. There is a range, and we are then thinking about how we deal with those at the lowest level of the range and raise their performance, so that we avoid what risks being a postcode lottery on speed investigation.

Another feature that we have worked on is interpretation. At the moment, we are putting forward guidance on, effectively, how you interpret forensic science. How likely is it, for instance, that somebody had left their DNA in a place when you have conflicting evidence and so forth? That interpretation has been extremely well supported and is another example of really good feedback from the criminal justice system, as well as policing. We are hoping to publish that in January, which should then clarify and bring consistency over a whole range of cases using forensic evidence.

Lord Burnett of Maldon: Going back to the last part of my original question, are the statutory powers adequate for you to do what is expected of you?

Dr Marc Bailey: The statutory powers are adequate. They are really quite free-ranging. There are a couple of additional ones that I would like from comparison with medicines, but their absence is not a barrier. The two that I would like include possibly more formal recognition of inspection powers by the regulator. I would also look at penalties. There has been a huge amount of work on the criminal practice directive—thank you for the work on that—but I am looking to see if there cannot be some kind of scale of penalties, reflective of the size of the organisation delivering, so that it is not one penalty for all and a large organisation could shrug it off.

Lord Burnett of Maldon: Mr Gantley, do you have anything to add on this particular question?

Matt Gantley: No, not on that particular point of regulation. It is not our role.

Q98 Baroness Northover: My questions follow on from what we have just heard. They focus on the gathering of information and the resources to do the work that you are doing. First, how do you become aware that a forensic science provider is not complying with the code? Is that through surveys and reports? Can you do inspections? Dr Bailey has just made reference to that. In particular, do you feel that you get sufficient access to in-house provision by the police? Can I turn to Mr Pugh first and then to Dr Bailey as to what he feels now needs to be done?

Gary Pugh: The simple answer is that we do get made aware of issues, and this has been a feature of the regulator’s role since its inception. There is a requirement in the code to report what we call non-conformances. Any individual or organisation that is undertaking forensic science activities, regardless of whether they are compliant with the code, is required under the code to tell us about stuff that is going to impact on criminal investigations or proceedings. There is a requirement for a reporting mechanism there.

The current level of referrals, as we call them, is running at about two a week, or just over 100 a year. The interesting thing about that is that most of those are people telling us about things that have gone wrong. I have said many times that, generally, in forensic science, we have a strong and healthy culture of self-referral. The investigation that I referred to around drugs-driving came to us as a referral from the company. Likewise, we get many notifications such as that. Some of them are relatively minor, but it allows us to assess the risks, so we have a good culture, and that is to be supported. It is what I might call the airline pilot culture, and I encourage that.

We also have an anonymous reporting line. What is probably not seen—even though I have had a long career in forensic science, I did not realise this until I got into this role—is that one of the key sources of information about things that are not going well or where there is potentially unreliable evidence are the defence experts. The defence sector is critical, because they will see, close up and in detail, what organisations are doing through the criminal justice system.

I gave an example of that reporting route to the regulator, and there are many others where it is one individual who is a defence expert revealing or finding problems. Sometimes they do not affect the particular case that is at trial, but they indicate that, underneath, the organisation is not following the code or is certainly creating risk.

Baroness Northover: Dr Bailey, coming out of medicines regulation, could you comment on what you feel is now required in terms of being able to inspect as opposed to waiting for these reports to come in?

Dr Marc Bailey: Yes, certainly. Just to make a slight correction, we are now seeing referrals at the rate of three to four a week rather than one to two. I am sorry to correct you, Gary. What has changed there, which is very pleasing, is the culture of near miss. We are not seeing referrals that are purely a case of, “It has gone wrong”, but of, “We almost made a mistake and have put in place this mitigation. Does the regulator approve?” Some of these referrals are becoming quite rapid to deal with, and I absolutely welcome the culture of near miss. It is important in many regulatory systems. It is better to know because we can then disseminate that best practice.

To add to Gary’s list, I have seen more information coming through the expert groups. The regulator has a power to convene expert groups to get real expert opinion on what a regulation would look like. These are made up of practitioners as well as, say, academic or defence experts. It really depends on the topic. They have also proven to be a very good information gathering system, and so we are beginning to see some stuff going through with leads for us to then ask and enquire about beyond what is received in referrals.

In terms of inspections, we have the UKAS inspection system, and Matt here can talk about, say, the powers of unannounced inspections. My team performed its first inspection, to my knowledge, in the latter half of this year. We were looking at parts of an investigation and felt it necessary to go in. It was notable that we received full and complete co-operation. Unlike medicines, it is not a formal inspective structure. That lies with UKAS. It has proven to be more of an informal one, which I intend to use as and when is necessary, and that is extremely useful.

Finally, I also just want to really emphasise letters. We get letters from the victims of crime who have the closest input on maybe not the technical detail of forensic science evidence, but certainly the impact. Those generate some very important leads.

Baroness Northover: Are there any further comments?

Matt Gantley: In the interest of brevity, I agree with all of the points that Gary Pugh and Marc Bailey have already highlighted. I also welcome the recognition that is given to the number of quality incidents that are now coming through, because they do indicate a culture of learning and of quality improvement. We want those near misses. We want those smaller incidents to come through so that we can identify the trends overall for a particular conformity assessment body or forensic science provider, and then overall within the sector itself. That is a very healthy culture to see in any sector, and we see that in aerospace, automotive and other areas. We want the practitioners to flag those issues for them to be able to resolve directly themselves.

There is also a mechanism where there is significant non-conforming work that is relevant to not just that particular forensic science provider. It may be more of a question relating to the test methodology or have implications more broadly across other forensic science providers. We have changed the mechanism for reporting from the forensic science provider to UKAS, and the customer agreement to allow that mechanism to happen, and we do a risk-based evaluation. We meet with the Forensic Science Regulator on a weekly basis to understand all of those quality reports that are coming through in order to identify trends and make sure that they are appropriately closed off.

I wanted to quickly highlight the process of UKAS accreditation and our assessment programme. Initially, we assess the forensic science provider to see if they meet the relevant requirements of the international standard as well as the code of practice for forensic science providers. If they meet all of those requirements, we grant accreditation, and then there is a process of surprise assessments every year, as well as, in the fourth year, a full reassessment of the whole system again. There is an ongoing process of evaluation.

In addition, as Marc has highlighted, if there are complaints or a whistleblower, or we have issues raised to us confidentially and directly, we have the right to go and do an unannounced visit of the laboratory or the police forensic science provider to understand what is going on on-site. As Gary has highlighted, if there are specific issues that come through, and significant non-conforming work, or it had been highlighted to us from defence experts, we will fully investigate that at the next assessment or through an unannounced approach.

Baroness Northover: There is that element. Coming to the resources, I understand that the Forensic Science Regulator’s latest annual report notes that it has 8.4 full-time equivalent members of staff, and a budget of under £800,000 a year. Is this sufficient for you to fulfil your functions? Realistically or ideally, what would you like to see?

Gary Pugh: I will let Marc answer on the detail, because, clearly, he is now the regulator. I would make a general comment. In the Act, there is a fairly standard provision that the Secretary of State, following consultation with the regulator, will give the regulator resources. I must admit that what I did not find in the Home Office is a process to do that. In fact, interestingly, I discovered that, as a statutory role holder—and I am probably showing myself up here—I should have had a framework agreement between me and the Permanent Secretary. I did not have one.

I worked with the Home Office. We found the template and produced it. When I left, it was sitting with the Treasury. This is still not published. You may find that useful because it sets out my relationship not only with the Home Office but with the Ministry of Justice and the Department for Business and Trade. It also covers off how resources are allocated. I feel like I have let Marc down, because we did not have a process where someone—and I am not expecting the Home Secretary to—at a senior level would talk through what the requirements were for the regulator, and whether those resources could be made available. Now that Marc is dealing with the practicalities, I will hand over to him.

Dr Marc Bailey: Thank you very much. Just to start with the framework agreement, it is still, sadly, waiting to be delivered. I would really like to encourage the Home Office to progress this. I came from the Medicines and Healthcare products Regulatory Agency, where the framework agreement was a key part of monitoring the effectiveness of the relationship between, in that case, an arm’s-length body and the Government. We do need this, and it will set some powers.

Moving on to this year and the annual report for 2023-24, I have since had an increase in funding of about 20%. I now have a team of 14 people and an increase in operating budget, so I am very grateful to the Home Office for that. However, I would still like to hold out for more resources. First of all, would you expect anything else, and secondly, why? As I mentioned, with that new staff, I was able to run a focused inspection this year, which enables me to get to the heart of it. If I had more resources, I could do this more effectively. I would also, from the framework, understand a budget for investigations. I am currently in negotiation as to how best to complete an investigation, where I am trying to get funding from the Home Office for an extraordinary measure. I do not wish to disclose it; it would go into the investigation. Nevertheless, there is no structured mechanism for me to do that.

It would also, of course, enable more FSAs to be brought in line with the code. Gary mentioned that there are 51 recognised forensic science activities. Why are there only 34 [2] subject to the code? It is due purely to the amount of time and resource. The missing resource would be used to get the experts in place to set up the standards, which enables us to bring all of forensics up rather than selective areas.

Another key area that I would really seek support on is information technology. For the first time this year, we had an IT portal—again, thank you to the Home Office—which enabled policing and other forensic science practitioners to submit data on their declarations and their compliance. It had a lot of teething problems and it is also only a step in the right direction.

Coming from another regulator, these portals were essential for bringing efficiency savings to the people you regulate as well as to the regulator. A lot of concerns have been raised with the regulator about the difficulty of using the current version of the portal. More support on the portal and more integration would enable policing to improve their compliance so much more effectively, as well as the FSPs. I could go on, but that is a good place to stop.

Q99 Baroness Young of Old Scone: I am slightly confused by the difference between inspections by the regulator and inspections by UKAS.

Dr Marc Bailey: Under Section 9 of the FSA Act, I have the right to take measures to understand any non-compliances. That includes not a formal inspection. I called it “inspection”, but it was probably closer to a structured visit, where we went and questioned. It was designed specifically for that investigation. It does not represent a power that I would necessarily adopt, because it was required in a certain period of time rather than a structured process. Matt, under UKAS, has a much more structured process that he can elaborate on.

Matt Gantley: I highlighted earlier that the UKAS assessment process is based on, first of all, an initial assessment. We gather information together, submitted by the forensic science provider, on its compliance against the relevant standards and the code. We then undertake an evaluation on-site, as well as some aspects that are done remotely. We then determine whether, through an evaluation of the practices and procedures, and in practice, the activities that are undertaken under the forensic science provision have met those relevant requirements. We then potentially grant accreditation. We also raise findings during the process for the forensic science provider to address.

If they have met all those requirements, we grant accreditation. There is then an annual surveillance assessment and, every four years, there is a full re-evaluation called a re-assessment. As I highlighted earlier, if there is a whistleblower or a specific incident that is highlighted to us or brought to our attention or, for example, on the commission of the Forensic Science Regulator, we will undertake an unannounced visit or increase the frequency of assessment of that forensic science provider. Ours is a process of ongoing evaluation as part of accreditation, and that model that I have just described is repeated by other accreditation bodies internationally.

The Chair: We must move on because time is pressing, and I hope that questions and answers can be a bit shorter.

Q100 Baroness Walmsley: My question is about compliance with the code. I was intrigued by your emphasis earlier on a near-miss culture. If you walk around this building, you will see a lot of posters saying, “Report accidents but also report near misses”, so it is interesting to see how important that is in your field as well.

Are forensic providers in England and Wales generally on track to meet the code standards, or are there still significant gaps? I noticed that you told us earlier that 22 of the 34 organisations came with quite a high score, but about seven were low or very low, so I wonder if we can dig into that a little more and see if you can give us an indication of the areas of the code where compliance is generally good and where it is generally lacking, perhaps with some examples.

Are there differences in compliance depending on the provider? I noticed that one of you said that there is a range among different kinds of providers, and I wonder if we could have perhaps a summary of that work after this event. That would be helpful.

Gary Pugh: As I did the survey and provided the information, I will start. I am sorry if I misled you. When I said 22 out of 34, that is forensic science activities that have high or very high compliance.

Baroness Walmsley: So it is not the organisations.

Gary Pugh: No, it is not the organisations. It may be worth me saying that, when we did the survey, we hunted out the organisations that are undertaking forensic science activities and are subject to the code. That first survey identified 77 organisations. That is a combination of police and commercial.

To go to the different levels, or perhaps the low compliance areas, there were seven in the low and very low. Perhaps if I go through the four that were very low, you will see in the annual report that I give an assessment of risk. Even where there was low compliance, we got underneath that to see whether organisations had the structures in place to manage quality and had made applications to UKAS to gain assessment.

It is important to remember that the UKAS assessment comes at the end. There is a lot of good work that UKAS can do to support organisations, but achieving accreditation comes after you have a proven track record and UKAS has assessed you. There are a lot of people in the process of doing that, and it is a multi-stage process, so we wanted to find out where they were.

Organisations that had not validated their methods, or whose staff were not competent and, basically, did not have a clue, were very few and far between. We targeted those first. Generally, because this has been around for quite a long while, there has not been an impetus to move it quickly, but organisations had started down that road and that is what we saw when we got underneath it.

Without making the answer too long—and please stop me if I am—I will go through the four that were at the bottom of the league. This is interesting, because, if I deal with just two of them, this is, again, where there is no accreditation requirement. We dealt with this differently. This relates to the routine and simple, if I can put it that way, collection of CCTV footage and audio.

The way that that was set up prior to my arrival was that the NPCC developed a framework with the regulator that set out the standards and the training that was required. We are looking now not at forensic experts but at front-line officers. Nevertheless, it is important that they get it right. Otherwise, all of that hard work and scientific interpretation that happens down the line is for nothing if they do not collect it in the first place, or they do not collect it at all.

What the code did was make the framework the compliance mechanism. The police service might not thank me for this, but they rather shot themselves in the foot, because, when we went out and did the survey, as good as the framework is, the responses that we got from the police forces were that they did not understand their own framework, so we ended up with very low compliance. The assistant chief constable who leads this and who developed that framework, who was an ACC from South Wales Police, was aghast at this. We worked with her then to make it very clear that, because this was a compliance mechanism in the code, and the FSA was subject to the code, that engaged my powers of enforcement.

The upshot of that was that, in the second annual report, we had made that very clear, and there was then a large increase in compliance. In fact, over 70,000 police officers have now met the requirements in the framework, so there has been a positive effect from that, albeit the starting point was not a good one.

That leaves two other forensic science activities, one of which I have already touched on, which is digital. The challenge here is that we now have not just one organisation but a multiplicity of organisations or units within police forces, and an increasing number of commercial providers. This is growing at a fast pace, and not just in terms of the number of organisations, so it is challenging, and particularly so certainly in my time.

What we also need to think about, of course, is that, because this is going to be so big, this is not going to be like a traditional forensic science discipline. The recovery of data is going to be a core competence of every detective, so we need to find a way to regulate the front line. Accreditation would be too onerous. We could not put every investigator through that same process.

When I left, we were in discussions. You heard evidence from Jayne Meir, who is the digital lead. We need to develop an operating model here that is tiered so that we can manage risk, and officers in the front line can get access simply to data that they need to progress the investigation. If it is deleted data or it is more complex, then it goes to different levels of units, and they will require a different regulatory solution.

Baroness Walmsley: Does that mean that you look at the quality of the training and the courses that front-line officers have?

Gary Pugh: Yes. In terms of what it needs within the police organisation, when I wrote to get further information on this from them, I asked for a nominated lead for the whole police force. Most police forces were fine with that, because the technical specialists in the central unit oversee what is going on. In some other forces, they were not. There were clearly internal tensions, even to the point of people saying to me, “We will give you the information, but do not tell that other unit in our police force”. There are some real issues here that need to be addressed, although not for the regulator, I am glad to say.

As may also have been mentioned, the HMI made a recommendation that all of digital forensic activity should come under the forensic unit so that you adopt that forensic culture. That has not happened. There are many forces still resistant to that. We have a lot of complexity here. We need to get the right proportional solution based on the risk. If I am honest with you, we will see some incremental improvements, and the central units will certainly comply with the code, but we then have a large number of individual practitioners who will need to somehow come under regulation.

Baroness Walmsley: We have been hearing how very complex the whole system is, and we have come to the conclusion that it is really important that the whole system works together from incident scene investigation right through to, as you just talked about a few minutes ago, the quality of interpretation. How does the code apply to the system as a whole in terms of the seamlessness of the communication between one stage and the next, right through the system?

Gary Pugh: The code certainly recognises that. Therefore, regulating incident examination is from the initial collection right through to interpretation. It has always taken that holistic view. As I have described, it does not limit itself to experts or the courts.

What is also significant is that the pushback that I sometimes get is, “This is only about expert evidence. It does not affect me as a front-line investigator”, but it does. The Act is clear. It is about criminal investigations and proceedings, so determining whether a crime is committed is in scope. Even the initial actions in a police force or an organisation at a crime scene, before they have even established that a crime has been committed, are in scope for regulation. It took some time for me to drive that point home. The investigation and enforcement powers apply to that part of the process in the same way as they apply to expert evidence in the courts.

Baroness Walmsley: Dr Bailey, can you tell us what support or resources you have or would be needed to bring all forensic science practitioners into compliance?

Dr Marc Bailey: This would be quite a difficult thing to achieve rapidly. Basically, this is a system based on risk. If you are not compliant, you have to declare what the risk is that the evidence that you are giving to the court is faulty. My starting point is to improve those risk statements. They are not necessarily consistent and are open to interpretation.

The other thing to get in is the recognition that not everyone can achieve ISO accreditation. We have already done some work on what can be done for the smaller FSPs, which aligns with ISO accreditation but is not the full accreditation. Effectively, it is about continuous reminders about compliance. You can have compliance, but if, for example, there is an act of God and the police station burns down, you are out of compliance again. You see a continuous turnover in terms of hitting compliance.

Overall, I am seeing a lot of effort put in there, because there is a strong culture of quality getting embedded now. Aside from my earlier answer about maybe support for the FSR team, there are resources out there. It is just about making sure that they are adequate for what each organisation is trying to do.

Matt Gantley: I would echo again the points that my colleagues here on this desk have highlighted. In terms of resource, it is always a challenge to make sure that we have sufficient resources in order to meet particular demand in terms of applications for accreditation. As I mentioned, the model of accreditation is self-financing. It is financed through the assessment fees that we charge to those accredited bodies. We have to make sure that we plan as far ahead as possible to ensure that we have the right internal resource and technical experts for any specific technical discipline.

Some of the challenges and opportunities that Marc highlighted there in relation to ensuring greater compliance across all forensic science providers, large and small, from traditional disciplines into new and emerging areas, particularly in digital, require us to look very carefully at the model that operates at present, and one model does not apply in all areas.

We have already started discussions about how we create milestones to compliance. The primary objective is compliance with the code, and accreditation is a model that allows demonstration of that compliance. Through UKAS and the Forensic Science Regulator working together, we can create distinct and clear milestones that take an organisation all the way to compliance with the code and, eventually, then on to accreditation. Supporting that with free-to-access and free-of-charge webinars and training through a learning management system will help practitioners understand what they need, whether it is an individual practitioner, for example, accessing digital information, or an enterprise that is undertaking deep forensic analysis on digital devices.

Baroness Walmsley: Can they do that through these milestones and the gateway and so on without having to pay a fee?

Matt Gantley: Our model in accreditation is based upon assessment of efforts. We do not receive government funds for any of the work that we do.

Baroness Walmsley: No, but you said that your survival is based on the fees. I was wondering whether there are steps that organisations might take before they have to pay a fee.

Matt Gantley: As much as possible, where we can develop materials and best-practice guidance, and develop training webinars online, we would make sure that we would provide it free of charge. When it requires distinct professional expertise to go out and do an assessment activity, that is where there has to be a cost recovery model inherent within it. Our model is not to seek public funding for that. The provider pays for it.

Baroness Walmsley: No, but it might help them to prepare for the point where they go for full assessment.

Matt Gantley: Through our portal, we have self-assessment tools, through which they can evaluate compliance against the relevant requirements and how they build to the current compliance. The code is very detailed in setting out what the requirements are.

The Chair: When it comes to compliance, I am afraid that we must be mindful of the compliance to our own schedule, and we are running behind schedule.

Q101 Lord Drayson: I want to take the questions to focus on whether the overall market is working, given that the Government control this market and determine whether sufficient resources are provided to enable your activities as regulators to be effectively complied with. Do you take into account, particularly when consideration was being made of the process for implementation of these regulations, of the impact on the practitioners and their ability to afford to comply, given the pricing that has been established for the provision of those services?

I am trying to get a sense as to whether the implementation of this regulatory regime to improve standards took place with an understanding that that would require additional financial resources to enable the market to continue to work. We have heard from other witnesses to this inquiry that forensic science is in crisis, given that so many practitioners have left because they have been unable to meet the regulatory requirements, and the funding that is provided to them to provide those services is inadequate for them to do so. Could you please give a sense as to whether you feel that that crisis is taking place and whether part of the reason for this is the level of resources being provided?

Gary Pugh: My observation is that forensic science regulation started some time ago—nearly 20 years ago now—and the model that I have described about having an effective quality management system predates that. This is 20 years in the making. For organisations who are going to undertake forensic science activities, this should not come as a surprise. It is also accepted that this is the way that things should be done. To me, the costs of quality and of providing accurate and reliable services have been very visible. Certainly, my predecessor, who fought hard to get statutory powers, was frustrated because no one was progressing things as quickly as they should have been. If you are going to do forensic science, you should do it to the appropriate standards.

Lord Drayson: My question is not to question whether the standards should be implemented. Clearly, they should. My question is whether the resources have been provided to enable people to meet those standards and to remain in this market.

Gary Pugh: My answer to that would be that, if you are an organisation that is going to do this, you should secure the appropriate resources. I say that because it is central.

Lord Drayson: I am really looking for your sense, as a regulator, as to whether those resources have been provided. Is what is at the heart of the problem the lack of resources to meet the recognised requirement to meet these regulatory standards?

Gary Pugh: There has certainly been an issue of organisations not realising that they need to take this seriously. They sometimes see accreditation as a badge. They chase the badge, they do this in a superficial way and they fail, or they do it in a way that creates a management system that is far too complex.

Lord Drayson: Dr Bailey, I would be interested in your perspective on this. Is what is at the heart of this a funding problem?

Dr Marc Bailey: It is a mixed answer. About three-quarters of forensic science activities are developed by the police. The police have a funding settlement from the Government, but it is up to each individual force as to what level of resource they give to forensic sciences. I am not aware of any force giving up on forensic science overall. That would be nonsense, given that you need forensic science even to collect evidence, but you do see them changing which forensic science activities they use. Some forces have partnered and distributed forensic science activities. That is probably reflected in the balance sheets of the police forces, but it is not reported on at the time.

Looking at commercial providers, this committee has heard from the largest providers, which are Eurofins and KFS, which are dominant in the market. They are very happy with the quality of systems.

Lord Drayson: We are concerned that that might be a case of regulatory capture. That often happens in markets when sufficient thought is not given to the creation of a well-functioning market, particularly at the tail end, and you see the largest, most well-funded practitioners being able to capture a dominant market share. Mr Gantley, would you like to comment on that?

Matt Gantley: Just building on some of the points that Gary Pugh has already made, those organisations that see quality assurance accreditation as a badge are missing out on huge opportunities for improving the scientific discipline and consistency, giving confidence to the market, and that ongoing continual improvement process that leads to that public confidence. Organisations that see it in that way miss that huge opportunity.

UKAS—and I know that the Forensic Science Regulator is very conscious of this—is not putting undue burden on forensic science providers. The cost of accreditation is a self-financing model, as I have mentioned several times already. It is done on a not-for-profit basis. We do not have any shareholders. Any small surplus that we make is reinvested into the business. The effort or the time that is taken to do an accreditation assessment is almost the minimum with which we are able to do in order to do a rigorous assessment of that forensic science activity. We are very mindful of the impact that that has, particularly on smaller, niche areas, and so any increase in the cost of that accreditation is done only at the rate of inflation in order to make sure that we can cover our costs.

Dr Marc Bailey: If I may come back, regulatory capture is a concern in any market for any regulator. I am very aware of it. We use quite a large system. At no point does this regulator take any instructions from any one company. We consult as widely as possible at every level of expertise and take that into balance, but the code reflects a baseline structure to enable compliance by all organisations. I will continue to be very vigilant for signs of regulatory capture, but I am aware of none today.

Lord Drayson: You are aware of none today. Are you concerned about the concentration that has taken place in the market over the last few years?

Dr Marc Bailey: Concentration comes in, but it also, effectively, looks like market dynamics. If the companies seem to operate in the structure where they can merge and so forth, that has created large providers, but they are not necessarily larger than the police forces. If you remember, they are still only about a quarter of the total number of providers. Would I say that they are in a position to dominate? No. Do they have freedom to still grow? Yes, probably.

Q102 Lord Berkeley: Just following on from the last discussion, we have heard a lot of evidence from people that part of it may include regulatory capture, but the process is time-consuming and burdensome, and the police complain that it takes away from their normal work. One could say, “Well, they would say that, wouldn’t they?” There is also evidence that some of the external providers may be reluctant to join the market because of the costs of doing it.

The comment that your charges are extortionate is a pretty strong criticism. Is there any other way that the process can be looked at? In particular, is there a different way for smaller providers? “Shortcut” is not the right word, but you will understand what I am trying to get at. In other words, there is no point in them leaving and no longer being part of the system if it is just because of cost. Perhaps the niche providers are not asked to do the work quite so often, but they are still needed and still need accreditation. What can you do to try to make it more accessible without everybody moaning all the time? I know that regulatory capture is a well-known criticism covering many regulators, but this one is quite a strong criticism that we have heard.

Matt Gantley: First of all, we are not a regulator in that sense, but what we do is we evaluate against the code and the accreditation requirements, and award accreditation based upon that evaluation. That is taken into consideration by the regulator in terms of evaluation of overall compliance.

When we look at our fees, we ensure that we evaluate or determine what is required in order to undertake a rigorous assessment of the forensic science provider, whatever discipline that might be, from digital forensics to aspects of toxicology. It is a risk-based approach to ensuring that we undertake sufficient time on-site with that forensic science provider or look at their systems remotely. We have to build in the time, and it is the time that is the chargeable element of our work. We recover the cost of that by charging those fees.

We are very mindful of the impact that that has, particularly on smaller enterprises, but we have to strike a balance. This affects everything that we do, from the work that we do in accrediting NHS pathology laboratories to the work that we do in evaluating the potability of water and water testing.

The many bodies that we credit are public organisations, such as the NHS pathology laboratories, and we need to, wherever possible, minimise the cost impact on the public service. That is why we are very cautious, in that, when fees go up because of inflation, we do that to the minimum possible level to cover those increased costs that we will see as an organisation, but we are not for profit in the way that we operate.

If there is a very large organisation, such as Eurofins, that may undertake a niche activity—for example, digital forensics—and there is a very small organisation that does the same activity, we cannot give a subsidy to one but not the other. We have to be very careful, and the fee rate is standardised for everyone.

Nevertheless, we realise the impact, particularly on smaller enterprises coming into the market, and that is why, working with the Forensic Science Regulator, we are now developing a programme of a milestones approach to achieving compliance with the code and then getting to accreditation. That will be universally welcomed by big and small organisations in terms of helping them to understand the systems, processes and practices that are needed in order to achieve compliance, and the self-assessment modules or the training will be done on a free-to-access basis.

Lord Berkeley: Dr Bailey, do you have anything to add?

Dr Marc Bailey: We do not collect costs at the moment, but we look at understanding the burden of regulation. I have engaged with the NPCC and other bodies to start collecting evidence. A lot of these complaints that you have heard are anecdotal, and I am struggling to find really robust evidence, partly because people define the word “burden” in so many ways. Trying to get a consistency of what is happening is work that I am undertaking.

Where I identify it, there are probably multiple drivers. It is a case of over-engineering a solution or, given that this is a risk-based structure, inappropriate response to risk. I have discussions with forces about how we can advise on their process reviews to make sure that we are removing inappropriate work, and I hope that, in time, we will then have figures that can back up these anecdotes.

Lord Berkeley: Would it help if there were fewer than 43 police forces to deal with?

Dr Marc Bailey: I must admit that the 43 police force structure does create duplication, but then there is also a fair amount of local need that drives it, so I am not sure that that would be a quick solution.

Q103 The Chair: Mr Gantley, the Westminster commission report, which we have taken into account in this inquiry, does say—forgive me if I use these quotes—that “The accreditation process was … ‘over-engineered’ and ‘disproportionate’, ‘overly arduous’, ‘serving to stifle disciplines’, and destabilising the market”. Do you think that those are fair criticisms or is there anything that you would like to tell us to counter them while we have today’s hearing?

Matt Gantley: The UKAS accreditation process is a rigorous one. We have to define the requirement to evaluate thoroughly the compliance of the forensic science provider in delivering against the code or the international requirements set out in the accreditation standards. We have to be rigorous in being able to do that. We do that on an initial assessment and then on a surveillance basis. It has to be rigorous.

The quality management systems that the forensic science providers put in place are their choice. If they have developed bureaucratic, burdensome systems, it would have been their choice to do that. We do not tell them what systems to put into place. They choose the methodology of demonstrating compliance.

In terms of the cost of accreditation, the number of assessment days for smallest provider that we have under accreditation is around five. That translates to an overall annual cost of around £6,000. The most frequent cost of accreditation in terms of assessment days is around 15. That translates to a cost of around £20,000. Remember that that is done on a cost recovery, self-financing basis. I do not see those as being extortionate costs.

Q104 Lord Stern of Brentford: Could I ask the in-house version of that question? Most forensic services are provided within the police service. Most of those are not accredited, particularly in the digital area but also more broadly. If most of the work is done by people who are not accredited, as it clearly is, does that suggest that the accreditation system is not fit for purpose?

Matt Gantley: No. It is that they have not yet demonstrated their ability to meet the requirements of the code or the accreditation requirements.

Lord Stern of Brentford: You are trying to accredit and, in that sense, to give quality standards. Most of the activity does not meet those standards. Does that tell us something about the relationship between the accreditation and the people who you are trying to work with? How can you bridge that gap? Something is not working.

Matt Gantley: I agree. We need to bridge the gap and we will work together to make sure that the system operates effectively. I have already highlighted some of the initiatives that we have put into place in terms of the training, the free-to-access webinars that we have provided, and the self-evaluation tools in our digital platform where the forensic science providers can go in and evaluate their compliance against the relevant requirements of the code or the accreditation requirements. All of that is free to access for them to demonstrate and evaluate their compliance against the code and then move towards accreditation when they are ready to be able to do that.

Lord Stern of Brentford: The gap is so big. Is there any sign of them doing it anytime soon?

Matt Gantley: What we have also been doing with the Forensic Science Regulator is focusing on the critical aspects of compliance against the code that are the immediate priority for any particular disciplines—for example, incident scene examination—and focusing on those first in terms of a process of milestones towards full compliance and then achieving accreditation.

Lord Stern of Brentford: There is still a very long way to go, it seems, in terms of how few of them are accredited.

Matt Gantley: Code compliance is critical to ensuring scientific discipline and the rigour of the forensic science activity.

Lord Stern of Brentford: My next question is for you, Marc Bailey. You talked about trying to understand the burden of regulation, and it is always a difficult issue, wherever you look, because it is so difficult to define.

Let me give a different version of that question. It is not the same thing, but it is along the lines that you were describing. If you think about the regulation and structure that is there—and it is there for a good reason—and about the difficulty of complying and the relationship of resources to that difficulty, are you aware of or initiating any studies along the lines that you began to describe on what sorts of resources are necessary to meet the compliance standards that one is looking for? It is not quite the same as the burden of regulation. Given the standards that are being imposed, and understandably so, what resources do they need to comply with those standards? Please also pick up any other comments that you would have wished to have made to the last question.

Dr Marc Bailey: I will start by picking up and then come to that. The statutory powers request that any practitioner is compliant with the code. The code is a risk-based structure, and so the final result from the forensic evidence should be coming out with a risk statement. If you are completely beginning and do not have the equipment, there is a very high risk that you have produced invalid results.

Lord Stern of Brentford: Clearly, any definition of compliance is associated with a degree of risk. We have to take that as understood.

Dr Marc Bailey: Yes, absolutely, but the compliance set out in the code is, effectively, a set of performance criteria, and your risk statement is whether you have missed that.

Coming to the second half of the question around what the resources are for that, it is highly variable, as you would expect, depending on which FSA. By and large, forensic science activities have a strong scientific component, so that, at the highest level—Gary mentioned three levels, from front line to scientist—you need qualified scientists to understand and interpret. That reflects a level of investment, because such scientists have to be trained and have proficiency and understanding, but those costs will still vary by scientific discipline.

Further down in the FSAs, you can start to approach straightforward work where proficiency can be done with people with a level of training that is lower than those on the front line, but that has to be assessed as a whole for any one FSA. It is very hard to give you an absolute answer. It is two things. It is the practitioners, what they feed back and what they are seeing, and the experts saying what is needed to hit that overall judgment of risk, and then understanding if the balance is in the right place.

Lord Stern of Brentford: Thank you very much for that. Is there any interaction between you and the police forces? I am focusing on the in-house, because that is where the majority is happening. Do they give you any idea, or are there any studies, of what extra resources they would need to be fully compliant, taking into account that any notion of “fully compliant” comes with a risk?

Dr Marc Bailey: I have not received as yet, in my role, a resource breakdown. I have had various forces promising such, and we will see if that comes in. The communication is there. I meet monthly with the head of quality at the NPCC, Chief Constable Paul Gibson. I meet much more regularly with the quality board. We discuss all aspects of the quality provision. It is about trying to get beyond the anecdote in that to get to the resource. Yes, we need more information to really understand and to give you a proper answer to your question.

Lord Stern of Brentford: Resource spent, we do not really know, and resource needed, we do not really know either.

Dr Marc Bailey: In relation to resource spent, I do not have access to the figures, which are, presumably, within police and practitioners’ budgets. Anticipating the access should come into part of what the FSA is and how it has changed. As we have mentioned, there are FSAs such as evidence collection where they want to deliver with fewer trained staff, making sure that the cost changes. It goes from the salary of an expert to the training costs for a large number of officers. There are still costs.

Gary Pugh: I would just make a few points having listened to that. First, in terms of commercial organisations coming into the market, when I did the review of the drugs-driving company, I saw that they had not appreciated the rigour of the criminal justice system. This is a perfectly reputable company doing toxicology analysis. It hit the criminal justice system and just did not realise the scrutiny that it would get with its results. My view as a regulator was that we could do something about that by helping new entrants understand the regulatory framework before they make the investment and start providing services.

Secondly, I have heard it said that most of forensic science is insourced, but it is not. I have just done a rough calculation. Of the 36 FSAs that are now subject to the code, seven are undertaken by the police only, 10 are undertaken by both police and commercial, and 19 are undertaken by the private sector only. The insourcing has been happening, and that raises a whole set of other issues, but, at the moment, most of the complex forensic science activities take place in the commercial sector.

Lord Stern of Brentford: On the digital side, we have heard that most of that is done in-house.

Gary Pugh: Yes. As I said earlier, there are probably at least 60 organisations involved in digital.

Lord Stern of Brentford: I am not talking about the number of organisations; I am talking about the level of activity, in that most of the digital is done in-house.

Gary Pugh: Yes. You have more front-line recovery of data that would not be done by the specialist units in police forces or the commercial providers. It is a very different model. The fact is that digital recovery is so ubiquitous.

Lord Stern of Brentford: If we are talking about the level of resources and activity, it is important to recognise that the big majority is in-house. It is not simply counting the number of suppliers.

Gary Pugh: Yes, it is the amount of the activity that is undertaken as well. Again, the annual report gives you some information on that, but there is a lot of forensic science that is still done outside of the police environment. That is not to say that the police do not have ambitions to insource that.

Lord Stern of Brentford: It is a matter of fact that the big majority of activity is in-house.

Gary Pugh: I do not think so. The large volume activity—DNA profiling and toxicology—is done by commercial companies. There is large-volume activity in terms of fingerprints and digital done in-house. I do not think that the police services are dominant at the moment in terms of volume.

Lord Stern of Brentford: We have had evidence of that.

Gary Pugh: I will own up to something that was mentioned about concerns around the burden of regulation. Particular concerns were raised with the Home Secretary in my time about crime scene examination. In the interest of time, basically, I set out to fix that. The regulation was ineffective. The code is written from a laboratory perspective. What we were seeing was the culture of a laboratory, so we are trying to treat a crime scene as a laboratory, and that just was not the right thing to do, so I took action in version 2 of the code.

The key to this, to go back to the beginning, is that the code did not have specific requirements for scene examination. We have introduced those into version 2 of the code and suspended the requirement for accreditation for a period to allow predominantly police organisations to adjust and to adopt a more proportionate approach, but still meet the relevant standards and requirements that are in the code.

Q105 Baroness Young of Old Scone: Our 2019 report and the Westminster commission report talked about having somebody looking at the whole of the forensic science market more broadly, rather than simply having a regulator regulating whatever happened to be in the market at the time. Where do you stand on that? Perhaps I can ask Dr Bailey, because he has the reins at the moment. Do you want to become the regulator of the whole market? What would that entail? What additional powers and resources would you need?

Dr Marc Bailey: It is not something that the Act currently defines and it is not something that I have personally investigated. There are examples of regulators that regulate markets and, if that was a route to go down, I would ask to commission a report to understand what the powers are. I cannot answer that question.

Gary made the point earlier that this is an unusual market. When you join it, you have to produce to the rigour both of the policing and the criminal justice systems. You have to retain evidence for many years, so that people can go back to it. You have to retain records. These all drive up costs. Any market has a high barrier to entry because of that and the market is going to be somewhat less fluid because of the barrier to entry, but that does not mean examples of that do not exist.

There are things that can be done within the regulatory framework to improve the confidence of those who are in the market already and to understand how well they are performing as vendors. More work is needed to understand if the Forensic Science Regulator role is in the right position to fully control the access of commercial providers to the forensic science market.

Baroness Young of Old Scone: I have seen examples of regulators that do not necessarily have market regulation in their establishing statute, but nevertheless see the stability of the market and the propensity of it to produce higher quality or lower quality as a fundamental part of their regulatory role. You do not see that.

Dr Marc Bailey: I am sorry if I gave that impression. I am very much keen on driving up quality as high as possible for practitioners, but I do not segregate the code by size of organisation. I would attempt to have an even-handed code.

Baroness Young of Old Scone: My experience in regulating health and social care was that, if you did not keep an eye on the market, the quality of organisation that had 800 old dears in its beds was not going to be very high if it had just gone bust. Perhaps we can move on from there.

If you do not see it necessarily as something that is an immediate priority for the regulator, who should be keeping an eye on the market? We now have this new post in the Home Office, the director of forensic science. Is that where it should lie?

Dr Marc Bailey: The director of forensic science is recently in post. This is my understanding of the role, rather than perhaps what the role is. That person is looking to understand how the services are delivered and come up with a structure that is more effective for policing. That, as a very broad remit, will have to include both the policing and the commercial providers. That role probably creates a new market structure, at the end of the day.

If you are creating a market, that does not necessarily mean you are best to regulate the market. It may mean that you need to have an additional regulatory function to call both the creator and the market to account. That may come on to this statutory role or may be perceived to be better done by a new statutory organisation of some kind. That really depends on what the solution is.

At present, we try to make sure that the code can be applied regardless of size of the FSP, and so we make some allowances in the code in terms of rigour of number of steps they need for compliance. For instance, for sole providers we have introduced peer review to make sure that there is an independent quality measure coming through. We recognise that not everybody can be accredited, but we still drive everybody to achieve the highest level of excellence and quality.

Baroness Young of Old Scone: Can I ask both our regulators—one can never have too many regulators, in my view—how you are feeling at the moment, on a personal basis, about the balance between in-house and commercial services? Is there a healthy balance at the moment? Is the direction of travel, which seems to be more stuff coming in-house, healthy or would you ideally want to see a much more diverse market?

Gary Pugh: I am drawing now on my experience, having been director of forensic services at the Metropolitan Police. I actually ran the largest forensic unit for 17 years. Prior to that, I was in the Forensic Science Service and the Home Office. I was a director in that organisation as well.

I have seen this market go from the very early days, when it was not really a market. It was a change of funding mechanism to allow what was then the FSS to increase its resources to meet the demand from the police. This is by accident, rather than design. Before we regulate the market, we need to decide what we want it to do. It is a constrained, disjointed system at the moment and we have seen the risks. We have seen companies come and go and that can have major consequences.

As Marc highlights, in terms of providers in this area—and, again, if you follow the Westminster commission view—you could have companies coming in and out of the market but, if they leave, where do people go for the evidence that the CCRC needs five or 10 years after the event? We have to have some careful thought as to what purpose the market serves.

In terms of the balance between police and the commercial sector—as I say, I have been part of this—what we seem to have lacked at the centre is thought about how this should operate in practice. The police service have—I will own up that I did this—ended up being provider and buyer. That means you have inevitable conflicts with no independent assessment of what the right solution is.

We will drift to more insourcing, particularly because at the moment there is no control. A chief constable can just set up a forensic laboratory and start doing forensic science. If they meet the requirements of the code, that is fine. There is no scrutiny of all of those funding and investment decisions. I would start, foot on the ball, and look to see what is actually going on.

Baroness Young of Old Scone: There was talk about the director of forensic science and their new work perhaps reshaping the market. What about the MoJ? Should it be involved?

Dr Marc Bailey: That is a good question. I am not aware of any statements from the MoJ, but of course the courts are the ultimate arbiter of forensic science. They pick what evidence goes into the courts; they understand the emphasis on it. That is very much a question for the MoJ, but you can see there is a source of information there that would be useful.

Baroness Young of Old Scone: Do you think there is enough of a handshake between the MoJ and the Home Office on forensic science?

Gary Pugh: It is interesting. The framework document I referred to positions the regulator as having a line into the Secretary of State for Justice, which took some persuading. The way this is seen is that certainly my role was under the Policing Minister. Forensic science is the Home Office’s problem, not the MoJ’s problem. That is the firm impression I get.

Having said that, I have worked closely with people in the MoJ. They need to be more of a party to this, in terms of what the future holds for forensic science. That relates to one of the things I said earlier about the defence sector. It is unregulated. There are no barriers to entry. There are some real issues around capacity and capability.

I raised those concerns with the Minister and I also tried to get the review of that part of forensic science into the reform programme, but, of course, it is not about policing. It did not work and the remit of the new director of forensic services, from my understanding, will not look at that aspect of forensic science, which is critically important and is a significant risk.

Q106 Lord Ranger of Northwood: Gentlemen, thank you very much. It is very enlightening hearing from you; you have different views from what we have heard from previous witnesses. I am taken by some of the comments, particularly, Dr Bailey, about your setting up of the IT portal for the first time this year and, Mr Pugh, your points about the competency of every detective around data recovery.

As someone who is completely new to this area—I did not know anything about it before we started this inquiry—the world of forensic science and then the world of digital forensics is very interesting to me. I come from an IT sector background. To be honest, the whole world is becoming digital. I wonder where these two worlds blend. Many people have talked about them quite separately but, effectively, there is a lot of technology that probably is involved at the moment and will be ever more so.

The question is, at the moment, if you are just getting a portal going, basic things are happening and we have this fragmented landscape of 43 different forces, et cetera, how you are able to keep up with the developments that are potentially emerging in digital forensics. I must disclose, as it is particularly relevant to this question, that I am a co-founder of the Business AI Alliance, which is a community of start-up AI businesses in the UK.

AI is going to play a big part in what you are doing. Are you reaching out to that type of sector to help you in terms of what you might be developing or need for requirements in digital forensics? How will that move into the setting of standards, codes and accreditation going forward?

Dr Marc Bailey: As I mentioned earlier, the Forensic Science Regulator gets advice from expert groups. There is no doubt that digital is growing enormously. From discussions with police forces, we are seeing that, if you go back 10 years, this was not considered. Now, one of their first actions is to seize the routers and the phones at a site and consider that evidence right from the start. You have a system that is taking on and learning quite rapidly.

I am bringing together expert groups so that we understand where the priorities are and what is needed to make this forensic evidence, rather than part of the general discussion of AI. There are multiple regulators grappling with how to regulate the expansion of digital information and AI. I do not intend to reinvent the wheel. I will happily borrow what is good practice from multiple regulators. I am looking to understand what is compelling for the criminal justice system and what is a controlled risk.

The police absolutely feel that they are in an arms race with the development of the digital world, and I do not wish to get in the way of that. We are looking at best practice. Today, there are already FSAs that use complex algorithms and complex IT. For instance, DNA analysis uses a significant amount of IT to get the information. Again, rather than putting something new in, it is about taking that. The code today is structured around how you collect the evidence. It does not prescribe what to do with a mobile phone. That is for the operating procedures of the police. It just says, “This is how the information could be structured”, but I am very aware that there will be other issues evolving, and I am looking to get input from the police to develop as rapidly as possible.

Gary Pugh: I think Matt has something to say about AI. The only thing I would say is that, having looked at this, we regulate human intelligence, comparing fingerprints, which is a cognitive process. We have developed in forensic science globally validation systems, which are quite robust. Again, we will see how they fare with AI, but we are prepared for it in that sense. We are always looking to validate a method to understand and manage the risk of error. We will come to it with that approach. I am not saying it is not going to be challenging, but we will come to it with the right mindset.

Lord Ranger of Northwood: Just before I come to Mr Gantley, Dr Bailey, on your point, it is really good to hear that you are working with the other regulators. I would ask if you are working with the Information Commissioner’s Office, because it is doing a lot about processing and bringing that view together.

It is less about the AI. It is more about the outcomes you are trying to achieve, and I definitely see an opportunity. You could bring some of the thinking that is happening in that world into how you are working at the moment, to see how what is done can be done differently in the future with agentic AI and various other things. That is something to consider.

Dr Marc Bailey: I am absolutely happy to, but we need to control the uncertainty throughout. We need to understand where the risks are of any such move.

Matt Gantley: Building on what my counterparts here have highlighted, AI has the opportunity and actually the challenge to transform the way in which conformity assessment works right across testing, inspection, certification, validation and verification. Everything that we accredit, everything that goes on, from the food that we eat to the air that we breathe, is tested, inspected or certified in some shape or form. AI in all industries will have a transformational impact.

In order to provide guidance or a framework for conformity assessment bodies that we accredit, in June this year we produced a technical bulletin that set out guidance for how laboratories or inspection and certification bodies should look to develop, test, validate and deploy artificial intelligence in the future.

We also created a body called the AIQI Consortium. We did that with the Testing, Inspection and Certification Council. That is a body of standards development organisations, metrology organisations, policy development organisations and accreditation and conformity assessment bodies working together on creating solutions for conformity assessment. Forensics is just one aspect of that. We have already published a technical bulletin. We are working with our international counterparts. In Germany, they are now translating that into German; that will be produced in English and German so that there is consistency between the UK and Germany on the use of AI for conformity assessment. There will be use cases that go behind it.

We have also produced a series of training materials that are free to access through the UKAS learning management system. We are working through a process of creating an assurance framework, saying, “If you are a regulator or a user of conformity assessment or have a product or service, how do you navigate this landscape of the EU AI Act, the UK regulations and the US regulations?” It will help users understand what form of conformity assessment they need.

It is a huge amount of work, because it is, as I have said, a transformation for all industries and for accreditation and conformity assessment. It will have a particularly huge impact on digital forensics. As I have mentioned already, we will work with the Forensic Science Regulator to produce appropriate guidance and information on how it should be developed, tested, validated and deployed in practice. We want to be pro innovation. We have to make sure we do that in the right way.

Lord Ranger of Northwood: That is great to hear. Coming back to a point you made, Mr Pugh, about the ability for any chief constable to set up a lab with no barriers to entry, maybe the development and deployment of the technology, which I hope will be beneficial, can help both in establishing some quality barriers but also in terms of standardisation.

Q107 Lord Borwick: It is still relatively early on for the FSR’s statutory powers. How do you think we should measure the success of this regime? What are the criteria for failure? What would failure look like?

Dr Marc Bailey: Failure is an interesting question. I suppose failure is going to be a succession of cases that fail due to particular forensic science activity having failed to deliver evidence.

Lord Borwick: Would that be particular or generalised forensic failures?

Dr Marc Bailey: I am about to put forward a general model of what it looks like. In the case of that forensic science activity, that was developed and delivered through the police. The police reviewed it and submitted it to the case. The CPS reviewed it and it still failed in court—not once, but time and time again. That is what a systematic failure looks like.

We would have to address that. As Gary mentioned earlier, the defence plays a key role in understanding that last ditch. I am trying to make sure that we see minimal invalid forensic evidence making it to the criminal justice system in the first place. That would be a view of failure.

We have mentioned success. We have seen the response of police forces to our bringing in compliance and the law in terms of additional training. Gary mentioned 70,000 staff having been trained in digital evidence. We have just re-counted that and it is now 120,000. You can see changes in practice.

If I can pick another example, I would like to raise sexual assault referral centres, referred to as SARCs. A significant part of any sexual assault case is getting the forensic evidence, and this has to be done on a person who has been traumatised and is in a difficult place. There are now 52 of these centres coming into line. They involve huge victim support and collection of evidence that is as compassionate as possible, so as not to add to the grievance and the injury. This has been an unprecedented collaboration between the Forensic Science Regulator and the medical establishment to make sure we have the right standards and the right approach. It has been inspiring.

Q108 Baroness Neville-Jones: Your responses to that question may be relevant to the one I am going to ask you. As you will be aware, the committee, after it has taken all its evidence, will write a report, in which we will be making recommendations to the Government and, most particularly, for the attention of the Home Office and the Ministry of Justice.

If you had the opportunity to make such recommendations, where would you like to put the emphasis? If you would, please address in particular the issues of funding, capacity and equality of arms between defence and prosecution.

My question to each of you is what your top recommendation would be, which would really help push things forward, also bearing in mind the fact that the market is, to some extent, changing with the advent of the digital world. I think you would agree that that is going to take up more and more of the provision needed.

Gary Pugh: If I could just mention some parochial things, in the review I did of the legislation, there are two things I really do want to highlight to you. The first is that, the way the Act is written, the regulation only applies to organisations in England and Wales. An organisation in Scotland, Northern Ireland or anywhere else in the world that undertakes a forensic science activity is outside of the remit of the regulator.

I can understand that I do not regulate Scotland and Northern Ireland. I need to make that very clear, having talked to those Administrations, but the way it is written is perhaps not what was intended. I can think of examples I dealt with where I could not have taken action against individuals who were giving evidence in England and Wales because they were not based in England and Wales. They would have been outside my remit.

The second parochial point is that Crown bodies are exempt from investigation and enforcement. That, interestingly, includes the National Crime Agency as an arm’s-length body of the Home Office and immigration enforcement, both of which are not compliant with the code. Those are two issues to be addressed.

To come to your question of funding and capacity, I will be brief. On funding, my recommendation is that we need to understand it to start with. I have not seen any data on this, certainly in my time and throughout my career. We do not understand what is being spent on forensic science or the investment decisions that are being made.

I would look at capacity—I would say this—by forensic science activity, and I would look at capability and performance as well. The forensic science activity definitions might extend to analysing and looking at forensic science in the round.

Finally, on equality of arms, I will be slightly radical and slightly off the wall. There is a real issue with the defence sector. This is very tongue in cheek, but I wonder whether all of the forensic staff within the police service should be able to work for the defence.

Dr Marc Bailey: I must echo some of Gary’s points.

Gary Pugh: Probably not the last one.

Dr Marc Bailey: No, possibly not the last one, but I particularly echo the concern about the geographic remit of England and Wales.

Baroness Neville-Jones: Do you think it is anomalous? Do you want England and Wales to move in the Scottish direction?

Dr Marc Bailey: No, that was not my point. I was thinking more about digital evidence. Increasingly, as we see the use of AI, we of course see use of the cloud. I would like to make sure it is unambiguous that cloud data, especially held in other geographic regions, is subject to the code, so you are not seeing digital evidence becoming invalid because of that. That would be an extension of the powers. I support the statement on the Crown bodies as well.

I would really encourage the criminal justice system not to move everybody into defence, but to have a much more structured exchange of information. That will enable us to understand how forensic science quality is working, where you need to increase quality, where you have hit the right level and where you have even overextended.

As I have mentioned, I would like more formal recognition of the surveillance powers, such as the visits, so that people are aware that the regulator is not just sitting in London but is there to both support and understand what is going on throughout. I also am interested to see that there has been a public consultation launched on biometrics, which is an interesting area, highly important to policing.

There are discussions there about the alignment of forensic science with other regulators. I absolutely endorse the need for consultation and making sure that biometrics are used appropriately. I just hope that it does not inadvertently damage the progress we have made to date on building the forensic science regulatory system.

Matt Gantley: I would set out three key areas of recommendations for the future, particularly as it relates to accreditation and compliance with the code.

The first is about earlier intervention into the process, supporting those forensic science providers to go through that journey towards accreditation and through the process of code compliance. That is focused on a series of milestones, supported with relevant best practice, with support from relevant webinars and self-evaluation tools. There should be a whole suite of tools there to support the forensic science provider, whether they are small or large, to reach compliance as soon as possible.

The second is a distinct and very clear requirement to achieve compliance, whether that is through the declarations given as part of the criminal prosecution system or through a clear commitment to code compliance and reaching accreditation. In this way, the process can be properly managed in terms of resources.

The last is about continuing on the process of a continual improvement culture. That comes from, as Gary has already said, ensuring there is a clear understanding of data and clear KPIs on success in managing risk, as well as a process of quality incidents being reported up and escalated at the earliest possible opportunity, so we can analyse and understand where the key issues are. That is particularly important in emerging areas of digital forensics or newly developed areas, such as sexual assault referral centres.

The Chair: Thank you very much indeed for coming and answering all of the questions. You have raised some interesting issues, right up to and including the end. We would like to thank you very much indeed for joining us today. You have set us up very nicely for what will be our next public session with Ministers from both the Home Office and the Ministry of Justice. For now, that concludes the session of the committee.

[1] Note by witness - The session was held 57 years after the Medicines Act 1968 was passed, the figure of 30 years is inaccurate.

[2] Note by witness - Version 2 of the code supports 36 FSA, it was 34 in the first version. The correct terminolgy is “subject to the code”.