#1380 DGFS level 7 - for development? change request resolved

this is a placeholder CR to note that there are more senior Digital Forensics skills that provide an external commentary, policy making or expert witness role. How does SFIA show this? Does another skill cover it and need adjustment?

Copied from SFIA 9. See there for any old comments.

Proposed change applies to Digital forensics

Current status of this request: resolved

Evaluating this request

Nothing in SFIA’s generic attributes prevents an externally focused expert-witness responsibility from being performed at Level 5 or Level 6.

The generic attributes distinguish levels primarily by the nature, scope and organisational impact of the responsibility, not by whether the audience is internal or external.

SFIA 9 defines DGFS from Levels 2 to 6. Its existing scope already includes:

• legally defensible forensic reporting
• presenting evidence and testifying as an expert witness
• developing forensic methods for emerging technologies
• ensuring legal and ethical compliance
• supporting criminal, fraud, security and counterintelligence investigations.

The current levels also provide substantial senior coverage:

• Level 5 leads investigations, presents findings to business and legal audiences, provides expert advice and contributes to policies, standards and guidelines.
• Level 6 leads the organisation’s approach, sets policies and standards, leads high-risk or wide-ranging investigations, authorises formal reports and engages external stakeholders.

What we decided

"An expert witness, particularly in common law countries such as the United Kingdom, Australia, and the United States, is a person whose opinion by virtue of education, training, certification, skills or experience, is accepted by the judge as an expert. The judge may consider the witness's specialized (scientific, technical or other) opinion about evidence or about facts before the court within the expert's area of expertise, to be referred to as an "expert opinion". Expert witnesses may also deliver "expert evidence" within the area of their expertise. Their testimony may be rebutted by testimony from other experts or by other evidence or facts. "

Source https://en.wikipedia.org/wiki/Expert_witness

Level 5

Level 5 is particularly well aligned with a practising senior expert witness.

Attribute	Relevance to expert-witness work
Autonomy	Work is self-initiated under broad direction, supporting responsibility for conducting analysis and forming a professional opinion.
Influence	Influences critical decisions within the domain and explicitly has operational-level contact with external contacts.
Complexity	Performs an extensive range of complex professional activities in unpredictable contexts.
Knowledge	Applies in-depth expertise to interpret complex situations and offer authoritative advice.
Communication	Articulates complex information to broad audiences with different viewpoints.
Decision-making	Uses professional judgement to make informed decisions and identify when objectives or outcomes are at risk.
Problem-solving	Investigates complex issues, identifies causes and impacts and evaluates possible conclusions with other experts.

The combination of authoritative advice, in-depth domain expertise, unpredictable contexts, external contact and communication to audiences with different viewpoints describes the central characteristics of expert-witness work very well. The Influence attribute expressly includes external contacts at Level 5.

A Level 5 digital-forensics expert could therefore:

• conduct or lead the forensic examination
• reach an independent professional opinion
• prepare a legally defensible report
• explain technical findings to lawyers, courts or tribunals
• withstand professional challenge and cross-examination
• advise on the implications of the evidence.

None of those activities requires organisational strategy or executive accountability.

Level 6

Level 6 supports expert-witness responsibilities with still wider authority and impact.

Attribute	Relevance to expert-witness work
Autonomy	Holds defined authority and accountability for decisions within a significant area of work.
Influence	Has significant management-level contact with external contacts and influences strategy and business plans.
Complexity	Performs highly complex work covering technical, financial and quality considerations.
Knowledge	Applies broad business knowledge to strategic leadership and cross-domain decision-making.
Communication	Communicates credibly to broad audiences with divergent objectives and explains complex matters clearly.
Collaboration	Builds influential relationships with senior internal and external contacts.
Leadership	Provides organisational-level leadership and contributes to policy and strategy.

This would support, for example:

• acting as the authoritative forensic expert in exceptionally complex or high-consequence proceedings
• overseeing the quality and professional integrity of forensic evidence
• authorising reports produced by a forensic function
• advising courts, regulators, law-enforcement bodies or government departments
• representing the organisation in professional or regulatory forums
• influencing forensic policy, standards or recognised practice
• coordinating evidence and expert contributions across several specialist disciplines.

Again, external focus is explicitly supported. At Level 6, Influence includes significant management-level contact with external parties, while Collaboration includes influential connections with external contacts at senior management or technical-leader level.