2 - What the System Built After Randox
The forensic science system in England and Wales was caught off guard. It responded. This is what it built.
Previously, I set out what happened at Randox Testing Services. Staff allegedly manipulated calibration data. Results were provided to the criminal justice system when they should not have been. Approximately 10,000 cases were affected. The manipulation was invisible to reporting officers, invisible to UKAS assessors, and invisible to peer reviewers. The only person who caught it was a defence expert doing what defence experts are supposed to do: looking at the actual data behind the report.
The Immediate Response
The Regulator did not wait for the criminal investigation to conclude. Dr Gillian Tully, the Forensic Science Regulator at the time, moved quickly. Every major forensic science supplier to the criminal justice system was asked to review their practices and safeguards against the potential for malpractice. Every major forensic toxicology provider was asked to conduct a detailed audit of a random selection of cases.
In her 2017 annual report1, the Regulator reported the outcome:
“The results from all of these audits were reported to the Regulator and no data manipulation was found. Clearly each audit was only a small sample of the overall number of samples processed, so if data manipulation is occurring in a small minority of cases, such audits would be unlikely to detect it. However, if data manipulation is occurring at an appreciable level, it would be likely to have been uncovered during this exercise.”
No data manipulation was found elsewhere.
UKAS conducted its own internal review. All 20 accredited toxicology laboratories were included. Detailed procedures and validation data were requested from each. The results were evaluated by technical assessors and scrutinised by an independent specialist.2
The most significant operational change was the introduction of vertical audits. Before Randox, UKAS assessments typically witnessed a range of laboratory activities across the process. After Randox, they increased the emphasis on following individual cases from raw data through to final report. The Regulator explained why:
“Vertical audit is more likely to uncover evidence of inappropriate data manipulation than is witnessing of a range of laboratory activities.”
The Structural Response
The deeper question was whether the regulatory framework itself was protecting the criminal justice system from harm. The answer, clearly, was no.
Before Randox, the Forensic Science Regulator existed in a curious position. Appointed by the Home Office. Respected across the sector. But ultimately toothless. The Regulator issued Codes of Practice and Conduct3 and forensic units could include compliance with those codes on their UKAS schedule of accreditation. Many did. But the codes were non-statutory. The Regulator had no power to compel compliance. No power to issue notices. No power to sanction.
By November 2017, twelve police forces in England and Wales had failed to meet the accreditation deadline for digital forensics. Several small providers had made no plans to pursue accreditation at all, openly citing the absence of statutory powers.
The Regulator’s 2017 annual report was pretty clear:
“Without statutory powers to enforce compliance, the Regulator cannot guarantee that all science being used in the CJS is being carried out to the required quality standards.”
The Regulator and others had been calling for statutory powers for years. But Randox gave the argument an urgency it had previously lacked. When 10,000 cases are affected and 90 convictions are overturned, the case for voluntary compliance becomes difficult to sustain.
What followed was the Forensic Science Regulator Act 20214. It received Royal Assent on 29 April 2021, though its key provisions came into force in stages over the following two years.5 6 In summary, the Act placed the Regulator on a statutory basis, required the publication of a statutory Code of Practice, and gave the Regulator powers to investigate and enforce compliance. For the first time, the Regulator could issue compliance notices requiring forensic units to take specific steps, and could prohibit them from carrying on forensic science activities altogether until satisfied those steps had been taken.
The statutory Code of Practice7 came into force on 2 October 2023. It defined 51 forensic science activities, of which 34 were immediately subject to the Code. For every activity subject to the Code, forensic units were required to comply with detailed quality management requirements, achieve and maintain UKAS accreditation, and include compliance with the Code on their schedule of accreditation.
The system that had been caught off guard by Randox now was looking stronger in the aftermath.
Timeline: Forensic Science Regulation in England and Wales, 2017–2025
What the Regulator could do, and what forensic units were required to do, at each stage.
January 2017 — Randox Testing Services self-refers to the Forensic Science Regulator and Greater Manchester Police. The Regulator initiates a sector-wide review. UKAS begins an internal review of all 20 accredited toxicology laboratories. Vertical audits are introduced.
October 2017 — New requirement for forensic science providers to demonstrate compliance with the Regulator’s non-statutory Codes of Practice and Conduct through the UKAS accreditation process. The Codes include a notification obligation at section 14.1.2: forensic units must inform the Regulator about any non-conforming work that could attract adverse public comment, be against the public interest, or lead to a miscarriage of justice. The Regulator has no statutory powers. Compliance is voluntary.
29 April 2021 — The Forensic Science Regulator Act 2021 receives Royal Assent. The Act provides for a statutory Regulator, a statutory Code of Practice, and enforcement powers including compliance notices and the ability to prohibit forensic science activities. However, none of these provisions are yet in force. They require commencement regulations, which will come in stages. The non-statutory codes remain the only reference point for compliance. The Regulator still has no enforcement powers.
25 July 2022 — Commencement No. 1. Sections 1, 2–4, 5, and 9 of the Act come into force. The Regulator now exists as a statutory body. The Regulator can publish a statutory Code of Practice. The Regulator can investigate concerns about forensic science activities. But sections 6, 7, and 8, the enforcement powers, are not yet commenced. The Regulator can investigate but cannot compel. The non-statutory codes are still the reference point for what compliance means.
March 2023 — The statutory Code of Practice, Version 1, is published. It defines 51 forensic science activities. It sets out mandatory requirements for quality management, UKAS accreditation, and compliance declarations. It includes a new notification obligation at section 37.3.1: forensic units must promptly report to the Regulator any suspension, withdrawal, or change in their accreditation status where that change means the unit is no longer compliant with the Code. The Code is published but not yet in force.
2 October 2023 — Everything changes. Commencement No. 2 brings the statutory Code of Practice into force. Sections 6, 7, and 8 of the Act are commenced. The Regulator can now issue compliance notices, prohibit forensic science activities, and pursue enforcement through the courts. 34 of the 51 defined forensic science activities are immediately subject to the Code. For every activity subject to the Code, forensic units must hold UKAS accreditation and include compliance with the Code on their schedule of accreditation. The notification obligation at section 37.3.1 is now mandatory and enforceable. Any forensic unit that has lost, suspended, or withdrawn accredited capability for a covered activity must notify the Regulator promptly.
2 October 2023 (also) — The Criminal Practice Directions 2023 require practitioners to declare compliance or non-compliance with the Code in their expert reports. Non-compliance declarations must include details of mitigations. From this date, every expert report produced by a forensic unit without UKAS accreditation for the relevant activity should contain a non-compliance declaration visible to the court, prosecution, and defence.
August 2024 — The Regulator publishes guidance on declarations of compliance and non-compliance. It confirms the notification obligation and adds that if a forensic unit experiences a change in accreditation status after providing reports for a case, the practitioner must notify the commissioning party immediately and confirm in writing if the existing statement or report requires any correction or qualification.
2025 — The Code is updated to Version 2. The notification obligation moves to section 8.3.1 and is strengthened. It now explicitly covers the accreditation status of any external forensic unit sub-contracted to provide forensic science activities. Section 8.3.2 adds detailed requirements: identify all affected cases, consider whether the reason for the change applied to completed cases, and report to the Regulator setting out the basis, reasons, actions taken, and impact on statements or reports already issued.
The obligation that exists throughout this entire timeline
Section 3 of the Criminal Procedure and Investigations Act 1996 requires the prosecution to disclose material that might reasonably be considered capable of undermining the prosecution case or assisting the defence. This is a continuing duty. It does not depend on the Forensic Science Regulator Act. It does not depend on the statutory Code. It does not depend on UKAS accreditation. It applies to every criminal case, at every point on this timeline. The accreditation status of the forensic unit that produced the evidence is material the defence is entitled to know about.
The Three Obligations
The post-Randox reforms created a framework with three distinct obligations that apply when something goes wrong with a forensic unit’s accreditation or quality. Understanding these matters, because they define what should happen. They are the benchmark.
The forensic unit must tell the Regulator
The statutory Code of Practice8, requires forensic units to promptly report to the Regulator any suspension, withdrawal, or change in their accreditation status where that change means the unit is no longer compliant with the Code.
That is a mandatory obligation. It covers any change in accreditation status that affects compliance. If a forensic unit loses accreditation for a forensic science activity covered by the Code, the Regulator must be told.
It is worth noting that even before the statutory Code, there was a notification obligation. The non-statutory codes, at section 14.1.2, required that:
The Regulator shall be informed at the earliest opportunity about any complaint or non-conforming testing/inspection if it has significantly disaffected the customer such that it could attract adverse public comment, be against the public interest or lead to a miscarriage of justice. The policies and procedures relating to complaints shall also indicate the escalation criteria and the individual/role holder responsible for notifying the Regulator.
That threshold matters. It covered anything that could attract adverse public comment, be against the public interest, or lead to a miscarriage of justice. A forensic unit losing accredited capability for an entire forensic science activity, for an extended period, would on any reasonable reading, meet that test IMO. Cases would be affected. Defendants’ rights would be engaged. The public interest is obvious.
The court and the defence must be told
The Criminal Practice Directions 20239 require practitioners to declare compliance or non-compliance with the Code in their reports. Any declaration of non-compliance must include details of mitigations. From 2 October 2023, every expert report produced by a forensic unit without UKAS accreditation for the relevant activity should contain a non-compliance declaration. That declaration is visible to the court, the prosecution, and the defence. If it is absent, someone should notice.
Unused material must be disclosed
This obligation exists independently of the Code. Under section 3 of the Criminal Procedure and Investigations Act 199610, the prosecution has a continuing duty to disclose material that might reasonably be considered capable of undermining the prosecution case or assisting the defence. The accreditation status of the forensic unit that produced the evidence is capable of doing both.
As the CPS’s own legal guidance on the FSR Code states11, non-compliant forensic evidence “will need to be carefully considered to ensure that it is reliable enough to be placed before the courts.” A police force that knows its forensic unit lacks accreditation for a particular activity and continues to commission and rely on that work without disclosing the accreditation gap is sitting on material that the defence is entitled to know about.
That is a potential disclosure failure. Disclosure failures, particularly those associated with forensic evidence, have a long and unhappy history in the criminal justice system.
In August 2024, the Regulator published guidance on declarations of compliance and non-compliance with the Code12. It confirmed at paragraph 4.10.1 that the obligation to report accreditation changes to the Regulator applied to any suspension, withdrawal, or change that meant the practitioner was no longer compliant. It also confirmed that if a forensic unit experienced a change in accreditation status after providing reports for a case, the practitioner was obliged to notify the commissioning party immediately and confirm in writing if the existing statement or report required any correction or qualification. That obligation comes from the Criminal Practice Directions, not from the Code itself, and it applies regardless of the reason for the accreditation change.
In practice, these three obligations create a chain. The unit tells the Regulator. The reports tell the court. The prosecution tells the defence. Break any link and the system fails.
The Standard
The Regulator investigated. UKAS changed its assessment approach. The sector was audited. Parliament legislated. Statutory powers were granted. A Code of Practice with mandatory notification obligations was put in place. The whole framework was rebuilt on the principle that when something goes wrong in forensic science, the people who need to know are told: the Regulator, the courts, and the defence.
That response set a benchmark. It showed what the system is capable of when it chooses to act.
The question is whether anyone followed those rules when the next problem came along. Because Randox was not the last time something went wrong in forensic toxicology in England and Wales.
This post was researched with the assistance of NotebookLM.
FSR Codes of Practice and Conduct, Version 7 (non-statutory), section 14.1.2