4 Who Is Responsible?
One schedule, two organisations, no answer.
This is the fourth post in a series examining whether the forensic science system in England and Wales responds consistently when things go wrong. Previous posts examined the Randox case, the notification obligations it created, and the response to failures at private providers.
It was a job advert that prompted this. Late October 2021, during the pandemic, when the forensic landscape was shifting, I had been taking stock of who was doing what and where in forensic science in England and Wales. Ever since the Forensic Science Service closed, the complex mix of private providers and in-house police laboratories was well known. I was trying to understand the extent of that different provision. But then up popped a job advert for a Technical Officer in Toxicology, posted by Hampshire County Council, it revealed a previously unknown (to me at least) third category, a partnership between two independent public sector bodies.
The advert described Hampshire Scientific Service as a “ground-breaking partnership” between Hampshire County Council and Hampshire Constabulary, providing forensic scientific expertise for public health and criminal enforcement in Hampshire.
It raised a straightforward question. What kind of partnership, and what was its legal structure? A forensic laboratory providing services to the criminal justice system must, under ISO/IEC 17025:2017 — the international standard for testing and calibration laboratories — be a legal entity, or explicitly part of one, responsible for its activities1. The usual web searches revealed little detail concerning the partnership.
I submitted a Freedom of Information request to Hampshire County Council on 30 October 2021. Three questions: what is the legal status of this partnership? Is it registered at Companies House? Have the council and the constabulary formed a new legal entity?
The response arrived on 21 December 2021. Hampshire County Council and Hampshire Constabulary Scientific Service departments, it said, work together under a shared service agreement with a Memorandum of Understanding first agreed and signed in 2011.
No legal entity. No Companies House registration. A Memorandum of Understanding from 2011.
The first response confirmed the MOU but did not answer the question about legal status directly. I sought further clarification. The response arrived on 23 March 2022.
The Hampshire Scientific Services partnership, it said, is between two public sector organisations and is therefore not registered on Companies House. The partnership is hosted by Hampshire County Council. There is a joint management board that has overall responsibility for all of the activities undertaken by the partnership. External work is billed by Hampshire County Council as the partnership host.
A copy of the MOU was attached, and they confirmed to me that it was the current version as of 2022. It’s 18 pages long, I won’t attach them all, but to give a flavour:
Reading it, the first thing to note is the cover page. The words “Memorandum of Agreement” have been crossed out by hand and replaced with “Understanding (MOU).” The distinction matters. An agreement implies obligations. An understanding does not. That correction was reinforced in the body of the document itself, where a handwritten addition to the recitals states plainly: “This MoU is not intended to produce a contractual agreement.”
The second thing to note is who signed it. The MOU was made between Hampshire County Council and Hampshire Police Authority. Hampshire Police Authority was abolished in November 2012, when Police and Crime Commissioners replaced police authorities across England and Wales under the Police Reform and Social Responsibility Act 2011. One of only two parties to the only document defining this arrangement ceased to exist eighteen months after it was signed. The document was never updated to reflect this.
The MOU had a five year term from 1 April 2011, with a maximum five year extension.Even if it was extended, and I have seen no evidence that it was, it would have expired in April 2021. The second FOI response, in March 2022, confirmed that the 2011 MOU was the only one relied upon.
The document that defined the legal structure of an accredited forensic science provider — a provider delivering toxicology results to criminal courts — was a non-contractual understanding, signed by a body that no longer existed, potentially expired, and never revised to account for any of the significant changes to the organisation’s activities in the decade that followed.
Clause 5.1 of ISO/IEC 17025:2017 states: “The laboratory shall be a legal entity, or a defined part of a legal entity, that is legally responsible for its laboratory activities.”
Not a shared service agreement. A legal entity, or a defined part of one, legally responsible. The MOU, by its own terms, was not a contractual agreement. It created no legal entity. It defined no legal responsibility. What it did do, in its Schedule of Standards of Service, was place the UKAS accreditation obligation on one party specifically. “Hampshire County Council Scientific Service will,” it stated, “maintain UKAS accreditation as required by the applicable regulators.”
But the work being done under that accreditation was not solely Hampshire County Council’s work. The MOU established an integrated team drawing staff from both organisations. The Management Board — with overall responsibility for all activities, according to the FOI response — comprised four members: Hampshire Police Head of Science, Hampshire Police Director of Finance, Hampshire County Council Director of Culture Communities and Business Services, and Hampshire County Council Head of Scientific Services. Two organisations. Four individuals. Shared responsibility, by design.
ISO/IEC 17025 does not accommodate shared responsibility of this kind. It requires a defined legal entity that is legally responsible. A legal entity that can be held to account.
The question the MOU’s structure could not answer was a simple one. If something went wrong with the accredited activities of Hampshire Scientific Services — if a question arose about who was responsible, who should be notified, who bore the obligation — was it the Council? Was it the Constabulary? Was it both? Without a proper legal entity to point to, it could, in practice, be neither. It is precisely the kind of ambiguity that an international standard for laboratory accreditation exists to prevent.
On 24 March 2022 I wrote to both UKAS and the Office of the Forensic Science Regulator. I attached the MOU, both FOI responses, and confirmation from Hampshire County Council that the 2011 MOU was the only one relied upon.
There did not appear to be an appropriately structured legal entity in place that could safely control the activities on HSS’s UKAS accreditation schedule. Without one, it was not clear who was responsible for those activities. I noted that the MOU on which the arrangement relied had potentially expired in 2021, and that in any case it had not been revised to account for significant changes to the organisation’s activities since 2011 — including the extension of the UKAS schedule to cover fingerprints and digital forensics, activities that appeared to involve Hampshire Constabulary staff, on Constabulary premises, using Constabulary email addresses, operating under HSS accreditation schedule. This is part of what I wrote:
On the face of it, this appears to be two organisations under one schedule, one of whom is piggybacking onto another’s accreditation without the legal safeguards and responsibilities typically associated with a single legal entity who is responsible for all quality matters on its schedule as required under section 5 of the standard. If allowed to continue, this sets a most unwelcome precedent where any organisation, public or private could exploit this apparent loophole to do the same…
This situation is exceptional. No other police force as far as I am aware has taken this route to accreditation, when it comes to fingerprints and/or digital, the Chief Constable is the named legal entity for police forces, and quite rightly so. At present I don’t understand who is responsible for the quality of all of the forensic activities: fingerprints, digital and toxicology in Hampshire. Is it the council? Is it the police? Is it both? Without a proper legal entity defining it could be neither and that is too much of a risk for the CJS, I’m sure you’d agree.
Neither UKAS nor the Office of the Forensic Science Regulator responded.
In October 2023, the Forensic Science Regulator’s statutory Code of Practice came into force. Among its requirements is one that did not exist when Hampshire Scientific Services held its UKAS accreditation in 2021: the Senior Accountable Individual2.
Gary Pugh, the Forensic Regulator at the time, told the House of Lords this:
“I introduced into the code a requirement for there to be a senior accountable individual reflecting that accountability for a system rather than the very important individual responsibilities that forensic practitioners have in the criminal justice system, and particularly those who give expert evidence. A senior accountable individual must be effective and committed to the leadership of a quality culture in an organisation and be accountable for the strategic leadership or the unit’s compliance with the code, and for risks related to FSAs. That is, broadly, in terms of change, what is in the code.”
Crucially, in UKAS assessments post 2023, UKAS lay out precisely what they expect:
The requirement exists because the system needs to know, at any given moment, who is responsible.
Now apply that question to the HSS governance structure as it existed according to the MOU being relied on in 2021/22. Under that structure, who would the SAI have been? Which of the four Management Board members would have been named to the Regulator as the individual personally accountable for compliance? Which organisation — the Council or the Constabulary — would have carried that responsibility?
The MOU cannot answer those questions. The SAI requirement was created, in part, because the system had clearly encountered arrangements where accountability was diffuse and the answer to “who is responsible?” was genuinely unclear. Whether HSS was one of the cases that informed that thinking, I cannot say. What I can say is that its governance structure illustrates precisely the problem the requirement was designed to solve.
The arrangement between Hampshire County Council and Hampshire Constabulary, as far as I am aware, continues. Two organisations. One UKAS schedule. 3
If an employee of the council acts like the employees of Randox allegedly acted, can an SAI, if they are an employee of the police, take action on those council employees, or vice-versa? I do not know how on earth this hybrid structure fulfills these requirements.
What I did not know in 2021/22, when I was investigating the governance structure of Hampshire Scientific Services was that at that precise moment, HSS was on the brink of losing its accreditation for S5A Detection and quantitation of drugs in relation to s5A of the Road Traffic Act 1988.
ISO/IEC 17025:2017, Clause 5.1 — Structural Requirements: Legal Entity Exact text confirmed via multiple accreditation body publications. See: https://www.pjlabs.com/downloads/webinar_slides/12.30.2021_Structural-Requirements.pdf
