Arsenly_OSINTby XowiaLabs

Appendix B. Structured Analytic Techniques (SATs)

Reference

Structured Analytic Techniques are mental tools to reduce analytical biases and produce more defensible conclusions. Popularised by Richards Heuer Jr. (Psychology of Intelligence Analysis, 1999) and by Heuer & Pherson (Structured Analytic Techniques for Intelligence Analysis, 3rd ed. 2020, CQ Press). These techniques are in the public domain of professional analytical literature — they are not attributed to specific agencies.

B.1 ACH (Analysis of Competing Hypotheses)

What it is: Systematic method to evaluate multiple explanatory hypotheses against the same set of evidence, instead of seeking evidence for the preferred hypothesis. Combats confirmation bias.

When to use: When analysis has high consequences (strategic decisions, judicial conclusions, public conclusions that damage reputations) and multiple plausible hypotheses compete.

The 8 steps:

  1. List all plausible hypotheses (3-7) without premature discard. Force inclusion of 1-2 "unlikely" ones to avoid tunnel vision.
  2. List all significant evidence (facts, not inferences) + arguments.
  3. Build a hypothesis × evidence matrix. Rows = evidence. Columns = hypotheses.
  4. For each cell, evaluate consistency: + consistent · inconsistent · ? indeterminate. Crucial: evaluate whether the evidence is INCONSISTENT with the hypothesis, not whether it supports it. This inversion breaks confirmation bias.
  5. Refine the matrix: remove evidence that does not discriminate between hypotheses.
  6. Compute the "inconsistency score" per hypothesis. The hypothesis with FEWER inconsistencies is the most robust (NOT the most consistent).
  7. Analyse sensitivity: "What evidence, if false, would change the conclusion?"
  8. Report with uncertainty: do not eliminate alternative hypotheses, report them with their relative probabilities.

Minimum ACH template:

              | H1: fraud   | H2: error     | H3: external
              | intentional | accounting    | malicious
--------------|-------------|---------------|------------
E1: balancing |    −        |     +         |    ?
E2: timing    |    +        |     −         |    +
E3: motive    |    +        |     ?         |    +
E4: auditor   |    +        |     +         |    −
E5: access    |    +        |     +         |    −
--------------|-------------|---------------|------------
# Inconsistencies | 1       |     2         |    2
Conclusion:   | H1 most robust (fewest inconsistencies);
              | H3 plausible if E4 (auditor) breaks

B.2 Key Assumptions Check

What it is: Explicit identification of the unverified assumptions on which an analysis rests. Combats anchoring bias.

When to use: At the start of any non-trivial analysis. Prerequisite for ACH and Devil's Advocacy.

# Assumption Why I assumed it Source/Evidence If false, impact on conclusion Action to verify
1 "Entity X is still active" Listed in registry 6 months ago Last query Change of main hypothesis Re-query today
2 "Identified UBO is correct" Listing in PSC Register Companies House Lower confidence overall Cross-check ICIJ + adverse media
3 "Applicable sanctions are EU" Client in EU Contract Re-evaluate with OFAC/UK Confirm with client

Rules: minimum 5-8 assumptions per analysis · assign confidence High/Medium/Low · if ≥2 assumptions are "Low", the overall conclusion cannot be "High Confidence" · review at the end of the analysis.

B.3 Devil's Advocacy

What it is: Designating a person (or role) to systematically criticise the dominant conclusion. Combats groupthink and premature closure.

How to implement individually:

  1. Assume the role explicitly. Write "Devil's Advocacy exercise" in the document.
  2. Identify 3-5 weak points in your own argument. Questions: What evidence do I NOT have? What alternative conclusion would explain the same data? What fails if my main source lied?
  3. Build the best possible counter-argument. Not a strawman — a strong argument that an intelligent critic would build. If you cannot build it, you do not understand the case well enough.
  4. Honestly evaluate whether the counter-argument has merit. Modify conclusion or confidence if it does.
  5. Document in the deliverable: "Devil's Advocacy applied; alternative hypothesis X considered and rejected for Y / accepted partially, adjusting confidence from High to Moderate".

Traps: If it NEVER changes the conclusion, you are doing it wrong · Do not just aim at minor flaws, aim at the pillars.

B.4 Indicators & Warnings (I&W)

What it is: Monitoring system that defines in advance what observable signals would indicate a scenario is materialising. Enables early detection.

When to use: Continuous surveillance of scenarios (sanctions, internal fraud, geopolitical conflict, competitor reputational crisis).

SCENARIO MONITORED: "Entity X is sanctioned by OFAC within next 6 months"
INITIAL CONFIDENCE: Low (no active indicators)
MONITORING OWNER: [analyst]
REVIEW FREQUENCY: weekly

INDICATORS (in increasing specificity order):

Level 1 — Background indicators (long duration, low specificity):
  [ ] Entity X appears in quality adverse media ≥3 times in 30 days
  [ ] Entity X's main jurisdiction added to FATF grey list
  [ ] Close commercial partner of Entity X designated by OFAC

Level 2 — Tactical indicators (medium specificity, weeks):
  [ ] Entity X changes auditor or correspondent bank without public reason
  [ ] Entity X transfers assets to risk jurisdiction (RUS, IRN, PRK)
  [ ] Civil litigation filed against Entity X in extraterritorial jurisdiction

Level 3 — Strategic indicators (high specificity, days):
  [ ] US State Department issues statement mentioning Entity X
  [ ] OFAC publishes sector-specific guidance
  [ ] US Congress introduces legislation naming Entity X

ACTIVATION MATRIX:
  - 1 Level 1 indicator → re-evaluate Low→Moderate, daily monitoring
  - 2+ Level 1 or 1 Level 2 → Moderate→High, deep DD
  - 1 Level 3 → High confidence of imminent designation; activate contingency plan

Principles: Indicators must be observable · Activation matrix defined BEFORE any indicator occurs · System has value only if reviewed at the committed frequency.