Incident Investigation

5 myths about incident memory investigators still believe

Incident memory is not a transcript. Use 5 myths and a 24 to 72 hour workflow to keep investigations tied to evidence, not first impressions.

By 4 min read
investigative scene on 5 myths about incident memory investigators still believe — 5 myths about incident memory investigator

Key takeaways

  1. 01Incident memory is reconstruction, so the first story should never be treated as the final record.
  2. 02Confidence and accuracy are different, especially after pressure, noise, or fear enters the scene.
  3. 03Separate interviews within 24 hours preserve useful variation before the story hardens.
  4. 04Photos, notes, and statements still need chain of custody if the file is going to survive challenge.
  5. 05Close the case only after the timeline, the evidence, and the correction owner are verified.

Incident memory is not a recording. It is a reconstruction built from attention, stress, sequence, and later prompts, which is why the first version of an event can sound complete and still miss the control failure that mattered most.

Across 25+ years in multinational EHS and more than 250 cultural transformation projects, Andreza Araujo has seen teams lose detail the moment they start retelling the event instead of mapping it. That is why the first responsibility in an investigation is not to admire memory, but to protect evidence before the story hardens.

Why incident memory matters before the story hardens

James Reason helps here because latent conditions shape what people notice, remember, and leave out. Daniel Kahneman helps for the same reason, because confidence and accuracy do not move together once pressure, interruption, or fear enters the room.

If the team wants a clean answer in the first 24 hours, it will usually get a comforting one. The better question is not what the witness remembers first, but what the field can still prove in 24, 48, and 72 hours.

That is why memory should sit beside an incident evidence map, not above it. When recollection and evidence disagree, the file should follow the evidence path first and treat memory as one input, not the final record.

Myth 1: Memory is a transcript

This myth sounds reasonable because people describe what happened as if they are replaying a file. They are not. Memory stores fragments, then the brain rebuilds the sequence when someone asks a question, especially after a noisy or emotional event.

That is why the first interview should anchor place, time, sequence, and control state, not chase a perfect narrative. The investigator needs a timeline that can survive the next witness, not a polished paragraph that only one person can defend.

Use the evidence map first, because a good map shows what still needs to be verified and which memory fragments should be treated as provisional.

Myth 2: Confidence equals accuracy

A confident witness feels safer to trust, which is exactly why this myth survives. Confidence rises when a person has repeated the story, heard other accounts, or filled gaps with plausible detail, even if the original observation was thin.

The fix is uncomfortable but simple: separate how certain the person feels from what was actually seen. In a serious-incident interview plan, the interviewer should ask for observable facts first and interpretation second, because the two are not the same thing.

Daniel Kahneman's work on judgment is useful here because it reminds investigators that fluency can look like truth. The witness who speaks smoothly may still be missing the one detail that changes the control story.

Myth 3: One interview is enough

One interview is rarely enough because no single person sees the whole chain. The operator sees the task, the supervisor sees the schedule, and the maintenance tech sees the condition that was already drifting before the event became visible.

Across 250+ projects, Andreza Araujo has seen the second and third witness add the control failure that the first account missed. Separate interviews within 24 hours preserve variation instead of collapsing it into one polished paragraph that feels complete but leaves out the gap that matters.

James Reason's latent-condition lens helps again, because the event usually lives in the space between what one person noticed and what the organization failed to keep visible. The file gets stronger when those different views are held apart before they are combined.

Myth 4: Photos and notes are objective

Photos look objective because they freeze one angle and one second. Notes look objective because they are written down. Neither one tells you what changed before the image, what was out of frame, or which step happened after the camera moved.

That is why incident chain of custody matters. If the file cannot show when evidence was captured, by whom, and under which conditions, the investigation is leaning on a story rather than a record.

A note can be honest and still incomplete, and a photo can be sharp while missing the control that failed one step earlier. The discipline is not to distrust the evidence, but to ask what the evidence can prove and what it cannot prove.

Myth 5: Fast closure protects the organization

Fast closure often protects the calendar, not the organization. It lets the team move on before the weak point in the sequence has been verified, which is why the same problem can reappear on the next shift while the report still looks neat.

In more than 25 years of EHS work and 30+ countries of exposure, Andreza Araujo has seen that speed without verification rewards tidy paperwork and weak learning. The safer move is to hold the file open long enough to test the finding, then close it with a decision owner and a correction date.

If the next question becomes who to blame, read Root-Cause "What, Not Who" first. The better investigation keeps the focus on what failed, where the proof sits, and which control needs repair before the next exposure.

What to do now

A practical incident workflow can stay simple: stabilize the evidence in the first 24 hours, run separate interviews in the next 24 to 48 hours, and verify the timeline before the 72-hour mark. That sequence respects memory limits without turning the case into bureaucracy.

Test What it answers Time window
Evidence map What can still be verified First 24 hours
Separate interviews What each witness actually saw 24 to 48 hours
Chain of custody What was captured, by whom, and when First 48 hours
Timeline review Which control failed first Before 72 hours

From there, move the case into corrective-action triage if the control gap is still active. If it is not active, verify the finding again before you close it, because a story that feels finished is not the same thing as a file that can survive challenge.

The point is not to slow every case forever. The point is to give memory a proper job, which is to help reconstruct the event while evidence carries the burden of proof.

If your team wants the next step after this article, start with the evidence map, then the interview plan, and keep the narrative open until the control failure is clear.

Topics incident-investigation memory witness-interviews evidence root-cause-analysis headline-podcast

Frequently asked questions

What is incident memory in an investigation?
Incident memory is the reconstructed account a witness gives after an event. It helps investigators, but it is not a recording, so it should be checked against the evidence map, the timeline, and the control state.
Why can a confident witness still be wrong?
Confidence rises when a person repeats the story or fills gaps with plausible detail. That does not prove accuracy, which is why investigators should ask for observable facts before interpretation.
How many interviews are enough?
Usually more than one. Different people see different pieces of the event, and separate interviews within 24 to 48 hours help preserve those differences before the narrative collapses into a single version.
What should be verified first after an incident?
The evidence map should come first, because it shows what can still be checked in the field. After that, the interviewer can test the timeline, the witness accounts, and the chain of custody.
When should the case be closed?
Only after the timeline, the evidence, and the correction owner are verified. If the control gap still looks active, the file should stay open until the next review can prove the finding.

About the author

Andreza Araújo

Safety Culture Expert | Senior EHS Executive

Andreza Araújo is a safety culture expert and senior EHS executive with more than 25 years of experience in environment, health and safety. She is a Civil Engineer and Occupational Safety Engineer from Unicamp, holds a Master's degree in Environmental Diplomacy from the University of Geneva, and completed sustainability studies at IMD Switzerland. Andreza has served in Global Head of EHS roles in Fortune 500 environments, leading cultural transformation programs across multinational operations. She has represented Brazil as a speaker at the United Nations in Paris and has spoken at the International Labour Organization in Turin. She is the author of more than 16 books on safety culture in Portuguese, Spanish, English and German. Her work has earned more than 10 EHS awards, including two recognitions from Indra Nooyi, former PepsiCo CEO.

  • Civil & Safety Engineer (Unicamp)
  • M.A. Environmental Diplomacy (University of Geneva)
  • Sustainability Cert (IMD Switzerland)
  • People Management & Coaching (Ohio University)
  • UN Paris speaker representative for Brazil
  • ILO Turin speaker
  • LinkedIn Top Voice
  • Indra Nooyi PepsiCo CEO recognition (2x)

Documentaries

Watch Andreza's documentaries

Three productions on safety culture, organizational failure and the human lessons behind major disasters.

Podcasts

Listen to Andreza's podcasts

She hosts three shows on safety leadership, EHS and organizational culture, in English and Portuguese.

Summarize with AI