Evidence Sufficiency Explained: 4 Thresholds Before an Incident Finding Becomes a Conclusion

An incident investigation can contain many facts and still support a weak conclusion. Evidence sufficiency is the discipline that asks whether the available record is strong enough for the claim being made, especially when early assumptions begin to harden into an official finding.

Evidence sufficiency is the point at which an incident record contains enough relevant, reliable, and connected information to support a defined finding without overstating what is known. It matters because a conclusion that outruns its evidence can direct corrective action toward the visible event while leaving the conditions that shaped it untouched.

Definition

Evidence sufficiency does not mean collecting every possible document, interview, photograph, or system record. It means matching the strength of the evidence to the precision of the conclusion. A record may be sufficient to establish what happened while remaining insufficient to explain why the conditions existed or which control should change.

James Reason's work on organizational accidents is useful here because it separates active failures from latent conditions. An investigation that stops at the last visible action may be factually accurate, yet still incomplete for a decision about supervision, design, workload, or control assurance.

Four evidence thresholds in an incident investigation

1. Event threshold

The event threshold is met when the record can establish the basic sequence, location, timing, and immediate outcome with reasonable consistency. Photographs, access records, equipment status, work permits, and contemporaneous accounts can support this layer when their timestamps and perspectives are clear.

The common error is treating one confident account as the event itself. A witness may remember the last movement accurately while missing an earlier handoff, alarm, or change in task conditions.

2. Exposure threshold

The exposure threshold asks whether the investigation can show what harmful energy, agent, or condition reached the person or asset, and how long that exposure remained possible. This moves the review beyond the question of who was present.

For example, a contact injury finding needs more than a statement that a guard was bypassed. The record should establish the access path, the equipment state, the expected barrier, and the work demand that made access possible or likely.

3. Control threshold

The control threshold is met when the investigation can identify the intended barrier, its owner, and its actual condition before and during the event. A procedure, inspection, or training record proves that an administrative element existed. It does not prove that the control worked at the point of exposure.

This distinction prevents a familiar finding from becoming a shortcut. “The procedure was not followed” may be accurate, but it is not a complete control finding unless the review also tests usability, supervision, equipment design, competing goals, and the authority available to pause the work.

4. Causal threshold

The causal threshold is the highest bar. It asks whether the evidence supports a defensible explanation of how the conditions combined and which change would reduce recurrence. Several facts can be true without proving that one factor caused the event.

A causal conclusion should therefore name its confidence and its limits. If the record cannot distinguish a design weakness from a temporary deviation, the finding should preserve that uncertainty instead of converting it into a confident label.

How to differentiate the thresholds in practice

Use the table during an investigation review to separate facts from interpretations. The purpose is not to delay action. It is to make the action proportional to what the record can actually defend.

When evidence sufficiency is useful

Apply these thresholds before closing a serious near miss, approving a corrective action, communicating a high-potential event, or assigning individual accountability. The earlier the review tests its evidence, the less likely the organization is to defend a convenient story simply because it was written first.

Andreza Araujo's safety-culture work consistently places learning close to leadership choices and field conditions. That perspective supports a practical rule for incident teams: close the finding only when the evidence is strong enough for the decision the organization intends to make.