How to Preserve Incident Evidence in 5 Decisions During the First 60 Minutes

F2 practical guide

An incident investigation can lose its most valuable evidence before the first formal interview begins. A machine is reset, a damaged component is discarded, a permit is corrected from memory, or a supervisor tells the team what probably happened. Each action may feel practical in the moment, yet it can replace evidence with a story that has not been tested.

The first 60 minutes are not a race to name a cause. They are a controlled handoff from emergency response to disciplined inquiry. This guide gives supervisors and investigation leads eight steps for protecting the scene, recording uncertainty, and deciding what must be verified before the operation returns to normal.

The approach reflects James Reason’s distinction between active failures and latent conditions. It also fits Andreza Araujo’s position in *Sorte ou Capacidade*, where an incident is not reduced to bad luck or one person’s final action. Andreza’s work keeps the investigation connected to Risk Perception, Safety Leadership, and the conditions that make a decision seem reasonable at the time.

What you need before starting

Before collecting evidence, the organization needs a named investigation lead, a controlled scene, a record of emergency actions, and permission to preserve relevant equipment, records, and digital data.

Prepare a simple incident pack that includes a time-stamped log, camera or phone access, a scene sketch template, witness contact details, the relevant permit or Job Safety Analysis, and a list of systems that may contain changing data. The pack does not need to be elaborate. It needs to make the first decisions visible.

For serious injuries and fatalities, the lead should also confirm internal escalation, regulator notification duties, and legal-hold requirements before anyone moves evidence that may need independent examination. The investigation should never obstruct medical treatment or emergency stabilization.

Step 1: Stabilize people and isolate immediate hazards

Stabilize the injured person and isolate the hazard first, because evidence has no value if the response creates another exposure.

Assign one person to coordinate medical response and another to control the area when staffing allows. Use Lockout/Tagout, barricades, evacuation, traffic control, or other established emergency measures according to the hazard. Record the time and purpose of each intervention.

Do not ask workers to recreate the event while the area remains unsafe. The common error is to treat curiosity as urgency and send people back into the exposure before the scene is controlled.

Step 2: Name the investigation owner

The investigation owner is accountable for the quality of the evidence record, even when technical specialists collect individual items.

The owner may be an incident-investigation lead, EHS manager, operations leader, or another person with the independence and competence required by the event. Write the name into the log, define the next decision time, and state who can release equipment or restart work.

Andreza Araujo’s *Make The Difference: Be a Leader in Health & Safety* is useful here because ownership is an operating behavior, not a title on an organization chart. The person who owns the investigation must be able to challenge production pressure, incomplete records, and premature conclusions.

Step 3: Freeze the scene without freezing the response

Preserve the scene by controlling unnecessary changes while allowing essential rescue, isolation, and environmental stabilization to continue.

Create a boundary that is practical for the event. It may include the equipment, access route, work platform, material staging area, control panel, or a wider zone where dropped objects, energy release, or weather could have influenced the outcome. Mark what was already changed during rescue or shutdown.

Photograph the scene before cleanup whenever conditions permit. Capture wide views first, then medium views, then close details with a scale reference. A common error is collecting only the damaged part, which hides the relationship between the equipment, the worker position, the control, and the surrounding work design.

Step 4: Build the first evidence map

An evidence map lists what must be checked, where it exists, who controls it, and how quickly it can change or disappear.

Divide the map into physical, human, procedural, organizational, and digital evidence. Physical evidence may include guards, tools, loads, isolation points, alarms, and housekeeping. Human evidence includes observations, expectations, communication, fatigue signals, and decisions made before the event. Procedural evidence includes permits, JSA or JHA records, shift handovers, and changes to the approved method.

Digital evidence can include access logs, equipment data, control-system trends, radio records, video, dispatch messages, and electronic permit histories. Record the system owner and request preservation before normal retention rules overwrite the data.

Use the evidence-gap review for incident investigations when the first map shows that the team has a narrative but not enough support for it.

Step 5: Capture witness accounts before group memory converges

Speak with witnesses individually and ask for observations before exposing them to a shared version of the event.

Start with open prompts such as what happened from your position, what changed before the event, and what did you expect to happen next. Ask about sounds, alarms, pace, interruptions, and handoffs when those details matter. Separate direct observation from interpretation, and mark uncertainty rather than correcting it in the conversation.

Do not conduct a group debrief as the first evidence activity when accounts may influence one another. The common error is to let the most senior or confident voice establish the official sequence before quieter observations are recorded.

Once individual accounts are protected, the team can use the first-hour investigation huddle method to coordinate evidence review without turning the meeting into a premature conclusion.

Step 6: Secure the records that explain the work context

Records explain the conditions surrounding the task, so secure them before routine editing turns the original context into a polished after-the-fact document.

Collect the current and previous versions of the procedure, permit, JSA, shift plan, maintenance record, training record, competency evidence, staffing information, and relevant production or dispatch instructions. Keep the original files and record when each copy was obtained.

Look for changes that were normal to the operation but absent from the formal paperwork. A temporary repair, altered sequence, contractor handoff, equipment substitution, or production constraint may have changed the risk without producing a new document. The investigation should test that possibility rather than assume the written method describes the work.

Step 7: Mark facts, inferences, and unknowns separately

A defensible investigation distinguishes observed facts from interpretations and keeps unknowns visible until evidence resolves them.

Use three labels in the working log. Facts are directly observed or supported by a reliable record. Inferences are explanations that fit the current evidence but still need testing. Unknowns are questions for which the team has no adequate evidence. This simple separation prevents a plausible first theory from becoming a hidden assumption.

James Reason’s Swiss Cheese Model is valuable because it directs attention toward multiple failed or weakened barriers, including supervision, design, maintenance, and organizational decisions. Andreza Araujo makes the same kind of distinction when she separates Compliance from Culture. A signed form may be a fact, yet it does not prove that the control worked in the field.

Compare the working log with the method-selection guide for serious incident analysis only after the evidence boundary is clear. Choosing a method too early can force the event into a preferred shape.

Step 8: Handoff a protected evidence package

The first-hour handoff is complete when another competent investigator can see what happened, what changed, what remains uncertain, and who controls the next decision.

Assemble the time-stamped log, scene photographs, sketch, witness list, evidence map, preserved records, digital-data requests, and a short statement of immediate controls. Include a record of every material change made during rescue, isolation, cleanup, or temporary restart.

State the restart boundary clearly. If work can resume in an adjacent area, define that boundary. If equipment must remain isolated, identify the owner and review point. If the investigation requires a technical examination, protect the item from alteration and record its storage location.

For high-consequence work, connect the handoff to a risk-owner review so the organization does not treat evidence collection and risk acceptance as separate conversations.

Final checklist for the first 60 minutes

An incident investigation is ready for the next phase when people are safe, the scene is controlled, evidence owners are named, and uncertainty is documented instead of hidden.

• Medical response and immediate hazard isolation were prioritized.
• An investigation owner and restart authority were named.
• The scene boundary reflects the actual hazard and work area.
• Rescue and shutdown changes are recorded with times and reasons.
• Physical, human, procedural, organizational, and digital evidence are mapped.
• Witnesses are contacted individually before group memory converges.
• Original records and changing digital data are preserved.
• Facts, inferences, and unknowns are separated in the working log.
• The handoff states the next decision, owner, and review point.

An investigation becomes weaker each time a plausible story is allowed to replace an uncollected fact. The disciplined response is not slower for its own sake. It is faster at protecting the decisions that prevent a second event.

Across 25+ years of EHS leadership, Andreza Araujo has treated investigation quality as a test of Safety Culture and Safety Leadership, because the organization reveals its priorities through what it preserves, what it questions, and what it is willing to change after harm occurs.

If your organization needs to strengthen incident learning, Risk Perception, and barrier verification, Andreza Araujo connects safety culture with decisions leaders can verify in the work.