Incident Investigation: 5 Evidence Gaps That Distort the Decision

An incident investigation can reach a polished conclusion while still resting on evidence that was never tested against the work as it happened. That weakness matters because a confident explanation can send corrective action toward training, discipline, or paperwork while the exposure that made the event possible remains in place.

This diagnostic is for investigation leads, EHS managers, and operations leaders who need to decide whether an incident record is ready for causal review. The central thesis is that evidence quality is a leadership control. Before anyone asks for a root cause, the team must know which facts are verified, which are reconstructed, which are disputed, and which conditions changed after the event.

Three dates should be visible in every serious investigation record: when the event occurred, when each material fact was captured, and when the conclusion was approved. The separation prevents later certainty from being mistaken for contemporaneous evidence.

1. Why evidence gaps distort incident decisions

Evidence gaps distort incident decisions because missing or weakly sourced facts are often replaced by the first plausible story.

A first explanation has unusual power after an incident. It shapes the questions investigators ask, the people they interview, and the controls they treat as relevant. Once that story enters a report, later evidence is frequently interpreted as confirmation rather than as a test.

James Reason's work on latent failures gives leaders a useful discipline here. The visible action is only one layer of an event, while design, supervision, scheduling, maintenance, communication, and management decisions may have created the conditions in which that action made sense. Andreza Araujo makes a related point in The Illusion of Compliance, where investigating to understand is separated from searching for a person to blame.

A reliable investigation therefore does not begin with a conclusion. It begins with an evidence status that tells the team how much confidence each claim deserves, which is why the record should remain open when a key fact is still uncertain.

2. Gap one is an untested timeline

An untested timeline is a material gap because sequence determines which controls were available before the event.

Witness memory usually compresses time. A radio log may show a message at 14:07, while a permit record shows an authorization at 14:11 and a machine alarm appears at 14:13. Those entries do not yet explain what the crew knew, but they give investigators a structure against which statements can be checked.

Build the timeline from at least 3 evidence classes, such as system records, physical observations, and human accounts. Mark the source beside each entry and preserve the original time zone, clock source, and collection time. If two systems disagree by 4 minutes, retain the discrepancy instead of silently selecting the convenient timestamp.

The timeline should also record changes after the incident. A barrier removed for rescue, a damaged component moved for examination, or a procedure edited during the first 24 hours can alter the evidence landscape. The difference between event conditions and post-event conditions belongs in the report.

3. Gap two is weak source provenance

Source provenance is strong when an investigator can show who created a record, when it was created, and whether it changed afterward.

A screenshot without its system context is not equivalent to an original record. A summary of a radio exchange is not equivalent to the recording. A copied statement can be useful, but the investigation should identify who transcribed it, when the transcription occurred, and whether the witness reviewed the wording.

Use a simple evidence register with fields for item, source, owner, capture time, alteration risk, and verification status. A register is not administrative decoration. It tells the review panel which claims can support a decision and which claims still require corroboration.

The distinction is consistent with the evidence thresholds described in Evidence Sufficiency Explained, which treats a conclusion as a claim that must earn its level of confidence.

4. Gap three is confusing field condition with written expectation

A written procedure describes the expected control, while field evidence shows whether that control was present, understood, and usable.

Investigators often place a permit, procedure, or training record beside the event description and treat the pair as proof that the control existed. That is a category error. The document may show what should have happened, but it does not show whether the isolation was complete, whether the boundary was visible, whether the alarm was trusted, or whether production pressure changed the sequence.

Compare the record with the physical condition and with the decisions that operators actually faced. Ask which control was supposed to prevent the event, which person could verify it, what evidence was available at the decision point, and what would have happened if the person had stopped the task.

ISO 45001:2018 requires organizations to manage operational risks and evaluate performance, but it does not turn a documented process into proof of field reliability. The operational test must be visible in the investigation, especially when a barrier depends on several teams whose responsibilities overlap.

Four questions expose this gap quickly: What was expected? What was present? What was known? What could the next person verify?

5. Gap four is treating witness memory as a recording

Witness memory is evidence of perception and meaning, not a perfect recording of the past.

People remember under pressure, after conversation, and in response to the wording of an interview. A supervisor who asks, “Why did you bypass the check?” has already placed intent inside the question. A stronger interviewer first asks the person to describe the sequence, the information available, the competing demands, and the point at which the situation changed.

Separate what the witness saw from what the witness inferred. Mark direct observation, heard information, later discussion, and interpretation as different evidence types. This distinction protects competent people from being assigned motives that the record cannot establish.

The investigation should also compare accounts without forcing artificial agreement. If two statements differ about whether a warning light was visible, the disagreement is a finding about evidence quality. It may trigger a lighting test, a control-panel review, or a reconstruction, which is more useful than selecting the statement that best fits the preferred narrative.

For a deeper treatment of interview reliability, see the Headline analysis of post-incident questions and speak-up conditions.

6. Gap five is naming causes before naming control owners

A cause statement is incomplete when it does not identify the control owner who could change the condition.

“Inadequate training” may be true, but it is too broad to guide a decision. The investigation should ask which task demand exceeded the person's preparation, who defined the preparation standard, who verified competence, and which control should have caught the mismatch before exposure.

Control ownership makes the analysis operational. The owner is not simply the person who signs a corrective action. It is the role with authority, resources, and a defined verification point. If a maintenance isolation depends on planning, operations, and electrical authority, the report should show the dependency instead of assigning a single owner who cannot complete the control.

Andreza Araujo's safety writing repeatedly separates formal accountability from practical control. Her book Luck or Capability is useful here because it treats incidents as evidence about the conditions that shaped performance, rather than as proof that the last person in the sequence was the whole problem.

7. What an evidence matrix should show

An evidence matrix should connect each material claim to its source, confidence, contradiction, and decision consequence.

Use the matrix before the causal workshop, not after the report is written. Each row should state the claim in plain language, identify the supporting material, name any conflicting material, and explain which decision would change if the claim proved false.

This matrix prevents the investigation from collecting facts without changing decisions. It also makes review faster because leaders can see where uncertainty matters rather than debating every detail with equal weight.

8. How leaders keep uncertainty from disappearing

Leaders preserve learning when they allow uncertainty to remain visible until a named test resolves it.

Senior reviewers should ask what the team knows, what it believes, and what it still needs to test. Those are different categories, and collapsing them creates false closure. A report can be decisive about immediate controls while remaining cautious about deeper causes, which is often the safest combination.

Set a review date for unresolved evidence, assign a person who can obtain it, and state what action will follow each possible result. A missing maintenance record, disputed alarm condition, or unverified permit practice should not vanish because the meeting calendar has moved on.

The Headline Podcast perspective is practical and demanding. Andreza Araujo's experience across 25+ years in multinational EHS leadership supports a clear position, while James Reason supplies the intellectual anchor: an incident report is valuable when it reveals how defenses aligned, weakened, or failed together.

If a serious incident conclusion cannot show the evidence behind its decisive claims, leaders should treat the report as provisional and protect the exposed work before debating blame, training, or closure.

The next investigation should begin with evidence status, not with a favorite cause. That one change gives operations a better chance to repair the condition that made the event possible and gives leaders a clearer basis for deciding whether the control is ready to trust.