Incident Investigation: 5 Questions That Keep Causal Stories Honest

An incident report can be coherent, polished, and wrong in the way that matters most. The chronology may read smoothly, the causal diagram may contain several boxes, and the corrective-action list may look complete, while the report still fails to answer the question leaders need answered: what must change before the same exposure reaches a person again?

That is why incident investigation should test a causal story instead of merely producing one. Across 25+ years in multinational EHS leadership and more than 250 cultural transformation projects, Andreza Araujo has repeatedly seen the same failure pattern. Teams close the narrative before they have tested the decisions, conditions, and controls that made the event possible. The report then explains the event without changing the system that produced it.

This article gives investigators, plant managers, and EHS leaders five questions that keep a causal account honest. The questions are not a replacement for a formal method. They are a decision-quality filter that can be applied to an internal review, a serious-incident investigation, or a board briefing before the organization commits money, discipline, or closure status.

1. What was the first observable change?

A causal story becomes weak when it starts with the final unsafe act. The operator pressed the wrong control, the contractor entered the area, or the supervisor accepted a deviation. Those details may be true, yet they rarely identify when the system first moved away from its intended condition.

Start with the earliest observable change that separated the work from the approved design. It may have been a missing isolation, an altered sequence, an overdue inspection, a production constraint, a staffing change, or a decision to continue after a control lost its owner. The question forces the investigation to search upstream without pretending that every upstream condition has equal weight.

James Reason’s work on latent failures gives this question technical depth. A visible action at the point of contact can be the final expression of earlier design, supervision, maintenance, or management decisions. The investigator should therefore record the first change that could be observed, dated, and connected to the exposure, rather than beginning with an assumption about individual intent.

Use a separate evidence map and timeline when the sequence is disputed. The timeline shows when conditions changed. The evidence map shows how confidently each statement can be supported.

2. Which statements are facts, interpretations, or assumptions?

Reports become persuasive too quickly when every sentence is written in the same voice. A camera record, a witness recollection, a procedure requirement, and an investigator inference then appear equally certain, even though they carry different evidentiary weight.

Every important statement should be labelled as a fact, an interpretation, or an assumption. A fact can be tied to a record, observation, physical trace, or consistent testimony. An interpretation connects facts into a reasonable explanation. An assumption fills a gap that still needs verification. The labels do not weaken the report. They show leaders where the decision is strong and where it remains conditional.

Frank Bird’s loss-control work is useful here because it keeps attention on the relationship between precursor conditions, events, and loss. The pyramid is not permission to treat every near miss as a numerical predictor of a fatality. It is a reminder that the investigation should test the conditions that precede harm, including the ones that did not produce a visible injury this time.

A practical review can borrow the four-label discipline in Incident Evidence Status Explained. If a conclusion depends on an unverified assumption, the report should say so before the corrective action is approved.

3. What control was expected to prevent or limit the exposure?

Many investigations name a failed behavior before naming the control that was supposed to make that behavior safe or impossible. That sequence reverses the logic of prevention. The first control question is not whether someone followed the rule. It is what barrier, design feature, supervision practice, or recovery process was expected to prevent the exposure from becoming an event.

Describe the intended control in operational terms. A permit should define the boundary, authorization, and conditions that make the work acceptable. An interlock should prevent hazardous motion or create a reliable stop condition. A supervisor check should detect a mismatch before the task continues. A training course may support competence, but it is rarely the only control for a serious hazard.

The investigation must then compare the designed control with the control that existed in the field. That comparison often reveals a gap between documentation and protection. The procedure may require two people, while the roster makes one person normal. The barrier may exist, while its verification is left to a rushed visual glance. The control may be technically capable, while nobody has authority to stop the work when it is unavailable.

Before calling an action complete, use the control-verification logic described in How to Build an Evidence Confidence Log Before RCA Starts. The question is whether the control now performs its intended function, not whether a new paragraph was added to the procedure.

4. What changed in the work that the procedure did not describe?

Procedures are written for a defined operating condition. Exposure grows when the work changes faster than the document, risk assessment, or authorization process. A temporary repair, a new product, a contractor substitution, an unusual sequence, or a longer shift can create a different task while the organization continues to judge it against the old description.

Ask the people who performed and supervised the work what was different that day. Do not ask only whether they followed the procedure, because that question invites a yes-or-no answer. Ask which step took longer, which control was inconvenient, which resource was missing, which decision required an exception, and which part of the plan no longer matched the equipment or schedule.

The aim is not to excuse a deviation. It is to identify the operating conditions that made the deviation reasonable, attractive, or difficult to detect. A report that treats every variation as personal choice can miss the management decision that left the team with no workable way to meet production and safety requirements at the same time.

Andreza Araujo’s safety-culture work makes this distinction practical. A declared standard matters only when the operation can execute it under pressure, with clear ownership and usable controls. If the work changes, the investigation should test whether the system noticed and governed that change.

5. Who knew about the risk before the event?

Knowledge is not the same as control, but it is a critical part of accountability. Someone may have seen the hazard, raised a concern, accepted an exception, approved a schedule, or received a warning without understanding what decision authority came with that information.

Ask who knew, when they knew, what they believed the information meant, and what they were able to change. The answers should include frontline workers, supervisors, maintenance, engineering, contractors, EHS, and leaders who controlled resources or deadlines. This is not an exercise in assigning blame to the person closest to the event. It is a way to find where risk information stopped moving toward a decision.

Psychological safety matters because people are more likely to surface uncomfortable information when the first response is serious, specific, and useful. Amy Edmondson’s research helps explain why a reporting channel alone is insufficient. If the organization receives warnings but does not clarify ownership, response time, or escalation, the channel becomes a place where concerns are recorded rather than acted upon.

For the final report, distinguish between information that was available, information that was understood, and information that reached a person with authority to act. Those are three different conditions, and combining them creates a false story about what the organization knew.

6. What action would change the exposure, not only the paperwork?

A corrective action is strong when it changes the conditions that allowed the exposure to persist. It may remove a hazard, redesign a task, add an engineered barrier, clarify decision rights, change the sequence, or create a verification point that catches drift before the next shift inherits it.

Training, communication, and reminders may be appropriate supporting actions, but they should not be accepted as the primary response when the investigation has identified a design, staffing, equipment, or control-ownership problem. A poster can explain a rule. It cannot make a missing guard reappear, shorten a stopping distance, or give a supervisor authority that the organization has not granted.

Ask the action owner to state the exposure that will be different after implementation. Then ask what evidence will prove the change. The answer should describe a field condition, a functional test, a decision record, or a verified work sequence. “All employees informed” is evidence of communication. It is not evidence that the risk has been reduced.

When the action changes a high-consequence control, connect it to the decision trail that survives investigation closure. Leaders need to know who accepted residual risk, why the timing was chosen, and what would trigger escalation if the control does not hold.

7. What would disprove our preferred explanation?

Investigators can become attached to the first explanation that makes the event feel orderly. Confirmation bias then turns missing evidence into support for the chosen theory. The report sounds decisive because alternatives are never tested.

Write down at least one observation that would weaken the preferred explanation. If the report says fatigue caused the error, what would show that the same failure occurred under normal recovery conditions? If it says a worker ignored a rule, what would show that the rule was impossible to execute with the equipment, staffing, or time available? If it says the contractor acted alone, what would show that the host organization created the conditions for the exposure?

This question does not demand endless investigation. It demands intellectual honesty before closure. A good review should be able to name the evidence that would change the conclusion, because a theory that cannot be challenged is only a narrative preference.

Use the distinction between direct evidence and inference throughout the review. When the evidence is incomplete, state the boundary clearly and select an action that protects people despite uncertainty. Leaders do not need artificial certainty. They need a defensible basis for changing the work.

8. How will we know the lesson survived the next operating pressure?

Closure is not the date on the action tracker. Closure occurs when the new condition has been tested in the work that previously defeated the control. The test should include the shift, task, equipment state, or production pressure that made the original exposure possible.

Define the verification window before the action is marked complete. Decide who will observe the control, what evidence will be collected, and what result will reopen the investigation. A maintenance change may need a functional test and a later field observation. A supervision action may need evidence across several shifts rather than one meeting attendance sheet.

Use a short comparison between the old condition and the verified condition so the board, plant manager, and frontline team can see what changed. The strongest report makes the decision visible without forcing readers to reconstruct it from attachments.

That discipline reflects the central lesson of Safety Culture: From Theory to Practice. Culture is not what the organization says after an event. It is what the organization makes easier, harder, visible, and accountable when the next pressure arrives.

Decision test: five questions before approving closure

An investigation that closes the story before it tests the control can create a second failure, because leaders may fund the appearance of correction while the original exposure remains available.

For teams preparing a serious-incident review, these questions provide a compact executive filter. They can be used alongside a formal investigation method, an evidence log, and a corrective-action process without replacing any of them.

Explore Headline Podcast for conversations on how leadership decisions shape safety, risk, and better work.

Conclusion

Incident investigations become more useful when they test the causal story before they approve the action. Ask what changed first, separate evidence from interpretation, identify the control, trace who knew, and verify the new condition under pressure. Those questions keep the report connected to the work instead of allowing a polished narrative to stand in for risk reduction.

Andreza Araujo’s experience across multinational EHS leadership and more than 250 cultural transformation projects supports a practical standard for closure. The report is not finished when it explains the past. It is finished when the organization can show what changed and why the next team will face a safer decision.