Incident Investigation: 6 Failures That Keep Serious Risk Alive

The investigation meeting ends with agreement, the report is approved, and the dashboard turns green. Three weeks later, the same exposure appears on another shift. The report was finished, yet the risk remained alive because the investigation described what happened without examining the decisions that made recurrence possible.

That distinction matters for serious events and high-potential near misses. A useful investigation does more than reconstruct the last few minutes. It shows how work was planned, which control was expected to hold, who could change the condition, and why the organization accepted evidence that was weaker than the exposure required.

Across more than 25 years of multinational EHS leadership, Andreza Araujo has seen that credibility is built after the report, when workers can tell whether their concern changed the work. Her experience across more than 250 cultural transformation projects supports the same practical principle found in Safety Culture: From Theory to Practice. A safety system is revealed by repeated decisions, especially when production pressure makes the safer choice inconvenient.

Why a polished report can still be operationally weak

Most investigation processes are designed to produce consistency. They require a timeline, interviews, causal analysis, corrective actions, approvals, and closure evidence. Those elements are useful, although consistency can become a substitute for judgment when the team treats every incident as a documentation exercise.

The central question is not whether the report contains enough sections. It is whether the report explains the gap between the control that should have worked and the conditions that actually governed the job. That gap may sit in design, planning, staffing, maintenance, supervision, competence, procurement, or leadership review.

James Reason’s work on latent failures provides a disciplined way to examine that gap. The final act remains part of the explanation, but it is rarely the whole explanation. When a worker bypasses a barrier, the investigation should ask what made the bypass practical, rewarded, tolerated, or difficult to detect before the event.

Decision failure 1: selecting the wrong event boundary

An investigation becomes narrow when its boundary begins at the moment of the incident and ends when the injured person leaves the scene. That frame is easy to manage because the facts are visible. It is also too small for serious risk.

Set the boundary around the decision chain. Include the work request, design assumption, procurement choice, staffing plan, permit, shift handover, inspection history, and earlier warning that could have changed the job. The relevant period may begin months before the event when a maintenance strategy or production decision established the conditions.

Verify the boundary by asking whether a leader outside the investigation team could recognize the same exposure in another task. If the answer is no, the team probably followed the event rather than the risk. A narrow timeline explains the past. A decision boundary helps prevent the next version of the event.

Decision failure 2: framing the problem around the final act

“The operator failed to follow the procedure” is not an investigation conclusion. It is a starting observation that requires context. The team still needs to test whether the procedure matched the equipment, whether the sequence was feasible, whether the person was trained and authorized, and whether supervision could detect a deviation before harm occurred.

This does not mean removing personal accountability. A person can make a poor choice, and the organization can still be responsible for the conditions that shaped the choice. Accurate accountability names both levels instead of allowing the final act to absorb every earlier failure.

Use the following question for each visible action, because it forces the investigation toward evidence rather than opinion. What condition, instruction, incentive, time pressure, design feature, or previous decision made this action more likely?

Decision failure 3: treating early evidence as incomplete noise

Workers often notice the weakening control before the incident team does. A repeated alarm, a temporary repair, a difficult handoff, an unreliable isolation, or a supervisor’s informal workaround may appear too ordinary to enter the causal analysis. That is precisely why the signal deserves attention.

Interview people who perform the task across shifts, not only the people named in the initial report. Ask what changed, what they stopped trusting, which step takes longer than the plan allows, and what they do when the formal route fails. Their answers can reveal the operating gap that the incident scene no longer shows.

Andreza Araujo’s Safety Culture Diagnosis: Learn how to do your own is useful here because it treats culture as evidence that can be tested through perceptions, decisions, and worksite proof. The investigation should apply the same discipline. A concern becomes causal evidence when it connects to the control condition and can be checked in comparable work.

Decision failure 4: assigning ownership to the function that writes the report

EHS often coordinates the investigation, which can create an unintended transfer of ownership. The report is written by EHS, the action is assigned to EHS, and the operating function that controls the equipment or schedule becomes a reviewer rather than the owner.

Assign ownership according to authority. Engineering should own a design change when design controls the exposure. Maintenance should own a reliability problem when equipment condition is central. Operations should own a planning or supervision change when the work system creates the pressure. Leadership should own a resource or priority decision when the control cannot be sustained without executive support.

The verification test is simple. Ask whether the named owner can change the condition without asking another function to act first. If not, the action has been assigned to an administrator rather than a controller. Split the action or move it to the person who can change the exposure.

Decision failure 5: closing actions without testing the control

A purchase order, revised procedure, completed training session, or signed briefing can be valid evidence of activity. None of them automatically proves that the control works under normal conditions.

For serious risk, closure should reach the fourth level. Observe the task, speak with the people who use the control, check the failure mode that caused the event, and return after the work has resumed its ordinary pace. A control that works only during a demonstration is not an effective control.

Decision failure 6: keeping the lesson inside the original report

An investigation can identify a strong lesson and still fail to transfer it. The report sits in a database, the local team receives a presentation, and similar operations continue with different assumptions. The organization has knowledge, but not learning that reaches decisions.

Transfer the lesson by exposure, not by title. Search for comparable equipment, tasks, shift patterns, contractor interfaces, and temporary conditions. Then ask each owner which control exists, how it is verified, and what evidence would show deterioration. This creates a practical comparison instead of a mass email.

Transfer also requires a clear decision statement. “Improve communication” is too vague to govern action. “The shift supervisor must confirm isolation status with the incoming supervisor before the task restarts, and the confirmation must be observable in the work record” can be tested, coached, and audited without turning the lesson into a slogan.

What an investigation leader should review before approval

Before approving the report, the investigation leader should read it as a decision map. The review should show where the exposure entered the system, which control was expected to prevent it, who controlled that condition, and what evidence will prove that the response is holding.

• Does the event boundary include earlier planning, design, maintenance, staffing, and escalation decisions?
• Does the analysis explain the final act without treating it as the whole cause?
• Do worker accounts connect to a control condition that can be checked?
• Does every action have an owner with authority to change the exposure?
• Does closure require field evidence that matches the potential consequence?
• Does the lesson reach comparable work rather than stopping with the original team?

Use a second reviewer when the event involves a critical barrier, a repeated condition, or a conflict between production priorities and control quality. The second reviewer should challenge the analysis, not simply proofread it. A useful challenge asks which decision the report is still avoiding.

How leaders know the investigation changed work

Leaders should look for a changed condition, not only a completed action count. The evidence may be a redesigned access point, a reliable isolation, a decision boundary that supervisors can apply, a maintenance task that no longer waits for failure, or a worker who can explain what changed and why.

Review the result during normal operations, because the pressure that shaped the original event usually returns. If the control fails as soon as schedules tighten, staffing changes, or contractors enter the task, the investigation produced a temporary performance rather than a durable improvement.

Make The Difference: Be a Leader in Health & Safety reinforces this leadership responsibility through practical ownership. The leader’s role is not to make the report sound decisive. It is to make the decision that protects the work visible, resourced, and verifiable.

FAQ

What is a decision failure in an incident investigation?

A decision failure is a point at which someone chose, accepted, delayed, or failed to clarify an action that shaped the exposure. It may involve planning, staffing, design, supervision, maintenance, escalation, or resource allocation. The term does not assume bad intent. It identifies where the operating system made a safer choice difficult or unlikely.

Why can a complete incident report leave serious risk alive?

A complete report can still leave serious risk alive when it documents the event sequence but does not test the controls, decisions, and conditions that will recur. A closed form proves that an investigation was recorded. It does not prove that the exposure changed in the field.

How should investigators use James Reason’s work?

Investigators can use James Reason’s work on latent failures to look beyond the final visible action and examine weaknesses in design, procedures, supervision, training, communication, and management decisions. This makes accountability more accurate because it distinguishes an individual choice from the conditions that shaped it.

Who owns an incident investigation finding?

The owner is the person or function with authority to change and sustain the relevant condition. The investigator owns the quality of the analysis, but operations, engineering, maintenance, procurement, or leadership may own the response. Assigning every finding to EHS weakens accountability when EHS cannot control the exposure.

What proves that an investigation changed risk?

Evidence includes a changed equipment condition, a clearer decision boundary, a verified procedure, a reliable staffing or competence arrangement, or a control that remains effective during normal work. Leaders should also test comparable tasks, shifts, and contractor interfaces so the response is not limited to the original event.

An incident investigation earns its value when it changes the decisions that shape exposure before the next event. The report is only the record of that work. The real result appears when the control holds, the owner is clear, and comparable teams can make a safer choice without waiting for another failure.