Incident Reviews: 5 Distortions That Hide Warning Evidence

This article also connects with the relationship that carries warning evidence, which gives leaders a focused way to test whether safety information changes the work.

An incident review can contain a timeline, interviews, photographs, and a corrective-action tracker while still missing the most valuable question. What warning evidence was available before the event, and why did it fail to change the decision?

The answer is rarely hidden in one dramatic mistake. Warning evidence becomes weaker as it passes through classification, reporting, memory, hierarchy, and action management. That is why the review process itself needs a diagnostic. In more than 250 cultural transformation projects supported by Andreza Araujo, the practical test has remained consistent: does the investigation reveal how the organization allowed exposure to persist, or does it only describe the final moment?

Why warning evidence disappears before the report is complete

Warning evidence disappears when the organization treats an incident as an isolated outcome instead of a decision history. A worker may report a recurring condition, a supervisor may accept a temporary control, maintenance may defer a repair, and production may continue without one record connecting those choices.

James Reason’s work on latent failures gives leaders a useful lens. The action closest to the harm can be visible, yet earlier choices about design, staffing, information, maintenance, or supervision may have shaped the conditions in which that action occurred. The evidence-contamination review is a useful companion because it shows how quickly an investigation can lose the original signal.

The five distortions below are not five individual errors made by investigators. They are five points where a management system can turn a credible warning into a harmless-looking record.

1. Outcome bias makes a serious exposure look minor

Outcome bias appears when the review depth follows what happened rather than what could reasonably have happened. If a dropped object misses everyone, the event may receive a short observation. If the same object strikes a person, the organization may launch a formal investigation, even though the barrier weakness existed in both cases.

That distinction matters because luck is not a control. Frank Bird’s loss-control work is useful when treated as a prompt to examine precursor events, not as a formula that predicts a fixed number of injuries from a fixed number of near misses. The credible consequence needs its own evidence, including energy, height, pressure, traffic, chemical properties, or proximity.

Record actual outcome and credible consequence as two separate fields. Then ask whether the exposure could recur during the next shift, under a different workload, or with a different person in the same position. The incident-classification framework can help match review depth to consequence and barrier weakness rather than to injury paperwork alone.

2. The first account is filtered through hierarchy

Warning evidence is often softened before an investigator hears it. A contractor may describe a missing isolation, a technician may question a restart, or a supervisor may admit that a procedure could not be followed within the production window. Each person is deciding how much risk the organization will tolerate when they decide how directly to speak.

The first interview therefore needs more than a standard question list. It needs a setting where the person can explain what they saw, what they expected to happen, what changed, and what they believed would happen if they stopped the work. Those questions reveal the decision environment without asking the witness to diagnose the organization.

Andreza Araujo’s position in The Illusion of Compliance is relevant here because a compliant record can coexist with a weak operating reality. Leaders should compare the written sequence with the lived sequence, especially when the person nearest the exposure had less status than the person controlling the schedule.

Use two interview passes when the event is serious. The first preserves the person’s account without forcing a theory. The second tests contradictions against physical evidence, records, and other accounts. That separation reduces confirmation bias and protects the review from becoming a search for a convenient culprit.

3. A single root cause erases the decision chain

A single-root-cause statement usually sounds complete because it is short. “The operator failed to follow the procedure” closes the story before the review has examined why the procedure was difficult, what supervision was available, which controls were missing, and what earlier signals had already been accepted.

Incident causation is better represented as a chain of decisions and conditions. The investigator should trace the task from planning to authorization, from authorization to field execution, from field change to escalation, and from escalation to the final decision. Each transition should identify what information was available and who had authority to act.

This approach does not remove personal accountability. It places individual action inside the system that shaped the options. Andreza’s book Luck or Capability makes the same distinction in practical language. An event is not explained by luck when repeated choices have constructed the exposure.

A useful review asks for at least four layers of explanation. What happened, what control failed, what decision allowed the control to remain weak, and what organizational condition made that decision seem acceptable? If the answer stops at the first layer, the warning evidence remains hidden.

4. Evidence is collected after the worksite has been rewritten

Every delay changes the scene. Equipment is reset, temporary barriers are removed, housekeeping restores the area, another shift takes over, and records are corrected without preserving the original state. By the time the formal team arrives, the worksite may show a clean version of the process rather than the conditions that existed during the event.

The first 24 hours should therefore be treated as an evidence-preservation window. Secure photographs from multiple positions, identify equipment status, preserve relevant permits and isolation records, record who controlled the area, and document temporary changes before normal work resumes.

Evidence quality is not limited to physical objects. A system timestamp, radio exchange, maintenance note, access record, or shift handover can show when the decision changed. The investigator should preserve the original record before asking a department to summarize it, because summaries often remove uncertainty, disagreement, and sequence.

The first-interview evidence guide provides a practical starting point. Leaders should also define who can authorize a restart, because restarting too soon can destroy both physical evidence and the opportunity to understand the warning.

5. Corrective actions close the file instead of changing the exposure

The final distortion appears when action closure becomes the success measure. A revised procedure, completed training, toolbox talk, or purchase order can be useful, but none proves that the task is safer. It proves only that an activity occurred.

A corrective action should state the field condition that must change, the control that should perform differently, the person who can verify it, and the date by which evidence will be reviewed. If the action depends on a new guard, a redesigned sequence, a staffing change, or a decision-rights update, the review should inspect that change under the conditions that previously exposed the weakness.

Thirty days is a practical first verification point for many actions, although the responsible team should set a shorter deadline when the exposure is immediate or severe. The test should include a normal shift, a late shift, an interruption, and a restart when those conditions are part of the risk.

The near-miss fix verification process makes the same point. Closure is administrative. Effectiveness is demonstrated in the work.

What leaders should change in the next incident review

Leaders can restore warning evidence by changing the review questions before the next incident occurs. The goal is not a longer report. The goal is a clearer link between signal, decision, barrier, and changed condition.

1. Separate actual outcome from credible consequence and require evidence for both.
2. Preserve the first 24 hours with a named evidence owner and a restart authority.
3. Interview the people closest to the exposure before management theories become fixed.
4. Trace at least four decision layers instead of accepting one root-cause sentence.
5. Verify corrective actions in the field within the agreed time, then test recurrence conditions.

Leaders should also review whether workers can report warning signs without losing status, access, or future opportunity. If people believe that bad news creates punishment, the investigation will inherit a silence problem that no form can solve. Psychological safety is therefore part of evidence quality, not a separate culture initiative.

Andreza Araujo’s Safety Culture: From Theory to Practice frames culture through observable decisions. That standard is demanding but useful. A safety system is learning when a warning changes a decision before harm, not merely when a report explains harm afterward.

Conclusion

Incident reviews lose authority when they reduce warning evidence to outcome, blame, paperwork, or action closure. The five distortions in this article show where that loss occurs and what leaders can do about it.

A stronger review preserves the first account, separates consequence from luck, traces the decision chain, protects the scene, and verifies changed conditions. When those five practices become routine, an incident stops being a document about the past and becomes a control for the next shift.