Incident Investigation

Root-Cause "What," Not "Who": 5 Investigation Habits That Keep Your Team Talking

When a serious event lands on the table, the first reading almost always points at the person closest to the harm, and that reflex quietly destroys the one thing every future investigation depends on: a workforce willing to tell you the truth. On a recent Headline Podcast episode, Tim Page-Bodoff argued that the question itself is the problem, because chasing a root-cause "who" treats the symptom and leaves the disease alive inside the processes that made the failure possible. This article reframes investigation as a learning act rather than a verdict, anchored in James Reason's systemic view and the on-air conversations Andreza Araujo and Dr. Megan Tranter host with frontline practitioners.

By 2 min read
investigative scene on root cause what not who 5 investigation habits that keep your team talking — Root-Cause "What," Not "W

Key takeaways

  1. 01Ask root-cause "what," not "who," so the inquiry maps system holes instead of closing on a culprit.
  2. 02An accident is a construction of failed layers, the Swiss cheese model, not random bad luck (Sorte ou Capacidade).
  3. 03Serious events look like operator error until you find the upstream decisions that made the safe path impractical.
  4. 04Corrective actions only stick when the department that runs the work co-authors them.
  5. 05A near miss is an accident that has not happened yet; structured inquiry beats waiting for the event.

Why "who did it" is the wrong opening question

Blame feels efficient because it closes the file fast, yet it answers nothing about why the action made sense to the person at the time. On Headline Podcast, Tim Page-Bodoff put it plainly: "I don't think we should do a root-cause who. I think we should do a root-cause what." The distinction matters because a named culprit ends the inquiry exactly where the useful part begins. OSHA reports that struck-by, caught-in, fall, and electrocution events, the construction "Focus Four," account for more than half of construction fatalities, and almost none of those traces back to a single careless individual rather than to layered decisions about layout, scheduling, and supervision made long before the shift started.

The accident is a construction, not bad luck

The deepest reframe comes from the host's own work. As Andreza explores in her book Sorte ou Capacidade (Luck or Capability), an accident is systemic, the late result of layers and barriers that failed in sequence, what James Reason described as the Swiss cheese model, not a random stroke of misfortune. Her companion line from Um Dia Para Não Esquecer sharpens it: "It wasn't chance. It was construction." When investigators internalize that an event was built, decision by decision, over weeks or years, they stop hunting for the unlucky operator and start mapping the holes that lined up. ISO 45001 specifies, in its incident-investigation requirements, that organizations determine the underlying causes and act on the management system, not merely the immediate trigger.

It always looks like the employee's fault until you look deeper

There is a predictable pattern in serious-event analysis that explains why blame is so seductive. On Headline Podcast, Dr. Thomas Krause noted that decision analysis of serious events "always looks like it was the employee's fault" for not following the procedure, until you look deeper and find that following it was made nearly impossible by system factors set by decisions made a month, a year, or five years earlier. The procedure existed. The training record was signed. The PPE was issued. And the work was still designed so that the safe path was the slow, awkward, career-limiting one. NIOSH recommends prevention-through-design precisely because the cheapest, most durable barriers are built upstream, long before the worker reaches the task.

Turn the finding into something the line actually owns

A root-cause "what" only pays off if the fix lives where the work lives. The practitioner rarely owns "what do we do about this," so a corrective action handed down from the safety office and never adopted by the department that runs the operation will not last even when everyone nods in agreement. The most reliable investigations end with the line manager and crew co-authoring the change, because the people who run the work hold the knowledge no procedure captures. BLS records tens of thousands of recordable cases each year where the recurrence, not the first event, signals that the original corrective action never reached the floor.

Don't wait for the accident to be your teacher

The worst place to learn about a risk is from the accident itself. Mature operations discover risk proactively through structured inquiry, treating a near miss as an accident that has not happened yet rather than a non-event to file and forget. As Andreza frames it on the show, a workplace accident is a book we did not read, and the near-miss log is usually the table of contents nobody opened in time.

Topics incident-investigation root-cause-analysis safety-culture iso-45001 near-miss

Frequently asked questions

Why is "root-cause who" so common if it's the wrong approach?
It closes the investigation quickly and satisfies the urge to assign responsibility, but it answers nothing about why the action made sense at the time, and it teaches the workforce that speaking up gets people punished, which dries up the information future investigations need.
Does avoiding blame mean nobody is ever accountable?
No. Accountability shifts to the system owners who set the conditions, the leaders whose decisions a month or five years ago shaped how the work could be done, rather than landing only on the person nearest the harm.
How do I keep a corrective action from being ignored?
Have the line manager and crew who run the work co-author it. A fix designed by the safety office alone rarely survives contact with the floor, because the people doing the task hold the operational knowledge the procedure left out.

About the author

Andreza Araújo

Safety Culture Expert | Senior EHS Executive

Andreza Araújo is a safety culture expert and senior EHS executive with more than 25 years of experience in environment, health and safety. She is a Civil Engineer and Occupational Safety Engineer from Unicamp, holds a Master's degree in Environmental Diplomacy from the University of Geneva, and completed sustainability studies at IMD Switzerland. Andreza has served in Global Head of EHS roles in Fortune 500 environments, leading cultural transformation programs across multinational operations. She has represented Brazil as a speaker at the United Nations in Paris and has spoken at the International Labour Organization in Turin. She is the author of more than 16 books on safety culture in Portuguese, Spanish, English and German. Her work has earned more than 10 EHS awards, including two recognitions from Indra Nooyi, former PepsiCo CEO.

  • Civil & Safety Engineer (Unicamp)
  • M.A. Environmental Diplomacy (University of Geneva)
  • Sustainability Cert (IMD Switzerland)
  • People Management & Coaching (Ohio University)
  • UN Paris speaker representative for Brazil
  • ILO Turin speaker
  • LinkedIn Top Voice
  • Indra Nooyi PepsiCo CEO recognition (2x)

Documentaries

Watch Andreza's documentaries

Three productions on safety culture, organizational failure and the human lessons behind major disasters.

Podcasts

Listen to Andreza's podcasts

She hosts three shows on safety leadership, EHS and organizational culture, in English and Portuguese.

Summarize with AI