Witness Interview vs Document Review vs Field Walkdown: Which Evidence Should Lead an Incident Investigation?

An incident investigation can collect a witness statement, a folder of procedures, and a carefully photographed worksite, yet still produce a weak decision. The problem is not always missing evidence. It is often the order in which investigators trust each source and the question they expect that source to answer.

A witness interview explains what people perceived and decided, a document review shows what the organization expected and recorded, and a field walkdown tests how the work and controls actually existed. The strongest investigation does not choose one source as universally superior. It gives each source a defined job and tests the gaps between them.

This comparison evaluates the three evidence streams by proximity to the event, vulnerability to distortion, ability to reveal latent conditions, speed, and usefulness for corrective decisions. The central thesis is simple. Investigators should lead with the source that can answer the immediate decision question, then use the other two to challenge the first explanation.

Key Takeaways

• Use witness interviews to understand perception, sequence, uncertainty, and local decisions, but do not treat memory as a complete record.
• Use document review to test expectations, approvals, controls, and prior signals, while checking whether the paperwork reflects the task that actually occurred.
• Use a field walkdown to examine physical conditions, work interfaces, access, layout, equipment state, and the control evidence that remains after the event.
• Choose the lead source according to the decision you need to make, then use the other sources to test and refine the explanation.
• A credible investigation connects event facts to control ownership and operating decisions rather than stopping at the last visible action.

What Should the Lead Evidence Source Prove?

The first question is not “What evidence do we have?” It is “What decision must this investigation support?” A team deciding whether a person could reasonably see a hazard needs a different starting point from a team deciding whether a critical control was designed, verified, and maintained.

James Reason’s work on organizational accidents remains useful because it separates active failures from latent conditions. That distinction prevents an investigation from treating the final action as the whole explanation, but it does not remove the need to establish what happened in the task, what the organization expected, and what conditions shaped the choice.

ISO 45001:2018 requires organizations to determine incident causes, identify whether similar incidents could occur, and take action that addresses the problem. The standard does not prescribe a single interview-first or document-first method. The investigation method must therefore match the exposure, the evidence risk, and the decision that follows.

The evidence-chain model helps investigators keep those questions connected instead of allowing a vivid statement or a polished procedure to dominate the review.

Evaluation Criteria for the Three Evidence Streams

The first criterion is proximity. Witnesses may be close to the decision, documents may be close to the intended system, and a field walkdown may be close to the physical arrangement. None is automatically close to the whole event.

The second criterion is distortion. Memory changes under stress and repetition. Documents can be backfilled, copied, or written for compliance rather than use. A field condition can change after an incident through cleanup, repair, isolation, or ordinary work progression.

The third criterion is explanatory range. A witness can reveal a confusing handoff that no procedure mentions. A document can reveal that the same control gap was already known. A walkdown can show that the control was impossible to use in the available space, even though the record described it as available.

The final criteria are speed and decision value. Evidence is not useful merely because it is easy to collect. The best source is the one that reduces uncertainty about the next safe decision without closing the investigation prematurely.

Witness Interviews: Best for Perception and Decision Sequence

Witness interviews are strongest when the investigation needs to understand what people saw, heard, believed, expected, and decided at particular moments. They can expose ambiguous instructions, competing priorities, unspoken workarounds, and points at which a person believed the job was still within the approved boundary.

The interview should begin with an open account of the event, followed by careful clarification of sequence, location, task conditions, communication, and uncertainty. Questions such as “What did you expect to happen next?” often reveal more than “Why did you do that?” because they explore the person’s working model rather than inviting a defense.

Interviews are vulnerable to hindsight, social pressure, leading questions, and contamination between witnesses. A supervisor’s early theory can become embedded in later statements, especially when the team is asked to confirm a sequence that has already been presented as fact. The investigator should preserve the first account, distinguish observation from interpretation, and record uncertainty without forcing a neat answer.

Use interviews as the lead source when the key decision concerns human perception, communication, coordination, or the moment at which a warning was noticed and acted upon. Do not use them alone to conclude that a control existed, because a person may believe a barrier was available without being able to verify its condition.

Document Review: Best for Expectations and Repeated Signals

Documents are strongest when the investigation needs to compare the intended system with the decision that was made. Permits, risk assessments, training records, maintenance histories, shift handovers, alarm logs, management-of-change records, and previous corrective actions can show what the organization knew, required, approved, or failed to revisit.

The important distinction is between a document that describes an expectation and evidence that the expectation was used. A procedure can require a verification step without showing that the step occurred. A completed checklist can demonstrate recording activity without proving that the stated condition was present. The document review should therefore ask what each record can establish and what it cannot establish.

Document review is also the most useful source for recurrence. If a similar issue appeared in an audit, near miss, maintenance note, or prior investigation, the new event is not only a task-level failure. It may indicate that ownership, escalation, or closure verification did not work across time.

Use documents as the lead source when the decision concerns governance, control design, authorization, prior warning, or whether a corrective action changed the system. Do not allow a complete-looking file to become a substitute for checking the worksite, because paperwork can preserve the intended process after the physical conditions have moved on.

Field Walkdowns: Best for Physical Conditions and Control Reality

A field walkdown is strongest when the investigation needs to test whether the work environment could support the expected control. It can reveal restricted access, poor sightlines, stored energy, inadequate separation, awkward reach, missing equipment, degraded surfaces, incompatible simultaneous operations, or a rescue route that existed only on the drawing.

The walkdown should reconstruct the task without staging a hazardous act. Investigators can map positions, review equipment condition, examine control interfaces, compare current layout with records, and ask people who perform the work to demonstrate the safe sequence using a controlled explanation. The goal is not to reenact the incident. It is to test the physical and operational assumptions behind the account.

Field evidence also has limits. Conditions may have changed, the area may have been cleaned, and a later observer may overinterpret a visible defect because it fits the event narrative. Photographs are useful when they include scale, location, time, and relation to the task. A close-up without context can create confidence without understanding.

Use the walkdown as the lead source when the decision concerns control availability, layout, equipment state, access, line of fire, or whether the written method was workable. Pair it with interviews whenever the physical evidence cannot explain why the task continued under those conditions.

Where Each Source Can Mislead the Investigation

Each evidence stream has a characteristic failure mode. Interviews can overvalue confidence. Documents can overvalue completeness. Walkdowns can overvalue what remains visible. A mature investigation names these limits before interpreting the evidence.

The table is not a ranking. It is a reminder that investigation quality comes from triangulation. When two sources disagree, the disagreement is not an inconvenience to remove. It is often the point that deserves the next question.

Decision Matrix: Which Source Should Lead?

Lead with witness interviews when the event turns on perception, communication, or a sequence that cannot be recovered from records. Lead with documents when the event raises questions about prior knowledge, authorization, repeated signals, or corrective-action ownership. Lead with a field walkdown when the central uncertainty concerns whether the control could work in the actual space and task.

For a fatality, serious injury, high-potential near miss, or process-safety event, the safest default is not to choose one source permanently. Secure the physical scene and time-sensitive records, then conduct early interviews before accounts converge around a common story. The order matters because perishable evidence can disappear, while interpretation can be revisited.

A useful decision matrix assigns each source a lead, challenge, or confirm role. For example, a witness interview may lead a communication question, a document review may challenge the stated authorization, and a field walkdown may confirm whether the proposed control was physically usable. The roles can change as uncertainty moves.

The first-24-hour evidence sequence is especially valuable when the investigation team must protect facts before it has a complete theory.

How to Combine the Three Sources Without Creating a Story Too Early

Start with a neutral event statement that separates known facts, reported perceptions, and unresolved questions. Then build an evidence map in which every important claim has a source, a confidence level, and a person responsible for testing it.

Next, compare the three views of the same control. What did the person believe the control was? What did the documents require or record? What did the field condition make possible? The gaps between those answers often identify the decision failure more clearly than any single source.

Finally, test the proposed cause against an alternative explanation. If the conclusion says that a worker failed to follow a procedure, ask whether the interview explains the decision, the document shows a usable instruction, and the walkdown shows that the instruction could be performed under the conditions. If one leg is missing, the conclusion needs more work.

That discipline is consistent with Andreza Araujo’s emphasis on connecting engineering, creativity, and care. In an investigation, care means protecting people from premature blame, engineering means testing the control, and creativity means asking what the evidence has not yet allowed the team to see.

Recommendation by Investigation Context

For a sudden injury where the sequence is disputed, begin with protected witness accounts while preserving the scene and records. For a recurring near miss, begin with documents and prior signals, then use interviews and a walkdown to test why the known issue remained unresolved. For a high-risk task involving a physical barrier, begin with the field walkdown and control evidence, then use interviews to understand how the barrier was interpreted.

For contractor work, use all three sources to examine the interface rather than assigning the event to the contractor’s final action. Review the contract and permit boundaries, interview both organizations, and walk the area with the people who coordinate simultaneous work. For a process-safety event, prioritize records that preserve sequence and control state, then test the operating assumptions in the field.

In every context, the recommendation should name the control owner, the decision that must change, the evidence that will verify the change, and the date by which verification will occur. A corrective action is not complete because an action was assigned. It is complete when the relevant evidence shows that the exposure or decision condition has changed.

What a Decision-Ready Investigation Looks Like

A decision-ready investigation does not claim certainty where the evidence remains incomplete. It explains what happened, identifies which conditions shaped the event, distinguishes active action from latent weakness, and shows why the selected corrective actions should address recurrence.

The strongest report makes the evidence architecture visible. Readers can see which statements came from witnesses, which expectations came from documents, which conditions came from the field, and where the sources disagree. That transparency makes the report more credible because it gives leaders a way to challenge the reasoning without discarding the facts.

The practical test is whether an operations leader can make a better decision after reading the report. If the report only identifies who acted last, it has described the event without explaining the system that made the action likely. If it connects evidence to control ownership, operating conditions, and verification, it can support a safer change.

Incident investigations improve when evidence is treated as a set of questions rather than a pile of exhibits. Witness interviews, document review, and field walkdowns each reveal a different part of the decision environment. The investigation should lead with the source closest to the uncertainty, then use the other two to challenge the first explanation before corrective action is approved.