Incident Investigation & Root Cause Analysis
Incident investigation should explain what happened, why it happened and what needs to change so recurrence becomes less likely.
2 min read
It should not be a search for someone to blame.
Immediate response boundaries
First priorities may include:
- emergency response;
- medical support;
- making the area safe;
- preserving evidence;
- required notification.
The exact response depends on site procedures and jurisdiction.
Evidence collection
Useful evidence can include:
- scene observations;
- photographs where permitted;
- equipment condition;
- alarms/logs;
- documents;
- maintenance history;
- procedures;
- training records;
- witness accounts.
Preserve facts before resetting or altering the scene where practicable and permitted.
Interviews
Good interviews are fact-finding, not interrogation.
Ask:
- What were you trying to do?
- What happened before the event?
- What did you expect?
- What conditions were unusual?
- What normally happens?
- What made the chosen action seem reasonable?
Timeline
Build a sequence of:
- conditions;
- actions;
- system responses;
- decisions;
- deviations.
A timeline often reveals interactions missed in narrative summaries.
Causal analysis
Separate:
Immediate event: what physically happened.
Contributing conditions: factors that made it more likely.
System causes: design, planning, supervision, maintenance, workload, training, change, culture or control weaknesses.
Root-cause methods
Methods can include:
- 5 Why;
- fishbone;
- barrier analysis;
- fault-tree thinking;
- causal-factor charting.
No method guarantees a correct root cause.
Use evidence.
Corrective actions
Strong actions target the cause.
Prefer, where feasible:
- elimination;
- design/engineering change;
- stronger system controls.
Training alone may be insufficient if the system encourages the same error.
Effectiveness review
Ask:
- Was the action implemented?
- Did the hazardous condition change?
- Has the failure mode repeated?
- Did the change create new risk?
Closure is not the same as effectiveness.
Reporting
A good report distinguishes:
- fact;
- inference;
- unresolved uncertainty;
- recommendation.
Portfolio exercise
Use a public incident or fictional case.
Build:
- timeline;
- evidence table;
- causal analysis;
- actions;
- effectiveness plan.
A strong investigation changes the system without pretending uncertainty does not exist.
Related content
- Safety Engineer Career Guide
- Safety Engineer Skills Employers Want
- Safety Engineer Portfolio & Evidence of Experience
Sources
- NIOSH — Hierarchy of Controls — Authoritative control hierarchy and engineering-control framing.