Rethinking Incident Investigation: We Can Do Better

Why We Should Rethink Incident Investigation

Incidents are not random. They are signals of a failure in systems and culture. A near miss is significant. It is a preview.

When investigations are treated as compliance exercises, organizations get paperwork and actions without depth. When treated as learning opportunities, organizations gain understanding and lasting change.

Where Investigations Go Wrong

The Incident: A Near Miss?

It was a “normal” evening shift.

The site was short-staffed. The supervisor was in the office, juggling calls to convince a third-shift employee to come in early while trying to finish shipping paperwork. On the production floor, equipment kept jamming. Two hours into the shift, frustration was running high. The supervisor, who had yet to make it to the production floor, was oblivious.

At 10:00 PM, an operator reached into the machine to clear a jam.
The machine cycled.

In a split second, the employee yanked their hand back just before the blade made a full cycle. A life-altering, life-threatening amputation was narrowly avoided.

Frustrated and shaken, the employee decided to submit a near-miss report. The supervisor received the report and barely spent a moment looking it over. There were other more important priorities, and after all, no one got hurt. Later that night, the supervisor gathered the crew for a huddle. The supervisor, recalling the near miss, reminded the team not to reach into live equipment.

The supervisor returned to the office, documented the huddle as a corrective action for the near miss, and closed the investigation. The report went into the system and was signed off by safety. The site manager saw the report two days later and decided to commend the team for reporting the near miss.

Thirty-seven days later, another operator reached into the same piece of equipment that continued to have issues with jamming.
This employee was not so lucky.

The organization had learned nothing from the near miss. Only after the amputation did the organization uncover the systemic issues that made the incident possible. Multiple safeguards had failed. Leadership decisions made years earlier had shaped the conditions. Even armed with this knowledge, the organization failed to learn. Instead, the prevailing opinion was that this was a one-time failure and the configuration of events leading to this injury was unlikely to happen again. The investigation system had clearly failed.

An investigation system that was focused on broad-based learning would have uncovered these vulnerabilities, driven meaningful preventive action, and improved decision-making across all levels.

The Investigation: Four Critical Flaws

When this organization reviewed its investigation system, four major weaknesses arose:

1. Only medically treated injuries were investigated.
   Near misses were documented but not truly examined.
   
2. Incidents were not prioritized by evaluating them for Serious Injury and Fatality potential (SIFp). A near amputation was treated the same as a first-aid incident that did not have SIFp.
   
3. The Supervisor of the injured employee led the investigation; they lacked training and were under constant pressure to focus on other priorities. Their investigation was often biased toward employee error as the primary cause.
   
   Learn more about The Role of Cognitive Bias In Safe Decisions
   
4. The organization lacked a learning orientation. It did not have a structured method for collective learning. There was a failure to use analytics to uncover warning signs and patterns, a failure to understand risk amplifiers, and leaders received no information that illuminated how their decisions influenced frontline outcomes.

These Challenges Are Not Unique to this Organization

In conversations with executives across industries, we frequently hear:

• “We treat every incident like a one-off event.”
• “Our investigations almost always result in retraining as the action.”
• “We spend too much time discussing minor incidents at senior meetings. Do we really need to review that someone bumped their head on a shelf?”
• “Our investigation forms are pages long. We collect reams of data, but what are we learning from it?”

These comments point to incident investigation systems underdelivering.

Why Investigation Systems Fall Short

The shared challenges contributing to weak outcomes:

1. Lack of Proportional Response

All incidents deserve attention, yet not all need the same depth. When organizations do not evaluate potential severity, high-potential events are treated as routine. These are often the very events that offer the greatest insight into culture, systems, and decision-making.

2. Pressure to Close Quickly

When policy dictates strict timelines, quality declines. The longer an investigation stays open, the greater the pressure to close it. Closure becomes the goal, and learning becomes secondary.

3. Ill-Equipped Investigators

Effective investigation requires specialized skills: interviewing, systems thinking, bias awareness, and root cause analysis. Investigators, especially supervisors, may also be biased toward blaming employee behavior and may limit corrective actions to what is within their span of control.

4. No Systematic Learning Methodology

Most organizations share what happened through safety alerts or by sending out the investigation findings. A small subset will verify that the action plans truly control exposure, and even a smaller subset will ensure improvements are implemented across the organization. While these activities are important, it is sharing, not learning. Learning requires a structure where employees at all levels explore how decisions shape outcomes and how amplifiers increase exposure.

5. Overcomplicated Software

Incident Management software can add to the challenge of getting a quality investigation. Investigators can become so focused on filling in the mass of required fields, be confused about what is expected to be input, and the system can be so rigid that it results in poor data and superficial analysis. Investigators focus on completing tabs instead of understanding causes.

Why it is Time for Disruption

The traditional incident investigation system is overdue for disruption. Too many organizations still rely on outdated, compliance-driven processes focused on blame, paperwork, and rapid closure rather than understanding how work happens and why failures occur. Emerging technologies, advanced analytics, and modern learning-based investigation methods are creating an opportunity to fundamentally redesign incident investigations.

We will not solve these challenges by sending investigators to another round of training. If an organization is serious about fixing its investigation system and capturing the full learning value of incidents, it requires fundamental redesign, not incremental tweaks.

How to drive real change in the Incident Investigation Process

1. Redefine What Is Identified in Every Incident

For every incident—without exception—two elements must be clearly set up:

• Immediate Causal Exposure
  Root cause analysis cannot begin until the immediate exposure is clearly defined. What was the hazardous energy, condition, or situation that created the potential for harm?
  
  Consistently classifying immediate exposures allows the organization to:
  – Find patterns in causation
  – Prioritize the most critical risks
  – Develop targeted Exposure Control Plans
  
  Without this clarity, investigations drift toward vague conclusions and behavior-focused fixes.

• Serious Injury and Fatality Potential (SIFp)
  Every incident must be evaluated for its potential severity, not just its actual outcome.
  
  This distinction ensures proportional response:
  – Non-SIFp incidents can be investigated locally.
  – SIFp incidents should be led by trained professionals with advanced investigation skills.
  
  Resources must align with risk. A high-potential near miss deserves more scrutiny than a low-risk first-aid case.

2. Professionalize the Investigator Role

Organizations must figure out the time required to conduct quality investigations and staff accordingly.

High-potential investigations should not be a side responsibility. They should be led by highly skilled professionals assigned full-time to the role.

Effective investigators must be proficient in:

• Identifying immediate exposures
• Evaluating SIFp
• Conducting root cause analysis
• Recognizing systemic contributors
• Understanding Safe Decision-Making® principles

Investigation is a discipline. It requires expertise, not convenience.

3. Develop Exposure Control Plans for Top SIF Exposures

Once leading SIF exposures are identified, the organization needs to create an Organizational Exposure Control Plan Document. This document identifies (in shorthand) all the actions the organization is taking to ensure exposures are being controlled and employees are well equipped to control exposures.

Once the Organizational Control Plan is developed, the next step is to identify the Critical Controls associated with each High Risk Task. High risk tasks have an inherent  SIF Exposure.  Critical Controls are the controls that must absolutely be in place at the point of work to control the exposure or mitigate the impact should something unexpected happen.  The critical controls become the basis of the critical control verification observation form.

When a future incident involves one of these exposures, the investigation should begin by evaluating all elements of the Exposure Control Plan. The investigation should focus on:

• Plan implementation effectiveness
• Gaps in execution
• Flaws in the plan

This approach shifts investigations from focusing on the incident as a one-off event to looking closely at whether the organization has lived up to its commitment to control SIF exposures.

4. Set Up Structured Learning Sessions

Investigation findings should not stop at corrective actions. They should drive organizational learning.

Structured learning sessions should be implemented at all levels, where:

• Incident themes are analyzed
• Decision-making impacts are explored
• Role-specific responsibilities are discussed
• Leaders examine how strategic choices shape frontline risk

True learning occurs when individuals understand how their decisions influence outcomes, not when they simply receive an alert.

5. Simplify and Strengthen Data Collection

Most investigation forms collect far more information than necessary. Every data field should be critically evaluated:

• Is it needed for compliance?
• Does it meaningfully improve understanding?
• Does it support identification of unique factors that led to an unusual increase in incidents and exposures?
• Is it structured in a way that enhances data quality?

Fields that do not serve a clear purpose should be eliminated. Overcomplicated systems dilute focus and produce low-quality insights. The goal is not more data—it is better data.

Conclusion:  Better Incident Investigations Can Start Now

Fixing the investigation system is not about refining paperwork. It is about redesigning how the organization understands exposure, responds to signals, and learns from experience.

When done well, incident investigation becomes one of the most powerful tools an organization has for building a strong culture, preventing serious injuries and fatalities, and improving decision-making.

And that is work worth doing.

For more information about the key practices discussed in this article, watch our recorded webinar, “It is Time for Incident Investigation Disruption: We Can Do Better” on YouTube.