How to Reconstruct an Incident Decision Timeline in 48 Hours

After an incident, the first account usually explains what happened at the point of contact. It rarely explains why the work was allowed to continue, which warning was discounted, or where a decision owner could have changed the outcome. That missing layer is the decision timeline.

This guide gives a supervisor or EHS manager an 8-step method to reconstruct that timeline in 48 hours without turning the review into a blame exercise. The aim is not to produce a longer report. It is to identify the earliest decision that changed the exposure, preserve the evidence around it, and give the right owner a corrective decision that can be verified.

The HSE explains that effective investigations should identify immediate, underlying, and root causes, while evidence preservation before the worksite changes protects the quality of every later conclusion.

Step 1: Set the review boundary before collecting opinions

Write one sentence that defines the event, the work package, the operating period, and the decision you need to explain. A useful boundary includes the last known safe state, the first change in exposure, and the point at which the incident became unavoidable.

Do not begin with a conclusion such as operator error or inadequate attention. Begin with a question that can be tested, such as, “Which decision allowed the changing exposure to remain untreated?” This wording keeps the review connected to work conditions, supervision, equipment status, and production pressure.

Record the boundary at 09:00 on day one, name one review owner, and set a 48-hour evidence freeze for the first reconstruction. The freeze does not end the investigation. It creates a stable first version that can be challenged later without allowing memories and records to drift together.

Step 2: Preserve 5 evidence streams before interviewing people

Collect five evidence streams in parallel. Start with the physical scene, then gather permits and work instructions, digital records, equipment or control-system data, and the messages or decisions that moved through supervision.

For each item, record its source, timestamp, custodian, condition, and location. Photograph the scene before cleanup changes the relationship between objects. Export system data rather than relying on a screenshot, because the export can preserve the time zone, revision history, and metadata that a screenshot removes.

OSHA describes incident investigation as a way to identify hazards and failures in controls. That purpose is lost when the review stores only statements and omits the work records that show what people were asked to do.

Step 3: Build two timelines instead of one

Create an event timeline and a decision timeline. The event timeline records what changed in the equipment, environment, task, or person’s position. The decision timeline records when someone noticed a signal, interpreted it, communicated it, accepted an exposure, or chose to continue.

Use the same clock for both timelines. If one record uses local time and another uses control-room time, keep the original timestamp and add a normalized time beside it. Never silently overwrite a record because a later account appears more plausible.

Mark each entry as observed, recorded, reported, or inferred. Inferred entries belong in a separate lane until another source confirms them. This simple separation exposes where the investigation is relying on a confident story rather than evidence.

Step 4: Interview 3 people in the order of the work

Interview the person closest to the changing exposure, the supervisor who received or should have received the signal, and the decision owner who controlled the next action. The order matters because the first interview can anchor every later question.

Ask each person to describe the task before asking what they think caused the incident. Use the same five prompts for every interview: What did you expect? What changed? What did you notice? What options were available? Who could authorize a pause or restart?

Separate observation from interpretation in your notes. “The alarm was heard at 14:12” is an observation if a record supports it. “The alarm was ignored because production pressure was high” is an interpretation until the evidence shows what was communicated, by whom, and when.

Step 5: Test the first explanation against 4 alternatives

Most early explanations are too narrow because they describe the final action rather than the conditions that made that action reasonable or difficult. Test the first explanation against four alternatives, including a control that was unavailable, a signal that was ambiguous, a work plan that had changed, and a supervision or escalation path that failed.

For each alternative, write the supporting evidence, the contradicting evidence, and the evidence still missing. Do not rank an explanation because it sounds familiar. Rank it only after the review has compared it with the records and conditions that shaped the decision.

James Reason’s work on organizational accidents remains useful here because it directs attention toward latent conditions that line up with active failures. A decision timeline makes those conditions visible without pretending that the final action had no role.

Step 6: Identify the earliest decision that changed exposure

Circle the earliest point where a different decision could have reduced exposure without requiring perfect performance later. That point might be a maintenance deferral, an incomplete handover, an unchallenged change in scope, a missing exclusion zone, or a supervisor’s decision to continue while a control was uncertain.

Use a 30-minute challenge meeting with the supervisor, the technical specialist, and the decision owner. Ask what information was available at that moment, what constraint was active, and what authority existed to pause the work. If the answer depends on a policy that nobody could access or interpret during the task, record that as a system condition.

Step 7: Convert findings into 3 owner-bound decisions

Write three decisions, not a long list of actions. The first decision should remove or reduce the exposure. The second should repair the control or work design that allowed the exposure to persist. The third should test whether the repaired control works in the field.

Every decision needs one accountable owner, one due date, one verification method, and one escalation route. “Retrain the team” is not a decision until the review explains which knowledge or skill gap contributed, how competence will be checked, and what stronger control will carry the risk when a person is tired, rushed, or new to the task.

The NIOSH hierarchy of controls places elimination and engineering controls above administrative measures and PPE. Use that hierarchy when ranking actions, because a briefing can clarify a task while leaving the exposure itself unchanged.

Step 8: Verify the timeline and decisions after 14 days

Close the first review after the 48-hour reconstruction, but schedule a 14-day verification before the investigation is considered effective. At that checkpoint, sample the changed work, inspect the control, and ask the people who perform the task whether the decision is visible in practice.

Compare the original timeline with the verified conditions. If the control exists only in a revised procedure, the decision is not yet complete. If the control works but the escalation route remains unclear, keep the action open and assign that gap to its owner.

Keep the final record for 90 days of review history, including the original evidence, disputed interpretations, accepted residual risk, and verification result. The record should help the next supervisor recognize the same exposure before an incident repeats.

What should the review owner do next?

The review owner should publish the verified decision timeline to the people who control the work, not only to the investigation file. In a mature review, the useful output is a change in authority, equipment, planning, or verification that workers can see before the next task begins.

Use the 30-day corrective-action verification method when the incident requires a longer control test, and compare the investigation with evidence-based investigation methods when the causal path remains disputed.

A decision timeline is complete when another competent person can trace the exposure from its first change to the decision that should have interrupted it, then confirm that the new control works in the field. That standard is more demanding than assigning blame, and it is far more useful for preventing the next serious event.