ICAM Investigation: 7 Controls Before Causes

Safety Wise describes ICAM as a method used in more than 140,000 training journeys across 43 countries, yet many organizations still reduce it to a colored chart after an event. This article shows how an EHS manager can use ICAM to validate failed defenses, protect evidence, and produce corrective actions that reduce SIF exposure.

Why ICAM fails when it becomes a form

ICAM investigation is effective only when the team treats the method as a disciplined search for failed defenses, absent controls, task conditions, and organizational decisions. If the worksheet becomes the objective, the investigation may look mature while the operation keeps the same exposure that allowed the event.

Across 25+ years leading EHS at multinationals, Andreza Araujo has observed that serious incident reviews often lose their value in the first two hours because leaders rush toward a cause label before facts are stable. That is why incident evidence preservation is not an administrative courtesy. It is the foundation of any credible ICAM output.

The practical test is simple enough for a plant manager to understand. If the final report cannot show which barrier failed, how it was verified, who owned the barrier, and what will change before similar work resumes, the ICAM process has documented the event without controlling the next one.

1. Freeze the event before the story hardens

The first ICAM control is to separate fact capture from interpretation because memory, hierarchy, and production pressure begin shaping the story as soon as the event is reported. In serious events, the first hour decides whether the investigation will examine the work system or merely confirm the first explanation heard by management.

James Reason's work on active failures and latent conditions matters here because it keeps the team from stopping at the visible action. As Andreza Araujo argues in *Safety Culture: From Theory to Practice*, a mature safety culture protects the conditions for truth before it asks for performance improvement.

The EHS manager should lock the scene, secure photos, preserve digital records, identify who touched equipment after the event, and record the operating state before cleanup begins. The report should show a short evidence log, not because auditors enjoy paperwork, but because later ICAM categories depend on facts that can be traced.

2. Map failed defenses before naming root causes

ICAM should start with failed or absent defenses because those defenses are the visible promise the organization made before the job began. A permit, guard, isolation point, alarm, procedure, supervisor check, or engineering control either held, failed, or was never present in the work as performed.

What most investigation reports miss is the difference between a defense listed in a procedure and a defense that workers could actually use under time pressure. During the PepsiCo South America tenure, where the accident ratio fell 50% in six months, Andreza Araujo learned that visible field verification beats elegant corporate language.

Use a barrier table at this stage. For each defense, write the intended function, the observed condition, the verification source, and the gap. This keeps the ICAM team from turning a missing guard, a bypassed interlock, or a weak handover into a vague statement about attention.

3. Interview for work conditions, not confession

ICAM interviews should reconstruct the work conditions that made the action sensible at the time, which is different from asking people to defend themselves. The goal is to understand workload, supervision, tools, environment, competing goals, competence, and available information.

The trap is subtle because investigators often believe they are neutral while their questions already carry a conclusion. Questions such as who failed to follow the procedure close the inquiry too early, whereas witness statements should show what the person saw, knew, expected, and could control.

Use separate interviews, ask for a task walk-through, and compare accounts against physical evidence. If two accounts conflict, record the conflict as data. Do not flatten it into consensus, since contradiction often reveals a shift handover gap, unclear role boundary, or production signal that the procedure never captured.

4. Classify causes only after the barrier logic is visible

Cause categories in ICAM are useful only after the team can see the path from event to defenses, task conditions, individual actions, and organizational factors. Classification before mapping usually produces tidy labels and weak controls.

In *Sorte ou Capacidade*, glossed in English as *Luck or Capability*, Andreza Araujo argues that accidents should not be treated as random bad luck when the organization had repeated signals before the event. That position is especially important in SIF investigations, where weak precursors often appear in maintenance backlog, permit quality, supervisor overload, or repeated deviations.

The EHS manager should challenge every cause statement with one question. What evidence proves this category? If the answer is opinion, rewrite the statement or return to evidence collection. ICAM is not a vocabulary exercise, because category names do not save lives unless they point to a controllable condition.

5. Separate corrective actions from comfort actions

Corrective actions after ICAM must change the conditions that made the event possible, not merely demonstrate that management reacted. Retraining, toolbox talks, and disciplinary reminders may be fast to assign, although they rarely change engineering gaps, staffing pressure, maintenance backlog, or unclear decision rights.

In more than 250 cultural-transformation projects supported by Andreza Araujo's team, the recurring pattern is that organizations prefer actions that are easy to close in software. The stronger action is often less comfortable because it touches production planning, capital expenditure, contractor qualification, supervision routines, or design assumptions.

Before accepting an action, test it against the failed defense. If a lifting plan failed because field conditions changed, the action should improve lift-plan revision authority, pre-lift verification, and stop criteria, not only repeat rigging training. Strong post-incident action plans make the new control observable in the work.

6. Use ICAM with Five Whys without confusing the tools

ICAM and Five Whys can work together when Five Whys is used as a probing technique inside a broader investigation structure. Five Whys alone can be too narrow for SIFs because it often follows one causal chain while ICAM asks the team to examine several layers of the work system.

The common error is to run Five Whys for SIFs, paste the chain into an ICAM template, and claim that the organization has completed a systemic investigation. That shortcut hides missing defenses because the team has not tested whether controls existed, functioned, were supervised, and were practical under the actual work conditions.

Use Five Whys to deepen one branch, then return to the ICAM map and ask what other branches remain unexplored. This rhythm gives the investigation depth without letting one attractive explanation consume the whole report.

7. Close the loop with verification, not signatures

An ICAM investigation is not closed when every action owner signs the tracker, because signatures confirm administrative movement, not risk reduction. Closure should require field verification that the new control exists, is used, and still works after supervisors stop watching.

This is where safety culture and investigation quality meet. In *Safety Culture Diagnosis* (Araujo), the central thesis is that culture appears in what people do when no campaign is running, which means ICAM closure should inspect ordinary work, not a prepared demonstration.

Set a 30-day and 90-day verification point for high-risk actions. Ask whether the same job can now be performed with a stronger defense, clearer authority, and less dependence on perfect human attention. If the answer is no, the finding remains open even if the software says complete.

Each week without verification leaves the organization exposed to repeated precursor events, while the report gives leaders a false sense that risk has already been reduced.

ICAM compared with common investigation shortcuts

ICAM creates value when it protects the investigation from shallow speed, especially after events that could have produced a fatality. The table below shows where the method changes the quality of decisions.

Conclusion

ICAM investigation works when it forces leaders to prove which defenses failed, why they were weak, and how the operation will be different before the next similar job starts. It fails when the report becomes a polished explanation that leaves the work unchanged.

If your organization needs to strengthen investigation quality after SIFs, near misses, or repeated precursor events, ACS Global Ventures can support diagnosis, leadership alignment, and implementation. Safety is about coming home, and that promise depends on investigations that change the field, not only the file.