Incident Investigation

Incident Evidence: 8 Myths That Make Investigations Less Reliable

Incident investigations become unreliable when photographs, witness accounts, timelines, and root-cause claims are treated as facts without testing their limits. These eight myths help investigators preserve evidence, separate observation from interpretation, and produce actions that address the conditions that allowed the event.

By 6 min read
investigative scene on incident evidence 8 myths that make investigations less reliable — Incident Evidence: 8 Myths That Mak

Key takeaways

  1. 01Evidence is not the same as a conclusion, even when the record looks complete.
  2. 02Photographs, witness statements, procedures, and digital logs each reveal only part of the event and require context.
  3. 03Investigators should separate what was observed from what was inferred before they assign causes or corrective actions.
  4. 04James Reason’s distinction between active and latent failures helps investigators examine decisions, conditions, and barriers beyond the final action.
  5. 05The strongest investigation ends with verified changes in work, not only a polished report or a closed action list.


An incident investigation becomes less reliable when a complete-looking record is treated as proof that the event has been understood. A photograph can show a condition without showing its history. A witness can describe a sequence without remembering every interruption. A procedure can define intended work while the crew operates under different constraints.

Investigators must separate observation from interpretation, compare independent sources, and keep uncertainty visible until the evidence supports a conclusion. The goal is to identify which conditions allowed the exposure and which changes will prevent a recurrence.

Key Takeaways

  • Evidence is not the same as a conclusion, even when the record looks complete.
  • Photographs, witness accounts, procedures, and digital logs each reveal only part of the event and require context.
  • Investigators should separate what was observed from what was inferred before assigning causes or actions.
  • James Reason’s distinction between active and latent failures helps investigators examine conditions beyond the final action.
  • The strongest investigation ends with verified changes in work, not only a polished report.

Why evidence quality matters more than report volume

A long report can still be weak when it contains repeated descriptions, unsupported assumptions, and actions that do not change the work. James Reason’s work on organizational accidents is useful because it distinguishes active failures at the workface from latent conditions embedded in planning, design, resources, and supervision.

The investigator’s job is not to collect everything. It is to collect enough reliable evidence to test competing explanations and show where the operating system made the exposure possible.

Myth 1: The first account is the most accurate account

The first account is often the most available account, not the most accurate one. People reconstruct a sequence from partial views, sounds, expectations, and conversations after the event.

Interview promptly, but do not turn speed into certainty. Ask what the witness saw, heard, touched, and decided before asking why the decision made sense. Compare the account with equipment status, permits, radio traffic, and the physical scene. “The operator saw the valve open” is different from “the valve was opened by the operator.” The first may be an observation. The second requires corroboration.

Myth 2: A photograph preserves the whole scene

A photograph preserves a frame, not the event. It can show a guard, spill, tool, or damaged component, but it rarely shows what changed before the camera arrived. The angle may hide access, lighting, line of sight, stored energy, or the sequence of work.

Photograph broadly before moving to detail, then record location, time, orientation, lighting, and changes made for rescue or stabilization. When the area has changed, mark the image as a reconstruction and describe its basis.

Myth 3: The procedure is what happened

A procedure shows the intended method. It does not prove that the method was available, understood, supervised, or workable under the conditions present that day.

Read the procedure alongside the permit, task plan, equipment condition, staffing, shift handover, and local instructions. Ask which step was difficult to execute and what the team did when the written sequence met physical reality. This does not excuse a departure. It makes the departure analyzable.

Myth 4: A witness statement is a factual transcript

A witness statement is a person’s account of an experience. It can contain direct observations, assumptions, later explanations, and language borrowed from other conversations.

Use open prompts before testing a theory. Ask what happened next, what the person expected, and what information was available at the decision point. When accounts conflict, record the conflict instead of averaging them into a convenient sentence. A neutral process improves evidence quality when the interview concerns production pressure or known equipment defects.

Myth 5: The last action explains the event

The last action is visible, which makes it attractive as an explanation. Yet it usually occurs inside a chain of preparation, information, equipment, supervision, and competing priorities.

Test what the person knew, what the person could see, which controls were available, and what would have happened if the person had stopped. Then trace earlier decisions that affected those conditions. A behavior can be part of the causal chain without being the complete cause.

Myth 6: A signed training record proves competence

A training record proves that an administrative event was recorded. It does not prove that the person understood the hazard, could perform the task, or had the equipment and time required to apply the instruction.

Review practical demonstration, supervision, task complexity, language, changing conditions, and the opportunity to ask questions. Training is weak when it is used to avoid redesigning equipment, improving isolation, clarifying ownership, or removing conflicting production demands.

Myth 7: A root cause is a single sentence

A single sentence can summarize an explanation, but serious incidents often involve interacting conditions. The phrase “operator error” may describe the final action while hiding a poor interface, ambiguous instruction, delayed maintenance response, and supervision gap.

Use a causal map or timeline to show how conditions connected. Andreza Araújo’s book A Ilusão da Conformidade, translated as The Illusion of Compliance, is relevant because a documented rule can create a false sense of control when operating conditions have not been verified. A root-cause sentence should point toward a condition that can be changed and checked.

Myth 8: Closing the action closes the risk

An action is not complete because a person uploaded a document, signed a training list, or marked a task closed. Closure means the exposure changed and the new control works under the conditions that produced the event.

Define acceptance criteria before assigning the action. The owner must have authority to make the change, while the verifier must be able to challenge a weak result. If the work still depends on memory, heroics, or silent workarounds, the risk has not been closed.

How to build a more defensible evidence trail

Write a timeline with three columns. Record what was observed, what source supports it, and what remains uncertain. Then compare the evidence across the physical scene, the human account, the work system, and barrier performance.

When the evidence does not support a confident conclusion, state the uncertainty and identify the next verification step. Honest limits are stronger than false precision when leaders decide whether similar exposure exists elsewhere.

For a practical review routine, compare this evidence trail with the five decision gaps that turn a timeline into a story and the evidence-preservation steps to take before the worksite changes.

What investigators should ask before issuing the report

Ask whether each important statement is an observation, an inference, or an unanswered question. Ask whether the investigation tested the work as performed, not only as the procedure describes it. Ask whether the proposed actions change the conditions that made the exposure possible.

If the answer is only that people were reminded to be careful, the investigation has not reached a reliable control. Safety Culture: From Theory to Practice connects culture with routines, decisions, and consequences. The report should make the next safe decision easier for the person doing the work and more visible to the leader responsible for the system.

Make investigations change the work. Explore Andreza Araújo’s safety culture resources for methods that connect evidence, leadership, and prevention.

Frequently Asked Questions

What counts as evidence in an incident investigation?

Evidence helps test what happened, when it happened, and which conditions influenced the event. It can include physical conditions, photographs, equipment data, documents, timelines, witness accounts, training records, and work-planning information. Each source has limits, so investigators should compare sources.

Why separate facts from interpretations?

A fact describes what was observed or reliably recorded, while an interpretation explains what that observation may mean. Keeping them separate makes uncertainty visible and prevents an early theory from shaping later interviews and corrective actions.

Are witness statements reliable after an incident?

They can be valuable when collected promptly and compared with physical and digital evidence. Memory is affected by stress, sequence confusion, social pressure, and hindsight, so a statement is one source in a tested timeline.

What makes a corrective action strong?

A strong action changes a contributing condition, has an owner with authority, includes acceptance criteria, and is checked under the operating conditions in which the risk appears. A document revision or training record alone does not prove control.

How can an investigation avoid blaming the operator?

Examine planning, equipment, staffing, supervision, competing priorities, procedures, and barrier effectiveness around the final action. Individual accountability can remain part of the review, but it should not replace analysis of the conditions that shaped the decision.

Topics incident-investigation incident-evidence root-cause-analysis SIF James Reason corrective-actions field-evidence

Frequently asked questions

What counts as evidence in an incident investigation?
Evidence helps test what happened, when it happened, and which conditions influenced the event. It can include physical conditions, photographs, equipment data, documents, timelines, witness accounts, training records, and work-planning information. Each source has limits, so investigators should compare sources.
Why separate facts from interpretations?
A fact describes what was observed or reliably recorded, while an interpretation explains what that observation may mean. Keeping them separate makes uncertainty visible and prevents an early theory from shaping later interviews and corrective actions.
Are witness statements reliable after an incident?
They can be valuable when collected promptly and compared with physical and digital evidence. Memory is affected by stress, sequence confusion, social pressure, and hindsight, so a statement is one source in a tested timeline.
What makes a corrective action strong?
A strong action changes a contributing condition, has an owner with authority, includes acceptance criteria, and is checked under the operating conditions in which the risk appears. A document revision or training record alone does not prove control.
How can an investigation avoid blaming the operator?
Examine planning, equipment, staffing, supervision, competing priorities, procedures, and barrier effectiveness around the final action. Individual accountability can remain part of the review, but it should not replace analysis of the conditions that shaped the decision.

About the author

Andreza Araújo

Safety Culture Expert | Senior EHS Executive

Andreza Araújo is a safety culture expert and senior EHS executive with more than 25 years of experience in environment, health and safety. She is a Civil Engineer and Occupational Safety Engineer from Unicamp, holds a Master's degree in Environmental Diplomacy from the University of Geneva, and completed sustainability studies at IMD Switzerland. Andreza has served in Global Head of EHS roles in Fortune 500 environments, leading cultural transformation programs across multinational operations. She has represented Brazil as a speaker at the United Nations in Paris and has spoken at the International Labour Organization in Turin. She is the author of more than 16 books on safety culture in Portuguese, Spanish, English and German. Her work has earned more than 10 EHS awards, including two recognitions from Indra Nooyi, former PepsiCo CEO.

  • Civil & Safety Engineer (Unicamp)
  • M.A. Environmental Diplomacy (University of Geneva)
  • Sustainability Cert (IMD Switzerland)
  • People Management & Coaching (Ohio University)
  • UN Paris speaker representative for Brazil
  • ILO Turin speaker
  • LinkedIn Top Voice
  • Indra Nooyi PepsiCo CEO recognition (2x)

Documentaries

Watch Andreza's documentaries

Three productions on safety culture, organizational failure and the human lessons behind major disasters.

Podcasts

Listen to Andreza's podcasts

She hosts three shows on safety leadership, EHS and organizational culture, in English and Portuguese.

Summarize with AI