Incident Evidence: Facts, Interpretations, Assumptions

Incident evidence is not the same as an incident story. A photograph, a witness account, a system record, and an investigator's explanation may all describe the same event while carrying different levels of certainty. This distinction matters because a confident interpretation can close an investigation before the work has been understood.

Incident evidence is information that helps test what happened, when it happened, and which conditions shaped the outcome. Investigators should label each item as an observed fact, an interpretation, or an assumption, because mixing those categories makes weak explanations look proven and sends corrective actions toward the wrong failure path.

What does incident evidence mean?

Incident evidence is any reliable information that helps reconstruct the event and examine the controls around it. It may include photographs, equipment data, permits, procedures, access records, physical conditions, medical information, or accounts from people who saw the work.

The useful question is not whether a source sounds convincing. The question is what the source can actually establish. A record can show that a permit was signed, but it may not show that the crew understood the control or that the barrier remained usable during the task.

James Reason's work on active and latent failures supports this discipline. The visible action is only one part of the explanation, while decisions, conditions, supervision, design, and local pressure may have shaped the path long before the event.

What counts as a fact?

A fact is an observation that can be checked against a source without adding a conclusion. “The guard was open at 14:20” is more precise than “the operator bypassed the guard,” unless the investigation has already verified who opened it and why.

Facts should carry a source, time, location, and level of confidence. A camera timestamp, a machine log, or a dated photograph can strengthen the record, while an unrecorded memory may still matter but should be marked for confirmation.

The article on incident evidence preservation is useful at this stage, because evidence that is not protected early can become impossible to test later.

What is an interpretation?

An interpretation connects facts into a possible explanation. It may be reasonable, but it remains a working explanation until other evidence supports it. “The crew may have continued because the isolation status was unclear” is an interpretation that can be tested through the permit, handover records, and interviews.

Investigators need interpretations because a list of disconnected facts does not explain how controls failed. The discipline is to keep the language proportional to the evidence, especially when a familiar label such as human error appears before the surrounding conditions have been examined.

Andreza Araújo's book Safety Culture: From Theory to Practice reinforces this distinction by treating culture as something visible through decisions and routines, not as a convenient explanation added after the event.

What is an assumption?

An assumption is a belief used to fill a gap before the gap has been verified. “The worker knew the procedure” may be plausible, yet it is not evidence unless training, communication, task conditions, and practical understanding have been checked.

Assumptions are dangerous when they disappear into final reports. Once written as fact, they can make an investigation blame the last person involved while leaving the design or management conditions untouched. Andreza's Sorte ou Capacidade, translated as Luck or Capability, is a useful anchor for resisting that shortcut.

How should investigators separate the three categories?

Use a three-column evidence log during the first review. Put the exact observation in the first column, the current interpretation in the second, and the missing verification in the third. Every interpretation should point to a test, and every assumption should either gain evidence or be removed from the explanation.

Compare sources rather than counting statements. The comparison of photos, witness statements, and equipment logs shows why different sources answer different questions. A witness may explain sequence and pressure, while a machine record may establish timing more reliably.

During the review board, ask which conclusion would change if one unverified assumption proved false. That question keeps the team from treating a neat narrative as a complete explanation. It also connects the evidence review to the decisions that keep an RCA from becoming paperwork.

Why does the distinction improve corrective actions?

Corrective actions improve when they respond to verified conditions rather than to an untested story. A training action may be appropriate when knowledge was missing, but it is weak when the procedure was unusable, the isolation was unclear, or production pressure made the expected sequence unrealistic.

Across 25+ years leading EHS at multinationals, Andreza Araújo has observed that strong investigations do not rush to name a person. They make the evidence strong enough to show which barrier failed, which condition weakened it, and who has the authority to restore it.

Incident evidence becomes valuable when it preserves uncertainty long enough to test it. Facts establish the ground, interpretations guide the inquiry, and assumptions identify the work still required before leaders can trust the conclusion.

FAQ

What is the difference between evidence and an incident explanation?

Evidence is information that can be checked, while an incident explanation is a conclusion built from that information. A good explanation shows which facts support it and which uncertainties remain.

Can a witness statement be treated as a fact?

A witness statement is evidence of what the person perceived and remembers. Specific details can be treated as observations, but the investigator should still compare them with records and physical conditions before treating the full account as established fact.

Why are assumptions a problem in root-cause analysis?

Assumptions can make an untested belief look like a verified cause. They often push corrective actions toward retraining or discipline while leaving equipment, workload, supervision, design, or decision conditions unchanged.

What should an investigator do when sources disagree?

Record the disagreement, preserve each source, identify what each source can establish, and define the next verification step. Do not force agreement simply to make the report read cleanly.

How can leaders use this distinction after an incident?

Leaders can require every major conclusion to show its supporting facts, open assumptions, and control owner. That makes review meetings more rigorous and helps the organization restore barriers instead of closing actions for appearance.

For practitioners who want a deeper diagnostic method, Andreza Araújo's Safety Culture Diagnosis offers a practical way to connect evidence, decisions, and culture. Explore the books and guides when the investigation needs to change the work, not only complete the report.