Incident Investigation: 4 Evidence Breaks That Let a Known Hazard Return

F1 critical diagnostic for EHS leaders, operations managers, and investigation teams

The report is finished, the photographs are filed, and the corrective-action tracker shows every item in green. Three months later, a supervisor faces the same production pressure, the same temporary condition, and the same unclear decision. The hazard has returned because the investigation changed the record without changing the work.

That is the central problem with many incident investigations. They reconstruct the event accurately, then mistake a plausible explanation for risk reduction. A useful investigation must answer a harder question. What evidence will show that the organization now makes a different decision when the same exposure appears?

Across more than 250 cultural transformation projects supported by Andreza Araujo’s teams, this distinction separates learning that reaches the field from paperwork that only reaches the archive. The four evidence breaks below help an EHS leader test that distinction before approving closure.

Why a credible timeline is not enough

A timeline is necessary because investigators need to see sequence, timing, information, and decisions. It is not sufficient because sequence alone does not explain why the available controls failed to influence the work.

James Reason’s work on active and latent failures provides a useful lens. The visible action may be close to the event, while the conditions that shaped that action may have been established days, months, or years earlier. A procedure that does not fit the task, a supervisor who cannot delay production, and an inspection that rewards completion instead of control quality can all sit behind the final error.

The investigation therefore needs two products. The first is an evidence-based account of what happened. The second is a control-change argument that explains why a comparable event should now be less likely or less severe. If the second product is missing, the investigation remains descriptive.

Evidence break 1: the problem statement is narrower than the exposure

Many investigations begin with a statement such as “an employee bypassed the guard” or “a contractor entered without authorization.” Those statements may be true, but they define the event at the smallest possible scale. They make the investigation search for a personal correction instead of an exposure pathway.

A stronger problem statement names the hazardous condition, the decision point, and the control that should have interrupted the sequence. For example, the question might become, “Why could energized equipment be accessed during a maintenance window when isolation status was not independently verified?” That wording does not excuse the action. It makes the system visible enough to examine.

The difference matters because the first sentence often predicts the final action. A narrow statement produces retraining, reminders, or discipline. A precise exposure statement prompts questions about isolation design, authorization, supervision, work planning, and verification.

Before the team interviews witnesses, ask whether the problem statement could describe a repeat event without naming a person. If it cannot, the investigation has probably begun too close to the final action.

Evidence break 2: the narrative stops at the operator

Operators matter, and their decisions deserve careful attention. The investigation fails when it treats the operator as the endpoint of causation rather than one part of a chain that includes design, information, resources, and leadership.

Ask what the person knew, what the person believed was permitted, what the task required in real time, and which competing demand shaped the decision. Then ask who designed the conditions in which that decision was made. Those questions often reveal that a local shortcut was already embedded in the normal work sequence.

Andreza Araujo addresses this pattern in Sorte ou Capacidade, known in English as Luck or Capability, where accidents are treated as organizational events rather than isolated acts. The practical implication is direct. If the action plan only retrains the person closest to the event, it has not tested the conditions that made the action reasonable, convenient, or difficult to challenge.

An investigation should leave a trace of the questions asked beyond the operator. Review the work design, staffing, maintenance state, supervisor decisions, contractor interface, and production commitments. The absence of that evidence is itself a sign that the investigation was too narrow.

Evidence break 3: the action changes the document, not the decision

Document revisions are sometimes necessary, but a revised form does not prove that the risk has changed. A procedure can gain two pages while the supervisor still has no authority to stop the work, the equipment still invites bypass, and the field verification still happens after the task begins.

Test every proposed action against the decision it is supposed to change. If the risk involves isolation, the action should show how isolation is selected, applied, verified, and released. If the risk involves a temporary repair, the action should define who accepts the condition, what limits apply, and when escalation is mandatory.

Use the hierarchy of controls as a challenge to weak action design. Administrative reminders may support a control, but they should not automatically replace elimination, substitution, engineering protection, or a more reliable authorization process. When the action is only “retrain employees,” ask which barrier remains dependent on memory and attention.

A useful review table can expose the gap quickly.

Evidence break 4: closure is based on completion, not proof

Action trackers create a dangerous illusion because a closed item often means that someone uploaded a file, not that the control performed under operating pressure. Completion is an administrative state. Verification is a risk judgment.

The evidence must match the action. A revised procedure needs field observation. A new interlock needs a functional test. A change in supervisor authority needs a decision record that shows the authority was used. A new contractor gate needs proof that the gate stopped or changed a real mobilization decision.

Closure also needs a named reviewer who was not responsible for merely completing the task. That separation matters because the person who implements a change is often too close to its success criteria. The reviewer should be able to ask whether the control worked when the work was busy, abnormal, or commercially inconvenient.

When the evidence cannot be collected, the action may be too vague. Rewrite it until another competent person can tell what to observe, what acceptable performance looks like, and what decision follows if the control fails.

What a serious investigation should preserve

A strong file preserves more than photographs and interview notes. It preserves the decision environment, including the information available at the time, the constraints that shaped the work, the status of critical controls, and the points where someone could have escalated or stopped the task.

That record protects the investigation from hindsight bias. People naturally explain an event as though the outcome was obvious, although the people involved were making decisions with incomplete information and competing demands. The investigator’s task is to reconstruct what was knowable, what was expected, and what was actually verified.

The file should also distinguish between evidence of presence and evidence of effectiveness. A checklist proves that a question was printed. It does not prove that the answer was accurate. A training record proves attendance. It does not prove that the person can recognize the changed condition that matters.

How leaders can review an investigation in 20 minutes

Senior leaders do not need to reread every interview to test investigation quality. They need a short review that focuses on exposure, control, ownership, and proof.

• Ask which high-consequence exposure was present and whether the problem statement names it clearly.
• Ask which control should have prevented or limited the event, then request evidence of its performance before and after the action.
• Ask which operational function owns the changed condition and what authority that owner has when production pressure rises.
• Ask what will be observed in the field, by whom, and before what date the result will be reviewed.

If the team cannot answer those questions without returning to general language, the investigation is not ready for closure. A concise review is valuable because it tests the action plan at the level where risk is accepted.

What to do when the same hazard appears again

A repeat exposure should not be treated as proof that workers ignored the lesson. It should trigger a comparison between the previous investigation and the current work condition. Did the control exist, was it available, was it used, and did anyone have authority to challenge the deviation?

Compare the two decision environments rather than comparing only the people involved. If the same production demand, equipment weakness, contractor interface, or unclear approval path appears again, the organization has evidence that the earlier action did not reach the cause of exposure.

At that point, reopening the investigation is appropriate. The purpose is not to punish the team for an old action. The purpose is to correct the organization’s understanding of what it believed had changed.

The leadership test for investigation quality

Across 25+ years leading EHS in multinational operations, Andreza Araujo has seen that safety culture becomes visible in decisions under pressure, not in declarations made when conditions are calm. The same test applies to incident investigations.

Ask whether the next supervisor, contractor, or maintenance planner would make a different decision because of the investigation. If the answer depends on remembering a new slogan, the risk reduction is fragile. If the answer is supported by a changed barrier, clearer authority, better information, and field evidence, the investigation has begun to create capability.

Her book Safety Culture: From Theory to Practice treats culture as something that is operated through habits, leadership choices, and visible consequences. An investigation becomes part of that culture when it changes what the organization accepts, verifies, and escalates.

Conclusion: close the evidence break, not just the action

The most important question after an incident is not whether the report is complete. It is whether the organization can prove that the next comparable exposure will meet a different control, a different decision, or a different escalation path.

Start with the four evidence breaks. Define the exposure precisely, investigate beyond the operator, change the decision rather than only the document, and close the action only after field proof. That sequence turns incident investigation from a record of the past into a test of present control reliability.

Andreza Araujo’s work on safety culture, leadership, and risk decisions offers a practical direction for teams that want investigations to produce more than compliance. For further resources on building safer decisions, visit Andreza Araujo.