Incident Investigation: 4 Questions That Reveal When the Root Cause Is Still Missing

The investigation is closed, the corrective action is assigned, and the report names the unsafe act. Yet the same exposure remains in the work system. That is the moment when a polished investigation becomes a dangerous document, because it gives leaders confidence without proving that the conditions behind the event have changed.

A useful investigation must explain how the event was constructed. Andreza Araújo frames this idea in Luck or Capability, where an accident is treated as the late result of barriers and decisions rather than a matter of chance. The practical test is not whether the report found a person to blame. It is whether the report can show why the event made sense at the time, what defenses failed, and which decisions will prevent the same pathway from opening again.

Why finding an unsafe act is not enough

The last unsafe act is easy to see because it is close to the outcome. A technician bypasses a guard, a driver enters a restricted zone, or a supervisor accepts an incomplete check. The visible act deserves attention, but it does not explain why the act was possible, why the normal barrier did not catch it, or why the surrounding work made the decision appear reasonable.

James Reason’s distinction between active and latent failures helps investigators avoid this trap. An active failure occurs close to the event, while latent conditions sit in design, planning, supervision, maintenance, workload, training, or management decisions. When a report stops at the active failure, it records the final movement while leaving the pathway intact.

That pathway usually contains several ordinary choices. The job was scheduled with a narrow production window. The permit was copied from an earlier task. The replacement part was unavailable. The supervisor had three areas to cover. The team had reported a similar deviation, but no one had closed the loop. None of these details excuses an unsafe decision. Together, they explain how the decision became likely.

The first question, therefore, is not “Who failed?” It is “What had to be true for this event to develop?” The answer should lead the team toward the four diagnostic questions below.

1. What did the person believe was safe enough?

Investigators often write that a worker “failed to follow the procedure” without testing the worker’s information, incentives, and practical choices. That wording assumes the procedure was available, understood, workable, and compatible with the conditions of the task. Those assumptions may be false.

Ask what the person could see at the time, which hazards were visible, what changed during the job, and what previous experience had taught the team. If a shortcut had worked repeatedly without consequence, the shortcut may have become a local signal that the formal control was optional. If the procedure required a tool that was not available, compliance may have been impossible without stopping the work and escalating the problem.

This question does not remove personal responsibility. It improves the quality of responsibility by separating an intentional violation from an honest mistake, a misunderstood boundary, or a control that could not survive real operating pressure. Each situation requires a different response, and a single label such as “human error” hides that difference.

A stronger report records the decision environment. It explains the worker’s goal, the information available, the time pressure, the competing demands, and the signals that shaped the choice. That evidence makes the corrective action more precise than another reminder to “be careful.”

2. Which barrier should have stopped the exposure earlier?

Every serious incident should be mapped backward through the barriers that were expected to prevent it or limit its consequence. The barrier may be physical, such as guarding or isolation. It may be procedural, such as a permit or a pre-job review. It may depend on a person, such as supervision, competence, or a stop-work decision.

For each barrier, ask whether it existed, whether it was suitable, whether it was available at the point of work, and whether anyone verified its condition. A control that exists in a manual but is absent from the work area is not a functioning barrier. A supervisor who is nominally responsible but cannot reach the job in time is not an effective verification layer.

The investigation should also distinguish between a barrier that failed and a barrier that was never designed for the exposure. If a checklist asks whether equipment is “in good condition” but never tests stored energy, line of fire, or isolation status, a completed checklist cannot prove control. The problem is not a missed signature. The problem is a weak control design.

Barrier mapping changes the tone of the investigation. Instead of adding five actions to a person’s file, the team can decide whether the work needs engineered protection, clearer decision rights, a different authorization boundary, or a verification method that produces observable evidence.

3. What earlier signal did the organization fail to read?

Serious events rarely arrive without precursors. A near miss, repeated equipment defect, informal workaround, delayed maintenance task, incomplete handover, or report that receives no visible response can reveal the same pathway before the loss occurs. The investigation must look for these signals without pretending that every prior deviation predicted the exact event.

Search maintenance records, near-miss reports, observation notes, shift handovers, overtime patterns, temporary changes, and previous investigations. Then ask whether the organization recognized the signal, whether someone owned the response, and whether the response removed the exposure or merely documented it.

A report that says “there were no previous incidents” proves very little. It may mean the exposure was controlled, or it may mean people did not report, records were not connected, or leaders looked only for events that produced harm. The absence of a record is not the same as the absence of a warning.

Andreza’s phrase that “a workplace accident is a book we did not read” is useful here. The event is not only an endpoint. It is also evidence about decisions that accumulated earlier. When the team reads the prior signals, the investigation becomes a management process rather than a search for a final mistake.

4. What will change in the work, not only in the report?

Corrective actions often fail because they describe intention instead of a changed condition. “Retrain the team,” “reinforce awareness,” and “communicate the lesson learned” may be appropriate supporting actions, but they do not prove that the exposure has been reduced. A credible action identifies what will be different when the next job begins.

Test each action against four questions. Does it change the physical design? Does it change the sequence or authorization of the work? Does it change who can stop, approve, or escalate the task? Does it create evidence that a critical control is present before exposure begins? If the answer is no to all four, the action may be too weak to address the pathway.

Training is valuable when the investigation finds a genuine knowledge or skill gap, and when the work system gives people a realistic chance to apply what they learned. Training cannot compensate for missing equipment, contradictory targets, unavailable supervision, or a procedure whose steps do not match the task.

Define a verification date and an observable test. A leader might watch the next three jobs, review the isolation evidence, compare the planned sequence with field execution, or confirm that stop-work decisions were accepted without penalty. Closure should mean that the barrier works under operating conditions, not that the action owner uploaded a certificate.

How the four questions change the investigation record

The table below contrasts a shallow conclusion with a stronger diagnostic conclusion. The purpose is not to make every investigation longer. It is to make the evidence more useful for decisions.

What leaders should change after the report is approved

Senior leaders should read the investigation as a test of management control, not as an administrative deliverable. Ask whether the report identifies a decision that leadership made, accepted, or failed to revisit. If the event depended on schedule pressure, unclear authority, weak contractor control, or deferred maintenance, those subjects belong in the executive conversation.

Supervisors should translate the findings into field checks that can be completed during real work. They should know which barrier matters most, what failure looks like, and when the job must pause. This is where the investigation becomes part of everyday safety leadership rather than a file stored after the meeting.

For a practical companion, review the internal guide on four decisions that keep incident triage honest. Leaders who need a broader view of how compliance can hide weak controls can also read six blind spots behind cosmetic compliance.

When should an investigation be reopened?

Reopen the investigation when the corrective action did not change the exposure, when a similar event or near miss occurs, when new evidence changes the sequence, or when the original conclusion depends on an assumption that cannot be verified. Reopening is not an admission that the team failed. It is a control against false closure.

The strongest organizations treat investigation quality as a learning discipline. They do not wait for a serious injury before examining repeated weak signals, and they do not confuse a completed form with a completed correction. The result is a record that helps people decide better before the next event creates a more costly lesson.

Andreza Araújo’s position is direct. Investigate to understand, not to punish, because an incident rarely has one isolated cause. The root cause is still missing when the report names a person but cannot show which barriers, decisions, and conditions will be different tomorrow.

Frequently Asked Questions

Is unsafe behavior ever a root cause?

Unsafe behavior may be an immediate cause or a contributing factor, but it should not automatically be treated as the root cause. The investigation should test the information, conditions, supervision, design, and incentives that shaped the behavior before deciding what must change.

How many root causes should an incident investigation identify?

There is no useful fixed number. A good investigation identifies the conditions that materially contributed to the event and separates evidence from speculation. Listing many causes is not better if the actions do not change the exposure.

Should every near miss receive a full investigation?

Every near miss deserves a proportionate response. The organization should escalate the review when the potential consequence was severe, when the exposure is repeated, when a critical barrier failed, or when the event reveals a weakness that could affect other teams.

What makes a corrective action effective?

An effective corrective action changes a barrier, work design, authorization rule, decision right, or verification method and includes an observable test after implementation. Training and communication can support the change, but they should not be the only evidence that risk was reduced.

A credible investigation does not end when the report is approved. It ends when the work system no longer depends on the same fragile conditions that produced the event.