Incident Investigation: 5 Gaps That Let a Plausible Story Replace Evidence

An incident investigation can fail before the first interview begins. The failure appears when a plausible explanation arrives too early, usually in the form of a familiar sentence such as “the operator bypassed the control.” Once that sentence becomes the working story, evidence is collected to confirm it rather than to test the conditions that made the event possible.

This is why a technically polished report can still leave the organization exposed. A defensible investigation does not merely identify the last action before harm. It reconstructs the decisions, constraints, signals, and barriers that shaped that action, then verifies whether the corrective response changes the work. The five gaps below are where many investigations stop short.

Why a plausible story is not yet an investigation

People prefer explanations that close uncertainty quickly. In safety work, that preference is dangerous because the first account often has the strongest emotional force, not the strongest evidence. A supervisor sees a missed step, a manager sees a training record, and the report begins to describe a personal failure before anyone has tested the task design.

James Reason’s Managing the Risks of Organizational Accidents gives investigators a more useful frame. An incident can involve active failures at the front line while latent conditions remain embedded in planning, supervision, equipment, staffing, maintenance, or management decisions. Treating the visible action as the complete cause leaves those conditions intact.

Andreza Araújo makes a similar point in Sorte ou Capacidade, whose English meaning is “Luck or Capability.” An accident is not a random interruption that can be resolved by naming the person closest to the event. It is the late result of barriers and decisions that deserve examination. That position changes the investigator’s first question from “Who did it?” to “What made this action likely here?”

The distinction matters for leaders because the report determines where resources go next. If the investigation ends with retraining, the organization may spend money while preserving the workload, sequence, interface, or control weakness that produced the exposure.

Gap 1: Treating the last action as the cause

The last action is often the easiest fact to observe, which makes it a poor stopping point. A worker removes a guard, enters before authorization, skips a verification, or uses a tool outside its intended condition. Those actions matter, but they do not explain why the choice appeared reasonable, necessary, or tolerated at that moment.

Investigators should separate the action from the conditions surrounding it. Ask what the person was trying to complete, what information was available, what sequence the plan required, which control was difficult to use, and what production or maintenance pressure shaped the decision. A control that exists only on paper cannot be treated as an effective barrier simply because a procedure describes it.

Andreza Araújo’s book A Ilusão da Conformidade, translated as “The Illusion of Compliance,” is useful here because it distinguishes written compliance from operating reality. The question is not whether the rule was printed, trained, or signed. The question is whether the work system made the safe action workable when the task changed.

A strong finding therefore names both levels. It may state that an isolation step was skipped, while also recording that the energy state was difficult to verify, the job sequence changed after planning, and the supervisor had no reliable escalation route. The first statement describes behavior. The second begins to explain the risk.

For a practical evidence sequence, use the evidence chain for defensible incident findings before assigning a corrective action. It helps prevent a conclusion from outrunning the record.

Gap 2: Freezing the timeline at the moment of harm

Investigations often begin at the incident timestamp and move backward only far enough to identify the immediate deviation. That narrow window misses the earlier choices that shaped the conditions. A maintenance delay, a temporary repair, a staffing change, an overdue inspection, or an ambiguous handover may have been present for days or weeks.

Build the timeline in layers. Start with the task, then add the work authorization, planning assumptions, equipment status, staffing, supervision, changes, alarms, prior reports, and decisions that altered the original plan. The aim is not to create a longer chronology for its own sake. It is to identify when the organization had an opportunity to detect or reduce the exposure.

Hindsight bias makes this step harder. Once the outcome is known, earlier signals look obvious even when they were weak, fragmented, or interpreted through a different operational priority. The investigator should record what was knowable at each decision point, not what became obvious after the event.

That standard protects both the quality of the analysis and the people involved. It avoids excusing poor decisions, but it also avoids judging earlier choices with information that was unavailable at the time. The result is a timeline that leaders can use to improve decision points rather than merely condemn the final one.

Gap 3: Ignoring decisions made upstream

A frontline event may be created by a decision that no one in the work area had authority to change. The design may have fixed the access route. Procurement may have selected equipment with a difficult inspection point. Planning may have compressed the window. A manager may have accepted a temporary condition without defining an owner or expiry date.

These decisions are not background context. They are part of the causal system. A useful investigation maps each important condition to the person or forum that could change it, then asks whether that authority was clear, exercised, and supported by evidence.

This is where safety leadership becomes visible. Andreza Araújo’s work consistently connects safety with the quality of management decisions, not with the safety department’s ability to write more rules. If a critical barrier depends on a production schedule, a maintenance budget, or an engineering choice, the finding must reach that decision owner.

Use a simple ownership test. For every failed or missing barrier, identify who owned the design, who owned the operation, who verified the condition, and who had authority to stop or change the work. When those roles cannot be named, the organization has found a governance gap rather than a training gap.

The six evidence-preservation decisions used before the story hardens provide a useful companion for keeping upstream records in the investigation rather than losing them to routine system updates.

Gap 4: Treating missing reports as missing evidence

When no near-miss, concern, or earlier defect report exists, investigators sometimes conclude that no warning was available. That conclusion is too strong. Silence can mean that the signal was not noticed, was not recorded, was not trusted, or was reported without a response.

Look for indirect evidence. Maintenance work orders, shift handovers, permit revisions, production interruptions, overtime patterns, equipment substitutions, supervisor notes, and informal messages may reveal that the condition was known in fragments. None of these records should be treated as proof by itself, yet together they can show how risk moved through the organization without becoming a formal incident.

Andreza Araújo describes a healthy safety culture as one in which information can move before harm occurs. That principle also changes how leaders interpret reporting volume. A low number of reports is not automatically evidence of control if workers have learned that raising a concern produces delay, blame, or no visible response.

Interview design matters here. People are more likely to describe weak signals when the investigator asks what made the task harder, what changed from the plan, and what people had to work around. Questions that begin with “Why did you fail to report it?” can close the conversation before the evidence appears.

Interview design can be strengthened with the witness interview distortion review, especially when people reconstruct a changing task under pressure.

Gap 5: Closing actions without testing changed conditions

An action is not complete because a training session occurred, a procedure was revised, or a responsible person marked a task as closed. Closure should mean that the exposure changed and that the relevant barrier now works under the conditions that previously defeated it.

Write the action in observable terms. State what will change in the work, who owns that change, what evidence will show implementation, and when the organization will test it. “Retrain the team” is not a sufficient action because it does not say whether the equipment, sequence, authorization, staffing, or supervision will be different.

Verification should include the people who perform the task. They can show whether the revised control fits the actual sequence, whether the new check adds a workable decision point, and whether the workaround has simply moved somewhere less visible. Their participation is evidence about control usability, not a ceremonial approval step.

Leaders should also test for recurrence in a different shift, location, or task variation. A corrective action that works only in the original setting may have addressed the example rather than the mechanism. The investigation becomes more valuable when its findings survive a change in context.

What a defensible investigation compares

A strong investigation compares the expected work with the performed work, the planned conditions with the actual conditions, and the assigned responsibility with the authority that existed in practice. The comparison should be explicit because hidden differences are where weak barriers often live.

This comparison is also a useful review tool for an EHS manager who must challenge a draft report without reopening every detail. If the report cannot show the changed condition, the causal reasoning remains incomplete.

The decision leaders should make within 72 hours

Within the first 72 hours, leaders should decide whether the event requires only local correction or a broader review of a recurring control. That decision should be based on the mechanism, not on the severity label alone. A low-consequence event can expose a barrier that is weak across several locations, while a serious outcome can result from a narrow failure that is already contained.

Ask whether the same condition can exist elsewhere, whether the decision rights are clear, whether earlier signals were available, and whether the proposed action changes the work rather than the paperwork. If the answer is uncertain, expand the review before the organization normalizes the explanation.

Andreza Araújo’s editorial approach treats investigation as a responsibility to read the system honestly. Her book Safety Culture: From Theory to Practice reinforces the point that culture is visible in what leaders permit, verify, and respond to when no one is watching. The investigation is therefore not separate from safety culture. It is one of the clearest tests of it.

A credible incident investigation does more than explain the past. It identifies which conditions made the event possible, assigns change to the people who can deliver it, and verifies that the new barrier works in real operations. When the first story feels complete, that is the moment to look for the gap it is hiding.