Incident Investigation: 6 distortions that make corrective actions look complete

A serious incident investigation can produce a polished report, a signed action plan, and a closure meeting while the same exposure remains in the next shift. The problem is not always weak intent. It is often a distortion in how the team collects evidence, explains causation, or decides that the work has changed.

Across 25+ years leading EHS work in multinational operations, Andreza Araujo has seen why formal completion can diverge from operational protection. Her experience across 250+ companies and 30+ countries supports a practical thesis. An investigation is not useful because it is finished. It is useful when its explanation survives challenge and the changed control works under comparable conditions.

James Reason's work on active and latent failures helps establish the boundary. The last visible action matters, but it rarely explains the whole exposure. A credible investigation connects the action to the task, the conditions, the decisions, and the controls that made the event possible. The six distortions below show where that chain commonly breaks.

Why a complete report can still leave the risk in place

Most organizations have an administrative definition of completion. The report is approved, actions have owners, dates are entered, and the incident is removed from the open list. Those steps create traceability, which is valuable, but traceability is not the same as risk reduction.

The harder test asks whether the explanation fits the evidence and whether the new control changes the conditions that produced the exposure. A rewritten procedure may leave equipment, staffing, authority, and time pressure untouched. In that case, the document has changed while the operating system has not.

Andreza Araujo explores this gap in Safety Culture: From Theory to Practice and The Illusion of Compliance. Formal order can look convincing when leaders inspect records instead of decisions. Incident investigation needs both views, because the record explains what the organization says happened while the work shows what the organization made possible.

Distortion 1 treats the last action as the whole cause

Investigators often begin with the final movement before the event. Someone bypassed a guard, entered an area, selected the wrong tool, or failed to verify isolation. That observation may be accurate, yet accuracy does not make it sufficient.

The last action is the visible end of a sequence. The team still needs to ask what information was available, which choices were realistic, how the task was planned, and what supervision or equipment condition shaped the decision. If the same action was normal across several shifts, the investigation should examine why the organization tolerated that pattern.

A useful timeline includes more than the worker's movement. It records the intended task, the actual task, changes in conditions, handovers, conflicting priorities, and points at which someone could have detected the exposure. When the timeline contains only personal actions, the report quietly converts a system question into an individual explanation.

The corrective action must therefore reach beyond reminders. A briefing can clarify an expectation, but it cannot substitute for a reliable interlock, a workable permit, a competent supervisor, or enough time to perform the verification. The action should state which condition changes and how the team will prove that change exists.

Distortion 2 confuses a missing rule with a missing control

When an incident occurs, teams often discover that a procedure does not mention the exact situation. The immediate response is to add a paragraph, issue a bulletin, or require a new signature. That response may be appropriate when ambiguity caused the exposure, although the absence of wording is not automatically the absence of control.

A rule can exist and still be unusable. It may require a decision that no role is authorized to make, depend on information that arrives too late, or describe a sequence that does not match the equipment. A document review should test those conditions rather than assume that more text means more protection.

ISO 45001:2018 requires organizations to control operational risks and evaluate whether processes achieve intended results. That logic matters after an incident because the investigation must examine control performance, not only document presence. The relevant question is whether people could apply the control under the conditions that existed.

Investigators can separate the two issues by asking what the worker had to notice, remember, decide, and physically do. If the proposed action changes only what someone must remember, it deserves a second review. High-consequence exposures often require an earlier barrier, a design change, clearer authority, or a better interface between planning and execution.

Distortion 3 mistakes consensus for evidence

Incident teams work under pressure to produce a coherent account. Once several people agree on a story, disagreement can feel unhelpful, especially when senior leaders want a short report. Consensus can reduce conflict, but it can also hide the uncertainty that the investigation needs to preserve.

Evidence has a different standard. A statement should be separated from an inference, and an inference should be separated from an assumption. The team should know which facts came from records, which came from observation, which came from interviews, and which remain unresolved. That distinction protects the investigation from turning the first plausible narrative into an official cause.

Witness interviews are especially vulnerable to this distortion. People reconstruct events through memory, social pressure, and the questions they receive. A leading question can make an uncertain sequence appear precise. Investigators should compare accounts with physical evidence and should record contradictions instead of smoothing them away.

Andreza's book Safety Culture Diagnosis: Learn how to do your own reinforces the value of testing what people report against observable conditions. The same discipline applies to incident work. If a team says a control was understood, the review should show how that understanding was demonstrated in the task rather than treating agreement in the meeting as proof.

Distortion 4 closes actions at document level

Administrative closure is attractive because it is easy to verify. The owner uploaded a revised procedure, attendance was recorded, and the system changed the action to complete. Those signals matter for governance, but they do not establish that the exposure is harder to recreate.

A stronger closure test has three parts. The intended change must be visible in the workplace, usable by the people doing the work, and effective when conditions vary. If the action concerns a permit, the review should examine a live permit and the handover that follows it. If the action concerns equipment, the reviewer should observe the control in service rather than inspect a photograph.

Verification also needs a time horizon. A new control may work during a launch week when attention is high and fail after production pressure returns. The owner should define when the comparable task will be reviewed again and what evidence would reopen the action.

This is where leaders can distinguish activity from protection. Training attendance measures participation. Field verification tests whether the work has changed. The first can support the second, but it cannot replace it.

Distortion 5 separates the incident from normal work

Some investigations describe the event as an abnormal episode caused by unusual pressure, an exceptional shortcut, or a one-time communication failure. That framing may be comfortable because it limits the scope of corrective work. It is also dangerous when the same conditions exist in routine operations.

The team should compare the incident task with normal production. Did workers regularly improvise around a blocked route? Did supervisors routinely accept incomplete information at shift change? Did the schedule make the safer sequence unrealistic? Did the organization reward output while treating escalation as delay? These questions turn the incident into a test of the operating model.

Normal work does not mean acceptable work. A repeated workaround may be evidence that the designed process does not fit the operation. When investigations label those adaptations as isolated behavior, the organization loses an opportunity to repair the mismatch before another event exposes it.

The comparison should include at least one similar task, one adjacent shift, and one location where the same control is supposed to work. That scope is small enough for a focused review and broad enough to show whether the event was local, recurring, or built into the way work is organized.

Distortion 6 measures investigation quality by speed

Fast closure is often presented as evidence of a mature process. Speed can be valuable when it restores protection quickly, yet a short investigation is not automatically a strong investigation. The right question is whether the organization has enough evidence to make a defensible decision.

Pressure for rapid closure can produce predictable shortcuts. Interviews happen once, uncertain facts disappear from the report, the action is assigned to the nearest function, and the review ends before the changed control has been observed. The dashboard turns green while the causal explanation remains fragile.

Leaders should track the time needed to restore immediate protection separately from the time needed to complete the causal review. Those are different management decisions. A temporary barrier may be installed within hours while a deeper examination of design, planning, and authority continues with a defined owner.

That separation protects both urgency and quality. The site does not need to wait for a perfect report before controlling an exposed condition, and it does not need to call the investigation complete merely because an interim action was taken.

What a stronger investigation review asks

A practical review can test the report before leaders approve closure. First, ask whether the explanation includes conditions that existed before the final action. Next, identify which evidence supports each causal statement and which points remain uncertain. Then check whether the corrective action changes the exposed condition rather than only the instruction.

The review should also ask who can verify the change in the field, when that verification will occur, and what result would reopen the action. If the answer depends on a person remembering a new rule under the same pressure, the action may be too weak for the risk.

Andreza Araujo's work combines engineering, creativity, and care. That combination is useful in investigations because technical controls, human decisions, and organizational meaning interact. A report that ignores any one of those dimensions may still be readable, but it will struggle to explain why the exposure existed and whether the next shift is safer.

For investigators who want to strengthen the method, review the incident triage meeting decisions that keep RCA honest, compare RCA methods for a SIF review, and use the witness-statement myths guide to challenge interview assumptions. The goal is not a longer report. It is a more reliable explanation followed by a control that survives contact with work.

Frequently asked questions

Incident investigation becomes credible when the report makes uncertainty visible and verifies that the work changed.