Incident Investigator in 30 Days: First RCA Plan

An incident investigator is the person who protects evidence, builds the event sequence, tests causal factors, and verifies whether corrective actions reduce risk after an injury, near miss, or high-potential event. In the first 30 days, the role must become disciplined enough to resist blame, memory loss, and easy closure.

The first month matters because a new investigator inherits pressure before authority. Operations wants the area released, legal teams want careful wording, supervisors want fairness, and workers want to know whether speaking honestly will make them vulnerable. If the investigator has no routine, the investigation will be shaped by the loudest pressure in the room.

OSHA encourages employers to investigate injuries and close calls because incidents reveal hazards and system weaknesses that can be corrected before someone else is harmed. That expectation is practical, although it still leaves a hard question for the person assigned to investigate: what should be built first so the first RCA does not become a polished story around a weak cause?

Across 25+ years leading EHS in multinational operations, Andreza Araujo has seen that investigation quality depends less on the name of the method and more on evidence discipline. The new investigator needs a 30-day plan that protects facts before interpretation, connects worker voice with field proof, and keeps corrective actions tied to the control that failed.

What the new incident investigator needs before starting

Before the first formal assignment, the investigator needs four things: authority to preserve evidence, access to the incident standard, a clear escalation route, and protection from being used as the person who confirms what leadership already believes. Without those four foundations, even a smart investigator can become an administrative processor.

ISO 45001:2018 requires organizations to react to incidents and nonconformities, evaluate the need for action, determine causes when applicable, and review whether corrective actions are effective. A new investigator should translate that standard into a local workflow, because the requirement only protects people when it reaches the scene, the interview, the report, and the action review.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, safety culture becomes visible through repeated decisions under pressure. Incident investigation is one of those decisions. The organization shows whether it wants truth, speed, blame, or learning by the way it treats the first hour after the event.

First week: protect evidence before theory

The first week should focus on evidence protection rather than cause analysis. A new investigator should learn how the site preserves the scene, captures photographs, secures equipment status, protects digital records, identifies witnesses, and prevents well-intentioned cleanup from erasing the condition that needs to be understood.

This is where many investigations lose quality before they officially begin. A moved load, restarted machine, overwritten alarm, replaced guard, or cleaned spill can remove the one fact that would have challenged the easy explanation. The investigator should treat scene control as a risk control, not as a paperwork preference.

Use the internal guide on preserving incident evidence in the first 24 hours as the first practice reference. The new investigator should walk through one past event and ask which evidence was protected, which evidence was lost, and which decision allowed that loss.

First 30 days: build the investigation spine

By day 30, the investigator should have a repeatable spine for every serious event: event statement, timeline, people involved, equipment and environment, changed conditions, credible worst outcome, controls expected, controls found, causal factors, corrective actions, and effectiveness test. The spine keeps the report from becoming a narrative that sounds complete while avoiding the hardest control questions.

The timeline is the anchor. A weak timeline jumps from what happened to who was present. A stronger timeline shows when the job was planned, when conditions changed, when controls were checked, when decisions were made, and when the exposure became possible. The internal guide on building an incident timeline in the first 24 hours gives the investigator a practical structure for that work.

James Reason's work on organizational accidents is useful here because it directs attention beyond the final visible act. The new investigator should ask what made the action possible, sensible, or tolerated at that moment. That question moves the investigation toward conditions, controls, supervision, planning, and leadership review without excusing personal choices.

Month 2: improve interviews and causal factors

In the second month, the investigator should improve interviews and causal-factor classification. The goal is not to become a courtroom examiner. The goal is to hear the people closest to the work while memory is fresh, then test what they say against physical evidence, records, equipment status, and the work sequence.

Interview quality depends on the first question. If the investigator starts with why did you do that, the conversation becomes defensive. If the investigator starts with what was different from the plan, what made the job harder, and which control was difficult to use, workers are more likely to describe the operating conditions that shaped the event.

The article on causal factors in RCA separates immediate, task, control, and organizational factors. That distinction protects the new investigator from stopping at a behavior label when the real lesson sits in procedure usability, supervision cadence, design, staffing, or production pressure.

Month 3: test corrective action quality

In the third month, the investigator should learn to challenge corrective actions before they enter the system. Many reports fail at the action stage because the recommended fix is easier to close than to verify. Retraining, reminders, new forms, and toolbox talks may support the response, but they rarely prove that the failed control is stronger.

Andreza Araujo's A Ilusao da Conformidade, glossed for English readers as The Illusion of Compliance, warns that formal completion can hide unchanged work. That warning belongs inside every action review. The investigator should ask what evidence will show that exposure changed after the action is implemented.

Use the internal guide on testing corrective action effectiveness in 30 days before the action is approved, not only after the due date passes. If the action has no future proof, the investigator should rewrite it with the action owner.

Month 4 onward: become the guardian of learning

After the first three months, the investigator should become the guardian of learning quality, not the owner of every investigation task. Supervisors still own immediate response, operations still owns risk decisions, and EHS still owns the management system. The investigator's value is to keep evidence, sequence, causes, and actions technically honest.

This means reviewing patterns across events. If three reports in four months close with awareness, procedure not followed, or lack of attention as the main cause, the investigator should escalate the pattern. Repeated shallow causes are not a worker problem. They are evidence that the investigation process is protecting comfort over control.

In more than 250 cultural transformation projects, Andreza Araujo's team has observed that organizations improve when leaders inspect the quality of learning, not only the number of investigations closed. The investigator should bring that quality lens to monthly EHS reviews.

Common mistakes in the first investigations

The first mistake is beginning with the person instead of the exposure. People matter, and choices matter, although the investigation weakens when it treats the last visible action as the whole explanation. The new investigator should write the credible worst outcome and expected control before judging behavior.

The second mistake is confusing cooperation with truth. A witness can be sincere and still remember sequence poorly after a stressful event. A supervisor can be helpful and still protect a decision without realizing it. The investigator should respect people while testing every account against evidence.

The third mistake is closing the report around an action that nobody can verify. If the fix depends only on people remembering better next time, the investigator should ask which control, decision rule, or field condition will make the safer behavior easier under normal pressure.

Incident investigator plan: role and deliverables

A simple plan helps the new investigator see the role as a sequence of deliverables rather than a heroic personal skill. The table below can be used by an EHS manager during onboarding or by a site leader who is assigning investigation responsibility for the first time.

Resources to deepen the role

The new investigator should study three internal skills first: evidence preservation, timeline building, and corrective action effectiveness. Those skills are more urgent than learning many diagram formats, because they protect the report from the three most common failures: missing facts, broken sequence, and weak action closure.

For the cultural side of the role, start with Safety Culture: From Theory to Practice and Sorte ou Capacidade, glossed as Luck or Capability. The first book helps the investigator understand why culture appears in decisions. The second reinforces that an accident should not be treated as random bad luck when repeated conditions made exposure possible.

Andreza Araujo's Safety School can also support the role when investigators need to strengthen interviewing, field evidence, leadership communication, and action verification. The technical skill matters, but the cultural skill determines whether people will tell the truth early enough for the organization to learn.

Every weak first investigation teaches the site how future events will be treated. If the first report protects speed, blame, or comfort, the next witness will remember that before they speak.

What should be true by day 30?

By day 30, the incident investigator should be able to protect evidence, build a defensible timeline, classify causal factors, challenge weak actions, and explain what proof will show that risk changed. That is enough to handle the first RCA with discipline, even if the investigator is still developing deeper expertise.

If your organization needs investigation routines that connect field truth, worker voice, leadership review, and corrective-action verification, start with Andreza Araujo's safety culture work through ACS Global Ventures.