New Incident Investigation Lead in 60 Days: Build Defensible Findings Before the Story Hardens

A new incident investigation lead often inherits a stack of reports, a calendar of overdue actions, and a team that wants a fast conclusion. The pressure is understandable, yet speed without evidence discipline turns the first explanation into the final explanation.

The first 60 days should build a repeatable way to protect facts, test conditions, and challenge weak corrective actions. The lead does not need to personally control every investigation. The lead needs to make the investigation system reliable enough that important decisions do not depend on memory, hierarchy, or the confidence of the loudest person in the room.

What a new incident investigation lead needs to understand before starting

An incident investigation is a decision process, not a writing assignment. Its purpose is to establish what can be supported by evidence, explain which conditions shaped the event, and identify changes that reduce the chance of recurrence without pretending that uncertainty has disappeared.

James Reason's work on organizational accidents is useful because it directs attention beyond the visible action at the end of the sequence. Planning, equipment design, supervision, communication, maintenance, and workload can create conditions in which an error becomes more likely or more harmful. The investigation should examine those conditions while still describing what people did and what they knew at the time.

Andreza Araujo makes a related point in Safety Culture: From Theory to Practice. Culture is not a slogan attached to the report. It is visible in the decisions that determine whether a concern is escalated, whether a control is funded, and whether an inconvenient fact survives review.

Use the 60-day plan below to establish that discipline without turning every event into a large investigation.

Days 1 to 7: Map the decision path before reviewing conclusions

Start with the process that operates when an event occurs. Identify who receives the first notification, who protects the scene, who decides whether work stops, who preserves documents and equipment, and who can appoint competent investigators.

Review several recent cases, including an injury, a near miss, and an event that generated a corrective action. Do not begin by ranking the reports. Compare how the organization handled the first hour, the first interview, evidence storage, causal analysis, approval, and action closure.

Write down where the process depends on informal knowledge. If only one experienced manager knows which equipment must be isolated or which contractor records matter, that dependency is a system weakness that the new lead should address.

Days 8 to 14: Set the minimum evidence standard

Define what every investigation must separate clearly. Facts are observations, records, measurements, photographs, physical conditions, and consistent accounts. Interpretations explain what those facts may mean. Hypotheses describe possibilities that still require testing.

A practical evidence standard should require a timeline, the task plan, relevant changes, equipment or control status, interviews with people close to the work, and a record of unresolved uncertainty. The standard should not force identical reports for every event. It should make weak evidence visible before a conclusion is approved.

Ask investigators to preserve the original record before editing summaries. A corrected timeline can be useful, but it should not erase the earlier version that shows when information became available and which assumptions shaped the first response.

Days 15 to 21: Improve interviews without turning them into interrogations

Interview quality determines how much of the work system becomes visible. A person who expects accusation will protect themselves, shorten answers, or repeat the official procedure instead of describing what the task required that day.

Train investigators to ask what the person was trying to achieve, what changed, what information was available, which control was difficult to use, and what decision had to be made under time pressure. Ask for sequence and conditions before asking for judgment.

The investigator should also speak with supervisors, planners, maintainers, contractors, and people who performed the same task on another shift when their knowledge can test the account. Contradictions are not automatically evidence of dishonesty. They may show that the process was understood differently by different roles.

Days 22 to 30: Test the first explanation against the work system

At the end of the first month, choose one active investigation and run a challenge review. Ask what evidence would disprove the current explanation, which conditions existed before the event, and whether the same exposure could recur with a different person.

Look for the difference between a failed action and a failed arrangement. A person may have missed a step, while the organization made the step difficult to see, difficult to perform, or easy to bypass without detection. The report should describe both levels when both influenced the event.

Use a simple test for each proposed cause. Can the team point to evidence? Can the condition be changed? Can someone verify the change at the point of work? If an answer is no, the statement may still be a hypothesis, but it should not be presented as a settled finding.

Days 31 to 45: Rebuild corrective actions around changed conditions

Review open actions by asking what will be different for the next person who performs the task. A refresher briefing may be useful, but it does not by itself change an unavailable guard, an unclear isolation boundary, an unrealistic schedule, or a supervision gap.

Each action should name an owner with authority, the condition to be changed, the evidence required for closure, and the date of an effectiveness check. The owner should be able to show the change in the place where the exposure occurs, not only in a meeting or a tracking system.

Separate immediate protection from long-term correction. An interim barrier can protect people while engineering, planning, procurement, or maintenance work is completed. The interim measure should have an expiry or review point so that temporary protection does not become a permanent substitute for the intended control.

Days 46 to 60: Create a review rhythm leaders will use

The investigation lead should establish a short monthly review with operations, maintenance, engineering, contractors, and safety leadership. The meeting should examine evidence quality, overdue decisions, repeated conditions, and action effectiveness rather than count reports alone.

Bring one case to the meeting in enough detail to test whether leaders can answer four questions. What exposure existed? Which condition allowed it to persist? Who had the authority to change it? What evidence now shows that the condition is different?

This rhythm gives the lead a practical way to connect investigations with operating decisions. It also prevents the investigation function from becoming a report factory that produces conclusions no manager uses to redesign work.

Common mistakes made by new investigation leads

• Accepting the first plausible explanation because the team wants closure.
• Allowing a polished report to compensate for missing scene evidence or weak interviews.
• Assigning actions to the safety team when the condition belongs to engineering, operations, maintenance, or planning.
• Using training as the default action when the task design or resource condition remains unchanged.
• Closing actions because a document was uploaded instead of checking whether the exposure changed.

These mistakes are predictable because a new lead is often rewarded for volume and speed. Credibility grows differently. It grows when people see that the process protects facts, treats uncertainty honestly, and sends decisions to the person who can change the work.

Resources to deepen the practice

Use Safety Culture: From Theory to Practice to connect investigation quality with the daily decisions that shape culture. Sorte ou Capacidade, published in English as Luck or Capability, is also useful for examining how organizations interpret outcomes and distinguish fortunate results from reliable capability.

Andreza Araujo's work across 25+ years in multinational operations and more than 250 cultural transformation projects supports a practical principle. A safer system is demonstrated by the conditions people can use and leaders can verify, not by the number of statements an organization can place in a report.

A new investigation lead has 60 days to establish the habit that matters most. Protect the evidence, test the conditions, and close only the actions that change the work.

Frequently asked questions

What should a new incident investigation lead do first?

The new lead should map the notification and evidence-preservation process, identify decision owners, review recent investigations, and observe how interviews and corrective actions are handled in practice.

How long should an incident investigation take?

The time depends on the event, the evidence, the number of systems involved, and the need to protect people immediately. A fixed deadline should not replace a clear evidence standard, although the lead should define decision checkpoints so the investigation does not drift.

What makes an incident finding defensible?

A defensible finding connects verified evidence to a condition that influenced the event, distinguishes fact from interpretation, explains uncertainty, and identifies a proportionate action whose effectiveness can be checked.

Should investigators interview the person who performed the task?

Yes, when the person is willing and the process protects a respectful, factual conversation. The interview should seek work conditions, instructions, changes, constraints, and decisions without reducing the investigation to personal blame.

When is a corrective action complete?

A corrective action is complete when the responsible owner can show that the contributing condition has changed, the change is available at the point of work, affected people understand it, and a later check confirms that the risk pathway is controlled.