New Incident Investigator in 60 Days: Build Evidence

Across more than 25 years of executive EHS work, Andreza Araujo has seen investigations fail for a reason that has little to do with the investigator's technical intelligence. The first 60 days shape whether evidence becomes a defensible decision or another report that changes nothing, and this guide gives a newly appointed investigator a practical sequence for making the work hold.

What a new incident investigator must understand before opening a case

A new incident investigator needs to separate the event, the evidence, and the decision that follows, because each answers a different question. The event describes what happened, the evidence shows what can be defended, and the decision determines which work conditions must change.

That separation matters because an investigation can contain many pages and still rest on one unsupported assumption. Write a provisional case question in one sentence, such as, "Which control should have prevented this exposure, and why did it fail at the time of work?" This keeps the inquiry away from personality judgments.

James Reason's work on latent failures remains useful because it directs attention toward conditions that sit behind the visible act. Andreza Araujo makes a related point in Safety Culture: From Theory to Practice, where culture becomes credible only when leadership decisions change the conditions in which work is performed.

The new investigator should enter the role as a decision architect, not as a report writer. The output is a traceable chain from evidence to control restoration.

Days 1 to 7: protect the evidence before interpreting it

The first seven days should establish evidence integrity, because early interpretation can quietly contaminate every later interview and conclusion. Preserve photographs, permits, training records, equipment status, shift rosters, messages, drawings, and the original sequence of work before asking what the evidence means.

Use three labels for every material fact, namely observed, reported, or inferred. A photograph may show a guard position, a worker may report a handover conversation, and an inferred statement may claim that the supervisor knew about a deviation. Those statements should never occupy the same evidentiary level.

The facts, interpretations, and assumptions distinction gives the investigator a simple language for making that separation visible to managers and reviewers. It also reduces hindsight bias, which often makes a known outcome look obvious before the work is reconstructed.

Appoint one evidence owner, set a daily preservation check, and record every missing item with an owner and due date. Do not fill gaps with confidence. A documented unknown is safer than a polished invention.

Days 8 to 14: build the event timeline that the team can challenge

A useful timeline shows decisions and changing conditions, not only clock times. Include the planned task, the actual task, the expected control, the deviation that appeared, the response that followed, and the information available to each person at that moment.

Ask witnesses to place events on separate timelines before bringing the versions together, because a group discussion can create agreement without improving accuracy. Compare the shift handover, permit issue, equipment condition, supervisor presence, and escalation points as distinct evidence streams.

Most investigations become shallow when the timeline starts at the injury and stops at the immediate action. The stronger question is where the work first became harder to control. That point may sit in planning, procurement, staffing, maintenance, or a decision made several shifts earlier.

Use a 24-hour reconstruction for the final shift and a 30-day lookback for recurring conditions. The first clarifies the event, while the second tests whether it was an isolated break or a tolerated pattern.

Days 15 to 21: interview for decisions, not for blame

Interviewing should reveal what people knew, what they expected, what they noticed, and what constrained their choices. Those questions are more reliable than asking who was responsible, because blame language makes people defend identity before they describe work.

Begin with an open reconstruction, then test specific points with documents, photographs, or physical evidence. Ask the worker, supervisor, planner, and maintenance representative what they believed the control would do, where that belief came from, and what would have made them stop or change the task.

Andreza Araujo's book Make The Difference: Be a Leader in Health & Safety is relevant to this phase because it treats frontline leadership as an operating practice, not a speech delivered after an event. Make the interview itself a test of leadership conditions.

Protect dissent during the process. If one person says the permit was technically complete but operationally unusable, do not close the point because the form was signed. Record the contradiction, verify the worksite condition, and ask which decision rights made the weaker option easier.

Days 22 to 30: convert findings into failed-control statements

A finding should identify a failed or missing control and explain the evidence that supports it. "The operator was careless" is a judgment about a person. "The isolation verification did not require an independent confirmation before access" describes a control condition that can be tested and changed.

Write each finding in four parts, including the expected control, the observed condition, the evidence, and the exposure created. This structure forces the investigator to state what the organization expected to happen and why the actual system did not reliably produce it.

The layered-control view of incidents helps reviewers see why a single unsafe act rarely explains a serious outcome. It also prevents the familiar mistake of closing a case with retraining when the stronger corrective action belongs in design, planning, supervision, or verification.

Limit the final findings to the conditions that matter for recurrence and severity. A shorter list with clear evidence gives leaders a better basis for funding and ownership.

Days 31 to 45: test corrective actions against the work

A corrective action is credible only when it changes the condition that allowed the exposure to persist. Test every proposed action against four questions, namely what changes physically, who owns the change, when the change will be verified, and what evidence will show that the control works under real operating pressure.

Replace vague actions such as "reinforce awareness" with a control statement that can be observed. For example, require a documented independent isolation check before access, then verify it in the field across day and night shifts, including one planned maintenance window.

The article on corrective-action myths investigators still believe is a useful companion because closure is often confused with effectiveness. A signed action is an administrative event; a restored barrier is an operational result.

Use a 30-day verification window for immediate actions and a 60-day review for changes that depend on design, procurement, or contractor alignment. If an action cannot survive an ordinary shift change, it is not yet a dependable control.

Days 46 to 60: present the decision without hiding uncertainty

The final presentation should let a plant manager understand the event, the failed controls, the exposure, and the required decision without reading every interview transcript. Put the one-sentence conclusion first, then show the evidence that supports it and the uncertainty that remains.

Separate proven facts from unresolved questions, because honest uncertainty increases the credibility of the findings. If a missing maintenance record prevents a precise conclusion about equipment condition, say so, explain the consequence, and assign a follow-up rather than disguising the gap with a stronger verb.

Use a decision table that connects each finding to a control owner, an approval level, a verification date, and an escalation trigger. This keeps senior leaders from approving actions that have no operating owner, which is one of the main reasons repeat events survive a well-written report.

At the end of day 60, the investigator should answer one practical question. What will be different in the next comparable task, and how will the operation know that the difference is real?

Common mistakes that weaken a new investigator's first quarter

New investigators often overvalue speed, form completion, and agreement. Those habits feel efficient, although they can produce a conclusion that nobody can challenge and nobody can use.

The first mistake is treating the first explanation as the final explanation. The second is interviewing only the people named in the initial report. The third is accepting training as the default action when the exposure was created by a weak physical or managerial control. The fourth is closing actions because evidence was uploaded rather than because the work changed.

Another mistake is confusing a calm interview with an honest interview. Silence can mean agreement, fatigue, fear, or the belief that speaking will not change the decision. Look for contradictory evidence and invite technical disagreement before finalizing the report.

The first quarter should include one peer review, one field verification after closure, and one retrospective discussion with action owners. The goal is to make weak reasoning visible while the case can still be corrected.

Compare a report-centered investigation with a control-centered investigation

A report-centered process can satisfy a deadline while leaving the exposure intact, whereas a control-centered process makes the decision and its verification visible to the people who own the work.

Conclusion: make the first 60 days a test of organizational learning

A new incident investigator earns credibility by protecting evidence, reconstructing decisions, identifying failed controls, and verifying that corrective actions work under real conditions.

That sequence reflects Andreza Araujo's broader view that safety becomes measurable when engineering, leadership, and care meet in daily decisions. If your organization needs to strengthen investigation quality and safety culture, explore the resources from Andreza Araujo and turn the next report into a safer operating condition.