New Incident Investigator in 60 Days: What to Do in the First Investigation Cycle

The first serious incident assigned to a new investigator creates a difficult tension. Leaders want an answer quickly, while workers want to know whether the process is genuinely interested in what happened. If the investigator starts by searching for a person to blame, evidence narrows before the first interview is complete.

This 60-day transition plan is designed for an EHS professional, supervisor, or technical specialist who has just taken responsibility for incident investigations. The goal is not to become a perfect interviewer in two months. It is to build a disciplined investigation cycle whose evidence can withstand operational pressure and whose actions address failed barriers rather than only visible behavior.

What a new incident investigator needs to understand before starting

An investigation is a decision process, not simply a report-writing task. You must preserve what can disappear, separate observation from interpretation, and test how work was actually organized at the time of the event. That means the investigator needs enough independence to ask uncomfortable questions, although the investigation still depends on cooperation from operations, maintenance, engineering, and workers.

James Reason’s work on latent conditions and barrier failure is useful here because it shifts attention from the last action in the sequence to the layers that made the outcome possible. Andreza Araujo makes a related point in A Ilusão da Conformidade (The Illusion of Compliance), where the true measure of a safety system is what happens when nobody is watching. A clean procedure cannot be treated as proof that the control worked in the field.

Before the first interview, define the event boundary, the decisions that must be explained, and the evidence that could confirm or challenge each explanation. The existing incident investigation charter is a useful starting point because it prevents scope from expanding into an unfocused search for every weakness in the site.

Days 1 to 7: protect the scene and establish the question

Your first week should produce a controlled evidence base, not a polished conclusion. Secure photographs, equipment condition, permits, isolation records, shift information, training records, alarms, maintenance history, and any digital record that can change when a system is restarted or edited. Record who collected each item and when, because evidence without provenance becomes an opinion.

Write one neutral event question that contains no conclusion. “Why did the operator bypass the guard?” already assumes the bypass was the central cause. “What conditions allowed contact with the moving part during the task?” leaves room for supervision, design, production pressure, access, and prior signals to enter the analysis.

Speak first with people who observed the work or arrived immediately afterward, then compare their accounts with physical evidence. A witness statement is important, but it is not a complete timeline. The article on timeline reconstruction, witness accounts, physical evidence, and digital records explains why these sources should be tested against one another rather than ranked by confidence alone.

Days 8 to 30: build a fact pattern that operations can challenge

During the second phase, organize the investigation around verified facts and open questions. Use a timeline that distinguishes what was seen, what was recorded, and what someone inferred later. Mark the gaps openly. A gap is not an embarrassment for the investigator; it is a signal that the next interview or document review has a purpose.

Interview the person closest to the work before interviewing the most senior manager. Ask what the task normally requires, what changed that day, what made the work easier or harder, and which warning signs had already become familiar. Questions should invite sequence and context, because “Why did you do that?” usually produces a defensive answer while “What happened immediately before that decision?” produces usable detail.

Then test the controls. Was the procedure available at the point of use? Did the permit reflect the actual job? Could the worker see the hazard? Did the design make the safe action slower than the shortcut? Did supervision verify the critical step, or did the system only require a signature? These questions distinguish a control that exists on paper from a control that changes exposure.

Keep the draft report open to technical dissent. A supervisor may believe the event was a training problem, while maintenance records show that the equipment had been difficult to isolate for months. The investigator’s responsibility is to make the stronger explanation visible, which may require challenging the first narrative offered by a respected manager.

Month 2: convert findings into barrier decisions

By the second month, the investigation should move from evidence collection to decisions about prevention. Group findings by failed or missing barriers, such as design, energy isolation, work planning, supervision, competence, communication, and organizational pressure. Do not treat every finding as equal. A missing poster and an unavailable isolation point do not carry the same preventive weight.

Describe each action in operational terms. “Retrain the team” is incomplete because it does not state what capability will change, how the change will be demonstrated, or which system condition will be checked. A stronger action might require a redesign review, a field verification before restart, or a change to the permit sequence, depending on the evidence.

Use the evidence breaks that allow known hazards to return as a final quality check. If an action closes only the report, the investigation has not yet reached prevention. The action must have an owner, a due date, a verification method, and a clear definition of what will be different in the field.

Month 3: make the investigation process trustworthy

At the end of 60 days, review not only the individual report but also the investigation process. Did people provide information early? Were interviews delayed because leaders wanted to align their story? Did the report distinguish facts from assumptions? Were high-consequence barriers tested in the field after the action was marked complete?

Trust grows when the investigator explains how evidence shaped the conclusion, including evidence that ruled out an attractive explanation. It also grows when workers see that reporting a concern does not automatically create a disciplinary search. Andreza’s book Cultura de Segurança: Da Teoria à Prática (Safety Culture: From Theory to Practice) describes an accident as a book that the organization failed to read. The practical implication is demanding. The organization must read the conditions around the event, not only the final page where harm occurred.

Build a short review rhythm with operations and worker representatives. A monthly review can examine overdue actions, repeated barrier failures, and events whose immediate causes look different but whose organizational conditions are similar. This turns investigation from a reactive administrative duty into a source of decisions about exposure.

Common mistakes that weaken a new investigator

The first mistake is accepting the first plausible story because it makes the report easier to finish. The second is confusing a rule violation with an explanation, even when the rule was difficult to follow under real operating conditions. The third is assigning actions that are easy to document rather than actions that reduce the hazard.

Another mistake is treating the investigator as the sole owner of prevention. The investigator owns the quality of the evidence and the reasoning, while operational leaders own the conditions that must change. A report that names ten actions without an accountable decision-maker is less useful than a shorter report whose critical actions are funded, scheduled, and verified.

Finally, avoid turning every interview into a test of loyalty. Workers who disagree with the official story may be protecting the organization from a repeated exposure. Their account should be checked against evidence, just as management’s account should be checked, because credibility belongs to the explanation that survives verification.

Resources to deepen your investigation practice

Start with James Reason’s writing on organizational accidents and latent conditions, then connect that reasoning with Andreza Araujo’s Sorte ou Capacidade (Luck or Capability), which argues that an accident is built through layers of conditions rather than explained by luck alone. These sources help the investigator resist hindsight and ask how the system became vulnerable.

Use the blog’s practical material on blind spots that keep serious causes out of an investigation report when reviewing your own draft. If you lead the process, keep one question visible throughout the cycle: what must change so that the same exposure is harder to recreate, even when the next team is under pressure?

The 60-day standard for a credible investigation

A new incident investigator does not need to promise certainty. The stronger promise is disciplined reasoning. In 60 days, you should be able to preserve evidence, interview without pre-judgment, separate facts from assumptions, test the barriers that shaped exposure, and translate findings into actions that operations can verify.

That standard protects both the people involved and the organization’s ability to prevent recurrence. When the investigation reads the whole system instead of stopping at the last visible action, the report becomes a decision tool rather than a record of blame.