Post-Incident Action Plans: 5 Decisions That Prevent Retraining Theater

After a serious incident, the most visible action is often the least useful one. A retraining assignment can close a workflow while leaving the decision conditions, barrier failures, and supervisory signals that shaped the event untouched.

This article argues that a post-incident action plan should be judged by five decisions, not by the number of actions closed. The aim is to help EHS managers and operational leaders convert findings into controls that can be verified in the work.

Why a closed action is not the same as a controlled risk

A corrective action controls risk only when it changes exposure, strengthens a barrier, or changes a decision that previously allowed the exposure to persist. ISO 45001, published in 2018, expects organizations to address nonconformity and prevent recurrence, but a task marked complete does not prove that the hazard pathway has changed.

The common failure is administrative completion. A manager assigns one owner, sets one due date, attaches one training record, and reports closure at the next review. The record looks disciplined, although the operation may still depend on the same permit, equipment setting, staffing level, or production assumption.

Andreza Araújo makes this distinction central to her work on safety culture. In Safety Culture: From Theory to Practice, the practical question is not whether a rule exists, but whether the organization has made the expected behavior possible, visible, and repeatable.

1. Decide what the incident actually exposed

The first decision is to define the exposed control problem before selecting an action. An investigation should separate the immediate event from the conditions that allowed it, using evidence from the scene, task design, supervision, equipment, and management decisions.

James Reason's Swiss cheese model remains useful because it distinguishes active failures from latent conditions. A wrong movement may be part of the event, while a weak alarm, unclear authorization, poor maintenance boundary, or incompatible schedule explains why the error reached the person.

Use a five-part evidence review that asks what the worker faced, what the supervisor knew, what the procedure required, what the equipment could do, and what the business process rewarded. If the action plan names only the final human movement, it has not yet identified the exposed control.

This is where four root-cause questions can sharpen the review, especially when the first explanation feels obvious.

2. Decide whether the proposed action changes the barrier

The second decision is whether the action changes a barrier or merely reminds people to use an unchanged barrier. Retraining can clarify a task, but it cannot compensate for a guard that is easy to bypass, a permit that does not match field conditions, or a production plan that leaves no safe recovery time.

A useful hierarchy has three layers. First, change the hazard or physical design where feasible. Second, improve the engineered or procedural barrier that should interrupt the pathway. Third, support the people who must operate the barrier through competence, supervision, and response.

The order matters because a training-only response places the final layer under pressure while leaving earlier weaknesses intact. Andreza's book Sorte ou Capacidade, rendered in English as Luck or Capability, treats accidents as events shaped by conditions, choices, and system capacity rather than by luck alone.

Ask one direct question before approval. If the same worker followed the same instruction tomorrow, what physical, technical, or organizational change would make the event less likely?

3. Decide who owns the risk, not just the task

The third decision is to assign risk ownership at the level that can change the condition. An EHS manager may coordinate the action, but the production, maintenance, engineering, procurement, or project leader who controls the relevant decision must own the result.

Ownership is weak when the action says “safety department to retrain operators” after an equipment or planning failure. The wording transfers a management problem to the people closest to the exposure, even though they cannot redesign the equipment, alter the schedule, or stop an incompatible job from entering the plan.

Build a simple authority test with four questions. Can the owner change the control? Can the owner allocate money or time? Can the owner stop the work when evidence is weak? Can the owner prove the change survived a normal production cycle?

This approach aligns with the lesson from the Deepwater Horizon decision-authority analysis, where warning signals mattered only to the extent that they reached people with authority to alter the operation.

4. Decide what evidence will prove the action worked

The fourth decision is to define verification evidence before the action is marked complete. A completion email proves that a task happened, while a control test proves that the changed condition works under the circumstances that previously produced exposure.

Verification should use at least three evidence types. Document review checks whether the new requirement is present. Field observation checks whether the requirement is usable during work. Performance evidence checks whether the barrier remains dependable after pressure, turnover, or a changed task.

For example, a revised lockout procedure needs more than a signed revision. The review should test whether the isolation point is identifiable, whether the worker can verify zero energy, and whether the process still works during a night shift or an urgent maintenance request.

In Safety Culture Diagnosis, Andreza Araújo emphasizes diagnosis that connects declared practice with observed practice. That same logic should govern incident actions, because an action is not effective merely because its documentation is complete.

5. Decide when the organization is allowed to close the action

The fifth decision is the closure threshold. An action should close only after the organization has verified the changed control, reviewed exceptions, and confirmed that the owner can sustain the requirement without extraordinary attention.

A practical closure test uses four dates. Record the decision date, the implementation date, the first field verification date, and the follow-up date after the operation has experienced normal pressure. These dates expose a frequent gap in which an action is closed immediately after a document change, before the work has tested it.

Across 25+ years leading EHS at multinationals, Andreza Araújo has built her authority around the difference between declared culture and lived culture. The same distinction applies here. A control that works only during an audit is not yet a control that the operation owns.

When the evidence is mixed, keep the action open, revise the barrier, and record the unresolved risk. Closure should describe a verified condition, not an optimistic intention.

6. Compare retraining theater with control recovery

The difference between a weak and a strong action plan becomes visible when the same incident finding is translated into two responses. The table below gives leaders a fast diagnostic for the quality of the proposed recovery.

The comparison is not an argument against training. Training is appropriate when competence was genuinely missing, but it becomes theater when it is used to absorb a risk that belongs to design, planning, or leadership.

7. Use the plan to connect near misses, incidents, and serious risk

A post-incident action plan becomes more valuable when it connects the event to earlier signals. Near misses, repeated deviations, overdue inspections, and failed field verifications can show that the same barrier was weakening before the incident became visible.

Review the preceding 30 days of available evidence, then compare the signal with the incident pathway. The point is not to create a larger spreadsheet. It is to identify whether the organization had information that could have triggered a different decision before harm occurred.

• Match each signal to the barrier it tests, rather than to a broad safety activity.
• Escalate repeated weak signals to the person who controls the exposure, even when no injury occurred.
• Use the action plan to define what future signal will reopen the risk review.

This makes the plan useful for prevention as well as response, and it links naturally with near-miss review and barrier analysis without treating every signal as proof of the same problem.

8. Make the executive review a decision forum

The executive review should decide whether risk has changed, not merely receive a list of overdue tasks. Leaders need the incident pathway, the owner with authority, the evidence collected, the remaining uncertainty, and the consequence of leaving the gap open.

That format changes the conversation from “Why is this action late?” to “What decision is still preventing this exposure from being controlled?” The second question is harder, although it is closer to the responsibility leaders actually hold.

For a serious injury or fatality potential, the review should also state whether the same barrier exists elsewhere in the business. Texas City in 2005 and Macondo in 2010 remain reminders that local findings can expose governance weaknesses whose consequences extend beyond one worksite.

The executive output should be short enough to use in a live meeting and specific enough to assign authority. A five-line status with no decision is not a safety review; it is a delayed report.

What a defensible action plan looks like after review

A defensible plan states the exposed control problem, changes a barrier or decision condition, assigns ownership to the authority that can act, defines evidence before closure, and preserves uncertainty when the evidence is incomplete. It also connects the incident with earlier signals so the organization does not wait for a second event to learn the same lesson.

Post-incident discipline is therefore a leadership practice, not a paperwork exercise. The strongest plan does not promise that every event can be prevented by perfect compliance; it shows which conditions will be changed, who has the right to change them, and how the organization will verify that the change survives real work.

Leaders who apply these five decisions can still use training, procedures, and accountability, but they stop asking those tools to carry risks that belong to engineering, planning, maintenance, procurement, or governance.