SIF Investigation: 5 Distortions That Keep Fatal-Risk Evidence Out of the Review

A serious injury or fatality can leave an operation with plenty of information and still not enough evidence to explain what failed. The first statements are often preserved, the photographs are collected, and the report begins on schedule. Yet the review may never reconstruct the conditions that made the event possible.

That is the central problem with SIF investigation. The question is not only who touched the equipment or which instruction was missed. The stronger question is which evidence would show whether the organization designed, verified, and maintained the barriers that were supposed to prevent a life-changing outcome.

Why SIF investigation needs a different evidence standard

A serious injury or fatality carries consequences that ordinary event counts can hide. The harm may be rare, but the exposure can be present every shift. An investigation that treats the event as an isolated deviation therefore risks closing the report while the same high-consequence pathway remains active.

James Reason’s work on organizational accidents is useful here because it separates the visible action from the latent conditions that shape it. A rushed decision, an unavailable guard, a weak handoff, and an unresolved design change can align without any single person intending the outcome. The investigation needs evidence from each layer.

Andreza Araujo’s book Luck or Capability, translated from Sorte ou Capacidade, makes a related point from a safety leadership perspective. A favorable outcome does not prove that the system was capable, just as an adverse outcome does not prove that the operator was the primary cause.

Investigators should define the evidence standard before assigning causes. Otherwise, the review will collect what is easy to retrieve, such as training records and statements, while missing what is harder to test, such as control availability, decision authority, production constraints, and the history of accepted exceptions.

1. The review confuses an event timeline with an evidence timeline

An event timeline describes what happened before, during, and after the incident. That chronology matters, but it is not the same as an evidence timeline. A SIF review also needs to show when a control weakened, when a concern was raised, when a decision was deferred, and when the organization had an opportunity to intervene.

Suppose a lifting exclusion zone was missing at the time of the event. The event timeline may record the lift, the movement of the load, and the injury. The evidence timeline asks when the zone was designed, who verified it before the shift, whether the layout changed, what supervisors saw during the work, and whether earlier observations described the same condition.

This distinction prevents the review from treating the final exposure as the beginning of the problem. The incident evidence handoff process is especially important because photographs, permits, access logs, equipment data, and physical conditions can change quickly after the event.

A useful review preserves both timelines in parallel. One explains sequence. The other explains opportunity, deterioration, detection, and response.

2. The investigation treats statements as the whole story

Witness statements are valuable, although they are not a complete record of work. People remember what they noticed, what they believed was relevant, and what they feel safe saying after a serious event. Their accounts need to be compared with physical evidence, work documents, equipment condition, and the decisions that preceded the task.

This is not a reason to distrust workers. It is a reason to widen the evidence base. A worker may accurately describe the final action while lacking access to the maintenance history, the staffing decision, or the earlier request that changed the work sequence.

The review should ask what each statement can establish and what it cannot establish. A supervisor’s account may clarify the authorization decision, while an equipment log may show that a control was unavailable. A permit may show that a barrier was named, while a field photograph may show that the barrier did not exist where the task occurred.

The strongest investigations make disagreement visible instead of forcing every source into one smooth narrative. When accounts conflict, the conflict is evidence about perception, communication, work design, or authority. It should be tested, not edited away.

3. The team records barriers without testing their condition

Many reports list barriers as if naming them proves that they worked. A procedure, a permit, a guard, a spotter, or a training module can appear in the control plan while being absent, bypassed, misunderstood, or unsuitable for the actual task.

Barrier evidence needs four questions. Was the barrier present? Was it available at the point of work? Was it understood by the people who depended on it? Did anyone verify its performance under the conditions that existed before the event?

The distinction between active and latent failures becomes practical at this stage. The active and latent failure evidence tests help investigators connect the visible action with the conditions that made the action more likely.

A barrier that existed only in a document should not receive the same evidentiary weight as a barrier that was physically present, independently checked, and capable of stopping the hazardous energy. The report should describe the difference plainly, because leaders cannot restore a control that the investigation has mistaken for paperwork.

4. The review removes production pressure from the causal picture

Production pressure is often treated as context rather than evidence. That weakens the investigation. If the work was accelerated, the crew was short, the delivery window was fixed, or a maintenance decision was postponed, those conditions may explain why people accepted a degraded control.

Pressure does not excuse a harmful decision. It does show what the system was asking people to optimize. The review should identify the target, deadline, staffing model, escalation path, and decision owner that shaped the work.

Ask what happened when the safe method conflicted with the operational plan. Could the supervisor stop the job without personal penalty? Did the worker have authority to delay the task? Was an alternative sequence available? Had leaders already accepted similar deviations because the work still produced an acceptable short-term result?

Andreza Araujo’s experience across more than 250 cultural transformation projects is relevant because safety culture becomes visible when operational priorities collide. The number is part of her published professional biography and describes project experience, not a guarantee that every investigation will identify the same pattern. In a serious review, pressure should be analyzed as a condition that leaders can redesign.

5. The team closes on retraining before confirming control restoration

Retraining is easy to assign, easy to record, and often too weak to close a SIF pathway. If the equipment layout, staffing, supervision, authorization process, or engineering control remains unchanged, the investigation may have responded to the person while leaving the exposure intact.

The five gaps that allow repeat risk to survive a closed report are a useful reminder that closure is not the same as correction. A corrective action should state what condition will change, who owns that change, what interim protection applies, and how effectiveness will be checked in the worksite.

Investigators should also distinguish between a learning action and a risk-control action. A briefing may help people recognize the hazard, while a design change may remove the hazard from the task. Both can be appropriate, but they should not be presented as equivalent protection.

A report that ends with “retrain the team” has not yet shown that the organization understands the failure pathway. It has shown only that a training response was available.

How to build a defensible SIF evidence map

A practical evidence map can be organized around the barrier pathway rather than around departments. Start with the hazardous energy or exposure that could produce the serious outcome. Then identify the preventive barriers, the detection barriers, the escalation route, and the recovery actions that were expected to limit harm.

For each barrier, record the intended condition, the observed condition, the evidence source, the accountable owner, and the uncertainty that remains. This format keeps the investigation honest because it separates confirmed facts from assumptions and open questions.

Use the incident triage decisions that keep RCA honest to set the investigation scope early. The group should decide which evidence needs immediate preservation, which expertise is required, and which decisions cannot wait for the final report.

Then test the map against previous events, near misses, maintenance findings, and unresolved actions. Repetition does not require identical incidents. The same weak barrier can appear through different tasks, crews, or equipment.

What leaders should challenge before approving the report

Senior leaders should be able to answer five questions before approving a SIF investigation. What exposure could still exist? Which barrier was expected to prevent it? What evidence proves that the barrier failed or was absent? Who can change the condition? When will the organization verify that the change works?

They should challenge language that turns uncertainty into certainty. “Human error” may describe the final action, but it does not explain why the action made sense to the person, why the control did not intercept it, or why the system allowed the exposure to remain available.

They should also challenge actions that have no verification method. An action without a test date, field owner, or effectiveness criterion is a future intention, not a restored barrier.

Andreza Araujo’s safety work at multinational scale includes a documented 50% accident-ratio reduction at PepsiCo in six months. That result should not be copied as a benchmark for a different operation. It does show why measurable follow-up matters. Leaders need evidence that decisions changed the work, not just evidence that the organization completed a report.

How this approach changes the final investigation conclusion

A defensible conclusion does not need to name one root cause. It needs to explain the conditions that allowed the exposure, the barriers that failed to stop it, and the decisions that can reduce recurrence.

The conclusion should distinguish between what is known, what is strongly supported, and what remains uncertain. It should identify the primary exposure, the failed or missing barriers, the organizational conditions that shaped the work, and the verification plan that will test whether risk has actually fallen.

Andreza’s book A Day Not To Forget, translated from Um Dia Para Não Esquecer, treats serious events as lessons that must remain connected to real decisions. That principle matters after the report is approved. The organization should be able to show what changed at the point of work, what leaders now see earlier, and what evidence will prevent the lesson from becoming another archived document.

SIF investigation is strongest when it examines the evidence that ordinary reports leave outside the frame. The aim is not to create a longer document. It is to make the exposure, the failed barriers, the operating pressure, and the accountable decisions visible enough to change the work before another person pays for the same weakness.