Incident Investigation

Incident investigation is the structured process of understanding what happened, why it made sense for people to act as they did at the time, and what an organisation can learn from an event.

Its purpose is not simply to identify a cause, assign responsibility or produce a report. A good investigation creates a credible understanding of the conditions that shaped an incident and helps the organisation make meaningful, lasting improvements.

This applies to major incidents, near misses and recurring operational problems alike. The depth and formality of an investigation may differ, but its central purpose remains the same: to learn enough to improve.

Incident investigation is more than finding a cause

Events rarely have one single cause. They emerge from a combination of decisions, conditions and influences that come together over time.

An incident investigation therefore looks beyond the person closest to the event. It asks how the work was organised, what information and resources were available, what competing demands people had to manage, and how equipment, procedures, communication, supervision and organisational arrangements shaped the situation.

This does not mean that individual actions do not matter. It means that actions need to be understood in context.

When an investigation stops with an explanation such as “human error”, “failure to follow procedure” or “lack of attention”, it has usually described the outcome rather than explained why it happened.

What should an incident investigation achieve?

A well-conducted incident investigation should help an organisation do four things.

Establish a reliable account of what happened

The investigation should create a clear account of the event: what happened, when, where, who was involved and how conditions changed over time.

This account needs to distinguish between evidence, assumptions and uncertainty. A credible investigation does not claim more certainty than the available information allows.

Understand work as it was actually done

Written procedures and formal expectations are important, but they do not always show how work is managed in practice.

Investigators need to understand the operational reality: the goals people were trying to achieve, the information available to them, the constraints they faced and the practical trade-offs they had to make.

This is essential to understanding why actions made sense at the time.

Identify the conditions that need to improve

The purpose of analysis is to identify the conditions that influenced the event, and that can be improved.

These may include gaps in planning, equipment design, maintenance, training, communication, supervision, workload, coordination, procedures or organisational priorities.

The most useful findings help the organisation see where its systems, arrangements or ways of working need attention.

Create confidence in the findings

People are more likely to engage with an investigation when they recognise the reality it describes and understand how its conclusions were reached.

That confidence depends on a fair process, careful evidence gathering, open-minded analysis and clear communication. It is built through the investigation, not added at the end.

What does good incident investigation look like?

Good incident investigation is not defined by the length of the report or the complexity of the method used. It is defined by the quality of the understanding it creates and the improvement it enables.

A strong investigation is:

Curious - it asks questions before drawing conclusions.
Fair - it seeks to understand people’s actions in context rather than beginning from blame.
Evidence-based - it tests assumptions and compares different sources of information.
Proportionate - it matches the depth of investigation to the potential learning and consequences of the event.
Credible - relevant people can see that the process was competent, impartial and thorough.
Useful - its findings support practical decisions and improvement.
Followed through - the organisation acts on the learning and checks whether improvements work in practice.

An investigation is not a search for someone to blame

After an incident, there can be understandable pressure to establish who was responsible as quickly as possible. But early blame can narrow the investigation before the relevant facts and conditions are understood.

Accountability still matters. Deliberate wrongdoing, reckless behaviour or serious failures of professional judgement should not be ignored. Yet these questions should be addressed fairly and separately from the need to understand how the event became possible.

A learning-focused investigation asks:

What conditions made this event possible, and what needs to change to reduce the chance of it happening again?

This creates a more complete understanding than asking only who made the final error.

Incident investigation is an organisational capability

Investigators play an important role, but investigation quality does not depend on them alone.

The organisation also needs people who can sponsor investigations well, define their purpose and scope, provide access to relevant information, review the quality of findings and ensure that improvements are owned and followed through.

Building this capability requires more than occasional training. Investigators need opportunities to practise skills such as observation, interviewing, evidence gathering, analysis and report writing.

Organisations also need a shared understanding of what good investigation looks like.

From investigation to learning

An investigation creates understanding. The organisation creates learning.

The investigation is therefore not complete when the report is issued. Its value depends on what happens next: whether findings are discussed openly, improvements are prioritised, ownership is clear, and changes are checked in practice.

A good incident investigation gives an organisation something more valuable than an explanation of the past. It gives people a stronger basis for improving the future.

Explore the incident investigation process

Understanding the purpose of incident investigation is the starting point. The next step is to organise a process that produces credible findings, practical improvement and sustained learning.

→ Explore the Incident Investigation Process