The Incident Investigation Process

A good incident investigation does more than establish what happened and produce a report. It creates a shared understanding of the conditions that shaped an event, gives people confidence in the findings and helps the organisation make meaningful improvements.

That outcome does not emerge at the end of the process. It is shaped from the start: by the purpose of the investigation, the people involved, the questions asked and the way findings are translated into action.

This page sets out the essential stages of an effective incident investigation process.

An investigation is a process, not a report

A report is an important output of an investigation, but it is not the purpose of one.

The purpose is to understand what happened, why it made sense for people to act as they did at the time, and what the organisation can learn from the event. That requires a process that is credible, fair and well organised, not simply a team collecting information and writing conclusions.

Why the process matters

A strong process creates the conditions for:

confidence in the findings;
meaningful involvement of relevant people;
practical recommendations;
clear ownership of improvement; and
learning that continues after the investigation is formally complete.

Before the investigation begins: agree purpose, scope and ownership

Before work begins, the organisation should agree what the investigation is intended to achieve. This early alignment is often the most important part of the whole process.

Start with the intended outcome

Do not design an investigation around producing a report. Start by asking what the organisation needs to understand, decide or improve as a result of the investigation.

This includes considering who needs confidence in the findings, how affected people will be involved and what should happen once the investigation is complete.

Agree the scope and key questions

A clear scope helps an investigation remain focused without becoming superficial. Agree what is in scope, what is not, the key questions to be answered and any constraints around time, access or confidentiality.

The investigation should be broad enough to understand the relevant operational and organisational conditions, rather than stopping at the actions of the people closest to the event.

Clarify sponsorship and ownership

An investigation needs visible sponsorship. The sponsor should provide a clear mandate, remove obstacles where necessary and ensure that findings receive serious attention.

They should also be clear about who will own the improvements that follow. If ownership is left until the report is issued, recommendations can easily become somebody else’s problem.

Plan the investigation

Once the purpose and scope are clear, the investigation team can make a proportionate plan.

Choose the right team

The team should combine independence, operational understanding and the skills needed to gather and interpret evidence. The right composition depends on the event, but credibility matters: people need to trust both the process and the people leading it.

Set out the practical approach

A good plan establishes the sequence of work, responsibilities, key stakeholders, evidence sources and decision points. It also anticipates how the team will keep relevant people informed without making premature conclusions.

Planning brings structure, but it should not prevent the team from following important new lines of enquiry as its understanding develops.

Secure evidence and support people

The first hours after an incident can strongly influence the quality of the investigation. Evidence can be lost, memories can be shaped by early assumptions, and people may need support before they are ready to contribute.

Preserve what may matter

Secure relevant physical, digital and documentary evidence early. This may include equipment, work records, permits, photographs, system data, communications and environmental conditions.

The aim is not to collect everything. It is to preserve enough reliable information to understand how work was actually being done.

Support the people involved

People affected by an incident should be treated with care and respect. They may be injured, distressed, worried about consequences or concerned that they will be blamed.

A supportive and fair approach is not separate from the quality of the investigation. It is essential to obtaining an accurate understanding of the event.

Gather evidence and build understanding

Evidence gathering is not simply a fact-finding exercise. The team needs to understand the operational context in which decisions and actions were made.

Observe work and conditions

Where possible, visit the location and observe the relevant work, equipment, environment and interfaces. Ask how the work is normally done, not only how it was expected to be done.

This helps reveal the difference between written procedures and the practical realities people need to manage every day.

Speak with the people who know the work

Interviews should help the team understand people’s perspective, their goals, the information available to them and the constraints they faced at the time.

Good interviewing is curious rather than accusatory. It does not begin by trying to prove a theory.

Test emerging understanding

As evidence develops, the team should compare sources, check assumptions and actively look for information that challenges its early conclusions. This reduces the risk of confirmation bias and hindsight bias.

Analyse what happened and why

Analysis turns evidence into understanding. The aim is to develop a coherent account of the event and the conditions that influenced it.

Establish the event narrative

First establish what happened: the sequence of events, relevant decisions, actions and changing conditions. Be precise about what is known, what is uncertain and what requires further exploration.

Look beyond the person closest to the event

People’s actions should be understood in context. Consider factors such as equipment, procedures, workload, supervision, training, communication, planning, competing priorities and organisational arrangements.

This is where a human factors perspective and methods such as Tripod Beta can help the team move beyond vague explanations such as “human error”.

Develop findings and recommendations people can own

Findings should be clear, evidence-based and useful to those who need to act on them. The purpose is not to assign blame or create a long list of actions. It is to identify what needs to change and why.

Make findings understandable and credible

A good finding connects the evidence to the underlying condition or issue. It explains the relevance of that issue without overclaiming certainty. People are more likely to accept findings when they recognise the reality described and can see how the conclusion was reached.

Design recommendations for practical improvement

Effective recommendations address the system conditions identified in the investigation. They are specific enough to guide action, but not so narrow that they merely treat a symptom.

Involve the people who will need to implement, support or live with the improvement. This creates stronger recommendations and clearer ownership.

Follow through: turn findings into improvement

The investigation is not complete when the report is issued. Learning depends on what happens next.

The organisation needs to decide how findings will be communicated, which improvements will be prioritised, who owns them and how progress will be reviewed. It should also consider whether the lessons apply more widely than the original event.

A completed action does not automatically mean an effective improvement. Follow-through should include checking whether the change is working in practice and whether it has made work safer, more reliable or easier to perform.

Build investigation capability over time

Investigation quality depends on the capability of both individual investigators and the organisation around them.

Skills such as interviewing, observation, analysis and report writing need practice. So do the wider capabilities of sponsoring investigations, reviewing quality and converting findings into improvement.

Developing that capability over time helps organisations investigate more consistently, learn more effectively and respond to incidents with greater confidence.

Strengthen your investigation capability

Tripod Academy helps organisations develop practical investigation capability through training, workshops and practitioner development.