Incident investigation: learning, not blaming

Published 27 October 2026

Incident investigation: what to know

The purpose of an incident investigation is not to find someone to blame. It is to understand what happened, why it happened, and how to prevent it from happening again. The moment an investigation becomes a search for a culprit, learning stops, defensiveness rises, and the same incident quietly waits to recur.

A just-culture approach distinguishes between honest mistakes, at-risk behaviour and reckless conduct. The vast majority of incidents are the result of systemic gaps — unclear procedures, inadequate training, time pressure, missing equipment, design flaws — rather than individual wrongdoing. People generally come to work intending to do it well; when they err, the system usually set them up to.

Effective investigations move quickly but calmly. Facts are gathered promptly while memories and evidence are fresh, the scene is preserved where possible, and witnesses are interviewed separately and without judgement. The aim is to reconstruct the chain of events as accurately as possible, not to confirm a theory formed in the first five minutes.

Techniques such as the 'five whys' — repeatedly asking why until you reach a root cause rather than a symptom — help trace surface events back to underlying conditions. An operator 'failed to follow procedure' is a finding; why they failed to follow it — was it impractical, ambiguous, untrained, under time pressure, or punished when followed? — is the root cause worth fixing.

The output of an investigation is not a report that sits on a shelf. It is a set of concrete, owned, time-bound actions that close the gaps identified. Each action should have someone responsible for it and a date by which it will be done — and someone should check that it was. An investigation with no follow-through is worse than none at all, because it creates the illusion that the problem has been handled.

When investigations are done well, they build trust. People see that the organisation cares about learning, not scapegoating, and they become more willing to report concerns, near-misses and hazards in future. That willingness is the foundation of everything else; without it, problems stay hidden until they hurt someone.

When they are done poorly — punitive, slow, or hollow — the opposite happens: silence descends, reporting collapses, and incidents repeat with increasing severity. The choice an organisation makes after every incident shapes its safety culture for years to come.