An incident investigation is useful only when it can explain what happened without pretending to know more than the record supports. That applies to a release, fire, injury, equipment event, process upset, or near miss. The goal is a reviewable record that helps responsible people choose the next safe and proportionate action. OSHA encourages employers to investigate both harmful incidents and close calls, and its systems approach starts with preserving the scene, collecting information, finding root causes, and implementing corrective actions (OSHA incident investigation overview, OSHA employer guide). HSE’s HSG245 workbook follows a similar path from gathering information through analysis, risk controls, and action implementation (HSE HSG245).
Define the event before asking why
The first question is not “what was the root cause?” It is “what event are we investigating?” A vague label such as “chemical incident” or “operator error” creates a vague search. Define the asset or area, operating mode, time window, people and contractors involved, energy or material present, actual consequence, potential consequence, and the point at which the situation returned to control. Include near misses when the same conditions could have produced harm if timing or exposure had been slightly different; OSHA defines a close call in those terms and recommends investigating it alongside incidents that caused harm (OSHA employer guide).
Scope needs a boundary. If a pump seal leaked during a transfer, the event may include the pump, seal plan, isolation, detection, operator response, maintenance history, transfer procedure, and nearby exposure controls. It does not automatically include every maintenance issue in the unit. Write the boundary before collecting records so the team can separate context from distraction.
Record the initial notification, first protective action, and the point when the area was declared stable. These markers distinguish the event from later investigation work and stop a response action from being mistaken for a causal explanation.
Use a neutral event statement: name the time, material, area, consequence, response, and boundary without saying what caused the event.
That statement leaves room for the evidence to change the explanation. It also gives the team a testable search window. OSHA says an effective investigation should look beyond immediate causes and ask why a procedure was not followed, whether production pressure mattered, and why an outdated procedure or training gap was not found earlier (OSHA incident investigation overview). HSE describes investigation as a sequence that moves from gathering information to analysis and risk controls, not a single meeting that chooses a label (HSE HSG245).
Preserve the scene and build the timeline
Evidence changes quickly after an industrial event. Equipment is made safe, damaged parts are removed, alarms are acknowledged, temporary repairs are installed, logs rotate, and people remember the sequence differently after the pressure has passed. OSHA’s employer guide puts scene preservation first: prevent material evidence from being removed or altered, then document the scene with photographs, video, sketches, and investigation details once emergency needs and site safety have been addressed (OSHA employer guide).
Preservation is not freezing the plant in an unsafe state. Emergency response, isolation, environmental protection, and stabilization come first. Record what changed before the scene was made safe, who authorized it, what was removed or reset, and whether samples or parts were retained. A clean area is not proof that nothing important was lost.
The timeline should use source timestamps rather than a single narrative clock. Place control-system events, alarms, trips, operator actions, radio traffic, permit status, access records, maintenance entries, lab results, camera footage, and witness recollections on one sequence. Record the time zone, clock source, known offsets, and confidence level. If a historian says 14:18:04 and a witness says “just before the shift call,” keep both until the difference is reconciled. Do not silently choose the timestamp that makes the story tidier.
The CSB describes its own investigations as combining detailed witness interviews, documentary material, physical evidence, company safety records, inventories, and operating procedures before findings and recommendations are drafted (About the CSB). That model is useful for industrial incident investigation with evidence: no single source should stand in for the whole event. A trend can show pressure movement. A work order can show what had been changed. A witness can explain what the display showed and what the team believed at the time. Each record has a different strength.
The investigation packet should preserve original files, not just extracted text. Keep the source identifier, revision, export time, owner, and any transformation used to make it searchable. A screenshot without its originating tag or display context may be useful, but it is weaker than a traceable export. A witness summary should distinguish direct observation from memory, inference, and information heard from someone else.
WizeeMind can present a timeline with linked evidence and visible gaps. It can flag that a trip preceded the operator action, that a procedure revision post-dated the event, or that the camera record has a gap. It should not manufacture missing seconds. The honest entry is “sequence unresolved between 14:18:04 and 14:18:21; control-system export available, operator radio log pending.”
Separate observations from explanations
Investigation meetings often go wrong when an explanation arrives before the record. “The valve was left open” may be a useful hypothesis. It is not an observation unless someone saw the valve position or a reliable record proves it. “The operator ignored the alarm” is even less precise: which alarm, what did the operator see, what response did the procedure require, and what competing information was present?
Use four labels in the packet: observed, supported, disputed, and unknown. An observed statement could be “the local gauge read 6.2 bar at 14:19, according to the inspection note.” A supported interpretation could be “pressure increased after the isolation valve was commanded closed, which is consistent with a delayed or incomplete isolation but does not identify the mechanism.” A disputed statement could be “the operator and the shift log give different accounts of the valve command.” Unknown means the record does not answer the question yet. These labels stop a plausible story from hardening into a finding.
OSHA’s guidance says investigators should collect information through interviews, document reviews, and other means, including equipment manuals, company records, maintenance logs, and procedures (OSHA employer guide). HSE’s training material also points investigators toward observing the scene, examining relevant documentation, and interviewing people involved or who witnessed the event (HSE incident investigation topic). The point is not to create a larger archive. It is to test each explanation against more than one kind of evidence.
Evidence table:
| Question | Record | What it supports | What it cannot prove |
|---|---|---|---|
| When did the condition begin? | Historian trend | The measured change and its timing | Why the change occurred |
| What did the operator see? | Interview and display capture | Perception, action, and uncertainty | The physical state of every field device |
| What had changed recently? | Work order and procedure revision | Work performed and document status | That the change caused the event |
| Was the barrier available? | Test record and inspection note | Whether a check or safeguard was documented | That the barrier would work under every condition |
| Evidence packet fields |
|---|
| source/owner/revision/export/timezone |
| asset/unit/area/event/state |
| observation/inference/conflict/unknown/status |
| file/hash/export/format/access |
| witness/role/language/consent/notes |
| permit/status/boundary/isolation/authority |
| reading/unit/quality/time/condition |
| barrier/test/result/frequency/owner |
| finding/claim/locator/source/limit |
| action/owner/due-date/evidence/reviewer |
That last column matters. Evidence has limits. A completed inspection is not proof that a component could not fail later. A procedure is not proof that the crew could use it under the actual workload. A model-generated correlation is not proof of causation. The CSB says its investigators review evidence, operations, and industry practices before drafting conclusions, which is a reminder to keep the inferential step visible rather than hiding it inside a summary (About the CSB).
Sometimes the right output keeps two explanations alive. A level excursion may fit both a failed transmitter and a delayed operator response. The next check could be a calibration record, a redundant measurement, or a replay of the control logic. That is slower than naming one cause, but faster than implementing the wrong fix and waiting for the next event.
Investigate near misses and human factors
Near misses deserve investigation when they reveal a credible path to harm, a weak barrier, or a recurring condition. They do not all deserve the same depth. A dropped tool in a controlled area and an unintended opening of a hazardous line may both be close calls, but their consequences, barriers, and required expertise differ. Match the investigation level to risk and learning value, not only to whether someone was injured.
OSHA recommends investigating close calls and says the team should include management and workers, because they bring different knowledge and perspectives (OSHA incident investigation overview). Its hazard-identification guidance also calls for a clear plan, trained investigative teams, worker and management participation, root-cause analysis, and communication of results (OSHA hazard identification and assessment). That is a practical reason to record who was in the room, which perspectives were missing, and which questions were never asked.
Human factors do not mean replacing a technical explanation with “human error.” HSE says investigations should examine why human failures occurred and look for underlying causes (HSE human factors in accident investigations). The Energy Institute guidance makes the same distinction: competence, procedure quality, weather, fatigue, and human error may describe performance-shaping conditions, but the investigation should continue into the system deficiencies that shaped them (Energy Institute human and organisational factors guidance).
Incident investigation is retrospective; proactive observation, inspection, and audit remain complementary methods (Energy Institute guidance).
Ask what made the action reasonable at the time. Was the display clear? Did the procedure match the equipment? Was the task covered by the right permit and isolation? Did the team have enough time, staffing, access, communication, and supervision? Had the abnormal condition been rehearsed? Were production targets pushing the work toward improvisation? These questions do not excuse unsafe choices. They show which conditions need changing.
Interviews should be treated as evidence collection, not a courtroom. Tell people the purpose is to understand the event and prevent recurrence. Let them describe the sequence before showing them a preferred timeline. Record what they saw, what they expected, what they did, what they could not see, and what they believed the safeguards would do. The packet should not convert a recollection into a fact without checking it against records.
Turn causes into corrective actions
An investigation is not finished when the report names a cause. It is finished when the organization has decided what must change, assigned ownership, set a due date, defined the evidence of completion, and checked whether the change reduced the original risk. OSHA’s guide says corrective actions should address root causes and that the investigation is not complete until those actions are implemented (OSHA employer guide). HSG245 likewise includes risk-control identification and action-plan implementation as parts of the investigation process (HSE HSG245).
The response should fit the finding. If the investigation finds that a guard could not be installed in the available space, “remind operators to be careful” is a weak response. If a procedure did not describe the actual line-up, revise and approve the procedure, brief affected roles, and verify use under the operating conditions. If a safeguard test was overdue, define the maintenance or inspection change, the responsible role, the temporary control, and the condition for returning to normal operation. If the evidence is still disputed, the action may be a focused verification rather than a permanent redesign.
Write completion criteria before the action starts. “Training completed” is not enough. Which people, which revision, which scenario, and what record proves understanding? “Valve repaired” is not enough. Which valve, what defect, what test, and which independent check confirms that it is available for service? A corrective-action ledger should link each action to the finding, the supporting claims, the affected barrier, the risk being reduced, the owner, the due date, the evidence required, and the reviewer.
Effectiveness is a separate check from completion. A new interlock test record proves that a test was performed. It does not by itself prove that the barrier works under the event conditions or that the problem will not recur. A revised procedure proves document control. It does not prove that the crew can find and use it during a night shift. The follow-up should set a reasonable observation window and name the evidence that will be reviewed. If that evidence is not available, say so.
The CSB explains that its investigations lead to recommendations aimed at preventing future releases and minimizing consequences, while implementation is tracked and monitored (About the CSB). That distinction is helpful for plant teams: a recommendation is not the same thing as a completed action, and a completed action is not the same thing as demonstrated risk reduction. WizeeMind can connect those states and show overdue or unsupported closure. It should not mark an action effective automatically.
Keep the decision with accountable people
Evidence software can reduce search time. It cannot accept residual risk, sign a permit, authorize a restart, or decide that a disputed cause is good enough. Named people who understand the equipment and consequences must make those decisions.
The CSB’s public description of its work is instructive: investigators obtain evidence, review operations and industry practices, develop findings and recommendations, and submit the draft for Board review (About the CSB). HSE also frames investigation as a process that includes analysis and action implementation, not just collection (HSE HSG245). The investigator assembles; accountable people decide. A plant investigation needs that separation.
The final packet should make uncertainty easy to see. Show the event statement, the timeline, the evidence links, the claims supported by each source, unresolved conflicts, missing records, causal hypotheses, corrective actions, and the person responsible for the next decision. A status such as “investigation complete” should mean the defined scope and required review are complete, not that every question has a satisfying answer. If the evidence is insufficient to distinguish two causes, the decision may be to collect more evidence or apply a temporary control while the question is resolved.
This is where human authority matters most. A model may rank a pattern, summarize a witness account, or point to a procedure revision. The investigator decides whether the source is reliable and relevant. The operations and safety roles decide whether the proposed control is workable. The accountable manager decides whether the residual risk and open actions are acceptable under the site’s rules. WizeeMind should keep those decisions explicit rather than hiding them behind a confidence score.
Start with a defensible packet: define the event, preserve what can change, build a source-linked timeline, separate facts from explanations, ask why the conditions made the outcome possible, and track corrective actions through review. An assistant can support the record; it cannot replace people responsible for safe operation.