Most organisations treat investigations as a response activity.
Something happens. An investigation team is formed. People gather data, build a timeline, and produce a report.
And then we expect quality.
But here’s the problem:
You don’t get a quality investigation because you respond well. You get a quality investigation because you were prepared.
The Myth of “We’ll Figure It Out When It Happens”
In many organisations, investigation capability is assumed- not built.
-
“We’ve trained our people.”
-
“We have a process.”
-
“We’ll pull a team together when needed.”
But when a serious event occurs, the cracks show quickly:
-
Evidence is missed or not preserved
-
Interviews drift into assumptions
-
Timelines are incomplete
-
Findings are vague or disconnected from controls
-
Recommendations don’t address the real risk
None of this happens because people don’t care.
It happens because capability wasn’t developed deeply enough before the event.
Investigations Are a System- Not an Event
High-quality investigations follow a structured model:
-
Gather – establish what happened
-
Organise – build a clear timeline
-
Analyse – understand why it happened
-
Learn – identify what needs to change
This isn’t just a process. It’s a system of thinking and skills applied under pressure.
And like any system, the outcome is only as strong as the capability behind it.
Where Capability Really Shows Up
You can’t see capability in a training certificate.
You see it in how investigators actually perform.
1. Data Gathering (PEEPO)
Strong investigators don’t jump to conclusions.
They:
-
Explore People, Environment, Equipment, Procedures, and Organisation
-
Ask “What evidence supports this?”
-
Separate fact from assumption
Weak capability leads to:
-
Early conclusions
-
Missing data
-
Bias creeping into the investigation
2. Evidence vs Assumption
Good investigations are built on verified facts.
Not:
-
“They should have…”
-
“They probably…”
-
“It looks like…”
Without disciplined evidence gathering, the entire analysis becomes unstable.
3. Timeline Reconstruction
A timeline is more than a sequence of events.
It’s the backbone of understanding:
-
What conditions existed
-
What controls were present or absent
-
How the situation evolved
If the timeline is weak, everything that follows is compromised.
4. Control-Based Thinking
ICAM is not about identifying who made a mistake.
It’s about understanding:
-
What controls should have been in place
-
Which controls failed
-
Why the system allowed the conditions to exist
When capability is low, investigations drift back to:
“The person didn’t follow the procedure”
When capability is high, the question becomes:
“Why did the system allow that to make sense at the time?”
Why This Matters More Than Ever
Most incidents involve some form of human error.
But stopping there doesn’t prevent recurrence.
To improve safety and performance, organisations must:
-
Understand contributing factors across the system
-
Strengthen defences
-
Learn in a way that leads to meaningful change
That only happens when investigation capability is strong.
Because:
The quality of your investigation determines the quality of your risk controls.
The Real Shift: From Response to Readiness
If you want better investigations, don’t wait for the next incident.
Build capability now.
That means developing:
-
Skilled investigators—not just trained ones
-
Consistent application of ICAM principles
-
Confidence in data gathering and analysis
-
The ability to challenge assumptions and think systemically
Because when the incident happens, it’s too late to build capability.
You’re already relying on what exists.
Final Thought
Most organisations focus on how they respond to incidents.
Few focus on whether they’re ready to investigate them well.
But the difference is significant.
Response gives you a report. Capability gives you learning.
And learning is what prevents the next event.