Better Investigations Will Not Come From More Automation

Why ICAM investigations remain a thinking discipline, and why investigator development matters more than ever

In our previous article, The Limitations of AI in ICAM Investigations, we explored an increasingly important question for investigators and organisations: where can artificial intelligence genuinely assist an investigation, and where does reliance on it begin to undermine the investigative process?

The conclusion was not that AI has no place in investigations. Used appropriately, technology can reduce administrative workload, help organise information, support transcription, collate timelines and assist with routine drafting tasks. Those capabilities are useful, particularly when investigation teams are working under significant time and resource pressures.

The concern is what happens when efficiency becomes confused with investigation quality.

There is an understandable temptation to believe that if technology can make an investigation faster, more consistent and easier to document, it must also make the investigation better. That assumption deserves much more scrutiny.

A well-formatted report is not necessarily evidence of a well-conducted investigation. A completed ICAM chart does not prove that the contributing factors have been properly understood. A rapidly generated timeline does not tell us whether important evidence is missing. A professionally worded finding does not demonstrate that the reasoning behind it is sound.

Automation can improve parts of the process. It cannot create the investigator.

That distinction matters because ICAM has always been a thinking discipline.

The capability organisations need most is therefore not simply better technology. It is investigators who are prepared to remain curious, test assumptions, follow evidence, challenge convenient explanations and continue developing their craft.

The danger of confusing completion with quality

Technology is particularly attractive in investigations because investigations contain many visible tasks.

There are documents to collect, interviews to record, evidence to catalogue, timelines to construct, charts to populate, findings to write and reports to produce. Many of those activities can now be accelerated through digital tools and artificial intelligence.

But the visible activities are only part of an investigation.

The difficult work happens between them.

An investigator must decide what information matters, what information is missing, whether two pieces of evidence actually support one another, whether an interview response should be explored further, whether an apparent procedural failure is really a symptom of something deeper and whether the available evidence is sufficient to support a finding.

Those decisions require judgement.

Safety Wise's ICAM methodology deliberately follows a structured investigation process of gathering, organising, analysing and learning. The purpose is not simply to move information efficiently through those stages. It is to progressively develop an evidence-based understanding of what happened, why it happened and what the organisation should learn from it.

ICAM looks beyond the errors and violations of individuals and examines the contributing factors surrounding the event. It seeks systemic deficiencies and considers the adequacy of the organisation's defences and controls.

That requires considerably more than processing information.

It requires thinking.

Investigation quality is built before the analysis begins

One of the misconceptions created by increasingly capable technology is that analysis is where the intellectual work of an investigation happens.

In reality, investigation quality is often determined much earlier.

Consider PEEPO.

People, Environment, Equipment, Procedures and Organisation provide investigators with a structured way of planning and gathering information across the system of work. PEEPO is not simply a filing system for evidence. Used properly, it forces the investigation team to broaden its field of view.

What people need to be interviewed? What was happening in the work environment? What equipment was involved and what was its condition? Which procedures, standards or instructions were relevant? What organisational systems, decisions, resources or expectations need to be examined?

Those questions generate more questions.

That is the point.

The Safety Wise Data Gathering and Witness Interviewing course describes disciplined data gathering as the foundation for a quality investigation outcome. Relevant information must be factual and supported by evidence, and investigators are encouraged to explore broadly rather than settle for the obvious.

That is investigative discipline in practice.

A weak investigator can populate a PEEPO chart.

A developing investigator uses PEEPO to discover what they do not yet know.

There is a significant difference.

Evidence must remain more powerful than assumption

One of the most important habits an investigator develops is learning to recognise the difference between what appears likely and what the evidence actually establishes.

After an incident, explanations emerge quickly.

"The operator didn't follow the procedure."

"The supervisor should have checked."

"They were rushing."

"The risk assessment wasn't completed properly."

"The worker was experienced and should have known."

Some of those statements may eventually be supported by evidence. Others may prove incomplete, irrelevant or simply wrong.

The investigator's responsibility is not to select the explanation that sounds most plausible. It is to establish the facts.

That requires intellectual discipline because human beings naturally form hypotheses. Once we have an explanation that seems to make sense, there is a risk that subsequent information is interpreted through it.

Experienced investigators learn to resist that pull.

They ask what evidence supports the proposition. They look for information that could disprove it. They distinguish contributing factors from information that happened to be present but did not contribute to the event. They recognise gaps and inconsistencies rather than smoothing them over.

Technology can help an investigator find information.

It cannot remove the investigator's obligation to interrogate it.

In fact, as AI-generated outputs become increasingly fluent and convincing, that discipline becomes even more important. Confidence of presentation must never be mistaken for strength of evidence.

A timeline is not just a chronology

The same principle applies to timeline reconstruction.

At its simplest, a timeline appears to be an ordered sequence of events. That makes it an obvious candidate for automation. Give a system enough timestamps, interview transcripts, photographs, equipment data and records, and it may be able to arrange much of the chronology extremely quickly.

Useful? Absolutely.

Complete? Not necessarily.

The investigative value of a timeline is not simply knowing that Event B followed Event A. The investigator needs to understand what the sequence reveals.

What changed?

When did conditions begin moving away from what was intended?

Which controls should have been operating?

What information was available to the people involved at the time?

Were there conflicting accounts?

Is there a gap in the sequence that requires further evidence?

Did an apparently minor event create the conditions for something significant several steps later?

The timeline therefore becomes an analytical bridge between gathering evidence and understanding contributing factors.

That bridge still has to be crossed by an investigator.

Human error should open the investigation, not close it

Perhaps nowhere is the need for investigative thinking clearer than when human error appears in an incident.

It is usually not difficult to identify the final action associated with an adverse outcome. Someone selected the wrong control, omitted a step, misunderstood information, entered an area, made a decision or departed from a procedure.

The easier that action is to see, the greater the danger that it becomes the explanation.

ICAM deliberately asks investigators to look further.

Safety Wise training teaches investigators that concluding human error was involved does little by itself to prevent recurrence. The investigator needs to understand the factors that influenced the error and the wider system in which the action occurred.

What conditions existed?

What equipment or interfaces influenced performance?

What procedures and practices shaped the task?

What pressures existed?

What knowledge was available?

What defences were absent or failed?

What organisational factors created or allowed those conditions to develop?

These questions are not generated because ICAM is trying to excuse people. They are asked because prevention requires understanding.

Stopping at the individual action gives the organisation something visible to correct. Continuing the investigation gives the organisation an opportunity to learn.

That difference is fundamental.

Good investigators learn to stay curious

The attributes Safety Wise teaches for effective investigators are revealing.

Integrity and ethics matter. So do communication, governance and compliance, adaptability and technical capability.

But several attributes deserve particular attention in the age of automation: exploration and research, critical thinking and problem solving, alertness, responsiveness and persistence.

An effective investigator has a need to find out more.

They do not settle for the obvious.

They connect and logically interpret valid data.

They recognise when something has not been adequately resolved.

They persist when information is difficult to obtain.

These characteristics cannot be reduced to knowing which box to complete next in an investigation template. They develop through education, practical application, reflection and repeated exposure to investigation problems.

This is why investigator development cannot be treated as a one-off training event.

Completing a course should create capability, but it should also create appetite.

The strongest investigators continue asking questions long after their initial training is finished.

Practical training creates the foundation

Formal training remains essential because investigators need a consistent methodology and a shared understanding of what good investigation looks like.

Safety Wise's investigation training pathway deliberately addresses different levels of capability and organisational responsibility.

The Fundamentals of Investigation course develops the principles required to conduct systematic investigations into lower-level events, including data gathering, witness interviewing, data organisation, analysis and the development of corrective actions.

The ICAM Lead Investigator course develops the capability to lead and facilitate investigations of significant events and examine contributing factors at a deeper systemic level.

Specialist courses in Data Gathering and Witness Interviewing and Investigation Report Writing develop capabilities in areas where investigation quality can easily be lost.

These courses are practical for a reason.

Investigation is applied work.

You cannot become a capable interviewer simply by reading a list of recommended questions.

 You need to understand how people recall events, how questioning can influence responses, when to probe, when to listen and how to create an environment where useful information can emerge.

Likewise, you cannot become an effective analyst simply by memorising ICAM categories. You need to practise moving from evidence to contributing factors, testing relationships and distinguishing genuine systemic issues from attractive but unsupported explanations.

Methodology gives investigators structure.

Practice develops judgement.

Governance is part of investigation capability

Investigator development alone, however, is not enough.

Organisations also need leaders who understand what a good investigation requires.

This is where governance training becomes critical.

A technically capable investigation team can still be undermined by poor terms of reference, unrealistic deadlines, inappropriate expectations, pressure for particular findings or an organisational culture that regards uncomfortable findings as problems to be managed rather than lessons to be understood.

ICAM Governance training therefore matters because investigation quality is partly a leadership responsibility.

Those commissioning, overseeing and receiving investigations need to understand why systemic investigation matters, why evidence must drive findings and why the organisation should be interested in broader contributing factors rather than simply the actions closest to the incident.

They also need to recognise the importance of investigation reports as instruments for organisational improvement.

An organisation does not build investigation capability merely by training investigators.

It builds capability by creating an environment in which investigators are expected, supported and permitted to investigate properly.

ICAM Goverance for Managers

ICAM Governance for Office Holders

The ICAM QRG (Quick Reference Guide) keeps methodology close to the work

Formal training provides depth, but investigators also need practical support when they return to the workplace.

This is the role of a good Pocket Investigation Guide and the Quick Reference Guide.

Investigations rarely unfold in the convenient order of a classroom exercise. The investigator may be standing at an incident scene, preparing for an interview, reviewing a timeline or testing an emerging contributing factor weeks or months after completing formal training.

At those moments, the value of a practical reference is considerable.

The QRG brings the methodology back into the investigation itself. It provides a prompt for the process, the questions to consider and the discipline required at each stage.

Importantly, it should not replace thinking.

A reference guide cannot tell an investigator what happened in a particular incident. It can help the investigator remember what needs to be considered in finding out.

That is an important distinction across the entire Safety Wise development approach.

Tools should support judgement, not substitute for it.

Cam's Corner makes development continuous

There is another problem with traditional training models: investigation capability can deteriorate between investigations.

Some investigators may conduct several significant investigations each year. Others may go months without leading one. Skills that seemed clear in the training room can become less accessible when they are not regularly applied.

Continuous learning matters.

That is the thinking behind Cam's Corner.

Short, regular investigation content creates opportunities to revisit concepts, challenge assumptions and keep investigation thinking active between formal courses and actual incidents.

A discussion about PEEPO today might cause an investigator to reconsider how they plan evidence gathering tomorrow. A prompt about interview technique might change the way they approach their next witness. A scenario involving a failed control might sharpen the questions they ask during their next analysis.

No single piece of daily content turns somebody into an expert investigator.

That is not its purpose.

Capability is cumulative.

Small, regular exposures to investigation concepts help maintain the language, questions and habits of good investigation. They encourage investigators to keep learning rather than regard their original qualification as the end of their development.

The best investigators rarely believe they have finished learning.

Cam's Corner Podcast

From Incident to Insight: keeping investigation thinking active

Continuous development also requires investigators to stay connected to the broader conversations taking place around incidents, investigation quality and organisational learning. Formal training can establish the methodology, but maintaining capability means continuing to engage with the questions and challenges that emerge when that methodology is applied in real workplaces.

That is the purpose of Safety Wise's twice-weekly LinkedIn newsletter, From Incident to Insight.

The newsletter provides another opportunity to keep investigation thinking active between formal training and actual investigations. Rather than treating professional development as something that happens only when a course is scheduled or a refresher becomes due, it creates a regular point of contact with ideas that investigators, investigation leaders and organisations can consider in the context of their own work.

That regularity matters. Investigation capability is not only developed through major learning events. It is also strengthened through repeated exposure to good questions, different perspectives and practical examples that cause people to reconsider how they approach their next investigation. A discussion about evidence may influence how an investigator prepares for an upcoming interview. An examination of investigation quality may cause a leader to look differently at the next report they receive. An article about controls, assumptions or organisational learning may prompt a team to revisit practices that have gradually become accepted as normal.

In that sense, From Incident to Insight serves a different purpose from formal training while supporting the same objective. It encourages investigators and leaders to continue thinking about the discipline of investigation rather than allowing that thinking to become active only after an incident occurs.

That is particularly important as AI and automation become more prominent. Access to information is becoming easier, and generating summaries, documents and suggested answers is becoming faster. The corresponding professional challenge is to remain interested in the quality of the thinking behind those answers. Regular learning helps maintain that curiosity and gives investigators reasons to keep questioning how they gather evidence, interpret events and turn investigation findings into meaningful organisational learning.

The aim is not to consume more content for its own sake. It is to maintain the habit of thinking like an investigator.

From Incident to Insight Newsletter

From trained investigator to investigation mastery

That philosophy ultimately sits behind the ICAM Mastery pathway. There is an important difference between being trained in an investigation methodology and developing genuine mastery in its application. Formal training establishes the framework, terminology and process, but experience introduces the complexity that cannot be fully replicated in a classroom. Real investigations involve incomplete evidence, conflicting accounts, time pressure, organisational expectations and situations where the most obvious explanation may not withstand closer examination.

Mastery develops through repeated application of the methodology, combined with reflection and continued learning. An investigator gradually becomes better at recognising when an investigation is drifting towards a convenient conclusion, when an assumption has entered the analysis without sufficient evidence, or when an apparent contributing factor does not adequately explain what occurred. They also become more comfortable acknowledging uncertainty. Rather than feeling compelled to fill every gap, experienced investigators recognise when the evidence simply does not support a conclusion and when further investigation is required.

This experience also changes the way investigators challenge information. The first theory proposed by an investigation team may need to be reconsidered. An assumption made during the initial briefing may turn out to be incorrect. A finding that appears reasonable may not be adequately supported by evidence. In other circumstances, an investigator may need to reconsider their own interpretation when new information becomes available. None of this represents failure in the investigation process. It is evidence that the process is working as intended.

For that reason, mastery should not be viewed as another qualification to obtain and then place on a CV. It is better understood as an ongoing professional discipline. The investigator continues to develop their ability to gather evidence, conduct interviews, reconstruct events, analyse contributing factors and connect findings with meaningful recommendations. 

The objective is not simply to become faster at completing an ICAM investigation. It is to become better at knowing where to look, what to question and when the investigation needs to go further.

ICAM Mastery Program

Organisations should build investigators, not just investigation systems

There is an important organisational lesson in this distinction. Many businesses have invested significantly in the systems surrounding incident investigation. Procedures have been standardised, templates developed, reporting workflows introduced and software platforms implemented. AI is now becoming another part of that environment, offering the possibility of faster transcription, document review, information organisation and report preparation.

Those developments can be valuable. Consistency matters, particularly in organisations where investigations are conducted across multiple sites, teams or jurisdictions. Safety Wise training has long emphasised the value of a structured and standardised investigation methodology because it reduces guesswork, supports investigation teams and creates a process that can be reviewed for quality.

The risk arises when investment in the investigation system begins to outpace investment in the people using it. An organisation can have excellent software, detailed procedures and sophisticated reporting tools while still producing poor investigations. If investigators do not know how to plan their evidence gathering, conduct an effective witness interview, distinguish evidence from assumption, reconstruct a meaningful timeline or test a contributing factor, the surrounding technology cannot compensate for those weaknesses.

The same applies to the organisation's expectations of investigators. If success is measured primarily by how quickly an investigation is closed, whether every field in the system has been completed or whether a report has been submitted by a predetermined date, investigators will naturally respond to those measures. 

The organisation may become very efficient at processing investigations without becoming more effective at learning from incidents.

A stronger capability model asks different questions. Are investigators developing their judgement? Are they being exposed to enough practical investigation work to maintain their skills? Do they have access to experienced people when they encounter difficult evidence or analysis problems? Are investigation reports being reviewed for the quality of the reasoning rather than simply for compliance with a template? Are leaders prepared to support an investigation when the evidence takes the team somewhere unexpected?

Those questions move investigation capability beyond systems and administration. They place development, practice and governance alongside methodology.

Building an environment for continuous investigator development

This is also why Safety Wise sees investigator development as more than attendance at a single course. Formal training remains the foundation because investigators need to understand the methodology before they can apply it consistently. The practical courses then allow particular capabilities to be developed in greater depth, whether that involves data gathering, witness interviewing, report writing or the broader requirements of leading an ICAM investigation.

Governance training addresses another part of the capability equation. Investigation quality is influenced by the people who commission investigations, establish their scope, receive their findings and ultimately decide what the organisation will do with what has been learned. A capable investigator operating within weak investigation governance can still encounter pressure that compromises the process. Unrealistic deadlines, narrow terms of reference, expectations about particular findings or a focus on individual behaviour can all restrict the organisation's ability to learn.

The QRG provides a different form of support. Its value lies in keeping the methodology accessible when investigators are applying it in the workplace. An investigator does not need to remember every question, prompt or consideration from formal training. They do need to know how to return to the methodology when they need guidance. Used in that way, the QRG supports thinking rather than replacing it.

Cam's Corner and From Incidents to Insights, extends that development into everyday practice. Regular exposure to investigation concepts helps keep them active between investigations. A short discussion about PEEPO, evidence, interviewing, controls or analysis may appear modest compared with a formal training program, but capability is not developed through formal courses alone. Regular prompts encourage investigators to revisit ideas, test their understanding and continue thinking about how the methodology applies to the situations they encounter at work.

The ICAM Mastery pathway brings those elements together around a broader idea: becoming a better investigator requires continued development. Training establishes the methodology, practical resources support its application, governance creates the organisational conditions for quality investigations, and ongoing learning helps investigators continue refining their judgement.

That is a very different proposition from attempting to automate the investigation itself.

Where technology belongs

None of this requires organisations to reject AI or other forms of automation. Technology can play a useful role in investigations, particularly where it reduces administrative effort that does not require investigative judgement. Organising large volumes of material, assisting with transcription, retrieving information, identifying possible chronological relationships and supporting document management are all areas where technology may allow an investigation team to work more efficiently, provided appropriate confidentiality, security and governance requirements are addressed.

The important question is what happens with the time that technology saves.

If automation simply allows an organisation to demand that investigators complete more investigations in less time, very little may have been gained. 

If it creates additional capacity for investigators to prepare properly for interviews, pursue another evidence source, examine the adequacy of a control or test whether a proposed contributing factor is actually supported by the evidence, the technology is supporting better investigation.

That should be the objective.

The value of AI is not that it can make the investigator less necessary. Its value is that it may allow the investigator to spend less time on low-value administration and more time on the parts of an investigation where judgement matters.

There is also an important boundary here. AI can identify relationships within the information it has been given, but an investigation is partly concerned with discovering the information that has not yet been gathered. It may be able to summarise an interview transcript, but the quality of that transcript still depends on the questions asked, the way the interview was conducted and whether the investigator recognised something that required further exploration. It may be able to arrange events into chronological order, but the investigator still has to determine what the sequence means and whether important events or conditions remain unexplained.

This is why the relationship between technology and investigator capability should be complementary. Better tools can support good investigators. They cannot turn weak investigative reasoning into strong investigative reasoning.

When answers become easier, questions become more important

The capability of AI will continue to improve. Tasks that currently require considerable administrative effort will become faster, and investigation platforms will almost certainly become more sophisticated in the way they organise and present information. Investigators should expect those changes and learn how to use them responsibly.

But as answers become easier to generate, the quality of the questions becomes more important.

An investigator still has to ask whether the evidence is reliable, whether another explanation is possible, whether a control was genuinely effective, why an action made sense to the person at the time, what conditions influenced that action and what organisational factors allowed those conditions to exist. They have to determine whether the investigation has reached a finding because the evidence supports it or because the team has become comfortable with the explanation.

These are not administrative questions. They sit at the heart of ICAM.

They are also why curiosity matters so much. Good investigators develop a healthy dissatisfaction with explanations that stop too early. Human error may describe part of what happened, but it should prompt further investigation into the conditions that influenced the error. A failed procedure may be relevant, but the investigator should still want to understand how the procedure was developed, implemented, understood and used in practice. An absent control may explain how the incident became possible, but the investigation should consider why that control was absent and what this reveals about the broader system.

The purpose is not to make every investigation unnecessarily complex. It is to investigate to the depth necessary to understand the contributing factors and identify learning that can meaningfully reduce the likelihood of recurrence.

Better investigations require better investigators

Our previous article argued that AI can become a useful assistant to an ICAM investigator, but it should not become the investigator. The logical next question is what organisations should invest in if automation itself is not the answer to better investigations.

The answer is investigator capability.

That capability begins with a sound methodology and practical training, but it develops through application. It is strengthened when investigators have access to useful reference material, opportunities to refresh and extend their knowledge, experienced people who can challenge their thinking and organisational leaders who understand what a quality investigation requires.

This is the thinking behind the broader Safety Wise development pathway. Practical investigation courses establish and deepen capability. Governance training helps leaders create the conditions in which good investigations can occur. The QRG keeps the methodology available at the point of application. Cam's Corner keeps investigation thinking active through regular learning. ICAM Mastery provides a pathway for investigators who want to continue developing beyond initial competence.

These resources serve different purposes, but the principle connecting them is straightforward. Investigation capability has to be developed and maintained.

Technology will continue to change the mechanics of investigation. It will make some tasks quicker and others easier. Used well, that should be welcomed because investigators have never needed more administration for its own sake.

What technology cannot provide is the professional curiosity that causes an investigator to question an easy explanation, the discipline to distinguish evidence from assumption, the judgement to recognise that a finding is not sufficiently supported or the persistence to keep investigating when the first answer is not good enough.

Those capabilities are developed.

For organisations considering the future of investigation, that may be the more important investment. The question is not how much of an ICAM investigation can eventually be automated. It is how technology can be used while continuing to develop people who know how to investigate.

Because the quality of an ICAM investigation will ultimately depend less on how quickly an answer can be produced than on whether the investigator had the discipline, capability and curiosity to ask the right questions in the first place.