Good Investigations Don’t Start at the Incident- They Start with Capability

Most organisations treat investigations as a response activity.

Something happens. An investigation team is formed. People gather data, build a timeline, and produce a report.

And then we expect quality.

But here’s the problem:

You don’t get a quality investigation because you respond well. You get a quality investigation because you were prepared.

The Myth of “We’ll Figure It Out When It Happens”

In many organisations, investigation capability is assumed- not built.

• “We’ve trained our people.”

• “We have a process.”

• “We’ll pull a team together when needed.”

But when a serious event occurs, the cracks show quickly:

• Evidence is missed or not preserved

• Interviews drift into assumptions

• Timelines are incomplete

• Findings are vague or disconnected from controls

• Recommendations don’t address the real risk

None of this happens because people don’t care.

It happens because capability wasn’t developed deeply enough before the event.

Investigations Are a System- Not an Event

High-quality investigations follow a structured model:

• Gather – establish what happened

• Organise – build a clear timeline

• Analyse – understand why it happened

• Learn – identify what needs to change

This isn’t just a process. It’s a system of thinking and skills applied under pressure.

And like any system, the outcome is only as strong as the capability behind it.

Where Capability Really Shows Up

You can’t see capability in a training certificate.

You see it in how investigators actually perform.

1. Data Gathering (PEEPO)

Strong investigators don’t jump to conclusions.

They:

• Explore People, Environment, Equipment, Procedures, and Organisation

• Ask “What evidence supports this?”

• Separate fact from assumption

Weak capability leads to:

• Early conclusions

• Missing data

• Bias creeping into the investigation

2. Evidence vs Assumption

Good investigations are built on verified facts.

Not:

• “They should have…”

• “They probably…”

• “It looks like…”

Without disciplined evidence gathering, the entire analysis becomes unstable.

3. Timeline Reconstruction

A timeline is more than a sequence of events.

It’s the backbone of understanding:

• What conditions existed

• What controls were present or absent

• How the situation evolved

If the timeline is weak, everything that follows is compromised.

4. Control-Based Thinking

ICAM is not about identifying who made a mistake.

It’s about understanding:

• What controls should have been in place

• Which controls failed

• Why the system allowed the conditions to exist

When capability is low, investigations drift back to:

“The person didn’t follow the procedure”

When capability is high, the question becomes:

“Why did the system allow that to make sense at the time?”

Why This Matters More Than Ever

Most incidents involve some form of human error.

But stopping there doesn’t prevent recurrence.

To improve safety and performance, organisations must:

• Understand contributing factors across the system

• Strengthen defences

• Learn in a way that leads to meaningful change

That only happens when investigation capability is strong.

Because:

The quality of your investigation determines the quality of your risk controls.

The Real Shift: From Response to Readiness

If you want better investigations, don’t wait for the next incident.

Build capability now.

That means developing:

• Skilled investigators—not just trained ones

• Consistent application of ICAM principles

• Confidence in data gathering and analysis

• The ability to challenge assumptions and think systemically

Because when the incident happens, it’s too late to build capability.

You’re already relying on what exists.

Final Thought

Most organisations focus on how they respond to incidents.

Few focus on whether they’re ready to investigate them well.

But the difference is significant.

Response gives you a report. Capability gives you learning.

And learning is what prevents the next event.