Organisational Culture in ICAM: Look for the Evidence, Not the Label

A question came up recently during a live Q&A session in our ICAM Mastery program: How do you identify Organisational Culture when analysing the Organisational Factors in an ICAM investigation?

It is a good question because Organisational Culture, or OC, can be one of the more difficult Organisational Factors for investigators to identify and, importantly, to substantiate. We can photograph a missing guard, examine a procedure, review a training record or establish that a risk assessment failed to identify a foreseeable hazard. Culture is less tangible. You cannot photograph it at the incident scene, and you are unlikely to find a document that neatly confirms that a particular cultural condition existed and contributed to an incident.

This is where investigators can sometimes take too broad an approach. They identify several behaviours or conditions that concern them and conclude that the organisation has a "poor safety culture". While that may sound significant, it does not necessarily tell us much about why the incident occurred, and it may go well beyond what the available evidence actually supports.

A better approach is to stop trying to diagnose the culture of an entire organisation and instead examine the smaller, observable pieces of organisational life that may indicate a cultural influence. In other words, take it in bite-sized chunks and follow the evidence.

That approach is much more consistent with what an ICAM investigation is intended to achieve. ICAM looks beyond frontline errors and violations to identify the conditions within the broader system that influenced what happened. Organisational Factors represent the latent organisational conditions that can shape the workplace, the task and ultimately the actions of individuals and teams. The purpose of the investigation is therefore not to find a convenient label, but to understand the specific organisational conditions that contributed to the event.

What do we actually mean by culture?

Culture is often described as "the way we do things around here". It is a useful shorthand, but investigators need to go further than that.

From an investigation perspective, we are interested in patterns of behaviour, expectations, decisions and organisational responses that have developed over time and may have influenced the conditions surrounding an incident. Those patterns matter because people do not make decisions or perform work independently of the organisations in which they operate.

The ICAM model deliberately moves the investigation beyond what happened at the frontline. It considers the Absent or Failed Defences, Individual or Team Actions, Task or Environmental Conditions and Organisational Factors that combined to produce the outcome. The purpose is not simply to identify what somebody did immediately before an incident, but to understand why that action occurred in the circumstances that existed at the time.

When culture is relevant, we might therefore be asking why a particular behaviour had become accepted, why an issue was repeatedly tolerated, why employees had adapted the way they performed a task, or why a known problem was no longer treated as unusual.

However, culture should never become a convenient bucket into which we put everything that is difficult to explain. If Organisational Culture is identified as a contributing factor, the investigation team should be able to explain what aspect of the culture they are referring to, what evidence supports that conclusion, and how it contributed to the incident.

"Poor safety culture" is rarely a useful finding

Consider a finding in an investigation report that simply states:

Organisational Culture: The site had a poor safety culture.

What exactly is management supposed to do with that finding? Where should they start? What needs to change, and how would the organisation know whether the problem had been addressed?

There is also an evidentiary problem. A workplace may employ hundreds or thousands of people across different departments, crews, sites, shifts and management structures. An investigation into a single event may uncover something important about the culture surrounding a particular task, workgroup or management practice, but that does not necessarily provide enough evidence to characterise the culture of the entire organisation.

Broad findings also tend to produce broad recommendations. If the finding is "poor safety culture", the recommendations can easily become another round of culture training, communication campaigns, leadership messaging or reminders about organisational values. Those actions might be well intended, but they may do little to address the specific conditions that contributed to the incident.

The more useful question for the investigator is: What exactly are we seeing that makes us think Organisational Culture may have played a role?

Once we ask that question, we have something we can investigate.

Start with the observable signal

Culture often becomes visible through patterns. An investigation might reveal that incidents regularly go unreported, hazards are known but not raised, procedures are routinely bypassed, supervisors accept shortcuts, maintenance defects are repeatedly carried forward, employees are reluctant to stop work, or previous investigation recommendations have not been effectively implemented.

Each of these observations is potentially significant, but none should automatically result in an Organisational Culture finding. Instead, treat the observation as a signal that tells you where to investigate next.

That distinction matters. The investigator is not there to diagnose the organisation based on an impression. The investigator is there to gather and validate evidence, establish the facts and determine whether the conditions identified contributed to the incident.

Consider under-reporting

Suppose you discover during an investigation that several similar events occurred previously but were never formally reported. It would be tempting to write "poor reporting culture" and move on.

But what does that actually mean?

The next step should be to explore why those events were not reported. Did employees understand the reporting requirements? Were the events considered too minor to report? Was the reporting system difficult or time-consuming to use? Had employees reported similar events previously without receiving feedback? Did they believe nothing would change? Were supervisors discouraging reports, either directly or indirectly? Was reporting associated with additional work, scrutiny or some other negative consequence?

You may hear workers say things such as, "We've raised that before and nothing happened", or, "You don't want to be the person who makes the team's numbers look bad." Those comments are useful investigative leads, but they are not necessarily findings on their own. They should prompt the investigation team to look further.

Review previous incident and hazard reports. Examine whether corrective actions were raised and completed. Look at how long actions remained open and whether feedback was provided to the people who originally raised the issue. Consider how reporting statistics are used by the organisation and whether the way performance is measured may unintentionally discourage reporting.

Now the cultural issue is becoming more visible because it is supported by evidence about how the system actually operates.

Perhaps employees have learned over time that reporting has little value. Perhaps they perceive that reporting carries a personal cost. Perhaps supervisors have become reluctant to enter minor events because of the administrative burden that follows. These are much m

ore specific and useful organisational issues than simply concluding that there is a "poor reporting culture".

What if everyone bypasses the procedure?

Another common situation occurs when an incident involves a departure from a procedure.

A shallow investigation can stop at "procedure not followed". A better investigation asks why the procedure was not followed and whether the behaviour was isolated or part of an established way of working.

Imagine an operator tells you, "Nobody does it that way." You then interview several other workers who tell you the same thing. The supervisor acknowledges that the documented procedure is not how the task is normally performed, and when you observe the task you discover that following the procedure exactly as written would make the work considerably more difficult or perhaps impractical.

At that point, the investigation has moved well beyond one employee failing to comply with a procedure.

What you may be seeing is a gap between work as imagined and work as done. The organisation imagines the task being performed in one way because that is what the procedure describes, while the workforce has adapted the task to operational reality. That adaptation may have existed for months or years and may even have become the way experienced workers teach new employees to do the job.

It would be easy to characterise this as workers having a poor attitude towards procedures. That conclusion could completely miss the organisational issue. The workers may have developed the adaptation because the formal system does not adequately support the task.

The more useful investigative question becomes: How did the documented system and operational reality drift apart, and what allowed that difference to continue?

That question may take the investigation into procedure development, consultation, supervision, change management, task design, workload, equipment availability, resources or competing organisational priorities. What initially looked like people breaking the rules may actually reveal a much deeper organisational condition.

Isolated behaviour or established pattern?

One of the most useful distinctions an investigator can make is between isolated behaviour and an established pattern.

If one employee bypasses a required step, that tells us something and needs to be understood in context. If ten employees performing the same task all bypass the same step, that tells us something quite different. If their supervisor knows they bypass it, and the supervisor's manager has observed the task being performed that way, and the workaround has existed for several years, it becomes increasingly difficult to describe the issue simply as an individual departure from the procedure.

The organisation has, formally or informally, learned to operate that way.

This is particularly relevant when considering routine violations. Safety Wise ICAM training material describes routine violations as habitual departures where the breach of rules may be implicitly accepted, and importantly notes that these behaviours can be perpetuated by supervision and management that tolerates the departure.

The investigative question should therefore move beyond, "Why did this person violate the procedure?" and towards, "How did this way of working become normal?"

That shift in questioning can fundamentally change the direction and quality of an investigation.

Culture is often visible in what an organisation tolerates

Organisations communicate expectations in more than one way. There is what the organisation formally says through its policies, procedures, values and leadership messages, and then there is what the organisation repeatedly accepts in practice.

For an investigator, the second can be particularly revealing.

An organisation may state that safety takes priority over production, but what actually happens when production and safety compete? What decisions are made when a piece of equipment is due for maintenance but production is behind target? What happens when a worker stops a job? What behaviours attract management attention, and which ones are routinely ignored?

These situations can provide a useful window into organisational culture because priorities often become most visible when they are in conflict.

Consider a piece of equipment that is overdue for maintenance. The maintenance team has requested downtime, operations is under production pressure, and a decision is made to continue operating the equipment. Two weeks later, the equipment is involved in an incident.

It might be tempting to label this as a "production over safety culture", but again that is too broad. The investigator should break the issue down.

Who made the decision to continue operating? What information did they have? What risk controls were considered? Was there a formal process for deferring maintenance, and was that process followed? How frequently had similar maintenance activities been deferred? What performance measures were influencing operational decisions? Did maintenance personnel have the authority to remove equipment from service, and what happened when they attempted to exercise that authority?

Those questions turn a general accusation about culture into an investigation of organisational decision-making.

Look at what happens when people raise bad news

Another useful window into culture is the organisation's response when somebody raises a problem.

Imagine a worker reports a hazard. Are they encouraged to raise it? Is the issue investigated? Is action taken? Does the worker receive feedback about what happened?

Or do they repeatedly hear responses such as, "We've always done it that way", "Just be careful", or "We don't have the budget to fix that at the moment"?

One comment does not define an organisational culture, but repeated responses across different people, events and periods may indicate an established organisational condition.

This is why investigators should look for patterns across multiple evidence sources. Interview workers and supervisors, review previous hazard reports, examine outstanding corrective actions, look at meeting minutes and maintenance requests, and consider whether the same concerns have been raised repeatedly without effective resolution.

Culture is rarely established by one piece of evidence. It becomes clearer when different evidence sources begin telling a consistent story.

Use PEEPO to explore the issue properly

PEEPO is particularly useful when exploring potential cultural influences because it encourages the investigation team to gather information broadly before drawing conclusions.

The five categories of People, Environment, Equipment, Procedures and Organisation provide a structured way of considering the system of work. Safety Wise emphasises gathering as many relevant facts as possible and validating information as fact through supporting evidence. It also reminds investigators that when human error is identified, the investigation needs to look beyond the error and understand why it occurred.

That principle is particularly important when Organisational Culture is suspected.

For example, workers might tell the investigation team that reporting hazards achieves nothing. That is useful People data, but it should not automatically become a finding. The team can then review previous hazard reports and discover that a significant number were closed without meaningful corrective action or feedback. Meeting records might show that the same hazards had been discussed repeatedly, while interviews with supervisors may establish that they had limited authority or resources to address them.

The picture is now considerably stronger. We are no longer relying on one person's opinion that "management doesn't care". We are identifying the organisational conditions that may have created that perception and influenced the behaviour of the workforce.

Evidence before labels

A useful discipline is to delay applying the Organisational Culture label until the evidence has been gathered and analysed.

Start with what you know. For example:

Known fact: Five operators interviewed stated that minor equipment damage was normally discussed within the crew but was not entered into the incident reporting system.

Then validate it. A review of maintenance records may identify numerous repairs consistent with minor equipment impacts during the previous six months, while only a small number of corresponding incident reports exist.

Then explore why. Operators may consistently report that previous minor incident reports resulted in significant administrative follow-up but little visible corrective action or feedback.

Now there is something meaningful to analyse.

The finding should emerge from the evidence. The investigation should not start with the conclusion that there is a "poor reporting culture" and then selectively gather information to support that conclusion.

This distinction is fundamental to investigation quality.

Be careful about assuming motivation

Another common trap when investigating culture is assuming we know why people behaved in a particular way.

Take the statement, "They didn't report the incident because they don't trust management."

That may ultimately prove to be correct, but unless the investigation establishes it, it remains an assumption.

There are many other possible explanations. Employees may not have understood the reporting threshold, the reporting system may have been difficult to access, the supervisor may have advised them that a verbal report was sufficient, previous reports may not have resulted in action, or reporting may have been associated with negative consequences.

Each explanation points towards a different organisational condition and potentially a different corrective action.

A reporting system problem requires a different response from a trust problem. A knowledge issue requires a different response from deliberate suppression of reporting. A resource problem requires a different response from a management behaviour problem.

If the investigation jumps immediately to "culture", the team may miss the mechanism that actually needs to change.

Look for what reinforces the behaviour

One of the most useful questions when exploring Organisational Culture is:

What is reinforcing this behaviour?

If procedures are routinely bypassed, what makes bypassing them easier or more effective than following them? If hazards are not being reported, what has taught people that reporting is not worthwhile? If maintenance is continually deferred, what organisational pressures or measures support those decisions? If workers are reluctant to stop a job, what happens to people who do stop work?

Similarly, if risk assessments have become little more than a paperwork exercise, how are those assessments actually used by supervisors and managers? Are they used to make decisions, or simply checked for completion? If investigation recommendations repeatedly focus on retraining workers rather than addressing system conditions, what does that tell us about how the organisation understands the purpose of investigation?

These questions help move the analysis away from abstract descriptions of culture and towards the organisational systems and responses that shape behaviour.

A simple test: Can you describe it without using the word "culture"?

One useful quality check is to ask the investigation team whether they can describe the issue without using the word "culture".

Instead of writing "poor reporting culture", could you say:

"Employees had stopped reporting minor equipment incidents because previous reports had not resulted in visible corrective action or feedback."

Instead of "poor procedural compliance culture", could you say:

"The documented procedure was routinely bypassed across the workgroup, with the practice known to and accepted by frontline supervision."

Instead of "production-driven culture", could you say:

"Planned maintenance was repeatedly deferred to meet production requirements, including on four occasions during the three months preceding the incident."

The second version in each example tells us much more. It describes an observable condition that can be investigated and validated. It also provides a much stronger foundation for developing meaningful recommendations.

The label may eventually be useful for coding the contributing factor within the ICAM analysis, but the label should never substitute for explaining what actually happened within the organisation.

Take Organisational Culture in bite-sized chunks

When Organisational Culture appears relevant, resist the temptation to characterise the entire organisation. Break the issue into manageable investigative areas and follow each one as far as the evidence justifies.

Reporting: Do people report incidents, hazards and errors? If not, what happens within the reporting process that might discourage them?

Speaking up: Can employees challenge a decision they believe is unsafe? Can junior personnel challenge someone more senior, and what happens when they do?

Procedures: Do documented procedures reflect how work is actually performed? If people routinely deviate from them, is that known and accepted by supervision?

Risk: What level of operational risk is routinely accepted, who makes those decisions, and how are they documented?

Production: When operational targets and safety requirements compete, how are those competing priorities resolved in practice?

Maintenance: Are defects repaired, formally deferred or simply normalised over time? What drives those decisions?

Learning: What happens after incidents and near misses? Are recommendations implemented, lessons communicated and recurring events recognised?

Supervision: What behaviours do supervisors challenge, what do they tolerate, and what might they unintentionally reinforce?

Accountability: How does the organisation respond to mistakes and violations? Does that response encourage reporting and learning, or create reasons for people to conceal problems?

Each of these areas gives the investigator something tangible to explore. They are far more useful than beginning with the question, "Does this organisation have a poor safety culture?"

One incident may reveal a clue, not the whole answer

Investigators also need to remain conscious of scope.

An ICAM investigation is commissioned to understand a particular incident. During that investigation, the team may identify evidence suggesting a broader organisational issue, but that does not necessarily mean the team has sufficient evidence to determine how widespread the issue is.

An investigation may establish, for example, that one maintenance team had normalised bypassing a particular permit requirement. That can legitimately be considered in the analysis if it contributed to the incident. However, claiming that the entire organisation has a "permit compliance culture problem" may go well beyond the evidence gathered.

Sometimes the more appropriate conclusion is that the condition has been established within the workgroup or activity examined and that the organisation should determine whether the same condition exists elsewhere.

That distinction allows the investigation to remain evidence-based while still creating an opportunity for wider organisational learning.

Individual investigations can also reveal wider patterns

Although we need to be careful about making broad cultural claims from a single event, organisations should not ignore the collective picture emerging from multiple investigations.

If one investigation identifies poor feedback following hazard reporting, that is useful information. If six investigations across three sites identify similar conditions, the organisation now has a much stronger signal.

The same applies if investigations repeatedly identify tolerated procedural deviations, unresolved hazards, ineffective supervision, maintenance deferrals, reluctance to report or failure to implement previous recommendations.

At that point, the organisation should ask a broader question:

What are these investigations collectively telling us about how our organisation operates?

This is one of the reasons Organisational Factor coding and trend analysis are valuable. Individual incidents provide pieces of organisational information. Looking across those pieces can reveal recurring systemic weaknesses that may not be obvious when each event is considered in isolation.

Culture should not become another form of blame

There is one final caution.

"Organisational Culture" should not become a more sophisticated way of assigning blame.

We may have moved beyond an investigation that concludes, "The operator caused the incident", but replacing that conclusion with, "The organisation has a bad culture", does not necessarily represent better investigation. It may simply move the blame from the individual to the organisation.

ICAM asks us to do more than that.

The objective is to understand the system: what conditions existed, which defences were absent or failed, what Individual or Team Actions occurred, which Task or Environmental Conditions influenced those actions, and which Organisational Factors created, permitted or failed to adequately control those conditions.

The objective is organisational learning and improvement, not finding a more impressive-sounding culprit.

Follow the evidence and let the culture reveal itself

Organisational Culture can be an important Organisational Factor in an ICAM investigation, but it needs to earn its place in the analysis.

Rather than beginning with, "This organisation has a poor culture", begin with what you can observe and establish.

People are not reporting incidents. Why?

Procedures are routinely bypassed. How did that become normal?

Maintenance defects are repeatedly accepted. What is driving those decisions?

Employees are reluctant to challenge unsafe decisions. What happens when somebody does speak up?

Supervisors tolerate a workaround. Why has it been allowed to continue?

Previous investigation recommendations have not been implemented. What prevented effective action?

Follow those threads using PEEPO. Interview broadly, review the relevant documents, examine previous events and compare what the organisation says should happen with what actually happens. Look for patterns and validate them against multiple sources of evidence.

The investigation may eventually lead you to Organisational Culture. When it does, you should be able to describe precisely which aspect of the culture mattered, what evidence demonstrated it and how that condition contributed to the incident.

That is considerably stronger than simply declaring that the organisation has a "poor safety culture", and it gives the organisation something specific it can learn from and act upon.

Don't try to diagnose the whole culture from one incident. Investigate the behaviours, decisions, systems and repeated organisational responses that reveal it.

The culture will show itself.