Stop Investigating the Brown M&M’s

What Van Halen’s Brown M&M’s Teach ICAM Investigators About Finding What Really Matters

In the early 1980s, Van Halen famously included a clause in their concert rider:

No brown M&M’s in the backstage bowl.

At first glance, it sounds like a rockstar ego. Petty. Unreasonable.

But it wasn’t.

It was a control.

If the band walked into a venue and saw brown M&M’s, they didn’t just complain. They stopped and checked everything. Rigging, power supply, stage loading- the things that could seriously hurt people.

Because if the promoter missed something small and visible, what else had they missed that wasn’t?

The brown M&M’s were never the issue.

They were a signal.

Most Investigations Still Focus on the Wrong Thing

In many workplaces, investigations still focus on the equivalent of the brown M&M’s.

Someone didn’t follow a procedure. Someone made a mistake. Someone didn’t check properly.

These are visible issues. Easy to point to. Easy to report.

But ICAM was never designed to stop there.

ICAM exists to move past the visible and understand the system behind it- because incidents don’t occur from a single failure. They occur when multiple contributing factors align across People, Environment, Equipment, Procedures and Organisation.

When we stop at the obvious, we’re not investigating. We’re describing symptoms.

The Critical Shift: From Issue to Indicator

The real lesson from the Van Halen story is this:

The brown M&M’s weren’t the problem. They were an indicator of a deeper failure in the system.

That distinction matters.

In an ICAM investigation, what you first see is rarely the core issue. It’s usually the final link in a chain of conditions, decisions and influences that have built up over time.

This is why focusing only on human error is ineffective. Human error is common across all industries, but identifying it alone doesn’t help prevent recurrence. What matters is understanding what influenced that error in the first place.

Why Investigators Stop Too Early

Even experienced investigators can fall into the trap of stopping at the visible issue.

Part of this comes down to how we think. We naturally focus on what we can see- a missed step, a damaged component, an action taken by a person. These are tangible and immediate.

There’s also pressure. Investigations are often expected to be completed quickly, which pushes teams toward simple explanations and fast conclusions.

And then there’s framing. If an investigation starts with “who did what,” it will almost always end with a person-based outcome.

But ICAM takes a different position.

It assumes that if something went wrong, the system allowed it to happen.

A Practical Example

Consider a simple scenario.

An operator skips a step in a checklist.

A traditional investigation might conclude that the operator failed to follow procedure.

But that’s just the brown M&M’s.

An ICAM investigation would keep going.

What was happening at the time? Was there time pressure? Was the checklist practical and aligned with how the task is actually performed? Was the environment distracting or difficult? Were there known workarounds? What supervision or expectations were influencing behaviour?

By systematically exploring across People, Environment, Equipment, Procedures and Organisation, the investigation shifts from a single action to a system view.

And that’s where the real learning sits.

Fixing Symptoms vs Fixing Systems

If Van Halen had simply removed the brown M&M’s from the bowl, they would have solved nothing.

The real risks would still be there.

This is exactly what happens when organisations respond to incidents with:

• refresher training

• procedure re-issues

• safety alerts

These actions might address the visible issue, but they rarely address the conditions that allowed it to occur.

As a result, the same types of incidents repeat- sometimes with more serious consequences.

ICAM is designed to prevent that cycle by focusing on contributing factors and system conditions, not just the outcome.

The Power of “If Not, Why Not?”

One of the most effective questions an investigator can use is:

“If not, why not?”

If the procedure existed, why wasn’t it followed? If the control was in place, why didn’t it work? If supervision was present, why didn’t it intervene?

This question forces a move away from assumption and into exploration. It aligns directly with structured data gathering, where investigators are expected to challenge initial impressions and seek evidence across multiple sources.

It’s also where many investigations either succeed or fail.

Brown M&M’s as a System Check

What Van Halen created was essentially a simple but powerful assurance mechanism.

They weren’t checking confectionery.

They were checking whether the system could be trusted.

In ICAM terms, this connects directly to the idea of controls and defences. A control only has value if it works in practice, not just on paper. If small requirements are missed, it raises legitimate questions about whether critical controls are being applied properly.

This is where investigators need to pay attention.

Small signals often reveal much larger weaknesses.

What Good Investigators Do Differently

Strong ICAM investigators treat visible issues as entry points, not conclusions.

They take the time to reconstruct what actually happened, not just what is assumed to have happened. Timeline development becomes critical here, allowing the sequence of events to be understood in context rather than in isolation.

They also expand their thinking beyond a single perspective. By working across PEEPO, they ensure they are not narrowing the investigation too early or overlooking contributing factors.

Most importantly, they link findings to evidence. Assumptions are replaced with validated information- interviews, observations, documentation and physical evidence.

This is what separates a report from an investigation.

Signals of System Health

Over time, experienced investigators start to recognise patterns.

Small issues that appear repeatedly. Workarounds that become normal. Controls that exist but aren’t applied consistently.

These are all signals.

They may seem minor in isolation, but collectively they point to the health of the system.

ICAM encourages organisations to look for these patterns, not just individual events, because this is where meaningful improvement happens.

Why This Matters

The purpose of the investigation is not to assign blame.

It is to understand what happened, identify contributing factors, and strengthen the system to prevent recurrence.

When organisations focus only on the visible issue, they miss the opportunity to learn.

When they focus on the system, they build stronger controls, improve reliability, and reduce risk over time.

Final Thought

The brown M&M’s were never about chocolate.

They were about confidence in the system.

And that’s exactly what ICAM investigators are trying to assess.

The next time you see a missed step, a simple error, or a minor deviation, don’t stop at the surface.

Ask yourself:

Is this the problem… or is this the signal?

Closing Question

What’s the “brown M&M’s” in your organisation right now — the small signal that might be pointing to a much bigger issue?