The Capability Gap Between the Training Room and the Next Incident

There is a significant difference between completing investigation training and being ready to lead an investigation when a serious incident occurs.

Training can provide the methodology, tools and opportunity to practice. It can give an investigator a structured process to follow, help them understand PEEPO, develop their interviewing technique and teach them how to move from evidence through analysis to findings and recommendations. In the training room, there is also something else available that is easy to overlook: support. There is a facilitator to challenge assumptions, answer questions and steer participants back towards the investigation process when their thinking starts to drift.

Then everyone goes back to work.

For some people, the opportunity to apply those skills comes quickly. For others, the next significant investigation might be six months away. It could be longer. During that time, their normal role takes priority and the investigation methodology they understood clearly during training gradually moves further into the background.

Then an incident occurs.

Someone may have been injured. The area needs to be made safe. Operations want to know when equipment can be released. Managers want an initial explanation. Witnesses are already talking to each other about what happened. Evidence is being moved, changed or lost. There may be regulatory requirements to consider and senior leaders asking when they can expect a report.

The investigator has to turn training into action.

That transition is where one of the most important challenges in investigation capability sits. Organisations often measure whether people have been trained, but the more useful question is whether those people remain capable of applying what they learned when the next incident occurs.

Training is the starting point

Formal investigation training matters because investigators need a repeatable process. Serious investigations cannot depend on instinct, personal preference or whichever approach the investigator happens to remember on the day.

The ICAM investigation process moves through seven steps: Immediate Actions, Investigation Planning, Data Gathering, Data Organisation, Data Analysis, Recommend and Report. Those steps sit within the four GOAL phases of Gather, Organise, Analyse and Learn. The sequence provides investigators with a disciplined way to move from understanding what happened to determining why it happened, deciding what should be done about it and identifying learning that can be shared.

The methodology provides structure, but structure alone does not create capability. A person can understand the seven steps in a classroom and still struggle to apply them when faced with incomplete information, competing priorities and a team looking to them for direction.

This distinction matters when organisations look at their investigation training records. A spreadsheet showing 40 people who have completed Lead Investigator training is evidence of training activity. It is not necessarily evidence that the organisation has 40 people who could confidently lead a significant investigation tomorrow morning.

Some may have completed several investigations since their training. Others may not have conducted one. Some will regularly work alongside experienced investigators and have opportunities to discuss evidence, findings and recommendations. Others may have returned to a role where investigation is a very small part of what they do.

Their certificates may look the same. Their current capability probably does not.

The next incident does not arrive as a case study

Training exercises need boundaries. Participants need enough information to practice the methodology within the time available, and facilitators need to create conditions where particular investigation skills can be developed and assessed.

A real incident is much less cooperative.

The first account of what happened may be wrong. Witnesses may remember the event differently. A procedure may describe one way of completing a task while people routinely perform it another way. Equipment may already have been moved. Photographs may be incomplete. Electronic records might exist, but nobody has requested them yet. The investigation team may also inherit an explanation that began circulating within minutes of the event.

"The operator didn't follow the procedure."

"The supervisor should have stopped the job."

"They were rushing."

"That equipment has always been a problem."

Any of those statements might eventually have some relevance. None should become the investigation before the evidence has been gathered and tested.

This is where investigation discipline becomes important. Relevant information needs to be validated as fact and supported by evidence. Evidence collection should begin as soon as practicable because physical conditions can deteriorate or be altered through weather, people or other intervention.

That principle is straightforward in a workbook. Applying it when an operational manager wants the area handed back in 20 minutes requires something more than recall. The investigator needs confidence in the process and enough practical experience to know what must be protected before the scene changes.

Knowing PEEPO is not the same as being able to use it

PEEPO is one of the clearest examples of the capability gap.

Most people who have completed ICAM training can recall the five categories: People, Environment, Equipment, Procedures and Organisation. The harder part is using those categories to think broadly enough about the system of work.

Consider an incident involving mobile plant. An investigator might identify the operator and supervisor under People, request maintenance records under Equipment and obtain the relevant operating procedure under Procedures. All of that is useful, but it is still only the beginning.

A capable investigator starts asking what else might help explain the event. Who planned the work? Who trained and assessed the operator? What information was available to the supervisor? What was happening elsewhere in the operation at the time? Were there competing work demands? What did the pre-start inspection identify? Were protective devices fitted and functioning? Had similar equipment generated previous reports? Was the documented procedure current, and did it reflect how the task was actually being performed? What risk assessments had been completed? Had the work or equipment changed over time?

The Organisation column can be particularly revealing because many of the conditions that shape work are not visible at the incident scene. Decisions about resources, training, maintenance, contractor management,

procedures, change and risk management may have been made weeks, months or years before the incident.

This is why PEEPO Mk1 is a planning tool rather than a paperwork exercise. It helps the investigation team identify potential data sources before gathering begins. PEEPO Mk2 then provides a structured way to organise factual information and distinguish between contributing and non-contributing factors. Safety Wise training places considerable emphasis on this distinction because the quality of the PEEPO has a direct effect on the quality of the investigation that follows.

Someone who has not used PEEPO since training may remember the headings but struggle with the depth. They fill the boxes rather than use them to drive the investigation.

That is a capability gap.

Evidence discipline gets harder under pressure

One of the easiest mistakes in an investigation is to confuse information with evidence.

People will provide opinions. Managers will offer theories. Procedures will tell the investigation team what was supposed to happen. Witnesses will explain what they remember. Equipment records, photographs, electronic data and physical evidence may tell another part of the story.

The investigator's job is to work through that information without deciding too early what it means.

We describe effective investigators as people who use information validated as fact, remain neutral and refrain from premature conclusions. It also stresses the need to explore, research, think critically and avoid settling for the obvious explanation.

Those behaviours sound simple until an investigator is placed inside an organisation that believes it already knows the answer.

Imagine that the initial notification says a worker bypassed a safety control. If the investigator accepts that description as the explanation, the investigation can quickly become a search for evidence supporting the original belief. Questions narrow. Contrary information becomes inconvenient. The report eventually confirms what everybody thought on day one.

A stronger investigator treats the bypass as something that needs to be understood. Was the control available? Was it functional? Was it practical for the task? Was bypassing it known or normalised? Had the organisation identified that possibility during risk assessment? Were there other controls intended to prevent the outcome? Had similar behaviour been observed previously, and if so, how had the organisation responded?

The difference is not about excusing behaviour. It is about understanding the conditions in which behaviour occurred so the investigation can identify contributing factors and the controls that failed or were absent.

ICAM was developed by Gerry Gibb at BHP around this systems-based approach. The methodology deliberately pushes the investigation beyond the actions of the people closest to the event and into the conditions, defences and organisational factors that shaped what happened.

That thinking needs practice. Without it, investigators can revert very quickly to the most visible explanation.

Interviewing is a perishable investigation skill

Witness interviewing is another area where classroom understanding and practical capability can separate quickly.

Most trained investigators know they should ask open questions, listen carefully and avoid leading the witness. Doing that well in a real interview is harder.

Witness memory is affected by factors including event duration, proximity, familiarity, stress, distraction, elapsed time and contamination from information received after the event. The investigator's own interviewing skill can also affect the quality of the account obtained.

That creates a demanding task. The investigator needs to establish rapport while remaining neutral. They need enough knowledge of the event to ask useful questions without signalling the answers they expect. They have to listen rather than mentally prepare their next question, recognise gaps without turning the interview into an interrogation, and distinguish between what the witness observed and what they later came to believe.

Safety Wise uses a questioning hierarchy that moves from free recall and open-ended questions through active listening and paraphrasing before narrowing into closed and, where appropriate, leading questions. The sequence matters because the investigator is trying to obtain the witness's recollection before contaminating it with information already held by the investigation team.

That skill becomes noticeably weaker when it is not practised.

An investigator who has not conducted an interview for a year may rush into detailed questions. They may interrupt useful free recall because something the witness says appears inconsistent with another statement. They may ask a question that contains the expected answer without recognising they have done it.

There is no lack of intent. The investigator may understand the principles perfectly well.

The skill simply has not been used.

This is why witness interviewing should not be treated as something learned once during an investigation course. Even experienced investigators benefit from reviewing the interviewing principles and preparing carefully before speaking with witnesses.

A timeline is more than a chronology

The same issue appears during data organisation.

A timeline can look deceptively simple. Put the events in chronological order, identify what happened before the incident, describe the incident itself and capture what happened afterwards.

The real value comes from what happens while the timeline is being built.

A good timeline forces investigators to test the relationship between pieces of evidence. If a supervisor says an instruction was given before the task started, where does that event sit? Is there evidence to support it? If an alarm activated, what happened immediately before and after it? If a procedure changed three months earlier, is that relevant to the incident sequence or simply background information?

As the timeline develops, gaps become visible. Events that seemed clear during individual interviews may no longer fit together. New questions emerge. Sometimes the investigation team discovers that a strongly held early assumption cannot be reconciled with the sequence of events.

Governance guidance for ICAM investigations expects a factual, event-based timeline that allows the pre-incident, incident and post-incident sequence to be understood. That is much more than preparing a diagram for the final report.

The timeline is an investigative tool.

An investigator who has practised building timelines learns to use them dynamically. They move events as new evidence emerges, identify gaps, return to witnesses and request additional records. Someone who has only built a timeline once during training may see it primarily as a reporting requirement and miss much of its analytical value.

Again, the methodology has not failed. The challenge is the distance between learning and application.

The capability gap widens during analysis

Data gathering can expose weaknesses in investigation capability, but analysis is often where the difference becomes unmistakable.

By this point, the team may have accumulated a substantial amount of information. There are witness statements, photographs, procedures, records, timelines, technical advice and pages of PEEPO data. The challenge is no longer finding information. It is making sense of it without losing the systems perspective.

This is where inexperienced or out-of-practice investigators can gravitate towards the actions closest to the event. Those actions are visible and easy to describe. Someone made a decision, missed a step, entered an area or operated equipment in a particular way. It can feel as though the investigation has found the answer.

ICAM requires the investigation to keep going.

The analysis starts with the Absent or Failed Defences closest to the incident and works back through Individual or Team Actions, Task or Environmental Conditions and Organisational Factors. This is specifically intended to prevent the analysis becoming restricted to the errors or violations of operators.

Suppose a worker entered an area where hazardous energy was present. The action matters, but a system-based investigation needs to understand the defences intended to prevent that exposure. Was isolation required? Was there an interlock? Was access physically restricted? Did the work process rely mainly on procedural compliance? Were controls absent, ineffective or defeated?

From there, the investigator can examine the conditions surrounding the task and the organisational decisions that influenced those conditions. Perhaps the work had changed without the risk assessment being updated. Perhaps supervision arrangements had changed. Maybe the equipment design created an operational problem that workers had learned to manage informally.

None of those possibilities should be assumed. They have to be supported by evidence.

That is the discipline ICAM demands.

When investigators have not practised the analysis for some time, there is a temptation to make the chart fit the incident rather than use the evidence to build the analysis. Categories become labels. The team debates where to place a factor before establishing whether the factor actually contributed.

Capability shows itself in the quality of that reasoning.

Recommendations expose the quality of the investigation

A weak analysis often produces weak recommendations.

If the investigation finishes with the worker's action, the recommendation might be retraining, a procedure reminder or a toolbox discussion. Those actions can be appropriate in some circumstances, but they should follow the evidence rather than appear automatically whenever human behaviour is involved.

A stronger analysis asks what needs to change in the system to reduce the likelihood of recurrence.

ICAM governance guidance expects recommendations to address the relevant Absent or Failed Defences and Organisational Factors, link directly back to the incident and focus on risk reduction and prevention of recurrence. It also calls for consideration of the hierarchy of controls, with attention to stronger engineering controls where applicable.

This is an important test of investigation capability because writing recommendations requires judgement. Investigators have to distinguish between an action that closes a report and an action that addresses a finding.

The difference can be substantial.

"Remind employees to follow the procedure" may be easy to implement. If the investigation found that the procedure did not reflect the actual task, the recommendation has missed the point.

"Retrain the operator" might be measurable. If the evidence showed the operator was competent and the failed defence was an unreliable interlock, the recommendation is disconnected from the analysis.

The quality chain is clear. Weak data gathering affects the timeline. Weak evidence affects the analysis. Weak analysis affects the findings. Poorly supported findings lead to recommendations that may do little to change risk.

By the time the final report is reviewed, the original capability gap may have travelled through the entire investigation.

Investigation capability is an organisational issue

It is tempting to treat this as an investigator problem. Send people to training, expect them to retain the knowledge and refresh them when required.

That places too much responsibility on the individual.

Investigation capability depends on the system surrounding the investigator as much as it depends on the person. Governance guidance identifies professional investigation training as one part of a broader corporate approach that also includes an incident management standard or procedure, suitable forms and templates, systems for capturing findings and actions, competent investigation resources and management commitment.

That matters because even a capable investigator can struggle inside a weak investigation system.

If managers appoint investigators solely because they are available, capability suffers. If terms of reference are unclear, the investigation can drift. If the team lacks the required technical expertise, important evidence may be misunderstood. If management pressures the team for an answer before data gathering is complete, premature conclusions become more likely.

The organisation therefore has a role before an incident occurs. It needs to know who its investigators are, what level of investigation they are competent to conduct, when they last applied those skills and where support will come from when a significant event occurs.

A training register cannot answer all of those questions.

A capability system can.

The bridge between training and the next incident

The answer is not simply more classroom training.

Formal refresher training has a place, particularly when investigators have had little opportunity to apply the methodology or when investigation quality reviews identify recurring weaknesses. Safety Wise's Data Gathering and Witness Interviewing course, for example, is specifically designed to supplement or refresh skills developed through Lead Investigator and Fundamentals training.

But capability can also be reinforced through practice.

An organisation does not need to wait for someone to be injured before an investigator practises developing a PEEPO. A short scenario can be used to test whether investigators can identify meaningful data sources. A recorded or simulated witness account can be used to practise free recall and open questioning. An old de-identified incident can be reconstructed into a timeline and investigators asked to identify what information is missing.

Completed investigations are another valuable learning resource. Instead of filing the report when the actions are assigned, organisations can review the quality of the investigation itself. Was the PEEPO broad enough? Were facts supported by evidence? Did the timeline make the event understandable? Did the analysis move beyond the actions of the people involved? Were the Absent or Failed Defences properly identified? Did the recommendations clearly address the findings?

These conversations create calibration. Investigators begin to see what good looks like in their own organisation, and less experienced investigators gain access to the judgement of people who have conducted more investigations.

Practical exercises are valuable for the same reason. Safety Wise includes an Investigation Practical Day within its training capability, using case studies and guidance to help participants embed investigation learning. The principle is important: knowledge needs opportunities for application if it is going to remain usable.

Coaching can extend that support into live investigations. A newly trained investigator does not necessarily need someone else to take over. They may need an experienced investigator to review their PEEPO, challenge the scope of their data gathering, discuss an interview plan or test whether a proposed contributing factor is actually supported by evidence.

That intervention can be small and still have a significant effect on investigation quality.

Capability needs to be maintained before it is needed

There is an uncomfortable feature of investigation capability: organisations need it most at exactly the moment they have the least time to build it.

Once a serious incident has occurred, the evidence clock is already running. That is not the time to discover that the only trained Lead Investigator on site completed the course three years ago and has never led an investigation.

Capability needs to exist before the event.

That means thinking differently about what happens after training. Instead of seeing the course as the end of the development process, organisations can treat it as the point where practical capability begins to develop. Investigators then need exposure, reinforcement, feedback and opportunities to apply the methodology.

The amount will vary. Someone regularly conducting investigations may develop quickly through experience. Someone in a low-frequency, high-consequence operation may need deliberate simulation because genuine opportunities to practise are rare.

Both situations need oversight.

Frequent investigation activity does not automatically create good investigators if poor practices are simply repeated. Equally, infrequent incidents should not mean investigators are left untouched until a serious event occurs.

Capability maintenance needs to reflect the risk and the investigation role.

The real measure is readiness

Training numbers are easy to report.

"We have 80 ICAM-trained investigators."

That sounds reassuring. It may even be true.

But there is a more useful question for leaders responsible for investigation governance:

If a significant incident happened tomorrow, who would you appoint to lead it?

Then go further. When did that person last conduct an investigation? When did they last plan data gathering using PEEPO? Could they confidently prepare for and conduct a witness interview? Can they build and test a factual timeline? Can they facilitate an ICAM analysis without allowing the group to stop at human error? Can they distinguish a plausible explanation from a contributing factor supported by evidence? Can they develop recommendations that clearly connect to the findings?

Those questions tell you much more about investigation readiness than a training register.

They also shift the conversation away from whether the organisation has delivered enough courses and towards whether it has built a sustainable investigation capability.

Training remains essential. It establishes the methodology, language and disciplined process investigators need. But the certificate is not the end point.

The next incident is.

When that incident occurs, the organisation needs people who can gather evidence before it disappears, interview without contaminating the account, organise information into a reliable sequence, analyse the system rather than settle on the person closest to the event, and develop recommendations that respond to what the investigation actually found.

That capability is built in the space between the training room and the next incident.

The question for organisations is what they are doing with that space.