Why Good Investigators Work Backwards

One of the defining features of ICAM analysis is the direction in which the investigation team works through the four contributing factor categories. The ICAM model presents Organisational Factors, Task or Environmental Conditions, Individual or Team Actions, and Absent or Failed Defences, but when undertaking the analysis, the investigator works in the opposite direction. We start on the right with the Absent or Failed Defences and work progressively to the left, through the Individual or Team Actions and Task or Environmental Conditions, before reaching the Organisational Factors.

This direction is deliberate. 

It provides a disciplined pathway from the controls closest to the incident back through the circumstances surrounding the event and into the broader organisational systems that influenced those circumstances. 

The process helps investigators avoid one of the most common weaknesses in incident investigation: identifying the action of a person close to the event and treating that action as a sufficient explanation for why the incident occurred.

ICAM is designed to do more than describe the final moments before an incident. Safety Wise's Pocket Investigation Guide describes ICAM as an investigation process that looks beyond the errors and violations of individuals and examines the contributing factors leading to those occurrences. Its objectives include establishing the facts, identifying contributing factors and latent conditions, reviewing the adequacy of risk controls and procedures, identifying organisational factors, and developing corrective actions that reduce risk and prevent recurrence. Importantly, the purpose of an ICAM investigation is not to apportion blame or liability.

Working from right to left is one of the practical mechanisms that keeps the analysis aligned with that purpose.

Analysis begins after we understand what happened

Before considering why we work from right to left, it is important to distinguish ICAM analysis from the earlier stages of the investigation. ICAM is not a process in which investigators arrive at an incident, draw four columns and immediately begin deciding where things belong. Analysis comes after substantial work has already been undertaken to establish what happened.

Safety Wise structures the investigation process through seven major steps and four broader phases described by the acronym GOAL: Gather, Organise, Analyse and Learn. 

The investigation first gathers information, then organises that information, analyses why the event occurred, and finally develops and communicates the learning arising from the investigation.

During data gathering, investigators use PEEPO to consider relevant sources across People, Environment, Equipment, Procedures and Organisation. The purpose is to gather sufficient relevant information to understand the incident, the events leading to it and, where relevant, what occurred afterwards. Our training emphasises that information relied upon during the investigation must be factual and supported by evidence. It also makes an important point about human error: where an error is identified, the investigator must look beyond the error to understand why it occurred.

The evidence is then organised into a timeline so the investigation team can reconstruct the event in a logical sequence. Only when there is a sufficiently developed understanding of what happened should the team move into ICAM analysis and begin considering why it happened.

This sequence protects the integrity of the investigation. If investigators begin analysing too early, there is a risk that assumptions will influence what evidence they look for. A conclusion may be formed first and evidence subsequently gathered to support it. 

By establishing the facts before analysing contributing factors, ICAM encourages investigators to work from evidence towards findings rather than from assumptions towards evidence.

The same discipline applies when working through the four ICAM columns. Right-to-left analysis should be driven by the evidence established during the Gather and Organise phases, not by a desire to populate every category on the ICAM chart.

Starting with Absent or Failed Defences

The first ICAM category considered during analysis is Absent or Failed Defences. This immediately directs attention towards the controls that were intended, or reasonably expected, to prevent the incident or reduce its consequences.

This is an important starting point because incidents occur within systems of work in which hazards should already be subject to some form of control. 

Organisations identify hazards, assess risk and implement controls intended to prevent unwanted events, detect developing problems, protect people and equipment, or mitigate consequences. When an incident occurs, one of the most useful initial analytical questions is therefore not simply what a person did, but what should have prevented the event from progressing to the outcome that occurred.

Consider a worker who enters an area in which mobile equipment is operating and is struck or nearly struck by a vehicle. It would be easy to begin by examining why the worker entered the area. That question may ultimately be relevant, but beginning there immediately places the person at the centre of the analysis. Starting with the defence question changes the investigation's perspective. The team considers what controls were intended to prevent pedestrians and mobile equipment from coming into conflict, whether those controls were actually present, and whether they operated effectively.

The investigation might examine physical separation, barricading, access control, traffic management arrangements, positive communication requirements, detection systems, warning devices, signage, designated pedestrian routes or other relevant controls. 

Some controls may have existed but failed to perform their intended function. Others may not have existed at all.

The distinction between an absent defence and a failed defence is useful because it tells the investigation something about the nature of the control problem. A failed defence indicates that a measure was present but did not provide the protection expected of it. An absent defence indicates that the relevant protective measure was not in place. In either case, the analysis begins with the management of the hazard rather than with an assumption that the incident occurred simply because somebody behaved incorrectly.

This control-based starting point is also consistent with the broader purpose of ICAM. Our training describes the primary objective of ICAM as learning all possible lessons from an incident and strengthening defences to avoid future incidents. 

If strengthening defences is an important investigation outcome, understanding how those defences performed is a logical place to begin the analysis.

Moving from the defence to the actions

Once an Absent or Failed Defence has been identified, the investigation can consider the Individual or Team Actions associated with the event. These are the errors or violations that contributed directly to the incident.

Actions at the operational interface are often the easiest aspects of an incident to identify. They occur close in time to the outcome, witnesses may have observed them, electronic data may have recorded them, and they can often be compared with procedures or expected work practices. For these reasons, they are highly visible. That visibility can create a problem when investigations begin and end with what a person did.

Human error is common in complex industries, but identifying human error as a causal factor does little by itself to prevent future occurrences. 

To understand the occurrence properly, the investigator must identify not only the error but also the factors that influenced it, because different forms of error may require different preventative strategies.

Suppose an operator selected the wrong control on a piece of equipment. The evidence may clearly establish that the wrong control was selected, and that action may legitimately form part of the ICAM analysis. However, the statement "the operator selected the wrong control" tells us primarily what happened. It does not yet provide an adequate explanation of why it happened.

The same problem arises with findings such as "the worker did not follow the procedure", "the driver entered the exclusion zone", "the supervisor did not identify the hazard", or "the isolation was not applied". Each may be factually correct and each may describe an action that contributed to the incident. None should automatically be treated as the end of the investigation.

Once the relevant action has been established, working right to left requires the investigation to continue. The question becomes what conditions existed at the time that influenced, encouraged, enabled or otherwise contributed to that action.

That movement is fundamental to systems-based investigation. The action remains part of the analysis, but it is placed within the context in which it occurred.

Understanding the conditions surrounding the action

The third stage of the right-to-left analysis examines Task or Environmental Conditions. These are the conditions in existence immediately prior to or at the time of the incident that directly influenced human and equipment performance.

This category provides the context that is frequently missing when an investigation concentrates too heavily on the person closest to the event. People undertake work within a particular physical and organisational environment. Their performance can be influenced by the design and condition of equipment, work demands, procedures, communication, supervision, knowledge and experience, environmental conditions, competing priorities and numerous other features of the task.

The importance of these conditions is reflected in the model underpinning ICAM. Organisational accidents involve the interaction of latent conditions, local triggering conditions and active failures at the operational interface. The action observed immediately before an incident therefore needs to be understood in the context of the conditions that existed when the action occurred.

Take the example of an operator who does not complete a required step in a procedure. A superficial investigation may compare the work performed with the procedure, identify the departure and recommend retraining. A more developed investigation examines the circumstances surrounding the departure. The procedure may have been difficult to use at the work location, may not have reflected the current equipment configuration, or may have required resources that were not readily available. The work may have been occurring under unusual time pressure, the task may have changed since it was originally planned, or the accepted practice within the workgroup may have differed from the documented method.

None of those possibilities should be assumed. They must be established through evidence. The point is that ICAM requires the investigation to explore whether such conditions existed and whether they contributed to the action.

This is also why putting behaviour into context should not be confused with excusing behaviour. 

ICAM does not require investigators to ignore what people did or to conclude that individuals can never be accountable for their actions. Treating incidents as system failures does not absolve individuals of personal accountability or responsibility. We describe Fair and Just Culture considerations as a separate process applied after the ICAM investigation where questions about accountability remain.

The role of the investigation is first to establish what happened and understand the factors that contributed to it. Questions of individual accountability should not be allowed to prematurely terminate that analysis.

Working back to Organisational Factors

The final movement to the left takes the investigation into Organisational Factors. These are the broader systemic factors that produced or allowed the Task or Environmental Conditions identified closer to the event.

This is where the analysis reaches beyond the immediate workplace circumstances and considers how organisational systems, decisions and processes contributed to those circumstances. These factors may have existed for a considerable period before the incident and may have remained undetected until combined with other conditions and actions.

ICAM draws on James Reason's organisational accident model to explain this relationship. 

Latent conditions can arise from management decisions, practices or organisational influences and remain dormant until they combine with local conditions and active failures to create an opportunity for an incident.

Working towards Organisational Factors from the right is important because it provides an evidence-based pathway into the organisation. Investigators should not simply begin with broad statements such as "poor safety culture", "inadequate management", "lack of training" or "poor supervision". Although these phrases can sound systemic, they have little analytical value unless the investigation can establish what specifically occurred and how it contributed to the incident.

For example, imagine an investigation establishes that a critical equipment inspection was not completed. Further analysis identifies that responsibility for the inspection was unclear between operations and maintenance. The team then establishes that this ambiguity developed after an organisational restructure in which ownership of the inspection activity had not been clearly reassigned. The analysis has now moved logically from a control issue through the circumstances surrounding that issue and into an organisational factor.

The Organisational Factor has not been guessed. It has been reached through evidence.

That is an important characteristic of quality ICAM analysis. 

Working from right to left prevents "systemic" from becoming a label attached to vague criticism of the organisation.

 Instead, organisational findings should have a demonstrable relationship with the conditions, actions and defence issues relevant to the incident.

Why we do not begin with the person

Many traditional investigations naturally gravitate towards the person closest to the incident. The event has occurred at the operational interface, so the immediate questions often concern who was involved, what they were doing and whether their actions complied with a procedure.

Those questions have a legitimate place in data gathering, but they become problematic when they define the entire analysis.

If the investigation concludes that an incident occurred because a worker did not follow a procedure, the likely corrective action is predictable: retrain the worker, communicate the procedure again, issue a safety alert or instruct the workforce to comply. Those responses may sometimes form part of a broader set of actions, but they are unlikely to produce sustainable improvement if the investigation has not established why the departure occurred.

Perhaps the procedure was technically correct but impractical to apply. Perhaps the equipment required by the procedure was unavailable. Perhaps the procedure had not been updated following a modification. Perhaps supervision had routinely accepted a different method. Perhaps the work planning process created conditions in which the documented method could not reasonably be completed. If those contributing factors exist and the investigation stops at the worker's action, the organisation may correct the person while leaving the conditions that influenced the incident unchanged.

This is precisely the problem ICAM is intended to overcome. ICAM explains that investigations restricted to identifying "who did what", risk treating the symptoms rather than understanding the broader organisational contributions to the incident. Working right to left ensures that the Individual or Team Action is examined but is not automatically treated as the final explanation.

Why we do not begin with the organisation either

A systems approach does not mean that every investigation should begin by searching for management failure. That would simply replace one form of predetermined thinking with another.

Starting with Organisational Factors creates a risk that investigators will identify broad organisational issues without demonstrating how those issues contributed to the event under investigation. Statements about culture, leadership, training, supervision or risk management can easily become generic explanations applied to almost any incident.

Right-to-left analysis provides an important safeguard. By starting with the defences and working backwards, the investigator must maintain a connection between the organisational finding and the event.

If training is identified as an Organisational Factor, the investigation should be able to explain what deficiency existed, how it affected the conditions or actions associated with the event, and what evidence supports that conclusion. If risk management is identified, the investigation should be able to show what relevant hazard or control issue was inadequately addressed. If maintenance management is identified, there should be a defensible connection between that system and the equipment or control condition that contributed to the incident.

This creates a clear line of sight between the incident and the organisational learning.

Right to left does not mean one straight causal chain

The direction of analysis should not be mistaken for a search for a single sequence of cause and effect. Significant incidents are rarely that simple.

We note that significant incidents typically involve a combination of pre-existing systemic deficiencies and that incidents do not generally occur because of one single cause. Multiple contributing factors can come together at a particular point in time.

An investigation may therefore identify several Absent or Failed Defences, several Individual or Team Actions, numerous Task or Environmental Conditions and multiple Organisational Factors. 

One Organisational Factor may contribute to several conditions. One condition may influence several actions. Several different pathways may converge on the same failed defence or incident outcome.

The value of working right to left is not that it forces all incidents into a neat linear chain. Its value is that it provides a consistent direction of inquiry. The team starts close to the event, identifies what did not protect the system, examines the relevant actions, establishes the conditions influencing those actions and then determines whether broader organisational factors produced or sustained those conditions.

The resulting analysis may be complex because the incident itself was complex. ICAM provides structure without pretending that organisational events are simple.

A practical example

Consider a near miss involving a light vehicle and a loader within an operating area. The light vehicle enters the area and comes into conflict with the loader, requiring immediate action to prevent a collision.

Following the incident, the investigation team gathers evidence across PEEPO, interviews the people involved, examines the work environment, reviews the relevant traffic management documentation, considers training and authorisations, examines communication arrangements and develops the timeline. Only after establishing the relevant facts does the team begin the ICAM analysis.

Starting with the Absent or Failed Defences, the team establishes that there was no effective positive access control preventing light vehicles from entering the loader's operating area without the required communication. The investigation then considers the Individual or Team Actions and establishes that the light vehicle entered the operating area without positive communication having been established with the loader operator.

If the investigation stopped at that point, the obvious conclusion would concern the driver's behaviour. However, the right-to-left process requires the team to examine the conditions surrounding that action. The evidence establishes that the access route was not clearly differentiated from the normal vehicle route, signage was difficult to identify from the driver's direction of travel, radio communications were congested, and similar movements had previously occurred without positive communication.

The analysis then moves further left to determine what organisational factors contributed to those conditions. Evidence establishes that the traffic management arrangements had not been reviewed following changes to the operating area, responsibility for reviewing temporary traffic changes was unclear, and existing assurance activities had not identified the difference between documented traffic arrangements and the way the area was actually operating.

The driver's action remains part of the analysis because it contributed to the event. However, it now sits within a much more complete explanation of how the incident became possible. More importantly, the organisation now has several meaningful opportunities to reduce the likelihood of recurrence.

Better analysis creates better corrective actions

One of the strongest reasons for working right to left is the effect that analysis quality has on corrective action quality.

If an investigation finishes with "operator did not follow the procedure", the corrective action will often focus on the operator. If the analysis establishes that the procedure was inconsistent with the current equipment configuration, the organisation can address the procedure. If the reason for that discrepancy was that equipment modifications did not trigger a review of operating documentation, the organisation can address the relevant change process. If the same weakness exists across several operational areas, the organisation can address the issue more broadly.

The further the investigation moves into evidence-based systemic factors, the greater the opportunity to develop corrective actions that address the circumstances that actually contributed to the incident.

We capture this principle succinctly by stating that recommendations should focus on the design of the game, not the player. This does not mean every recommendation must be an organisation-wide initiative. It means recommendations should be directed at the identified contributing factors rather than defaulting to attempts to make an individual more careful.

The effectiveness of recommendations therefore depends heavily on the quality of the right-to-left analysis that precedes them.

Right-to-left analysis also exposes gaps in the investigation

The process is useful not only for identifying contributing factors but also for testing whether the investigation has gathered enough information.

An investigation team may identify an Individual or Team Action but discover that it cannot explain what conditions influenced that action. Rather than filling the next column with assumptions, this should prompt the team to consider whether further evidence is required. Additional interviews, documents, equipment information or examination of the work environment may be necessary.

Similarly, a proposed Organisational Factor that cannot be logically connected to the incident may indicate that the finding is too broad, unsupported or non-contributing. The team should be prepared to challenge its own analysis rather than forcing information into the ICAM structure.

Investigators should use information validated as fact, refrain from premature conclusions, explore beyond the obvious and apply critical thinking to connect and logically interpret valid data.

A good ICAM chart is therefore not simply one in which all four columns contain numerous entries. Quality is demonstrated by the strength of the evidence, the relevance of the contributing factors and the logical relationships established during the analysis.

The four columns are an analytical framework, not boxes to fill

There can be a temptation, particularly when investigators are learning ICAM, to treat the four columns as a form that needs to be completed. If one column contains little information, the team may feel that something must be added to make the analysis appear complete.

That is not the objective.

The purpose of the analysis is to identify the contributing factors supported by the evidence. Not every incident will produce the same number or type of findings, and investigators should not manufacture an Organisational Factor simply because the column appears light. Likewise, the existence of an error does not automatically mean that training was inadequate, and a communication issue does not automatically mean that supervision failed.

The question is always whether the factor contributed to the incident and whether the evidence supports that conclusion.

This is another reason the right-to-left discipline is valuable. Each movement further into the system should be justified by what has already been established. The investigator is not searching for something to put in the next column. The investigator is trying to understand what influenced the factors already identified and whether that influence was relevant to the incident.

From the incident to organisational learning

Ultimately, the reason for working from right to left is much larger than the physical layout of the ICAM chart. It reflects the way ICAM approaches organisational learning.

The Absent or Failed Defences tell us how the controls associated with the hazard performed. The Individual or Team Actions tell us what occurred at the operational interface. The Task or Environmental Conditions help us understand the circumstances that influenced those actions. The Organisational Factors take the analysis into the systems and organisational arrangements that produced or sustained those circumstances.

Viewed together, the four categories provide a structured explanation of how an incident became possible. They move the investigation beyond the visible event without disconnecting the analysis from the evidence.

This is particularly important because the person closest to an incident is often where the failure becomes visible, not necessarily where the most valuable opportunity for improvement exists. An operator's error may reveal a poorly designed interface. A procedural departure may reveal a mismatch between documented work and operational reality. A failed inspection may reveal unclear organisational ownership. A missing barrier may reveal weaknesses in risk assessment or change management.

None of those conclusions should be assumed merely because an incident has occurred. They must be demonstrated. That is precisely what the right-to-left process helps the investigation team do.

ICAM was developed to support a systemic understanding of incidents and to strengthen organisational defences through learning. Safety Wise's investigation material consistently reinforces the need to look beyond human error, understand contributing factors in context, identify systemic deficiencies and develop corrective actions that reduce risk and prevent recurrence.

Working from right to left gives practical effect to those principles. The investigation starts with the controls closest to the unwanted outcome, examines the actions relevant to their failure or the event, establishes the conditions that influenced those actions, and then follows the evidence into the organisational factors that created or sustained those conditions.

That progression keeps the analysis grounded. It discourages premature conclusions about individual behaviour, but it also prevents investigators from making vague assumptions about organisational failure. It provides a defensible connection between evidence, contributing factors and corrective actions, while recognising that incidents normally involve multiple interacting factors rather than one convenient explanation.

This is why the direction matters. 

In ICAM analysis, we start at the defences and work back towards the organisation because our purpose is not simply to identify where the incident became visible. Our purpose is to understand how the system allowed it to become possible, and then use that understanding to make the system stronger.