On the Trail of Truth: Conducting an Accident Investigation

Start at the Beginning

An incident investigation is a systematic effort to determine the answer to six key questions: what happened, when did it occur, who was involved, how did it happen, why did it happen, and how can it be prevented in the future. The first five questions are analytical in nature. They reconstruct what occurred up to the culmination of the negative event. That involves taking things apart into their constituent parts, examining them, determining their role and significance in the final outcome, and reassembly of the pertinent facts to generate a complete and as accurate as possible explanation of the chain-of-events leading up to the incident. The last question is one of synthesis, a pulling together of all the answers of the previous five questions into a coherent and comprehensive view of the event. While these are simple questions, the task of gaining satisfactory answers to them may not always be simple.

The Investigator's Challenges

The challenge for the individuals conducting the investigation will be to gather and accumulate information, of varying degrees of availability, quality, and reliability, to uncover the truth. The bits and pieces of information gathered in the course of the investigation must be assembled into a descriptive picture of what transpired. This is the analytical aspect of the investigation. The depth of the investigation required should weigh as a factor in the selection of the investigator. The more serious an incident, the more vital it is that as experienced and competent an individual as possible should be assigned responsibility to conduct, or to lead the investigation, in the event that the scale of the event necessitates that more than one individual become involved.

The picture that emerges, a coherent and understandable explanation of the incident, will be a mosaic of some sort. The completeness of the picture or mosaic will be limited by an investigator's imagination, resources, and willingness. The resulting picture can range from a "thin" description, wherein the investigator merely collects and connects a few dots or pieces of information, to a "thick" description with a complex picture comprised of a detailed composition of many finely defined pieces. The choice of the degree of detail thus is a significant determinant of the amount of effort to be expended by the investigator in conducting the investigation.

The principle tool of the investigator will be questions used to probe witnesses, documents, evidence, and other artifacts. The level and depth of the questions, and extent to which they will need to be asked will vary according to the circumstances of the event. The questions should be asked in ever widening concentric circles, moving out (in time and physical space) from the point of the event. It is important to remember that nothing after the event can have any relationship to causation. So during the analytical stage of the investigation—the fact gathering—focus must remain on creating a complete picture of what happened, i.e., the past. The investigator should not yet be thinking of the future and preemption of potential events.

As the investigator begins to develop a trail of facts backward through time, each preceding event will be the result of some other event (or activities or events) preceding it at a particular point in time. This exercise is the primary objective of the investigator. The number of events needed to generate a satisfactory explanation of the event will depend upon the investigator and the circumstances of the event. (One difficulty is that once the basic direction of the trail is established, it will always be possible to go one more step backwards in the search for an antecedent cause.)

Another implicit challenge for the investigator is to judge the trustworthiness of each piece of data gathered. It is necessary to gather, but the task of gathering is insufficient by itself, in achieving the intent of the investigation. The investigator cannot act on information if he does not know whether it is valid. Reliability of data is classified based on source evaluation. This means that the investigator must not just gather data, but interrogate and assess the source of that data in the course of its accumulation.

Each piece of data (fact) must be placed in one of four categories of reliability: good, bad, suspect, or "IDK" (i.e., "I don't know"). Good means that you are certain that the source can be trusted and thus, the data is usable. Bad means that you are certain that the source is untrustworthy, and therefore the data is unusable. Suspect means that you have some information about the source, but not enough to be certain whether you can classify the information into either category of certainty: good or bad. The fourth category—"IDK" or I don't know—is a recognition that in some cases you may have no information whatsoever about the source. When data is classified in either of the later two categories, further inquiries must be conducted to be able to convert the uncertainty with regard to source into certainty.

Defining the Parameters

The investigator needs some guidance as to the bounds of the task before him. A set of "stop rules" needs to be established, in advance, to facilitate decision-making during the course of the investigation. This is the boundary that determines when it is time to stop. The other boundary is established by guidance setting forth the minimum amount of information that is required for an investigation to be considered adequate.

The definition of what constitutes "truth" depends upon the objective—or goal—of the investigation. As was discussed in the previous article, the purpose of the investigation will set the tone and determine the "stop rules" for the investigation. If the objective is simply to find someone to blame, the investigator will find it difficult to gain cooperation of those who might provide insight into the sequences of activities leading up to the event, because they are concerned with becoming a target.

Procedures, determined in advance, should establish the structure for the investigation—the process to be followed, regardless of the type of incident. This underlying process applies regardless of the severity and impact of the incident, as the goal of knowledge development remains the same for each incident. These procedures should define the degree of detail that is expected from the investigation. If the procedures are not defined in adequate detail, the investigator will be compelled to respond in an ad hoc basis, which is only going to increase the variation in investigation quality.

The degree of detail required should parallel the severity of the incident. An organization needs to understand that the more severe in consequences an incident is, the more vital the development of a complete picture of the situation. This information will not just be utilized to develop prevention measures, but in those cases where there are severe consequences it is predictable that the organization will need to develop information for the eventual litigation that is likely to emerge.

Included within these procedures must be the various forms that are required, and instructions. All the forms required, such as the witness forms, basic event data report, and the final report format, should be provided, along with completed samples to be used by less experienced investigators. Additionally, the administrative instructions, such as who is the lead, who reviews, the number of copies, where they are to be submitted, and when they are to be turned in all need to be defined. Rather than bury this vital information in a large volume, cutting edge organizations respond to the needs of field staff and assemble a special manual organized around investigations. In this way, all the information required is collected in one document, simplifying the task of the investigator.

The required forms are the principle mechanism for structuring an investigation. The forms provide the investigator with guidance, in the form of questions that require responses. Typically, organizations have a "one-size-fits-all" accident investigation form, which is included as a component of the Safety & Health program, but generally as a blank form without instructions. As a result, there are generally two problems with every investigation. First, the lack of instructions, coupled with problems of training, leaves individuals in the field ill-equipped to conduct an adequate investigation. This leads to a significant variation in the quality of information provided by the forms. The second problem with a single form is that investigators have to make their incident fit the form rather than the reverse.

As was noted above, the appropriate level of detail will vary from thin to thick. This same range needs to also be reflected in the forms. Organizations should have several types of forms, reflecting a variety in the extent of information required. This form variety should parallel the event severity. For example, "minor property damage only incidents" or first aid cases can generally be satisfied with thin, or less detailed, investigations. Serious incidents always require thick, or more detailed, investigations. Incidents in between should be some variation of these two forms.

An organization must discipline itself to investigate all incidents, regardless. For instance, a minor property damage only incident still provides insight and needs to be pursued, but are routinely ignored on the basis of "no harm, no foul." This reluctance to report must be overcome, because a near miss shows that something—either human, equipment, planning or execution—failed, but this failure was insufficient to lead to damage or injury. Thus, guidance must also be provided for what constitutes the minimum—or "thin"—set of descriptive information required, for these minor incidents.

The Incident Investigation Process

Once the structure is set by an organization in the instructions, order is imposed by the actual investigation process. The basic incident investigation process outlines the stages to be followed sequentially (or some simultaneously). This process remains the same, regardless of the type of incident.

There are seven stages in a complete accident investigation. Each stage must be addressed, regardless of the seriousness of the incident. To pick and chose among the stages, or skip a stage is to ensure the outcome will be a failure to achieve the objectives.

The seven stages are: First Response; Gathering Information; Release; Analysis and Synthesis; Report Compilation; Communication; and Implementation. If these stages are not properly completed, the liability of the organization, especially for future litigation, increases significantly. The presence of the investigation report, with any degree of findings or documentation, represents an exposure for the organization, under both Occupational Safety and Health Administration (OSHA) standards and Tort Law. The investigation is recognition of a problem, and any inadequacy of adherence with the procedures can be interpreted as a failure to act to protect against recognized hazards. Depending upon the extent of failure, this can range from a mere nuisance to being considered a serious violation.

First Response. In this step, the investigator must work with coordinating both the initial steps of the investigation along with the actions to address the severity of the incident. There are three vital tasks to be performed at this stage. Failure to address all three tasks in this stage can, and usually does, doom the entire investigation. The first task is coordination of the emergency response. Here management must react to the seriousness of the incident, coordinate notification of appropriate emergency responders and other authorities, attend to personal injury or severe property damage, and address surrounding personnel and work activities. This first task is seldom neglected, but is often the source of failure with investigations.

Generally, emergency response absorbs all the management attention, to the neglect of the other essential tasks. Simultaneous with this emergency response, management must address the second task: securing the site. This task requires shutting down the work in progress (if it is related to the event or for other appropriate reasons), locking down the actual location of the event, safeguarding material and equipment involved in the event (to preserve physical evidence), and identifying witnesses. Identifying witnesses is crucial because they will be the principle source of data about the circumstances of the actual event and the activities immediately preceding it.

The final task in this first stage is to assess the seriousness of the event and determine the depth of investigation required. The seriousness of the event, based on actual or potential consequences, brings several elements into consideration. It sets the parameters of the investigation to follow and defines the extent of resources that need to be mobilized to accomplish the coming stages.

Gathering Information. The primary purpose of the second stage of investigation is to gain data. Think of this as evidence collection. The duration will be dependent upon the type of investigation selected in the last step of the previous stage. A thin investigation will not require much information, while a thick investigation will require much more information. This stage also has several critical tasks to be achieved before moving on to the next stages. There is a concurrent task that should occur throughout the information gathering process. The investigator must continuously identify gaps in data and seek to bridge those gaps in the course of the three actual data gathering steps.

The first step is for the investigator to study the scene of the event, to examine the physical setting and surroundings of where the event occurred. Next, the investigator should gather all the documentation that seems appropriate, such as pictures, diagrams, drawings, plans and other pertinent items. Last, the investigator questions all the witnesses. Investigators should realize that it is important to speak with all witnesses as quickly after the event as possible. As essential as is this last step, it is fraught with difficulties. These difficulties and the caveats are beyond the scope of this discussion, but will be addressed in a subsequent article.

The critical caveat in this stage is to not jump to conclusions. While it is important to begin with some sense of the desired results, the investigator must also remain open to new insights that will emerge in the course of the investigation. The goal of this stage is not to determine why the accident happened, but rather to collect all information possible about the event.

This stage of the investigation will start with several advantages. First, the event itself will mark a point in time when elements converged into a defined result: what happened, and when, in time, it occurred. Thus, the investigator starts with two of the five key questions already answered. Also, in conducting the examination of the details of activities leading up to that particular point in time, the investigator will have the advantage of 20/20 hindsight. What is known already, through the occurrence of the event, places boundaries on where and what needs to be examined. Therefore, they will be tracing back a chain of actions and events, in a chronological sequence, directly related to the final consequences. Knowing the "end of the trail" gives an investigator significant clues as to where to look and what to examine in peeling back time to determine the origins of the incident.

Release of the Scene and Witnesses. Once the preliminary work by the investigator to gather the basic information about the scene and questioning of witnesses is completed, the next stage—a brief one—can be taken. Since the event occurred on an active construction site, it will be vital to get the work moving again. The investigator should be responsible for making the determination as to when this stage can happen. The investigator must be satisfied that all the data that can be acquired through an examination of the site has been gathered, all the physical evidence that can be preserved has been taken care of, and the area is either safe for work to recommence or for remediation work to begin to restore it to safe working conditions.

Analysis and Synthesis. This stage is the core of every investigation, where the key questions are answered on the basis of the evidence collected. The outcome of this stage is to figure out what actually happened leading up to the negative occurrence. The investigator takes the information gathered and studies it, through a variety of techniques—such as the Five Whys (where you ask why of the information five times). The objective is to determine what is known (or knowable) and what is unknown. It also lays out the chain of events, in two different formats. The first is to spell out activities in a chronological sequence. The second is to analyze activities in a logic sequence, looking at things that occur adjacent or concurrently and that impacted upon the actual event.

Compile the Report. This stage is comprised of principally administrative functions. Most of the tasks here are defined by the procedures "recipe," that lists what documents or elements must be present in the level of investigation for a report to be complete. In general, it should be comprised of a description of the incident, analysis of the factors and circumstances, a synthesis of why the event occurred, and recommendations. This report should also be supplemented by other documentation upon which the conclusions are based, such as witness statements, photos, diagrams, drawings and contract documents, tests, reports, memos, plans and other written documents, as well as artifacts of physical evidence to support the basis of the report's conclusions.

Communicate Findings and Recommendations. In this stage the organization must circulate the investigation to the remainder of the organization. If the knowledge, developed in the course of the previous stages, is kept a secret from the rest of the organization then nothing can be gained from the effort. Considerations need to be given with regard to safeguarding the privacy of individuals involved, and any increased liability exposure which might be created for the organization by openly discussing the details of the incidents.

The specifics of how an organization chooses to accomplish this task will depend upon the comfort level of management in openly discussing failures and errors, and the internal processes of the organization. This can be achieved through either an informal or formal procedure. However it is done, the findings of investigations need to circulate within the organization so that the entire organization can take advantage of learning from the negative experience of others. The level to which this needs to be accomplished depends upon the recommendations.

Implement Change and Follow-Up. The final stage of the incident investigation is to implement the recommended changes. This is where the loop is closed, and the benefit of the investigation is transmitted to the organization. This is the "easier said than done" stage, in that it will require the organization to make changes. It will also require a sustained commitment to be certain that things are not simply acknowledged, but actually happen.

Conclusion

The incident investigation can provide valuable insight into the processes and methods of an organization. In order to capitalize upon the opportunity to gain this insight, it is incumbent upon the organization to properly conduct the investigation process, in a systematic manner. This is a multistage process that should be applied, in concept, to each incident, regardless of its impact on the organization. The stages, as defined in this article, promote a consistent approach to determining causation for each negative occurrence that might impact an organization.