Incident Investigation 4: Analysis, Report Writing, Recommendations and Follow-up
Scope of this domain
Domain 4 tests analysis, reporting and closure: proving causes from evidence, writing a report a busy manager can act on, and making recommendations that stick.
Core rules
- Analysis tools include 5 whys, cause-and-effect (fishbone) diagrams grouped by people, equipment, procedure, environment and management, events-and-causal-factor timelines, fault trees and barrier analysis.
- Test each candidate cause against the evidence and look for absent barriers as well as failed ones; beware confirmation bias towards the first plausible story.
- A workable report contains: summary, scope and terms of reference, method, chronology, findings, causes split into immediate/underlying/root, conclusions, recommendations and appendices.
- Recommendations should be SMART, ranked by risk, consistent with the hierarchy of control and reasonably practicable (ALARP).
- Close the loop: action plan with named owner and date, verification of completion, lessons shared, risk assessments and procedures updated, effectiveness reviewed later.
Worked example
A draft report concludes "operator error - retrain". Weak. Reworked: immediate cause, guard removed; underlying, removal made the job quicker and supervision tolerated it; root, no guard-integrity check or management-of-change control. Recommendations: interlocked guard, revised safe method, periodic guard audit with named owner and date. Each is verifiable, unlike "retrain".
Traps
Defaulting to retraining for system faults; recommendations with no owner or deadline; conclusions unsupported by the findings; reports written for the file rather than the reader; no follow-up to confirm actions were taken.