Inspection, Audit, and Incident Investigation Techniques
Audit and investigation are different tools
The exam tests whether you can gather objective evidence and find causes rather than blame. An inspection checks current condition against a requirement. An audit samples the management system to see whether controls work across time. An investigation reconstructs a specific event to prevent recurrence.
Technique
- Define the criteria before looking at evidence.
- Sample records across people, shifts, and tasks; record sample size.
- Interview separately, ask open questions, and compare accounts with documents.
- Separate immediate causes from root causes using causal trees or the five whys.
- Classify findings by risk and require corrective action with an owner and due date.
- Verify closure with evidence, not assurance.
- Maintain chain of custody for physical evidence and protect confidentiality.
Worked example
An audit samples ten dive logs and finds three without supervisor signatures. Reasoning: this is a sampling result, not proof that exactly three dives were unsupervised. The pattern suggests a control weakness in log review. Root-cause analysis should test form design, supervisor workload, and review habits. Corrective action may include a revised form, a weekly review step, and a re-audit of twenty logs. Retraining the team alone is not a root-cause fix.
Traps that cost marks
- Writing human error as the root cause.
- Generalizing from a sample without stating it.
- Investigating to assign blame.
- Closing corrective actions without verification.
- Breaking chain of custody.