Incident investigation — finding the cause rather than the culprit

Something went wrong. Nobody was hurt, or somebody was. The question that follows decides whether the plant learns anything: why did this happen, or who did it.

Those two questions lead to entirely different places, and only one of them prevents a recurrence.

Why “operator error” is not a finding

It is the commonest conclusion in bad investigations, and it is almost always where the work stopped rather than where it finished.

This is not about excusing people. Deliberate violation exists and is handled differently. But an investigation that names a person and stops has left every condition in place for the next person to meet.

A section of process plant cordoned off with red and white barrier tape strung between temporary posts, the equipment beyond left untouched, with a spanner, a screwdriver and a dropped glove lying on the ground inside the cordon. — Nothing inside the tape has been moved, and that is the point. A scene tidied up before anyone recorded it has destroyed the evidence that would have explained the event.

Build the timeline first

The discipline that separates a useful investigation from a confirmation exercise is simple: establish what happened before deciding why.

The timeline draws on more than memory: DCS trends and alarm logs with their own timestamps, permits and their sign-off times, CCTV, radio logs, shift handover notes, the physical evidence exactly where it lies.

Interview early and separately. Memory degrades within hours and is genuinely rewritten by discussion — people absorb somebody else’s account and later recall it as their own, with no intent to mislead. Separate accounts taken early capture what each person actually saw.

And interview to understand, not to establish fault. A witness who believes they are being blamed stops being a witness.

Going past the immediate cause

The immediate cause is what physically happened: the flange leaked, the valve was open, the sling failed. Necessary, but not enough.

Asking why repeatedly is the standard technique, and its value is not the number of times but the direction. Each answer should move outward, from the act toward the conditions:

The line released hydrocarbon. Why? The flange was not fully bolted. Why? The fitter was called away and another finished the job. Why? Two crews were working the same permit with no handover step. Why? The permit system has no provision for a partial handover mid-task.

The first answer names a person. The last names a system defect that can be fixed, and which was waiting for anyone.

The hierarchy of control shown as a descending scale from elimination and substitution at the top, through engineering controls, to administrative controls and personal protective equipment at the bottom, with effectiveness falling down the scale. — Recommendations land somewhere on this scale. 'Retrain the operator' and 'remind the team' sit at the bottom, where controls are weakest — which is where most investigation actions end up unless somebody insists otherwise.

Recommendations that change something

Two failures account for most investigations that achieve nothing.

Actions at the bottom of the hierarchy. “Retrain”, “remind”, “issue a toolbox talk”, “revise the procedure” — all administrative, all dependent on somebody remembering under pressure later. If the same incident could be prevented by a different valve handle, an interlock, or removing the substance altogether, that is worth far more than a briefing.

Near misses are the cheap lessons

A near miss is an incident with the consequence removed by luck. The scaffold board that fell into an area that happened to be empty. The valve opened and shut again before anything escaped. Everything upstream was identical to the version that injures somebody.

Process safety is not occupational safety

A plant can go years without a lost-time injury and still be heading for a major accident, because the two are measured by different things and driven by different failures.

An investigation that stays inside one unit protects one unit. The conditions that produced it almost certainly exist elsewhere — the same valve arrangement, the same procedure, the same handover gap.

The findings worth circulating are the conditions, not the event. “A flange leaked on unit 3” teaches nothing. “Our permit system has no step for handing over a part-finished job, and here is what that cost” applies everywhere.

What to take away

“Operator error” is where a bad investigation stops. Ask what made the action reasonable at the time.
Build the timeline before forming a conclusion, or the conclusion decides which evidence survives.
Interview early and separately. Memory fades fast and is rewritten by discussion.
Ask why, repeatedly, moving outward from the act to the conditions.
Recommendations should reach up the hierarchy of control, not stop at retraining.
Every action gets one named owner and a date, and is tracked to closure.
Near misses are free lessons, and a falling report rate usually means reporting stopped.
Process safety is not occupational safety. A clean injury record is not evidence that containment is under control.