9.3 Four-Step Investigation Process
Key Takeaways
- The four-step process is: (1) gather information, (2) analyse information, (3) identify suitable risk control measures, (4) plan and implement remedial action.
- Gathering includes securing the scene, photos, equipment/documents/CCTV, and witness interviews — preserve facts before they disappear.
- Analysis builds a timeline, cause tree (immediate/underlying/root), and human-factor understanding — not a blame story.
- Control measures should follow ERICPD; remedial actions need owners, dates, and verification of effectiveness.
- Interviews: put people at ease, use open questions, one at a time, facts not blame, separate witnesses; depth of investigation is proportional to potential severity.
9.3 Four-Step Investigation Process
Quick Answer: Investigate in four steps: (1) Gather information, (2) Analyse information, (3) Identify suitable risk controls (use ERICPD), (4) Plan and implement remedial action with owners, dates, and checks. Interview witnesses fairly (open questions, no blame theatre). Match investigation depth to potential severity, not only to luck this time.
Knowing definitions and cause levels is not enough. Managers need a repeatable process so investigations are thorough, fair, and productive. Managing Safely teaches a clear four-step sequence. Exam questions may ask for the order of steps, what belongs in each step, or good interview practice.
The four steps at a glance
| Step | Name | Core purpose |
|---|---|---|
| 1 | Gather information | Collect facts before they are lost or altered |
| 2 | Analyse information | Turn facts into a coherent explanation of causes |
| 3 | Identify suitable risk control measures | Decide what will prevent recurrence (ERICPD) |
| 4 | Plan and implement remedial action | Make changes real with owners, deadlines, and verification |
Do not jump to conclusions at step 1. Do not stop at a clever analysis with no actions. Do not issue actions nobody owns.
Step 1 — Gather information
The goal is a reliable evidence base. Poor gathering produces biased analysis and weak controls.
Secure the scene (when safe and appropriate)
- Make the area safe first (isolate energy, prevent secondary injury, emergency care).
- Then preserve the scene as far as practicable: stop unnecessary cleaning or plant moves until photos and measurements are taken (unless emergency or legal direction requires otherwise).
- Restrict access to those who need to be there.
What to collect
| Source | Examples |
|---|---|
| Scene | Photos, sketches, measurements, lighting, weather if outdoor, positions of people and plant |
| Equipment / materials | Damaged parts, settings, substances involved, PPE condition |
| Documents | Risk assessments, SSoW, permits, training records, maintenance logs, method statements, induction records |
| Electronic | CCTV, telemetry, access logs, machine data where available |
| People | Injured person (when fit), witnesses, supervisors, contractors, first aiders |
| Environment | Housekeeping, noise, congestion, time of day, production pressure signals |
Record times, names, and who said what. Separate facts from opinions in your notes.
Interview technique (high-yield exam content)
Good interviews produce usable facts; bad interviews produce fear and silence.
| Practice | Why it matters |
|---|---|
| Put people at ease | Stress blocks memory and honest detail |
| Explain the purpose | Learning and prevention, not a public trial |
| Open questions | “What did you see?” beats “You forgot the guard, didn’t you?” |
| One question at a time | Avoids confusion and leading bundles |
| Facts, not blame | Capture sequence and conditions; reserve judgment for analysis |
| Separate witnesses | Prevents stories merging and contamination |
| Allow time | Do not rush the only person who saw the critical five seconds |
| Note-taking / statements | Accurate record for step 2 and for any later legal process |
| Suitable location | Private enough to speak freely; respectful after trauma |
Avoid leading questions (“You were rushing because of the bonus scheme, right?”). Avoid multi-part questions. Avoid interviewing a group as a panel for individual recollections.
Step 2 — Analyse information
Turn raw evidence into a timeline and cause structure.
Build a timeline
List events in order: what was normal, what changed, what failed, what injury/near miss occurred, what emergency response followed. Gaps in the timeline tell you where more gathering is needed.
Cause analysis
Use the three levels from the previous section:
- Immediate unsafe acts/conditions
- Underlying job/human factors
- Root management-system failures
Simple tools taught at overview level include:
- Cause tree / fault tree style thinking — ask “why?” down through layers
- Human factors review — competence, fatigue, design of controls, pressure, communication
- Comparison to standards — what did the risk assessment and SSoW require vs what happened?
Analysis should answer: How did barriers fail? not only Who messed up?
Common analysis errors
| Error | Better approach |
|---|---|
| Single cause obsession | Multiple causes usually combine |
| Hindsight bias | Judge decisions by information available at the time and by whether systems supported safe choices |
| Stopping at PPE failure | Ask why PPE was needed as last line and why higher controls failed |
| Ignoring near-identical previous reports | Pattern = system signal |
Step 3 — Identify suitable risk control measures
Once causes are clear, choose controls using ERICPD (from Controlling Risks):
Eliminate → Reduce → Isolate → Control → PPE → Discipline
| Cause found | Weak response | Stronger ERICPD-minded response |
|---|---|---|
| Recurring oil leaks | Mop more often | Fix/replace hoses (Reduce/Control), PM system (system Control), temporary isolation of route |
| Missing guard | “Wear gloves” | Refit interlocked guard (Control), eliminate need to reach into danger if redesign possible |
| Untrained temp on high-risk task | Verbal warning | Competence assurance, remove from task until trained (Control), supervision |
| Time pressure driving shortcuts | Poster saying “don’t rush” | Rebalance targets, plan work, adequate staffing (root/system Control) |
Link each significant cause to at least one control. Prefer measures that protect everyone, not only the person blamed last week.
Step 4 — Plan and implement remedial action
A brilliant report that sits in a drawer prevents nothing.
Action plan quality checklist
| Element | What good looks like |
|---|---|
| Specific action | Clear task, not “improve safety” |
| Owner | Named role/person with authority |
| Deadline | Realistic date |
| Priority | Linked to risk / potential severity |
| Resources | Budget, downtime, contractor support agreed |
| Verification | How you will check it worked (inspection, trial, audit, metric) |
| Communication | Who needs to know the new method |
| Review | Date to confirm sustained effectiveness |
Implement, then verify. A guard ordered but not fitted is not control. A procedure rewritten but never trained is not control.
Proportionality — depth matches potential severity
Not every paper-cut needs a multi-week inquiry. Not every “lucky” near miss deserves a shrug.
Match effort to potential, including:
- How bad could it have been (high potential near miss → deep investigation)
- Actual severity of injury or ill health
- Number of people exposed
- Whether a legal reportable event is involved (RIDDOR next section)
- Whether the event signals a systemic failure or a rare one-off with low potential
- Learning value for other sites or shifts
| Event type | Typical depth (manager overview) |
|---|---|
| Minor first-aid, low potential, clear one-off | Short report; quick local fix; trend watch |
| Lost-time injury or recurring pattern | Formal investigation; full four steps |
| High-potential near miss (e.g. load nearly struck head) | Treat like a serious accident investigation |
| Fatality / specified serious injury / major dangerous occurrence | Full investigation; specialist/legal involvement as required; preserve evidence carefully |
Proportionality is not an excuse to skip learning. It is a way to spend investigation effort where it prevents the worst outcomes.
Putting the steps in sequence (exam order)
- Gather — scene, people, documents, media
- Analyse — timeline, immediate/underlying/root
- Identify controls — ERICPD-based measures for the causes found
- Plan and implement — owners, dates, verify effectiveness
If options scramble the order, pick the sequence above. Analysis before gathering is fantasy. Actions without analysis are guesswork. Controls without implementation are paper safety.
Manager checklist
- Was the scene made safe, then preserved enough for evidence?
- Were witnesses interviewed separately with open, non-blaming questions?
- Does the report show causes at three levels, not only immediate?
- Do recommended controls climb ERICPD rather than default to PPE and posters?
- Does every action have an owner, date, and verification method?
- Was depth proportional to potential severity?
Next, RIDDOR explains when UK law requires reporting certain outcomes to the enforcing authority — a duty that runs alongside this internal four-step process, not instead of it.
What is the correct order of the four-step investigation process taught in Managing Safely?
Which interview practice is recommended when gathering information?
A scaffold tube falls into an empty walkway with no injury. Potential severity was fatal head injury. How should proportionality guide the manager?
In step 3 of an investigation, why is ERICPD used when identifying risk control measures?