Investigation should identify systemic causes rather than blame individuals

What it is

A systems-oriented accident investigation reconstructs how technology, task, organization, and environment combined to produce an event and why defences failed to catch it. Its endpoint is reduced recurrence under the same preconditions, not merely naming the last person to err. Safety learning can coexist with disciplinary and legal processes, but the two should run on different questions, evidence rules, and closure criteria. Whether that goal is actually achieved does not depend on an individual investigator's professionalism or intent — it depends on whether the investigation system itself makes a systemic finding the only output that counts toward closing a case.

Why it happens

Requiring investigators to be "objective" is not enough on its own, because closure pressure, time budgets, and the day-to-day working relationship between the investigation team and the unit under review pull the process back onto an individual-blame track unless organizational structure blocks that path. Three common failure points:

First, the closure criterion itself. If report sign-off only checks whether a disciplinary opinion or a responsible party has been named, then even a well-conducted, descriptive interview gets overridden further up the chain: reviewers send the draft back asking for "attribution of responsibility" to satisfy administrative closure, reintroducing blame at the approval stage rather than the interview stage.

Second, when the disciplinary process and the safety investigation share the same evidence file and the same investigators, the same testimony has to serve two incompatible evidentiary standards at once — a safety finding only needs enough certainty to establish that a condition existed and shaped a decision, while a disciplinary outcome needs evidence that can withstand a due-process challenge. Mixing the two makes witnesses expect their statements could be used against them directly, so they hold back even when the question asked was purely descriptive.

Third, investigator performance metrics. If investigators are evaluated on closure speed or on whether a responsible individual was identified, they will drift toward individual-attribution conclusions that are quick and easy to sell, because systemic findings usually require cross-department verification and resource negotiation that does not pay off within a review cycle.

Studying it

Compare causal depth, evidence chains, action types, and recurrence across reports; triangulate timelines, physical evidence, logs, interviews, and barrier analysis. Investigators should actively seek disconfirming evidence and comparable work that did not result in an accident, to resist writing the causal chain as though it were inevitable in hindsight. This extends to the organizational level: audit a batch of closure approvals to see how many required adding individual attribution before sign-off; check whether the safety-investigation file and the disciplinary file for the same event are genuinely separate documents issued by different roles with separate access logs — if the two are the same material under a different cover, the separation is nominal only.

Where it stops holding

Systems analysis does not presume no one is accountable, and it must not obstruct statutory evidence-gathering; deliberate violations and reckless conduct still require appropriate disciplinary or legal process, and systemic framing is not a reason to avoid that fact. Conversely, attributing everything to "culture" or "the environment" in the abstract is equally unactionable — a finding must name the concrete causal path: which design, resource allocation, or process condition shaped the decision, not a label standing in for analysis. When a case must be handed to a regulator or judicial process, the barrier between safety-investigation testimony and disciplinary evidence can be overridden by statutory requirement; that contingency needs a pre-agreed procedure rather than an ad hoc decision about whether to hand material over.

Applying it

• Make a closure precondition in the report template: findings must point to a concrete system condition (interface, equipment, procedure, resourcing, training) before a case can close; a report whose only conclusion is "raise awareness" gets sent back.
• Establish a separate authorization for evidence use: testimony gathered for safety learning cannot flow into disciplinary process without an added legal requirement, and this boundary should be documented, not left to informal understanding between teams.
• Decouple investigator performance review from "was a responsible individual named" or "closure speed," and tie it instead to how concrete the systemic recommendations are and how often they get adopted and verified afterward.
• How to check: audit closure approvals over a period and measure how many required adding individual attribution before sign-off; confirm the safety and disciplinary files for the same event are separate documents with separate access permissions.

Related

• Same group: Y7.05.2 Missing feedback loops cause accidents to recur · Y7.05.3 Findings must become concrete design or procedure changes · Y7.05.4 Investigation must be independent of routine management
• Nearby: Y7.01 Systemic causes · Y7.02 Error reporting
• Search terms: systems accident investigation · local rationality · safety learning