Incident Investigation

Forensic investigations and the identification of technical causes and effects are usually well understood and managed effectively during incident investigations. However, integrating human and organizational factors into causal analysis remains a challenge for most organizations. The common tendency is to focus on nearby factors that are close in time and space to the event. Often, investigations conclude once a cause is identified, even though it is clear that multiple factors played critical roles in the system failure. These factors were all necessary but, taken individually, were only collectively sufficient to push the system beyond its safe limits. Therefore, human error is the starting point of an investigation – not the end point.