Accident investigation techniques 2nd edition pdf

34 ProfessionalSafety OCTOBER 2014 www.asse.org

Incident Investigation Our Methods Are Flawed

By Fred A. Manuele

It would be a rare exception if an outline for a safety management system did not include a requirement for incidents to be investigated and analyzed. And that is appropriate; incident inves- tigation is a vital element within a safety manage- ment system. The comments in section E6.2 of ANSI/AIHA/ASSE Z10-2012, Standard for Occu- pational Health and Safety Management Systems (OHSMS) (ANSI/AIHA/ASSE, 2012, p. 25), de- scribe the benefits that can be obtained from inci-

dent investigations:

as possible symptoms of prob- lems in the OHSMS.

should be used for root-cause analysis to identify system or other deficiencies for develop- ing and implementing correc- tive action plans so as to avoid future incidents.

- vestigations are to be fed back into the planning and correc- tive action processes.

As Z10 proposes, organiza- tions should learn from past experience to correct deficien- cies in management systems and make modifications to avoid future incidents.

Research Results The author has reviewed more than 1,800

incident investigation reports to assess their

quality, with an emphasis on causal factors identifi- cation and corrective actions taken (Manuele, 2013, p. 316). This revealed that an enormous gap can exist between issued investigation procedures and actual practice. On a 10-point scale, with 10 being best, an average score of 5.7 would be the best that could be given, and that could be a bit of a stretch.

These reviews confirmed that people who com- pleted investigation reports were often biased in favor of selecting an employee’s unsafe act as the causal factor and thereby did not proceed further into the investigation.

The author then conducted a five-why analysis to determine why this gap exists between issued procedures and actual practice. As the analysis proceeded, it became apparent that our model is flawed on several counts. The author’s observa- tions follow. These observations are made a priori, that is, relating to or derived by reasoning from self-evident proposition.

Why Incident Investigations May Not Identify Causal Factors

When supervisors are required to complete inci- dent investigation reports, they are asked to write performance reviews of themselves and of those to whom they report, all the way up to the board of directors. Managers who participate in incident investigations are similarly tasked to evaluate their own performance and the results of decisions made at levels above theirs.

It is understandable that supervisors will avoid expounding on their own shortcomings in inci- dent investigation reports. The probability is close to zero that a supervisor will write: “This incident

d

a le

s a o in ti fu

v in ti

ti e c a a

R

IN BRIEF An earlier review of incident investi-

gation reports revealed an enormous gap between established reporting procedures and actual practice. Supervisors are commonly assigned

responsibility for incident investiga- tion. However, most supervisors are not qualified to offer recommendations for improving operating systems be- cause they lack sufficient knowledge of hazard identification and analysis, and risk assessment. This article presents a sociotechnical

model for hazards-related incidents. Such a system stresses an interde- pendent relationship between humans and machines, and accommodates the needs of both the system’s output goal and workers’ needs.

Fred A. Manuele, P.E., CSP, -

ing director and manager of M&M Protection Consultants. His safety experience spans several decades. Manuele’s books, Advanced Safety Management: Focusing on Z10 and Serious Injury Prevention, and On the Practice of Safety, have been adopted for several graduate and un- dergraduate safety degree programs. He is also author of Innovations in Safety Management: Addressing Career Knowledge Needs and Heinrich

Revisited: Truisms or Myths and coeditor of Safety Through Design. He was chair of the committee that developed ANSI/ASSE Z590.3, Standard for Prevention Through Design—Guidelines for Addressing Occupational Hazards and Risks in Design and Redesign Processes. Manuele is an ASSE Fellow and received the Distinguished Service to Safety Award from NSC. He has served on the board of directors for ASSE, NSC and BCSP, which he also served as president. In June

Safety Management Peer-Reviewed

www.asse.org OCTOBER 2014 ProfessionalSafety 35

occurred in my area of supervision and I take full responsibility for it. I overlooked X. I should have done Y. My boss did not forward the work order for repairs I sent him 3 months ago.”

Self-preservation dominates, logically. This also applies to all management levels above the line su- pervisor. All such personnel will be averse to de- claring their own shortcomings. Similarly, it is not surprising that supervisors and managers are reluc- tant to report deficiencies in the management sys- tems that are the responsibility of their superiors.

With respect to operators (first-line employees) and incident causation, Reason (1990) writes:

Rather than being the main instigator of an ac- cident, operators tend to be the inheritors of sys- tem defects created by poor design, incorrect installation, faulty maintenance and bad man- agement decisions. Their part is usually that of adding the final garnish to a lethal brew whose ingredients have already been long in the cook- ing. (p. 173)

Supervisors, one step above line employees, also work in a “lethal brew whose ingredients have al- ready been long in the cooking.” Supervisors have little or no input to the original design of operations and work systems, and are hampered with regard to making major changes to those systems. The au- thor’s practical on-site experience has shown that most supervisors do not have sufficient knowledge of hazard identification and analysis, and risk as- sessment to qualify them to offer recommenda- tions for improving operating systems.

History In safety management systems, first-line su-

pervisors are often responsible for initiating an incident investigation report. In relatively few or- ganizations, this responsibility is assigned to a team or an operating executive.

It is presumed that supervisors are closest to the work and that they know more about the details of what has occurred. The history on which such as- signments are based can be found in three editions of Heinrich’s Industrial Accident Prevention. Hein- rich’s influence continues to this day. Heinrich

(1941, 1950, 1959) comments on incident inves- tigation methods in the second, third and fourth editions of his book.

The person who should be best qualified to find the direct and proximate facts of individual accident occurrence is the person, usually the supervisor or foreman, who is in direct charge of the injured person, The supervisor is not only best qualified but has the best opportunity as well. Moreover, he should be personally inter- ested in events that result in the injury of workers under his control.

In addition, he is the man upon whom man- agement must rely to interpret and enforce such corrective measures as are devised to prevent other similar accidents. The supervisor or fore- man, therefore, from every point of view, is the person who should find and record the major facts (proximate causes and subcauses) of ac- cident occurrence.

In addition, he and the safety engineer should cooperate in finding the proximate causes and subcauses of potential injury producing acci- dents. (1941, p. 111; 1950, p. 123; 1959, p. 84)

Heinrich’s premise that the supervisor is best qualified to make incident investigations continues to be influential to this day, as evidenced by the following example from NSC (2009).

Depending on the nature of the incident and oth- er conditions, the investigation is usually made by the supervisor. This person can be assisted by a fellow worker familiar with the process, a safety professional or inspector, or an employee health professional, the joint safety and health committee, the general safety committee or a consultant from the insurance company. If the incident involves unusual or special features, consultation with a state labor department, or a federal agency, a union representative or an outside expert may be warranted. If a contrac- tor’s personnel are involved in the incident, then a contractor’s representative should also be in- volved in the investigation.

The supervisor should make an immediate re- port of every injury requiring medical treatment and other incidents he or she may be directed to

An enormous gap can exist between

issued investigation procedures and actual practice.

© IS

TO C

K P

H O

TO .C

O M

/D R

A G

O N

IM A

G E

S

36 ProfessionalSafety OCTOBER 2014 www.asse.org

investigate. The supervisor is on the scene and probably knows more about the incident than anyone else. It is up to this individual, in most cases, to put into effect whatever measures can be adopted to prevent similar incidents. (p. 285)

Ferry (1981) also writes that the supervisor is closest to the action and most often is expected to initiate incident investigations. But he was one of the first writers to introduce the idea that supervi- sors may have disadvantages when doing so.

The supervisor/foreman is closest to the action. The mishap takes place in his domain. As a re- sult, he most often investigates the mishap. If it is the supervisor’s duty to investigate, he has every right to expect management to prepare him for the task.

Yet the same reasons for having the super- visor/foreman make the investigation are also reasons he should not be involved. His reputa- tion is on the line. There are bound to be causes uncovered that will reflect in some way on his method of operation.

His closeness to the situation may preclude an open and unbiased approach to the supervisor- caused elements that exist. The more thorough the investigation, the more likely he is to be impli- cated as contributing to the event. (p. 9)

Ferry (2009) makes similar comments about line managers and staff managers (e.g., personnel di- rectors, purchasing agents).

A thorough investigation often will find their func- tions contributed to the mishap as causal fac- tors. When a causal factor points to their function they immediately have a point in common with the investigator. (p. 11)

In one organization whose safety director pro- vided input for this article, the location manager leads investigations of all OSHA recordable inci- dents. That is terrific; senior management is in- volved. Many of the constraints applicable to the people who report to the manager can be over- come. But, in a sense, the manager is required to

write a performance appraisal on him/herself and on the people in the reporting structure above his/ her level. If contributing factors result from deci- sions the manager made or his/her bosses made, details about them may not be precisely recorded.

Investigation Teams Discussions with several corporate safety profes-

sionals indicate that their organizations use a team to investigate certain incidents. Assume the team consists of supervisors who report to the same in- dividual as the supervisor for the area in which the incident occurred. The team is expected to write a performance appraisal on the involved supervisor as well as on the person to whom all of them re- port, and that person’s bosses.

A priori, it is not difficult to understand that su- pervisors would be averse to criticizing a peer and management personnel to whom they also report. The supervisor whose performance is reviewed be- cause of an incident may someday be part of a team appraising other supervisors’ performance.

At all management levels above line supervisor, it would also be normal for personnel to avoid being self-critical. Self-preservation dominates at all levels.

Safety professionals should realize that con- straints similar to those applicable to a supervisor also apply, in varying degrees, to all personnel who lead or are members of investigation teams.

Nevertheless, the author found that incident investigation reports completed by teams were superior. Ferry (1981, p. 12) says, “Special investi- gation committees are often appointed for serious mishaps” and “their findings may also receive bet- ter acceptance when the investigation results are made public.”

To the extent feasible, investigation team leaders should have good managerial and technical skills and not be associated with the area in which the incident occurred.

Chapter 7 of Guidelines for Investigating Chemi- cal Process Incidents (CCPS, 2003) is titled “Build-

the word chemical appears in the book’s title, the text is largely generic. The opening paragraph of Chapter 7 says:

A thorough and accurate incident investigation depends upon the capabilities of the assigned team. Each member’s technical skills, expertise and communication skills are valuable consider- ations when building an investigation team. This chapter describes ways to select skilled person- nel to participate on incident investigation teams and recommends methods to develop their capa- bilities and manage the teams’ resources. (p. 97)

This book is recommended as a thorough dis- sertation on all aspects of incident investigation. Throughout the book, competence, objectivity, ca- pability and training are emphasized.

Training for Personnel on Incident Investigation If personnel are to perform a function they should

be given the training needed to acquire the nec-

In a sense, the manager is required to write a perfor- mance appraisal on him/ herself and on the people in the reporting structure

above his/her level.

© IS

TO C

K P

H O

TO .C

O M

/D R

A G

O N

IM A

G E

S

www.asse.org OCTOBER 2014 ProfessionalSafety 37

essary skill. Others make similar or relative com- ments. Ferry (1981) says, “If it is the supervisor’s duty to investigate, he has every right to expect management to prepare him for the task” (p. 9).

The following citation is from Guidelines for Investigating Chemical Process Incidents: “High quality training for potential team members and supporting personnel helps ensure success. Three different audiences will benefit from training: site management personnel, investigation support per- sonnel and designated investigation team mem- bers including team leaders” (CCPS, 2003, p. 105).

For each organization, several questions should be asked; the answers may differ greatly.

- vestigation techniques do supervisors and investi- gation team members receive?

and technically qualified?

Consideration also must be given to the time lapse between when supervisors and others attend a training session and when they complete an in- cident investigation report. It is generally accepted that knowledge obtained in training will not be re- tained without frequent use. It is unusual for team members to participate in two or three incident in- vestigations in a year. Inadequate training may be a major problem.

What Is Being Taught: Causation Models Dekker (2006) makes the following astute ob-

servation, worthy of consideration by all who are involved in incident investigations.

Where you look for causes depends on how you believe accidents happen. Whether you know it or not, you apply an accident model to your anal- ysis and understanding of failure. An accident model is a mutually agreed, and often unspoken, understanding of how accidents occur. (p. 81)

Safety professionals must understand that how they search for causal or contributing factors relates to what they have learned and their beliefs with re- spect to incident causation. There are many cau- sation models in safety-related literature. Dekker (2006) describes three kinds of accident models. His models, abbreviated, are cited as examples of the many models that have been developed.

sees accidents as a chain of events that leads up to a failure. It is also called the domino model, as one domino trips the next. [Author’s note: The domino sequence was a Heinrichean creation.]

accidents as related to latent failures that hide in everything from management decisions to pro- cedures to equipment design.

- dents as merging interactions between system components and processes, rather than failures within them. (p. 81)

Dekker (2006) strongly supports a systems ap- proach to incident investigation, taking into con-

sideration all of the relative management systems as a whole. He says:

The systems approach focuses on the whole, not the parts. The interesting properties of systems (the ones that give rise to system accidents) can only be studied and understood when you treat them in their entirety. (p. 91)

Dekker is right: Whether persons at all levels are aware of it, they apply their own model and their understanding of how incidents occur when in- vestigations are made. Thus, two questions need consideration:

about incident causation?

people in the organizations they advise? Answers to those questions greatly affect the

quality of incident investigations. Based on the author’s research (Manuele, 2011), the myths that should be dislodged from the practice of safety are:

1) Unsafe acts of workers are the principal causes of occupational incidents.

2) Reducing incident frequency will achieve an equivalent reduction in injury severity.

These myths arise from the work of Heinrich and can be found in the four editions of Industrial Ac- cident Prevention (1931, 1941, 1950, 1959). Analyti- cal evidence developed by the author indicates that these premises are not soundly based, supportable or valid.

Heinrich professed that among the direct and proximate causes of industrial incidents:

88% are unsafe acts of persons; 10% are unsafe mechanical or physical conditions; and 2% are unpreventable. (1931, p. 43; 1941, p. 22; 1950, p. 19; 1959, p. 22)

Heinrich advocated identifying the first proximate and most easily prevented cause in the selection of remedies for the prevention of incidents. He says:

Selection of remedies is based on practical cause-analysis that stops at the selection of the first proximate and most easily prevented cause (such procedure is advocated in this book) and considers psychology when results are not pro- duced by simpler analysis. (1931, p. 128; 1941; p. 269; 1950, p. 326; 1959, p. 174)

Note that the first proximate and most easily prevented cause is to be selected (88% of the time, a human error). That concept permeates Hein- rich’s work. It does not encompass what has been learned subsequently about the complexity of in- cident causation or that other causal factors may be more significant than the first proximate cause.

Many safety practitioners still operate on the be- lief that the 88-10-2 ratios are soundly based. As a result, they focus on correcting a worker’s unsafe act as the singular causal factor for an incident rather than addressing the multiple causal factors that contribute to most incidents.

A recent example of incident causation complex- ity appears in the following excerpt from the report prepared by BP (2010) following the April 20, 2010, Deepwater Horizon explosion in the Gulf of Mexico.

38 ProfessionalSafety OCTOBER 2014 www.asse.org

The team did not identify any single action or in- action that caused this incident. Rather, a com- plex and interlinked series of mechanical failures, human judgments, engineering design, opera- tional implementation and team interfaces came together to allow the initiation and escalation of the accident. (p. 31)

During an incident investigation, a professional search to identify causal factors such as through the five-why analysis system will likely find that the causal factors built into work systems are of greater importance than an employee’s unsafe act.

The author’s previous work (Manuele, 2011) cov- ered topics such as moving the focus of preventive efforts from employee performance to improving the work system; the significance of work system and methods design; the complexity of causation; and recognizing human errors that occur at orga- nizational levels above the worker.

Although response to that article was favorable, some communications received contained a dis- turbing tone. It became apparent that Heinrich’s premise that 88% of occupational incidents are caused by the unsafe acts of workers is deeply em- bedded in the minds of some safety practitioners and those they advise. This is a huge problem. This premise was taught to students in safety science degree programs for many years and is still taught. The author received a call from one professor who said that the 2011 article gave him the leverage he needed to convince other professors that some of Heinrich’s premises are not valid and should not be taught.

How big is the problem? Paraphrasing an April 2014 e-mail from the corporate safety director of one of the largest companies in the world, “We are thinking about how far to go to push Heinrich thinking out of our system. We still have some traditional safety thinkers who would squirm and voice concerns if we did that.”

In May 2014, the author spoke at a session ar- ranged by ORCHSE, a consulting organization

whose members represent Fortune 500 companies. When the more than 85 attendees were asked by show of hands whether Heinrich concepts domi- nated their incident investigation systems, more than 60% responded affirmatively. This author believes that many of those who did not respond positively were embarrassed to do so.

At an August 2014 meeting of 121 safety person- nel employed by a large manufacturing company, participants were asked: About what percentage of the incident reports at your location identify unsafe acts as the primary cause? The results follow:

% of reports Participant responses 100% 3% 75% 33% 50% 37% 25% 12% < 25% 15%

A total of 73% of participants indicated that for 50% to 100% of incident reports, workers’ unsafe acts are identified as the primary cause. To quote the colleague who conducted this survey, “We’ve got work to do.”

Also, note the following comments that are sig- nificant with respect to how big the problem is. For more than 35 years, E. Scott Geller has been a prominent practitioner in behavior-based safety. His current thinking is relative to the reality of causal factors and their origins. Excerpts from a re- cent article follow (Geller, 2014).

A person who believes that most injuries are caused by employee behavior can be viewed as a safety bully. This belief could influence a focus on the worker rather than the culture or manage- ment systems, or many other contributing fac- tors. As Deming warns, “Don’t blame people for problems caused by the system.”

When safety programs are promoted on a premise such as “95% of all workplace acci- dents are caused by behavior,” one can under- stand why union leaders object vehemently and justifiably to such. Claiming that behaviors cause workplace injuries and property damage places blame on the employee and dismisses manage- ment responsibility. Most worker behavior is an outcome of the work culture, the system.

It is wrong to presume that behavior is a cause of an injury or property damage. Rather, behavior is one of several contributing factors, along with environmental and engineering factors, manage- ment factors, cultural factors and person-states. (pp. 41-42)

This author concludes that supervisors, manage- ment personnel above the supervisory level, in- vestigation team members and safety practitioners who are not informed on current thinking with respect to incident causation are not qualified to identify causal and contributing factors, particular- ly those that derive from inadequacies in an orga- nization’s culture, operating systems and technical aspects applications, and from errors made at up- per management levels. This presents a challenge for safety professionals, as well as an opportunity.

Practitioners who are not informed on

current thinking with respect to incident

causation are not qualified

to identify causal and contributing

factors.

© IS

TO C

K P

H O

TO .C

O M

/D R

A G

O N

IM A

G E

S

www.asse.org OCTOBER 2014 ProfessionalSafety 39

Multifactorial Aspects of Incident Causation Most hazards-related incidents, even those that

seem to be the least complex, have multiple causal factors that derive from less than adequate work- place and work methods design, operations man- agement and personnel performance.

The author’s reviews of incident investigation reports, mostly on serious injuries and fatalities, showed that:

fatality are unique and singular events, having multiple and complex causal factors that may have organizational, technical, operational systems or cultural origins.

- quence events are seldom represented in the ana- lytical data on incidents that occur frequently. (Some ergonomics-related incidents are the exception.)

Those studies also showed that a significantly large share of incidents resulting in serious injuries and fatalities occurred:

performed;

- tions (replacing a motor weighing 800 lb to be in- stalled on a platform 15 ft above the floor);

and startups; -

trical, steam, pneumatic, chemical); -

mal to abnormal). In every report reviewed, multiple causal fac-

tors were identified; there was an initiating event followed by a cascade of contributing factors that developed in sequence or in parallel. They related directly to deficiencies in operational management systems that should be subjects of concern when investigations are made.

Johnson (1980) writes succinctly about the mul- tifactorial aspect of incident causation:

Accidents are usually multifactorial and develop through relatively lengthy sequences of changes and errors. Even in a relatively well-controlled work environment, the most serious events in- volve numerous error and change sequences, in series and parallel. (p. 74)

Human Errors: Management Decision Making Particular attention is given here to Guidelines for

Preventing Human Error in Process Safety (CCPS, 1994). Although the term process safety appears in the book’s title, the first two chapters provide an easily read primer on human error reduction.

Safety professionals should view the following highlights as generic and broadly applicable. They advise on where human errors occur, who commits them and at what level, the influence of organiza- tional culture and where attention is needed to re- duce the occurrence of human errors.

It is readily acknowledged that human errors at the operational level are a primary contributor to

the failure of systems. It is often not recognized, however, that these errors frequently arise from failures at the management, design or technical expert levels of the company. (p. xiii)

A systems perspective is taken that views error as a natural consequence of a mismatch between human capabilities and demands, and an inap- propriate organizational culture. From this per- spective, the factors that directly influence error are ultimately controllable by management. (p. 3)

Almost all major accident investigations in recent years have shown that human error was a signifi- cant causal factor at the level of design, operations, maintenance or the management process. (p. 5)

One central principle presented in this book is the need to consider the organizational factors that create the preconditions for errors, as well as the immediate causes. (p. 5)

Since “failures at the management, design or technical expert levels of the company” affect the design of the workplace and the work methods (i.e., the operating system), it is logical to suggest that safety professionals encourage that incident investi- gations focus on improving the operating system to achieve and maintain acceptable risk levels.

Dekker’s (2006) premises are pertinent to this subject. Several excerpts follow:

Human error is not a cause of failure. Human er- ror is the effect, or symptom, of deeper trouble. Human error is systematically connected to fea- tures of people’s tools, tasks and operating sys- tems. Human error is not the conclusion of an investigation. It is the starting point. (p. 15)

Sources of error are structural, not personal. If you want to understand human error, you have to dig into the system in which people work. (p. 17)

Error has its roots in the system surrounding it; connecting systematically to mechanical, pro- grammed, paper-based, procedural, organiza- tional and other aspects to such an extent that the contributions from system and human error begin to blur. (p. 74)

The view that accidents really are the result of long-standing deficiencies that finally get acti- vated has turned people’s attention to upstream factors, away from frontline operator “errors.” The aim is to find out how those “errors,” too, are a systematic product of managerial actions and organizational conditions. (p. 88)

The Systemic Accident Model . . . focuses on the whole [system], not [just] the parts. It does not help you much to just focus on human errors, for example, or an equipment failure, without tak- ing into account the sociotechnical system that helped shape the conditions for people’s per- formance and the design, testing and fielding of that equipment. (p. 90)

Reason’s (1997) book, Managing the Risks of Organizational Accidents, is a must-read for safety professionals who want to learn about human er- ror reduction. Reason writes about how the effects

40 ProfessionalSafety OCTOBER 2014 www.asse.org

of decisions accumulate over time and become the causal factors for incidents resulting in serious in- juries or substantial damage when all the circum- stances necessary for the occurrence of a major event fit together. He stresses the need to focus on decision making above the worker level to prevent major incidents:

Latent conditions, such as poor design, gaps in supervision, undetected manufacturing defects or maintenance failures, unworkable proce- dures, clumsy automation, shortfalls in training, less than adequate tools and equipment, may be present for many years before they combine with local circumstances and active failures to penetrate the system’s layers of defenses.

They arise from strategic and other top level decisions made by governments, regulators, manufacturers, designers and organizational managers. The impact of these decisions spreads throughout the organization, shaping a distinctive corporate culture and creating error-producing factors within the individual workplaces. (p. 10)

If the decisions made by management and others have a negative effect on an organization’s culture and create error-producing factors in the work- place, focusing on reducing human errors at the worker level—the unsafe acts—will not solve the problems. Thus, the emphasis in incident investi- gations should be on the management system defi- ciencies that result in creating a negative “culture” and “error-producing factors in the workplace.”

A Causation Model Safety professionals are obligated to give advice

based on a sound and studied thought process that considers the reality of the sources of hazards. The author proposes that a causation model must en- compass the following premises.

- miner with respect to the avoidance, elimination, reduction or control of hazards and whether ac- ceptable risk levels are achieved and maintained.

to operational risk management is an extension of the organization’s culture.

at the management level when policies, standards, procedures, provision of resources and the ac- countability system are less than adequate.

- tion are systemic. They derive from management decisions that establish the operating sociotech- nical system—the workplace, work methods and governing social atmosphere-environment.

incidents must consider the entirety of the socio- technical system, applying a holistic approach to both the technical and social aspects of operations. It must be understood that those aspects are inter- dependent and mutually inclusive.

The sociotechnical system in an organization is a derivation of its culture. The following definition of a sociotechnical system is a composite of several defi- nitions and the author’s views, based on experience.

A sociotechnical system stresses the holistic, interdependent, integrated and inseparable inter- relationship between humans and machines. It fosters the shaping of both the technical and so- cial conditions of work in such a way that both the system’s output goal and the workers’ needs are accommodated.

This article presents a sociotechnical model for hazards-related incidents (Figure 1). It is the au- thor’s composite and is influenced by his research and experience.