Incident investigation methods: ISO, ILO, CSB, ICAM, RCA and more

The short answer: a tool is not an investigation

A professional incident investigation builds a traceable chain: what happened, what evidence supports each claim, which controls were absent or ineffective, how the work was actually performed, and which changes reduce the likelihood or consequence of recurrence. 5 Whys, a causal tree or ICAM can organise parts of that thinking. A method's name cannot establish causation by itself.

This comparison asks what the major references do well, where each stops and how to match effort to an event. The site's central investigation guide addresses the whole process, while its evidence article goes deeper into facts, hypotheses and causal conclusions. Preventive internal investigations, regulatory inquiries, legal expert reports and criminal inquiries also have distinct purposes and powers.

Central investigation guide — Portuguese →

Facts, hypotheses and evidence — Portuguese →

Brazilian law: what NR-1 actually requires

Brazil's NR-1, in force on 28 September 2026, requires organisations to analyse work-related accidents and illnesses under item 1.5.5.5.1. Item 1.5.5.5.1.1 also calls for analysis of dangerous events that could have had serious consequences. Documented analyses must account for the activity actually performed, workplace, materials, production process, work organisation and other related factors; use organisational and epidemiological data and information from workers; and provide evidence to revise and improve preventive measures.

The regulation states a duty and outcomes, not a mandatory universal technique such as 5 Whys, a causal tree or ICAM. The occupational risk management action plan specifies responsibility, schedule, follow-up and assessment of results. Formal accident notification and preventive investigation are different tasks. This Brazilian law does not govern investigations in other jurisdictions.

The Ministry of Labour identifies the wording effective from 26 May 2026. Future amendments require revalidation of the original text. We use Brazil here as an explicit legal example while the remaining references are technical or educational unless local law says otherwise.

Brazilian accident notification versus investigation — Portuguese →

What sound references share

Across sectors, credible investigations prioritise safe response and preservation, collect physical and documentary evidence, build a chronology, test technical and organisational safeguards, connect recommendations to demonstrated mechanisms, and revisit the work to check effectiveness. The formality can vary; the distinction between observation and inference cannot.

Open interviews ask what people saw, did, knew and expected at the time. Process logs, maintenance records, work orders, alarms, images, samples and digital traces help test accounts. A timeline should show gaps and conflicting accounts instead of silently smoothing them away. Actual work is a source of evidence, not an assumed deviation from a written procedure.

'Human error' describes an action at most; it cannot close an inquiry into interface design, time pressure, staffing, competing goals, communication or supervision. Claims about fatigue or personal factors also require specific evidence. A good investigator tests alternative explanations and their preventive implications.

Beyond blame — Portuguese →

ILO and HSE: public starting points

The ILO's free Investigation of Occupational Accidents and Diseases is a practical guide for labour inspectors, available in several languages. It develops information gathering, causes and prevention. Internal company teams can learn from it while recognising that they do not have an inspector's powers.

The UK HSE's free HSG245 workbook, first published in 2004, organises work into gathering information, analysing it, identifying risk controls and implementing an action plan. NEBOSH and HSE jointly offer a one-day qualification for non-complex incidents, including witness interviews, evidence and action planning. That course is training, not a requirement of Brazilian NR-1 or a universal licence to lead complex investigations.

These public guides teach the process before a company chooses a commercial system. Serious engineering failures may still need domain specialists, laboratory tests and a larger multidisciplinary team.

Near misses and weak signals — Portuguese →

ISO 45001/45002 and IEC 62740 answer different questions

ISO 45001:2018 concerns occupational health and safety management: incidents, nonconformities, corrective action, risk review and improvement. ISO 45002:2023 guides implementation of that management system. Neither is a branded root-cause method or mandates ICAM, 5 Whys or another technique. As of September 2026, ISO listed a revision project for ISO 45001; a draft does not replace the published 2018 edition.

IEC 62740:2015, in contrast, describes basic root cause analysis principles and steps for an RCA process. It helps structure causal work without being a Brazilian statutory requirement or a licence to assign blame. The detailed technique must still fit the evidence, event and investigators' competence. We do not reproduce the protected text of these standards.

What CSB teaches, and what its app does not

The U.S. Chemical Safety and Hazard Investigation Board is an independent, nonregulatory federal agency for serious chemical incidents. Its reports, updates, videos and recommendations show the use of interviews, documents, physical evidence, tests and operational analysis. Reading a completed investigation closely develops judgment about what is measured, inferred and recommended; an ongoing case should not be treated as a final causal finding.

CSB offers a free Process Safety Management training application on OSHA's 14 PSM elements, using the 2005 BP Texas City disaster as a model. This is not a general investigator certification course. The download page does not establish compatibility with current operating systems. We did not find an official general investigator certification programme on the agency's site in this review.

The strongest educational resource is its public case library. The Andrade Safe guide to CSB reports explains how to use it without confusing a U.S. investigation agency with a Brazilian regulator.

Study CSB investigations — Portuguese →

Clairton and work as done — Portuguese →

CCPS: depth for process safety events

The AIChE Center for Chemical Process Safety offers Incident Investigation and Root Cause Analysis training and Guidelines for Investigating Process Safety Incidents, 3rd Edition. Its published description covers incident classification, initial response, team selection, scene preservation, evidence, interviews, what happened, causal analysis, recommendations, implementation and communication. The book targets process safety while noting use in other reliability and occupational events.

A release, fire, explosion or integrity failure can demand process, materials and instrumentation engineers, digital evidence, laboratory tests and management-of-change review. The test of depth is evidence for each important causal link, including plausible alternatives, not the number of boxes in the chart. Scale resources to actual severity, potential severity and uncertainty.

Shell Monaca illustrates why the architecture of administrative safeguards and human-machine interfaces matters beyond an isolated operator action.

Shell Monaca barriers and HMI — Portuguese →

DuPont and dss+: related history, separate organisations

Industrial company DuPont reported adopting Apollo Reality Charting in its 2022 Sustainability Report to improve its internal incident investigations and recommendations. That historical statement does not prove universal current use and does not make Apollo a mandated standard. We do not reproduce its proprietary method.

DuPont Sustainable Solutions became independent in 2019 and adopted the dss+ brand in 2022. The independent consulting firm currently lists four Incident Investigation e-learning modules, covering team formation and information through analysis, recommendations and follow-up, and describes a web app with a seven-stage workflow. Those are dss+ offerings, not current 'DuPont courses'. Public descriptions allow comparison, not a review of course quality without taking the course.

ICAM, Tripod Beta, DNV and human factors

Safety Wise describes ICAM as a systemic method linking local conditions to organisational factors such as communication, procedures, conflicting goals, change management and equipment. Energy Institute's public Tripod Beta overview starts with missing, failed or successful barriers, then examines immediate actions, performance-influencing conditions and underlying organisational factors. Training, manuals, accreditation and applicable licences belong to their providers.

DNV advertises a practical course, particularly in a maritime setting, covering evidence, interviews, STEP timelines, event and causal factor charts, fact trees and its M-SCAT tool. IOSH offers human factors training that explicitly addresses investigators' own biases. Summarising these public aims neither teaches the proprietary procedures nor certifies a reader to use them formally.

Barrier performance and conditions for human action are shared questions, but proprietary workflows are not interchangeable. Ask what made a decision reasonable or likely in context before writing 'human error' as the end of an investigation.

Systemic factors beyond blame — Portuguese →

Fundacentro and the causal tree

Brazil's Fundacentro has promoted the Método da Árvore de Causas (ADC). Its key discipline is linking established facts while distinguishing observations from comments, opinions and judgments. Multiple antecedents can be represented without forcing one linear cause. An elegant tree with unsupported links is still a hypothesis, so the team must document and test each connection.

A 2025 Fundacentro technical report discusses deeper and systemic approaches, including the MAPA model, bow-tie ideas and work as performed. It warns against superficial blame explanations that hide design and organisational conditions. The causal tree is a useful technical reference, not the only method prescribed by Brazilian NR-1.

Evidence and causal claims — Portuguese →

Five tools, five distinct jobs

5 Whys can probe a fairly bounded causal chain if each answer is supported. There is no obligation to ask exactly five questions; a neat linear story may miss parallel factors. A fishbone diagram organises candidate categories for inquiry but its arrows are not proof. A causal tree relates established facts and multiple antecedents, demanding careful language and logical links.

Barrier analysis asks which controls should have prevented an event or limited its escalation, whether they were available and independent, and how they actually performed. Counting correlated safeguards is not redundancy. Structured RCA is a family of processes for testing explanations, not a promise of one magic 'root cause'. Bow-tie can visualise threats, a central event, consequences and controls but does not replace factual reconstruction. FTA, FMEA and HAZOP can support a specialised technical or risk analysis; they are not universal incident investigation equivalents.

An international map of access and use

Free means an official resource is openly available; a paid standard, course, software licence or companion material may still exist. Availability and prices change, so check the provider.

Match rigour to severity, potential and uncertainty

For a bounded event with sound evidence, a timeline, evidence-tested Why questions and barrier review may suffice. Multiple changes, conflicting accounts or interacting factors call for a causal tree, event and causal factor chart or fact tree to display connections and unknowns. A more detailed chart does not repair weak evidence.

Serious or high-potential events warrant formal preservation, multidisciplinary competence, worker input, alternative hypotheses, safeguards and technical tests. A near miss deserves resources based on credible potential and nearly failed barriers, not merely the absence of injury. Specialist mechanisms demand process, materials, electrical, fire, structural or digital experts as appropriate.

Regulatory, employment, civil or criminal implications can create separate evidence-handling duties and decision makers. This preventive framework does not replace those processes.

Near-miss signals — Portuguese →

Clearly fictional example: a jammed conveyor

This example is invented solely to compare reasoning. An operator enters a conveyor danger zone to clear a jam. A weak report ends with 'careless worker ignored the procedure'. That does not explain why entry was possible, why jams recurred or why the formal alternative was impractical.

Suppose the hypothetical evidence establishes that a guard allowed access, jams repeatedly occurred, stoppages hurt output, there was no workable safe clearing method, supervision knew the routine and previous near misses prompted no change. These are stipulated facts of the exercise, not claims about an actual case. A timeline, interviews and safeguard review should test the roles of guarding, interlocking, energy isolation, process design, maintenance, goals and supervision.

Better actions could eliminate the jam at source, redesign access and guards, make isolation practicable, revise the real task, train after the system changes and measure recurrence and entry. Retraining alone cannot fix a technical defect deliberately left in place. The conveyor article treats that hazard in more detail.

Conveyor safety and energy control — Portuguese →

Recommendations and effectiveness checks

A strong recommendation identifies the mechanism to change, owner, deadline, proof of implementation and effectiveness test. 'Raise awareness' is weak if the evidence identified recurring jams or a defeated guard. Prefer elimination and engineered controls where feasible; procedures and training may still be necessary but must work in actual operations.

An action is not effective merely because its status turns green. Observe the job after change, test the safeguard, check whether risk moved to another task and hear workers using the new method. Set indicators and a timeframe suited to exposure. A short period without an injury alone proves little; reopen the analysis if the control does not perform.

Limits of administrative safeguards — Portuguese →

How Andrade Safe structures the work

Método SAFE — Sistema de Análise de Falhas e Evidências — uses five operational steps: prepare and preserve, reconstruct with evidence, analyse causes and barriers, act on supported mechanisms, and verify effectiveness. This is Andrade Safe's way to organise preventive work. It is consistent with broad principles in the references above, but is not certified, endorsed or equivalent to ISO, ILO, HSE, CSB, CCPS, DuPont, dss+, ICAM, Tripod or DNV methods.

Readers who want practical training can explore the Portuguese-language Método SAFE programme after using the open guides and comparison. Sound evidence and effective changes matter whether or not a course is purchased.

Método SAFE training — Portuguese →

Investigator's closing checklist

Review the work before closing the report and again after preventive changes.

• Were people protected and evidence preserved during initial response?
• Are facts, sources, dates, gaps and hypotheses distinguished?
• Were actual work, interviews, records and physical evidence compared?
• Is the timeline auditable and explicit about uncertainty?
• Were absent, degraded and common-cause safeguards tested?
• Did the team examine technical, human and organisational alternatives beyond blame?
• Does team competence match severity, potential and uncertainty?
• Does each recommendation address an evidence-supported mechanism?
• Are ownership, deadlines and implementation criteria clear?
• Will the task be observed and controls tested after the change?
• Are worker feedback and cross-site learning planned?
• Will risk assessments and action plans change when findings require it?