Run and sign off an investigation
A versioned investigation with findings that become actions — approved by someone who did not write it.
7 min read · Last reviewed 18 August 2026
Open the investigation
- 1
From the incident, start the investigation and assign the lead.
- 2
The investigation level is enforced against the incident’s severity — a serious event cannot quietly get the light-touch treatment.
- 3
Gather the account: sequence of events, evidence, witness statements. Everything attaches to the investigation record.
Findings and causes
- 1
Record findings with their root causes — what failed, why it failed, what would stop it failing again.
- 2
For each finding, name the corrective action it needs: what must change, who should own it.
Tip: Write findings someone can act on. “Improve safety culture” is a wish; “guard the infeed rollers and add the check to the weekly walk” is a finding.
Submit for separated sign-off
- 1
Submit the investigation for approval. The approver cannot be the person who led or submitted it — separation of duty is enforced, not encouraged.
- 2
At approval, every finding’s action gets a confirmed owner and due date — approval is the moment the fixes become real work.
- 3
Approved revisions freeze. Reopening an investigation writes revision two; it never edits what was approved.
Note: Where no independent approver exists — a genuinely sole-manager operation — an override is possible, with a justification that goes on the record.
Close the loop, then check it held
- 1
The incident moves to actions-outstanding until the corrective actions are done, then closes.
- 2
About 90 days on, an effectiveness review asks the only question that matters: did the fix work?
- 3
“Not effective” reopens the incident rather than filing it — a fix that did not hold is not a closed incident.