Incident Investigations: “Employee Did Not Follow Procedure” Is Not a Root Cause
An incident occurs. The employee is interviewed. The written procedure is reviewed. Someone identifies the step the employee did not follow.
The investigation concludes: Employee failed to follow established procedure.
The corrective actions are predictable. Retrain the employee, review the procedure with the department, document the counseling, and remind everyone to follow the rules. Investigation closed.
But was the incident actually investigated?
Determining that an employee deviated from a procedure may describe what happened immediately before the event. It does not explain why the deviation occurred, why the existing defenses failed, or why the organization allowed the situation to reach the point where one person’s decision could produce an injury, release, equipment failure, or serious near miss.
As Human and Organizational Performance coach, speaker and author Todd Conklin says: “Written plans cannot plan for unplanned events.”
A procedure can describe the expected task under expected conditions, that’s it. Real work includes changing conditions, equipment problems, time pressure, incomplete information, conflicting priorities, unexpected events and people. That’s people as in human beings.
A meaningful investigation must examine that context.
Start With an Open Mind
An investigation should begin with a question, not a conclusion. If the team begins with the belief that an employee caused the incident by failing to follow a procedure, every interview and piece of evidence may be interpreted to confirm that belief.
The questions become accusatory:
Why didn’t you follow the procedure?
Why did you take the shortcut?
Didn’t you know better?
Why didn’t you stop work?
Those questions assume the answer before the investigation is complete. A better opening is: Walk me through the job as you understood it that day.
Then ask:
What normally happens when you perform this task?
What was different this time?
What information did you have?
What were you expecting to happen?
What problems were you trying to solve?
What made the action seem reasonable at the time?
The purpose is not to excuse unsafe conduct. It is to understand the conditions that influenced the decision. If you are not asking those questions, you may not be investigating. You may be confirming your own bias.
Context Drives Behavior
Employees do not perform work in a vacuum. Before concluding that someone simply chose not to follow a procedure, the investigation should examine the conditions surrounding the work.
Production and Schedule Pressure
Was an operations supervisor pushing the employee to restore equipment or resume operations?
Was a shipment waiting?
Was the work delaying startup?
Was the crew behind schedule?
Had leadership repeatedly emphasized production, cost, or completion time?
Were employees told to work safely while receiving a completely different message about how quickly the work needed to be completed?
Pressure does not always come through a direct order. Employees learn what the organization rewards, what supervisors tolerate, and which delays require uncomfortable explanations. If production pressure influenced the decision, retraining one employee will not correct the condition.
Personal note: Once upon a time I turned wrenches. The moment an operations leader stood over my shoulder, breathing down my neck and repeatedly asking “how much longer” I dropped my tools and work stopped until they left my immediate work area.
Fatigue and Workload
How many hours had the employee worked that day?
How many hours had the employee worked that week?
Was the employee early in the shift, several hours into it, or near the end of an extended shift?
Had the employee been called in unexpectedly?
Was the person working nights, rotating shifts, or significant overtime?
How many competing assignments was the employee managing?
Fatigue affects attention, memory, reaction time, judgment, and the ability to recognize changing conditions, and that’s before you throw in 30° or 100° temperatures, uncomfortable PPE, levels of hydration and other factors. A statement that the employee was qualified and trained does not address whether the person was physically and mentally capable of performing reliably under the conditions present that day.
Conditions in the Field
What was changing as the work occurred? Consider:
Weather.
Heat or cold.
Rain, ice, or wind.
Lighting.
Noise.
Congestion.
Simultaneous operations.
Nearby contractors.
Equipment status.
Unexpected process conditions.
Communication problems.
Changes in personnel.
Temporary hoses, wiring, scaffolding, or barriers.
A procedure written for normal conditions may not adequately address the conditions the employee encountered. The investigation should determine whether the work environment still matched the assumptions used when the task was planned.
Tools and Equipment
Did the employee have the correct tool? I always say there are 4 types of tools. The right tool for the job, the wrong tool for the job, broken tools, and missing tools. Broken or missing tools lead to the wrong tool being used for the task.
Was the required tool broken, missing, unavailable, or being used by another crew?
Was a substitute tool commonly used?
Did the employee improvise because the organization had not provided a practical alternative?
Had the equipment been modified since the procedure was written?
Were labels, indicators, guards, valves, or access points damaged or difficult to use?
“Used the wrong tool” is not a complete finding when the correct tool was unavailable and supervision knew employees regularly improvised.
Experience and Familiarity
How many times had the employee performed this exact task?
Had the employee worked on this specific equipment?
Was the task normally performed alone or with another qualified person?
Was the employee filling in for someone else?
Was the employee recently transferred, promoted, or assigned new responsibilities?
Did training include practical demonstration, or did the employee simply sign a roster after reviewing slides?
An employee may have years of experience while having limited experience with the exact task, equipment, process condition, or abnormal situation involved.
Personal Factors
Was the employee experiencing a distraction, emotional strain, lack of sleep, or another personal issue that may have affected performance?
Was it a holiday period with unusual staffing, workload, or personal demands?
These questions must be handled respectfully and confidentially. An investigation is not permission to pry into an employee’s private life. However, when an employee voluntarily identifies a relevant concern, the investigation should not ignore it simply because it does not fit neatly into a procedure compliance box.
Was the Work Properly Planned?
Before blaming an employee for deviating from the plan, determine whether the organization provided a workable plan. Ask:
Was there a pre-task Job Safety Analysis?
Did the JSA address this specific task and equipment?
Were the employees performing the work involved?
Was the JSA completed in the field or copied from a previous job?
Did the work permit identify the actual hazards?
Were required isolations verified?
Were changing conditions discussed?
Was a pre-job briefing conducted?
Did the employee understand when work was required to stop?
Was there a process for revising the plan when conditions changed?
A generic JSA that lists pinch points, proper PPE, and situational awareness does not demonstrate that the work was meaningfully planned.
A permit with every box checked does not prove that the crew understood the hazards.
The investigation should evaluate the quality of the planning process, not merely confirm that paperwork exists.
Who Wrote the Procedure?
This question is often overlooked.
Was the procedure developed with input from the people who perform the work?
Was it based on a Job Hazard Analysis?
Was the task observed in the field while documenting the steps required and the hazards associated with each step? If not, you’ve missed many operational learning moments to support the creation of your procedure. This is how one frequently overlooked hazard goes unidentified… ergonomic assessments are missed. No work observations mean no learnings for your procedure.
Was the procedure tested before it was issued?
Or was it written by someone in an office who believed they already understood how the job should be performed? There is often a difference between work as imagined and work as actually performed.
A procedure may look excellent from behind a desk while being difficult or impossible to follow in the field.
The investigation should determine whether the procedure was:
Current.
Available at the point of use.
Written clearly.
Accurate for the equipment.
Sequenced logically.
Practical under actual operating conditions.
Consistent with training and supervision.
Capable of addressing reasonably foreseeable problems.
Reviewed with the employees who use it.
If employees routinely deviate from the procedure and supervisors know about it, the organization does not have an isolated employee compliance problem, it has a management system problem.
Why Did the Action Make Sense at the Time?
After an incident, the correct action often appears obvious. That is hindsight.
The employee did not know the outcome when the decision was made. The investigator does.
A good investigation reconstructs what the employee saw, knew, expected, and believed before the incident occurred.
Perhaps:
The same shortcut had worked many times.
Other employees used the same method.
A supervisor had previously observed the practice without correcting it.
The procedure did not match the equipment.
The employee was trying to prevent a production interruption.
The required tool was unavailable.
Conditions changed after the job began.
The hazard was not visible or was poorly communicated.
The employee believed another protection layer was available.
If the decision made sense to this employee under those conditions, it may make sense to another employee in the future. Disciplining one person will not remove that possibility.
A Clean Employment History Does Not Disappear Overnight
How does an employee with years of acceptable performance suddenly become “the bad worker who does not follow procedures”? That conclusion should create more questions.
Did the employee suddenly stop caring about personal safety, coworkers, continued employment, and family? Or, did experienced people encounter a combination of conditions that exceeded the system’s ability to support reliable performance?
Past performance does not excuse an unsafe decision. It is still important evidence. If a normally dependable employee makes an unexpected mistake, the investigation should determine what changed in the work, equipment, supervision, workload, environment, or organization.
Labeling the employee as the problem is easier. Understanding what changed is more useful.
Accountability Still Matters
A Human and Organizational Performance approach does not mean that employees can ignore requirements without accountability. Intentional misconduct, reckless behavior, impairment, sabotage, and knowingly exposing others to serious danger requires an appropriate response.
The investigation still must establish the facts before assigning that label.
There is a difference between:
A deliberate violation for personal convenience.
An honest error.
A routine workaround accepted by supervision.
An adaptation to missing tools or inaccurate procedures.
A decision made under production pressure.
A deviation caused by an unexpected field condition.
A reasonable action based on incomplete or misleading information.
Treating every deviation as intentional noncompliance destroys that distinction and weakens the investigation.
“Retrain the Employee” Is Usually a Weak Corrective Action
Retraining may be appropriate when the employee did not understand a requirement. It is not a universal solution.
If the employee already knew the procedure, repeating the same training does not address why the procedure was not followed.
Effective corrective actions may require the organization to:
Repair or replace tools.
Improve equipment design.
Install engineering controls.
Correct staffing or fatigue concerns.
Reduce conflicting production pressures.
Improve planning and permitting.
Update an inaccurate procedure.
Involve employees in procedure development.
Strengthen supervision.
Address inconsistent enforcement.
Improve labeling or access.
Manage operational changes.
Verify corrective action effectiveness.
The corrective action should address the conditions that allowed the incident to occur, not simply the person closest to the event.
What a Better Finding Looks Like
A weak finding states: The employee failed to follow the established procedure and used an unapproved method.
A stronger finding might state:
The employee deviated from Step 7 of the procedure by using an alternate tool. The specified tool had been unavailable for approximately three weeks, and interviews established that alternate tools were routinely used to complete the task. The procedure did not identify an approved substitute or require work to stop when the specified tool was unavailable. The pre-task JSA did not address the substitution, and supervision had not corrected the established practice. Schedule pressure to return the equipment to service influenced the decision to continue.
The employee’s action is still documented. The difference is that the stronger finding explains the conditions that shaped the action and identifies where the organization can reduce the likelihood of recurrence.
When you dig deep enough, most of the time your investigation will result in a management systems error or deficiency. Human behavior is often a contributing factor, but the management system gap is the root cause. Do not confuse contributing factors with root causes!
The Real Test of an Investigation
Before closing an investigation, ask:
Do we understand why the action made sense at the time?
Did we examine the conditions surrounding the work?
Did we evaluate the quality of the procedure and work planning?
Did we identify which defenses were absent, failed, or were bypassed?
Would another employee likely make the same decision under similar conditions?
Will our corrective actions reduce risk if someone makes a similar mistake again?
If the report only tells management that an employee failed to follow a procedure, the investigation has probably stopped at the easiest answer.
“Employee did not follow procedure” may identify an action. It is not a root cause. It is where the investigation should begin.
Appalachian EHS & Process Safety Consulting supports industrial organizations with incident investigations, root cause analysis, corrective action development, Human and Organizational Performance reviews, procedure evaluation, Job Hazard Analysis, and management system improvement.
The objective is not to decide who failed.
The objective is to understand why the event made sense at the time and strengthen the system before it happens again.