Most incident investigation training in Malaysia focuses on method — how to structure interviews, how to build a timeline, how to apply 5W or fishbone analysis. Method matters, but it assumes something that often isn’t true in practice: that the evidence the method is meant to analyse is still there by the time the investigation starts.
What Actually Happens in the Days After an Incident
A common pattern in Malaysian operations: an incident is reported to a shift supervisor, who logs it for discussion at the next scheduled meeting rather than escalating it immediately. The person typically responsible for leading investigations — an HSE coordinator, safety officer, or equivalent — may be on leave, on another site, or otherwise unavailable. The investigation gets formally assigned days later, once that person is available.
In the interim, operations continue. A damaged structure or piece of equipment is repaired or removed because the area is needed back in service. Equipment involved in the incident continues to be used on subsequent shifts. The people who witnessed the event continue working, and their memory of exact positions, sequences, and timing — which was never a perfect recording to begin with — settles further into a simplified, more confident-sounding version of events.
Why a Delayed Investigation Can Look Thorough and Still Be Compromised
An investigation conducted four or more days after an incident can still follow every correct procedural step: interviews are conducted, the SOP is reviewed, findings are documented, a report is produced. The investigation can be thorough in method while being fundamentally compromised in input, because it’s reconstructing a scene that no longer exists, using physical evidence that’s been altered and memories that have already drifted.
This is a different failure mode from a poorly conducted investigation. The method can be sound. The evidence base it’s working from has simply degraded past the point where the method can compensate for it.
What Evidence Actually Decays, and How Fast
Different categories of evidence decay at different rates. Physical evidence — damage patterns, debris, the exact condition of a failed component — can be altered or removed within hours if the area needs to return to operation. Equipment-specific evidence, such as exact positioning or settings at the time of the incident, is typically lost as soon as the equipment is used again. Human memory, particularly around sequence and timing under stress, begins to reconstruct itself almost immediately, with witnesses unconsciously filling gaps with what seems plausible rather than what was directly observed.
For an incident like a structural or equipment failure — a racking collapse, a barrier failure, an equipment malfunction — relevant evidence can include load or weight records, inspection and maintenance logs, and physical condition at the point of failure, all of which need to be captured close to the event to be useful. Waiting days to begin doesn’t just slow the investigation down; it can permanently remove access to the evidence the investigation’s conclusions should have been based on.
Why “We Did a Thorough Investigation” Isn’t the Right Standard
Organisations frequently measure investigation quality by how comprehensive the resulting report looks — number of interviews conducted, length of findings, number of corrective actions generated. A late-started investigation can score well on all of these measures while having actually investigated a reconstructed approximation of the event, not the event itself.
The more useful question for any investigation isn’t whether it was thorough. It’s whether it started soon enough that the evidence it relied on still reflected what actually happened, rather than what people came to believe happened by the time anyone looked.
Building Timing Into Your Investigation Process
The structural fix is straightforward in principle and frequently missing in practice: a defined maximum time between an incident being reported and an investigation being assigned and started, regardless of who is on leave or unavailable. This typically means having more than one person authorised and trained to initiate an investigation, so the process doesn’t depend on a single individual’s availability.
It also means building a habit of immediate evidence preservation — photographs, securing the area, pausing equipment use where practical — as a standard first response to any reportable incident, independent of when the full investigation formally begins. This buys time for the formal investigation to start without losing the evidence that makes it meaningful.
The Question Worth Asking About Your Own Process
How long does an incident at your site typically wait between being reported and someone being assigned to investigate it? If the honest answer depends on who’s available that week, your investigation quality is currently determined as much by scheduling as by method — and the evidence that matters most is decaying every day in between.
Want an investigation process that captures evidence before it’s gone, not just a method for analysing what’s left? Cikgu Barrier’s Incident Investigation Basics program covers practical investigation timing, evidence preservation, and structured analysis (5W, 4P, Fishbone) for safety officers, supervisors, and HR teams across Malaysia.