Accident Investigation

Brian Hughes

The importance of evidence collection

and preser- vation can be

overpowered by other

priorities.

Incident Investigation: Evidence Preservation

Looking back at your last incident investiga-tion, did you experience anything similiar orwere you faced with any of these dilemmas? •While attending to the needs of injured and dis-

tressed employees, time-sensitive evidence was missed.

• While securing the area and bringing it back to a safe mode, circumstances that could have served as evidence had to be altered.

•In the bustle to minimize costly downtime, resuming production rushed the evidence collec- tion process.

• A piece of critical evidence disappeared.

•The legal department wished it had more to demon- strate due diligence.

•A regulatory body's requirement or request could not be fulfilled.

In tlie rush to return to a state that resembles normalcy, the importance of evidence collection and preservation can be overlooked or over- powered by other priorities.

Evidence is critical to any incident investigation because it is the data that support the conclusions of the investigation. The primary intent of an inci- dent investigation is to identify effective solutions. To accomplish this, the investigation needs to uncover causes and how they relate to one another. Evidence provides support for what the team con- cludes to be causes, it cultivates a level of confi- dence that correlates directly to the quality of the evidence collected. Evidence is the foimdation for an investigation—for the investigation team as well as for others reviewing fuhue investigation results and conclusions.

Many companies do not have a formal evidence preservation policy in place, so the process is ad hoc—left up to the investigator or individuals on the team. Some highly regulated companies, with the nature of their governing regulations, specify requirements for evidence documentation. They tailor their evidence preservation policy to match the requirements of the regulatory agency. But evi- dence documentation is not necessarily the same as evidence collection or preservation. Regulatory requirements must be considered. However, a poli- cy can be developed that fulfills the objectives of the investigation and the requirements of regulato- ry agencies.

It is best to decide how to handle evidence before an emergency occurs. Develop an evidence preservation policy based on the organization's

needs and distribute it to everyone who will have the responsibility to carry it out. Include it in train- ing curriculum so pc\iple are familiar with the process before they actually need it.

What follows are guidelines that any company can use to develop a simple evidence preservation policy to help ensure that evidence is managed effectively throughout an investigation.

Step 1: Assess the Significance Ask a few simple questions to dtxument the

actual and potential significance of the problem. Try not to overreact to a rela- tively benign problem, but try to accommodate the require- ments of an incident that has major significance.

The following questions \\'iil help assess the signifi- cance of the problem.

1) Safety: Were fatalities and/or injuries involved?

2) Environmental impact: Did a major environmental release occur?

3) Revenue: What was the impact on revenue?

4) Costs: What additional expenses were incurred?

5) Erequency: How often has this type of prob- lem happened in the past?

6) Other: Different firms will have unique signifi- cance factors to capture, such as regulatory impact, supplier quality rating, employee confidence, drain on customer service department and public image. These should be identified and considered.

Determining risk adds a different, yet potentially important, piece of data to the significance assess- ment. Risk assessment needs to be balanced with its intended outcome. It can be a complex process involving probabilities and statistics that yield powerful predictions. Or, it can be a simple process of combining individual scores of probability multi- plied by consequence. The simple process is still highly subjective, but it is quick and understood easily.

However, complexity does not ensure that a model is actually predictive. Either way, remember- ing that any actual outcome exists within a range of possibilities is important. Simply considering the likelihood that the outcome could have been worse may be enough. For example, if it is reasonable to assume that someone could have been killed, usu- ally this is enough of an assessment to qualify the

Best Practices continued on page 56

www.asse.org OCTOBER 2009 PROFESSIONAL SAFETY 55

ices M contitmed J

i from page 55

investigation as being extremely impor- tant, upping the ante regarding the for- mality of evidence preservation.

Impact may also be related to the product or process involved. Will the evidence gathered present a risk to compromising the com- pany's intellectual property? Often, the company has an interest in maintaining confi- dentiality regarding an inci- dent and a thorough evidence preservation policy will sup- port this. Assessing the impact allows the investigator to gauge the appropriate ap- proach to preserving evidence. The more significant the eveiit, the more thorough the evidence presen, ation approach.

The legal department has the respon- sibility to protect the company against litigation, as well as to litigate on behalf of Üie company. The purpose of an inci- dent in\'estigation is to identify what happened to prevent recurrence. These two functions sometimes seem at odds. The legal department should not control the course of an investigation, but it should control how the information pro- duced by the investigation is managed. In addition, the department should be involved as soon as possible to ensure the evidence presen.'ation steps align with the responsibility to protect the company's integrity.

Step 2: Secure the Scene When possible, secure the scene of the

incident. This gives the investigation team the opportunity to document evi- dence and gather information before it is disturbed. This can be crucial to an accu- rate root-cause analysis later. Depending on the incident, you may be required to grant access to additional parties, such asOSHAorCSB.

Get the legal department involved right away to determine those who are authorized to access the area. Tape the area off and allow access only to author- ized personnel. Assign an area gatekeep- er who is responsible for keeping a log of those who enter the controlled area. This log should include the name, com- pany, time in and out, and purpose of entry. If these individuals remove evi- dence, document it thoroughly (see Step 3). Evidence removed may not be physi- cal—it may be pictures or notes. If neces- sary, identify a secure room in which to store the evidence.

Step 3: Document & Secure the Evidence

Evidence will come in many forms. Maintain confidentiality and secrecy when required. Ensure that evidence is released only to authorized individuals. A log sheet should be used and include the following items.

Evidence ID Number Assign a unique idenfification num-

ber that will be associated with a certain piece of evidence from that point forward.

Relative Timing What was happening relative to the

event? Even if the process seems benign at first, you need to know what was happening in the facility leading up to and following the event.

Procedures What procedures govern the activities

leading up to and following the event? Are these procedures accurate and up to date? Were they followed? Why or why not? it is important to understand the procedural controls and whether they

are effective.

When possible, secure the scene of the incident. This gives the investigation

team the opportunity to document evidence and gather information before

it is disturbed.

Date What time and date was the evidence

collected?

Location/Source Where was the evidence collected?

Physical Evidence Document physical evidence as accu-

rately as possible where the evidence was found. Depending on the signifi- cance of the event, creating a map of the affected area may be useful. Evidence locafion can then be documented rela- tive to the incident locafion.

Statements Statements should be taken fi^m wit-

nesses. Document each person's name and contact informafion, as well as his/her locafion relafive to the incident. This is an inifial interview, and you may need more informafion once the formal root-cause analysis is underway.

However, the interview should be conducted by someone familiar with the root-cause analysis process. This will help ensure that quesfions elicit causes as much as possible and minimize state- ments that are jaded by opinion, loyal- fies, etc. Ensure that proper protocol is followed. Hourly staff may require union representafion. Human resources and other departments may need to be involved. Protocols for interviewing employees may be nœded as well.

Computer Data Ensure that computer data leading up

to and following the incident are protect- ed. You may need to idenfify a system expert to help understand what informa- fion is available and how to interpret it. If possible, get the raw data as well as any screen prints or strip charts. Care- fuUy note the timing of data captures rel- afive to the incident.

Work Orders WTiat is the state of the

maintenance on the system? Are maintenance work orders open or up to date? When was the last time maintenance was performed on the equipment? Was it conducted according to specificafions? Were there any

changes in parts/materials sourcing? When is the next maintenance acfivity scheduled?

Equipment What is the state of the equipment? Is

it in good operafional shape? Is it being used in accordance with its intent? If not, why not? Include equipment data, such as asset numbers and otber rele- vant data.

Photos & Video Photos and video are extremely useful

forms of evidence. Automatic photos or video, such as from a security camera, need to be documented and secured. Take numerous photos—do not worry about using them all. Illustrate scale of objects photographed, even compared to something as simple as a hotel key card.

Samples Take product samples as soon as pos-

sible. This may be helpful later in deter- mining the exact state of the product at the fime of the incident.

Dateñlme Checked Out List the date and fime the item was

checked out.

Checked Out By List the person who checked out the

evidence. Include contact informafion. Ensure that only authorized individuals are able to check out evidence.

DateHime Checked In List the date and time the item was

checked back in.

Distribution List If any item has been copied and dis-

tributed, maintain a list of people to whom the item was distributed.

The recommended steps are not exhausfive. Individual companies will

56 PROFESSIONAL SAFETY OCTOBER 2009 www.asse.org

find themselves gathering different types of evidence based on what is perti- nent and available.

Regardless, an evidence log will be invaluable later if chain of custody needs to be proved, or if the root-cause analy- sis is reopened for further evaluation or assessment.

Step 4: Destruction of Evidence Sometimes it is necessary to destroy

e\ idence after an investigation is com- pleted. While some investigations will require the evidence to be held in perpe- tuity, most will not. Storing electronic files is easy and does not take up much space. However, storing physical parts and equipment may not be necessary. The legal department should advise regarding evidence maintenance.

Step S: Refine the Evidence Policy lÉ is safe to assume misktakes might

happen the first time. Conduct a post- investigation review to determine improvement opportunities. Refine the policy based on lessons learned, and dis- tribute to the organization.

Evidence preservation is crucial to any incident investigation. Approach evidence presen-ation according to the actual and potential significance of the problem. E)eveloping and becoming

5 Steps of Evidence Preservation These guidelines can help any company develop a simple evidence preserva- tion policy to ensure that evidence is managed effectively throughout an investigation.

1) Assess the significance. •How serious is the problem? More serious problems require more stringent

evidence management.

2) Secure the scene. •D(x:ument and control access.

3) Document and secure the evidence. •Catalog evidence and maintain chain of custody.

4) Destroy evidence? •Most evidence does not need to be kept forever. Work with legal staff to

develop a destn.iction schedule.

5) Refine evidence policy. •Learn from experience, roll lessons into policy, share with others.

familiar with a formal evidence preser- vation policy tailored to the organization will ensure that personnel have the data required to complete an accurate analy- sis—the only path to identifying true causes and pinpointing solutions that effectively reduce risk and prevent recurrence.

Brian Hughes is vice president of Apollo Associated Services. He has led incident inves- tigations related to major explosions, chemical releases, consumer product contamination, manufacturing defects and supply ctiain processes. For more information, visit umnv .apoUorca.com or contact him at bhughes ©apolhrca.com: (206) 331-2569.

PS oniLiniE Like a library at your fingertips

Professional Safety's online article archive gives you ready access to aU articles published in the journal since 2000. Search by keyword, including author name, or issue date to find articles covering topics ranging from program development, construction safety, fall protection and safety by design, to employee motivation, safety and organizational culture, and effective program management techniques. All just a few clicks away.

Access It TDday! www.asse.org/membersonly

Bowen EHS, I nc.

Professional Development for Health & Safety Experts since 2003

4-Day Workshops

CIH & ASP/CSP Columbia, SC

ASP/CSP - November 2-5

Cairo, Egypt ASP/CSP - November 16-19

San Diego, CA CIH-December 7-10

ASP/CSP - December 14-17

CIH BOOT CAMP

2 Days of Intense Study Newark, NJ - October 17-18 Houston, TX- November 7-8

Visit Our NEW Bookstore

SIGN UP FOR FREE STUDY QUESTONS

www.BowenEHS.com Visit www.asse.org/links to reach this advertiser

www.asse.org OCTOBER 2009 PROFESSIONAL SAFETY 57