Incident Investigator

View saved version →

---
name: corrective-action-planning
description: Convert substantiated incident causes and control gaps into prioritized corrective and preventive actions with owners, due dates, and effectiveness measures.
---

# Corrective Action Planning

Develop actions that address supported causes rather than merely restating outcomes.

Map every action to a causal factor or control gap. Prefer elimination, substitution, engineered or system controls, and resilient process design over reminders, retraining, or discipline used alone. Include interim controls when durable changes take time.

For each action specify the intended risk reduction, accountable owner role, due date or dependency, resources, completion evidence, leading effectiveness measure, review date, and residual risk. Check whether the action could introduce new hazards, operational burden, or workarounds.

Distinguish correction, corrective action, preventive action, and broader improvement. Prioritize by risk reduction, urgency, feasibility, and dependency. Do not promise zero risk or claim effectiveness before verification. Output a cause-to-action matrix and call out causes with no adequate action or actions with no supported cause.

View saved version →

---
name: evidence-and-timeline
description: Organize incident evidence, build a source-linked chronology, identify contradictions and gaps, and plan proportionate evidence collection. Use when investigation material is incomplete, scattered, or disputed.
---

# Evidence and Timeline

Create an auditable evidence picture without overstating certainty.

Maintain an evidence register with item, source/custodian, time created or captured, relevance, authenticity or integrity concern, access status, and limitations. Preserve originals and provenance; recommend appropriate chain-of-custody handling when evidence may be altered or formally relied upon.

Build a chronology with event time, event or condition, source, confidence, and conflicts. Distinguish incident time from record-creation time and normalize time zones only when justified. Use ranges when precision is unavailable.

Classify statements as direct observation, reported information, interpretation, or inference. Corroboration increases confidence but does not automatically establish truth. Surface missing records, unexplained gaps, conflicts, and evidence that could disconfirm the leading account.

Prioritize collection by likely relevance, volatility, independence, and proportionality. Do not advise unauthorized access, covert surveillance, or alteration of source material. Output the evidence register, chronology, gap list, contradiction log, and next collection priorities.

View saved version →

---
name: fact-finding-interview
description: Develop and conduct neutral, adaptive fact-finding questions from incident information. Use for witness, involved-person, supervisor, or subject-matter-expert interviews and written information requests.
---

# Fact-Finding Interview

Turn the supplied incident information into an interview plan that closes material knowledge gaps without implying an answer.

## Method

1. Separate known facts, reported claims, assumptions, contradictions, and unknowns. Preserve source attribution.
2. Identify each interviewee's likely first-hand scope. Do not ask them to speculate outside it.
3. Start with an uninterrupted account: what they were doing, what they observed, and what happened next.
4. Follow the sequence before exploring conditions, decisions, changes, communications, barriers, and recovery.
5. Ask for observable detail: who, what, when, where, how, frequency, distance, settings, records, and exact actions. Ask "what led to that?" rather than "why did you fail?"
6. Test inconsistencies neutrally by presenting the conflicting information and inviting clarification.
7. Close by asking what records or people could corroborate the account, what could have prevented or reduced the outcome, and what else matters.

## Output

Organize questions by objective and interviewee. Mark essential questions, useful probes, and questions dependent on earlier answers. Include a short list of evidence to request.

Never invent testimony or treat an unanswered question as evidence. Avoid compound, leading, accusatory, or blame-seeking questions. Flag legal privilege, mandatory-reporting, representation, confidentiality, or trauma-sensitive considerations for the responsible human to handle under applicable policy and law.

View saved version →

---
name: investigation-quality-review
description: Review an incident investigation plan, analysis, or report for completeness, neutrality, evidentiary support, causal logic, and action quality. Use for a pre-issue challenge or gap assessment.
---

# Investigation Quality Review

Perform an independent challenge of the investigation product without rewriting unsupported conclusions.

Review scope and mandate, investigator independence or conflicts, preservation and coverage of evidence, interview breadth and neutrality, chronology, handling of contradictions, causal logic, consideration of failed barriers and systemic factors, proportionality of actions, and report traceability.

Look specifically for confirmation bias, hindsight bias, outcome bias, blame substitution, unsupported certainty, missing alternative explanations, selective evidence, circular causal claims, and recommendations disconnected from causes.

Classify issues as critical, material, or improvement. For each, cite the affected section or claim, explain the risk to reliability, and propose the smallest useful corrective step. End with open questions and a release recommendation: ready, ready with minor corrections, or not ready. A quality review is not approval by legal counsel, a regulator, or a qualified domain professional.

View saved version →

---
name: investigation-report
description: Draft a clear, evidence-linked incident investigation report from investigation findings. Use for formal findings, causal conclusions, corrective actions, executive summaries, and report-ready wording.
---

# Investigation Report

Produce a defensible report that lets a reader distinguish evidence from analysis and conclusions.

Adapt to the user's required template. Otherwise use: purpose and scope; incident overview; investigation team and method; evidence reviewed; factual chronology; findings; causal analysis; conclusions; corrective actions; limitations and unresolved matters; appendices.

Use neutral, precise language. Attribute contested claims, identify the applicable standard of proof when supplied, and state confidence or uncertainty where material. Link each material finding and causal conclusion to supporting evidence. Clearly distinguish:

- established facts;
- accounts or allegations;
- analysis and inference;
- conclusions;
- recommendations.

Exclude unnecessary personal or sensitive details and use identifiers consistently. Do not fabricate evidence, fill gaps silently, convert hypotheses into findings, or make legal conclusions unless the user supplies the governing framework and asks for that analysis. Flag privacy, privilege, regulatory-submission, and disclosure requirements for human review.

Before finalizing, check internal consistency among chronology, findings, causes, and actions; verify dates, roles, terminology, references, and unresolved contradictions.

View saved version →

---
name: root-cause-analysis
description: Perform evidence-grounded causal analysis from completed or emerging incident findings. Use to distinguish immediate causes, contributing conditions, failed or absent controls, and systemic root causes.
---

# Root Cause Analysis

Explain how and why the incident occurred with causal claims traceable to evidence.

First define the unwanted outcome and relevant boundary. Build the causal chain backward from the outcome, using a method suited to the evidence such as five-whys, causal-factor charting, barrier analysis, or change analysis. Use more than one lens when a single linear chain would hide interacting causes.

For every proposed cause, state:

- the evidence supporting it;
- the causal mechanism connecting it to the outcome;
- whether it was necessary, sufficient, contributing, or severity-influencing;
- plausible alternatives or disconfirming evidence;
- confidence and remaining gaps.

Separate event-level actions and conditions from latent organizational factors. Analyze control design, availability, implementation, use, monitoring, and recovery. Do not label a person's error as a root cause without explaining the conditions that made it possible or likely. Do not infer causation from chronology or policy deviation alone.

Conclude with a concise causal statement or map, contributing factors, failed or missing barriers, systemic causes, uncertainty, and evidence needed to raise confidence. If findings are insufficient, provide hypotheses and validation needs rather than a definitive root cause.