An incident is when the data proves its value, and when it is most likely to be misread.
What to preserve immediately
Before automatic retention deletes it, which is a real risk with short retention periods.
Telematics for the equipment involved, for the shift.
Scan and task records for everyone in the area.
Environmental data for the zone: temperature, lighting, noise.
Proximity and detection events.
Video, where it exists, exported rather than left in a rolling buffer.
Rota and staffing for the shift.
Maintenance records for the equipment.
Preserve broadly and narrow later, because reconstructing after the buffer overwrites is impossible.
What it answers
Sequence and timing, precisely.
Who was where, which is the point at which individual data is legitimately used.
Equipment state: speed, load, fault codes.
Conditions: how busy, how dark, how cold.
What was happening upstream, which frequently explains the pressure.
What it does not answer
Why the person did what they did, which comes from asking them.
What the pressures were, which the data hints at and people explain.
What everyone else does routinely, which is usually the more important question — an incident is frequently the moment a routine practice went wrong rather than an aberration.
Whether the procedure was workable, which requires observing normal work.
The trap
The data will identify an individual action that immediately preceded the harm.
Stopping there produces a finding of human error, which is not a cause and prevents nothing.
Keep asking: why was that action reasonable at the time, what made the safe method slower, what else was happening, how often does this happen without harm.
The useful findings are conditions: layout, pace, equipment, staffing, lighting, training, procedure.
An investigation that ends at the individual has ended early, and the same incident will recur.
The purpose limitation problem
Investigation access opens the individual data.
Which creates the temptation to look at more than the incident, and it is the most common drift in this field.
Scope the retrieval technically to the incident window and the people involved.
Log the access, and review the log.
Do not retain the retrieved data beyond the investigation.
State this policy before the first incident, because deciding under investigation pressure produces the wrong answer.
Reading equipment data carefully
Impact severity is not injury severity. Machines record forces, not consequences.
Speed data has tolerance, and the recorded figure may not be precise enough for a conclusion.
Timestamps must be checked for clock agreement before building a sequence across systems, which is exactly where drift produces a confidently wrong narrative.
Equipment data shows what the machine did, which may differ from what the operator intended.
After
Record the conditions found, not only the sequence.
Check whether the same conditions exist elsewhere in the facility, which is where the preventive value is.
Feed near-miss data back: were there warnings at this location that nobody acted on.
Update the risk assessment, which in most jurisdictions is a requirement after a significant incident.
Report what changed, publicly, which is what sustains reporting of the next one.
Scoping the retrieval
The technical control that prevents investigation access becoming general access.
Define the window — the incident time plus a stated margin.
Define the people: those involved and those present.
Define the systems needed for the sequence.
Retrieve only that, through a mechanism that enforces the scope rather than relying on restraint.
Log the retrieval and review it afterwards.
Delete the retrieved set at the end of the investigation, retaining the findings rather than the raw data.
Checking whether the conditions exist elsewhere
The step that converts an investigation into prevention.
Take the conditions found — the sightline, the crossing point, the pace, the lighting.
Search the facility for the same combination.
Search other sites, if you have them.
Fix the matches before an incident occurs there, which is the entire preventive value of the investigation.
Record that you looked, including where nothing similar was found, which is evidence that the investigation was more than a report on one event.