ICAM Incident Investigation, Explained (and What to Capture on the Day)
ICAM, the Incident Cause Analysis Method, is a structured way of investigating an incident so that the findings point at what the organisation can change, not just at the person who was nearest when it happened. It grew out of the Australian mining industry in the late 1990s and is now used widely in mining, energy, construction and transport.
ICAM is built on James Reason's well-known "Swiss cheese" idea: serious incidents rarely have one cause. They happen when holes in several layers of protection line up at once. An ICAM investigation's job is to find each of those holes.
This post explains how the method works and, more practically, what has to be captured in the first hours, because no analysis method can recover evidence nobody collected.
The four levels
ICAM sorts what the investigation finds into four levels, working back from the event:
| Level | The question | Examples |
|---|---|---|
| Absent or failed defences | What should have stopped this, and didn't? | A guard missing, an isolation not proved, a proximity alarm switched off, a spotter not in place |
| Individual or team actions | What did people do, or not do, just before? | Stepped into the line of fire, skipped a check, misread a signal |
| Task or environmental conditions | What about the job or the place made those actions likely? | Time pressure, poor lighting, fatigue, unfamiliar equipment, a confusing layout |
| Organisational factors | What in the system created those conditions? | Training gaps, rostering, procedures that don't match the work, maintenance backlogs, how risk was managed and supervised |
The discipline is to keep going past the second level. Stopping at "the operator didn't follow the procedure" explains nothing about why, and fixes nothing for the next person.
PEEPO: what to gather
ICAM investigators commonly use PEEPO as a checklist for evidence:
- People: who was involved and who saw it, what they were doing, their training and experience, hours worked, statements
- Environment: weather, light, noise, ground, temperature, visibility, the layout of the area
- Equipment: what was in use, its condition, settings, maintenance records, any data it logged
- Procedures: what the procedure, permit or risk assessment said, and whether it matched what actually happens
- Organisation: supervision, rosters, communication, recent changes, how similar risks were managed before
It's a memory aid, not a form. Its value is that it stops an investigation fixating on the person and forgetting the machine, or the reverse.
What to capture on the day
The analysis can take weeks. The evidence has hours. Once the area is made safe and anyone hurt is cared for:
Before anything moves
- Photograph the scene as found: wide shots first, then mid-range, then close-ups, from more than one direction. Include anything that will be moved to make it safe.
- Note positions: of people, vehicles, equipment, controls, guards, tools, materials. A sketch with measurements helps.
- Record conditions now: weather, light, ground, noise. They will be different tomorrow.
- Secure the evidence: failed parts, tools, PPE, documents. Tag and keep them, and note who took them and when.
Data that disappears
- Logged data: vehicle and machine data, cameras, radio recordings, access logs. Some of it overwrites itself within days.
- The paperwork as it stood: the permit, the risk assessment, the pre-start check, the job briefing, the training records. Copy them before anyone "tidies them up".
People, while it's fresh
- Initial accounts from everyone involved and every witness, separately, in their own words, as soon as it's appropriate. Memories merge quickly when people talk to each other.
- Ask open questions: "Talk me through what you were doing" gets more than "Did you check the isolation?"
- Record who was there, including anyone who left before the investigation started.
Important
Make it safe and look after people first. Evidence never comes before rescue, first aid or preventing a second incident. Where an incident is notifiable, the regulator may also need the scene left undisturbed. Check what applies where you work.
From findings to actions
ICAM's output is a set of findings at each level and recommendations that address them. Good recommendations:
- Aim at the higher levels, especially failed defences and organisational factors, not just "retrain the operator"
- Follow the hierarchy of controls: eliminate or engineer before relying on procedures and PPE
- Have an owner and a date, and a check that they worked
A common weakness in investigation reports is a long, careful analysis that ends with three actions, all of them "remind staff".
Doing it on the day
The first hours after an incident are chaotic, and the investigator is often also the supervisor making the area safe. Notes go on the back of a permit, photos sit unlabeled on someone's phone, and the timeline is rebuilt days later from memory.
Speak while you walk, and the document writes itself. Walking the scene and saying what you see — "Haul road, bay three. Light vehicle stopped twenty meters past the berm gap, facing north. Whip flag snapped at the base, photo. Road wet, light rain since six." — gives you a timestamped, photographed record of the scene as found, while it's still as found.
Key Takeaway
The free incident investigation report covers the sequence of events, evidence log with chain of custody, contributing factors, root causes and corrective actions, and fills in on a phone. The incident report form is the first report, filed the same day. In the ReportWalk app both fill in as you speak. First walks free.
Related
- Incident investigation report: the free template
- Incident report form: the first report, same day
- Near-miss report: the incident that didn't happen
- Hazard reporting: why people don't report, and how to fix it
Frequently asked questions
What does ICAM stand for? Incident Cause Analysis Method. It's a structured approach to investigating incidents that traces causes back through four levels, from the failed defences to the organisational factors behind them.
What are the four levels of ICAM? Absent or failed defences, individual or team actions, task or environmental conditions, and organisational factors.
What is PEEPO in ICAM? A checklist for gathering evidence: People, Environment, Equipment, Procedures and Organisation. It helps make sure an investigation looks at every source of information, not just the people involved.
Is ICAM only used in mining? No. It started in the Australian mining industry but is used across mining, energy, construction, transport and other high-risk industries.
How is ICAM different from a root cause analysis? ICAM is one structured kind of root cause analysis. Its particular strength is pushing the investigation beyond individual actions to the conditions and organisational factors that made those actions likely.
What should be done first after an incident? Make the area safe and look after anyone hurt. Then preserve the scene as far as is safe and possible: photograph it as found, secure evidence and data that could be lost, and take initial accounts from those involved and witnesses separately.
