Incident Investigation — SuperbaLearning

Learning objectives

Conduct a structured investigation, from securing the scene to formal closure.
Distinguish immediate, contributing and root causes of an event.
Apply the 5 Whys and Ishikawa methods for cause analysis.
Understand the Swiss Cheese model and the role of latent organisational causes.
Build effective corrective actions and genuinely verify their effectiveness over time.
Contribute to a reporting culture that genuinely feeds prevention.

Module 01

Why investigate: from event to prevention

Module objectiveDistinguish immediate response, reconstruction, causal-factor analysis and preventive action within the SMS process.

Every incident, near-miss or non-conformity is valuable information, often obtained at great cost. The value of an investigation lies not in assigning blame, but in turning the event into knowledge that prevents its recurrence.

For a company subject to the ISM Code this is not a matter of good practice: it is an obligation, and it sits in two sentences of §9.

«The SMS should include procedures ensuring that non-conformities, accidents and hazardous situations are reported to the Company, investigated and analysed, with the objective of improving safety and pollution prevention.» (§9.1)

«The Company should establish procedures for the implementation of corrective action, including measures intended to prevent recurrence.» (§9.2)ISM Code, Part A, §9 — Reports and analysis of non-conformities, accidents and hazardous occurrences

The three words in §9.1 — reported, investigated, analysed — describe three distinct activities, and a system that stops at the first does not satisfy the paragraph. §9.2 adds the part most often skipped: it is not enough for the corrective action to remedy the situation, it must prevent recurrence.

Investigation phases may overlap. Notify and preserve without delay; the EU two-month limit concerns commencement from the occurrence.

The fundamental steps

Immediate securing of the scene and prompt collection of evidence.
Reconstruction of the chronological sequence of events.
Identification of verified causal factors and systemic conditions.
Definition of corrective actions targeted at verified factors.
Verification of the actions' real effectiveness over time.
Sharing lessons learned with the rest of the fleet.

Key point

An investigation that stops at correcting the symptom (for example, replacing the failed component) without verifying causal factors and systemic conditions may leave the recurrence risk unresolved.

Key takeaways

ISM Code §9 connects reporting, investigation, analysis and corrective action with prevention of recurrence.
Making the situation safe comes first, but evidence preservation begins immediately.
A useful investigation produces verifiable decisions, not only an account of the occurrence.

Module 02

Who actually investigates: internal investigation and safety investigation

Module objectiveDistinguish the purpose, authority, duties and outputs of an internal investigation, marine safety investigation and judicial or administrative proceedings.

After a serious event one investigation does not start — at least two do, and they share neither legal basis nor purpose. Confusing them is the costliest mistake for shore staff: answering a flag-State investigator with the mindset of an internal audit, or treating a public report as if it were an indictment.

The three investigations that follow the same event, each on its own clock: the EU safety investigation follows the displayed deadlines; the other tracks follow the SMS, contract and national law.

Table 1 — Who actually investigates: internal investigation and safety investigation
	Internal investigation	Marine safety investigation	Judicial or administrative inquiry
Who conducts it	The company, under its own SMS	The safety investigation authority of the investigating State — normally the flag State	The prosecuting authorities of the competent State
Legal basis	ISM Code §9	Casualty Investigation Code, mandatory through SOLAS XI-1/6	National criminal or administrative law
Purpose	Improving the safety and pollution prevention of the SMS	Preventing future casualties and incidents	Establishing liability
Outcome	Internal corrective action, with measures to prevent recurrence	Public report with safety recommendations	Sanctions or damages
The company’s role	Conducts it	Cooperates with it: provides evidence, witnesses, documents	Is subject to it

Table 2.1 — The three investigations that may follow the same event.

The Casualty Investigation Code

The reference text is the Code of the International Standards and Recommended Practices for a Safety Investigation into a Marine Casualty or Marine Incident, adopted by resolution MSC.255(84) of 16 May 2008. It is not a recommendation: by MSC.257(84), Parts I and II were made mandatory through amendments to SOLAS chapter XI-1, and the Code took effect on 1 January 2010 with the entry into force of the amendments to regulation XI-1/6.

«Marine safety investigations do not seek to apportion blame or determine liability. Instead a marine safety investigation, as defined in this Code, is an investigation conducted with the objective of preventing marine casualties and marine incidents in the future.» (§1.1)

«A marine safety investigation should be separate from, and independent of, any other form of investigation. However, it is not the purpose of this Code to preclude any other form of investigation, including investigations for action in civil, criminal and administrative proceedings. Further, it is not the intent of the Code for a State or States conducting a marine safety investigation to refrain from fully reporting on the causal factors of a marine casualty or marine incident because blame or liability may be inferred from the findings.» (§1.2)Casualty Investigation Code, Part I, chapter 1 — Purpose

“Does not apportion blame” does not create universal privilege

Protection lies in separation of purpose and in the protections applicable law gives to specified safety-investigation records. The final report is public and is not written to determine blame or liability, but the Code does not guarantee automatic inadmissibility in every proceeding. Company interview records, emails and internal analyses do not acquire public-investigation protection merely because they concern the same occurrence.

The central obligation sits in chapter 6: a marine safety investigation shall be conducted into every very serious marine casualty. There is no discretion and no financial threshold. The flag State ensures the investigation is carried out, unless another substantially interested State takes on that responsibility by mutual agreement. For all other events the decision is discretionary.

Table 2 — The Casualty Investigation Code
Term	The Code’s definition
Marine casualty §2.9	An event, or sequence of events, that has resulted directly in connection with the operations of a ship in any of: the death of, or serious injury to, a person; the loss of a person from a ship; the loss, presumed loss or abandonment of a ship; material damage to a ship; the stranding or disabling of a ship or its involvement in a collision; material damage to marine infrastructure external to the ship that could seriously endanger safety; severe damage to the environment or the potential for it. It excludes deliberate acts or omissions intended to cause harm.
Very serious marine casualty §2.22	A marine casualty involving the total loss of the ship, a death or severe damage to the environment. It is a category subject to the CIC investigation duty; check the applicable regime and specific EU provisions.
Marine incident §2.10	An event other than a marine casualty, occurring directly in connection with the operations of a ship, that endangered — or, if not corrected, would endanger — the safety of the ship, its occupants, any other person or the environment.
Serious injury §2.18	An injury resulting in incapacitation where the person is unable to function normally for more than 72 hours, commencing within seven days from the date the injury was suffered.
Severe damage to the environment §2.19	Damage to the environment which, as evaluated by the affected State(s) or the flag State, produces a major deleterious effect upon the environment.
Causal factor §2.2	Actions, omissions, events or conditions without which the casualty would not have occurred, or the adverse consequences would probably not have occurred or been as serious.
Substantially interested State §2.20	The flag State; the coastal State; a State whose environment was severely or significantly damaged; a State whose interests or installations were seriously harmed or threatened; a State whose nationals died or were seriously injured; a State holding information considered useful; or one with another interest considered significant.

Table 2.2 — The definitions in chapter 2 of the Casualty Investigation Code.

The Code does not say «root cause»: it says «causal factor»

The immediate / contributing / root triad of Module 4 is method vocabulary — useful and widespread — but it is not the Code’s vocabulary. §2.2 defines a single category, the causal factor, with a counterfactual test: causal is whatever, absent it, would have prevented the event or made its consequences less serious. The difference is practical: the Code’s test does not ask how «deep» a cause is, it asks whether removing it would still have left the event to happen. In a report destined for an authority, use its words.

The European level

The table distinguishes the current framework from amendments introduced by Directive (EU) 2024/3017. Those amendments must be transposed by Member States by 27 June 2027 and become operational under applicable national law. Before handling an actual event, check the rules of the flag State, coastal State and competent safety investigation authority.

Table 3 — Current EU framework and amendments awaiting transposition
Status	Duty	Content
Current framework	Independence and commencement	The safety investigation remains independent from parallel proceedings and starts without delay and no later than two months after the occurrence.
Current framework	Report and records	Every effort to publish within twelve months; under the pre-transposition text, an interim report within that period if the final is not ready. Protection of specified records under applicable law.
After national transposition by 27 June 2027	Fishing vessels under 15 m	For a very serious marine casualty the authority carries out a preliminary assessment within two months and decides whether to investigate: a full investigation is not automatic.
After national transposition by 27 June 2027	Shore or port workers	Inclusion depends on a direct connection with ship operations, assessed by reference to structure, equipment, procedures, crew and ship management.
After national transposition by 27 June 2027	Method and reporting	Regulation (EU) No 1286/2011 is repealed from 27 June 2027. The transposed text refers to updated IMO A.1075(28) Guidelines; amended Article 14 limits the twelve-month interim duty to very serious casualties. Authorities populate EMCIP, with the special rule for fishing vessels under 15 m.

Table 2.3 — Current rules are separated from amendments dependent on national transposition.

What changes when Directive (EU) 2024/3017 is transposed

For a very serious marine casualty involving a fishing vessel under 15 metres, the authority will carry out a preliminary assessment without delay and no later than two months and decide whether to investigate; reasons for not proceeding must be recorded and notified. For events involving shore or port workers while the ship is alongside, moored or in dock, the direct connection with ship operations must be assessed. Full inclusion is not automatic in either case.

Key takeaways

The three tracks may run in parallel and have different purposes, powers and evidential regimes.
The CIC requires a safety investigation for every very serious marine casualty, subject to the arrangements between States allowed by the Code.
EU amendments of 2024 need transposition by 27 June 2027: investigation is not automatic for small fishing vessels or port workers.

Module 03

Beyond human error: the Swiss Cheese model

Module objectiveUse Swiss Cheese and HFACS to explore defences, latent conditions, supervision and operational acts without stopping at the label “human error”.

Attributing an incident solely to «operator error» is the most common and least useful shortcut: almost always human error is the final symptom of a chain of organisational conditions that made it likely, not the isolated cause of the event. It is the insight James Reason made famous with the Swiss Cheese model in Human Error (1990): an organisation's defences are not solid barriers but slices full of holes, and an event gets through when the holes line up.

Swiss Cheese and HFACS are analytical models, not mandatory IMO classifications: they generate hypotheses to verify against evidence.

Table 4 — Beyond human error: the Swiss Cheese model
Level	Example of a gap
Organisational influences	Commercial pressure that implicitly discourages strict compliance with procedures
Inadequate supervision	A superior who does not genuinely verify the application of critical procedures
Preconditions for unsafe acts	Fatigue, inadequate communication, insufficient training
Unsafe acts	The error or violation of procedure committed by the operator at that moment

Table 3.1 — The four levels of HFACS, the taxonomy built on Reason's model.

Reason supplies the metaphor, HFACS supplies the taxonomy

The four levels in the table are not James Reason's. They are the four levels of the Human Factors Analysis and Classification System (HFACS), developed in 2000 by Scott Shappell and Douglas Wiegmann for US military aviation and since adopted in many other sectors, shipping included. HFACS translates Reason's ideas into an applicable framework, breaking the four levels into nineteen causal categories with which to code an event. Reason's model, in its original form, speaks instead of latent conditions, active failures and defences in depth: it is the metaphor that explains why defences fail together, not the list of boxes to fill in. The distinction matters in an investigation report: cite Reason for the reasoning, HFACS for the classification.

Investigation Focus — the right question is not «who made the mistake»

The question that guides an effective investigation is not «who made the mistake», but «why, for a competent person acting in good faith, did the error become likely under those conditions». This shift in perspective is what distinguishes an investigation that prevents future events from one that merely closes a case.

Barriers may be absent, degraded, bypassed or ineffective in the actual scenario. The timeline and evidence must confirm the causal links suggested by the model.

Key takeaways

Operator action is often the last observable step in a wider chain.
Barriers may be absent, degraded, bypassed or ineffective in the actual scenario.
Models generate hypotheses; timelines and evidence must confirm causal factors.

Module 04

Causal factors and systemic conditions

Module objectiveClassify proximate events, contributing factors, causal factors and systemic conditions without presuming one root cause.

An analytical classification separates what immediately preceded the outcome, what contributed and which systemic conditions may be relevant. It does not presume one cause or guarantee that one correction will prevent every recurrence.

Table 5 — Causal factors and systemic conditions
Analytical level	Practical use	Required verification
Proximate event/condition	Describes what immediately preceded the outcome	Timeline, data, traces and witness evidence
Contributing factor	Explains what increased likelihood or severity	Evidence of its connection with the event
Causal factor	Meets the CIC counterfactual test: without it, the occurrence or consequences would not have happened in the same way	Converging evidence and alternative explanations considered
Systemic condition	Organisational or technical weakness that may explain several factors and guide prevention	Procedures, barriers, resources and work as done

Table 4.1 — Analytical levels requiring converging evidence.

Labels do not replace proof

“Immediate”, “contributing” and “underlying/root” may be used as methodological labels, but they do not replace the Casualty Investigation Code test or imply that one definitive cause always exists. A preventive measure reduces likelihood or consequence; it rarely guarantees non-recurrence by itself.

Key takeaways

The CIC uses a counterfactual test for causal factors.
Several factors may contribute to the same occurrence and its consequences.
A preventive measure reduces likelihood or consequence; it rarely guarantees non-recurrence by itself.

Module 05

The 5 Whys method

Module objectiveApply 5 Whys as a proportionate technique for developing and testing a possible causal chain.

The «5 Whys» technique is the simplest and most widespread cause-analysis method: it develops a possible causal chain through repeated «why» questions towards conditions the organisation can address; every step must be verified.

Illustrative example of «5 Whys» analysis: the chain generates hypotheses to verify; it does not itself prove causation.

How to apply it correctly

Describe the event specifically and factually, avoiding generalisations.
Ask «why did this happen» and answer with a verifiable fact, not a hypothesis.
Repeat the question on the answer and test each step against evidence and alternative explanations.
Stop when a verifiable systemic condition emerges, without treating it as automatic proof of causation.

Investigation Focus — the 5 Whys are not always exactly five

The name of the method is indicative, not prescriptive: a useful condition may emerge after three steps or seven. The stopping criterion is the verifiable quality of the answer, not the count; the chain does not prove causation by itself.

Key takeaways

The number of “whys” in the method is indicative, not prescriptive.
Each answer must rest on verifiable facts, not assumptions or personal judgement.
The output is a condition to test against other evidence, not automatic proof of causation.

Module 06

The Ishikawa diagram

Module objectiveBuild a cause-and-effect diagram covering people, procedures, equipment and organisation, then convert each branch into a testable hypothesis.

The cause-and-effect diagram, or fishbone diagram (Ishikawa), visually organises the possible causes of an event, grouping them into categories, to facilitate structured group brainstorming before delving into the most promising causes.

Cause-and-effect diagram (Ishikawa) with the four typical maritime categories and some sub-causes to explore.

Typical categories in the maritime context

Table 6 — Typical categories in the maritime context
Category	Examples of causes to explore
People	Competence, fatigue, communication, experience
Procedures	Clarity, currency, suitability to actual context
Equipment	Maintenance condition, design, spare parts availability
Organisation	Safety culture, operational pressure, supervision

Table 6.1 — Typical categories of an Ishikawa diagram in the maritime context.

Investigation Focus — Ishikawa is a starting point, not an endpoint

The diagram helps avoid overlooking entire categories of potential causes, but does not replace subsequent deeper analysis: every branch identified must be verified with concrete evidence, not left as a mere untested hypothesis.

Key takeaways

Ishikawa broadens the search and reduces the risk of omitting whole categories.
Brainstorming and causation are not the same thing.
Each branch must be confirmed, rejected or qualified using evidence.

Module 07

Advanced methods: TRIPOD Beta and Fault Tree

Module objectiveSelect TRIPOD Beta, Fault Tree or Event Tree according to the investigative question, complexity and available competence.

For complex events, with multiple concurrent causes and deep organisational factors, there are methods more structured than the 5 Whys and Ishikawa, generally reserved for serious incidents or investigations conducted by specifically trained personnel.

Table 7 — Advanced methods: TRIPOD Beta and Fault Tree
Method	Principle	When it is used
TRIPOD Beta	Analyses latent organisational causes and missed or failed safety barriers	Complex events with multiple organisational factors at play
Fault Tree Analysis	Combinatorial logic linking component failures to an undesired event	Complex technical systems with multiple concurrent failure modes
Event Tree Analysis	Analyses possible consequences starting from an initiating event	Risk assessment and emergency planning

Table 7.1 — Advanced cause-analysis methods, beyond the 5 Whys and Ishikawa.

Where they come from, and a distinction that often gets lost

TRIPOD Beta originated in Shell-commissioned research between the universities of Leiden and Manchester — the same James Reason, Willem Wagenaar and Patrick Hudson of the latent-cause tradition — and is today maintained and certified by the Energy Institute: it is not a public-domain methodology, it has a body that publishes the standard and accredits practitioners. As for the other two: Fault Tree and Event Tree are not on the same footing as the first two. Fault Tree reasons backwards from an undesired event towards the combinations of failures that can produce it, and so can also be used after an event; Event Tree reasons forwards from an initiating event towards possible consequences, and is a tool for risk assessment and emergency planning — not a method for investigating an event that has already happened.

Investigation Focus — the choice of method depends on the severity and complexity of the event

Not every near-miss requires a full TRIPOD Beta: a simple method like the 5 Whys is often sufficient and faster for minor events. Reserving more complex methods for events that genuinely require them avoids over-bureaucratising the investigation process, with the risk of discouraging reporting.

Key takeaways

TRIPOD Beta examines barriers and organisational conditions and is a proprietary method governed by the Energy Institute.
Fault Tree works backward from an event to combinations of failure; Event Tree explores forward consequences from an initiating event.
Method complexity should be proportionate to risk and analytical value.

Module 08

The first hours: notify, preserve, save the data

Module objectiveActivate notification, evidence preservation and data-saving through the correct channels, distinguishing company duties from authority reporting.

After the analytical methods, return to the first hours: notifying through the competent channel and promptly preserving evidence make reconstruction possible. Legal notification or commencement deadlines and technical overwrite windows serve different purposes and must not be confused.

Notify through the correct channel

Table 8 — Actors, channels and timing
Recipient/channel	Actor	Time and limitation
Company/DPA	Ship and roles identified in the SMS	Without delay under the SMS, flag and applicable coastal-State law
Competent safety investigation authority	Responsible authorities and/or parties involved, as determined by national law	Without delay under EU Article 6; verify the national channel
Flag State and other public authorities	Company/ship under SOLAS, flag, coastal-State and national rules	There is no single global window; apply the relevant procedures
GISIS — Marine Casualties and Incidents	Investigating/reporting State	Basic factual data as soon as possible; report required for very serious casualties under the CIC and circular
EMCIP	Member State, safety investigation authority or other designated national authority	Under the Directive and national method; it is not a direct company upload
Class, P&I, insurers, charterers	Company under contract/policy	Under contractual deadlines, without presenting them as IMO duties

Table 8.1 — The company reports under the SMS and applicable law; States and authorities populate GISIS and EMCIP.

Notification and commencement are different

The EU two-month maximum concerns commencement of the safety investigation and runs from the occurrence, not notification. Notification enables the authority to react and request preservation, but it does not move the legal starting date.

Preserve

Preserving evidence is not discretionary. Article 13 of the Directive requires Member States to adopt measures ensuring that the parties concerned make every effort to:

«(a) save all information from charts, logbooks, electronic and magnetic recordings and video tapes, including information from VDRs or S-VDRs and other electronic devices relating to the period preceding, during and after an accident;
(b) prevent the overwriting or other alteration of such information;
(c) prevent interference with any other equipment which might reasonably be considered pertinent to the safety investigation of the accident;
(d) collect and preserve all evidence expeditiously for the purposes of the safety investigations.»Directive 2009/18/EC, article 13, as amended by Directive (EU) 2024/3017

VDR data

Preserve immediately: VDR windows are not permission to wait. For VDRs subject to MSC.333(90), all data items remain available for at least 48 hours on fixed and float-free media and for at least 30 days on the long-term medium before overwrite. If shipboard power fails, the dedicated reserve source maintains bridge audio only for two hours, after which all recording stops automatically. After termination, the fixed medium preserves recorded data for at least two years and the float-free medium for at least six months.

Three distinct VDR periods: overwrite window, two hours of bridge audio after power loss, and physical retention after recording terminates.

VDR minimum capacity and retention: overwrite, power-loss reserve and post-termination retention are different periods.

Table 9 — The three VDR windows
Window	MSC.333(90)	Operational meaning
Continuous recording before overwrite	48 hours on fixed and float-free; 30 days on long-term medium	Minimum capability, not time allowed to decide
Loss of shipboard power	Two hours of bridge audio only on the dedicated reserve, then automatic stop	Other data items do not continue for two hours
After recording terminates	Fixed at least two years; float-free at least six months	Physical retention is distinct from the overwrite window
Legacy VDR, where applicable	12-hour minimum window under the earlier standard	Check the actual standard, equipment and manual

Table 8.2 — Durations depend on the applicable standard and do not replace freeze, save and extraction.

Freeze, save and extraction remain immediate

Access and saving depend on the equipment, condition of the ship, power source and manufacturer instructions. Preserve and extract as soon as possible under the SMS, authority instructions and VDR manual; the long-term medium is an easily accessible internal medium, not normatively defined as the one that “goes down with the ship”.

VDR data falls within CIC §2.15 marine safety records: protection depends on the investigative use and applicable law, not simply pressing save. New EU VDR/S-VDR provisions must be read within national transposition and Article 9 conditions; they do not authorise unrestricted reuse or disclosure.

Investigation Focus — the first hour is worth more than the report’s last chapter

Almost every decision that determines the quality of an investigation is taken before the investigation begins: saving the data, photographing the state of components before they are put back in service, noting who was present, keeping witnesses apart. No methodological refinement in the modules that follow recovers evidence that was not preserved.

Key takeaways

The company follows the SMS, flag, coastal-State and national law; GISIS and EMCIP are populated by competent authorities.
The EU two-month limit concerns commencement of the investigation, not notification, and permits no delay.
VDR windows are minimum capabilities: freeze, save and extraction should begin as soon as possible.

Module 09

Evidence collection and conducting interviews

Module objectiveCollect physical, documentary and witness evidence while preserving integrity, provenance and the rights of those involved.

The quality of an investigation depends largely on the quality of the evidence collected in the first hours after the event, before witnesses' memories fade or become contaminated with later reconstructions.

Sources of evidence

Physical evidence: condition of components, marks, position of objects at the time of the event.
Documentary evidence: deck logs, PMS records, communications, sensor and VDR data.
Testimonies: collected separately, as soon as possible, avoiding witnesses agreeing on a common version before being interviewed.

Conducting interviews

Interviews should be conducted in a just culture climate: the goal is to reconstruct the facts, not assign blame. A witness who fears repercussions tends to protect themselves or colleagues, distorting the reconstruction. Open, non-judgemental questions («what did you see», not «why didn't you...») produce more reliable testimony.

The rights framework, which comes before the technique

A just culture climate is the company’s choice. The rights of a seafarer interviewed in a safety investigation are not. Chapter 12 of the Casualty Investigation Code provides that a person giving evidence be informed of the nature and basis of the investigation, have access to legal advice concerning the risk of self-incrimination, be informed of the right to remain silent and of the protections available, and that evidence be taken at the earliest practical opportunity so as not to delay repatriation.

The Guidelines on the fair treatment of seafarers in the event of a maritime accident — promoted by resolution A.987(24) in 2005 and adopted by the Legal Committee as LEG.3(91) on 27 April 2006 and approved by the ILO that June — complete the picture, and Article 18 of Directive 2009/18/EC requires Member States to take them into account. On confidentiality, Article 9 prohibits making available, for purposes other than the investigation, the witness evidence and statements taken, the records revealing who gave them, and particularly sensitive information about the persons involved, absent an overriding public interest determined by the competent authority.

A company interview does not automatically receive the same protections

Article 9 protections concern specified safety-investigation records under applicable law. An internal record may be obtained in other proceedings: the company should not promise anonymity, confidentiality or privilege it cannot guarantee, and should coordinate preservation, representation and disclosure under applicable law without obstructing the safety investigation authority.

Investigation Focus — separate facts from opinions

During evidence collection, it is essential to distinguish what a witness directly saw from what they believe happened. Opinions are useful for generating hypotheses, but only verifiable facts can support the investigation's conclusions.

For each item of evidence record its provenance, collection time, custodian and transfers; preserve originals and distinguish observed facts, inferences and opinions.

Key takeaways

Observed facts, inferences and opinions must remain distinguishable.
Authority interviews and company interviews do not receive the same protection.
No one should promise anonymity, confidentiality or privilege beyond applicable law.

Module 10

Effective corrective actions

Module objectiveDesign actions linked to verified factors, with an owner, deadline, residual-risk assessment and effectiveness criterion.

A well-designed corrective action addresses verified factors and relevant systemic conditions, is realistically achievable, has a clear owner and a defined deadline, and is verifiable in its effectiveness over time.

Hierarchy of controls

Table 10 — Hierarchy of controls
Type of control	Relative effectiveness and example
Elimination	Maximum effectiveness: completely removes the hazard (e.g. eliminating an unnecessary hazardous component)
Substitution	High effectiveness: replaces the hazard with a less risky one
Engineering controls	Good effectiveness: modifies the design or equipment to reduce risk (e.g. safety interlock)
Administrative controls	Moderate effectiveness: procedures, training, signage
Personal protective equipment	Minimal effectiveness as the sole measure: last line of defence, does not replace the preceding measures

Table 10.1 — Hierarchy of controls, from most to least effective.

The hierarchy of controls is an established way to prefer elimination, substitution and engineering measures over training or PPE alone. ISO 45001 §8.1.2 formalises it for OH&S management systems, but it is not textually incorporated into the ISM Code and does not by itself determine whether every maritime safeguard is adequate. Within an SMS it is a robustness test used together with feasibility, residual risk, operational interactions and applicable technical duties.

Investigation Focus — be wary of «training-only» corrective actions

A corrective action that consists solely of «reinforcing training» or «reminding the crew of the procedure» is often the weakest in the hierarchy of controls. It is not wrong in itself, but should be accompanied, where possible, by more solid engineering or administrative controls, not used as the sole response.

Before implementing a measure, assess residual risk and interactions with other operations: the intended improvement should not introduce unassessed new risks. Define at this stage how effectiveness will be verified.

Key takeaways

Training and reminders alone are often weak controls.
The hierarchy of controls is a robustness test, not an automatic ISM rule for every casualty.
Each action should address a demonstrated factor without creating new operational risks.

Module 11

Verifying the real effectiveness of actions

Module objectiveDefine indicators, time horizon and responsibility for verifying whether actions reduced the intended risk.

A formally closed corrective action is not the same as an effective one: verifying effectiveness over time is the step most often neglected in the entire investigation process.

Illustrative tracking: effectiveness is checked against a predefined criterion and a time window proportionate to risk.

How to verify effectiveness

Before closure, define an observable indicator, verification owner and time window proportionate to risk; six months may be an example, not a universal period.
Schedule a follow-up check after some time has passed, not just at the point of immediate closure.
If the event recurs despite the corrective action, reopen the investigation rather than treating it as a new isolated case.

Investigation Focus — closing quickly is not the same as closing well

Pressure to quickly close a non-conformity case, for reporting or upcoming audit reasons, is one of the factors that most compromises the real quality of corrective actions. A mature organisation measures the quality of closure, not just its speed.

Implemented, closed and effective are different states: carrying out a measure, closing its record and demonstrating effectiveness are not equivalent. Assign a verification owner; recurrence or no improvement requires review of factors, actions and initial assumptions.

Key takeaways

Implemented, closed and effective are different states.
The effectiveness criterion should be set before closure and proportionate to risk.
Recurrence or no improvement requires review of factors, actions and initial assumptions.

Module 12

Sharing lessons learned

Module objectiveConvert investigation findings into timely, non-blaming and verifiable fleet learning.

An investigation that produces knowledge useful only to the ship involved wastes most of its potential value: systematically sharing lessons learned with the rest of the fleet is what turns a single event into company-wide prevention.

How to build effective sharing

Clear, non-judgemental summaries, focused on verified factors, barriers and corrective actions, not on the names of the people involved.
Timely distribution, not quarterly: lessons learned lose value if communicated months late.
Practical, visual format (safety bulletins, brief case studies), not just a long, little-read technical report.
Verification that the lesson has genuinely been absorbed, not just distributed (for example through a brief reminder at safety meetings).

Investigation Focus — honest sharing requires mutual trust

A crew that fears being publicly exposed or ridiculed in a safety bulletin will tend to hide their mistakes rather than report them. The most effective companies communicate lessons learned in a way that strengthens trust in the system, not erodes it.

Anonymisation should not remove the necessary operational context: the brief connects the occurrence, factors, barriers and actions without unnecessarily exposing individuals. Check understanding and onboard application, not merely receipt of the bulletin.

Key takeaways

Anonymisation should not remove the operational context needed to understand the lesson.
A short brief should connect the occurrence, factors, barriers and actions.
Distribution is not learning: understanding and application must be checked.

Module 13

Building a reporting culture

Module objectiveAssess the channels, feedback and accountability that make occurrence and near-miss reporting credible.

The success of any investigation system depends, upstream, on people's willingness to report minor events and near-misses before they escalate into serious events.

The reporting pyramid as a picture of visibility: the shape holds, Heinrich's and Bird's ratios do not.

The pyramid's numbers are contested — its logic is not

The ratios usually quoted go back to Herbert Heinrich (1931) and Frank Bird (1969), and were derived from industrial samples of their day, using classification criteria that cannot be reconstructed today. Later research does not confirm that the frequency of minor events reliably predicts the probability of a serious one: the causes of a trivial injury and those of a disaster are often of a different nature, and reducing the former does not automatically reduce the latter. What holds about the pyramid is not the ratio but the shape: the base is always far wider than the organisation can see, and whatever does not reach the top of the reporting system does not exist for those who must decide. Using the pyramid as a picture of visibility is sound; using it to estimate how many near-misses «equal» a serious accident is not.

The pillars of a just culture

Table 11 — The pillars of a just culture
Pillar	Practical meaning
Non-punishment for good-faith errors	Whoever reports their own honest mistake does not suffer retaliation
Proportionate accountability	Good-faith errors and reporting do not trigger retaliation; intentional, reckless or grossly negligent conduct is assessed through a separate, consistent process under applicable law
Visible feedback	Whoever reports sees that something changes, not a form that disappears into a void
Simplicity of the reporting channel	Easy to use, with anonymous reporting where available and legally permitted; do not promise protection the system cannot guarantee

Table 13.1 — The pillars of an effective reporting culture (just culture).

Investigation Focus — interpret the count, do not reward it alone

A low number of reports is not, by itself, evidence of good performance. Interpret it alongside exposure, activity, report quality, feedback, trust in the system and other indicators.

Key takeaways

The pyramid is a visibility model, not a predictive model with universal numerical ratios.
Just culture combines protection from retaliation with proportionate accountability through separate processes.
Report counts should be interpreted alongside quality, exposure, activity and trust in the system.

Module 14

Emerging trends in investigation

Module objectiveAssess the impact of longer VDR windows, the amended EU regime, aggregate data and fair-treatment developments without anticipating their legal effect.

More data, with different windows. VDRs subject to MSC.333(90) retain all data items for at least 48 hours on fixed and float-free media and for at least 30 days on the long-term medium before overwrite. If shipboard power fails, the dedicated reserve records bridge audio only for two hours. Freeze, save and extraction remain immediate.

A new EU regime through national transposition. Member States must transpose Directive (EU) 2024/3017 by 27 June 2027. Very serious casualties involving fishing vessels under 15 metres require a preliminary assessment, not automatically a full investigation; events involving shore or port workers require an assessment of their direct connection with ship operations. Regulation (EU) No 1286/2011 is repealed with effect from the same date and the Directive refers to the updated IMO A.1075(28) Guidelines.

Authority-operated public reporting. GISIS and EMCIP support aggregate analysis, but they are populated by States and designated authorities: they do not replace company reporting and do not authorise unrestricted reuse of safety-investigation records.

Fair treatment is evolving. The 2025 IMO/ILO Guidelines on seafarers detained in connection with alleged crimes complement the 2006 framework in detention cases; they remain distinct from safety-investigation interview and confidentiality rules.

Data helps but does not replace investigative judgement

More data broadens reconstruction, but converging evidence, alternative explanations and professional judgement remain necessary.

Key takeaways

More data supports reconstruction but does not replace investigative judgement.
EU amendments become operational through national transposition by 27 June 2027.
The 2025 detained-seafarer guidelines complement, but do not automatically replace, the 2006 maritime-accident framework.

Recurring mistakes

From the Mistake Library of SuperbaKnowledge, filtered to the subjects this course covers. This view selects and organises content published in SuperbaKnowledge; it does not modify or replace it. The linked Knowledge page remains the reference version, while official texts remain authoritative.

Recurring mistakes published in SuperbaKnowledge
Topic	Mistake	Typical consequence	Topic sheet
Corrective and Preventive Action (CAPA)	Corrective action addressing the symptom, not the verified factor	The event or non-conformity may recur	See the topic sheet
Near Miss	Punitive culture towards those who report	The reporting rate collapses and useful information is lost	See the topic sheet

Glossary of terms

Table 12 — Glossary of terms
Term	Definition
CAPA	Corrective and Preventive Action
Contributing cause	A factor that makes the immediate cause of an event more likely
Immediate cause	The action or condition directly linked to the event
Root cause	A methodological term for a systemic condition to verify; it presumes neither a single cause nor equivalence to a CIC causal factor
CIC — Casualty Investigation Code	IMO Code for marine safety investigations into casualties and incidents, Res. MSC.255(84)
Causal factor	An action, omission, event or condition without which the event or its consequences would not have occurred (CIC §2.2)
EMCIP	European Marine Casualty Information Platform — the EU marine casualty database
GISIS	Global Integrated Shipping Information System — the IMO information system, including the MCI module for casualties and incidents
HFACS	Human Factors Analysis and Classification System — four-level taxonomy built on Reason's model
Ishikawa	Fishbone cause-and-effect diagram
Just culture	Organisational culture that distinguishes good-faith error from gross negligence
Near-miss	An event that could have caused harm but did not
RCA	Root Cause Analysis
Marine safety record	The category of investigation records subject to the confidentiality regime, VDR data included (CIC §2.15)
S-VDR	Simplified Voyage Data Recorder
Swiss Cheese Model	James Reason's model of latent organisational causes
TRIPOD Beta	Structured cause-analysis method for complex events
VDR	Voyage Data Recorder
VSMC	Very Serious Marine Casualty — a casualty involving total loss of the ship, a death or severe damage to the environment; a category subject to the CIC investigation duty; check the applicable regime and specific EU provisions

References and sources

Consolidated list of the sources cited. Updated as of August 2026; for application to a specific case, always refer to the official procedures of your company and your Flag Administration.

Table 13 — References and sources
Source	Scope
ISM Code §9 (Res. A.741(18) and amendments)	Duty to report, investigate and analyse non-conformities, accidents and hazardous occurrences; corrective action and prevention of recurrence
ISM Code §1.2.2.2	Assessment of all identified risks and appropriate safeguards — the anchor for the hierarchy of controls within an SMS
MSC-MEPC.7/Circ.7	Guidance on near-miss reporting
Resolution MSC.255(84), as amended by MSC.390(94) — Casualty Investigation Code	International standards for marine safety investigations into casualties and incidents; mandatory through SOLAS XI-1/6 since 1 January 2010
Resolution A.1075(28), updated version	IMO guidelines to assist investigators in the implementation of the Casualty Investigation Code
MSC-MEPC.3/Circ.4/Rev.1 (18 November 2014)	Harmonised procedures for reporting casualties to the IMO and use of the GISIS MCI module
Resolution LEG.3(91) (27 April 2006)	IMO/ILO guidelines on the fair treatment of seafarers in the event of a maritime accident
2025 IMO/ILO Guidelines on detained seafarers	Fair treatment in connection with alleged crimes; a separate development from the 2006 maritime-accident guidelines
Resolution MSC.333(90)	VDR performance standards: data to be recorded, retention periods, download interface for investigation authorities
Directive 2009/18/EC, as amended by Directive (EU) 2024/3017	Fundamental principles governing the investigation of accidents in the maritime transport sector in the EU; transposition by 27 June 2027
James Reason — Human Error (1990)	The Swiss Cheese model: latent conditions, active failures and defences in depth
Shappell and Wiegmann — HFACS (2000)	Four-level, nineteen-category causal taxonomy built on Reason's model
TRIPOD Beta — Energy Institute	Structured analysis of latent causes and barriers for complex events
ISO 45001:2018, §8.1.2	Hierarchy of controls for eliminating hazards and reducing risks
Heinrich (1931) and Bird (1969)	Reporting-pyramid ratios — illustrative and contested by later research

Educational material

This course is educational material for training purposes and does not constitute a professional certification or qualifying credential. Read the full disclaimer.