Incident Investigation — SuperbaLearning

Learning objectives

Conduct a structured investigation, from securing the scene to formal closure.
Distinguish immediate, contributing and root causes of an event.
Apply the 5 Whys and Ishikawa methods for cause analysis.
Understand the Swiss Cheese model and the role of latent organisational causes.
Build effective corrective actions and genuinely verify their effectiveness over time.
Contribute to a reporting culture that genuinely feeds prevention.

Module 01

Why investigate: from event to prevention

Module objectiveDistinguish immediate response, reconstruction, causal-factor analysis and preventive action within the SMS process.

Every incident, near-miss or non-conformity is valuable information, often obtained at great cost. The value of an investigation lies not in assigning blame, but in turning the event into knowledge that prevents its recurrence.

For a company subject to the ISM Code this is not a matter of good practice: it is an obligation, and it sits in two sentences of §9.

«The SMS should include procedures ensuring that non-conformities, accidents and hazardous situations are reported to the Company, investigated and analysed, with the objective of improving safety and pollution prevention.» (§9.1)

«The Company should establish procedures for the implementation of corrective action, including measures intended to prevent recurrence.» (§9.2)ISM Code, Part A, §9 — Reports and analysis of non-conformities, accidents and hazardous occurrences

The three words in §9.1 — reported, investigated, analysed — describe three distinct activities, and a system that stops at the first does not satisfy the paragraph. §9.2 adds the part most often skipped: it is not enough for the corrective action to remedy the situation, it must prevent recurrence.

Investigation phases may overlap. Notify and preserve without delay; the EU two-month limit concerns commencement from the occurrence.

The fundamental steps

Immediate securing of the scene and prompt collection of evidence.
Reconstruction of the chronological sequence of events.
Identification of verified causal factors and systemic conditions.
Definition of corrective actions targeted at verified factors.
Verification of the actions' real effectiveness over time.
Sharing lessons learned with the rest of the fleet.

Key point

An investigation that stops at correcting the symptom (for example, replacing the failed component) without verifying causal factors and systemic conditions may leave the recurrence risk unresolved.

Key takeaways

ISM Code §9 connects reporting, investigation, analysis and corrective action with prevention of recurrence.
Making the situation safe comes first, but evidence preservation begins immediately.
A useful investigation produces verifiable decisions, not only an account of the occurrence.

Module 02

Who actually investigates: internal investigation and safety investigation

Module objectiveDistinguish the purpose, authority, duties and outputs of an internal investigation, marine safety investigation and judicial or administrative proceedings.

After an event several investigations may run in parallel, and they share neither legal basis nor purpose. Confusing them is the costliest mistake for shore staff: answering a flag-State investigator with the mindset of an internal audit, or treating a public report as if it were an indictment.

The three investigations that may follow the same event, each on its own clock: the EU safety investigation follows the displayed deadlines; the other tracks follow the SMS, contract and national law.

Table 1 — Who actually investigates: internal investigation and safety investigation
	Internal investigation	Marine safety investigation	Judicial or administrative inquiry
Who conducts it	The company, under its own SMS	The safety investigation authority of the investigating State — normally the flag State	The prosecuting authorities of the competent State
Legal basis	ISM Code §9	Casualty Investigation Code, mandatory through SOLAS XI-1/6	National criminal or administrative law
Purpose	Improving the safety and pollution prevention of the SMS	Preventing future casualties and incidents	Establishing liability
Outcome	Internal corrective action, with measures to prevent recurrence	Public report with safety recommendations	Sanctions or damages
The company’s role	Conducts it	Cooperates with it: provides evidence, witnesses, documents	Is subject to it

Table 2.1 — The three investigations that may follow the same event.

The Casualty Investigation Code

The reference text is the Code of the International Standards and Recommended Practices for a Safety Investigation into a Marine Casualty or Marine Incident, adopted by resolution MSC.255(84) of 16 May 2008. It is not a recommendation: by MSC.257(84), Parts I and II were made mandatory through amendments to SOLAS chapter XI-1, and the Code took effect on 1 January 2010 with the entry into force of the amendments to regulation XI-1/6.

«Marine safety investigations do not seek to apportion blame or determine liability. Instead a marine safety investigation, as defined in this Code, is an investigation conducted with the objective of preventing marine casualties and marine incidents in the future.» (§1.1)

«A marine safety investigation should be separate from, and independent of, any other form of investigation. However, it is not the purpose of this Code to preclude any other form of investigation, including investigations for action in civil, criminal and administrative proceedings. Further, it is not the intent of the Code for a State or States conducting a marine safety investigation to refrain from fully reporting on the causal factors of a marine casualty or marine incident because blame or liability may be inferred from the findings.» (§1.2)Casualty Investigation Code, Part I, chapter 1 — Purpose

“Does not apportion blame” does not create universal privilege

Protection lies in separation of purpose and in the protections applicable law gives to specified safety-investigation records. The final report is public and is not written to determine blame or liability, but the Code does not guarantee automatic inadmissibility in every proceeding. Company interview records, emails and internal analyses do not acquire public-investigation protection merely because they concern the same occurrence.

CIC chapter 6 requires investigation of every very serious marine casualty within its scope. Agreements between States may assign the investigation to another substantially interested State; they do not remove the duty. For other events also check EU and national requirements: discretion does not exclude preliminary-assessment duties. Under the EU framework before transposition of Directive 2024/3017, Article 5 requires preliminary assessment of serious casualties and reasons for a decision not to investigate.

Table 2 — The Casualty Investigation Code
Term	The Code’s definition
Marine casualty §2.9	An event, or sequence of events, that has resulted directly in connection with the operations of a ship in any of: the death of, or serious injury to, a person; the loss of a person from a ship; the loss, presumed loss or abandonment of a ship; material damage to a ship; the stranding or disabling of a ship or its involvement in a collision; material damage to marine infrastructure external to the ship that could seriously endanger safety; severe damage to the environment or the potential for it. It excludes deliberate acts or omissions intended to cause harm.
Very serious marine casualty §2.22	A marine casualty involving the total loss of the ship, a death or severe damage to the environment. It is a category subject to the CIC investigation duty; check the applicable regime and specific EU provisions.
Marine incident §2.10	An event other than a marine casualty, occurring directly in connection with the operations of a ship, that endangered — or, if not corrected, would endanger — the safety of the ship, its occupants, any other person or the environment.
Serious injury §2.18	An injury resulting in incapacitation where the person is unable to function normally for more than 72 hours, commencing within seven days from the date the injury was suffered.
Severe damage to the environment §2.19	Damage to the environment which, as evaluated by the affected State(s) or the flag State, produces a major deleterious effect upon the environment.
Causal factor §2.2	Actions, omissions, events or conditions without which the casualty would not have occurred, or the adverse consequences would probably not have occurred or been as serious.
Substantially interested State §2.20	The flag State; the coastal State; a State whose environment was severely or significantly damaged; a State whose interests or installations were seriously harmed or threatened; a State whose nationals died or were seriously injured; a State holding information considered useful; or one with another interest considered significant.

Table 2.2 — The definitions in chapter 2 of the Casualty Investigation Code.

The Code does not say «root cause»: it says «causal factor»

The immediate / contributing / root triad of Module 4 is method vocabulary — useful and widespread — but it is not the Code’s vocabulary. §2.2 defines a single category, the causal factor, with a counterfactual test: causal is whatever, absent it, would have prevented the event or made its consequences less serious. The difference is practical: the Code’s test does not ask how «deep» a cause is, it asks whether removing it would still have left the event to happen. In a report destined for an authority, use its words.

The European level

The table distinguishes the current framework from amendments introduced by Directive (EU) 2024/3017. Those amendments must be transposed by Member States by 27 June 2027 and become operational under applicable national law. Before handling an actual event, check the rules of the flag State, coastal State and competent safety investigation authority.

Table 3 — Current EU framework and amendments awaiting transposition
Status	Duty	Content
Current framework	Independence and commencement	The safety investigation remains independent from parallel proceedings and starts without delay and no later than two months after the occurrence.
Current framework	Report and records	Every effort to publish within twelve months; under the pre-transposition text, an interim report within that period if the final is not ready. Protection of specified records under applicable law.
After national transposition by 27 June 2027	Fishing vessels under 15 m	For a very serious marine casualty the authority carries out a preliminary assessment within two months and decides whether to investigate: a full investigation is not automatic.
After national transposition by 27 June 2027	Shore or port workers	Inclusion depends on a direct connection with ship operations, assessed by reference to structure, equipment, procedures, crew and ship management.
After national transposition by 27 June 2027	Method and reporting	Regulation (EU) No 1286/2011 is repealed from 27 June 2027. The transposed text refers to updated IMO A.1075(28) Guidelines; amended Article 14 limits the twelve-month interim duty to very serious casualties. Authorities populate EMCIP, with the special rule for fishing vessels under 15 m.

Table 2.3 — Current rules are separated from amendments dependent on national transposition.

What changes when Directive (EU) 2024/3017 is transposed

For a very serious marine casualty involving a fishing vessel under 15 metres, the authority will carry out a preliminary assessment without delay and no later than two months and decide whether to investigate; reasons for not proceeding must be recorded and notified. For events involving shore or port workers while the ship is alongside, moored or in dock, the direct connection with ship operations must be assessed. Full inclusion is not automatic in either case.

Key takeaways

The three tracks may run in parallel and have different purposes, powers and evidential regimes.
The CIC requires a safety investigation for every very serious marine casualty, with the investigating State assigned under the Code.
EU amendments of 2024 need transposition by 27 June 2027: investigation is not automatic for small fishing vessels or port workers.

Module 03

Beyond human error: the Swiss Cheese model

Module objectiveUse Swiss Cheese and HFACS to explore defences, latent conditions, supervision and operational acts without stopping at the label “human error”.

Attributing an incident solely to «operator error» is the most common and least useful shortcut: almost always human error is the final symptom of a chain of organisational conditions that made it likely, not the isolated cause of the event. It is the insight James Reason made famous with the Swiss Cheese model in Human Error (1990): an organisation's defences are not solid barriers but slices full of holes, and an event gets through when the holes line up.

Swiss Cheese and HFACS are analytical models, not mandatory IMO classifications: they generate hypotheses to verify against evidence.

Table 4 — Beyond human error: the Swiss Cheese model
Level	Example of a gap
Organisational influences	Commercial pressure that implicitly discourages strict compliance with procedures
Inadequate supervision	A superior who does not genuinely verify the application of critical procedures
Preconditions for unsafe acts	Fatigue, inadequate communication, insufficient training
Unsafe acts	The error or violation of procedure committed by the operator at that moment

Table 3.1 — The four levels of HFACS, the taxonomy built on Reason's model.

Reason supplies the metaphor, HFACS supplies the taxonomy

HFACS, developed by Shappell and Wiegmann, translates Reason’s ideas into four analytical levels. The 2000 FAA report describes categories for unsafe acts, preconditions, supervision and organisational influences. Subcategories depend on version and adaptation: identify the scheme used rather than automatically attributing nineteen categories to the 2000 document. Models organise hypotheses; they do not alone prove causal links.

Investigation Focus — the right question is not «who made the mistake»

The question that guides an effective investigation is not «who made the mistake», but «why, for a competent person acting in good faith, did the error become likely under those conditions». This shift in perspective is what distinguishes an investigation that prevents future events from one that merely closes a case.

Barriers may be absent, degraded, bypassed or ineffective in the actual scenario. The timeline and evidence must confirm the causal links suggested by the model.

Key takeaways

Operator action is often the last observable step in a wider chain.
Barriers may be absent, degraded, bypassed or ineffective in the actual scenario.
Models generate hypotheses; timelines and evidence must confirm causal factors.

Module 04

Causal factors and systemic conditions

Module objectiveClassify proximate events, contributing factors, causal factors and systemic conditions without presuming one root cause.

An analytical classification separates what immediately preceded the outcome, what contributed and which systemic conditions may be relevant. It does not presume one cause or guarantee that one correction will prevent every recurrence.

Table 5 — Causal factors and systemic conditions
Analytical level	Practical use	Required verification
Proximate event/condition	Describes what immediately preceded the outcome	Timeline, data, traces and witness evidence
Contributing factor	Explains what increased likelihood or severity	Evidence of its connection with the event
Causal factor	Meets the CIC counterfactual test: without it, the occurrence or consequences would not have happened in the same way	Converging evidence and alternative explanations considered
Systemic condition	Organisational or technical weakness that may explain several factors and guide prevention	Procedures, barriers, resources and work as done

Table 4.1 — Analytical levels requiring converging evidence.

Labels do not replace proof

“Immediate”, “contributing” and “underlying/root” may be used as methodological labels, but they do not replace the Casualty Investigation Code test or imply that one definitive cause always exists. A preventive measure reduces likelihood or consequence; it rarely guarantees non-recurrence by itself.

Key takeaways

The CIC uses a counterfactual test for causal factors.
Several factors may contribute to the same occurrence and its consequences.
A preventive measure reduces likelihood or consequence; it rarely guarantees non-recurrence by itself.

Module 05

The 5 Whys method

Module objectiveApply 5 Whys as a proportionate technique for developing and testing a possible causal chain.

The «5 Whys» technique is the simplest and most widespread cause-analysis method: it develops a possible causal chain through repeated «why» questions towards conditions the organisation can address; every step must be verified.

Illustrative example of «5 Whys» analysis: the chain generates hypotheses to verify; it does not itself prove causation.

How to apply it correctly

Describe the event specifically and factually, avoiding generalisations.
Ask «why did this happen» and separate available evidence from hypotheses still to be tested.
Repeat the question on the answer and test each step against evidence and alternative explanations.
Stop when a verifiable systemic condition emerges, without treating it as automatic proof of causation.

Investigation Focus — the 5 Whys are not always exactly five

The name of the method is indicative, not prescriptive: a useful condition may emerge after three steps or seven. The stopping criterion is the verifiable quality of the answer, not the count; the chain does not prove causation by itself.

If several explanations emerge, branch the analysis and record supporting and conflicting evidence. The diagram analyses a failed high-level alarm; the source of water requires separate investigation.

Key takeaways

The number of “whys” in the method is indicative, not prescriptive.
Each answer must rest on verifiable facts, not assumptions or personal judgement.
The output is a condition to test against other evidence, not automatic proof of causation.

Module 06

The Ishikawa diagram

Module objectiveBuild a cause-and-effect diagram covering people, procedures, equipment and organisation, then convert each branch into a testable hypothesis.

The cause-and-effect diagram, or fishbone diagram (Ishikawa), visually organises the possible causes of an event, grouping them into categories, to facilitate structured group brainstorming before delving into the most promising causes.

Cause-and-effect diagram (Ishikawa) with the four typical maritime categories and some sub-causes to explore.

Typical categories in the maritime context

Table 6 — Typical categories in the maritime context
Category	Examples of causes to explore
People	Competence, fatigue, communication, experience
Procedures	Clarity, currency, suitability to actual context
Equipment	Maintenance condition, design, spare parts availability
Organisation	Safety culture, operational pressure, supervision

Table 6.1 — Typical categories of an Ishikawa diagram in the maritime context.

Investigation Focus — Ishikawa is a starting point, not an endpoint

The diagram helps avoid overlooking entire categories of potential causes, but does not replace subsequent deeper analysis: every branch identified must be verified with concrete evidence, not left as a mere untested hypothesis.

The four categories are a teaching choice, not a mandatory maritime taxonomy. Add environment, interfaces, materials or measurement where relevant.

Key takeaways

Ishikawa broadens the search and reduces the risk of omitting whole categories.
Brainstorming and causation are not the same thing.
Each branch must be confirmed, rejected or qualified using evidence.

Module 07

Advanced methods: TRIPOD Beta and Fault Tree

Module objectiveSelect TRIPOD Beta, Fault Tree or Event Tree according to the investigative question, complexity and available competence.

For complex events, with multiple concurrent causes and deep organisational factors, there are methods more structured than the 5 Whys and Ishikawa, generally reserved for serious incidents or investigations conducted by specifically trained personnel.

Table 7 — Advanced methods: TRIPOD Beta and Fault Tree
Method	Principle	When it is used
TRIPOD Beta	Analyses latent organisational causes and missed or failed safety barriers	Complex events with multiple organisational factors at play
Fault Tree Analysis	Combinatorial logic linking failures, actions and conditions to an undesired event	Complex technical systems with multiple concurrent failure modes
Event Tree Analysis	Analyses possible consequences starting from an initiating event	Risk assessment and emergency planning

Table 7.1 — Advanced cause-analysis methods, beyond the 5 Whys and Ishikawa.

Where they come from, and a distinction that often gets lost

TRIPOD Beta analyses events, barriers and organisational conditions. The Stichting Tripod Foundation works in partnership with the Energy Institute; accreditation distinguishes practitioners, trainers and assessors. Do not attribute governance solely to the Energy Institute. Fault Tree works backwards from a top event to combinations of failures, actions and conditions through logic gates. Event Tree develops outcomes from an initiating event according to barrier success or failure: primarily a risk tool, it can also support examination of the observed sequence and alternatives. Neither tree replaces evidence. Probabilities require data and treatment of dependencies, not diagrams alone.

Investigation Focus — the choice of method depends on the severity and complexity of the event

Investigation depth also depends on potential severity, not only actual harm. A near-miss with no damage may need extensive investigation if critical barriers were involved. Choose methods and competence according to risk, complexity, recurrence and learning value; broaden the analysis where a simple chain leaves alternatives unexplained.

Key takeaways

TRIPOD Beta: Stichting Tripod Foundation in partnership with the Energy Institute.
Fault Tree analyses combinations; Event Tree develops sequences and possible outcomes.
Scale the method to potential severity as well as actual harm.

Module 08

The first hours: notify, preserve, save the data

Module objectiveActivate notification, evidence preservation and data-saving through the correct channels, distinguishing company duties from authority reporting.

After the analytical methods, return to the first hours: notifying through the competent channel and promptly preserving evidence make reconstruction possible. Legal notification or commencement deadlines and technical overwrite windows serve different purposes and must not be confused.

Notify through the correct channel

Table 8 — Actors, channels and timing
Recipient/channel	Actor	Time and limitation
Company/DPA	Ship and roles identified in the SMS	Without delay under the SMS, flag and applicable coastal-State law
Competent safety investigation authority	Responsible authorities and/or parties involved, as determined by national law	Without delay under EU Article 6; verify the national channel
Flag State and other public authorities	Company/ship under SOLAS, flag, coastal-State and national rules	There is no single global window; apply the relevant procedures
GISIS — Marine Casualties and Incidents	Investigating/reporting State	Basic factual data as soon as possible; report required for very serious casualties under the CIC and circular
EMCIP	Member State, safety investigation authority or other designated national authority	Under the Directive and national method; it is not a direct company upload
Class, P&I, insurers, charterers	Company under contract/policy	Under contractual deadlines, without presenting them as IMO duties

Table 8.1 — The company reports under the SMS and applicable law; States and authorities populate GISIS and EMCIP.

Notification and commencement are different

The EU two-month maximum concerns commencement of the safety investigation and runs from the occurrence, not notification. Notification enables the authority to react and request preservation, but it does not move the legal starting date.

Preserve

Preserving evidence is not discretionary. Article 13 of the Directive requires Member States to adopt measures ensuring that the parties concerned make every effort to:

«(a) save all information from charts, logbooks, electronic and magnetic recordings and video tapes, including information from VDRs or S-VDRs and other electronic devices relating to the period preceding, during and after an accident;
(b) prevent the overwriting or other alteration of such information;
(c) prevent interference with any other equipment which might reasonably be considered pertinent to the safety investigation of the accident;
(d) collect and preserve all evidence expeditiously for the purposes of the safety investigations.»Directive 2009/18/EC, article 13, as amended by Directive (EU) 2024/3017

VDR data

Preserve immediately: VDR windows are not permission to wait. For VDRs subject to MSC.333(90), all data items remain available for at least 48 hours on fixed and float-free media and for at least 30 days on the long-term medium before overwrite. If both main and emergency supplies fail, the dedicated reserve source maintains bridge audio only for two hours, after which all recording stops automatically. After termination, the fixed medium preserves recorded data for at least two years and the float-free medium for at least six months.

Three distinct VDR periods: overwrite window, two hours of bridge audio after power loss, and physical retention after recording terminates.

VDR minimum capacity and retention: overwrite, power-loss reserve and post-termination retention are different periods.

Table 9 — The three VDR windows
Window	MSC.333(90)	Operational meaning
Continuous recording before overwrite	48 hours on fixed and float-free; 30 days on long-term medium	Minimum capability, not time allowed to decide
Loss of main and emergency supplies	Two hours of bridge audio only on the dedicated reserve, then automatic stop	Other data items do not continue for two hours
After recording terminates	Fixed at least two years; float-free at least six months	Physical retention is distinct from the overwrite window
Legacy VDR, where applicable	12-hour minimum window under the earlier standard	Check the actual standard, equipment and manual

Table 8.2 — Durations depend on the applicable standard and do not replace freeze, save and extraction.

Freeze, save and extraction remain immediate

Access and saving depend on the equipment, condition of the ship, power source and manufacturer instructions. Preserve and extract as soon as possible under the SMS, authority instructions and VDR manual; the long-term medium is an easily accessible internal medium, not normatively defined as the one that “goes down with the ship”.

VDR data falls within CIC §2.15 marine safety records: protection depends on the investigative use and applicable law, not simply pressing save. New EU VDR/S-VDR provisions must be read within national transposition and Article 9 conditions; they do not authorise unrestricted reuse or disclosure.

Investigation Focus — the first hour is worth more than the report’s last chapter

Almost every decision that determines the quality of an investigation is taken before the investigation begins: saving the data, photographing the state of components before they are put back in service, noting who was present, keeping witnesses apart. No methodological refinement in the modules that follow recovers evidence that was not preserved.

MSC.333(90) concerns VDRs installed on or after 1 July 2014. The bridge-audio reserve applies when both main and emergency supplies fail. Save under the manual without improperly interrupting recording; verify copy readability, clocks and system offsets. Rescue, care and vessel stabilisation take priority over collection: document necessary changes to the scene.

Key takeaways

The company follows the SMS, flag, coastal-State and national law; GISIS and EMCIP are populated by competent authorities.
The EU two-month limit concerns commencement of the investigation, not notification, and permits no delay.
VDR windows are minimum capabilities: freeze, save and extraction should begin as soon as possible.

Module 09

Evidence collection and conducting interviews

Module objectiveCollect physical, documentary and witness evidence while preserving integrity, provenance and the rights of those involved.

The quality of an investigation depends largely on the quality of the evidence collected in the first hours after the event, before witnesses' memories fade or become contaminated with later reconstructions.

Sources of evidence

Physical evidence: condition of components, marks, position of objects at the time of the event.
Documentary evidence: deck logs, PMS records, communications, sensor and VDR data.
Testimonies: collected separately, as soon as possible, avoiding witnesses agreeing on a common version before being interviewed.

Conducting interviews

Interviews should be conducted in a just culture climate: the goal is to reconstruct the facts, not assign blame. A witness who fears repercussions tends to protect themselves or colleagues, distorting the reconstruction. Open, non-judgemental questions («what did you see», not «why didn't you...») produce more reliable testimony.

The rights framework, which comes before the technique

CIC chapter 12 requires seafarers to be informed of the nature and basis of the investigation and allowed legal advice about self-incrimination risks, any rights not to self-incriminate or to remain silent, and protections for evidence given. It does not create an identical absolute right to silence in every jurisdiction: check applicable law and the authority’s powers. Take evidence at the earliest practical opportunity while respecting human rights, assistance and repatriation.

The Guidelines on the fair treatment of seafarers in the event of a maritime accident — promoted by resolution A.987(24) in 2005 and adopted by the Legal Committee as LEG.3(91) on 27 April 2006 and approved by the ILO that June — complete the picture, and Article 18 of Directive 2009/18/EC requires Member States to take them into account. On confidentiality, Article 9 prohibits making available, for purposes other than the investigation, the witness evidence and statements taken, the records revealing who gave them, and particularly sensitive information about the persons involved, absent an overriding public interest determined by the competent authority.

A company interview does not automatically receive the same protections

Article 9 protections concern specified safety-investigation records under applicable law. An internal record may be obtained in other proceedings: the company should not promise anonymity, confidentiality or privilege it cannot guarantee, and should coordinate preservation, representation and disclosure under applicable law without obstructing the safety investigation authority.

Investigation Focus — separate facts from opinions

During evidence collection, it is essential to distinguish what a witness directly saw from what they believe happened. Opinions are useful for generating hypotheses, but only verifiable facts can support the investigation's conclusions.

For each item of evidence record its provenance, collection time, custodian and transfers; preserve originals and distinguish observed facts, inferences and opinions.

Arrange individual interviews without preventing legal assistance, an interpreter, rest or care. Use open questions, avoid prompting and preserve uncertainties and disagreements. Distinguish direct recollection, inference and expert opinion, assessing their basis and limitations.

Key takeaways

Observed facts, inferences and opinions must remain distinguishable.
Authority interviews and company interviews do not receive the same protection.
No one should promise anonymity, confidentiality or privilege beyond applicable law.

Module 10

Effective corrective actions

Module objectiveDesign actions linked to verified factors, with an owner, deadline, residual-risk assessment and effectiveness criterion.

A well-designed corrective action addresses verified factors and relevant systemic conditions, is realistically achievable, has a clear owner and a defined deadline, and is verifiable in its effectiveness over time.

Hierarchy of controls

Table 10 — Hierarchy of controls
Type of control	Relative effectiveness and example
Elimination	Maximum effectiveness: completely removes the hazard (e.g. eliminating an unnecessary hazardous component)
Substitution	High effectiveness: replaces the hazard with a less risky one
Engineering controls	Good effectiveness: modifies the design or equipment to reduce risk (e.g. safety interlock)
Administrative controls	Moderate effectiveness: procedures, training, signage
Personal protective equipment	Minimal effectiveness as the sole measure: last line of defence, does not replace the preceding measures

Table 10.1 — Hierarchy of controls, from most to least effective.

The hierarchy of controls is an established way to prefer elimination, substitution and engineering measures over training or PPE alone. ISO 45001 §8.1.2 formalises it for OH&S management systems, but it is not textually incorporated into the ISM Code and does not by itself determine whether every maritime safeguard is adequate. Within an SMS it is a robustness test used together with feasibility, residual risk, operational interactions and applicable technical duties.

Investigation Focus — be wary of «training-only» corrective actions

A corrective action that consists solely of «reinforcing training» or «reminding the crew of the procedure» is often the weakest in the hierarchy of controls. It is not wrong in itself, but should be accompanied, where possible, by more solid engineering or administrative controls, not used as the sole response.

Before implementing a measure, assess residual risk and interactions with other operations: the intended improvement should not introduce unassessed new risks. Define at this stage how effectiveness will be verified.

Key takeaways

Training and reminders alone are often weak controls.
The hierarchy of controls is a robustness test, not an automatic ISM rule for every casualty.
Each action should address a demonstrated factor without creating new operational risks.

Module 11

Verifying the real effectiveness of actions

Module objectiveDefine indicators, time horizon and responsibility for verifying whether actions reduced the intended risk.

A formally closed corrective action is not the same as an effective one: verifying effectiveness over time is the step most often neglected in the entire investigation process.

Illustrative tracking: effectiveness is checked against a predefined criterion and a time window proportionate to risk.

How to verify effectiveness

Before closure, define an observable indicator, verification owner and time window proportionate to risk; six months may be an example, not a universal period.
Schedule a follow-up check after some time has passed, not just at the point of immediate closure.
If the event recurs despite the corrective action, reopen the investigation rather than treating it as a new isolated case.

Investigation Focus — closing quickly is not the same as closing well

Pressure to quickly close a non-conformity case, for reporting or upcoming audit reasons, is one of the factors that most compromises the real quality of corrective actions. A mature organisation measures the quality of closure, not just its speed.

Implemented, closed and effective are different states: carrying out a measure, closing its record and demonstrating effectiveness are not equivalent. Assign a verification owner; recurrence or no improvement requires review of factors, actions and initial assumptions.

The chart shows monthly flows: newly opened actions and actions verified effective that month, possibly opened earlier. It does not compare one cohort or alone measure backlog or effectiveness rate. For the latter, define actions actually assessed as the denominator and also record those not yet assessable. No recurrence without sufficient exposure does not prove effectiveness: also assess barrier performance and residual risk.

Key takeaways

Implemented, closed and effective are different states.
The effectiveness criterion should be set before closure and proportionate to risk.
Recurrence or no improvement requires review of factors, actions and initial assumptions.

Module 12

Sharing lessons learned

Module objectiveConvert investigation findings into timely, non-blaming and verifiable fleet learning.

An investigation that produces knowledge useful only to the ship involved wastes most of its potential value: systematically sharing lessons learned with the rest of the fleet is what turns a single event into company-wide prevention.

How to build effective sharing

Clear, non-judgemental summaries, focused on verified factors, barriers and corrective actions, not on the names of the people involved.
Timely distribution, not quarterly: lessons learned lose value if communicated months late.
Practical, visual format (safety bulletins, brief case studies), not just a long, little-read technical report.
Verification that the lesson has genuinely been absorbed, not just distributed (for example through a brief reminder at safety meetings).

Investigation Focus — honest sharing requires mutual trust

A crew that fears being publicly exposed or ridiculed in a safety bulletin will tend to hide their mistakes rather than report them. The most effective companies communicate lessons learned in a way that strengthens trust in the system, not erodes it.

Anonymisation should not remove the necessary operational context: the brief connects the occurrence, factors, barriers and actions without unnecessarily exposing individuals. Check understanding and onboard application, not merely receipt of the bulletin.

For an urgent hazard promptly share interim safeguards, distinguishing them from unconfirmed conclusions; update the bulletin when evidence changes.

Key takeaways

Anonymisation should not remove the operational context needed to understand the lesson.
A short brief should connect the occurrence, factors, barriers and actions.
Distribution is not learning: understanding and application must be checked.

Module 13

Building a reporting culture

Module objectiveAssess the channels, feedback and accountability that make occurrence and near-miss reporting credible.

The success of any investigation system depends, upstream, on people's willingness to report minor events and near-misses before they escalate into serious events.

The reporting pyramid as a picture of visibility: the shape holds, Heinrich's and Bird's ratios do not.

The pyramid measures neither risk nor under-reporting

Historical Heinrich and Bird ratios are not universal coefficients for predicting serious events. Even the pyramid’s shape does not measure under-reporting: it depends on definitions, exposure and data collection. Assess potential consequences and the barriers involved; fewer minor injuries alone do not demonstrate lower major-accident risk. Reports are one source to combine with observations, audits, alarms and maintenance data.

The pillars of a just culture

Table 11 — The pillars of a just culture
Pillar	Practical meaning
Non-punishment for good-faith errors	Whoever reports their own honest mistake does not suffer retaliation
Proportionate accountability	Good-faith errors and reporting do not trigger retaliation; intentional, reckless or grossly negligent conduct is assessed through a separate, consistent process under applicable law
Visible feedback	Whoever reports sees that something changes, not a form that disappears into a void
Simplicity of the reporting channel	Easy to use, with anonymous reporting where available and legally permitted; do not promise protection the system cannot guarantee

Table 13.1 — The pillars of an effective reporting culture (just culture).

Investigation Focus — interpret the count, do not reward it alone

A low number of reports is not, by itself, evidence of good performance. Interpret it alongside exposure, activity, report quality, feedback, trust in the system and other indicators.

Key takeaways

The pyramid is a visibility model, not a predictive model with universal numerical ratios.
Just culture combines protection from retaliation with proportionate accountability through separate processes.
Report counts should be interpreted alongside quality, exposure, activity and trust in the system.

Module 14

Emerging trends in investigation

Module objectiveAssess the impact of longer VDR windows, the amended EU regime, aggregate data and fair-treatment developments without anticipating their legal effect.

More data, with different windows. VDRs subject to MSC.333(90) retain all data items for at least 48 hours on fixed and float-free media and for at least 30 days on the long-term medium before overwrite. If both main and emergency supplies fail, the dedicated reserve records bridge audio only for two hours. Freeze, save and extraction remain immediate.

A new EU regime through national transposition. Member States must transpose Directive (EU) 2024/3017 by 27 June 2027. Very serious casualties involving fishing vessels under 15 metres require a preliminary assessment, not automatically a full investigation; events involving shore or port workers require an assessment of their direct connection with ship operations. Regulation (EU) No 1286/2011 is repealed with effect from the same date and the Directive refers to the updated IMO A.1075(28) Guidelines.

Authority-operated public reporting. GISIS and EMCIP support aggregate analysis, but they are populated by States and designated authorities: they do not replace company reporting and do not authorise unrestricted reuse of safety-investigation records.

Fair treatment is evolving. The 2025 IMO/ILO Guidelines on seafarers detained in connection with alleged crimes complement the 2006 framework in detention cases; they remain distinct from safety-investigation interview and confidentiality rules.

Data helps but does not replace investigative judgement

More data broadens reconstruction, but converging evidence, alternative explanations and professional judgement remain necessary.

Key takeaways

More data supports reconstruction but does not replace investigative judgement.
EU amendments become operational through national transposition by 27 June 2027.
The 2025 detained-seafarer guidelines complement, but do not automatically replace, the 2006 maritime-accident framework.

Recurring mistakes

From the Mistake Library of SuperbaKnowledge, filtered to the subjects this course covers. This view selects and organises content published in SuperbaKnowledge; it does not modify or replace it. The linked Knowledge page remains the reference version, while official texts remain authoritative.

Recurring mistakes published in SuperbaKnowledge
Topic	Mistake	Typical consequence	Topic sheet
Corrective and Preventive Action (CAPA)	Corrective action addressing the symptom, not the verified factor	The event or non-conformity may recur	See the topic sheet
Near Miss	Punitive culture towards those who report	The reporting rate collapses and useful information is lost	See the topic sheet

Glossary of terms

Table 12 — Glossary of terms
Term	Definition
CAPA	Corrective and Preventive Action
Contributing cause	A factor that makes the immediate cause of an event more likely
Immediate cause	The action or condition directly linked to the event
Root cause	A methodological term for a systemic condition to verify; it presumes neither a single cause nor equivalence to a CIC causal factor
CIC — Casualty Investigation Code	IMO Code for marine safety investigations into casualties and incidents, Res. MSC.255(84)
Causal factor	An action, omission, event or condition without which the event or its consequences would not have occurred (CIC §2.2)
EMCIP	European Marine Casualty Information Platform — the EU marine casualty database
GISIS	Global Integrated Shipping Information System — the IMO information system, including the MCI module for casualties and incidents
HFACS	Human Factors Analysis and Classification System — four-level taxonomy built on Reason's model
Ishikawa	Fishbone cause-and-effect diagram
Just culture	Organisational culture that distinguishes good-faith error from gross negligence
Near-miss	An event that could have caused harm but did not
RCA	Root Cause Analysis
Marine safety record	The category of investigation records subject to the confidentiality regime, VDR data included (CIC §2.15)
S-VDR	Simplified Voyage Data Recorder
Swiss Cheese Model	James Reason's model of latent organisational causes
TRIPOD Beta	Structured cause-analysis method for complex events
VDR	Voyage Data Recorder
VSMC	Very Serious Marine Casualty — a casualty involving total loss of the ship, a death or severe damage to the environment; a category subject to the CIC investigation duty; check the applicable regime and specific EU provisions

References and sources

Direct sources used in the review:

Consolidated list of the sources cited. Updated as of August 2026; for application to a specific case, always refer to the official procedures of your company and your Flag Administration.

Table 13 — References and sources
Source	Scope
ISM Code §9 (Res. A.741(18) and amendments)	Duty to report, investigate and analyse non-conformities, accidents and hazardous occurrences; corrective action and prevention of recurrence
ISM Code §1.2.2.2	Assessment of all identified risks and appropriate safeguards — the anchor for the hierarchy of controls within an SMS
MSC-MEPC.7/Circ.7	Guidance on near-miss reporting
Resolution MSC.255(84), as amended by MSC.390(94) — Casualty Investigation Code	International standards for marine safety investigations into casualties and incidents; mandatory through SOLAS XI-1/6 since 1 January 2010
Resolution A.1075(28), updated version	IMO guidelines to assist investigators in the implementation of the Casualty Investigation Code
MSC-MEPC.3/Circ.4/Rev.1 (18 November 2014)	Harmonised procedures for reporting casualties to the IMO and use of the GISIS MCI module
Resolution LEG.3(91) (27 April 2006)	IMO/ILO guidelines on the fair treatment of seafarers in the event of a maritime accident
2025 IMO/ILO Guidelines on detained seafarers	Fair treatment in connection with alleged crimes; a separate development from the 2006 maritime-accident guidelines
Resolution MSC.333(90)	VDR performance standards: data to be recorded, retention periods, download interface for investigation authorities
Directive 2009/18/EC, as amended by Directive (EU) 2024/3017	Fundamental principles governing the investigation of accidents in the maritime transport sector in the EU; transposition by 27 June 2027
James Reason — Human Error (1990)	The Swiss Cheese model: latent conditions, active failures and defences in depth
Shappell and Wiegmann — HFACS (2000)	Four analytical levels based on Reason; specify the version of the subcategories
TRIPOD Beta — Stichting Tripod Foundation / Energy Institute	Structured analysis of latent causes and barriers for complex events
ISO 45001:2018, §8.1.2	Hierarchy of controls for eliminating hazards and reducing risks
Heinrich (1931) and Bird (1969)	Reporting-pyramid ratios — illustrative and contested by later research

Educational material

This course is educational material for training purposes and does not constitute a professional certification or qualifying credential. Read the full disclaimer.