How do incident investigation and root cause analysis differ in their objectives?

• A. Incident investigation focuses on collecting data about the incident.
• B. Root cause analysis determines what happened and what was affected.
• C. Root cause analysis identifies immediate actions.
• D. Incident investigation determines what happened and what was affected; root cause analysis seeks underlying systemic causes to prevent recurrence.

Answer: (D)

The important idea is that incident investigation and root cause analysis have different objectives. An incident investigation describes what happened and who or what was affected, gathering data, reconstructing the sequence of events, and identifying immediate factors and consequences so that people and operations can be protected right away. Root cause analysis goes further to uncover the underlying systemic causes that allowed the incident to occur—things like gaps in policies, management oversight, training, design flaws, or weaknesses in defenses. The goal of RCA is to implement changes that address those deeper causes and prevent recurrence, not just fix the immediate situation.

So the best choice captures both aims: incident investigation determines what happened and what was affected, while root cause analysis seeks the underlying systemic causes to prevent recurrence. The other descriptions either focus only on data collection or only on immediate actions, or misstate RCA’s purpose, and don’t reflect the broader preventive objective of RCA.