Outline a step-by-step approach to incident investigation.

• A. Assign blame, start remedial actions, publish report.
• B. Skip evidence gathering, immediately restart operations.
• C. Secure scene, collect evidence, interview witnesses, construct timeline, perform root cause analysis, implement corrective actions, verify closing actions.
• D. Only interview a single supervisor.

Answer: (C)

A disciplined, evidence-based process focuses on what happened, why it happened, and how to prevent recurrence. The step-by-step approach outlined—secure the scene to preserve evidence, collect and preserve evidence, interview witnesses, construct a timeline, perform root cause analysis, implement corrective actions, and verify closing actions—follows that logic in a logical sequence. Securing the scene protects data and physical clues; gathering and preserving evidence ensures you can trust what you find; interviewing multiple witnesses provides different viewpoints and helps build a complete picture; constructing a timeline helps you understand the sequence of events and how factors interacted. Root cause analysis moves beyond the surface cause to identify underlying system or process gaps that allowed the incident to occur. Implementing corrective actions addresses those root causes, and verifying closing actions confirms that those changes actually worked and are sustained. This holistic, methodical flow is what makes the investigation credible and capable of preventing recurrence.

The other options don’t fit this approach. Blaming people and publishing a report without a structured, evidence-based process misses how to learn from the incident and can derail improvements. Restarting operations without gathering evidence risks repeating the same problem. Interviewing only a single supervisor provides an incomplete and biased view, missing data from others involved and from records or systems.