ICAM investigations: a step-by-step method
How the Incident Cause Analysis Method works — its four factor levels, the investigation steps, and how to turn findings into controls that hold.
ICAM — the Incident Cause Analysis Method — is a structured investigation methodology developed in Australia and now used widely across mining, resources, oil and gas, and heavy construction. It is built on James Reason’s organisational accident model (the “Swiss cheese” model): serious incidents are rarely the fault of one person at the sharp end, but the result of latent weaknesses lined up across the whole system.
The goal of ICAM is not to find someone to blame. It is to find the organisational conditions that made the event possible, so the same holes can be closed everywhere they exist.
The four levels of contributing factors
ICAM organises what it finds into four levels, from the sharp end back to the blunt end:
- Absent or failed defences. The controls that should have caught the event but were missing, bypassed, or did not work — guards, permits, alarms, supervision, competency checks.
- Individual or team actions. The errors or violations that immediately preceded the event. ICAM treats these as symptoms to be explained, not causes to be punished.
- Task or environmental conditions. The conditions that shaped those actions — time pressure, poor lighting, unclear procedures, fatigue, tool design.
- Organisational factors. The upstream decisions and systems that created those conditions — resourcing, procurement, training budgets, competing priorities, culture.
Sorting factors this way stops an investigation from stopping too early at “operator error” and pushes it toward the conditions a business can actually change.
The investigation steps
- Secure and gather. Preserve the scene and collect evidence across people, environment, equipment, procedures and organisation (the “PEEPO” model).
- Build the timeline. Reconstruct what happened as a sequence of events and conditions, not a single moment.
- Identify contributing factors. Work each event back through the four levels above, using techniques like 5-Whys to test each causal link.
- Find the absent/failed defences. Ask which controls should have stopped this — and why they did not.
- Recommend controls. Target the highest levels of the hierarchy of controls you realistically can, not just more training and reminders.
Turning an ICAM into controls that hold
An investigation that ends in a filed report changes nothing. The findings have to flow back into the system:
- Re-score the risk. Every incident is evidence about a critical control. The investigation should re-assess the risk whose control failed.
- Generate tracked actions. Recommendations become corrective actions with an owner, a due date and verification — not a to-do list that quietly expires.
- Push the learning. Turn the lesson into a short refresher for the crews exposed to the same risk, and track that they received it.
Contego runs ICAM as part of one connected loop, so an investigation automatically re-scores the risk, opens verified actions, and feeds the learning back to the field. See it end to end.