At the facility
Structured prevention, a response path the people on shift have actually rehearsed, and root-cause work that closes rather than files. An incident is not over when the load is back.
Most incident processes end at restoration. The event is closed, the report is written, and nothing about the site changed. A closed loop means the corrective action has an owner, a date, and a check.
Someone writes and files the report, and nobody reads it. Six months later, the same breaker trips for the same reason, and the one person who remembers the first time has left.
During the event nobody is writing anything down, which is correct. Afterwards the timeline is assembled from a group chat and two recollections. That is enough to satisfy a manager and nowhere near enough for a regulator, an insurer, or your own client.
Every event goes to root cause, and the correction is verified rather than assumed. That is the loop here. An incident does not close when the load is back; it closes when the thing that caused it cannot happen the same way again.
We write escalation paths, isolation steps, and decision authority against your equipment, and the people who will be on shift rehearse them.
We deploy live dashboards during the event and build a timeline as it happens rather than reconstructing after the fact. We capture what was done and when while the room is still loud.
The first plausible explanation is where most investigations stop. This one carries to the condition that allowed it, which is usually a maintenance, data, or training decision made months earlier.
Every corrective action takes an owner and a date and we track each one to completion. The finding then goes back into the maintenance strategy, which is the only step that stops the event from recurring.
The procedure, the record, and the root-cause work come from us; the response is still yours.
The figures below are from a healthcare portfolio where prevention, response, and improvement went in together. The compliance number is the hardest of the two to move and the first one an auditor wants.
40%fewer incidents
across a healthcare portfolio, over the engagement
100%
Compliance on that engagement
Closed
Loop, every action owned
Incident management runs one named workstream, and it is the part that makes the loop compound instead of repeat.
This is a portfolio-level record of failure modes, causes, and corrective actions, fed by every incident and read back into maintenance strategy.
These questions come from operators who have just had a bad quarter and want to know if this is process or theatre.
Usually the end of it would change. Most processes end at restoration: the event is closed, the report is written, and nothing about the site changed. We add the half after restoration, where the corrective action has an owner, a date, and a check that it happened.
In this process, we track the corrective action from a root cause to completion and then feed it back into maintenance strategy, so the interval or the procedure actually changes. A lesson learned that lives in a report is not closed, it is filed.
The owner is a named person with a date, recorded at the time the root cause is agreed rather than assigned afterwards. Unowned actions are the single most common reason that the same failure appears twice on one site.
We always provide the process. Where the engagement includes on-site staffing and vendor oversight, we provide the prescribed response. The two are worth separating: a rehearsed escalation path is worth more at 3 am than an extra body who has never run it.
RCA changes the maintenance strategy through the failure library. Every root cause is recorded against the asset class it came from, so the next interval, procedure, or spares decision is made against the site's own history instead of the manufacturer's default.
Not the question you have? Send it over, and one of the people who would actually run your site will answer it.
Ask an operatorAn incident is almost never only an incident. These three are where the cause usually sits.
Both routes begin from something real: the event you have not finished explaining or the procedure you would not want to test tomorrow.
Usually what changes is the end of it. Most processes end at restoration: the event is closed, the report is written, and nothing about the site changed. We add the half after restoration, where the corrective action has an owner, a date, and a check that it happened.
We rewrite the response against your equipment, then rehearse it with the people who would be standing there at two in the morning. What comes from that rehearsal is usually the real finding.