Describing “Events” and “Conditions”
We describe the “events” and “conditions” leading up to the incident, and sometimes beyond. To assist
accuracy and understanding, a simple guide as to what should be contained in the description is as follows:
Event: - Actor, Action and Object (and if appropriate, the Outcome)
Condition: - Object / Person and the State (and if appropriate, its significance)
It is also helpful to write these descriptions in the current tense; that way, when we are reading the timeline,
we are better placed to understand the circumstances as they were happening.
Maintaining visibility of information accuracy
Remember that, ideally, we need to work with “facts” – information that is irrefutable, beyond question.
However, not every piece of information we collect can be termed a fact; often as not, the information will be
refutable – questionable. In other words, for some information we will have a high degree of confidence that
it is accurate, other information will be less so.
Fact – information that is verifiable – beyond question.
Inference – a conclusion based on incomplete information; if this could be relevant, we need to work
this to disprove it, or improve our confidence level in its accuracy.
Hearsay – evidence based on second-hand information. If it could be important, verify through firsthand
evidence
Supposition – believed to be true but based on incomplete information; an unsupported, or poorly
supported, conclusion. We may have to work at this level on occasion as the physical evidence may
no longer exist (e.g. following a fire or explosion); we may have to work with the “most likely scenario”
or “most probable cause.” If this is the case, it is imperative to clearly highlight this in our report and
analysis.
We need to keep track of this confidence level, and so we will benefit from a simple coding system. Using
small colored dots to provide a marking system will maintain visibility of our confidence level, e.g. red –
not confident this is accurate information, green – very confident it is accurate. Alternatively, a “?” could
represent questionable information, and a “#” to represent solid information. Whatever system you choose
to use, simply make sure everyone uses, and understands, the agreed notation.
Regular review of the timeline and planning boards
It is important to review and update both the timeline and the planning board at least daily. This helps
to keep the whole team up to date with progress and the current picture, to review ideas for further
investigation and to reprioritize lines of enquiry.
Extending the timeline
beyond the incident
events
There will be a need to extend our research to include
post-event actions and conditions if there is a possibility
that the incident response activities may have contributed
to an increase in the outcome severity.
It is worth considering researching the incident response
activities anyway; in most cases our response plans are
rarely put to the test (fortunately), and there is merit
in understanding what happened, and analyzing their
effectiveness.