When documenting incident investigation, which content is essential?

• A. Facts
• B. Opinions
• C. Assumptions
• D. Rumors

Answer: (A)

The most important content in incident investigation documentation is facts: verifiable, objective observations and data that describe what happened without adding interpretation. Fact-based records provide a solid, testable basis for understanding the incident, allow others to review and reproduce findings, and support credible corrective actions.

What counts as facts include concrete details like who was present, exact times and dates, equipment identifiers, observed conditions, measurements or readings, logs and sensor data, photos or video evidence, and statements from witnesses that can be corroborated. These elements should be recorded with clarity and precision, and sources or evidence should be cited or preserved so the information can be traced back.

Avoid mixing in opinions, assumptions, or rumors. Opinions are subjective judgments about why something happened, assumptions are unverified beliefs about circumstances, and rumors are unverified or false information. All of these can bias the investigation and lead to faulty conclusions, whereas sticking to facts keeps analysis focused on what can be demonstrated by evidence.

Best practices include using neutral, non-leading language; separating facts from conclusions; documenting sources and chain of custody for evidence; and employing a consistent template to capture the who, what, when, where, and how of the incident. For example, noting that a valve actuator failed at a specific time with the exact error code, the maintenance log entry from the prior service, and a security camera timestamp provides a factual, assessable record—whereas stating “the operator caused the trip” would be a conclusion, not a fact.