Safety Occurrence Investigation

Safety Occurrence Investigation


Investigation - A process conducted for the purpose of accident prevention which includes the gathering and analysis of information, the drawing of conclusions, including the determination of causes and, when appropriate, the making of safety recommendations. [ICAO Annex 13]

Regulatory Requirements

According to the provisions laid down in International Civil Aviation Organisation (ICAO) Annex 13 - Aircraft Accident and Incident Investigation, States shall investigate or delegate the investigation of accidents which have occurred in their territory. Serious incidents should be investigated by States or by other organisations, such as dedicated accident/incident investigation bodies or aviation service provider organisations.

According to Regulation (EU) No 996/2010 on the investigation and prevention of accidents and incidents in civil aviation “every accident or serious incident involving aircraft to which Regulation (EU) 2018/1139 ... applies shall be the subject of a safety investigation...”. The investigation of incidents, other than serious incidents, is also encouraged as this will enable drawing of safety lessons.

The ICAO divisional meeting on Accident Investigation and Prevention held in Montreal in October 2008 proposed a change in Annex 13 to foster a more proactive approach towards the prevention of accidents. It is proposed that States be mandated to investigate serious incidents by upgrading the current ‘recommended practice’ to a ‘standard’ to be applicable to serious incidents involving aircraft with a maximum mass limit of over 2 250 kg.

EUROCONTROL ESARR 2 mandates the investigation of safety occurrences in ATM which occur in the States in which in is applicable.


The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability. (ICAO Annex 13)

Occurrence investigations are carried out in order to:


According to the EU Council Directive 94/56/EC “The extent of investigations and the procedure to be followed in carrying out such investigations shall be determined by the investigating body, taking into account the principles and the objective of this Directive and depending on the lessons it expects to draw from the accident or serious incident for the improvement of safety”.

The extent of an investigation should depend on the actual or potential consequence or hazard. Incidents that indicate high risk potential should be investigated in greater depth than those with lower risk potential.

Although the investigation should primarily focus on the factors that are most likely to have influenced action, the dividing line between relevance and irrelevance is often blurred. Data that initially may seem to be unrelated could later prove to be relevant once the relationship between the different elements of an occurrence are better understood.

Investigation and analysis of safety occurrences is an essential ingredient of the overall risk management process in aviation. Effective safety management systems largely depend on the quality of the investigation of reported accidents, incidents and safety issues.

Investigation Phases

The investigation process is triggered by a notification (report) submitted in accordance with the established safety occurrence reporting arrangements. Several basic phases of an investigation can be distinguished:

  • Set up of the investigation team with the required skills and expertise. The size of the team and the expert profile of its members depend on the nature and severity of the occurrence being investigated. The investigating team may require the assistance of other specialists. Often, a single person is assigned to carry out internal (to the concerned organisation) investigation of an incident considered to have limited potential to cause harm.
  • Gathering of factual information that is pertinent to the understanding of the circumstances and the events leading to the occurrence. A variety of information sources will be used to collect the necessary data for the reconstruction of the event. To ensure the continued availability of such data for the purpose of aviation safety improvement, information sources need to be protected. Guidance on the protection of safety information sources used for investigations is provided by ICAO Doc 9859 - Safety management manual, Third Edition 2012.
  • Event reconstruction in order to establish the exact sequence of events leading to the safety occurrence with its causal and contributory factors. The output of the reconstruction phase should be a set of events that agrees with recorded information and which unifies the views of the various persons who were involved in these events immediately before and after the occurrence.
  • Analysis of the information to assess the risk and provide explanation of the technical and operational factors, and underlying (including organisational) factors and issues. The analysis shall provide argumentation about why the occurrence happened and enable the drawing of conclusions and identification of safety actions to eliminate or mitigate the risk.
  • Drawing conclusions on the basis of collected and analysed information, generally presented by the following categories:
    1. Main (direct) cause(s) and contributing factors leading to the occurrence;
    2. Findings that identify additional hazards which have risk potential but have not played direct role in the occurrence;
    3. Other findings that have potential to improve the safety of operations or to resolve ambiguity or controversy issues contributed to the circumstances surrounding the occurrence.

Identifying the lessons to be learned from a safety occurrence requires an understanding of not just what happened, but why it happened. Therefore, the investigation should look beyond the obvious causes and aim to identify all the contributory factors, some of which may be related to weaknesses in the system’s defences or other organisational issues.

  • Identification of safety recommendations and actions to be taken in order to eliminate or mitigate the safety deficiencies identified by the investigation. The safety recommendations are the main product of any occurrence investigation and are made in the final report.
  • Communication of safety messages to those who have the authority to implement the safety recommendations and to the aviation community in general by means of safety information exchange and lesson dissemination.

For maximum effectiveness, the outcome of the investigation should focus on determining hazards and risks and not on identifying individuals to blame and punish. The way the investigation is conducted influences the overall safety culture in the aviation service provider organisation. According to Council Directive 94/56/EC the investigation ”shall in no case be concerned with appointing blame or liability”. Also, according to EU-OPS 1.037 the objective of the accident prevention and flight safety programmes run by aircraft operators shall be the “evaluation of relevant information relating to accidents and incidents and the promulgation of related information, but not the attribution of blame”.

Official State Investigations

The international standards and procedures for safety occurrences reporting and investigation are outlined by ICAO in Annex 13 - Aircraft accident and incident investigation, Doc 9756 - Manual of Aircraft Accident and Incident Investigation and Doc 9156 - Accident/Incident Reporting Manual.

The responsibility for accident investigation is vested in the States. In order to discharge this responsibility in an effective and impartial manner many States have created specialised investigating bodies, often referred to as Air Accident Investigation Agencies. Such agencies must be wholly independent of the regulatory entities and aviation service providers so as to be able to examine the possibility of shortcomings in State Safety Regulations or State Safety Programmes. An example of such an agency which covers only aviation is the UK Air Accident Investigation Branch (AAIB) and an example of a multimodal agency which includes aviation investigation is the National Transportation Safety Board (NTSB) in the USA.

Many investigation agencies publish the final reports from their investigations online to promote access to hazard and risk-related information for the benefit of aviation safety worldwide, although if the state language is not English, many publish only in the state language with only a selection of reports - or none at all - also available in English translation.

In Europe, full transparency is not mandated. Council Directive 94/56/EC requires only that the reports and the safety recommendations from the official investigations “… be communicated to the undertakings or national aviation authorities concerned and copies forwarded to the Commission” and that “Member States shall take the necessary measures to ensure that the safety recommendations made by the investigating bodies or entities are duly taken into consideration, and, where appropriate, acted upon without prejudice to Community law”.

Investigations by Aviation Service Providers

There are a number of safety occurrences that do not warrant official investigations by States. Nevertheless, those occurrences may be indicative of high risk hazards and could lead to the identification of systemic problems that will not be revealed unless thoroughly investigated. Sound safety management principles and practices require that aviation service providers investigate all occurrences which put or might put at risk the safety of their services. Occurrence investigation is a major component of the organisation’s safety management system.

Often, it is not possible or simply is not productive for an organisation to investigate every single reported occurrence. In such cases the occurrences collected by the safety reporting system shall be accurately assessed and prioritised for investigation based on their perceived risk potential.

The safety management value of the investigation is proportional to the quality of the investigative effort. The following example of poor and high quality incident investigation practices in ANSPs, portray a clear connection between Just Culture concept and the investigation process.

ANSP Occurrence investigation practices example Image source:Safety Culture Enhancement Toolbox for ATM

Without a structured investigation methodology it is difficult to collect, integrate and analyse all pertinent information, assess risks and produce impartial output that would help improve safety. As investigations are often carried out by a single person, the organisation should ensure that investigators possess the necessary skills, experience and support to carry out their duties.

The investigation reports should be communicated organisation-wide and distributed to other parties that are likely to benefit from the findings. Appropriate de-identification measures may be applied. Safety recommendations and suggested corrective actions should be recorded in a database, and their implementation and effectiveness monitored.

Further Reading







SKYbrary Partners:

Safety knowledge contributed by: