1) A Need for Certainty: Organizations Prefer Reassuring Explanations
Over Accurate Ones

When an incident occurs, organizations face two simultaneous
pressures. The first is operational: “What do we stop, and what do we
continue?” “How do we prevent further harm?” These demands require
immediate answers. The second is psychological and political: “Who is
responsible?” “How do we explain this to leadership?” “What message do
we communicate externally?” Both pressures land at the same time.

What organizations want most in this moment is not complete truth — it
is the restoration of order. The longer uncertainty persists,
the more anxiety, blame, speculation, and rumor grow. As a result,
when the first plausible explanation emerges, it is often quickly
adopted as a psychological stabilizer — regardless of whether it has
been sufficiently verified.

This is Hollnagel’s central point. Incident explanation is not simply
the factual reconstruction of what happened — it is the process of
constructing a socially acceptable causal narrative. Unless we ask
“why was this explanation chosen?”, it becomes difficult to
distinguish between analysis that is close to the truth and analysis
that is a compromise made in the interest of organizational stability.

This is why an investigation team’s first question cannot stop at
“what happened?” It must also ask: “What questions is our organization
trying to close quickly?” and “What questions, however uncomfortable,
must we keep open?” Without this separation, the investigation process
transforms from a fact-gathering system into a ritual that soothes
organizational anxiety.

2) A “Good Cause” Is Not Objective Truth — It Is Selected Based on
What the Organization Can Currently Manage

Causes appear to be fixed values, but in practice they are determined
relatively. Hollnagel frames incident causation as “a limited set of
conditions selected after the fact.” Among an infinite number of
background conditions, organizations select and declare as causes
those that are explainable, actionable, and socially acceptable given
current constraints.

As a result, the causal language in investigation reports tends to
converge on whichever explanation satisfies three conditions: first,
it must not contradict existing explanation practices; second, it must
be traceable to a specific and identifiable target — a person,
procedure, or piece of equipment; third, it must allow the
organization to demonstrate that “something was done” within available
time and budget. When all three conditions are met, a simplified
causal structure is likely to be adopted even if important factors are
omitted.

The problem is that systemic conditions get pushed to the back of the
queue in this process. Factors such as schedule structure, approval
delays, information asymmetry, and performance pressure may enter the
analysis as causal candidates — but they are easily excluded on the
grounds that accountability is hard to assign and that short-term
improvement effects are difficult to demonstrate. The organization
ends up selecting manageable causes, leaving the difficult ones
unaddressed, and waiting for the next incident.

3) Explaining the Out of the Ordinary: Humans Default to Familiar
Explanations Even for Abnormal Events

The 1995 Tokyo subway sarin attack illustrates this mechanism clearly.
Victims were exposed to an unprecedented and lethal threat, yet many
initially interpreted their symptoms through familiar frameworks — a
cold, an allergy, a temporary drop in physical condition. Even in the
presence of anomalous symptoms, people first applied explanations that
did not conflict with prior experience.

This response is not irrationality — it is cognitive economy. Because
humans cannot hold all possibilities open simultaneously at every
moment, the most readily available explanation takes precedence. Under
normal circumstances, this strategy is fast and efficient. But in
rare, high-consequence events, it delays initial response and
compresses risk recognition.

The same dynamic operates in incident investigation. When the analysis
team forces an event into an existing classification framework, newly
emerging hazard patterns are missed. The ETTO perspective therefore
requires not just asking “how does this incident fit existing
categories?” but also: “Is the existing framework omitting variables
that are critical to understanding this event?”

4) The Stop Rule: When Does Analysis Stop, and Who Decides the
Stopping Criteria?

No analysis can continue indefinitely. Time, personnel, budget, and
organizational attention are all finite. Incident investigations must
therefore stop at some point. The problem is that most organizations
never explicitly define their stopping criteria. Without defined
criteria, an investigation ends not through scientific closure but
through inertia, organizational power dynamics, or schedule pressure.

In practice, the Stop Rules that actually operate in the field are
often informal. Phrases like “we’ve explained it sufficiently,”
“further analysis won’t change the outcome,” “going deeper will
produce organizationally uncomfortable conclusions,” or “if we wait
any longer, external communications will be compromised” function as
de facto termination signals. These rules never appear in
documentation — but they powerfully shape results.

Hollnagel’s point is straightforward: the process of finding causes is
itself subject to ETTO. Digging deeper improves accuracy but costs
more resources (thoroughness). Closing quickly enables faster
execution but increases the risk of omission (efficiency). Ultimately,
the quality of an investigation is determined not only by “what was
found” but by “where it stopped.”

The Stop Rule must therefore be a transparent design parameter — not a
hidden convention. At the outset of any investigation, teams should
explicitly define: what data must be secured before a first-round
conclusion is drawn; under what conditions additional analysis becomes
mandatory; and which questions will be formally deferred to a
subsequent review cycle. Only with this structure can results be
validated later and quality variance between investigations be
reduced.

5) The Root Cause Trap: The Language of “True Cause” Closes
Organizational Learning

Many organizations favor the term “root cause.” The problem is that in
practice, this term functions as a synonym for “the final answer.” But
from Hollnagel’s perspective, root cause is itself just one form of
selected explanation. Regardless of what analytical method is used,
the moment a decision is made about how deep to investigate, the Stop
Rule is already operating — and the causal chain is cut at that point.

Single root cause narratives are therefore easy to manage but weak at
preventing recurrence. If a report concludes with “worker
inattention,” the prescribed remedy is invariably additional training.
But if the actual contributing conditions included shift handover
failures, compressed inspection windows, delayed notification of
interface changes, and approval bottlenecks, training alone cannot
break the same causal pathway.

A more operationally effective approach is to replace the single-cause
declaration with a documented “contributing set” — a combination of
causal factors expressed in operational language. The investigation
should identify which factors repeatedly combine with each other,
under what conditions their combined effect intensifies, and at which
organizational level — field, management, or policy — intervention is
required to disrupt the combination.

6) Investigation Quality from an ETTO Perspective: Managing Speed and
Depth Simultaneously

How can organizations realistically maintain balance? ETTO is not an
argument for slow investigations or rapid conclusions. The key is
designing the investigation process in two phases: separating
immediate stabilization (rapid provisional conclusions) from
structural learning (deep analysis over time).

Phase 1 rapidly applies provisional hypotheses and interim controls to
prevent harm escalation and maintain operational continuity. Phase 2
uses adequate time and multi-disciplinary perspectives to reconstruct
systemic conditions, decision-making context, and organizational
pressure. A critical safeguard: Phase 1 conclusions must not be
allowed to foreclose Phase 2. A formal “hypothesis-lock prohibition”
rule is required to keep the analysis open.

Investigation report formats must also change. Rather than a single
root cause field, reports should document: (a) immediate causal
hypothesis; (b) contextual contributing factors; (c) Stop Rule
rationale; and (d) deferred questions with plans for additional data
collection. This structure preserves investigation speed while
protecting the depth of organizational learning.

Finally, every investigation closure should include a formal
meta-review: “What questions were closed too quickly in this
investigation?” “What data, if available, might have changed the
conclusion?” “Did the composition of the investigation team — by
function, seniority, or expertise — introduce interpretive bias?”
Consistently applying this review improves Stop Rule quality across
future investigations.

7) Part 2 Summary: Incident Investigation Is Designing Explanation
Quality, Not Just Finding Facts

The core takeaway of Part 2 is clear. When an incident occurs,
organizations are pulled toward explanations that restore comfort
quickly — and that pull is itself a form of ETTO (the
efficiency-thoroughness trade-off). Without consciously acknowledging
this trade-off, analysis becomes faster but organizational learning
becomes shallower.

A well-designed investigation system does not demand a single
definitive answer. Instead, it makes explicit: what explanation was
selected and under what conditions; where the analysis stopped; and
what remains uncertain. A report that manages uncertainty as an
actionable task is safer than one that conceals it.

Part 3 connects this discussion to the ETTO argument proper. We
examine why organizations systematically prefer simple explanations,
how the efficiency-thoroughness balance tips in real-world operations,
and under what conditions the strategies that produce everyday success
become the strategies that produce failure.

The three practical takeaways from Part 2 are:

• Quick conclusions are necessary, but must never be treated as final
• Stop Rules must be managed as explicit, documented criteria — not
  implicit convention
• Causal statements must be recorded as combinations of operational
  conditions, not as single-line responsibility assignments

When these three elements are in place, incident investigation moves
beyond a blame-assignment process — and becomes a genuine learning
process.