Incident Timeline Review¶
Method — instantiates Situational Attribution Check
A chronological reconstruction of events, cues, handoffs, decisions, and pressures before a behavior or failure.
Incident Timeline Review lays the run-up to a behavior or failure out in sequence — the cues, the handoffs, the decisions, and the pressures, each at its moment — so the visible act stops looking like an isolated choice and starts looking like the last link in a chain. Its defining lens is time: by ordering the conditions and marking what was known at each step, it reveals the latent, upstream conditions that had already lined up before the final actor did anything, and it keeps the harm and the breached standard tagged to the exact points where they entered. It ends by pulling the recurring, changeable conditions out of the story into a record meant to prevent the next one. The timeline is not a search for the responsible person; it is a search for the shape of the chain.
Example¶
A warehouse forklift operator nearly strikes a picker rounding an aisle, and the shift report reads "driving too fast — reckless." An Incident Timeline Review reconstructs the two hours before. 06:00 — two of the shift's four operators called out sick. 08:05 — the pick-rate dashboard flips red; the backlog is visible to everyone. 08:20 — the supervisor announces over the radio, "we need to clear this before the next truck." 08:40 — a mis-stacked pallet is left blocking the mirror at the aisle-7 corner, killing the sightline. 08:52 — the near-miss. Laid in order, the "reckless driver" reads instead as the endpoint of a staffing shortfall, a throughput push, and a blocked sightline that lined up in sequence. The harm (a near-strike on a pedestrian) and the standard (the corner speed limit) are tagged where they entered, and the review extracts the changeable conditions — call-out coverage, the throughput announcement, corner-mirror discipline — as prevention items.
How it works¶
- Build the sequence from mixed sources — logs, sensor data, radio traffic, interviews — placing every cue, handoff, decision, and pressure at its timestamp.
- Mark what was known at each step, not what became obvious later, so the chain is read forward rather than backward.
- Flag the latent conditions — the sick-call gap, the throughput push — that were already in place before the final act, the holes that had to align.
- Tag harm and standard where they enter, and extract the recurring, changeable conditions into a prevention record.
Tuning parameters¶
- Time window — how far back the reconstruction reaches; a longer window catches deeper latent conditions but costs effort and can over-attribute.
- Granularity — minute-by-minute versus phase-level; fine granularity exposes hidden handoffs but risks drowning the signal in detail.
- Source mix — how heavily objective logs are weighted against recollection; instrumented data resists hindsight better than memory.
- Harm/standard tagging depth — how rigorously each step is checked against the applicable standard; deeper tagging keeps accountability visible but slows the walk.
When it helps, and when it misleads¶
Its strength is that the chronological layout surfaces the upstream, latent conditions that a snapshot of the final act cannot see — the way ordinary gaps line up until only one barrier is left. It is the mechanism that shows a "reckless" endpoint sitting on top of a chain nobody had fixed.
Its failure mode is hindsight bias[n1]: once the bad outcome is known, every prior step looks like an obvious warning ignored, and the timeline can be read as a trail of negligence that was invisible in real time. The classic misuse is scanning the completed chain for the person nearest the failure and stopping there. The discipline that guards against it is to reconstruct what was actually knowable at each step before the outcome, and to keep asking which conditions — not which people — made the endpoint likely.
How it implements the components¶
situational_factor_map— it builds the map in time order: cues, pressures, and handoffs placed in sequence, so conditions are seen as they accumulated rather than as a flat list.impact_or_standard_reference— harm and the applicable standard are tagged at the steps where they entered the chain, keeping consequence and expectation visible through the reconstruction.context_learning_record— the recurring, changeable conditions are extracted into a prevention record so the same chain can be interrupted next time.
It reconstructs the sequence but does not capture the actor's own first-person account (actor_perspective_record — Actor Perspective Interview), weigh the trait-versus-situation explanations to a conclusion (explanatory_weighting — Context Reconstruction Interview), or run the fixed factor scan (constraint_context_review — Constraint and Incentive Checklist).
Related¶
- Instantiates: Situational Attribution Check — it reconstructs the run-up so the final behavior is judged as the end of a chain, not a lone act.
- Consumes: Actor Perspective Interview and Context Reconstruction Interview — their accounts fill the human decision points on the timeline.
- Sibling mechanisms: Actor Perspective Interview · Context Reconstruction Interview · Behavior-Context Mapping Template · Constraint and Incentive Checklist · Empathy Mapping · Performance Context Review · Policy Exception Review · Just Culture Review
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Incident Timeline Review operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it a chronological reconstruction of events, cues, handoffs, decisions, and pressures before a behavior or failure
Independent corroboration: The frozen evidence defines Incident Timeline Review as 'A chronological reconstruction of events, cues, handoffs, decisions, and pressures before a behavior or failure', so its operative form is Assessment, Review & Assurance.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Reconstructing upstream conditions, handoffs, pressures, and knowledge before a failure is a human-factors and safety-investigation method.
Related originating lineages:
- History & Historiography — Chronological source criticism supplies a distinct reconstruction lineage.
- Psychology — Retained as a formative lineage because the independent reviewer identified it as primary: Its defining discipline is resisting Fischhoff's hindsight bias by judging each action from what was knowable then.
Review resolution: NASA human-factors incident analysis reconstructs what information and constraints were present at each point before judging actions. Psychology explains hindsight bias, but reviewing a technical-event timeline against system state is primarily safety engineering. The retained alternate domains identify independent or materially shaping provenance, not downstream reach alone. domain_reach=multi_domain because the mechanism has independent established use in several fields. The encyclopedia entry deliberately composes those lineages.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
- https://humansystems.arc.nasa.gov/flightcognition/Publications/KD_CRMHF_Conference.pdf — NASA human-factors source on reconstructing local rationality during incident review.
Notes¶
[n1] Hindsight bias — the "knew-it-all-along" effect studied by Baruch Fischhoff, in which a known outcome makes the preceding events seem far more predictable than they were. It is the central threat to any after-the-fact timeline, and the reason each step must be judged by what was knowable then. ↩