Post-Incident Analysis & Reporting Flashcards
7 cards from real CIM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Post-Incident Analysis & Reporting flashcards as text
What is the primary purpose of a 'timeline reconstruction' during a post-incident analysis?
Answer: To establish the sequence of events and decisions that led to and during the incident
Timeline reconstruction establishes a factual chronological sequence of events, enabling analysts to identify causal chains and decision points.
In a post-incident report, what does 'contributing factor' mean as distinct from 'root cause'?
Answer: A contributing factor increased the likelihood or impact of the incident but was not the primary cause
Contributing factors are conditions or actions that worsened the incident's likelihood or impact without being the single root cause.
Which technique is commonly used in post-incident analysis to iteratively ask 'Why?' until the root cause is identified?
Answer: 5 Whys
The 5 Whys technique drills down through layers of symptoms by repeatedly asking why each effect occurred until the root cause is reached.
When should a post-incident review (PIR) meeting ideally be scheduled after a major incident?
Answer: Immediately after resolution while details are fresh, typically within 24-72 hours
PIRs should occur quickly after resolution—within 24-72 hours—so that participants' memories are still accurate and evidence is intact.
What is 'normalization of deviance' in the context of post-incident analysis?
Answer: Accepting small deviations from procedures as normal over time, increasing systemic risk
Normalization of deviance occurs when teams gradually accept non-standard practices as routine, often preceding major failures.
In a post-incident fishbone (Ishikawa) diagram, the 'bones' typically represent which elements?
Answer: Categories of potential causes such as people, process, technology, and environment
Fishbone diagrams organize potential causes into categories (e.g., People, Process, Technology, Environment) branching off the main incident effect.
What distinguishes a 'lessons learned' document from a corrective action plan in post-incident reporting?
Answer: Lessons learned identifies what went wrong; corrective action plan specifies what will be done to prevent recurrence
Lessons learned captures insights and findings, while a corrective action plan defines specific, assigned, time-bound steps to address those findings.