CIM Post-Incident Analysis & Reporting 2

Question 1

What is the primary purpose of a 'timeline reconstruction' during a post-incident analysis?

Accepted Answer

To establish the sequence of events and decisions that led to and during the incident

Answer

Timeline reconstruction establishes a factual chronological sequence of events, enabling analysts to identify causal chains and decision points.

Question 2

In a post-incident report, what does 'contributing factor' mean as distinct from 'root cause'?

Accepted Answer

A contributing factor increased the likelihood or impact of the incident but was not the primary cause

Answer

Contributing factors are conditions or actions that worsened the incident's likelihood or impact without being the single root cause.

Question 3

Which technique is commonly used in post-incident analysis to iteratively ask 'Why?' until the root cause is identified?

Accepted Answer

5 Whys

Answer

The 5 Whys technique drills down through layers of symptoms by repeatedly asking why each effect occurred until the root cause is reached.

Question 4

When should a post-incident review (PIR) meeting ideally be scheduled after a major incident?

Accepted Answer

Immediately after resolution while details are fresh, typically within 24-72 hours

Answer

PIRs should occur quickly after resolution—within 24-72 hours—so that participants' memories are still accurate and evidence is intact.

Question 5

What is 'normalization of deviance' in the context of post-incident analysis?

Accepted Answer

Accepting small deviations from procedures as normal over time, increasing systemic risk

Answer

Normalization of deviance occurs when teams gradually accept non-standard practices as routine, often preceding major failures.

(CIM) Certified Incident Manager Practice Test