Incident Investigation: 5 Whys & PEEPO Field Guide
How to run incident investigations that prevent recurrence. The 5 Whys finds root cause, PEEPO finds blind spots, and BLS data shows 2.8M reasons it matters.
Process Safety Management, hot-work permits, confined-space entry, contractor management. Built for the operations where the consequence ceiling is catastrophic and the regulatory bar is set accordingly.

Oil and gas operations sit at the high-consequence end of every EHS distribution. Process Safety Management (PSM) was codified by OSHA as 29 CFR 1910.119 in 1992, written in direct response to the Phillips 66 Pasadena explosion (1989) and the Bhopal disaster (1984). The standard exists because the failure mode of an oil and gas facility is not one injury; it is a release event with cascading consequences across the facility, the community, and the environment.
The regulatory bar is set accordingly. PSM requires fourteen documented elements including process hazard analysis, written operating procedures, employee participation, contractor management, and incident investigation. Each element generates evidence that auditors and regulators sample. Operations that cannot produce the evidence on demand fail audits and accumulate findings.
Six hazard categories the platform is built to capture, investigate, and close.
Loss of containment, runaway reactions, vapor cloud ignitions. Low-frequency, high-consequence events that drive PSM regulation.
Welding, cutting, grinding near hydrocarbon inventory. Permit-to-work with atmospheric testing and fire-watch verification.
Vessels, tanks, pipe runs. Atmospheric testing, entry attendant, retrieval equipment, and rescue plan required.
Hydrogen sulfide at sour-gas operations, benzene in some streams, NORM in older installations. Real-time monitoring and exposure-record retention.
PSM requires contractor pre-qualification, training records, and performance evaluation. The audit trail must reconstruct on demand.
Mechanical integrity programs for pressure vessels, piping, instrumentation. Inspection cycles tied to equipment risk classification.
PSM auditors and regulators evaluate operations on documentary evidence. Did you do the process hazard analysis? Show me the report, the participants, and the closure of recommendations. Did the operator on duty follow the written procedure? Show me the procedure, the training record, the most recent review, and the operator's acknowledgement. Did the contractor get pre-qualified? Show me the contractor's safety record, the pre-job briefing, and the evaluation at job close.
Programs that cannot produce the evidence chain at audit time fail. The 2010 Macondo (Deepwater Horizon) investigation is the canonical example of a documented chain working in reverse: every gap was forensically reconstructable from the records, and every gap had a regulatory consequence.
Hot-work and confined-space permits move from paper packets to mobile-first PTW with atmospheric testing logs, attendant attestations, and fire-watch verification all captured digitally. Permit heat maps show overlap hazards in real time, preventing the kind of concurrent-operations conflicts that historical incidents have made famous.
Contractor management runs the full PSM lifecycle: pre-qualification documents, training records, induction acknowledgements, work-period access permissions, and post-job evaluation. Every step is timestamped and reconstructable.
Incident investigation runs on structured methods (5 Whys, PEEPO, or full-scale TapRooT-style investigations) with evidence chains preserved. Recurrence detection surfaces patterns across the global operation, which is essential when the same root cause may appear three years apart at facilities in different countries.
PSM compliance audits run on a three-year cycle. Operations that maintain queryable records all year pass cleanly; operations that scramble to assemble evidence at audit time accumulate findings. The shift from a once-every-three-years scramble to a continuously-audit-ready posture is the single biggest operational improvement in PSM since the standard was written.
Haloehs maps to the 14 PSM elements out of the box. Process hazard analysis, operating procedures, training, contractors, pre-startup safety review, mechanical integrity, hot work, management of change, incident investigation, emergency planning, compliance audits, trade secrets, employee participation, and recordkeeping each have a defined data path. The 2022 ISO Survey counted 294,420 valid ISO 45001 certificates worldwide; oil and gas operations are over-represented in that population, and the same data paths support both PSM and ISO 45001 evidence chains.
The Haloehs modules most directly relevant to oil & gas operations.
Empower every worker to report hazards in seconds. AI auto-classifies and routes observations for review, with anonymous reporting built in.
From first report to verified closure. AI-generated titles, 5 Whys and PEEPO investigation, CAPA generation, and recurrence detection across history.
Your command center for every CAPA across every module. Personalized task lists, automated reminders, evidence-based closure, and effectiveness tracking.
Standards and regulations the platform is built to evidence.
How to run incident investigations that prevent recurrence. The 5 Whys finds root cause, PEEPO finds blind spots, and BLS data shows 2.8M reasons it matters.
ISO 45001 requires CAPA. Most operations log them; few close them effectively. Here is how to track corrective actions to verified closure and prove the loop.
Spreadsheet-driven EHS programs miss patterns and fail audits. With US workplace injuries costing $58.5B/yr, the upgrade case is data-driven.
Multi-site, multi-contractor construction operations need EHS that fits the site, not the office. JSA, fall protection, PTW, and contractor onboarding in one platform.
LOTO, machine guarding, ergonomics, near-miss capture, and audit-ready records. Haloehs fits the line, not the office.