What needs to be finished first
A complete chronological timeline of the incident with timestamps, actors, actions, and observations is available.
The investigation team works in a blameless setting with psychological safety so that management oversight failures can be openly named.
What needs to be ready before start
MORT diagram (standard tree with approx. 1,500 nodes); worksheet template with columns for node, status (Less Than Adequate, Adequate, Not Applicable), evidence, owner; access to documentation, logs, interviews; version control for worksheets.
A MORT-experienced investigator (lead); two to four investigators with domain expertise; a sponsor with mandate (often safety or compliance lead); interview partners from operations and management.
Incident description with damage profile; timeline; list of relevant processes, procedures, trainings, audits; known prior incidents; management structure and accountability lines.
Several days to weeks
Make the MORT diagram visible on a wall or in a tool. Set up the worksheet template. Kickoff with sponsor to align mandate, confidentiality, and reporting deadline; pre-plan interview slots.
The one question this method answers
Which specific controls and which management oversight functions were involved in the incident, were effective, insufficient, or missing, and which systemic levers follow from this?
Marker: Phase
| Step | Duration | Action | Hint |
|---|---|---|---|
1Phase 1: Mandate and scope | 1 day | Sponsor briefing: define investigation scope, confidentiality, reporting deadline, and output format. Name team and interview partners. Set definition of done for the report (for example findings, recommendations, systemic causes). | Without clear mandate, Phase 4 (management branches) stalls early. Sponsor must confirm in writing that management findings can be published. |
2Phase 2: Consolidate evidence base | 2-4 days | Finalize timeline. Collect documents (procedures, audits, trainings, test protocols). Conduct initial interviews. Prepare data basis for each MORT node. | Interviews without psychological safety yield sanitized answers. Communicate the blameless norm and sponsor confirmation before interviewing. |
3Phase 3: Review specific controls | 3-7 days | Review the left MORT main branch (Specific Control Factors) node by node against the incident. For each node set status (Less Than Adequate / Adequate / Not Applicable) and evidence. | There is a temptation to only test controls that obviously failed. Full traversal of nodes is the method core. Half a MORT is no MORT. |
4Phase 4: Review management oversight | 2-5 days | Review the right main branch (Management System Factors) node by node: policy, implementation, risk assessment, lessons learned, trainings, audit accountability. Back findings with evidence. | This phase is most politically sensitive. Findings must be evidence-based, not speculative. Secure sponsor mandate and escalate if needed. |
5Phase 5: Findings, systemic causes, recommendations | 2-3 days | Categorize less-than-adequate nodes as findings. Extract systemic causes across multiple nodes. Formulate recommendations: immediate, medium term, structural. Add owner and deadline per recommendation. | Findings without recommendations become shelfware. Recommendations without owner and deadline are also shelfware. Both are required. |
6Phase 6: Review and handover | 1-2 days | Review report with sponsor. Incorporate factual corrections without watering down findings. Deliver final report including worksheets and schedule follow-up implementation check in 3-6 months. | Removing findings at sponsor request prevents learning. Wording debates are acceptable, substance debates are not. If needed, document dissent. |
What comes out at the end
Investigation report with executive summary, timeline, MORT worksheets (status per node), findings by category, systemic causes, recommendations with owner and deadline, and appendix with evidence references.
Include date, incident ID, investigator, and sponsor in header. Store worksheets in separate tabs or files. Revisions include date and preserve previous versions. Reference follow-up report in final report.
Compact working template for MORT Analysis with context, input, output artifacts, and next step.
| Element | Description | Rating | Evidence | Owner | Next step |
|---|---|---|---|---|---|
| 1 | |||||
| 2 | |||||
| 3 |
What consequence follows from the matrix?
Concrete filled scenario, fictional example
Concrete filled scenario, fictional example
Damage: No injuries, EUR 1.2m property damage, six weeks of production outage.
Mandate: Sponsor @sabine (site management), confidentiality class C, internal publication. Six-week investigation.
Specific Controls worksheet excerpt:
Management system factors worksheet excerpt:
Systemic causes:
Recommendations (excerpt):
Recognize symptoms and steer against them
Sponsor expects a quick root-cause list and does not accept MORT depth, particularly in Phase 4.
Secure written mandate before start with explicit clause for management findings. If publication is not possible, stop MORT and choose another method.
Worksheets mark only 50 nodes as reviewed, while the standard tree has about 1,500. Completeness claim collapses.
All nodes must be traversed, at least as Not Applicable with rationale. Unreviewed nodes indicate weak diligence.
Sponsor removes uncomfortable management findings in review, reducing report usefulness.
Factual corrections are acceptable; removing substance is not. Document dissent if necessary. Return investigator mandate if dissent cannot be recorded.
Report is delivered, recommendations are not tracked, and root causes recur.
Plan mandatory follow-up in 3-6 months with sponsor. Use a tracking tool or audit list. Repeated incidents indicate MORT failure.
Employees stay silent from fear, and worksheets remain vague.
Communicate blameless principle in advance, confirm confidentiality, and have sponsor sign off on the principle. Reference statements anonymously in worksheets.
Incident is small, MORT effort spreads across all nodes and nobody reads the report.
Check before start: does the damage justify MORT? For small incidents use five whys or fishbone. Use MORT only for regulatory or severe incidents.
Done signals checkable in under a minute
Go to the profile for purpose, similar methods, and sources or continue to the next method in the catalog.