The Evidence is Gone

The Problem

The call comes in at 2 AM. By 6 AM, the failed bearing has been cleaned, bagged, and set on a shelf. The equipment is back online. The shift crew has gone home. The DCS trend that captured the last four hours before the event has been overwritten by the next shift’s data.

Three days later, someone opens an RCA.

The investigation is already compromised — and nobody did anything wrong. The technicians restored production as fast as they could. The supervisor documented what he saw. The planner closed the work order. Everyone did their job. But the evidence that would have made the investigation rigorous is gone, and the RCA that follows will be built on memory, opinion, and whatever paper trail happens to survive.

This is the preservation failure. It happens before the first “why” is ever asked.

Getting to the Root Cause

The root cause isn’t negligence. It’s a program design that treats evidence collection as an investigation task rather than an emergency response task.

Most RCA programs trigger after the repair. By then, the most valuable data — positional evidence, wear patterns, DCS snapshots, eyewitness accounts taken at the scene — has already been altered, overwritten, or dispersed. The sequence is backwards. Repair first. Investigate second. Preserve never.

Three specific gaps drive this pattern:

1. No preservation reflex in the emergency response. Technicians are trained to restore function. Unless someone has explicitly taught them that a failed component is evidence — not scrap — the bearing gets cleaned, the coupling gets replaced, and the scene gets reset. By the time an analyst arrives, the physical story has been erased.
2. Digital data has a shelf life nobody tracks. DCS historians, vibration monitoring systems, and alarm logs don’t hold data indefinitely. A system logging every 10 seconds will never capture an event that unfolded in three. And no one is responsible for pulling and preserving that data the moment an event is flagged.
3. Eyewitness value degrades fast. The operator who felt the vibration change, heard the noise, or noticed the temperature climb before the alarm triggered is the most valuable witness in the investigation. Twenty-four hours later, memory has already been contaminated by conversation, by sleep, and by the team’s informal consensus about what happened. Seventy-two hours later, the details that mattered most are gone.

Corrective Action (You Can Do This Week)

You don’t need a new RCA program to fix this. You need a one-page preservation checklist that lives with your emergency response procedure — not your investigation procedure.

Build it around four actions that happen before the repair is complete:

• Photograph the scene before anything is touched. Component position, wear patterns, fluid paths, and visible damage tell a story that disappears the moment a wrench is picked up. Two minutes with a phone camera preserves evidence that no amount of analysis can reconstruct later.
• Pull and save the digital data immediately. Identify the historian, the DCS trend, and any condition monitoring records relevant to the asset. Pull a window that starts at least two hours before the alarm triggered and save it to a named folder before the next shift overwrites it.
• Separate the failed component before it gets cleaned or scrapped. Tag it with the date, asset ID, and event number. A cleaned bearing tells you nothing. An unaltered bearing tells a metallurgist or reliability engineer exactly how it failed and why.
• Interview the first witness at the scene — not in a conference room three days later. One conversation at the equipment, asking what they noticed, heard, or felt before the event, recovers information that no post-incident report will ever capture.

None of these steps require an analyst to be on-site. They require one person, with a short checklist, who understands that evidence has a half-life.

What Do You Think?

What’s the most valuable piece of evidence you’ve ever lost before an investigation started? And what finally got your team to treat the scene as something worth protecting? Drop a comment below — I’d love to hear what changed the habit.

Help If You Need It

If your investigations consistently start with incomplete evidence, the fix is rarely more training for analysts. It’s a preservation protocol built into your response process — so the right data is captured before anyone thinks to ask for it.

We work with teams on exactly this problem. RCA software like EasyRCA prompts evidence collection as part of the investigation launch, not as an afterthought, so preservation becomes part of the workflow rather than something that gets remembered too late. And if your team needs the foundational skills to know what evidence to look for and why it matters, root cause analysis training builds that capability from the ground up. Reach out — we’d love to help you get there.