Running an investigation

When something goes wrong, the Investigations module walks you through a structured root cause analysis so you reach real causes, not just a name to blame. Each stage builds the next, and AI assistance helps you think it through.

Pick your method first

When you start an investigation you choose the analysis framework your team uses. TruStar Connect supports six, with no proprietary lock in, and the AI, the on screen categories, and the final report all adapt to the one you pick. If you are not sure which to use, the TruStar Method is the built in default.

1. 1
   Start and capture

   Create the investigation, attach the site, and capture what happened, who was involved, and any evidence.

2. 2
   Build the timeline

   Lay out the sequence of events so everyone shares the same picture.

3. 3
   Identify causal factors

   Work from the timeline to the factors that actually contributed.

4. 4
   Examine defenses

   Look at the barriers that should have caught the problem and why they did not.

5. 5
   Assign corrective actions

   Turn findings into specific actions with owners and due dates. These flow into Corrective Actions and the assignees’ task lists.

6. 6
   Review and finalize

   Review the whole analysis, then finalize to lock it and generate a polished PDF report with your logo.

How the timeline is built

Building the timeline reads every evidence document you captured, one at a time, then consolidates them into a single sequence. A progress bar shows which document is being read and how many are left, followed by the merge. Depending on the size of the investigation and the number of documents this can take up to several minutes, so keep the page open until it finishes.

Several statements will describe the same moment in different words. The merge collapses those into one event rather than listing each account separately, and marks how many sources corroborate it. If two sources genuinely disagree about a detail, the event is flagged as a conflict for you to resolve rather than silently merged.

Training records, competency matrices and certification histories are handled differently. They describe a person's qualifications rather than steps in the incident, so they never appear as timeline events. They are read for findings instead, which are attached as supporting evidence notes beneath the event they bear on. A gap such as training delivered with no observation recorded, or a demonstration date that predates the training date, shows up there where it informs the causal analysis without burying the sequence.

Order, and fixing it yourself

Source documents almost always record a single time for the whole job, so most events on a real investigation share one timestamp and the clock cannot put them in order. Each event is therefore placed in the part of the story it belongs to: the lead up, the incident, the response, then the aftermath. That order holds even when everything carries the same time, and it means an event from the lead up is never shown after the injury.

When the sources disagree, or you were there and know better, tap Reorder above the timeline. Drag an event by the handle on its left, or use the up and down arrows to move it a single step. Drag near the top or bottom of the screen and the page scrolls with you. Tap Save order when you are done, and that order is kept from then on.