The Eight Step Investigation
Every investigation we run moves through the same eight steps. The order matters more than any single step, and the order is the thing clients most often want to skip. They want the answer before the map, the remedy before the source. We have learned to hold the sequence, because a remedy aimed at the wrong step does nothing but spend money.
This is the method. It is not a secret. It is a discipline, and the discipline is what makes it work.
The eight steps
Here they are, in order.
- Symptom: name precisely what is going wrong, and where it shows.
- Map: draw the system the symptom sits in, the people, the handoffs, the rules.
- Evidence: gather what can be checked, and separate it from what is merely asserted.
- Source: trace the symptom back to the point where it originates.
- Pattern: look for the repeating behaviour that keeps producing the symptom.
- Test: try to falsify your own conclusion before you trust it.
- Rule: name the underlying rule, belief, or design choice that holds the pattern in place.
- Remedy: change the rule, then check that the symptom actually moved.
Each of these deserves a little more than a line, because each is where investigations usually fail.
Step one: name the symptom
The symptom is what you can see. Attrition is high. Defects are rising. Complaints take too long. A project keeps slipping. Naming it precisely means saying where and when it shows, and how you would measure it. A symptom described vaguely cannot be traced, because you cannot tell whether it has moved. Half the value of the first step is forcing the vague complaint into a shape you can follow.
Step two: map the system
Nothing happens in isolation. A symptom sits inside a system: a sequence of steps, a set of people, a chain of handoffs and approvals. The map shows you where to look. It also shows you what you do not yet understand, which is useful. We draw the map even when we think we already know the answer, because the map regularly contradicts what we thought. The map is where the investigation earns its keep.
Step three: gather evidence
Evidence is what can be checked by someone other than the person who offers it. Records, logs, dates, numbers, documents, observed behaviour. We gather it before we theorise, so that the theory has something to stand on. This is the step where the earlier work on evidence over assurance pays off. A file full of impressions is not ready for the next step.
Step four: find the source
The source is where the symptom begins. Not where it is noticed. Not where it is painful. Where it starts. This is the step clients most want to shortcut, because the source is often not where the complaint was made. A defect that appears in the final product may start in a supplier conversation three months earlier. A resignation that lands on a manager's desk may start in a hiring decision made by someone else. You find the source by following the symptom backward, one link at a time, until the chain stops producing new causes.
Step five: find the pattern
One occurrence can be bad luck. A pattern cannot. We look for the behaviour that repeats: the same mistake across different teams, the same delay every quarter, the same friction at the same handoff. The pattern tells you the symptom is not accidental. It is being produced, reliably, by something in the system. Patterns are the strongest signal an investigator has, because they point at structure rather than at a person having a bad day.
Step six: test
Before we trust a conclusion, we try to break it. We ask what would have to be true for us to be wrong, and we go looking for that thing. We check whether the source we found actually explains the symptom, or only seems to. We look for a competing explanation and see whether it fits the evidence better. Most investigations we review skip this step, and most of the ones that fail later failed here.
Step seven: name the rule
Under the pattern there is a rule. It may be a written rule, a policy that produces the wrong behaviour. It may be an unwritten rule, a belief the team holds about how things work. It may be a design choice, a process that makes the bad outcome the easy one. Naming the rule is the turning point, because the rule is what you can actually change. Fixing the symptom without naming the rule guarantees the symptom returns.
Step eight: remedy and recheck
The remedy changes the rule, not the symptom. Then it checks whether the symptom moved. This is the step that separates an investigation from a report. A report describes. An investigation changes something and confirms it changed. If the symptom has not moved, the rule was not the one holding it, and we go back. We would rather loop than declare a victory the data does not support.
Why the order matters
The steps build on each other. You cannot find the source without a map. You cannot trust the source without evidence. You cannot find the rule without the pattern. You cannot choose a remedy without the rule. Skipping a step does not save time. It moves the cost to the end, where it is highest, in the form of a fix that does not fix.
We have been asked to jump straight to the remedy, more than once, and we understand the pressure. The answer is that a remedy chosen before the source is a guess. Guessing is what we are for avoiding.
What the method gives you
It gives you a finding you can defend, because every step is on the record. It gives you a fix that holds, because it targets the rule. And it gives you something quieter: a way of thinking that transfers. Clients who watch the method once start running it themselves, which is the outcome we want.
Eight steps, in order, every time. The order is the method, and the method is the point.
We don't guess. We investigate, from the symptom to the source, and then we change the rule.