Skip to main content
An investigation is a structured process to determine the facts, conditions, and circumstances of a safety event, identify root causes, and recommend corrective or preventive actions (CPAs). Investigations are initiated from safety reports and are a core component of Safety Assurance under 14 CFR Part 5 Subpart D. ICAO Annex 13 establishes a 30-day target for preliminary report completion.

Investigation Statuses

StatusAPI ValueDescription
NewnewInvestigation created and assigned. Scope and initial facts being established.
Data Collectiondata_collectionActive evidence gathering underway — witness interviews, document collection, flight data extraction.
AnalysisanalysisRoot cause analysis in progress — applying 5 Whys, Fishbone, or Barrier Analysis methods. Findings being documented.
ReviewreviewInvestigation report submitted for safety manager review and approval.
CompletedcompletedInvestigation complete. All findings finalized, CPAs generated. Record is immutable.

Status Lifecycle

Status Transition Rules

FromToPermitted RolesConditions
NewData CollectionLead investigator, safety managerAt least one investigator assigned
Data CollectionAnalysisLead investigatorEvidence collection sufficient to begin analysis
AnalysisReviewLead investigatorAt least one root cause documented; investigation report narrative complete
ReviewCompletedSafety manager, adminReview complete; findings accepted; all recommended CPAs created
ReviewData CollectionSafety manager, adminReturn reason documented

View Modes

The investigation list supports two display modes. Users can toggle between them at any time.
ModeDescriptionBest For
KanbanColumns represent statuses (New, Data Collection, Analysis, Review, Completed). Investigation cards move left to right as they progress. Drag-and-drop supported for permitted transitions.Visual tracking of investigation pipeline and workload distribution.
ListSortable, filterable table view with columns for status, assignee, linked reports, priority, and age.Bulk review, sorting by due date, and exporting investigation data.

Investigation Roles

RoleResponsibilities
InvestigatorCollects evidence, conducts interviews, documents facts, performs analysis. Can be assigned to one or more investigations.
Lead InvestigatorCoordinates the investigation team, manages scope and timeline, authors the investigation report, submits findings for review. Responsible for root cause analysis.
Safety ManagerAssigns investigations, reviews findings, approves or returns reports, ensures CPAs are generated and tracked. Has oversight of all investigations within the workspace.

Root Cause Analysis Methods

PlaneConnection provides three structured RCA methodologies accessible from the investigation’s Analysis tab.
Iterative questioning technique that traces causal chains from the event back to the root cause.
FieldDescription
event_statementDescription of the event being analyzed.
why_1 through why_5Each successive “why” question and answer.
root_causeThe fundamental cause identified at the end of the chain.
Applicability: Simple, linear cause chains. Effective for operational and procedural failures.
Categorized cause-and-effect diagram that organizes contributing factors into standard categories.
CategoryScope
PeopleHuman factors, training, fatigue, experience, communication.
ProceduresSOPs, checklists, regulatory requirements, documentation.
EquipmentAircraft systems, ground equipment, tools, software.
EnvironmentWeather, airport conditions, organizational culture, time pressure.
ManagementSupervision, resource allocation, scheduling, policies.
MaterialsFuels, fluids, parts, supplies, documentation materials.
Applicability: Complex events with multiple contributing factors across different domains.
Examines the defenses (barriers) that should have prevented the event and identifies where they failed or were absent.
FieldDescription
hazardThe identified hazard or threat.
targetThe person, asset, or system that was harmed or at risk.
barriersList of barriers (physical, procedural, administrative) that existed or should have existed.
barrier_statusFor each barrier: effective, failed, bypassed, or absent.
gap_analysisExplanation of why each failed or absent barrier did not perform as intended.
Applicability: Events involving defense-in-depth failures. Particularly effective for incidents where multiple safeguards broke down.

Findings Documentation

A finding is a factual statement about a condition, event, or practice identified during the investigation. Each finding includes:
FieldTypeDescription
titleStringBrief description of the finding.
descriptionTextDetailed narrative of what was found.
categoryEnumprocedural, training, equipment, environmental, organizational, human_factors.
contributing_factorBooleanWhether this finding is a contributing factor to the event.
evidenceArrayReferences to supporting evidence (documents, photos, interview records).
created_atTimestampWhen the finding was documented (UTC).

Timeline Tab

The investigation Timeline tab provides a chronological reconstruction of the event. Each timeline entry includes:
FieldDescription
timestampDate and time of the event or action (local time with UTC offset).
descriptionWhat occurred at this point.
sourceHow this information was obtained (interview, flight data, ATC recording, document review).
evidenceLinked evidence items supporting this entry.
The timeline is sortable and filterable. It serves as the factual backbone of the investigation report. Investigations produce recommended Corrective and Preventive Actions. Each recommendation includes:
FieldTypeDescription
titleStringShort description of the recommended action.
descriptionTextDetailed description of what should be done.
typeEnumcorrective (addresses existing deficiency) or preventive (prevents future occurrence).
priorityEnumcritical, high, medium, or low.
When approved, recommendations are converted into CPA records that enter the CPA lifecycle.

ICAO Annex 13 Compliance

RequirementTargetPlaneConnection Feature
Preliminary report30 days from eventAge indicator on investigation cards. Amber warning at 21 days, red at 30 days.
Final report12 months (target)Due date tracking and overdue notifications.
Non-punitive purposeInvestigation for prevention, not blameJust Culture framework integration.

Linked Records

An investigation can be linked to:
  • One or more safety reports — the originating events.
  • One or more CPAs — the resulting actions.
  • Risk assessments — associated hazard evaluations.
  • MOC records — if the event relates to a change management process.

Regulatory Alignment

Part 5 SectionRequirementInvestigation Component
5.71(a)(4)Employee safety reportingLinked safety reports
5.73Safety performance assessmentFindings and root cause analysis
5.75Continuous improvementRecommended CPAs
5.97SMS recordsInvestigation records retained minimum 5 years

Report Statuses

How report statuses connect to investigation triggers.

CPA Lifecycle

Lifecycle for actions generated from investigation findings.

Manage Investigations

Run an investigation from initiation to closure.

Just Culture Framework

Behavior classification framework used during investigations.
Last modified on April 11, 2026