Investigation Data and Chain of Custody

Why This Topic Matters
Incident investigation is one of the core competencies tested in the BCSP Associate Safety Professional (ASP) exam under the Safety Programs and Concepts domain. An investigation is only as good as the data it is built on. If evidence is lost, altered, contaminated, or cannot be shown to be authentic, the conclusions drawn from it become questionable, the corrective actions may target the wrong cause, and the organization may be unable to defend itself in regulatory, civil, or criminal proceedings. Chain of custody is the procedural backbone that proves evidence is what it claims to be and has not been tampered with from the moment it was collected until it is presented or disposed of. Examiners expect you to understand both the technical side (what to collect and how) and the legal and administrative side (how to document, secure, and transfer it).

What Is Investigation Data?
Investigation data is any information gathered to determine what happened, how it happened, and why it happened. It is commonly organized into categories often remembered by the Four Ps (sometimes expanded to Five Ps):

1. People – Witness statements, injured party accounts, supervisor interviews, training records, medical information, fatigue and shift data.
2. Parts – Physical evidence such as failed components, tools, PPE, guards, chemical containers, residues, and fragments.
3. Positions – Where people, equipment, and materials were located at the time of the event, captured through photographs, sketches, measurements, and marking of the scene.
4. Papers – Documentary evidence including procedures, permits (hot work, confined space, lockout/tagout), maintenance logs, inspection reports, SDSs, training sign-in sheets, and prior incident reports.
5. Paradigms/Programs (the fifth P) – Organizational culture, management systems, production pressures, and underlying policies that shaped behavior.

Investigation data can also be classified by form:
• Physical evidence – tangible items; most vulnerable to being moved, cleaned up, or discarded.
• Documentary evidence – paper and electronic records; vulnerable to being revised or deleted.
• Testimonial evidence – interviews and statements; degrades rapidly as memory fades and witnesses talk to each other.
• Electronic/digital evidence – video surveillance, data loggers, PLC histories, badge access records, vehicle event data recorders, phone records; often overwritten automatically after a set period.
• Environmental data – air sampling results, noise levels, lighting measurements, temperature, weather, housekeeping conditions.

What Is Chain of Custody?
Chain of custody is the chronological, documented record showing the seizure, custody, control, transfer, analysis, and disposition of evidence. Its purpose is to demonstrate that the item presented later is the same item collected at the scene and that it has not been altered, substituted, or contaminated. If the chain is broken, meaning there is a gap in time or an undocumented transfer, the evidence may be ruled inadmissible or its credibility seriously weakened.

A complete chain of custody record typically includes:
• A unique identifier or evidence number for each item
• A description of the item (what it is, condition, quantity, markings)
• Where exactly it was found (location, position, orientation)
• Date and time of collection
• Name and signature of the person who collected it
• Name, signature, date, and time for every person who subsequently received or released the item
• Purpose of each transfer (storage, laboratory analysis, legal review)
• Storage location and security conditions
• Final disposition (returned, destroyed, retained)

How It Works: The Investigation Data Process

Step 1 – Respond and Secure the Scene
The first priorities are always rescue, medical care, and eliminating ongoing hazards. Once the scene is safe, it must be secured with barricades, tape, or guards to prevent unauthorized entry and disturbance. Nothing should be moved, cleaned, repaired, or restarted until the investigator releases the scene, unless necessary to protect life or prevent further damage. If something must be moved, its original position should be photographed or marked first.

Step 2 – Prioritize Perishable Evidence
Collect evidence in order of fragility. Transient or perishable evidence goes first: spills, liquid levels, skid marks, odors, positions of controls and switches, weather conditions, lighting, and the recollections of witnesses. Durable evidence such as heavy equipment or written procedures can wait. Digital video should be requested and preserved immediately because many systems overwrite footage within days.

Step 3 – Document Before Disturbing
Photograph the scene from general to specific: overall views, mid-range views, then close-ups with a scale reference such as a ruler. Create a photo log recording the date, time, photographer, and what each image shows. Prepare sketches and take measurements to fix positions of people, equipment, and evidence. Video walk-throughs are useful. Documentation should be objective; avoid staging or editing images.

Step 4 – Collect, Label, and Package
Each item is assigned a unique number, tagged, and recorded on an evidence log. Use appropriate containers: paper bags for items that may hold moisture (to prevent mold), sealed and labeled jars for liquids, anti-static bags for electronics, rigid containers for fragile parts. Wear gloves to prevent contamination. Do not clean, test, disassemble, or repair components before documentation; destructive testing should only be performed after all parties with an interest (insurers, manufacturers, legal counsel) have been notified and have had the opportunity to observe.

Step 5 – Interview Witnesses
Interview as soon as possible, individually, in a private and non-threatening setting. Begin with open-ended questions, let the witness narrate without interruption, then ask clarifying questions. Avoid leading questions and avoid assigning blame. Document statements accurately and have the witness review and sign where practical. Record the date, time, location, and persons present. Witness information is testimonial data, and the record of it should be handled with the same care as physical evidence.

Step 6 – Preserve Documentary and Electronic Records
Issue a litigation hold or preservation notice if there is any potential for legal action. Obtain originals or certified copies of procedures, permits, training records, and maintenance logs as they existed at the time of the incident. Download data from PLCs, data recorders, and access control systems using methods that do not alter the source data, and document who extracted it and how.

Step 7 – Store Securely and Control Access
Evidence should be kept in a locked, access-controlled location with a log of who enters. Environmental conditions should be appropriate to the item (refrigeration for biological or certain chemical samples). Access should be limited to those with a need to know.

Step 8 – Transfer with Documentation
Every time evidence changes hands, both the releasing and receiving parties sign and date the chain of custody form. When shipping samples to a laboratory, the chain of custody form travels with the samples, seals are placed on containers and coolers, and the lab documents seal condition on receipt.

Step 9 – Analyze and Interpret
Analysis should be performed by qualified personnel using accepted methods. For industrial hygiene samples this means accredited laboratories (for example, AIHA-LAP accredited) using validated analytical methods, with field blanks, media blanks, duplicates, and calibration records to support data quality.

Step 10 – Retain and Dispose
Retain evidence and records for the period required by regulation, company policy, and legal counsel. Key regulatory retention periods to remember: OSHA injury and illness records (Forms 300, 300A, 301) must be kept for five years following the end of the calendar year they cover; employee exposure records must be retained for at least 30 years under 29 CFR 1910.1020; medical records generally for the duration of employment plus 30 years. Disposal should be documented as the final chain of custody entry.

Chain of Custody in Industrial Hygiene Sampling
The ASP exam frequently connects chain of custody to exposure monitoring. Key points: calibrate sampling pumps before and after sampling and record the values; label each sample with a unique ID, date, worker or location, sampling time, and flow rate; include field blanks that are handled identically but not exposed; seal samples; complete the chain of custody form listing all samples and the analysis requested; ship under appropriate conditions; and retain lab reports with the chain of custody documentation. Without an intact chain of custody, exposure data cannot be relied upon to demonstrate compliance with a PEL or to defend against a claim.

Data Quality and Integrity Principles
Good investigation data is accurate (reflects reality), complete (nothing important is missing), objective (free of bias and conjecture), timely (captured before it degrades), traceable (its source and handling are documented), and secure (protected from loss or alteration). Investigators should separate facts from assumptions and clearly label any inference. Original records should never be altered; corrections are made by a single line-through, initialed and dated, so the original entry remains legible.

Legal Considerations
• Attorney-client privilege and work product – Investigations conducted at the direction of legal counsel in anticipation of litigation may be protected; investigators should follow counsel guidance on report distribution.
• Spoliation – Destroying or altering evidence, even negligently, can result in sanctions, adverse inferences, or loss of a case.
• Regulatory access – OSHA compliance officers have the right to examine records and the scene; employers should cooperate while documenting what is provided.
• Privacy – Medical information and personal data must be handled in accordance with applicable privacy requirements.
• Fatality and serious incident reporting – Fatalities must be reported to OSHA within 8 hours; inpatient hospitalizations, amputations, and loss of an eye within 24 hours. The scene of a fatality or catastrophe should be preserved for the compliance officer.

Common Mistakes That Break the Chain
• Allowing cleanup or restart before documentation
• Failing to photograph items before moving them
• Unlabeled or ambiguously labeled samples
• Gaps in the custody log (an item leaves one person without a record of who received it)
• Storing evidence in unlocked or shared areas
• Testing or disassembling parts without notifying interested parties
• Interviewing witnesses in groups, which contaminates recollections
• Letting video or electronic logs overwrite
• Altering original documents instead of annotating copies

Exam Tips: Answering Questions on Investigation Data and Chain of Custody

Tip 1 – Remember the order of priorities. Life safety first, then hazard control, then scene security, then evidence collection. If a question asks what to do first after an incident, the answer is almost never collect evidence; it is care for the injured and make the area safe. Only once the scene is safe does evidence preservation begin.

Tip 2 – Perishable evidence comes before durable evidence. When a question asks which evidence to collect first, choose the most transient option: liquid spills, positions of controls, weather, skid marks, witness recollections, or video that may be overwritten. Procedures and heavy equipment can wait.

Tip 3 – Document before you disturb. Any answer choice that involves moving, cleaning, repairing, restarting, or disassembling before photographing and recording is wrong. The correct response is to photograph, sketch, measure, and log first.

Tip 4 – Know what belongs on a chain of custody form. Expect questions listing elements and asking which is required or which is missing. The essentials are unique ID, description, collection location, date and time, collector signature, and a signature for every transfer. A missing signature between two custodians is a broken chain.

Tip 5 – Think like a lawyer. When the question involves potential litigation, the best answer protects admissibility: secure storage, documented transfers, notification of interested parties before destructive testing, preservation holds, and never altering originals. Be alert to the term spoliation.

Tip 6 – Apply the Four Ps. If a question asks about categories or completeness of investigation data, map the options to People, Parts, Positions, and Papers. A thorough investigation collects from all four.

Tip 7 – Witness interviews follow consistent rules. Correct answers emphasize interviewing promptly, individually, privately, with open-ended and non-leading questions, in a non-blaming manner, and documenting the statement. Choices involving group interviews, leading questions, or delaying interviews are distractors.

Tip 8 – Memorize key retention periods. Five years for OSHA 300 logs; 30 years for exposure records; duration of employment plus 30 years for medical records. Also know the 8-hour fatality and 24-hour hospitalization, amputation, and eye-loss reporting deadlines.

Tip 9 – Connect chain of custody to industrial hygiene sampling. Questions may describe a sampling scenario and ask what invalidates the result. Look for missing field blanks, missing pre- and post-calibration, unsealed containers, or missing custody signatures. Any of these undermines data defensibility.

Tip 10 – Facts versus conclusions. Questions on report writing often test whether you can distinguish objective data from opinion. The investigator records what was observed and measured, states conclusions separately, and avoids assigning blame. Root cause findings should trace back to specific documented evidence.

Tip 11 – Watch for absolute and best-practice language. The ASP exam often asks for the best or most appropriate action. Choose the option that is most systematic, most defensible, and most consistent with recognized investigation practice, even if other options are not strictly wrong.

Tip 12 – Eliminate distractors through consequence thinking. For each option, ask: would this action lose, alter, or contaminate evidence, or leave an undocumented gap? If yes, eliminate it. The remaining option is usually correct.

Quick Review Summary
• Investigation data includes people, parts, positions, papers, and programs.
• Secure the scene, collect perishable evidence first, and document before disturbing anything.
• Chain of custody is the unbroken, signed, dated record of who had the evidence, when, and why.
• Every item needs a unique ID, description, location, time, collector, and transfer signatures.
• Store evidence securely, notify interested parties before destructive testing, and never alter originals.
• Interview witnesses promptly, individually, and without leading or blaming.
• Retention: 5 years for injury logs, 30 years for exposure records; reporting: 8 hours for fatalities, 24 hours for hospitalization, amputation, or loss of an eye.
• Defensible data supports accurate root cause analysis, effective corrective actions, regulatory compliance, and legal protection.