GROUND TRUTH · ENGINEERING CAREERS
Engineering Investigations Get Harder as More People Join
More people investigating a problem should mean more coverage. It can just as easily mean more confusion about what has already been checked.
Add more people to an investigation, and the hardest part can become keeping everyone aligned.
It seems intuitive that a serious engineering failure, a production line stopped, a service outage affecting customers, a safety-relevant defect found in the field, should be investigated by more people, faster, because more people means more hands checking more possibilities at once. In practice, teams that have run large incident investigations often report the opposite experience: past a certain point, adding more people to an investigation does not speed it up, and can actively slow it down, because the coordination cost between investigators starts to exceed the benefit of the additional coverage they provide.
One person's mental model does not automatically transfer to a group
A single engineer investigating a problem builds up an internal, evolving picture of what has been checked, what has been ruled out, and what still seems suspicious, entirely inside their own head, updated continuously as they work. That picture never has to be communicated to anyone else in order to be useful. It only has to be correct. The moment a second person joins the investigation, that private, continuously updating picture has to be externalized: written down, spoken aloud, or otherwise made visible, or the two investigators will end up working from two different, silently diverging versions of what is already known. This externalization takes real time and effort, and it is easy to underestimate how much of an investigation's total effort quietly shifts from "finding the answer" to "keeping everyone aligned on what has been found so far" as more people join.
The intuition vs what happens as an investigation grows
| What people think | What it actually is |
|---|---|
| More investigators means more ground covered, faster | Past a certain size, more investigators means more time spent synchronizing what each person has already found. |
| Everyone on the call has the same understanding of the problem | Different people often build subtly different mental models from the same facts, especially under time pressure, and those differences surface as contradictions later. |
| Parallel investigation of different theories is automatically efficient | Parallel investigation without a shared, updated record often produces duplicated work or two teams ruling out the same theory independently. |
Duplicated work is easy to produce and hard to notice
When several people are simultaneously chasing different leads on the same problem, without a clear, shared, continuously updated record of what has already been tried, it is remarkably common for two people to independently investigate the exact same theory, sometimes discovering the same dead end hours apart, having each spent real time reaching a conclusion the other had already reached. This is not a failure of individual competence; it is a structural consequence of parallel investigation without a strong shared source of truth. The fix is not fewer people. It is making sure that whatever each person finds, including a negative result ("I checked this and it was not the cause"), gets recorded somewhere everyone else can see quickly, so that a ruled-out theory stays ruled out instead of getting silently re-investigated by the next person who thinks of it.
Under pressure, communication quality tends to drop exactly when it matters most
A serious incident usually arrives with real time pressure, a system is down, customers are affected, or a safety concern is live, and under that pressure, people naturally communicate in shorter, less precise bursts: a quick message instead of a careful explanation, an assumption stated as if it were confirmed fact, a partial update that omits context because the person is already moving to the next check. This is a completely understandable response to pressure, and it is also exactly the condition under which miscommunication does the most damage, because a wrong assumption stated confidently and briefly can get treated by the rest of the group as settled fact, sending the whole investigation down a path that a calmer, more precise version of the same message would never have produced. Experienced incident leads often deliberately slow communication down at exactly the moment everyone else wants to speed it up, insisting on explicit confirmation of what is known versus suspected, precisely because that discipline tends to erode fastest under pressure.
Someone has to own the shared picture, or nobody does
The practical solution large engineering organizations converge on is rarely "fewer people investigate": a large failure may legitimately need many people's expertise. The solution is usually a designated coordinating role, separate from the people doing the hands-on technical investigation, whose entire job during the incident is maintaining the shared picture: what is confirmed, what is still a hypothesis, what has already been ruled out, who is checking what right now. Without that role, the shared picture belongs to no one in particular, which in practice means it quietly stops existing, and each investigator reverts to trusting their own private mental model: the exact single-person pattern that worked fine for one person and breaks down the moment several people are all doing it simultaneously about the same problem.
Junior engineers often absorb the most from watching how a lead runs an investigation
A large, well-run investigation is also, whether intended or not, a teaching moment for anyone less experienced who is part of it: watching a skilled incident lead insist on a confirmed-versus-suspected distinction, redirect a conversation away from an uncomfortable but avoided question, or slow down communication at the exact moment everyone else wants to rush teaches a kind of judgment that is hard to convey outside of watching it happen live under real pressure. Engineers who have been through several well-run investigations tend to carry those habits into how they handle much smaller problems on their own, long before they are the one formally leading anything.
Status updates can create the illusion of progress without producing it
A large investigation under pressure often develops a rhythm of frequent status updates, a call every thirty minutes, a constant stream of chat messages, that feels productive because there is visible activity happening continuously. This visible activity is not the same thing as actual progress toward the cause, and it is possible for a team to spend an enormous amount of collective time generating and consuming status updates about an investigation that, measured by how much closer it is to identifying the cause, has barely moved. Experienced incident leads sometimes deliberately reduce the frequency of full-group updates precisely because they have learned that constant synchronization has a real cost in interrupted, fragmented investigation time for the people doing the actual technical work: a investigator who is interrupted every ten minutes to give a status update spends a meaningful share of their available time context-switching rather than investigating, even though each individual interruption feels brief and reasonable in isolation.
Splitting an investigation by theory works better than splitting it by task
One structural choice that makes a large investigation more or less effective is how the work gets divided among the people involved. Splitting the work by loosely defined task, "you look at the logs, you check the hardware, you talk to the customer", tends to produce overlapping, poorly bounded investigations where it is unclear when any one person's piece is finished. A more effective division tends to be by theory: assign one credible hypothesis to one person or small group, give them clear ownership of confirming or ruling it out, and have them report back a definitive answer rather than a stream of partial updates. This makes it much easier for the person maintaining the shared picture to track real progress, "theory A is ruled out, theory B is still open, theory C has not been investigated yet", instead of trying to piece together status from several people's simultaneous, half-finished threads of activity.
A closed investigation still needs a single, agreed conclusion
A large investigation can reach a point where the failure stops recurring, the immediate pressure eases, and momentum toward writing up a firm conclusion quietly evaporates, different people involved walk away with somewhat different personal beliefs about what caused the problem, none of which get formally reconciled into one documented answer. This matters beyond intellectual tidiness, because the next time a similar symptom appears, whoever investigates it will look for a previous root-cause record to check against, and if that record does not exist or contains several conflicting theories instead of one confirmed conclusion, the next investigation effectively starts from zero rather than building on what was already learned. Closing an investigation properly, with one documented, agreed root cause, even if reaching agreement takes an uncomfortable conversation among people who found different partial evidence, is what converts the effort spent into something the organization can use again later.
What keeps a multi-person investigation from working against itself
- A single, shared, continuously updated record of what has been checked, confirmed, or ruled out, not several people's separate notes.
- A clear distinction, stated explicitly, between "confirmed" and "suspected but not yet verified."
- Someone whose job is coordinating the shared picture, separate from the people doing hands-on investigation.
- A habit of stating assumptions out loud rather than letting them pass silently as if already agreed.
- Deliberately slowing down communication precision exactly when time pressure makes everyone want to speed it up.
References and further reading
Background reading on the topic of this article. HireSetu is not affiliated with these organisations.