Incident investigation management procedures