November 28, 2022

A Conceptual Model for Critical Incident Analysis

by Elizabeth A. Kirby, Ed.D.


The purpose of this paper is to introduce a conceptual model designed for critical incident analysis.  The framework offered by this model is intended to guide the analysis of critical incidents and enhance the ability to understand, mitigate, and negotiate the episodes and incidents in society that have a great impact and deep significance for humankind. The model consists of three essential elements, the event, political arena, and authorized interveners, each of which is influenced by the media and context of the critical incident. An operational definition of a critical incident, identification of different types of incidents, and an overview of model components establish a common lens and foundation for rich and meaningful analysis. 

Keywords: conceptual model, critical incident, critical incident analysis


The critical incident analysis (CIA) model introduced in this article is a pictorial representation of the thinking that emerged over the last fifteen years among individuals affiliated with various groups, including the Critical Incident Analysis Group (CIAG) at the University of Virginia, and the National Center for Critical Incident Analysis (NCCIA) at the National Defense University.  In 2004, Dr. Frank Ochberg, a psychiatrist, representative of the Dart Foundation, and founder of the Dart Center for Journalism and Trauma, CIAG, NCCIA, and the Academy for Critical Incident Analysis (ACIA) at John Jay College of Criminal Justice (CUNY), convened a focus group to explore a collective interest of the complex and often-cruel nature of critical incidents. The group embarked on a mission to create a conceptual model that would guide analysis and meet a growing need to understand, manage, and mitigate such incidents.

From this effort, a model emerged that provides a conceptual framework of the essential elements of a critical incident and is illustrative of the dynamic interrelationships that exist among them.  The resulting value of the model will ultimately be determined within the context of its use.  This purpose of this article is to introduce the model as an instructional tool for novice students or individuals in the field of critical incident analysis.  The capacity of the model to enhance critical thinking processes and to propel the consumer towards new learning and sense making, along with the importance of clearly defining and categorizing critical incidents is explored.

Figure 1: A Model for Critical Incident Analysis

Source:  Ochberg, F., Cinti, S., Goodman, E., Houk, P., Kirby, E., Lammers, J., Melia, H., Prior, S., & Taggart, R. (2004). A Model for Critical Incident Analysis.

Defining Critical Incidents

A first step in understanding CIA is through definition.  Across disciplines, CIA has many variants and definitions of a critical incident are ubiquitous.  For the novice, multiple definitions can be confusing, therefore an effective approach to defining a critical incident would be one that first includes personal experience, reflection, and transformation of knowledge and meaning (Parker, Webb, and D’Souza, 1995).  Students are introduced to critical incidents by initially defining it as a significant event in one’s life, such as graduation, marriage, or a traumatic event. Defined in this way, critical incidents are life-changing events that influence a person’s life for a long period of time.  Through reflection on the impact of the event, the study of critical incident analysis is first situated within the learner’s personal experience.  This starting point is developmental in nature and marks an incremental step in helping the novice construct a deeper understanding of critical incident analysis.  They do this by “making connections, building mental schemata, and developing new concepts from previous understanding” (Roehler & Cantlon, 1996).

Unlike individual incidents, critical incidents in a social context are large-scale events that shock communities or nations and may draw global attention as they unfold.  They are usually traumatic and tragic, causing death or destruction.  Because they are unexpected and may involve new and unique method or targets, they shake individuals’ assumptions and can generate fear or wonder.  These incidents “generate extraordinary social concern” and “have the potential to change public opinion, policies, and even social values… (Carter, Kang, and Taggart, 1999, p. 6).  Through rich analysis and inquiry into these incidents, individuals move from a self-centered view of critical incidents, towards a new and transformative understanding that is collective, or communal in nature. Feelings anchored by first examining critical incidents in relation to personal experience helps open the door to empathetic understanding of the societal impact and consequences of a mega critical incident.

Providing a novice in CIA with a working definition of an incident establishes boundaries and removes ambiguity.  It narrows and sharpens the focus of the study by intentional grounding without limiting the scope of future development and exploration of the concept.  The following definition attributed to Frank Ochberg has been adopted for this purpose:

A critical incident is a relatively brief occurrence involving injury, loss, conflict, discovery or change of significant proportion, usually unscripted and unanticipated, with    the potential to alter existing societal norms. Critical incidents are usually traumatic, threatening the bonds of trust that bind communities, but may be positive, initiating historic consequents.  (Schwester, Dank, and Horning, 2008, p. 4)

Types of Critical Incidents

Other ways to reduce ambiguity occur when the learner begins to sort, categorize, and label critical incidents. Carter, Kang, and Taggart (1999) identified the three categories of critical incidents:  natural disasters; human error, or accidents; and purposeful human acts. Natural disasters are those that arise from natural phenomena.  Throughout history, these disasters have appeared in such forms as earthquakes, tsunamis, hurricanes, and wildfires. Recent examples of natural, uncontrollable events that carry significant consequence include the tsunami in Indonesia (2004), earthquake in Sichuan, China (2008), and Hurricane Katrina in New Orleans (2005).

Unlike natural disasters, incidents that arise from human complicity, error and negligence are ones that could have been avoided.  Examples in this category include aviation, industrial, and environmental crises, such as the nuclear reactor meltdown in Chernobyl (1986), the Bhopal industrial disaster in India (1984), and the crash of the Hindenburg (1937).

Incidents that are purposeful and arise from intentional acts create the third category.  These acts are deliberate and endanger one set of values for another.  They can be extremely complicated and often involve fervent issues related to religion, politics, and civil liberties.  Terrorists attacks such as the Oklahoma City bombing in 1995, the World Trade Center on September 11, 2001, and a series of suicide and car bombs throughout regions in the Middle East in 2008 provide examples of the destructiveness and disregard for human life characteristic of this kind of incident.  Intentional incidents are not always negative.  The first moon landing and the removal of the Berlin Wall are examples of purposeful incidents that are positive.  Another example would be positive outcomes or consequences that may emerge after a critical incident occurs.

Conceptual Models

Critical incidents are multi-dimensional and through deep analysis we can improve our understanding and management of such events. Given the complexity of these incidents, schematic frameworks can help learners remember information by creating meaningful linkages.  Conceptual models, and other types of mapping systems, “serve as a way for students to think explicitly about these connections” (Carnot & Stewart, 2006, p. 2).   Important linkages are established which can then be transferred to a broader understanding of a critical incident in a social context.  Conceptual models are research-based instructional tools that present frameworks to assist in developing cognitive structures as learners assimilate new concepts. Specifically, a conceptual model utilized for the study and analysis of critical incidents creates a common lens from which a variety of critical incidents can be viewed.  By applying a common lens, the similarities and differences among incidents become more evident. These comparatives help the learner narrow the focus and make meaning of the intent and ramifications related to critical incidents. The model also serves as a powerful means to organize thoughts, generate ideas, and examine multiple perspectives.  Critical incident analysis provides a rich context for discourse and when learners are supported by a conceptual model or framework, they are apt to present information and articulate complex ideas more effectively. Critical thinking processes and the ability to retain complex information is also enhanced.

Early Model

Critical incident analysis techniques emerged from studies conducted by the military in World War II in an effort to evaluate and classify psychological dimensions of human behavior. The applications of the technique were used to make inferences in related areas, such as performance criteria, training, motivation, and aptitude (Flanagan, 1954).  Building on the foundation of this seminal work, a conceptual model to analyze critical incidents was first introduced by Ochberg (1978) in the form of a flow chart. The early model, called the Hostage Incident Flow Chart, was narrow in scope and designed for analysis of a specific type of incident. It was created during an era of political hostage taking.  Hostage taking incidents, generally used by agents to extort concessions from governments, are highly calculated and publicized events.  Throughout history, humankind has generally sought two ways to bring about change, through rational discussion and negotiation, or by dramatic and often violent actions.  Driven by moral, psychological, and cultural ideologies, people tend to lose patience with the slow speed of change and government bureaucracy.  Hostage takers depend on the publicity to raise awareness of their cause and to stimulate a response.

Figure 2: The Hostage Incident Flow Chart

An illustration of how demands from a hostage taking incident cycle through the political arena and bureaucratic structures. These demands result in interventions and tactics that are used to negotiate and manage the incident.
Source:  Ochberg, F.M. (1978). The Victim of Terrorism. Practitioner. 220:1316, 293-302.

The flow chart was used to analyze hostage taking incidents and as a result, to emphasize the fact that siege managers, those delegated to handling the situation, had to calculate effects beyond the usual goals of public safety officials: saving lives, apprehending offenders, preserving evidence. With no good options, officials often faced public criticism and, in some instances, outrage.  This was the era of the Munich Olympics and the massacre of Israeli athletes (1972), and Carlos the Jackel (1975).  The volatility of hostage-taking events, especially terrorist hostage takers, demonstrates the complicated challenges negotiators and tactical response teams face as they attempt to resolve hostage/crisis events. The tragedies of failed negotiations and tactical rescue attempts at Ruby Ridge (1992) and Waco (1993) highlight the difficulty of peacefully resolving hostage/crisis situations.

Understanding human behavior in response to critical incidents will not necessarily provide solutions, however, designing new ways to conceptualize and analyze data provides valuable insight into the problem and contributes to the development of more effective protocols and standards of practice. The Hostage Incident Flow Chart represented another dimension of CIA.  It establishes the early origins of the current model and represents an important step in the journey of CIA as an interdisciplinary field of study.

Current Model for Critical Incident Analysis

The purpose of the current CIA model is to capture the interconnectedness of the different processes, players, and dependencies that converge during a critical incident. The model is not predictive, nor does it simulate what happens in all critical incidents.  In summary, the CIA conceptual model:

  • Presents a framework to help organize reporting and analysis of critical incidents;
  • Accentuates the similarities and differences among incidents; and
  • Provides a useful tool for training individuals to analyze critical incidents.

The current critical incident analysis model (See Figure 1) was designed to improve the collective understanding of events that threaten societal norms.  The model serves as a useful tool in training individuals to think critically as they analyze and critique significant incidents of this nature.  It provides a structure for the analysis and helps visualize a critical incident through discrete, yet interrelated components.

The three primary components in the model represent the event (threat), the political arena (trust), and authorized interveners (bureaucracy and adhocracy) of a critical incident. Through labeling, and then defining these components, the variability of possible meanings for the decoder decreases. However, each of the components is complex in itself and open to a wide range of interpretations. These interpretations will be unique to individual learner and subject to change as the context changes.  Tension created by different interpretations amongst learners can result in greater insight into the incident (Safayeni & Derbentseva, 2003).  An overview of each of the components contained in the model follows.

Figure 3. Primary Components of the Critical Incident Analysis Model

Model Components

The basic structure of the conceptual model is cyclical in nature and intentionally designed to demonstrate the interconnectedness of three key components. Similar to a cyclic concept map, the relationship between each component is dynamic.  Changes or a disturbance in one component contributes to changes or reactions from the subsequent component (Safayeni & Derbentseva, 2003). The model represents a dynamic system that is constantly subjected to pressures from a wide range of variables inherent to the incident and resonating within the internal and external environment.  Beginning with the red circle and continuing in a clockwise flow, the event or critical incident creates a demand eventually received in the political arena.

Whether or not a political leader is involved, through existing or ad hoc rules, there is policy and a delegation of authority from the blue to the green sphere of action. Green represents the tools and the tactics people deploy to manage the event. Directional arrows between the three components demonstrate the ebb and flow of the model. For example, the demands of participants and targets in the red zone flow back and forth from those in top levels of governance to those engulfed at the scene.  The interveners in the green zone, the bodies and agencies through which elected government official work, subsequently have their own demands generally associated with policy needs.  The tactics utilized by the interveners are also dynamic in nature.  Tactics deployed to the red zone cause a reaction, and based on that reaction, new tactics may be applied to modulate various aspects of the situation.

Each of the components in the model is characterized by specific colors and shapes used to symbolize very different zones of action.   The red symbol is intended to represent a dramatic event with a shape that changes literally, as buildings fall, disease spreads, and the dust clears. The overall impact and force of the incident will influence the ultimate shape and size of the red symbol.

Figure 4. Event Component of the Critical Incident Analysis Model

Within the red zone, violators may threaten and act upon others; or forces of nature and accidents may disrupt and destroy lives and property.  In reference to terrorism, an agent or agents actually physically plan and carry out the attack.  These agents generally have a larger goal in mind beyond the immediate target and may be supported financially, spiritually or strategically by individuals or organizations united by a common purpose for the incident – an aim.  This may be specific and come in the form of demands, but is usually accompanied by broader aims of showing strength, stirring up feelings, provoking a reaction that will aid in the recruitment of more agents, damaging the regime in power, or spreading fear throughout the populous. Agents pose a direct threat to the victim(s) or targets of the attack; targets are deliberate and intended to cause harm and disturbance in society. Part of the intent of the agents is to get the media and other responders, such as the police, involved to increase the impact of the incident.  The greater the response; the greater the impact the incident has on the targeted audience and society as a whole.

Targets of terrorist acts may be identified for their iconic value, such as the World Trade Center, or the Statue of Liberty.  These icons often have profound symbolic and cultural meaning attached to them and their destruction can evoke strong feelings, similar to that of a personal attack. When humans are the target, the emotional response may be even more traumatic.  As the frequency in critical incidents increases, citizens around the globe are learning new ways to interpret and predict human responses, individual and collective.  Ultimately, for an incident to be labeled as critical it must have a significant effect on the prevailing culture. The outcomes of a critical incident will result in a change in the collective behavior and norms by which society operates.

The blue symbol is shaped as a rectangle to represent the political arena.  The shape itself is stable and positioned at the top of the model in an attempt to represent the power and significance of all of the forces that exist in the body politic. There are different levels of blue – local, state, national, and international.  Governments monitor and are monitored by other governments. The rectangle stands for government and the governed.  It is representative of the larger community and includes the various factions, party affiliations, and social groups within society that coexist in a given nation.  The individuals and groups within these social clusters include dominant and marginalized classes; those with authorized or disenfranchised power, those who have access to resources, and those denied access, and those groups who are valued or rendered insignificant in society. The government as portrayed in the model serves as a symbol of ultimate consequence – for communities, the nation, or the world.

Figure 5. Political Arena Component of the Critical Incident Analysis Model

The public and lobby groups can exert great influence on the government. When a triggering event, such as a critical incident creates issues related to public health and safety, the government receives urgent demands from the public, which are propelled swiftly to the governmental policy agenda. Policy as defined by Fowler (2009) is “the dynamic and value-laden process through which a political process handles a public problem.  It includes a government’s expressed intentions and official enactment…” (p. 4).  During critical incidents the government dictates policy while elected and appointed officials at federal, state, and local levels respond to immediate and future incidents. While the government receives general direction from society, it also receives informed opinion and suggestions from the responders in the green zone.  Strong factions within the body politic often fight and diminish one another because of the event itself, or because of the way the event was managed. An example of this is the critical incident that occurred in Waco, Texas in 1993.  In this incident a standoff between federal law enforcement agents and a Protestant sect known as the Branch Davidians, resulted in the tragic loss of over eighty lives.  The Waco incident exposed flaws in law enforcement, lowered respect for several political leaders, and intensified the desire for ordinary citizens to form their own army. As a result, the FBI was demoralized, and the militia movement was strengthened. The human actions played out in the red and green zones, the media, and the context all had an impact on how the blue zone was perceived.  Trust and confidence between government and the governed are critical outcomes of such incidents and dependent upon this perception.

The green symbol represents bureaucracy and adhocracy. These words often bring to mind the notion of a hierarchy or multiple hierarchies, and represent the dualistic nature of the classic triangle of the organizational chart.   The points in the triangle suggest direction and purpose, indicative of the many elements and layers of bureaucracy that come into play in this zone, such as training, equipment, coordination, clarity of command, wisdom of response, preparation, and courage. In some critical incidents the response is impeded by rigid bureaucracy individuals and agencies in the green zone may create ad hoc groups or implement more informal and flexible procedures. Some of us are responsible for preventing, managing or mitigating disasters.  Some of us have professional responsibilities to communicate during and immediately after newsworthy events. In those roles, we are participant observers, shaping the incident and affecting its long-term significance.

Figure 6. Bureaucracy and Adhocracy Component of the Critical Incident Analysis Model

When a critical incident occurs, the government will activate the tools and the people they have in place for handling and recovering from the incident.  The people that work in the green circle can be viewed as a subset of the blue zone. These individuals will receive direction in the form of policy from the government and deal directly with the agents in the red zone.  The response to the incident is highly dependent on the personnel involved and in their ability to inflame or calm the situation.  When the response is impeded by rigid bureaucracy, individuals and agencies in the green zone may create ad hoc groups or implement more informal and flexible procedures. At times this can be problematic as evidenced by the immediate response to the needs of people in New Orleans after Hurricane Katrina, and provides a classic example of what happens when the interveners become disorganized.  The agencies in the green zone appeared to be poorly managed; their response was slow and ineffective. Trust in the government to manage a mega incident was greatly diminished as images and stories of the people impacted by the storm came to light in the media.  In any case, when the interveners become disorganized, the critical incident becomes even more critical.

Colleges and universities prepare many professionals for operational roles and for analytic roles.  By analyzing the actions in the green zone, we create a common ground on which to build new, collaborative insights. Firefighters can examine the technology that helps airline officials order passengers out of planes. Red Cross workers can understand psychologists’ theory for managing children during emergencies.  Military can recognize principals of community policing applicable to citizen control.  In an oversimplified sense, we look for good and bad incident management.  Unfortunately, the true stories get lost amid loud voices.

Communication and the media have significant and defining roles in CIA and are shaped as a ring to signify the interconnectedness between the event, political arena and bureaucracy and adhocracy. There are an infinite number of ways that communication contributes to understanding a critical incident.  Sense-making, and the importance of narratives in disasters, compliance-gaining and persuasion strategies, and the effects of stressful communication and events on people are three key areas in which meaning is created during the course of a critical incident.

Figure 7. Communication Component of Critical Incident Analysis Model

The media is powerful and can influence the outcome of an incident in positive or negative ways.  For example, media can be a positive force criticizing the government, exposing corruption, and educating the public.  On the other hand, the media can leak information at the wrong time, push the timeframe of the incident too fast, sensationalize the incident, and distort reality. A vital part of critical incident analysis is in understanding how the media operates and how it affects an incident.  Media consumers are frequently bombarded by calculated and contemporaneous reports, iconic photographs and multiple replays of dramatic images, relentless punditry, and false rumors fanned into forceful themes.  Further, media projected for the public and agents is becoming harder to control due to the immediacy of information available through embedded journalists, and other mediums, such as instant text messaging and blogs.

Participants in each of the areas represented by the red, blue and green symbols want something from the media.  Red is used to symbolize the event.  Agents, or perpetrators of the incident, want to gain attention and therefore increase the impact of the incident. For example, agents welcome extensive media exposure to heighten the importance of their agenda.  Green, represents bureaucracy and adhocracy.  Agencies and individuals working in the green arena want to be seen in a good light.  They want to reduce fear and panic in the public and limit or control the information received by the agents in the red circle.  They may have ulterior motives as well.  A positive reflection of their ability to respond effectively may lead to increase recruitment or funding. Blue, which represents the political arena, wants to maintain public trust. Those operating in the blue arena want to be perceived as attentive and improving the situation.

The final component in the model is context and is represented as the background for the model (See Figure 1).  Context refers to such things as the physical situation –  the time, place, people and the who, what, where, and when; or the historical circumstances leading up to the incident, which may provide insight into understanding the “why” of the event. Consideration must also be given to the social norms that shape and influence individuals perceptions of and responses to incidents.  Some events epitomize an era.  An example would be the assassination of President John F. Kennedy, followed by Martin Luther King and Robert F. Kennedy.  Each would have been a terrible blow by itself, but the ripple effect of three assassinations in a relatively short time-frame was enormous.  The historical context was significant and the social impact of these incidents would ultimately shape and define future generations.

The context and immediate effect of an incident is hard to discern when comparing incidents as long term consequences unfold over time.  Severity could be measured by mortality and morbidity, but that is really not the whole story.  A single death, the American president, is obviously of enormous importance, but a symbolic loss can have large effects as well (the first teacher in space).  Some severe traumas such as a cyclone in Bangladesh with 100,000 deaths are, unfortunately, expected and tolerated without meaningful change.


As the frequency in critical incidents increases, citizens around the globe are learning new ways to interpret and predict human responses, individually and collectively. Critical incident analysis after a disruptive event raises awareness and helps citizens learn how to cope in an imperfect world. It serves as an analytical method to help understand, predict, and negotiate the episodes that have deepest significance, and to do the task with appreciation of the roles and methods of various academic disciplines and occupational experts.  The conceptual model and graphic representations in this article are devices intended to establish a common ground, enhance dialogue, and prompt new ideas, concepts, and models.  Within every critical incident, there will be lessons for future generations — lessons that serve to broaden our understanding and guide our way. Critical incident analysis provides a fertile landscape and conceptual means for generating creative and effective initiatives to successfully mitigate and manage future incidents of this nature.


Carnot, M. J., & Stewart, D. (2006).  Using concept maps in college level psychology and social   work classes.  Paper presented at the Second International Conference on Concept Mapping. San Jose, Costa Rica.  Retrieved on May 13, 2009 from

Carter, S., Kang, M., & Taggart, R. (Summer, 1999).  An interdisciplinary approach to a critical    incident course.  Journalism & Mass Communication Educator, 54(2), 4-14.

Flanagan, J. C. (1954).  The critical incident technique.  Psychological Bulletin, 51(4), 327 -358.

Fowler, F. C. (2009).  Policy studies for educational leaders (3rd ed.). Boston:  Allyn & Bacon.

Ochberg, F. M. (1978).  The victim of terrorism. Practitioner. 220, 293-302.

Ochberg, F., Cinti, S., Goodman, E., Kirby, E., Melia, H., Prior, S., & Taggart, R. (2007).  The critical incident model. PowerPoint presentation at the meeting for Critical Incident  Analysis at John Jay College of Criminal Justice (CUNY), January 4, 2007.

Parker, D. L., Webb, J., & D’Souza, B. (1995).  The value of critical incident analysis as an educational tool and its relationship to experiential learning.  Nurse Education Today, 15,  111-116.

Roehler, L.R., & Cantlon, D.J. (1997). Scaffolding: A powerful tool in social constructivist classrooms. In K. Hogan & M. Pressley (Eds.), Scaffolding student learning:    Instructional approaches and issues (pp. 6-42). Cambridge, MA: Brookline.

Safayeni, F., & Derbentseva, N. (2003). Concept Maps:  A theoretical note on concepts and the   need for cyclic concept maps.  Institute for Human & Machine Cognition.  Pensacola, FL.  Retrieved on May 14, 2009 from

Schwester, R. W., Dank, M., & Horning, A. M. (2008).  Conceptualizing, defining and operationalizing critical incidents.  A paper presented at the Symposium on Critical Incidents, Academy for Critical Incident Analysis (ACIA), John Jay College of Criminal Justice (CUNY), October 2, 2008.