How do you report a human error without making unnecessary accusations?

First describe what demonstrably happened, when, within what scope and with what consequence. Then record relevant circumstances, such as available information, instructions, workload, access rights and technical security. Make it clear what is fact, statement and unconfirmed assumption.

Use a name only when identification is necessary and proportionate. Wordings such as ‘an account was able to perform the action’ are often more informative than ’employee X caused the incident’. Where appropriate, give those involved the opportunity to correct factual inaccuracies or missing context.