alt Hacker NewsI agree with most of what you said but i'd like to raise 2 points
1) the immediate action _is more important immediately_ than the systemic change. We should focus on maximizing our "fixing" and letting a toxic element continue to poison you while you waste time wondering how you got there is counterproductive. It is important to focus on the systemic change, but once you have removed the person that will destroy the organization/kill us all.
2) I forgot. Sorry
I suppose that depends on context. I think it's important to be pragmatic regarding urgency. Of course the most urgent thing is to stop the bleeding; removing the bullet can probably wait until things have calmed down a bit.
If Joe dropped the production database and you're uncertain about his intentions then perhaps it would be a good idea to do the bare minimum by reducing his access privileges for the time being. No more than that though.
Whereas if you're reasonably certain that there was no intentional foul play involved then focusing on the individual from the outset isn't likely to improve the eventual outcome (rather it seems to me quite likely to be detrimental).