The decision is methodological: given a system you did not build, in what order do you gather information, and at what point do you trust your model enough to act?
This question has two modes. The first is non-urgent: you have joined a team and have days or weeks to build a working model of the system. The second is urgent: something is wrong now, and you need a hypothesis within minutes. The method is the same; the depth of each step differs.