Incident investigation is the structured process of finding out what happened, why it happened and what must change so an injury, near miss or other unplanned event does not happen again.
Incident investigation is the structured process an organization uses to find out what happened during an unplanned event, why it happened and what needs to change to prevent it from happening again. The event may be an injury, an illness, property damage, a spill, a fire or a near miss where no one was hurt but easily could have been.
The purpose of an investigation is prevention, not blame. A good investigation looks past the person closest to the event and asks why the conditions, equipment, procedures, training, supervision and management systems allowed it to happen. Most incidents have several contributing causes, and the deepest ones, often called root causes, usually sit in systems rather than in individual behavior. Fixing only the surface cause, such as retraining one worker, leaves the underlying problem in place for the next person.
OSHA encourages employers to investigate all incidents, including near misses, as part of an effective safety and health program. ISO 45001 requires organizations to investigate incidents and nonconformities, determine their causes and take corrective action. Investigation findings also feed key metrics such as the incident rate and help prioritize improvements.
Some incidents must be reported to OSHA, and they almost always warrant a full investigation. Under 29 CFR 1904.39, employers must report:
States that run their own OSHA-approved programs may have additional or stricter reporting rules. Separately, recordable injuries and illnesses must be entered on the OSHA 300 log, and environmental releases may need to be reported to environmental agencies. Reporting and investigation are different obligations; meeting one does not satisfy the other.
Care for the injured first, then make the area safe and preserve evidence. Restrict access, take photographs and avoid moving equipment or materials unless it is necessary for safety.
Choose investigators who are trained in the method being used and who are as independent as practical from the event. Include someone who knows the work well, such as an experienced operator, and involve worker representatives where possible.
Collect physical evidence, documents and accounts. Interview witnesses and the people involved as soon as practical, one at a time, in a non-threatening setting, with open questions that focus on what they saw and did. Review procedures, training records, maintenance logs, permits, inspection records and any previous similar incidents.
Lay out what happened step by step, from the conditions that existed before the event through the event itself and the response. Timelines and causal factor charts help reveal where things departed from what should have happened.
Identify the immediate causes, such as an unguarded pinch point or a slippery floor, then ask why those conditions existed. Common tools include:
Each root cause should have a corrective action with an owner and a due date. Use the hierarchy of controls so that fixes favor eliminating or engineering out the hazard rather than relying on reminders or more training.
Document the findings and share the lessons with everyone who does similar work, including other sites. Check later that actions were completed and that they actually worked.
A worker at a metal fabrication shop suffered a crushed finger while changing tooling on a press brake. The initial report concluded that he had not followed the lockout procedure and recommended retraining. The safety manager reopened the investigation and interviewed the operator, two coworkers and the shift supervisor. She found that tooling changes happened several times a shift, that the lockout point was on the far side of the machine, and that operators routinely used the foot pedal in inch mode with the machine powered to align dies, because the written procedure did not describe a safe way to do it. Production targets left little time for full lockout/tagout at every change.
The corrective actions focused on the system rather than the individual. The shop installed a lockable disconnect at the operator's side of each press brake, worked with the manufacturer to set up a safe die-setting mode with reduced speed and two-hand control, rewrote the tooling change procedure with input from operators, and adjusted production standards to include changeover time. Supervisors began observing one tooling change per shift. The findings were shared with the company's other two shops, which had the same machines.
Yes. Near misses share the same causes as injuries, and investigating them is one of the cheapest ways to prevent a serious incident. The depth of the investigation can be scaled to the potential severity of what could have happened.
Usually a supervisor or safety professional trained in investigation methods, supported by a team that includes people familiar with the work. For serious events, a more senior or independent lead helps avoid conflicts of interest.
As soon as the scene is safe and the injured have been cared for, ideally within the same shift. Early action preserves evidence and captures accurate witness accounts.
The immediate cause is the condition or action that directly led to the event, such as a missing guard. The root cause is the underlying reason that condition existed, such as no process for checking guards after maintenance. Fixing root causes prevents a wider range of future incidents.
Part of SafetyIQ's EHS glossary: plain-English definitions of workplace health and safety terms.
> Keep learning
> See it in action
Capture hazards, run inspections, track training and close out corrective actions in one platform built for high-risk, field-heavy work.
Book my free demo
Get a demo built around your sites, your teams, and the way your people work.
EHS, journey, and fatigue management software for field-heavy teams.
.png){kind=logo}
.png)