Incident investigation is a structured review of an injury, illness, near miss, property damage event or other unplanned occurrence to find out what happened, why it happened and what must change to prevent it from happening again. A good investigation looks past the immediate cause to the system failures underneath.
Incident investigation matters because every incident is evidence that a hazard or control failed. Investigations that stop at "worker error" miss the chance to fix the equipment, procedures, training or supervision that allowed the error to cause harm, so the same incident tends to happen again.
What Is an Incident Investigation?
An incident investigation gathers facts from the scene, people, equipment and records, analyzes them to identify causes, and produces corrective actions. OSHA encourages employers to treat incident investigation as a way to find and fix root causes, not to assign blame. Its guidance describes investigations as most effective when they involve workers, focus on systems and lead to real corrective action.
Most organizations investigate in proportion to severity. A first aid case may get a short review by a supervisor, while a serious injury, fatality or high-potential near miss gets a full team investigation with formal root cause analysis.
Which Events Should You Investigate?
- Fatalities and serious injuries, including amputations, hospitalizations and loss of an eye.
- Recordable injuries and illnesses, including those with days away, restricted work or medical treatment beyond first aid.
- First aid cases, which often reveal the same hazards that cause serious injuries.
- Near misses, especially those that could have resulted in a fatality or serious injury.
- Property damage, fires, spills and releases, including vehicle accidents.
- Process safety incidents. OSHA's process safety management standard, 29 CFR 1910.119(m), requires employers to investigate each incident that resulted in, or could reasonably have resulted in, a catastrophic release of a highly hazardous chemical, starting no later than 48 hours after the incident.
Related Reporting and Recordkeeping Rules
Investigation is separate from, but often runs alongside, legal reporting duties. Under 29 CFR 1904.39, employers must report a work-related fatality to OSHA within 8 hours, and an in-patient hospitalization, amputation or loss of an eye within 24 hours. Recordable cases must be entered on the OSHA 300 log within seven calendar days of receiving information that a recordable case occurred. See the OSHA severe injury reporting guide for details.
Immediate Causes vs. Root Causes
- Immediate causes are the unsafe acts and conditions present at the moment of the incident, such as a missing guard or a worker standing under a suspended load.
- Underlying or root causes are the management system failures that allowed those acts and conditions to exist, such as inadequate procedures, poor maintenance, production pressure, missing training or a weak change process.
Common analysis methods include the 5 Whys, fishbone (cause and effect) diagrams, fault trees and timeline or barrier analysis. The method matters less than asking "why" until you reach causes that management can control.
How to Investigate an Incident Step by Step
- Respond and secure the scene. Provide first aid and emergency care, make the area safe and preserve evidence.
- Report as required. Notify management and, where required, OSHA or other agencies within the legal deadlines.
- Assemble the team. Include a supervisor, a safety professional and a worker familiar with the task, and avoid having only the directly involved supervisor investigate.
- Gather evidence. Take photos, measurements and sketches, collect equipment and records, and note conditions such as lighting and weather.
- Interview people. Talk to the injured worker and witnesses separately, as soon as practical, using open questions and a non-blaming tone.
- Build a timeline. Lay out what happened before, during and after the incident.
- Analyze causes. Identify immediate causes, then dig for root causes using a structured method.
- Develop corrective actions. Choose actions that address root causes, favoring stronger controls in the hierarchy of controls, and assign owners and due dates.
- Report and share. Write up findings and share lessons learned with workers and other sites.
- Verify effectiveness. Confirm actions were completed and that they actually reduced the risk.
What to Include in an Investigation Report
- The date, time, location and people involved.
- A factual description of what happened and the sequence of events.
- Injuries, damage and any regulatory reports made.
- Evidence gathered, such as photos, statements and records.
- Immediate and root causes, and the analysis method used.
- Corrective actions, owners and due dates.
- Names of the investigation team and the date of review and sign-off.
Keep the report factual and focused on causes and fixes rather than fault.
Common Mistakes to Avoid
- Stopping at "employee did not follow procedure" without asking why.
- Blaming or disciplining workers in a way that discourages future reporting.
- Waiting too long, so evidence is lost and memories fade.
- Choosing weak actions, such as "retrain the worker" or "be more careful," when engineering fixes are possible.
- Never checking whether corrective actions were completed or worked.
- Ignoring near misses and first aid cases.
How SMS360 Helps
SMS360's Incident Management module helps teams record incidents and near misses, capture investigation details and keep findings in one place. Corrective actions from investigations can be assigned and tracked to completion in Actions Management, and trends across sites can be reviewed in Analytics & Reports.
Frequently Asked Questions
Does OSHA require incident investigations?
OSHA does not have a single general standard requiring investigation of every incident, but some standards do, such as the process safety management standard. OSHA strongly recommends investigating all incidents and near misses as part of a safety and health program.
How soon should an investigation start?
As soon as the scene is safe and injured people are cared for. Evidence and memories degrade quickly. For process safety incidents covered by 1910.119, the investigation must begin within 48 hours.
Who should be on an investigation team?
Typically a supervisor, a safety professional and at least one worker who knows the task. Serious events may also need engineers, maintenance staff or outside experts.
What is the goal of an incident investigation?
To prevent recurrence by finding and fixing root causes, not to assign blame. A good investigation results in corrective actions that change the system.
