How to report and investigate an incident

An incident investigation finds out what happened, why it happened and what will stop it happening again. It starts with a good report and ends with actions that are closed and checked. This guide covers how to report an incident, how to investigate it and how to use root cause analysis to find causes that matter.

How to report an incident

An incident report is the first written record of an event such as an injury, illness, near miss, property damage, environmental release or dangerous occurrence. Fast, accurate reporting gives the organization time to protect people, preserve evidence and meet legal deadlines.

Steps to report an incident

• Make the scene safe: stop work, give first aid and call emergency services if needed
• Tell a supervisor or the designated contact straight away
• Record the basics as soon as possible, while memories are fresh
• Preserve evidence: leave equipment where it is if safe to do so and take photos
• Notify regulators, insurers and others where the law or contracts require it
• Log the report in the incident system and assign an investigator

What an incident report should include

Item	Details to record
Who	Name and role of the people involved and any witnesses
What	A factual description of the event and the outcome, such as injury, damage or release
When	Date and time of the event and the time it was reported
Where	Exact location, equipment and work area
How	The task being done and the conditions at the time
Immediate actions	First aid, isolation, clean-up and who was told
Severity	Actual outcome and the potential outcome if it had gone worse

Stick to facts. Write what people saw and did, not opinions about who was at fault.

Report near misses too

A near miss is an event that did not cause harm but could have. Near misses show weak controls before someone is hurt. Make reporting simple, thank people who report and show what changed as a result.

Legal reporting deadlines

Many countries require serious incidents to be reported to a regulator within a set time. Examples include RIDDOR in Great Britain and OSHA severe injury reporting in the US. Deadlines and thresholds differ, so check the rules that apply to each site and record who is responsible for making the notification.

Whatever the method, make sure everyone knows how to report and that reports reach the right person quickly. Ideagen's incident reporting system is one example of how teams can capture reports and route them for review.

How to investigate an incident

An incident investigation is a structured process for establishing the facts of an event, identifying its causes and deciding on corrective actions. The goal is to learn and prevent a repeat, not to assign blame.

Decide the level of investigation

Match the effort to the risk. Use the actual and potential severity to decide who investigates and how deeply.

Level	Typical events	Who investigates
Basic	Minor injuries and low-potential near misses	Supervisor
Standard	Lost time injuries and incidents with moderate potential	Supervisor with EHS support and worker representative
Major	Fatalities, serious injuries, major releases or high-potential events	Trained team led by senior management, often with specialist and external input

The investigation steps

• Secure the scene: keep people safe and protect evidence
• Form the team: include someone who knows the work, a trained investigator and a worker representative
• Collect evidence: photos, sketches, equipment condition, records, procedures, training files and maintenance logs
• Interview witnesses: talk to people separately, ask open questions and listen without leading
• Build the timeline: put events in order, from the start of the task to the outcome
• Analyze the causes: use root cause analysis to move from what happened to why it happened
• Agree corrective actions: choose controls that address the causes and assign owners and due dates
• Write the report: describe facts, causes and actions clearly
• Share the lessons: brief affected teams and other sites with similar risks
• Follow up: check that actions are done and that they work

Interview tips

• Hold interviews as soon as practical and in a private place
• Explain that the purpose is learning, not blame
• Ask people to describe what they saw and did in their own words
• Avoid leading questions and avoid interrupting
• Take notes and read them back to confirm accuracy

Common investigation mistakes

• Stopping at the first cause, such as human error
• Blaming individuals instead of looking at systems
• Starting too late and losing evidence
• Writing actions that are vague, such as remind staff to be careful
• Not checking that actions were completed or effective

What is root cause analysis?

Root cause analysis (RCA) is a method for finding the underlying reasons an incident happened so that fixes address the cause rather than the symptom. A root cause is a fundamental cause that, if removed, would prevent the incident from happening again.

Most incidents have more than one cause. Immediate causes are the unsafe acts or conditions closest to the event. Root causes often sit in systems such as training, supervision, maintenance, design or planning.

Common root cause analysis methods

Method	How it works	Best for
5 Whys	Ask why repeatedly, usually five times, until you reach a cause you can act on	Simple problems with a clear chain of events
Fishbone (Ishikawa) diagram	Map possible causes under headings such as people, equipment, methods, materials, environment and management	Brainstorming with a team
Fault tree analysis	Work backward from the event using logic gates to show combinations of failures	Complex technical failures
Barrier analysis	Check which controls should have prevented the event and why they failed	Events with multiple safeguards
Timeline and change analysis	Compare what happened with normal practice to spot what was different	Events after a change in process or equipment

A simple 5 Whys example

Question	Answer
Why did the worker slip?	There was oil on the floor
Why was there oil on the floor?	A hose on a machine leaked
Why did the hose leak?	It was worn and had not been replaced
Why was it not replaced?	The inspection checklist did not include the hose
Why was the hose not on the checklist?	The checklist was not updated when the machine was modified

The root cause here is a gap in change management and the inspection process. Mopping the floor treats the symptom. Updating the checklist and the change process addresses the cause.

Tips for effective root cause analysis

• Use more than one person, because different views find different causes
• Base each answer on evidence, not assumption
• Look at both what failed and what controls were missing
• Keep asking why until you reach a cause you can control
• Rank corrective actions by how strongly they reduce risk, favoring design and engineering fixes over reminders and retraining

Corrective actions and follow-up

An investigation only prevents harm when its actions are completed. Give each action an owner, a due date and a way to check that it worked. Track overdue actions and escalate them. Ideagen's guide to corrective actions for safety risks looks at how to manage this stage.

• Write specific actions that describe what will change
• Link each action to a cause from the analysis
• Set a realistic due date and an accountable owner
• Verify that the action was completed and that it works
• Look across incidents for repeat causes and trends

Frequently asked questions

What is the purpose of an incident investigation?

The purpose is to find the causes of an incident and put in place actions that prevent a repeat.

Who should investigate an incident?

A trained person with knowledge of the work, supported by a worker representative and, for serious events, senior management and specialists.

What is the difference between a root cause and an immediate cause?

An immediate cause is the direct trigger, such as a wet floor. A root cause is the underlying reason, such as a missing inspection step.

How soon should an incident be reported?

Report it as soon as it is safe to do so, usually within the same shift. Legal deadlines for serious incidents can be shorter.

Is the 5 Whys method enough?

It works for simple problems. Complex incidents usually need more than one method and more than one cause.