Incident Investigation: How to Investigate Workplace Incidents

An incident investigation is a structured process for establishing what happened during a workplace incident, why it happened and what needs to change to prevent it from happening again.

Effective investigations look beyond the immediate event. They examine immediate, underlying and root causes to identify weaknesses in equipment, procedures, training, management or the wider work environment. The objective is not to assign blame, but to learn lessons and implement corrective actions that prevent future incidents.

For organisations managing incidents across different teams, locations or activities, environment, health and safety (EHS) software can provide a more consistent digital approach to recording health and safety information and managing associated EHS processes.

Incident investigations should also extend beyond workplace accidents resulting in injury. Near misses and dangerous occurrences can provide valuable warnings about hazards and control failures before more serious consequences occur.

What is an incident investigation?

Incident investigation is the process of gathering and analysing evidence after a health and safety event to determine how and why the incident occurred.

The terms incident investigation and accident investigation are sometimes used interchangeably. However, incident is generally the broader term because it can include accidents involving injury as well as near misses and other events that could have resulted in harm.

The primary purpose of investigating accidents and incidents is prevention.

A successful investigation should establish:

• What happened
• Where and when it happened
• Who was involved
• What hazards were present
• What controls were in place
• Why those controls failed or were insufficient
• The immediate and underlying causes
• The root causes
• What corrective actions are required
• How similar incidents can be prevented

An investigation should therefore result in practical improvements rather than simply producing a report about an event that has already happened.

Why should workplace incidents be investigated?

Investigating workplace incidents provides organisations with an opportunity to identify health and safety issues that may otherwise remain hidden.

An accident may expose a defective piece of equipment. Further investigation could reveal that inspections were not being completed correctly, maintenance intervals were inappropriate or previous warning signs had not been acted upon.

Stopping at the defective equipment stage would address the immediate problem before it progresses into an incident. Understanding why the defect existed can help prevent recurrence.

Incident investigation can help organisations:

• Prevent future accidents
• Identify previously unrecognised hazards
• Improve existing control measures
• Understand organisational factors contributing to incidents
• Review existing risk assessments
• Identify weaknesses in procedures or training
• Prevent repeat incidents
• Improve employee awareness
• Strengthen the overall safety culture

Near misses should also be taken seriously. An event does not need to result in an injured person before it can provide useful information about risk.

Effective near miss reporting allows organisations to capture warning signs and investigate why an event occurred before similar incidents result in injury or more serious consequences.

What does the HSE recommend for incident investigation?

The Health and Safety Executive (HSE) provides comprehensive guidance on investigating accidents and incidents in their guidance workbook HSG245.

Its accident investigation process consists of four main stages:

1. Gathering information
2. Analysing the information
3. Identifying suitable risk control measures
4. Creating and implementing an action plan

The scale of the investigation should reflect the potential consequences and complexity of the incident. A relatively non-complex incident may not require the same investigation team or resources as a serious accident involving multiple people, pieces of equipment or organisational factors.

However, the fundamental principles remain the same.

The investigation should establish the facts, determine why the incident occurred and identify action that can prevent future incidents.

1. Respond to the incident and gather information

The immediate response following an incident should prioritise people and safety.

Where necessary, provide first aid or emergency assistance and take appropriate steps to prevent anyone else from being harmed. The scene may then need to be secured so that important evidence is not lost, moved or altered.

Gathering information should begin as soon as reasonably practicable while evidence is available and memories are fresh.

Depending on the incident, evidence might include:

• Photographs and video
• Equipment involved
• The position of objects
• Damaged components
• CCTV
• Maintenance records
• Training records
• Operating procedures
• Previous inspection reports
• Risk assessments
• Risk assessment and method statements (RAMS)
• Witness accounts
• Records of similar incidents

Investigators should distinguish factual evidence from assumptions and opinions.

If a machine guard was found removed after an incident, for example, that is an observable fact. Assuming that a particular employee deliberately removed it without supporting evidence is an opinion.

Cross-checking different sources of evidence can help the investigation team establish a more reliable sequence of events.

Interview the people involved

Witnesses, the injured person and other people involved can provide information that physical evidence alone cannot.

Interviews should take place promptly where appropriate, while memories of the incident remain relatively fresh.

Investigators should use open questions rather than questions that suggest a desired answer.

Instead of:

“Did you forget to follow the procedure?”

Ask:

“Can you describe what you were doing immediately before the incident?”

This encourages the person to explain events in their own words.

The purpose is gathering information, not establishing who should be blamed.

Safety representatives and employees familiar with the activity can also provide useful context about normal working practices and conditions.

2. Identify immediate, underlying and root causes

Once the evidence has been collected, the next stage is analysing why the incident occurred.

A good investigation goes further than identifying the most obvious explanation.

Incident investigations commonly consider three levels of cause.

Immediate causes

Immediate causes are the circumstances directly associated with the incident.

For example, an employee may have fallen because liquid was present on the floor.

Identifying the spill explains the immediate cause, but it does not explain why the hazard was present or why existing controls failed to prevent the accident.

Underlying causes

Underlying causes are factors that allowed the immediate cause to develop.

In the same example, these could include:

• Inadequate inspections
• Poor housekeeping procedures
• A leaking piece of equipment
• Insufficient maintenance
• Unclear responsibilities
• Previous reports not being addressed

These factors provide considerably more useful information for preventing future accidents.

Root causes

Root causes are the deeper organisational or management weaknesses that allowed the underlying causes to exist.

A maintenance problem, for example, may ultimately be linked to inadequate maintenance planning, unclear responsibilities or a wider failure to act on previously identified risks.

Tools such as the 5 Whys and the Fishbone Diagram can help investigation teams explore these relationships systematically.

The 5 Whys involves repeatedly asking why an event or condition existed until the investigation moves beyond the immediate explanation towards the systemic issue.

This doesn’t mean every investigation literally requires five questions. The objective is to keep investigating until the organisation understands why the conditions that produced the incident were allowed to exist.

Focusing on root causes rather than blame is important. Concluding that someone was “careless” rarely explains why an incident occurred or identifies effective ways to prevent recurrence.

3. Identify suitable risk control measures

Once the causes have been established, the investigation should determine what needs to change.

Corrective actions should address the causes identified during the investigation rather than simply correcting the visible result of the accident.

This may require reviewing existing risk assessments.

• Was the hazard already identified?
• Was the risk underestimated?
• Were suitable controls specified?
• Had working conditions changed since the assessment?
• Were existing controls actually being implemented?

Using risk assessment software can help organisations maintain digital records of identified hazards, risk assessments and associated control measures across different activities and locations.

Where an investigation identifies problems with planned working methods, the relevant RAMS may also need to be reviewed.

For example, an investigation might determine that the risk assessment identified the hazard correctly but the method statement did not adequately explain the safe system of work required to control it. RAMS software can support the digital creation and management of risk assessments and method statements where these documents are required.

The investigation may also identify that new risk control measures are necessary.

The appropriate action will depend on the hazard and could involve eliminating the activity, changing equipment, introducing engineering controls, updating procedures, providing additional training or improving supervision.

The important point is that corrective actions address the actual causes of the incident.

4. Create and implement an action plan

Identifying improvements is not enough. They need to be implemented.

The final stage of the HSE approach is developing an action plan and ensuring that it is put into practice.

An effective action plan should make clear:

• What needs to be done
• Why the action is necessary
• Who is responsible
• The priority of the action
• When it should be completed
• How completion will be recorded
• How effectiveness will be reviewed

Actions should be specific.

“Remind employees to be careful” is unlikely to provide an effective long-term solution to a systemic safety issue.

A more appropriate corrective action might involve repairing defective equipment, changing an inspection process, updating a safe system of work or introducing a more effective engineering control.

Organisations also need to check whether actions have worked.

If the same or similar incidents continue after corrective measures have supposedly been implemented, this may indicate that the original root causes were not fully understood or that the chosen controls were ineffective.

Health and safety management software can help organisations bring risk assessments, inspections, incidents and other health and safety processes into a more structured digital system.

Who should be involved in an incident investigation?

The people involved should reflect the nature and seriousness of the incident.

A competent investigator should understand the investigation process and be able to gather evidence objectively, conduct interviews and distinguish immediate causes from deeper organisational factors.

For more complex incidents, an investigation team may include:

• Managers or supervisors
• Employees familiar with the work
• Health and safety professionals
• Safety representatives
• Technical specialists
• Maintenance personnel
• Other relevant subject matter experts

A diverse investigation team can improve the quality of the investigation because different people bring different knowledge and perspectives.

Someone familiar with the equipment may recognise a technical problem, while an employee performing the task may understand how work is actually carried out in practice.

What matters is that the investigation remains objective and focused on evidence.

Common incident investigation mistakes

An investigation can be completed without being investigated effectively.

Some of the most common mistakes include:

Starting too late. Evidence can disappear and people’s memories can become less reliable over time.

Assigning blame. Focusing on an individual can prevent the investigation from uncovering wider systemic weaknesses.

Stopping at the immediate cause. Identifying what physically caused an injury is not necessarily the same as understanding why the accident happened.

Ignoring near misses. Near misses can reveal the same weaknesses that later contribute to serious workplace accidents.

Failing to involve employees. The people who carry out an activity often possess valuable information about the work environment and how procedures operate in practice.

Relying on assumptions. Findings should be supported by evidence wherever possible.

Choosing vague corrective actions. Actions should be specific enough to address identified causes.

Failing to follow up. Corrective measures need to be implemented and monitored to establish whether they actually reduce risk.

How incident investigation helps prevent future incidents

Incident investigation should form part of a wider cycle of health and safety improvement.

An incident occurs. Evidence is gathered. Immediate, underlying and root causes are identified. Suitable controls are selected. Corrective actions are implemented. Risk assessments and procedures are reviewed. The effectiveness of those changes is then monitored.

Findings from an investigation may therefore trigger a new or updated EHS risk assessment where hazards, risk levels or control measures have changed.

Sharing relevant findings can also help other employees, teams and sites learn from similar events. An issue identified in one location may exist elsewhere even if an accident has not yet occurred there.

This is an essential part of learning lessons from workplace incidents.

Effective investigation isn’t about producing paperwork after something goes wrong. It is about understanding why incidents happen and using that knowledge to prevent workplace incidents in the future.

When investigations consistently focus on evidence, root causes and effective corrective actions, organisations can move from reacting to accidents towards a more proactive approach to health and safety.