Incident Investigation: 6 Stages, Field Kit and a Worked Example
An incident investigation is the structured process of finding out what happened in a workplace incident or near miss, why it happened, and what must change so it does not happen again. It runs from the first response at the scene through evidence gathering, interviews and cause analysis to an action plan that is tracked to closure. Its purpose is prevention, not blame.
Most organizations do investigate. The problem is how. A supervisor fills in a form, writes "operator did not pay attention", adds "retrain the operator" and closes the case the same day. Nothing in the workplace changes, so the same event returns a few months later with a different person, sometimes with a worse outcome.
Both of the main public guides, the UK HSE workbook Investigating accidents and incidents (HSG245) and OSHA's Incident [Accident] Investigations: A Guide for Employers, describe a better way. This guide turns them into a field process with a complete worked example, from the first call to closure.
The Pallet That Missed
The following scenario is fictional and is used throughout this guide.
At 14:20 on a busy afternoon in a distribution warehouse, a pallet of bottled water falls from the third beam level of a racking bay into aisle 14. Thirty seconds earlier a picker walked through that aisle, directly under the location. Nobody is hurt. The reach truck operator who placed the pallet two minutes before is shaken. The shift supervisor clears the aisle, and by 14:45 the pallet has been restacked and the aisle reopened.
Two versions of what happens next are possible.
In the first, the supervisor writes a near-miss report: "Pallet not placed correctly. Operator reminded to take care." The case is closed.
In the second, the safety adviser asks a different question: what would this event have cost if the picker had been 30 seconds later? The answer is a possible fatality. That single question changes the depth of the investigation, who is involved, and what the organization learns. We will follow the second version through every stage below.
What Is an Incident Investigation?
An incident investigation is a systematic examination of an adverse event that identifies its immediate, underlying and root causes and produces corrective actions. It covers events that caused harm and events that could have.
The terms vary between sources, so it helps to fix them:
| Term | Meaning (HSE HSG245) | Example from the scenario |
|---|---|---|
| Accident | An event that results in injury or ill health | The pallet strikes the picker |
| Near miss | An event that does not cause harm but has the potential to cause injury or ill health | The pallet falls; the picker has already passed |
| Undesired circumstance | Conditions that have the potential to cause injury or ill health | A dented beam that nobody reported |
| Immediate cause | The most obvious reason the event happened | The pallet was not fully seated on the beams |
| Underlying cause | The less obvious system or organizational reason | Weekly racking checks were not being done |
| Root cause | The failing from which all other causes spring, usually management, planning or organizational | No one owned the racking-check task after a role change |
OSHA prefers the word "incident" to "accident" because "accident" suggests a random event that could not have been prevented. Its guide strongly encourages employers to investigate all incidents, including close calls.
An investigation is wider than root cause analysis, which is the analytical step in the middle.
In management-system terms, ISO 45001 Clause 10.2 expects an organization to react to incidents in a timely manner, investigate them with worker participation, determine their causes, check whether similar incidents have occurred or could occur, review existing risk assessments, take action following the hierarchy of controls, review the effectiveness of that action, and keep documented information about the whole process.
The First Hour: Before the Investigation Starts
The first hour decides how much evidence survives. HSG245 lists the steps to take after an adverse event: emergency response, an initial report and an initial assessment. In practice, run them in this order.
- Care for people first. Give first aid and call emergency services where needed. No evidence is worth a delay in treatment.
- Make the area safe. Isolate energy, stop the process, close the aisle. In some cases this has to happen before anything else, so that rescuers are not hurt.
- Preserve the scene. Cordon it off with tape, cones or barriers. HSG245 notes that information is easily corrupted (items moved, guards replaced), so stop work and prevent unauthorized access if necessary.
- Note names and equipment. Who was involved, who saw it, who was nearby, which machine or vehicle (with its ID), and what state the controls were in immediately afterwards.
- Save perishable evidence. Export CCTV and machine logs before they overwrite. Take wide photos before anything moves.
- Report internally to the person responsible for health and safety, who decides the level of investigation.
- Notify the authority if the event is reportable. Do not wait for the investigation to finish.
Notification Deadlines (Check Your Own Jurisdiction)
| Jurisdiction | What must be notified | Deadline | Source |
|---|---|---|---|
| United States (OSHA) | Work-related fatality | Within 8 hours | 29 CFR 1904.39(a)(1) |
| United States (OSHA) | In-patient hospitalization, amputation or loss of an eye | Within 24 hours | 29 CFR 1904.39(a)(2) |
| United Kingdom (RIDDOR 2013) | Deaths and specified injuries | Without delay, report received within 10 days | HSE RIDDOR guidance |
| United Kingdom (RIDDOR 2013) | Over-seven-day incapacitation of a worker | Within 15 days | HSE RIDDOR guidance |
| Türkiye | Work accident, to the Social Security Institution (SGK) | Within 3 working days | Law No. 6331, Article 14(2)(a) |
OSHA's fatality report applies if the death occurs within 30 days of the incident; hospitalization, amputation and eye-loss reports apply if they occur within 24 hours of the incident. Reporting rules change and have exceptions, so check the current text for your site.
In the scenario: the supervisor closed the aisle and the first aider checked the picker (no injury). The supervisor also put the reach truck out of use and asked the operator to take a break. Then the case went in the wrong direction: the pallet was restacked and the aisle reopened within 25 minutes. When the safety adviser arrived, the pallet's landing position had already been lost. The CCTV was still recoverable and was exported straight away.
How Deep Should You Investigate?
Investigate by the worst potential outcome and the likelihood of recurrence, not by the injury that actually happened. HSG245 is explicit: "It is the potential consequences and the likelihood of the adverse event recurring that should determine the level of investigation, not simply the injury or ill health suffered on this occasion." Its example is a scaffold collapse that hurt nobody but could have killed.
HSE's decision table (HSG245, page 13):
| Likelihood of recurrence | Minor | Serious | Major | Fatal |
|---|---|---|---|---|
| Certain | Low | Medium | High | High |
| Likely | Low | Medium | High | High |
| Possible | Low | Medium | High | High |
| Unlikely | Minimal | Low | Medium | High |
| Rare | Minimal | Low | Medium | High |
Columns are the potential worst consequence. HSG245 defines "serious" as an injury that keeps the person off normal work for more than three consecutive days and "major" by reference to the RIDDOR list (for example, fractures other than fingers or toes, amputations, loss of sight).
What each level means in practice, according to the same guide:
| Investigation level | Who investigates | Depth |
|---|---|---|
| Minimal | The relevant supervisor | Looks into the circumstances and the lessons |
| Low | Supervisor or line manager | A short investigation of immediate, underlying and root causes |
| Medium | Supervisor or line manager, health and safety adviser, employee representatives | A more detailed investigation of all three cause levels |
| High | A team of supervisors or line managers, health and safety advisers and employee representatives, under the supervision of senior management or directors | Team-based investigation of all three cause levels |
Two more rules from HSG245 belong in your procedure. A series of similar minor events may be worth investigating together even if each one alone is not. And the team must be led by, or report directly to, someone with the authority to act on its recommendations.
In the scenario: a 600 kg pallet falling into a pedestrian aisle could kill (potential consequence: fatal). Damaged beams were visible in other bays, so recurrence was rated "possible". The table gives a high-level investigation. The team was the warehouse manager (lead, reporting to the operations director), the safety adviser, an employee representative, the reach truck trainer and the maintenance technician who inspects the racking.
The 6-Stage Investigation Process
The HSE workbook uses four steps after the initial response: gather the information, analyze it, identify risk control measures, and make and implement an action plan. OSHA's guide also uses four: preserve and document the scene, collect information, determine root causes, and implement corrective actions. Combined with the first-hour actions above, they make six practical stages.
| Stage | What you do | Output |
|---|---|---|
| 1. Respond and make safe | First aid, emergency services, isolate the hazard | Casualties treated, area safe |
| 2. Preserve and notify | Cordon the scene, note names, save CCTV/logs, report internally and to the authority if required | Scene intact, notifications made |
| 3. Set level and team | Rate potential consequence × recurrence, appoint the team, set a timetable | Investigation level, named team, terms of reference |
| 4. Gather evidence | People, place and paper (see below) | Statements, photos, sketches, records, evidence log |
| 5. Analyze causes | Build a timeline, separate immediate, underlying and root causes, pick an analysis method | Causal chain agreed by the team |
| 6. Act, share and close | Action plan by hierarchy of controls, review the risk assessment, share lessons, check effectiveness | Closed actions, updated risk assessment, lessons shared |
OSHA recommends writing this down as an investigation program before anything happens: how and when management is told, who notifies outside agencies, who investigates and what training they need, the timetable for finishing and implementing recommendations, and who is responsible for the corrective actions. When a serious event happens, everybody is busy with the emergency. A written plan is what keeps the investigation from being improvised.
Gathering Evidence: People, Place and Paper
HSG245 describes three kinds of information: physical (the scene), verbal (witness accounts) and written (risk assessments, procedures, instructions). Collect from all three, in proportion to the level of the investigation.
Place: The Physical Scene
- Photos. OSHA's guide recommends starting with distance shots and moving in, shooting from several angles, placing an object of known size in the frame for scale, and noting the date, time, location, subject and conditions of each photo, plus who took it.
- A sketch with measurements taken from permanent reference points (a column, a door) and a north arrow. Mark where each person was before, during and after the event. Use the sketch later in interviews.
- Equipment details from the nameplate: manufacturer, model, serial or machine number, year and any modifications, as HSG245 advises. Record the position of controls immediately after the event.
- Physical items such as a broken part, a damaged pallet or a used glove. Tag and keep them.
People: Accounts and Context
Talk to everyone who was nearby: the injured person, eyewitnesses, the supervisor, coworkers and the person who assigned the task. HSG245 suggests also asking people who work in the area whether conditions had changed over time, because they know what normal looks like.
Paper: Records and Systems
OSHA's guide lists sources beyond interviews: equipment manuals, industry guidance, company policies and records, maintenance schedules and logs, training records, inspection and audit reports, and earlier corrective action recommendations. Add the risk assessment, the method statement or procedure for the task, permits to work, shift rosters and any change records.
A Field Kit You Can Grab in a Minute
OSHA's guide includes a full investigator's kit list. A condensed version that fits in one bag:
| Category | Items |
|---|---|
| Recording | Phone or camera with spare batteries, voice recorder, notepad, pens, graph paper, investigation forms |
| Measuring | Tape measure, straight-edge ruler (scale reference in photos), protractor or inclinometer, compass |
| Scene control | Barrier tape, cones, marking chalk or paint stick, ID tags |
| Evidence | Sample bags and containers with lids, disposable gloves, flashlight, magnifying glass |
| Protection | PPE suitable for the site (hard hat, glasses, gloves, hearing protection, mask), first-aid kit |
In the scenario: the team photographed the bay, the dented front beam and the damaged pallet and took the CCTV export. The paper trail was more revealing. The last weekly visual racking check was five weeks old. The damage log had no entry for the dented beam. The operator's refresher training was due. The traffic plan allowed pickers to walk through an aisle during put-away.
How to Interview Witnesses Without Blame
Interview as soon as people are able and the site is safe. OSHA's guide notes that memories fade, so the earlier you speak to a witness, the more accurate and candid the account is likely to be. Interview people one at a time, not in a group.
| Do | Don't |
|---|---|
| State that the purpose is to find facts, not fault | Open with "What did you do wrong?" |
| Hold the interview in the person's language; use an interpreter if needed | Rely on a coworker's informal translation for a serious event |
| Tell them they may have a representative present, where one is available | Interview in front of their manager |
| Ask them to describe what happened in their own words | Interrupt or finish their sentences |
| Ask clarifying, open questions ("What happened next?") | Ask leading questions ("The aisle was clear, wasn't it?") |
| Take notes; record only with permission | Record secretly |
| Repeat the facts back and correct inconsistencies | Argue with their account |
| Ask what they think could have prevented it | Promise outcomes you cannot deliver |
All of the "do" items come from OSHA's interview guidance. Use the sketch so people can point to where they were, and re-interview when new evidence appears.
In the scenario: the operator explained that the forks had "touched the beam" on the way up, and that they had repositioned and placed the load anyway because three more pallets were waiting. They had seen the dent the week before but had not reported it: the last driver who reported damage had been asked who caused it. That one answer moved the investigation from the operator to the reporting system.
Analyzing Causes: Immediate, Underlying, Root
Analysis turns facts into a causal chain. HSG245 notes that information gathering and analysis run side by side: the analysis creates new questions that send you back for more evidence.
- Build the timeline first. List events in time order, including the wider workplace: shift changes, staffing, concurrent work, recent maintenance. Gaps in the timeline are where the next questions are.
- Separate the three levels from the definitions table: immediate (the obvious reason), underlying (the system reason) and root (the management, planning or organizational failing). An analysis that stops at the immediate cause produces a correction, not a corrective action.
- Pick a method that fits the event. For a single causal chain, asking "why?" repeatedly is usually enough; HSG245 itself uses that technique. Many contributing factors call for a fishbone diagram, complex equipment failures for fault tree analysis. Our root cause analysis guide compares five methods.
When the Answer Looks Like "Human Error"
HSG245 states that investigations concluding operator error was the sole cause "are rarely acceptable". It divides human failures into types, and each needs a different fix:
| Type of human failure | What it looks like | Controls that work (HSG245) |
|---|---|---|
| Slip or lapse (skill-based error) | A familiar action done wrongly or a step forgotten | Design it out: color coding, checklists, interlocks |
| Rule-based or knowledge-based mistake | The wrong rule applied, or a wrong judgement in an unfamiliar situation | Training, clear safe working procedures, better equipment design |
| Violation | A deliberate shortcut, often because the rule seems unworkable or unenforced | Training, simple practical rules, routine supervision and monitoring |
HSG245 adds that, unless there was a deliberate and malicious violation or sabotage, disciplinary action may be counterproductive. It recommends a fair and just system in which people are held to account without being unduly blamed, and says blame should be considered only after the investigation is complete.
Worked Example: Falling Pallet Investigation
Fictional example, continuing the scenario. Figures are illustrative.
Timeline
| Time | Event |
|---|---|
| 13:55 | Peak period starts; two additional agency pickers begin their shift |
| 14:12 | Reach truck operator starts put-away in aisle 14 with a backlog of four pallets |
| 14:18 | While lifting, the forks contact the dented front beam at level 3; the operator repositions and places the pallet |
| 14:19 | A picker walks through aisle 14 under the location (CCTV) |
| 14:20 | The pallet tips forward and falls into the aisle |
| 14:21 | Supervisor closes the aisle; the first aider checks the picker (no injury) |
| 14:45 | Pallet restacked and aisle reopened (landing position lost) |
| 15:05 | Safety adviser arrives, photographs the bay, exports CCTV |
| Next day | High-level investigation team appointed; interviews held; records collected |
Causes
| Level | Cause |
|---|---|
| Immediate | Pallet not fully seated on the beams; a pallet with a broken bottom deck board; a pedestrian in the aisle during put-away |
| Underlying | Front beam dented by an earlier, unreported impact; weekly visual racking checks missed for five weeks; operator under time pressure from the backlog; pedestrian exclusion during put-away not in the traffic plan; damaged pallet accepted at goods-in |
| Root | No one was assigned the racking-check task after the previous supervisor left; reporting damage led to questions about who caused it, so drivers stopped reporting; peak staffing planned for picking but not for put-away |
Action Plan
Actions follow the hierarchy of controls. HSG245 sets the same order: eliminate the risk, combat it at source, and only then rely on procedures and PPE.
| # | Action | Control level | Owner | Due | How effectiveness is checked |
|---|---|---|---|---|---|
| 1 | Replace the damaged beam; inspect all bays and offload any location with damage until repaired | Engineering | Maintenance lead | 7 days | Inspection record for every aisle |
| 2 | Physically close an aisle (gates or chains) during put-away; pickers rerouted | Engineering / separation | Warehouse manager | 30 days | Spot checks over four weeks show no pedestrians in active aisles |
| 3 | Name an owner and a deputy for weekly racking checks, with a checklist | Administrative | Operations director | 7 days | Twelve consecutive weekly checks completed |
| 4 | Make damage reporting no-blame and acknowledge every report within 24 hours | Administrative / culture | Operations director | 14 days | Number of damage reports in the next quarter (expected to rise) |
| 5 | Add a pallet condition check at goods-in | Administrative | Goods-in supervisor | 14 days | Rejected pallet log in use |
| 6 | Include put-away capacity in peak staffing plans | Administrative | Operations planner | Next peak | Put-away backlog tracked at peak |
| 7 | Refresher training for reach truck operators on load placement and stopping work after contact with racking | Training | Reach truck trainer | 30 days | Training records; observed practice |
| 8 | Review the put-away risk assessment and traffic plan | Review | Safety adviser | 14 days | Revised documents approved |
"Remind the operator to take care" does not appear. HSG245 calls recommendations like that woolly and says they show the investigation did not go deep enough. OSHA's guide makes the same point about actions such as "workers should remember to wear PPE".
Closing the Investigation
An investigation closes when the actions are done and shown to work, not when the report is signed. Before closing:
- Every action is complete and its effectiveness check has a result. Track them in a corrective action (CAPA) register.
- The risk assessment for the task has been reviewed; HSG245 links this review to a legal duty under UK regulation 3(3) of the Management of Health and Safety at Work Regulations 1999, and ISO 45001 Clause 10.2 requires it too.
- HSG245's last questions have answers: do similar risks exist elsewhere, and have similar events happened before?
- The findings have been shared with the people involved, the workforce and other sites. A short toolbox talk on "what happened, why, and what changed" is often enough.
- The report is filed. Our incident report template covers what it should contain.
Common Incident Investigation Mistakes
1. Sizing the investigation by the injury
A cut finger gets a minimal look even when the machine could have taken a hand. Rate the potential worst consequence, as the HSE table does, or high-potential near misses will never be investigated properly.
2. Stopping at "human error"
"Operator did not pay attention" describes the moment, not the cause. Ask why the action made sense to the person at the time. Both HSE and OSHA treat a conclusion of human error as the start of the analysis, not the end.
3. Investigating alone
A safety adviser working alone misses the knowledge of the people who do the job. HSG245 notes that joint investigations with employees and their representatives bring wider practical knowledge and make people more supportive of the changes.
4. Actions without owners or checks
An action list with no owner, no date and no effectiveness check is a wish list. Each action needs all three, and someone with authority must own the plan as a whole; HSG245 suggests a director, partner or senior manager.
5. Ignoring near misses
Near misses are cheaper to investigate than accidents and, as HSG245 points out, witnesses are more open when nobody was hurt. A working near miss reporting system is the steady source of these lessons.
How FindRisk Supports Incident Investigations
At the scene, use FindRisk to photograph the area, mark the hazards directly on each photo and run the AI analysis as a second check on what you might have missed. Marked photos make the timeline and the interviews easier, because everyone is looking at the same picture.
After the analysis, re-score the hazard with the built-in Fine-Kinney risk assessment so the revised risk assessment shows the risk before and after the new controls. FindRisk can also create an inspection checklist with AI for the follow-up checks, for example a weekly racking check for the scenario above.
When the investigation is ready to share, FindRisk produces a professional report in seconds, with the photos and findings, so the people who need to act get it the same day. FindRisk runs on iOS and Android.
Frequently Asked Questions
How soon should an incident investigation start?
As soon as people are safe and the scene is secure. HSE guidance says adverse events should be investigated as soon as possible because memory is best and motivation greatest immediately after the event. Evidence such as CCTV, positions of controls and the condition of the scene can be lost within minutes, so preserve the scene first. Reportable events must be notified on time even if the investigation is not finished.
Who should be on an incident investigation team?
It depends on the level of the event. HSE suggests that a supervisor can handle minimal-level events, while high-level events need a team of line managers, health and safety advisers and employee representatives under senior management. Include someone who knows the task well and someone independent of the area. The team should be led by, or report to, a person with authority to act on its findings.
Should near misses be investigated?
Yes. OSHA strongly encourages employers to investigate close calls as well as incidents that caused harm, and HSE notes that near misses are as useful and much easier to investigate than accidents. Decide the depth by the worst outcome the near miss could have had and how likely it is to recur, not by the fact that nobody was hurt.
What is the difference between incident investigation and root cause analysis?
Root cause analysis is one stage inside an incident investigation. The investigation also covers the emergency response, preserving the scene, notification, evidence gathering, interviews, the action plan, the risk assessment review and checking that the actions worked. Root cause analysis methods such as 5 Whys or fishbone diagrams are the tools used during the analysis stage.
Can investigation findings be used to discipline a worker?
Blame should wait until the investigation is complete, and even then HSE warns that disciplinary action may be counterproductive unless there was a deliberate, malicious violation or sabotage. If people expect punishment, they stop reporting, and the organization loses the information it needs. Aim for a fair and just approach in which people are accountable but not unduly blamed.
How long should an incident investigation take?
There is no single deadline in OSHA or HSE general guidance; the effort should be proportionate to the investigation level. OSHA recommends that your written investigation program sets timetables for completing the investigation and implementing the recommendations. Separate deadlines apply to notifying the authorities, and those do not wait for the investigation to finish.
Conclusion
A good incident investigation answers three questions: what happened, why it was allowed to happen, and what will stop it happening again. Secure the scene in the first hour, size the investigation by the potential outcome, collect evidence from people, place and paper, interview for facts, and push the analysis past the immediate cause to the management failing behind it.
Then finish the job. Track every action to a verified result, review the risk assessment and share the lessons. The falling pallet in our example ended with a safer aisle because the team treated a near miss as a possible fatality.
Download FindRisk to document the scene with marked photos, re-score the risk with Fine-Kinney and share a professional investigation report with your team the same day.
Try FindRisk
Ready to modernize your safety workflow?
Conduct AI-powered risk assessments, generate reports instantly, and keep your team safe — anywhere, anytime.