Incident Investigation Best Practices: Root Cause to Action

Why Incident Investigation Is a Core Process in Safety Management

Every workplace incident — whether it results in a fatality, a minor injury, property damage, or a near-miss — carries information. Information about what went wrong, why controls failed, and what the organization can do differently. The quality of your incident investigation process determines whether that information is captured and acted upon, or lost forever.

Effective incident investigation isn't about assigning blame. It's about organizational learning. OSHA makes the same point: investigations that focus on identifying and correcting root causes, not on finding fault or blame, also improve morale and productivity. The goal is to understand the systemic factors that allowed an incident to occur and implement changes that prevent recurrence — not just at the incident location, but across the entire organization.

The Cost of Poor Investigation

Organizations that conduct superficial investigations, attributing incidents to "human error" or "failure to follow procedure", can miss the underlying causes, so the same failures may recur. HSE's investigation guidance, HSG245, says investigations that conclude operator error was the sole cause are rarely acceptable, and gives the Clapham Junction rail crash and the Herald of Free Enterprise capsize as cases where management had failed to recognise, and act on, previous failings in the system.

Official reviews of later disasters describe the same pattern. The US National Commission on the Deepwater Horizon spill found recurring themes of missed warning signals, including lessons from an earlier near miss on another rig that were not adequately passed to the crew. The Grenfell Tower Inquiry found that fire safety recommendations, including those of the Lakanal House coroner, were not adequately implemented by government in the years before the fire, as the government's response to its Phase 2 report records. A report by the majority staff of the US House Transportation and Infrastructure Committee on the Boeing 737 MAX described multiple missed opportunities, at Boeing and at the FAA, to change the aircraft's course before the two crashes.

The Anatomy of an Effective Incident Investigation

Phase 1: Immediate Response and Scene Preservation

The first minutes and hours after an incident are critical. Your immediate priorities are:

Life Safety

• Ensure medical attention for injured persons
• Evacuate if ongoing hazards exist
• Establish safety perimeter
• Account for all personnel

Scene Preservation

• Secure the incident scene before evidence is disturbed
• Photograph and video document the scene from multiple angles
• Identify and preserve physical evidence (damaged equipment, materials, PPE)
• Capture environmental conditions (weather, lighting, noise levels)
• Note the positions of equipment, materials, and people
• Secure electronic evidence (CCTV footage, access logs, equipment data)

Initial Documentation

• Record date, time, and exact location (the incident report template lists these fields)
• Identify all persons involved, present, or witness to the incident
• Document immediate conditions and circumstances
• Record any initial statements (but don't conduct formal interviews yet)
• Notify required parties (management, regulators, insurance, family). Which incidents must be reported to a regulator, and how fast, is set in law: in the US, 29 CFR 1904.39 for fatalities, in-patient hospitalizations, amputations and losses of an eye; in Great Britain, the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR)

Technology Role: Mobile reporting apps can attach photos and video, a location and a timestamp to the first report, which gives later investigators a dated record of the scene. Confirm which of these a given product documents.

Phase 2: Evidence Collection and Witness Interviews

Once the scene is secure and immediate needs are addressed, systematic evidence collection begins.

Physical Evidence

• Equipment inspection and testing
• Material analysis (if relevant)
• PPE examination
• Environmental sampling
• Maintenance records review
• Calibration records for instruments and equipment

Documentary Evidence

• Standard operating procedures and work instructions
• Risk assessments and job safety analyses
• Permits to work
• Training records for involved personnel
• Inspection and audit records
• Previous incident reports for similar events
• Shift handover notes
• Communication logs

Witness Interviews

Witness interviews are often the most valuable source of information — and the most easily compromised. Follow these principles:

• Interview promptly but after the witness has had time to process the event
• Interview individually — never in groups, which leads to conformity
• Use open-ended questions: "Tell me what you saw" not "Did you see him slip?"
• Listen actively without interrupting or expressing judgment
• Capture verbatim statements where possible (with consent)
• Explore context: What was the witness doing before and after? What was normal about the situation? What was different?
• Be empathetic — witnesses may be traumatized, especially if colleagues were injured
• Document non-verbal observations — hesitation, body language, emotional state

Technology Role: Digital interview templates with structured question frameworks ensure consistency. Audio recording (with consent) captures nuances that notes miss. Secure storage with access controls protects sensitive testimony.

Phase 3: Root Cause Analysis

This is where investigations succeed or fail. Surface-level causes ("the worker slipped") must be traced to their organizational roots ("inadequate housekeeping standards, lack of non-slip surfaces, time pressure, inadequate supervision, production-over-safety culture").

Method 1: 5 Why Analysis

A simple and widely used technique. Start with the incident and ask "why?" repeatedly until you reach systemic causes.

Example:

• Why did the worker fall? → The walkway was wet
• Why was the walkway wet? → A valve was leaking
• Why was the valve leaking? → It hadn't been replaced despite being past service life
• Why wasn't it replaced? → The maintenance schedule wasn't followed
• Why wasn't the schedule followed? → Maintenance was deferred due to production pressure

The root cause isn't the wet floor — it's the organizational decision to prioritize production over maintenance.

Pitfalls: 5 Why can oversimplify complex incidents with multiple contributing factors. It tends to follow a single causal chain rather than exploring the full causal landscape.

Method 2: Fishbone (Ishikawa) Diagram

Organizes potential causes into categories: People, Process, Equipment, Materials, Environment, Management. This approach ensures you consider the full range of contributing factors rather than fixating on the most obvious cause.

Best for: Incidents with multiple potential contributing factors that need systematic exploration.

Method 3: Fault Tree Analysis (FTA)

A top-down, deductive technique that starts with the incident (top event) and systematically identifies all possible combinations of events and conditions that could lead to it. Uses AND/OR logic gates to model causal relationships.

Best for: Complex incidents involving multiple systems, barriers, and failure modes. Particularly useful in process safety investigations.

Method 4: Bow-Tie Analysis

Combines fault tree (threats → top event) and event tree (top event → consequences) to visualize the complete picture: what threats exist, what barriers should prevent the incident, what controls should mitigate consequences if it occurs, and where barriers failed.

Best for: Understanding the relationship between hazards, controls, and consequences. Excellent for communicating investigation findings to non-technical audiences.

Method 5: TRIPOD Beta

A structured methodology specifically designed for investigating organizational factors behind incidents. Identifies active failures (immediate causes), preconditions (local workplace factors), and latent failures (organizational management shortcomings).

Best for: Major incidents where organizational and management system failures need to be systematically identified.

Method 6: AcciMap

Maps contributing factors across multiple organizational levels: government/regulatory, organizational management, operational management, and the physical event sequence. Shows how decisions and conditions at each level contributed to the incident.

Best for: Systemic investigations where regulatory and organizational factors are significant.

Technology Role: Some QHSE products document structured root cause tools such as guided 5 Why steps, fault trees or bow-tie views, and some describe AI-assisted suggestions drawn from historical incidents. Treat each as a claim to test in a demonstration with one of your own past incidents, because a template does not by itself make the analysis thorough.

Phase 4: Corrective and Preventive Actions (CAPA)

Root cause analysis without effective corrective action is academic exercise. The CAPA process must be rigorous:

Hierarchy of Controls

Apply the hierarchy of controls, in the order NIOSH sets out, to your corrective actions, preferring higher-level controls:

1. Elimination: Remove the hazard entirely (highest priority)
2. Substitution: Replace with something less hazardous
3. Engineering Controls: Isolate people from the hazard
4. Administrative Controls: Change procedures, training, signage
5. PPE: Provide personal protective equipment (last resort)

SMART Corrective Actions

Every corrective action should be:

• Specific: Clearly define what needs to be done
• Measurable: How will you verify the action has been effective?
• Assigned: Who is responsible for implementation?
• Realistic: Is the action achievable within the given constraints?
• Time-bound: What's the deadline for completion?

Effectiveness Verification

Organizations sometimes close corrective actions when they're implemented without verifying they actually prevent recurrence. Build effectiveness verification into your CAPA process:

• Define verification criteria at the time the action is assigned
• Schedule follow-up assessments 30/60/90 days after implementation
• Monitor relevant metrics for signs of recurrence
• Re-open actions that fail effectiveness verification

Technology Role: A CAPA module may track owners, due dates, escalation and overdue alerts, which helps keep actions visible (see CAPA management software). Whether a product records effectiveness verification as a separate step from completion is worth asking about.

Phase 5: Communication and Organizational Learning

The value of an investigation is multiplied by how effectively its lessons are shared.

Investigation Reports

A good investigation report:

• Tells the story of the incident clearly and factually
• Presents evidence systematically
• Explains the root cause analysis methodology and findings
• Recommends corrective actions with clear rationale
• Avoids blame language
• Is accessible to non-technical readers

Safety Alerts and Lessons Learned

• Distribute key findings to all relevant parts of the organization
• Translate technical findings into practical, actionable guidance
• Include photos and diagrams that make the scenario vivid
• Provide clear "what to do differently" actions for frontline workers
• Archive in a searchable database for future reference

Technology Role: Alert distribution and a searchable incident database can help lessons reach the people who need them, and some products describe similarity matching against past incidents. Whether a lesson was read and acted on still needs a named owner.

Building an Investigation-Ready Organization

Investigator Competency

Not everyone can conduct effective incident investigations. Develop a cadre of trained investigators with:

• Root cause analysis methodology training
• Interview skills development
• Evidence collection and preservation techniques
• Report writing skills
• Understanding of human factors and organizational behavior
• Emotional intelligence and trauma awareness

Investigation Triggers and Classification

Define clear criteria for when investigations are triggered and what level of investigation is appropriate:

• Level 1 (Basic): Near-misses, minor first aid — supervisor investigation with 5 Why analysis
• Level 2 (Standard): Medical treatment cases, significant property damage — trained investigator with full RCA
• Level 3 (Major): Lost time injuries, high-potential near-misses — investigation team with comprehensive methodology
• Level 4 (Critical): Fatalities, multiple injuries, major environmental release — multi-disciplinary team, potentially with external expertise

HSE's HSG245 uses a similar scale (minimal, low, medium and high level investigations) and bases the choice on the worst potential consequences of the event and the likelihood of it recurring, not only on the harm it actually caused, so a high-potential near miss can call for a high-level investigation.

Timeliness

Investigation quality can degrade with time:

• Scene evidence is disturbed or cleaned up
• Witness memories become less reliable
• Organizational pressure to "move on" increases
• Contributing conditions may change

Establish and enforce investigation timelines. The ones below are our suggested examples, not legal limits; where a rule sets a deadline, such as OSHA's process safety standard for incidents that could have caused a catastrophic release (29 CFR 1910.119(m)), the rule takes precedence:

• Scene documentation: within 2 hours
• Initial witness interviews: within 24 hours
• Root cause analysis completion: within 5-10 working days
• CAPA plan finalized: within 15 working days
• Report published: within 20 working days

A Worked Example: A Forklift Near Miss at a Loading Dock

This is an illustration, not a real case. A forklift driver reversing out of a trailer stops about a metre from a pedestrian who was crossing the dock to reach a break room. Nobody is hurt. The site's own scheme treats it as a high-potential near miss, in line with HSG245's advice to rate an event by its worst potential consequence, so a team investigation is opened.

What to Ask a Software Vendor About Investigations

Ask every vendor the same questions, and use your own past incident as the demonstration case.

• Which investigation methods are documented, and are they templates or guided workflows?
• Can evidence such as photos, statements and maintenance records be attached to the investigation, with a record of who added it and when?
• Can a corrective action be linked to its root cause and kept open until a separate effectiveness check is recorded?
• Can the severity scheme use potential outcome as well as actual outcome?
• What can a reader without a licence see, such as a contractor supervisor reading a safety alert?

For documented scope across many products, see the capability map, the incident investigation software page and the incident platform comparison.

Frequently Asked Questions

Is "human error" ever an acceptable root cause? HSG245 says an investigation that ends at operator error is rarely acceptable. Ask what training, supervision, equipment design or management decisions made the error likely.

Which method should I use first? Match the method to the event. A simple event may need only a short 5 Why chain, while a multi-system failure needs a structured method. The glossary entry on root cause analysis and the guide to root cause analysis techniques cover the options.

Where do these steps connect to the wider system? See the glossary entries on incident investigation and CAPA, and the follow-up post on root cause analysis techniques.

Common Investigation Mistakes

1. Stopping at "Human Error" Human error is a starting point, not a root cause; HSE's HSG245 says investigations that conclude operator error was the sole cause are rarely acceptable. Ask why the error occurred, why the system allowed it, and why existing controls didn't prevent the outcome.

2. Investigation by Committee Large investigation teams are slow and produce diluted findings. Assign a lead investigator supported by subject matter experts as needed.

3. Ignoring Near-Misses Near-misses can share the causes of actual incidents and differ mainly in outcome. HSE's HSG245 makes the same point: it is often pure luck whether an undesired circumstance becomes a near miss or an accident. Investigate near-misses with the same rigor as actual incidents; the near-miss reporting guide covers how to get them reported.

4. Corrective Actions That Don't Address Root Causes "Retrain the employee" and "remind all staff to follow procedures" are weak corrective actions on their own because they don't address why the training or procedures failed in the first place.

5. Failure to Share Lessons An investigation that results in a filed report and a corrective action at one location, without sharing lessons across the organization, misses the most valuable opportunity for prevention.

6. Blame-Oriented Investigations When workers expect investigations to lead to discipline, they may stop reporting, and unreported events cannot be investigated.

Leveraging Technology for Investigation Excellence

Where a product documents them, these functions can make an investigation more consistent. What each product covers has to be checked against its own pages:

• Structured workflows guide investigators through each phase
• Mobile tools enable immediate scene documentation
• Root cause analysis templates ensure methodological rigor
• CAPA tracking with escalation helps reduce corrective action drift
• Analytics reveal patterns across multiple incidents
• AI features, where offered, may suggest contributing factors and similar historical incidents; check how a reviewer can see and override the suggestion
• Knowledge management preserves and shares organizational learning

Software supports the method; it does not replace the investigator.

Explore QHSE platforms with built-in investigation tools in our software comparison guide, or find your best-fit platform with our matching tool.

Sources

• HSE: Investigating accidents and incidents (HSG245)
• US OSHA: Incident investigation
• NIOSH: Hierarchy of controls
• eCFR: 29 CFR 1904.39, reporting fatalities, hospitalizations, amputations and losses of an eye and 29 CFR 1910.119, process safety management
• legislation.gov.uk: Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013
• National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling: Deep Water, report to the President (January 2011)
• UK Government: Grenfell Tower Inquiry Phase 2 Report: Government response (CP 1248, February 2025)
• US House Committee on Transportation and Infrastructure, majority staff: Final committee report on the design, development and certification of the Boeing 737 MAX (September 2020)

Updated 4 October 2026: the OSHA, HSE (HSG245), NIOSH, eCFR, Deepwater Horizon Commission, Grenfell government response and 737 MAX committee statements were checked against the primary documents again; unsupported statements about what software does were removed or hedged, and a worked example, vendor questions and an FAQ were added.

Corrected 23 September 2026: claims attributed to research and to official inquiries were linked to the primary reports or removed, the suggested investigation timelines are labelled as examples, and the regulations cited now link to their official texts.