Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Incident Investigation

    Definition

    A structured examination of an incident or near miss to establish what happened, why it happened and what changes would prevent it happening again.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/incident-investigation

    Scope: Depth should follow potential consequences, not only the injury that resulted. Legal reporting is a separate decision.

    Example for your evaluation: Follow one report from the original record through evidence, causes and actions to a check that the actions worked.

    Sources checked: . Examples are editorial illustrations.

    What HSE and OSHA say about investigating incidents

    HSE's guidance HSG245, Investigating accidents and incidents (published 2004), describes an investigation in four steps: gathering the information, analysing the information, identifying risk control measures, and the action plan and its implementation. It says the level of investigation should follow the potential consequences and the likelihood of recurrence, not only the injury or ill health suffered on this occasion, and that the potential for learning, such as a run of similar minor events, should count too. It advises capturing information as soon as possible, before items are moved or guards replaced, and talking to everyone who was close by when the event happened.

    HSG245 separates three levels of cause. Immediate causes are the agent of injury; underlying causes are unsafe acts and conditions; root causes are the failures from which other failings grow, often remote in time and space and generally management, planning or organisational failings. It says that dealing only with immediate causes may be a short-term fix, that investigations should be conducted with prevention in mind and not placing blame, and that HSE does not endorse any one analysis technique. OSHA's incident investigation page makes similar points: it encourages investigating incidents and close calls, warns that it is far too easy, and often misleading, to conclude that carelessness or failure to follow a procedure alone was the cause, and says investigations should include managers and employees working together and look for root causes, not fault.

    Whether and when an event must be reported to a regulator is a separate question from how deeply to investigate it, and depends on the jurisdiction and the type of event. ISO 45001:2018 handles incidents in the same part of the management system as nonconformities and corrective action, which is one reason organisations often run both through one action process. This page is general information only.

    Sources opened :

    What an investigation record holds in software

    • The original report, kept unchanged, with the investigation held as a separate record that refers to it.
    • The decision on investigation depth and the reason: potential consequence, likelihood of recurrence and learning value.
    • Evidence collected, with who gathered it and when: statements, photographs, sketches, measurements, permits and equipment data.
    • A timeline of events and conditions, kept apart from the opinions about them.
    • Causes recorded at the immediate, underlying and root levels, each with the evidence that supports it.
    • Risk control measures proposed, accepted or rejected, with owners, dates and the reason for any that were not taken.
    • A follow-up entry that checks whether the measures worked, with the reviewer and date.

    Investigation, incident reporting and root cause analysis

    Reporting records that something happened; investigation establishes why. Root cause analysis methods such as the five whys or a fishbone diagram are techniques used within an investigation, and HSE says it does not endorse any one of them, so a completed diagram is not the same as a finished investigation. Nor is an investigation a disciplinary process: both HSE and OSHA say it should aim at prevention and not at finding someone to blame.

    A hypothetical example: a dropped load on a loading bay

    This case is invented to illustrate the steps and describes no real site. A pallet slips from a forklift's forks as it is raised to a rack and lands close to a picker, who is not hurt. The report is filed the same day. The safety lead notes that a person in that spot could have been seriously injured and sets a medium depth of investigation from the potential consequence and the chance of recurrence, not from the lack of injury. The scene is preserved first: the pallet, wrapping, forks and floor marks are photographed, the truck is taken out of use for checking, and the driver, the picker and a nearby colleague give their accounts separately.

    The analysis finds an immediate cause (an uneven load with loose wrap), underlying causes (a fork tilt setting not checked at the start of the shift, and a picking route that crosses the loading lane) and a possible root cause (pre-use checks and traffic routes were not reviewed after the layout changed). A team of a supervisor, a driver and the safety lead proposes a route barrier, a revised pre-use check and a review of how layout changes are assessed. Each action has an owner and a date. At the agreed review date the team looks at whether reports about that lane have changed and whether the checks are being completed, and records that one action had to be reworked.

    Common misunderstandings about incident investigation

    • Finding the person nearest the event is not finding the cause. HSE and OSHA both warn against stopping at carelessness or a missed procedure, and HSG245 asks why normal practice was inadequate.
    • Depth should follow potential, not outcome. Two events with the same cause can differ only in luck, so the seriousness of what could have happened is the better basis for effort.
    • A form full of answers is not a root cause. Asking why a check was not done or a risk not assessed leads towards the management and organisational failings that HSG245 says root causes generally are.
    • No single method suits every case. HSE does not endorse one technique, and the choice should fit the complexity and the evidence available.
    • Closing the actions is not the end. Without a check that the changes worked, an investigation has produced a plan and not learning.

    How incident investigation relates to other glossary terms

    Investigation is the step that turns an event record into changes to controls, so it sits next to the terms for events and for the controls that follow.

    • Near miss: events without harm are investigated in proportion to what could have happened, with the same questions about causes.
    • Hierarchy of controls: a guide for choosing risk control measures once the causes are known.
    • Non-conformance: a related record in quality systems, with similar cause analysis and corrective-action steps.
    • Management of change: an investigation that traces a cause to an unreviewed change leads back into the change process.

    Records and evidence that usually exist for an investigation

    • The original report with date, time, place and reporter.
    • The record of the depth decision and who made it.
    • Witness accounts, photographs, sketches, measurements, permits and equipment data, with collection dates.
    • The causal analysis, showing the method and the evidence behind each cause.
    • The list of risk control measures with owners, dates and the decision on each.
    • Evidence that actions were completed and a later check on whether they worked.
    • Feedback to the people involved and to the wider workforce where the lessons apply.

    What a software tool needs to capture for investigations

    • A report that stays unchanged after submission, with later edits shown as separate entries with author and date.
    • A depth decision field that records the potential consequence, the likelihood and the reason, and routes the case to a suitable investigator.
    • An evidence store that accepts photographs, documents and notes and records who added each item.
    • Cause fields that separate immediate, underlying and root causes, and do not force a single cause or a single method.
    • Actions that link to the cause they address, with owner, due date and a separate effectiveness check.
    • Restricted access for sensitive details, and clear rules on who sees witness statements.
    • Views that show open investigations by age and depth, and recurring causes across cases.

    Catalog profiles documenting incident investigation

    Each profile documents an investigation workflow in its record. The list does not show that any product performs a sound causal analysis, which depends on the people doing it.

    Same rule for every product: tagged “Incident Management”, “Incident Reporting” or “Root Cause & Investigation”, with a sourced incident investigation or root cause analysis capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 45 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Which incidents should be investigated?

    HSG245 says depth should follow potential consequences, likelihood of recurrence and the potential for learning, and OSHA encourages investigating incidents and close calls. Set criteria in your procedure and record the reason for the depth chosen.

    Does an investigation replace a report to a regulator?

    No. Whether and when an event must be reported depends on the rules that apply and the type of event. It is decided separately from the internal investigation.

    Who should be on the investigation team?

    OSHA says investigations should include managers and employees working together, since each brings different knowledge and perspectives.

    More safety terms

    Related guides