An incident investigation is a structured process to find out why a safety event happened and stop it from happening again. OSHA recommends a four-step systems approach: preserve the scene, collect the facts, determine the root causes, and implement corrective actions, without stopping at blame.
When someone gets hurt, the instinct is to find who did it and move on. That instinct is exactly why the same incidents keep happening. A good investigation is not a search for a guilty party; it is a search for the system conditions that let the event occur, so you can change them. The difference shows up months later, in whether the next worker in that spot is safe or is the second person to get caught in the same trap. This guide walks the whole process: securing the scene, gathering evidence and building a timeline, getting to root causes instead of the unsafe act, writing corrective actions that stick, and why you should investigate near misses with the same rigor as injuries.
What is the goal of an incident investigation?
The goal is prevention, not blame. You investigate to understand the chain of events and the underlying system weaknesses that produced them, so you can put controls in place that keep it from recurring. An investigation that ends at "the operator was careless" has found a symptom, not a cause.
This matters because blame and learning pull in opposite directions. The moment an investigation feels like a hunt for someone to punish, people stop telling you the truth, they shade the story, leave out the shortcut everyone takes, and hide the broken guard nobody reported. A blame-free, learning-focused investigation gets you the honest account you need to actually fix the hazard. That does not mean no one is ever accountable; it means the first question is "what in our system made this the likely outcome," not "whose fault is it." OSHA is explicit that failing to find the underlying, root causes leaves the systemic problem in place and the next incident waiting to happen.
What are the first steps at the scene?
First, make the scene safe and preserve it. Take care of injured people, correct any immediate hazard that could hurt someone else, then secure the area so evidence is not moved, cleaned up, or lost before you can document it. Photograph everything before anything changes.
The scene decays fast. Within an hour, the spilled material is mopped, the broken part is thrown out, the machine is back running, and the memory of exactly what happened starts to blur. Good investigators treat the first response like preserving a crash site: correct the danger, but capture the state of things with photos, measurements, and samples before the floor returns to normal. Note positions, guard states, readings on gauges, housekeeping conditions, and anything unusual. You can always discard evidence later; you cannot recover what got swept away.
How do you gather facts and build a timeline?
You gather facts from three sources, people, physical evidence, and records, and organize them into a timeline of what happened, in order. Interview witnesses individually and soon, while memory is fresh, and ask them to describe events rather than assign blame. Pull training records, maintenance logs, procedures, and prior reports for the same job.
Interviews are where blame does the most damage. Ask open questions, "walk me through what you saw", not "why did you do that," which puts people on the defensive and shuts down the truth. Interview witnesses separately so they do not anchor on each other's version, and get to them quickly. Then lay every confirmed fact on a timeline. A timeline does two things: it exposes gaps where you are missing information, and it reveals the sequence of small failures that lined up to produce the event.
How do you get to the root cause instead of the unsafe act?
You keep asking why the unsafe act was possible, likely, or necessary, until you reach a system condition you can change. The unsafe act is where the chain ends, not where it starts. Behind "the operator reached into the machine" sits a removed guard, a normal workaround, a staffing shortfall, and a procedure that was faster to skip than to follow.
This is the step that separates real investigations from paperwork. Tools like the 5 Whys and cause-and-effect analysis are built for it, and the full toolkit for safety events is its own topic, see root cause analysis for safety incidents. The test is simple: if your root cause is a person's behavior, ask why once more. "Operator error" is almost never a root cause; it is the visible end of a system that made the error easy to make and hard to catch. OSHA defines a root cause as a fundamental, underlying, system-related reason why an incident occurred that points to a correctable system error, not a name.
What makes a corrective action actually work?
A corrective action works when it is specific, assigned, time-bound, verified, and aimed as high on the hierarchy of controls as practical. "Retrain the operator" and "remind everyone to be careful" are the weakest fixes because they depend on people behaving perfectly forever. Engineering the hazard out is the strongest.
Match the fix to the cause. If a guard was removed because it made a jam impossible to clear, the fix is a guard design that lets the jam be cleared safely, not a memo telling people to keep the guard on. Every corrective action needs an owner, a due date, and a way to confirm it was done and is working, a corrective action nobody verifies is just a wish. This is where investigations quietly fail: the root cause is correct, the action is written, and then it never gets closed. Run the whole thing in this order:
- Respond and secure. Care for the injured, correct immediate hazards, and preserve the scene before anything is moved or cleaned.
- Document the scene. Photograph, measure, and sample the state of things, guard positions, gauge readings, housekeeping, before the floor returns to normal.
- Interview and collect. Talk to witnesses individually and soon, ask them to describe not defend, and pull training, maintenance, and procedure records.
- Build the timeline. Put every confirmed fact in order to expose gaps and reveal the chain of contributing events.
- Find the root causes. Ask why past the unsafe act until you reach correctable system conditions, using the 5 Whys and cause-and-effect analysis.
- Write and assign corrective actions. Make each one specific, aimed high on the hierarchy of controls, with an owner and a due date.
- Verify and share. Confirm each action is done and effective, close the investigation, and share the lesson so other areas fix the same hazard before it bites.
Should you investigate near misses too?
Yes. A near miss is a free lesson, the same chain of failures without the injury, and OSHA strongly encourages investigating close calls with the same seriousness as injuries. The only difference between a near miss and a fatality is often luck, so waiting for the injury to investigate means waiting for someone to get hurt to learn something you could have learned already.
Near misses are also far more numerous, which makes them your best early-warning data if you actually capture and investigate them. A workplace that investigates its near misses is finding and fixing hazards while they are still cheap. The catch is reporting: people only report close calls when doing so is easy and never used against them, the same blame-free culture that makes injury investigations honest is what makes near-miss reporting work at all.
Incident investigation, by the sources
- OSHA recommends a four-step systems approach to incident investigation: preserve and document the scene, collect information, determine root causes, and implement corrective actions (OSHA, Incident Investigation).
- OSHA defines a root cause as a fundamental, underlying, system-related reason why an incident occurred that identifies a correctable system error (OSHA Incident Investigation Guide).
- OSHA strongly encourages employers to investigate near misses close calls in which a worker might have been hurt under slightly different circumstances (OSHA, Incident Investigation).
- Recordable work-related injuries and illnesses must still be logged on the OSHA 300 forms regardless of the investigation's findings (OSHA Recordkeeping).
Where investigations fall apart, and how data helps
Two failures sink most investigation programs. First, corrective actions get written and never closed, because nobody tracks them to completion. Second, the same root cause shows up across three incidents in three departments and no one connects the dots, because each investigation lives in its own folder. Both are visibility problems.
When investigations and corrective actions live on paper forms and shared drives, you cannot see which actions are overdue, whether a fix was verified, or that "removed guard" has now caused four incidents this year. Harmony captures incidents, near misses and their corrective actions as structured, timestamped records on the same floor system as your OSHA recordkeeping and job safety analyses so a safety lead can track every open action to closure and see recurring causes across the plant. The deeper analysis of why events happen is covered in root cause analysis for safety incidents. See how one plant put its safety and quality records on one system. An investigation only prevents the next injury if the fix gets done and the lesson travels, and both are easier when the data is in one place you can actually search.