A Practical Guide to Incident Investigation

A serious incident can place a business under immediate pressure. Work may be stopped, injured workers and their families need support, clients may demand answers, and senior leaders need to understand their legal exposure. A sound guide to incident investigation gives the business a disciplined way to establish what happened, act on immediate risks and prevent the event from being repeated.

The objective is not to find someone to blame. It is to identify the conditions, decisions and control failures that allowed an incident to occur. Done properly, an investigation protects people, supports WHS compliance and produces corrective actions that work in real operations rather than sitting unused in a register.

Start with response, not paperwork

The first priority is always emergency response. Provide first aid, arrange medical treatment, isolate the area where necessary and make the site safe without destroying critical evidence. If machinery, plant or a work area is involved, prevent it from being returned to service until an authorised person has assessed the risk.

For a potentially notifiable incident, preserve the incident site as required under the applicable state or territory WHS legislation. In New South Wales, for example, a person conducting a business or undertaking must notify SafeWork NSW immediately after becoming aware of a death, serious injury or illness, or dangerous incident. The site must generally not be disturbed until an inspector arrives or directs otherwise, except to assist an injured person, remove a deceased person, make the site safe, or prevent further injury or property damage.

Requirements differ across jurisdictions and circumstances. Directors and managers should ensure their escalation procedure identifies who assesses notifiability, who contacts the regulator and who records the notification. Delays and informal decision-making can create unnecessary legal and reputational exposure.

Set the scope of the incident investigation

Not every event requires the same level of investigation. A minor first-aid event may call for a focused review, while a serious injury, high-potential near miss, environmental release or repeated event may require a formal investigation team and independent review.

Set the scope early. Define the event being investigated, the time period, locations, activities, contractors and equipment involved, and the questions that must be answered. This avoids investigations expanding into broad criticism of the business without producing useful findings.

The investigation lead needs sufficient authority, competence and independence. For high-consequence incidents, it is often sensible to include operational management, HSEQ personnel and technical specialists. However, people directly responsible for the work should not be the sole decision-makers on the findings. Their input is essential, but independence helps maintain credibility.

Gather evidence before recollection fades

Evidence collection should begin as soon as the immediate response allows. Memories change quickly, physical conditions are altered and electronic records can be overwritten. A strong investigation builds its findings from verifiable information, not assumptions made in a meeting room.

Collect the evidence needed to reconstruct the work as it was actually performed, including:

• photographs, video, site sketches and measurements of the scene

• plant inspection records, maintenance history, pre-start checks and isolation records

• SWMS, permits, risk assessments, procedures, training records and competency evidence

• rosters, supervision arrangements, toolbox talk records and contractor documentation

• relevant CCTV, access logs, vehicle data, mobile communications and weather information.

Document where each item came from, who collected it and when. This is particularly important where the incident may lead to a regulator inquiry, workers compensation matter, contractual dispute or prosecution.

Interview people fairly and promptly

Witness interviews are not interrogations. Their purpose is to understand the sequence of events, the work conditions and the controls that were present or absent. Interview affected workers and witnesses privately, as soon as reasonably practical, and use open questions such as: “Talk me through the task from the start” or “What was different about this job?”

Avoid leading questions or language that suggests a preferred answer. Separate fact from opinion in interview notes and give the person an opportunity to confirm the record. It is also worth asking what makes the task difficult on a normal day. The answer often reveals a gap between the written procedure and site reality.

Build a clear timeline

A timeline is one of the most useful investigation tools because it exposes missing information and competing accounts. Start with the planned work, then document what occurred before, during and after the event. Include shift changes, work delays, equipment changes, communications, supervision and changes in conditions.

The timeline should distinguish confirmed facts from assumptions. If a worker states that a guard had been removed earlier in the shift, identify that as witness evidence and seek corroboration through photographs, maintenance records or other accounts. This discipline prevents a report from presenting untested conclusions as fact.

Identify causes beyond worker behaviour

The immediate event may be clear: a worker fell, a forklift struck a pedestrian, a chemical was released, or a load shifted during transport. The more difficult question is why the controls did not prevent it.

A useful investigation looks at several layers. The direct cause may relate to an action or equipment condition. Contributing factors can include inadequate separation of pedestrians and mobile plant, poor visibility, production pressure, unclear responsibilities, unsuitable equipment, ineffective training or a supervisor who could not reasonably monitor the work.

Root causes sit further back in the management system. For example, a worker bypassing a machine guard is not a sufficient root cause if the guard regularly prevented the task from being completed, breakdowns were normalised, and no effective change-management process existed. The system had accepted an unsafe workaround.

Tools such as the five whys, causal factor analysis and barrier analysis can be useful. They are not substitutes for judgement. The best method depends on the incident’s complexity, available evidence and potential consequence. For significant events, barrier analysis is particularly valuable because it tests which controls should have prevented the event, which failed, and why they failed.

Test the controls against actual work

An investigation should assess controls in the hierarchy of control, rather than defaulting to retraining or telling people to be more careful. Administrative controls and personal protective equipment have a place, but they rely heavily on consistent human behaviour.

Ask whether the hazard could be eliminated, substituted or isolated. Could plant be modified? Could physical separation be installed? Could a delivery process be redesigned so workers are not exposed to reversing vehicles? If higher-order controls are not reasonably practicable, document why and strengthen the remaining controls through clear procedures, supervision, competency and verification.

This is where ISO 45001-aligned systems add commercial value. The standard expects organisations to investigate incidents, determine underlying causes and take corrective action, then review whether those actions are effective. A closed corrective action is not evidence of improvement unless the business can show the control works in the field.

Turn findings into accountable corrective actions

Investigation reports often fail at the final step. They identify valid issues but assign vague actions such as “review procedure” or “retrain staff”. These actions rarely change risk exposure.

Each action should state what will be changed, who owns it, the required completion date, resources required and the measure used to verify effectiveness. If a procedure is revised, confirm workers understand and can apply it. If a physical control is installed, inspect it in use. If contractor management was weak, test the new prequalification and site induction process on the next engagement.

Actions should be prioritised by risk, not convenience. A low-cost document update should not be treated as equivalent to engineering work needed to control a high-consequence risk. Where a permanent control will take time, implement and monitor an interim control with a clear expiry date.

Report with enough detail to withstand scrutiny

A credible report records the event, evidence reviewed, timeline, findings, causal analysis, legal or system requirements considered, and corrective actions. It should be factual, readable and proportionate to the incident. Avoid speculative wording, personal criticism and unsupported findings.

Senior management should receive a clear view of the business implications: residual risk, required investment, regulatory obligations, operational disruption and any patterns across sites or contractors. This allows directors to demonstrate active oversight rather than receiving a superficial incident count after the fact.

A disciplined incident investigation is not simply a response to something going wrong. It is a practical test of whether the organisation’s WHS system works under pressure. When findings are translated into verified improvements, the business is better placed to protect its people, satisfy clients and demonstrate the operational control expected in audits, tenders and regulator scrutiny.