How to Conduct a Workplace Incident Investigation

When something goes wrong at work, the first explanation is rarely the complete explanation. A worker slipped. An operator pushed the wrong control. A driver did not see someone. A procedure was not followed. Those statements may describe part of what happened. They do not necessarily explain the event.

The objective is not to make the evidence fit a story. Make the story fit the evidence.

What Is the Purpose of an Incident Investigation?

The purpose of an investigation is not simply to complete a report. It is to learn enough about an event to make informed decisions.

A useful investigation should help answer:

• What happened?
• What evidence supports that account?
• What conditions influenced the event?
• Which controls were present?
• How did those controls perform?
• What reasonable alternative explanations exist?
• What can be changed to reduce the likelihood or consequences of a similar event?

OSHA similarly describes incident investigation as an opportunity to identify hazards, shortcomings in safety and health programs, and corrective actions that can prevent future incidents. That makes investigation a learning process—not merely a documentation exercise.

Which Events Should Be Investigated?

Organizations naturally investigate serious injuries. But learning should not be limited to events with severe outcomes.

Depending on your organization's investigation criteria, useful learning opportunities can include:

• injuries,
• occupational illnesses,
• property-damage events,
• equipment failures,
• environmental events,
• near misses or close calls, and
• other events that reveal weaknesses in controls.

OSHA specifically encourages employers to investigate workplace injuries and close calls because these events can reveal hazards and program weaknesses. The severity of the outcome is not always a good measure of how much can be learned. Sometimes the difference between a near miss and a serious injury is only timing, position, or luck.

First: Take Care of People and Stabilize the Situation

Investigation is not the first priority when someone needs help. Address immediate needs first.

That can include:

• emergency response,
• first aid or medical care,
• controlling continuing hazards,
• preventing additional exposure, and
• making the area safe enough for necessary response activities.

Once immediate needs are addressed, preserve relevant evidence as soon as practicable.

A Regulatory Note

Internal investigation procedures should not be confused with external reporting obligations. For employers covered by OSHA's reporting requirements, certain severe work-related events have specific reporting deadlines. Verify the current requirements and any applicable state-plan rules whenever a serious event occurs.

Preserve Evidence Before It Changes

Workplaces do not remain frozen after an incident. Equipment gets moved. Materials are cleaned up. Employees leave. Weather changes. Digital records are overwritten. Production resumes. The scene you examine tomorrow may not be the scene that existed when the event occurred. Preserve relevant evidence as early as reasonably possible.

Depending on the event, that may include:

• photographs,
• video,
• equipment condition,
• control positions,
• measurements,
• damaged components,
• tools,
• personal protective equipment,
• electronic records,
• access records,
• maintenance history,
• permits,
• procedures,
• training records,
• inspection records,
• communications, and
• witness information.

Do not collect everything merely because it exists. Collect what may help establish or test the account of the event.

Start With a Neutral Event Statement

Early descriptions can quietly bias an investigation.

Compare:

“Employee failed to secure the load and caused it to fall.”

with:

“A load shifted and fell during material handling, resulting in an employee injury.”

The first statement already contains a conclusion about cause. The second identifies the event without deciding why it happened. At the beginning of an investigation, use neutral language. Conclusions should come after the evidence—not before it.

Build a Timeline

A timeline is one of the simplest and most powerful investigation tools. Start before the incident.

Include relevant:

• planning,
• preparation,
• equipment setup,
• work activities,
• changes in conditions,
• communications,
• decisions,
• control actions,
• event sequence, and
• response activities.

Do not worry if the first timeline has gaps. Those gaps tell you where additional evidence may be needed. The timeline should evolve as the investigation develops.

Separate Facts, Statements and Interpretations

These are not the same thing.

Fact or physical evidence

A photograph shows a guard in a particular position.

Statement

A witness says the guard was open before the event.

Interpretation

Someone concludes that the open guard caused the event. Each may be relevant. But they carry different evidentiary meaning. Keeping them separate reduces the chance that an early interpretation quietly becomes accepted as fact.

Interview People to Learn, Not Confirm

Interviews should help reconstruct what happened and how the situation appeared to the people involved. Do not begin an interview trying to prove your theory. Start broadly.

Useful questions include:

“Walk me through what happened.”

“What were you doing immediately before that?”

“What did you see?”

“What did you expect to happen?”

“What happened next?”

“What was different from normal?”

“What normally makes this job difficult?”

“What usually helps this job go well?”

“Is there anything else you think I should understand?”

Open questions allow information to emerge that the investigator may not have anticipated.

Avoid Leading Questions

Compare:

“You were rushing because production was behind, weren't you?”

with:

“What was happening with production at the time?”

The first question supplies an explanation. The second explores the condition. Investigators should remain open to explanations that differ from their initial expectations.

Understand What Made Sense at the Time

Hindsight changes how an event looks.

Afterward, we know:

• which warning mattered,
• which decision preceded the event,
• what the outcome was, and
• what someone theoretically could have done differently.

The people involved did not have knowledge of the outcome beforehand.

Try to reconstruct:

• what they knew,
• what they could see,
• what they expected,
• what they were trying to accomplish,
• what normally happened,
• what information was available, and
• what competing demands existed.

Understanding why an action made sense at the time does not mean declaring the action correct. It means investigating it accurately.

Do Not Stop at Human Error

Suppose the investigation finds:

The operator selected the wrong control. That may be true. Now continue.

Ask:

• Why was the incorrect control easy to select?
• How were the controls arranged?
• Were labels clear?
• What feedback did the operator receive?
• Was the operator interrupted?
• Was this a familiar control arrangement?
• What should have detected the incorrect selection?
• Why could one incorrect selection produce the consequence?

OSHA likewise cautions investigators against stopping when they conclude that a worker made an error or failed to follow a procedure. Human action can be part of the event without being the end of the investigation.

Do Not Stop at Procedure Violation

The same principle applies when someone did not follow a procedure. First establish whether the procedure actually applied.

Then ask:

• Did the worker know it?
• Was it available?
• Was it understandable?
• Did it match the current equipment?
• Did it match the way the work was normally performed?
• Were the necessary tools available?
• Did another requirement conflict with it?
• Was the deviation common?
• Did supervisors know about the normal practice?
• Was the behavior deliberate?
• What conditions influenced the decision?

The fact that a procedure was not followed is evidence. It is not automatically a complete explanation.

Examine the Controls

A strong investigation examines what was supposed to prevent the event or reduce its consequences.

Controls might include:

• elimination,
• substitution,
• physical separation,
• guarding,
• interlocks,
• alarms,
• engineering safeguards,
• procedures,
• permits,
• inspections,
• training,
• supervision, or
• personal protective equipment.

For each relevant control, ask:

Was it present?

Was it available?

Was it being used?

Did it function as intended?

Could it be bypassed?

Was it reliable?

Did people understand it?

Did it detect the developing problem?

Did it reduce the consequence?

Sometimes the most important finding is not that someone made an error. It is that one ordinary error could pass through several layers of protection without being detected.

Test Competing Explanations

Investigators can become attached to the first explanation that appears to fit. Fight that tendency.

Suppose one explanation is:

The worker was distracted. Ask what evidence supports it. Then ask what other explanations fit the known facts.

Could there have been:

• poor visibility,
• equipment design issues,
• unexpected movement,
• communication problems,
• confusing feedback,
• workload,
• interruption,
• procedural mismatch, or
• another condition?

You do not need to invent exotic possibilities. You do need to test reasonable alternatives. The explanation that survives should be the one best supported by the evidence.

Look for Multiple Contributing Conditions

Workplace events frequently involve more than one contributing factor.

An incident might involve a combination of:

• equipment condition,
• work environment,
• human decisions,
• planning,
• communication,
• control weaknesses,
• supervision,
• design,
• maintenance,
• organizational expectations, and
• normal work practices.

Do not force a complex event into one convenient box simply because the investigation form asks for a single “root cause.” OSHA's own recommended practices recognize that incidents often have more than one underlying cause.

Ask Why the Event Does Not Happen More Often

This question can reveal something traditional investigations miss:

What normally makes the work successful?

Suppose employees perform the task hundreds of times each month.

Why have most of those attempts succeeded?

Maybe workers:

• informally verify each other's work,
• notice subtle warning signs,
• communicate in ways not described in the procedure,
• adjust the sequence,
• compensate for equipment limitations, or
• use experience to keep the process within safe boundaries.

Those adaptations may contain important information. Investigations should learn from successful work as well as failure.

Develop Corrective Actions From the Findings

Corrective actions should connect to the conditions identified during the investigation. If the investigation identifies an equipment-design weakness, retraining employees may not address it. If the problem is an outdated procedure, disciplining one worker does not update the procedure. If workers cannot see approaching equipment, telling them to “be more aware” does not improve visibility.

Ask:

What condition are we trying to change?

Then choose an action capable of changing it. Where feasible, consider stronger controls before relying primarily on warnings, procedures, training, or personal protective equipment.

Verify That Corrective Actions Actually Work

Closing an action in a tracking system is not the same as improving the system.

After implementation, ask:

• Was the action completed?
• Does it function as intended?
• Did it introduce another problem?
• Do employees actually use it?
• Does it address the condition identified?
• Is the control sustainable?
• Has the risk meaningfully changed?

OSHA's safety-management guidance likewise emphasizes tracking corrective actions and ensuring that controls remain effective. Corrective-action verification belongs to the investigation process.

When Does a Learning Team Fit?

An investigation and a Learning Team can support one another, but they are not identical. An investigation should establish a supported account of an event and examine the evidence and controls.

A Learning Team can then explore more deeply:

• how the work normally happens,
• where work varies,
• what makes the job difficult,
• what adaptations employees make,
• what helps the work succeed, and
• where work as imagined differs from work as done.

A Learning Team can also begin proactively when no incident has occurred.

A useful distinction is:

Investigation asks what the evidence supports about the event. A Learning Team explores how the work actually happens and what can be learned from it.

What Should an Investigation Report Contain?

The exact format will vary by organization and event, but a useful report should make the reasoning traceable.

That can include:

• event description,
• scope,
• evidence reviewed,
• timeline,
• relevant statements,
• established facts,
• uncertainties,
• contributing conditions,
• control analysis,
• conclusions,
• corrective actions,
• responsible parties,
• target dates, and
• verification requirements.

A reader should be able to understand how the evidence led to the conclusions.

A Simple Investigation Test

Before closing the investigation, ask:

Can we explain what happened without relying on unsupported assumptions?

Have we separated evidence from interpretation?

Have we looked beyond the immediate human action?

Have we examined how the controls performed?

Have we considered reasonable competing explanations?

Do our corrective actions address conditions supported by the evidence?

Will we verify that those actions work?

If not, the investigation may not be finished.

The Standard: A Supported Account

A good investigation does not need to create a perfect explanation of everything that happened. Sometimes evidence is incomplete. Sometimes witnesses disagree. Sometimes uncertainty remains. The investigator's job is not to eliminate uncertainty by guessing. It is to identify what the evidence supports, what it does not support, and what remains unknown.

That produces something far more valuable than a convenient story:

a supported account of the event. And from that supported account, the organization can make better decisions.

For a closer look, read Root Cause Analysis vs. Learning From Events.

Supporting resources

Related commercial publications are disclosed under Authorship & disclosures below.