How to Conduct an Incident Investigation


How to Conduct an Incident Investigation Image

In this article, we're going to introduce to you a relatively standard process for conducting an incident investigation. While we think you'll find this article and method helpful, know that you may also want to explore an alternative method of incident investigation that uses a learning team.

An incident investigation is something you (and/or others in your company) should perform when an incident occurs at the workplace. This can include near-misses, quality problems, accidents, property damage, illnesses, injuries, and fatalities.

There are two primary purposes of an incident investigation. The first purpose is to identify the root cause or causes of the incident. That's the short-term goal. And the second purpose is to use the information gathered in the incident investigation, and the determination of the root cause, to prevent a similar incident from happening again. That's the long-term goal.

But not everyone knows how to perform an incident investigation. What about you? Do you have a plan in place right now? Do you know what you'd do if you had an incident at work?

If you have already planned your response and investigation, hats off to you. If not, you can begin planning now. But if you don't begin planning your investigation until you've had an incident at work, you're much too late and will be behind the proverbial eight-ball.

So in this article, we'll sketch out what you need to know about performing an incident investigation. And we'll even give you a list you can use to begin making your incident investigation plan and another list you can use to begin stocking up your incident investigation kit. Hope you find it helpful.


We're going to break this article down into the following sections:

  1. Incidents
  2. Incident Investigations--An Overview
  3. Incident Investigations--A Closer Look at Each Step
  4. Incident Investigation Plans

We recommend you read the entire article, and then use the "incident investigation plans" section at the end to guide you through what to do next.

In addition to our guide, you may also want to check out our Incident Investigation eLearning course, which is part of our health and safety training eLearning library. We've got a short sample of it for you immediately below.


Before we charge ahead and begin explaining how to perform an incident investigation, let's start by making sure we know what an incident is and what incidents you should investigate.

What's an Incident?

"Incident" is an umbrella term that includes the following:

  • Fatalities
  • Injuries
  • Illnesses
  • Property damage
  • Environmental release or exposure
  • Near misses

An incident could even be a quality problem or any unexpected occurrence (even something that turned out better than expected).

But let's look at the more commonly investigated "negative" incidents a little more closely.


Just what it sounds like. When someone dies at work.

You can read more about preventing fatalities at work here.


A physical injury, such as a bump on the head or a broken arm.


A sickness, such as a respiratory illness suffered from inhaling chemical fumes.

Property damage

Damage to property, such as crashing a forklift into a shelving unit and damaging the forklift and shelving.

Environmental release or exposure

Releasing something into the environment that should not have been released, such as a toxic leak into a stream.

Near misses

Something that could have resulted in a fatality, injury, illness, and/or property damage, but didn't. For example, a wrench falls from a shelving unit and falls to the ground, barely missing striking a worker on the head.

Check out our interactive poll about what to call a near miss.

For even more on all of this, you might also benefit from reading our overview of Human & Organizational Performance, or HOP, based on Todd Conklin's book Accident Pre-Investigations and/or our article on learning teams for incident investigations based on Todd Conklin's book Accident Pre-Investigation: Better Questions.

Should You Investigate All Incidents?

In an ideal world, you'd investigate all incidents, even near misses.

But of course, time is limited, so it makes sense to prioritize the most severe incidents and/or the ones that happen/could happen most often (see our article on Risk Management and Safety for more about the ideas of severity, frequency, and risk management).

The more incidents you investigate, the more information you'll gather, and therefore the better chance you'll have of avoiding incidents in the future.

Obviously, some incidents will SCREAM for an investigation, such as a fatality (there will be legal requirements to consider as well), while a very minor injury or near miss may not call quite so dramatically for investigation. But again, the more incidents you investigate, the lower your risks will be in the future.

Do All Incidents Merit the Same Type of Investigation?


You'll use a similar technique for all incident investigations, but you'll apply more resources while investigating some incidents than you will when investigating others.

For example, it's logical that more people will play a role in investigating a fatality than in investigating a near miss that would have led to a minor injury.


An incident investigation is a multi-step process. Those steps include:

  1. Gather the necessary people to perform the investigation
  2. Get your previously prepared incident investigation kit
  3. Go to the location of the incident
  4. Help provide any first aid, medical care, or assistance necessary
  5. Secure the area where the incident occurred
  6. Preserve the work area as it is/as it was at the time of the incident
  7. Identify witnesses to the incident
  8. Separate witnesses
  9. Interview the worker(s) involved
  10. Interview the witnesses
  11. Document the scene
  12. Create an incident investigation report
  13. Distribute the incident investigation report
  14. Use the findings of the incident investigation report to better identify and control hazards
  15. Ensure that the corrective actions called for in the report are put into place

Just by skimming the list above, you can understand that you'll benefit from a lot of planning and consideration in advance.

Knowing what the incident investigation will involve will help you in two ways:

  • First, it will help you create a plan for incident investigations that will take place in the future
  • Second, it will guide you through the steps of an incident investigation when you're performing one.

We'll look at each of these steps in much more detail in the section below.


Gather the Necessary People to Lead and Take Part in the Investigation

Normally, an incident investigation is led by the supervisor of the worker(s) involved in the incident.

In some cases, other people may also help the supervisor or may lead the investigation instead of the supervisor. This can include:

  • The EHS/Safety manager
  • A special Incident Investigation team
  • The Safety Committee

In addition, the incident investigation will include:

  • Workers who were injured or made ill by the incident
  • Workers who were present and/or participated but were not injured or made ill
  • Other workers who witnessed the incident

In some cases, the worker involved may have the right to request that an employee representative be present during the investigation.

If the incident is especially major, or if a fatality is involved, senior management, engineering, and/or legal personnel may also play a role.

Get Your Previously Prepared Incident Investigation Kit

When going to the site where the incident took place, take with you an incident investigation kit.

You should have prepared the incident investigation kit in advance so it's ready when needed.

The incident investigation kit should include:

  • Incident investigation forms
  • Interview forms
  • Markers/tape to barricade the incident area
  • High-visibility tape
  • Scissors
  • Scotch tape
  • Warning tags and padlocks to secure the area
  • A camera and/or video recorder
  • A voice recorder (possibly integrated into video recorder)
  • Measuring equipment (measuring tape/ruler)
  • Flashlight
  • Containers to hold samples
  • Personal protective equipment appropriate to your work site
  • Atmospheric monitors appropriate to your work site
  • First aid kit
  • Gloves
  • Large envelopes
  • Graph paper
  • Other paper to write/sketch on
  • A checklist that lists the steps of the incident investigation and the order in which to complete them

Remember, if you don't have an incident investigation kit prepared now, you want to do it soon--before you forget. Do it now, or put a reminder on your email calendar to do it tomorrow, or get old-school and put a Post-In note somewhere. But don't put this off for long.

Go to the Site of the Incident

Once you've got the correct people and your incident investigation kit, go to the site of the incident.

As you approach the area, remember to pay close attention and be cautious. Don't walk into a situation that will harm you, making a bad situation even worse.

Also, make sure you've equipped yourself with any PPE that's necessary to enter the area, either because it's normally needed in that work area or because the incident has created a need for the PPE.

Help Provide Any First Aid, Medical Care, or Other Assistance Necessary

Remember, there's been an incident. People may have been hurt, or a hazard may exist.

Do what is necessary to help any sick or injured people, to get people out of harm's way, and to control the hazard safely before you begin your investigation. Call or otherwise arrange for medical care if necessary.

Secure the Area Where the Incident Occurred

Once people are safe, barricade the area where the incident occurred so that people can't enter.

Preserve the Area As It Was At the Time of the Incident

With the area barricaded, make sure everything in the area stays as it was when the incident occurred. If things are not removed, moved, or changed, it will make the incident investigation more effective and meaningful.

Identify All People Who Were Involved in or Witnessed the Incident

When you get there, you'll want to identify the people who were:

  • Involved in the incident
  • Witnesses to the incident

Do this as soon as possible, before people go their separate ways and begin to forget key details.

The reason you're doing this is because you're going to want to interview all of these people to find out what happened.

But there are two important points to keep in mind at this point.

First, don't interfere with someone if they have suffered a significant injury or illness and need medical attention. That may be obvious, but it's worth stating now and keeping in mind during a real incident investigation.

And second, once you begin identifying and talking to the participants and witnesses, it's important that they know why you want to talk to them and what the purpose of the incident investigation is. And it's equally important that they know what the purpose is NOT. You want to make it clear that the purpose of holding the interviews and conducting the investigation is to gather information that can be used to help prevent similar incidents in the future. And likewise, you want to make it clear that the purpose is NOT to place blame, assign fault, or punish anyone.

Here's a hint: you'll have better luck explaining that the purpose of conducting an incident investigation is simply to prevent future incidents and is NOT to place blame or punish if it's something you've already explained to workers in advance. Consider explaining the purpose of incident investigations to your workers as part of the general safety training that they receive, and/or as part of the standard efforts associated with your safety and health management program. Employees are more likely to cooperate fully, and less likely to worry about participation, if you do this.

Separate the Witnesses

Separate the people that you'll interview: sick/injured people, other participants, and witnesses.

You want to hear each person's wholly unique perspective and thoughts on what happened. If they've hung around and discussed events together, you're less likely to get that raw, unfiltered information and more likely to get people or ideas that have been influenced by other people.

Interview the Workers Affected and/or Involved

Take the person to a place where you can interview him/her privately. While you're interviewing the person, keep the conversation informal. Talk to the person as an equal--don't talk down to the person. Avoid creating an atmosphere that's accusatory or confrontational.

Begin the interview by reminding the person that you're not trying to place blame or penalize, and that you're just trying to learn what happened so similar incidents won't happen again.

Then, ask the person to explain what happened, from beginning to end. Don't interrupt the person--let the person explain the incident in his or her own words. It's a good idea to record this conversation as its happening, and you may also want to take notes with paper and pencil as the person talks.

Once the person has completed his or her story, ask additional questions to fill in any "gaps" or clarify any confusion. Try to use open-ended questions that invite the person to give extended answers based on his or her own thoughts--try to avoid close-ended questions that the person will answer with "Yes" or "No."

Once you believe you understand the person's full story, tell it back to that person. Have them listen to your explanation of their story and ask if you've captured what they experienced accurately. If the person explains that you've got something wrong, or adds more information, correct your version.

Next, ask the person why the incident happened and what they think could have been done to prevent the incident from occurring. Have them focus on the conditions and events that led up to the incident.

Once the person's finished their explanation, you may find it helpful to lead them through the "5 Whys?" exercise. You may already be familiar with this, but if not, it's a simple exercise that helps to identify the root cause of an incident. All you do is ask the question "Why?" five times (give or take a few, based on circumstances) to get from superficial explanations to the true root cause(s) of the incident. Here's an example:

You: Why did the person get hurt? (Why number 1.)

Worker: He put his hand on the moving blade.

You: Why? (Why number 2.)

Worker: He didn't know there was a blade there.

You: Why? (Why number 3.)

Worker: He wasn't properly trained about safety aspects of this machine.

You: Why? (Why number 4.)

Worker: He doesn't normally work in this area and was called in as a replacement without receiving the safety training people who work in this area typically receive.

You: Why? (Why number 5.)

Worker: There's no organized way to determine who's received safety training for this area/that area.

You get the idea. You can also see that the 5 Whys? method could have gone in a different direction above, and that the worker could have suggested that the moving blade should have had been guarded to prevent workers from touching the blade. Remember that your goal is to "dig deep," moving past superficial explanations of a direct cause (the person's had was cut by a moving blade), through indirect causes (the person didn't know there was a moving blade there), to root causes (the person hadn't received proper safety training to work in the area, there's no way to know who's received what safety training, etc.). Remember, there's nothing "magic" about the number 5. Ask "Why?" until you've identified root causes.

Finally, check to see that you've got the following information, all of which may prove helpful during your investigation, while making your report, and while trying to put corrective measures into place:

  • Characteristics of all workers involved with the incident, including:
    • Age
    • Gender
    • Department
    • Job role/title
    • Experience
    • Tenure
    • Employment status (full time, part, time, seasonal, contractor, consultant)
  • Type of injury/illness/incident, including:
    • Description
    • Body part(s) affected
    • Severity
  • Task being performed when incident occurred, including:
    • General task
    • Specific activity within that task
    • Location of involved workers
    • Body posture of involved workers
  • Was person working alone or with others?
  • Time factors associated with incident, including:
    • Time of day
    • Hour within worker's shift (example: 3rd hour of 8-hour shift)
    • Shift (example: day/night)
    • Phase of worker's day (example: entering work, normal work, 15-minute break, mealtime, overtime, leaving work)
  • Supervision when incident occurred (example: worker directly supervised, indirectly supervised, or worker not supervised at time of incident)
  • Expected supervisor when incident occurred (example: normal/not normal, expected/not expected, feasible/not feasible)

Please also read our Incident Investigations: Tips from a Pro article to learn some common mistakes people make while interviewing during an incident investigation.

Interview the Witnesses

Use the same technique that you used to interview people involved in the incident (explained immediately above) to interview all other participants and witnesses.

This interview about performing an incident investigation includes some great tips on how to interview witnesses to an incident (and common mistakes, too).

Document the Scene of the Incident

Once everyone who was involved and/or witnessed the incident has been interviewed, turn your attention to the evidence at the site of the incident.

Because you would have already barricaded the area, conditions should be the same as they were immediately after the incident (or as close to that as possible).

The process of documenting the scene may involve:

  • Taking photos and/or videos
  • Making audio recordings document the scene (perhaps as part of the video)
  • Writing notes
  • Sketching/drawing the scene
  • Making measurements
  • Taking samples
  • Noting information in equipment operation logs, charts, and records

During this part of the incident, gather the following information:

  • Position/status of machines, tools, equipment, supplies, or similar devices
  • Information in equipment operation logs, charts, and records
  • Characteristics of machines/equipment/tools/supplies associated with incident, including:
    • Type
    • Brand
    • Identification numbers
    • Size
    • Distinguishing features
    • Condition
    • Specific part(s) involved
    • Operating settings/status
    • Entries in logs/charts/records
  • Any other materials/subjects involved (example: chemicals)
  • Atmospheric/environmental conditions, including:
    • Temperature
    • Light
    • Noise
    • Weather
    • Ergonomics
  • Preventive measures in place when incident occurred
  • How well any preventive measures in place performed

Please note: there's no reason why documentation of the incident scene can't be going on at the same time as incident participants and witnesses are being witnessed, and if you have enough people on your incident investigation team, that's ideal.

Create an Incident Investigation Report

Once you've gathered all the information, it's time to create a written report.

Your report should:

  • Summarize everything you learned during your investigation
  • Identify root causes of the incident
  • Recommend corrective measures
  • List who's responsible for ensuring each corrective measure is put into place
  • State the date by which each corrective measure should be put into place

This article includes some great tips on how to determine the root cause of a workplace incident.

Distribute the Incident Investigation Report

Once you've created the report, it's time to distribute the report.

Once of the things you should do before an incident occurs is determine who should get a copy of incident investigation reports and how quickly these reports should be created and distributed.

In addition, you should have determined what kind of information gets relayed to managers and general employees, and how that information is made public. You'll want to follow through accordingly to plan and communicate the appropriate information accordingly.

Communicate Report Findings to the General Work Force

You may not distribute the full incident investigation report in its original form to all workers.

However, you should communicate key findings of the report to the workers at the site.

Use the Findings of the Report to Implement Corrective Measures

Use the findings and recommendations of the report to put corrective measures into place.

Make sure anyone who is responsible for putting a corrective measure into place knows:

  • What he/she is responsible for doing
  • When he/she should have the correct measures in place
  • How he/she should communicate any problems experienced while putting the corrective measures in place or how to communicate if he/she could not put the corrective measures in place
  • How he/she should communicate that the corrective measures have been put into place so that they can be tracked

Ensure that the Corrective Actions Called For Are Put Into Place

You should have some way to track if and when all corrective actions have been put into place.

Be sure everyone involved in implementing corrective measures knows how to track completion of those measures, and make sure someone has the final responsibility of ensuring that all measures have been implemented by a certain date.

If you don't track the completion of these corrective measures, it's easy for one (or several) to never get done.


Now that we've discussed incidents and incident investigations, let's turn our attention to the logical next step: the incident investigation plan.

What's an Incident Investigation Plan?

It's your plan for preparing to lead incident investigations and for how you'll actually conduct one.

When Should You Create an Incident Investigation Plan?

Now. Or soon.

The critical thing is, you want to create an incident investigation plan before you need to perform an incident investigation.

And of course, since the future's uncertain, you don't know when the next incident is going to occur. So the sooner you create your plan, the better.

Reading the information below will help you create your incident investigation plan.

Why Should You Create an Incident Investigation Plan?

An incident investigation is a multi-step process that requires you to:

  • Consider some things in advance
  • Make some decisions in advance
  • Inform some people in advance
  • Provide training in advance
  • Gather materials in advance
  • Create forms in advance

All this work that's done in advance will make your incident investigation much more effective. And that should be reason enough to do it now.

Now that you know quite a bit about incidents, and also know what to do during a real incident investigation, it's time to start creating an incident investigation plan for your workplace.

Do it now, or soon, instead of later. If you're not going to do it now, go to your calendar, find the next open opportunity, and set an appointment with yourself. Get the time blocked out now, make it a personal action item, and get it done.

What to Include in Your Incident Investigation Plan

Here are some things to include in your incident investigation plan:

Which incidents will be investigated?

Some? All? Just injuries and illnesses? Property damage? What about near misses?

How intensively will different types of incidents be investigated?

It makes sense that some incidents, such as ones that result in a fatality or serious injury, may lead to more intensive incident investigations that other incidents, such as those that lead to a near miss that would have led to only a minor outcome. Give this idea some thought now and come up with a plan to respond/investigate appropriately.

Who should be involved in incident investigations?

Who will be involved in incident investigations? Will it always be the same person/people? Or might it include different people with the same job title (for example, the department manager who supervises the worker involved)?

Will the EHS/Safety manager always be involved? When should management, engineering, and/or legal be included? Is an employee representative to be included? If so, in which cases, and who is that person?

What will be in your incident investigation kit?

Come up with a list (use the recommendations above as a starting point), go get what you need, and put it all together in a single bag or case.

Remember, sooner is better than later for this.

Are policies and procedures in place for contacting outside help in the event of an emergency?

This is a little off-topic, but it's worth double-checking at this point.

Are there specific policies in place for employees, managers, and others at the company to summon emergency assistance when necessary after an incident has occurred? Have these methods been explained adequately to all workers?

Do all workers understand the explanations, and can they do what's necessary should the need arise?

Do all methods and systems used to do this (example: emergency phone systems, alarms) work and are they tested regularly?

This is stuff that's worth checking on.

Has everyone received proper training about incident investigations?

Some people at your workplace may actively play a role in conducting an incident investigation. Before they do, they should know they may be called upon to do this, and they should be trained in the purpose and methods.

In addition, all workers could potentially be included in an incident investigation--being interviewed because they were directly involved or because they were witnesses. As we mentioned earlier, it's important that they understand the purpose of the incident investigation isn't to assign blame or punish. Make sure all workers know in advance that incidents will be followed by incident investigations, and make sure they realize the purpose of an incident investigation is to determine root causes and implement preventive measures so similar incidents won't happen again. And that the purpose isn't to assign blame or punish.

Create, print, and store interview forms

Create an interview form that can lead interviewers through the process of conducting interviews with the people who were involved in the incident or witnessed the incident. Print out many copies of the form, put them on a clipboard or in a hard-covered binder, and put them into your incident investigation kit. Keep an electronic copy and save it in some logical place on your computer or the work network so you can access this later, print more copies, and/or modify it as necessary.

Create, print, and store investigation forms

Once you’ve finished with the forms to lead investigators through the interview process, create a similar form to lead investigators through the rest of the investigation. Use the section above, where we explain what to look for during the investigation, as a starting point for what to include in your investigation forms.

Print out many copies of the form, put them on a clipboard or in a hard-covered binder, and put them into your incident investigation kit. Keep an electronic copy and save it in some logical place on your computer or the work network so you can access this later, print more copies, and/or modify it as necessary.

Create a template form for your incident investigation reports

You’ll also want to create a form that acts as a template for the person completing the incident investigation report. That form can be used to guide the person writing the report so that he/she is sure to include all the relevant information.

It’s not necessary to print this out, but do save a copy on a computer or the work network so its’ ready when needed.

Determine who will complete the incident investigation

Who completes the incident investigation report? The same person every time? Or is it someone different each time?

Determine how quickly the incident investigation report should be completed

Will there be a specific deadline for completing incident investigations? No deadline? Or will it vary, depending on the type of incident?

Figure out who will get a full copy of the completed incident investigation report

When the incident report is complete, it should be distributed at the workplace. Determine who will get a full copy of the report and have that list available and ready when needed.

Determine a method for implementing corrective measures

How will people responsible for implementing the various corrective measures know they’re responsible? How is this communicated?

How will they note when they’ve successfully implemented the corrective measure? What will they do if they try to implement a corrective measure and can’t? How will they communicate that information?

Determine a method for checking to see if corrective measures have been implemented

Finally, create a method to check back and confirm that all of the correct measures have been implemented. Make sure someone’s responsible for doing this and that it’s done by a specified date.

If that person finds that one or more measure has not been implemented, have the person follow through to find out why and to get the measure implemented as soon as possible.

Conclusion: How to Conduct an Incident Investigation

By performing an incident investigation as described above, you’ve got a better chance of eliminating or reducing the number of incidents at your workplace.

If you explain the process to all the workers at your site, and explain its purpose is to prevent future incidents and not to blame or punish, you’ll have a much better chance of getting their buy-in and of getting full cooperation during an actual investigation.

Remember that the people who will help lead investigations need training in advance about the purpose, methods, and tools used in the investigation, and be sure to get your incident investigation plan and incident investigation kit finished soon, using the tips above as a guide.

For even more information about incident investigations, you may find these articles helpful:

Want to Know More?

Reach out and a Vector Solutions representative will respond back to help answer any questions you might have.