How to Create an Incident Investigation Plan (+ Checklist)

An incident happens on second shift. The supervisor doesn’t know who to call, the camera is in someone’s desk, the witness has already gone home, and the investigation form is a blank page. By the time anyone starts investigating, the scene has been cleaned up.

An incident investigation plan is a documented process that sets out, before anything goes wrong, which events get investigated, who investigates them, what tools they use, and how findings turn into corrective actions.

Having an incident investigation plan in place will allow you to quickly and smoothly begin, conduct, and complete your incident investigation. You’ll know what to do when, you’ll know who to involve and notify, and you’ll have all your supplies and equipment ready to go.

This article covers what to put in your plan, the six-step incident investigation process your plan should follow, and a checklist you can use to build or audit your own.

Main Takeaways

• An incident investigation plan defines, before an incident, which events get investigated, who leads, what tools they use, and how corrective actions get tracked to closure.
• Scale each investigation to the event’s worst credible outcome, not just what actually happened. A near miss that could have been fatal deserves a full investigation.
• OSHA requires employers to report a work-related fatality within 8 hours and an in-patient hospitalization, amputation, or eye loss within 24 hours, so the plan must name who makes those calls.
• A six-step process (respond, plan, collect, analyze, correct, report) keeps every investigation consistent across sites and shifts.
• An investigation isn’t finished when the report is filed. It’s finished when the corrective action is verified to work.

Why Every Workplace Needs an Incident Investigation Plan

An incident investigation plan turns a stressful, unplanned event into a repeatable process. Without one, investigations start late, evidence disappears, and corrective actions stall. With one, every incident follows the same steps, no matter who’s on shift.

Create your incident investigation plan before there’s an incident at work. That way, should there be an incident, the plan will be in place and the investigation will run more smoothly.

A strong plan:

• Finds root causes, so the same incident doesn’t happen again.
• Exposes gaps in existing controls and compliance before an inspector or insurer does.
• Creates defensible records for OSHA, insurers, and workers’ compensation claims.
• Shows workers that reports lead to action, which builds a stronger reporting culture.

The stakes are real. The National Safety Council estimates that each medically consulted work injury cost $48,000 in 2024. That figure reflects the cost to society, not a single employer’s bill, but it shows what’s at stake when a known hazard goes unaddressed.

You’ll see “incident investigation” and “accident investigation” used interchangeably, and the same goes for the incident investigation process and the accident investigation process. OSHA prefers “incident” because nearly all workplace injuries and illnesses are preventable, and the term includes near misses.

What Should an Incident Investigation Plan Include?

A complete incident investigation plan defines which incidents trigger an investigation, the investigation approach, how scope scales with severity, pre-assigned team roles, an investigation kit, emergency contacts, workforce training, ready-to-use forms and report templates, and a method for assigning and verifying corrective actions.

What should an incident investigation program include? Start with these components:

• Which incidents to investigate
• What type of incident investigation you’ll perform
• How thoroughly you’ll investigate different types of incidents
• Who will be involved in incident investigations
• What you’ll want in your incident investigation kit
• When your organization should contact outside help during certain emergencies
• Training for all employees, including supervisors, on incidents and incident investigations
• Plans and procedures for creating, printing, and storing necessary forms and documents, including investigation forms, interview forms, and incident investigation reports
• Who will conduct each phase of the incident investigation

Define Which Incidents Trigger an Investigation

Will you perform an incident investigation after every incident, or just after some of them? If some, how will you determine which incidents call for an investigation? Only the most severe? Only the most costly? And what about near misses? Safety observations?

Investigate every incident and near miss at some level, and scale the depth to the worst credible outcome, not just what actually happened. A near miss that could have caused a serious injury gets a full investigation, even though no one was hurt.

Use severity tiers to decide how deep each investigation goes, who joins the team, and what OSHA requires.

Choose Your Investigation Approach

Probably the most common way to perform an incident investigation involves going to the scene, performing interviews, and searching for one or more root cause(s).

A newer, alternative method is to perform a learning team exercise, which is more of a team-based learning approach.

Your plan should name a default approach and note when the other one applies. For example, use learning teams for complex events with many contributing factors, or when workers are hesitant to speak up in formal interviews.

Assign Roles Before an Incident Happens

Decide whether you’ll lead investigations alone or create a team. A team is the better choice, and it should include employees. Add legal, engineering, or management when the incident calls for it. Make sure everyone on the team knows they’re on it and knows their role.

Also decide whether and when you’ll use external, third-party investigators.

Assign each role in advance so the team knows who does what the moment an incident is reported.

When a temporary worker is injured, the host employer and staffing agency share safety responsibilities. The host employer typically records the injury on its OSHA 300 Log if it supervises the worker day to day. Agree in advance on who participates in the investigation, so it doesn’t stall over who owns it.

With Vector EHS Management, configurable incident forms and real-time alerts notify the right people as soon as an incident is reported.

Build Your Incident Investigation Kit

When an incident does occur at work, it helps to have a pre-planned, pre-packed bag or case full of everything you’ll need to conduct the investigation. That’s what an incident investigation kit is. Stock yours with:

• Camera or phone with a charger
• Cones and barrier tape
• Lockout tags
• PPE
• Measuring tape and a flashlight
• Evidence bags and sample containers
• Notebook and pens
• Investigation forms and interview forms
• Emergency contact list

Set Up Emergency Contacts and Outside Help

There may be incidents that are so severe that they require you to get help from emergency responders, such as an active shooter situation, a serious injury, or a fire.

Now’s a good time to figure out all of the emergency responders that you may need to call on in the event of serious incidents like this, find out the best way to contact them, create lists with those contact numbers, and post them at appropriate places at work.

Confirm how people will reach those responders, whether by landline, cell phone, computer, or radio. Make sure the equipment works, test it on a recurring schedule, and make sure everyone knows how to use it.

Name who makes the OSHA report for severe and fatal incidents, and keep OSHA’s reporting phone number and online form on the same contact list.

Prepare Forms, Interview Guides, and Report Templates

• Investigation forms: Guide investigators through each step and give them a place to enter information during the investigation.
• Interview forms: Guide interviews with people who were involved in or witnessed the incident, and record their answers.
• Report templates: Get reports ready in template form now, so every investigation documents the same elements. Step 6 below lists what every report should include.
• Distribution list: Decide in advance who will get a full copy of the completed report.

Train Your Workforce on the Process

Make sure everyone at work knows that you plan on conducting incident investigations after incidents occur, and that those investigations will be used to learn and try to prevent future incidents, not to assign blame and punish.

You’ll also want to make sure people know what to do in the event of an incident, what the incident investigation process is, and what role they will play, if any, in the incident investigation.

Train supervisors in more depth, since they’re usually the first ones on the scene.

Plan How Corrective Actions Get Assigned and Verified

After an investigation, you’ll usually put one or more corrective actions into effect. Decide now how that happens: who gets notified, and how. Then decide how you’ll confirm those corrective actions are actually completed.

Step 5 of the process below walks through how to assign, track, and verify each corrective action.

The Incident Investigation Process: 6 Steps Your Plan Should Follow

A workplace incident investigation follows six steps: respond and assess severity, plan the investigation, collect evidence, analyze root causes, assign and verify corrective actions, and report and share the results.

Step 1: Respond Immediately and Assess Severity

1. Get injured workers medical care.
2. Secure the scene to prevent further harm.
3. Preserve physical evidence before it changes or disappears.
4. Begin the investigation as soon as conditions are safe.

Begin the investigation as soon as the scene is safe and injured workers have care, ideally on the same shift. Delays degrade evidence and witness memory. For severe incidents, OSHA requires a report within 8 hours of a fatality and within 24 hours of an in-patient hospitalization, amputation, or loss of an eye.

Step 2: Plan the Investigation

• Set the scope using the severity tier: define what happened, where, and when, which equipment and processes are involved, and which records you’ll need.
• Bring in the pre-assigned team and confirm everyone has the kit, forms, and authority they need.
• Estimate a timeline so the investigation doesn’t drag on and lose momentum.

Step 3: Collect Evidence Before It Disappears

1. Photos and video of the scene, equipment positions, and conditions
2. Physical evidence, such as damaged equipment, PPE, or materials
3. Equipment logs, maintenance records, and inspection histories
4. Written procedures and training records for the tasks involved
5. Environmental conditions, such as lighting, weather, noise, and temperature

Interview each witness separately and as soon as possible, so accounts don’t blend together. Use open-ended questions, interview at the scene when it’s safe to help jog memories, and ask workers how they think the incident could have been prevented. Remind them that the goal is to fix the system, not to blame anyone.

Then organize the evidence into a sequence of events before, during, and after the incident. Your documentation of an incident investigation should be detailed enough for someone who wasn’t there to understand exactly what happened.

Step 4: Analyze the Data and Find Root Causes

Root cause analysis turns your evidence and timeline into an explanation of why the incident happened. It looks past the surface error to the system failures, missing controls, or process gaps that allowed it, so your fix prevents the next incident instead of just the last one.

Look for causes at three layers:

1. Direct cause: The immediate action or condition that caused harm (for example, “the worker slipped”).
2. Contributing causes: The conditions or decisions that set the stage.
3. Root cause: The underlying system failure that, if fixed, prevents a repeat (for example, “the cleaning procedure didn’t specify anti-slip coating”).

“Human error” isn’t a root cause. It’s the starting point for asking why the error was possible.

Match the analysis method to the incident’s complexity.

Step 5: Assign Corrective Actions and Verify Results

1. Assign one owner. One person is accountable for each action, not a committee.
2. Set a specific deadline. Use a date, not “as soon as possible.”
3. Track status in one place. Monitor which actions are open, in progress, and complete.
4. Verify effectiveness. Re-inspect, observe the changed process, or review incident data to confirm the fix worked.

Choose the strongest fix the root cause allows, using the hierarchy of controls. If the root cause is a missing procedure, the fix is writing the procedure and training on it, not reminding workers to “be careful.”

Verification is where most programs break down. A corrective action marked “complete” isn’t the same as one that works. Closing the loop means checking again at 30, 60, or 90 days to confirm the fix held and didn’t create new risks.

Vector EHS Management connects incident reports to corrective actions, with alerts and dashboards that show which actions are open, overdue, or complete.

Step 6: Report, Share, and Update Your Plan

Strong accident investigation reporting covers five elements:

1. Incident description: What happened, where, when, and who was involved.
2. Evidence summary: Photos, witness statements, equipment records, and the timeline.
3. Root cause analysis: The method used and the causes found at each layer.
4. Corrective actions: Specific fixes with owners and due dates.
5. Follow-up plan: How and when you’ll verify the actions worked.

The investigation report supports your OSHA 301 and OSHA 300 Log entries. Establishments with 100 or more employees in designated high-hazard industries must also submit 300 and 301 data electronically by March 2 each year. OSHA requires employers to keep the 300 Log, 300A, and 301 for five years after the end of the year they cover, and keeping investigation reports on the same schedule is good practice.

Have the people involved review the report for accuracy before it’s final. Then share key lessons with workers through briefings or toolbox talks. Workers who see that reports lead to action are more likely to report the next hazard.

After each significant investigation, and at least once a year, review the plan itself. Ask what slowed the investigation down, and fix it before the next incident.

Incident Investigation Plan Checklist

Use this checklist to build your plan, or to audit the one you have.

Before an incident (plan setup):

• Written criteria for which incidents and near misses trigger an investigation
• Severity tiers that set investigation scope
• A default investigation approach (traditional root cause analysis or learning teams)
• A named investigation lead and team roles
• An agreement with staffing agencies on temporary worker incidents
• A stocked incident investigation kit
• An emergency contact list, including who reports to OSHA
• Investigation forms, interview forms, and report templates
• A report distribution list
• Workforce and supervisor training on the process and its no-blame purpose
• A corrective action workflow with owners, deadlines, and verification

After an incident (investigation steps):

• Injured workers received care, and the scene is secure
• Severity assessed and OSHA reporting deadlines met
• Perishable evidence photographed and preserved
• Witnesses interviewed separately
• Timeline of events built
• Root causes identified, not just the direct cause
• Corrective actions assigned with owners and due dates
• Report completed, reviewed, and distributed
• OSHA forms updated
• Corrective actions verified at follow-up
• Plan reviewed for improvements

Put Your Incident Investigation Plan Into Action With Vector Solutions

You now have what you need to build an incident investigation plan before an incident, run a consistent six-step investigation after one, and use the checklist to keep both on track.

Start with the checklist’s “before an incident” section this week, and close the biggest gap first.

Vector Solutions helps safety teams run that plan in one place. Vector EHS Management connects incident reports, investigations, corrective actions, and OSHA recordkeeping, so every investigation follows the same process and every fix has a record.

FAQs About Incident Investigation Plans

What’s the Difference Between an Incident Investigation and an Accident Investigation?

The terms describe the same process. OSHA prefers “incident” because nearly all workplace injuries are preventable and the term covers near misses, not just events that caused harm. Many organizations still use “accident investigation” in their written procedures, and either term works for your accident investigation procedure as long as near misses are included.

What Is the Purpose of an Incident Investigation?

The purpose is to find the root causes of an incident or near miss and fix the system failures behind it, so it doesn’t happen again. It isn’t to assign blame. A no-blame approach gets witnesses to share accurate accounts, which leads to fewer repeat incidents and stronger records.

How Do I Decide Whether a Near Miss Gets a Full Investigation?

Base the decision on the worst credible outcome, not what actually happened. A near miss that could have caused a serious injury, or that repeats a known pattern, deserves a team investigation. A low-potential event can get a short supervisor review. Treat repeat events and failed controls as triggers to escalate.

What if the Root Cause Points to a Management Decision?

Document it the same way you’d document any other root cause. Keep the report factual and focused on the decision and its effect, not the person. Then assign the corrective action to someone with authority over that decision, escalating through the EHS reporting line if needed.

What if Witnesses or Evidence Are Hard to Reach?

Capture what’s still available right away, and record every gap. Take scene photos and pull equipment data first, interview reachable witnesses separately, and schedule follow-up or remote interviews for the rest. Note in the report which conclusions rest on incomplete evidence.

How Often Should We Review Our Incident Investigation Plan?

Review the plan after any significant investigation and at least once a year. Look at what slowed investigations down, how many corrective actions closed on time and were verified, and whether repeat incidents are declining. Treat a rise in near miss reports as a healthy sign of reporting culture, not a failure.