Incident Investigation: 8 Steps That Find the Actual Cause
Technology organisations are unusually good at investigating failures. When a production system goes down, engineering runs a postmortem: a timeline, contributing factors, systemic causes, actions with owners, and a write-up circulated so others learn from it. Blame is explicitly off the table because it degrades the quality of the information.
The same organisations frequently investigate a workplace injury by filling in a form that records what happened and who was involved, and closing it.
The discipline that works for outages works for safety incidents, and most of the sectors this firm works with already own it. They have simply never applied it here.
Eight steps.
1. Know why you are doing it
Two reasons, and they pull in the same direction.
The duty. Regulation 5 of the Management of Health and Safety at Work Regulations 1999 requires arrangements for the effective planning, organisation, control, monitoring and review of preventive and protective measures. Investigation is a core part of monitoring, and its findings feed the review of your risk assessments.
The value. An incident is expensive information you have already paid for. The only question is whether you extract it.
HSE's guide HSG245 covers investigating accidents and incidents.
2. The first hour is not investigation
Separate the immediate response from the enquiry, because conflating them produces bad versions of both.
Care for the person. First aid, and getting them proper treatment. Nothing else matters until this is done.
Make it safe. Stop the activity, isolate the equipment, secure the area, so nobody else is harmed while you work out what happened.
Preserve what you can. Photographs, the physical scene, equipment settings, system logs, access records, rotas. These degrade within hours, and in an office the scene is usually cleared before anybody thinks to record it.
Tell the right people. Internally, and where the incident is reportable, the enforcing authority.
3. Reporting and investigating are different activities
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
A distinction that trips organisations constantly.
Reporting satisfies a legal obligation on a deadline. Investigating works out why it happened and what to change. One does not substitute for the other.
Two consequences. An incident that is not reportable may still be well worth investigating, and near misses are the clearest example. And a reportable incident still needs an investigation, because the report tells the regulator what happened and tells you nothing.
Regulation 12 of RIDDOR requires records of reportable incidents to be kept for at least three years.
4. Build the timeline before you build the explanation
The single most useful technique, and the one borrowed most directly from engineering practice.
Establish what happened, in sequence, with times, before anybody offers a theory. Who was where, what was done, what the conditions were, what was said, what the system showed.
Two disciplines make this work. Talk to people early, separately, and about facts rather than judgements, because memory degrades and hardens quickly. And write down what you do not know as well as what you do.
The common failure is arriving with a conclusion and collecting the facts that support it. Once a theory exists, everybody starts confirming it.
5. Look for causes at three levels
The step that separates a useful investigation from a form.
Immediate cause. The thing that directly produced the harm. The floor was wet; the box was too heavy; the door swung back.
Underlying causes. Why that condition existed. The cleaning schedule runs at the busiest time; heavy items are stored on the top shelf; nobody fitted a vision panel.
Root causes. The organisational reasons the underlying causes persisted. Nobody owns the cleaning schedule; the storage arrangement was never assessed after the move; the fit-out specification omitted it and nobody checked.
Investigations that stop at the first level produce actions like "remind staff to take care", which change nothing. The useful actions almost always come from the third.
6. Ask the system question before the person question
The cultural discipline, and the reason engineering postmortems produce better information than safety forms.
HSE's material on human failure distinguishes slips and lapses from mistakes and from deliberate violations, and the distinction matters because the responses differ entirely.
Where somebody made an error, the productive questions are why the system allowed that error to cause harm, whether anybody else would have done the same, and what made the wrong action easy or the right one difficult.
Where several competent people have all departed from a procedure, that is almost always information about the procedure.
None of this means nobody is ever responsible. It means responsibility is established after the facts, not while gathering them.
7. Actions that actually change something
The output, and where most investigations quietly fail.
Test each proposed action against three questions. Does it change a condition, a design or a process, rather than relying on somebody remembering? Does it have a named owner and a date? And would it have prevented this incident?
Rank them the way you would any control: eliminate the hazard, engineer it out, change the process, then train and instruct. "Toolbox talk delivered" as the sole action after a serious incident is a documented decision to leave the cause in place.
8. Close the loop, and tell people
Two final steps, both routinely skipped.
Verify the actions happened, and that they worked. An action marked complete is not the same as a control operating.
Share what was learned. Engineering postmortems circulate; safety investigations usually do not. Publishing a short, anonymised account of what happened and what changed does three things: it prevents recurrence elsewhere, it demonstrates that reporting produces action, and it is the most effective encouragement to report that exists.
The eight, in short
| Step | The failure it prevents |
|---|---|
| Know why | Investigation as paperwork |
| First hour | Evidence gone before anyone looks |
| Reporting is separate | Report filed, nothing learned |
| Timeline first | Conclusion first, facts to match |
| Three levels of cause | "Remind staff to take care" |
| System before person | Blame, and the information drying up |
| Real actions | Toolbox talk as the whole response |
| Close and share | Actions open, lessons unshared |
Rows five and six are the two that determine whether an investigation is worth doing. The first decides whether you find anything; the second decides whether anybody tells you the truth.
What to investigate, and how deeply
Not everything needs the same treatment, and proportionality matters.
Full investigation: anything causing serious injury, anything reportable, and any near miss whose realistic worst outcome was serious. That last category is the one organisations under-use.
Proportionate enquiry: minor injuries, particularly where a pattern is emerging in one location or activity.
Trend review: the accumulated minor incidents, read together. Three trips in the same corridor in a quarter is a finding that no individual investigation would produce.
HSE's framework for managing health and safety places investigation within the check stage of plan, do, check, act.
For international groups
Two considerations.
Several jurisdictions prescribe the investigation itself. Slovakia requires a registered injury to be investigated with the participation of the injured employee where their condition allows and the relevant employee representative, with the record written within eight days. Morocco requires a committee investigation through two nominated members and a report to two inspectorates within fifteen days. Croatia requires a committee session within two working days of a fatality.
So a group investigation standard has to accommodate mandatory participants and short deadlines, not just a methodology.
Findings travel even where the rules do not. An underlying cause found in one entity frequently exists in others, which is the strongest argument for holding investigations centrally. That is where health and safety consultants and software are worth more together than either alone, and periodic health and safety audits find investigation actions that were closed without being done.
Where Arinite fits
Arinite investigates incidents to the level that produces usable findings, and does it independently, which matters when the underlying cause sits with management decisions rather than with the person injured. We support 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years.
Our health and safety consultants work extensively with IT and software, legal, insurance and education organisations, many of which run excellent incident review in other domains.
Where entities sit in several countries, our global health and safety consultants establish what each jurisdiction requires of participation and timing, and our international health and safety consultants keep that current.
If your last investigation produced an action that was a reminder to be careful, a free gap analysis is the right place to start.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
