Resources › Incident Management

How to Conduct an Effective Incident Investigation

Richard Levack Richard Levack
· 6 min read · Incident Management

Every workplace incident is a failure of a system, not just a failure of a person. The purpose of an investigation is to understand what went wrong and prevent it happening again — not to find someone to blame.

Too many organisations conduct investigations that stop at the immediate cause ("the operator didn't follow the procedure") without asking why. Effective investigations dig deeper.

Immediate response: secure the scene

Before the investigation begins, ensure the immediate situation is safe. Provide first aid, isolate the area if necessary, and preserve evidence. This means not cleaning up, not moving equipment, and not allowing the scene to be altered before it's been documented.

Take photographs, note the positions of equipment and materials, and record the time and conditions (weather, lighting, shift patterns). Evidence deteriorates quickly — what you capture in the first hour is more valuable than anything you reconstruct later.

Gather the facts

Interview witnesses as soon as practically possible, while memories are fresh. Use open questions: "Describe what you saw," not "Did you see him fail to clip on?" Leading questions produce the answers you expect, not the answers you need.

Collect documents: the relevant risk assessment, method statement, training records, maintenance logs, permit-to-work records. Were they current? Were they followed? Were they adequate?

Build a timeline of events. What happened, in what order, and who was involved at each stage?

Find the root cause, not just the immediate cause

The immediate cause is what directly led to the incident. The root cause is the underlying system failure that allowed the immediate cause to exist.

Example: a chemical spill occurs because a valve was left open (immediate cause). The root cause might be that the isolation procedure was ambiguous, that the operator wasn't trained on the new valve configuration, that the management of change process didn't capture the equipment modification, or that the shift handover didn't communicate the status of the system.

Tools that help identify root causes include the "5 Whys" technique (asking "why" repeatedly until you reach a systemic factor), fault tree analysis, and bow-tie analysis. The right tool depends on the complexity of the incident.

Identify corrective and preventive actions

Every root cause should have at least one corrective action. Corrective actions should be:

  • Specific — "improve training" is too vague; "deliver refresher training on isolation procedures to all shift operators by [date]" is actionable
  • Assigned to a named individual — actions without owners don't get done
  • Time-bound — set a realistic deadline and track completion
  • Proportionate — the action should address the root cause, not just the symptom

Consider whether the same root cause could exist elsewhere in the organisation. If your shift handover process failed for this operation, it might be failing for others too.

Report and communicate

Document the investigation findings, root causes, and corrective actions in a clear report. Share the findings with relevant teams — not just the people directly involved, but anyone who could benefit from the lessons learned.

The investigation report should be honest and factual. It's not a legal defence document — it's a learning tool. If the investigation finds that a management system was inadequate, say so. Organisations that hide behind vague findings don't learn and don't improve.

Close the loop

Track corrective actions to completion. Verify that the actions taken have actually addressed the root cause. Review the effectiveness of the changes after a reasonable period.

This is where many organisations fall down. The investigation is thorough, the report is excellent, the actions are identified — and then nobody follows up. A tracking system that escalates overdue actions is essential. EHS Protect provides incident investigation services and can support your organisation in building investigation capability internally.

Richard Levack

Richard Levack

Managing Director, EHS Protect. IRCA EMS Lead Auditor · NEBOSH · COSHH Assessor

Need support with an investigation?

Whether you need independent investigation support or help building investigation capability in your team, book a free consultation to discuss your situation.

Book a free consultation Incident investigation services