Access a quick summary of incident investigations with AI
What is an incident investigation?
An incident investigation is a structured process for examining a workplace incident – an accident, near miss, injury, or dangerous occurrence – to identify its immediate, underlying, and root causes, and put corrective actions in place to prevent recurrence.
The aim is to learn, not to assign blame.
Why do incident investigations matter?
Investigating workplace incidents is one of the most powerful tools a health and safety leader has to reduce risk. A good investigation does three things: it identifies the gaps in your existing controls, it generates the data you need to prevent recurrence, and it sends a clear cultural signal that the organisation takes safety seriously.
The Health and Safety Executive (HSE) makes the case clearly in its core guidance (HSG245 Investigating Accidents and Incidents) – a thorough investigation is an essential part of demonstrating a positive safety culture, and a failure to investigate properly increases both the risk of recurrence and your exposure to enforcement action.
The cost of not investigating is rarely just one incident. Latent failings – a missing risk assessment here, a training gap there – tend to surface across multiple events. Each unexamined incident is a missed opportunity to fix a systemic issue before it harms someone else.
In our work with health and safety teams across construction, manufacturing, logistics, and food and beverage, we consistently see that organisations with structured investigations have fewer Lost Time Accidents (LTAs) and RIDDOR-reportable events. Menzies Distribution Solutions reduced LTAs and RIDDOR-reportable incidents by 40% after embedding structured incident reporting and investigation processes alongside Notify.
When should you investigate an incident?
The short answer: investigate every safety event, not just the serious ones.
HSE guidance, and broadly accepted UK best practice, is that any unplanned event with the potential to cause harm should be investigated. The depth of the investigation should be proportionate to the actual or potential severity. A minor cut that healed in a day might warrant a quick supervisor-led review. A near miss that could have been a fatality warrants the same depth of investigation as the fatality itself.
| Event type | Example | Investigate? |
| Accident | A forklift collides with a pedestrian | Yes - always |
| Injury | A worker sustains a hand laceration during machine cleaning | Yes - always |
| Near miss | A falling tool misses an operative by inches | Yes - proportionate to potential severity |
| Dangerous occurrence | A scaffold partially collapses with no injury | Yes - and report under RIDDOR |
| Hazard / observation | An unguarded edge spotted during a walk-round | Investigate the conditions; correct immediately |
| Occupational illness | A confirmed case of Hand-Arm Vibration Syndrome (HAVS) | Yes - and report under RIDDOR |
A common and costly mistake is to investigate only events that resulted in injury. Near misses are by far the largest reservoir of free safety data your organisation has. They reveal the same underlying weaknesses as accidents, without the harm.
After deploying digital incident reporting, NWF Agriculture saw hazard reports rise by 230%.
What does UK law require?
Under the Health and Safety at Work etc. Act 1974, employers have a general duty to ensure, so far as is reasonably practicable, the health and safety of their workers. The Act does not prescribe how to investigate, but the HSE expects every employer to have a system for learning from incidents.
Two specific areas matter most:
- RIDDOR – Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013: Certain incidents must be reported to the HSE – fatalities, specified injuries, over-7-day injuries, certain occupational diseases, and dangerous occurrences. RIDDOR is a reporting duty, not an investigation duty. But a RIDDOR-reportable event will almost always justify a formal investigation, and the HSE may follow up with its own.
- ISO 45001:2018 (Occupational Health and Safety Management Systems): Clause 10.2 requires organisations to react to incidents, investigate them, determine the underlying causes, evaluate the need for corrective action, and implement that action. If you are certified to ISO 45001, structured investigation is part of your management system commitment.
For organisations operating in the United States, the equivalent reference is the Occupational Safety and Health Administration’s (OSHA) “Incident (Accident) Investigations: A Guide for Employers.” OSHA recommends investigating every incident, including near misses, using a systems-thinking approach.
Who should conduct an incident investigation?
The simple answer: someone competent, with the time and authority to do it properly.
In practice, who that is depends on the severity:
- Low-severity incidents (minor injury, near miss) – typically the line manager or supervisor, with H&S team review.
- Medium-severity incidents (RIDDOR-reportable, lost-time, repeat occurrence) – a small investigation team including a trained H&S professional, the area manager, and a worker representative.
- High-severity or potentially fatal incidents – a multi-disciplinary team led by a senior H&S leader, often supported by external investigators, legal advice, and (where the HSE is involved) careful coordination with regulators.
The HSE emphasises in HSG245 that investigators must be “competent“, meaning they have the knowledge, skills, and authority to gather evidence, conduct interviews, and analyse causation. Competence typically means formal investigation training (ICAM, TapRoot, or HSE-accredited courses), supported by relevant qualifications such as NEBOSH or CertIOSH.
A point that often gets missed: frontline workers should be involved. Worker representatives bring context that desk-based investigators lack – and their involvement strengthens both the findings and the credibility of the outcome.
The four stages of an incident investigation (HSE HSG245)
The HSE’s guidance HSG245 sets out a four-stage framework that has become the de facto UK standard. Each stage builds on the last.
Stage 1:
Gather the information. Secure the scene, ensure casualties receive care, and capture evidence before it changes. This includes physical evidence (photographs, equipment, environmental conditions), documentary evidence (training records, risk assessments, maintenance logs, prior incident reports), and witness accounts.
Speed matters; memories degrade quickly, and physical evidence is often disturbed within hours.
Stage 2:
Analyse the information. Build a timeline of what happened. Then ask why. The aim is to surface three layers of causation: the immediate cause, the underlying cause, and the root cause.
Investigators apply structured methods such as 5 Whys, Fishbone, and ICAM (covered in the next section) to avoid jumping to conclusions or stopping too early.
Stage 3:
Identify suitable risk control measures. For every cause identified, ask: what control would have prevented this? Controls should follow the hierarchy – elimination, substitution, engineering controls, administrative controls, PPE – and be specific, assignable, and measurable.
Stage 4:
Plan and implement the action. Translate the control measures into a corrective and preventive action plan (CAPA). Assign each action to a named owner with a deadline. Track every action through to verified completion.
The output of all four stages is a single coherent investigation report: what happened, why it happened, what will change, and how you will know it worked. Sharing the findings across teams, sites, and where appropriate externally, multiplies the value of the investigation.
For a step-by-step practical breakdown of each stage, see our blog how to conduct an effective incident investigation.
The three layers of causation: immediate, underlying, and root
A weak investigation stops at the first answer. A strong one keeps going until it reaches the systemic issue.
| Layer | What it is | Example: a worker falls from a ladder |
| Immediate cause | The unsafe act or condition at the moment of the event | The ladder slipped because it was not tied off |
| Underlying cause | The local conditions that allowed the unsafe act or condition to exist | The required tie-off equipment was not available on site |
| Root cause | The systemic, organisational, or management failing | The working-at-height procedure did not specify equipment provisioning, and the safe-system-of-work was never audited |
This is the HSE’s own language, and it matters because organisations that consistently address only immediate causes find themselves investigating the same incident over and over with a different name on the report each time. Root cause analysis (RCA) is the discipline of pushing through to that third layer.
For more on why pushing to the root cause prevents repeat incidents, see why accident investigations are important.
Six incident investigation methods compared
There is no single best investigation method. The right choice depends on the complexity of the incident, the maturity of your safety system, and the skill of your investigators.
| Method | Best for | How it works | Strengths | Limitations |
| 5 Whys | Low-to-medium complexity incidents; fast turnaround | Repeatedly asking "why?" - typically five times - until the root cause is exposed | Simple, fast, no training required | Linear; risks oversimplifying multi-causal events; vulnerable to investigator bias |
| Fishbone (Ishikawa) | Brainstorming potential causes across categories | Visualises causes in categories - typically People, Process, Equipment, Environment, Materials, Management | Encourages broad thinking; good for team workshops | Identifies possible causes but does not prove them |
| ICAM (Incident Cause Analysis Method) | Medium-to-high complexity; multi-causal events | Systems-based model that separates absent/failed defences, individual or team actions, task and environmental conditions, and organisational factors | Strong on systemic causation; well-suited to high-hazard industries | Requires trained investigators; longer process |
| TapRoot | High-volume, high-consistency environments such as process plants and refineries | Proprietary, structured methodology with a built-in corrective action library | Highly consistent results; corrective actions embedded in the method | Requires licensing and formal training; can feel rigid |
| Bowtie analysis | Major hazard events; understanding both prevention and mitigation | Maps the hazard, the top event, threats, consequences, and the barriers between them | Excellent for visualising barriers and where they failed | Better for risk visualisation than for new investigations |
| Tripod Beta | Complex incidents in high-hazard industries (originated in oil and gas) | Maps the chain of events and the latent and active failures that drove them | Strong on human and organisational factors | Steep learning curve; requires specialist training |
The pragmatic recommendation for most UK H&S teams: use 5 Whys as your default for routine incidents, escalate to ICAM or Fishbone for anything multi-causal, and reserve TapRoot or Tripod Beta for high-severity events where consistency and rigour are non-negotiable.
Six common incident investigation mistakes, and how to avoid them
Even well-resourced organisations make these mistakes. Avoiding them is often the difference between an investigation that prevents recurrence and one that ticks a box.
1. Hunting for someone to blame.
Investigations should focus on system failures, not individual fault. Blame-led investigations suppress reporting and shut down the honest conversation you need.
2. Stopping at the immediate cause.
“The operator did not follow the procedure” is rarely the end of the story. Why did they not? Was the procedure realistic? Were they trained on the current version? Push to the underlying and root causes.
3. Investigating slowly.
Memories fade within hours, not days. Physical evidence is disturbed by clean-up, repairs, or the next shift. Aim to start gathering information within hours of the event.
4. Ignoring near misses.
A near miss is an accident with the harm subtracted out. Investigating it gives you the lessons without paying the cost. Organisations that report and investigate near misses consistently outperform those that wait for harm before they learn.
5. Closing actions on paper.
A CAPA that has not been verified is not closed. Track every action through to evidence of completion and, where appropriate, evidence of effectiveness.
6. Keeping the findings in a folder.
An investigation finished on a single site, never shared, repeats the same incident on the next site six months later. Share learning systematically through things like toolbox talks, safety alerts, and board reports.
How software supports incident investigations
Health and safety software can remove the friction that typically lets investigations slip, and gives you the trend data to spot recurring causes across sites. The typical capabilities to look for are: real-time reporting from any device, including offline, automated alerts for RIDDOR-reportable and high-severity events, structured investigation workflows aligned to HSE guidance, assignable corrective and preventive actions with deadlines and audit trails, and dashboards that turn closed investigations into recurring trends.
AI is increasingly part of this picture, too. Notify’s Spark AI Companion, for example, generates potential root causes and corrective actions from raw incident data, drafts executive briefings, and creates tailored toolbox talks, reducing the administrative load on safety teams and accelerating the move from event to learning.
The full incident management capability – reporting, investigation, action tracking, and analytics – is covered within Notify’s Incident Reporting and Management Software.
Ready to see how Notify supports the full investigation lifecycle? Book a demo today.
Notify is trusted by over 300,000 workers globally and rated 4.9/5 on G2. Customers including Menzies Distribution Solutions, Wolseley, City Plumbing Supplies, and NWF Agriculture use Notify to investigate, learn from, and prevent workplace incidents.
FAQs
An accident is an event that has caused harm. An incident is any unplanned event that could cause – or did cause – harm; the term covers accidents, near misses, dangerous occurrences, and occupational illnesses.
The HSE and OSHA both encourage using “incident” rather than “accident” because the word “accident” implies the event was random and unpreventable, when in fact nearly all are preventable.
An incident investigation is the overall process – gathering information, analysing it, identifying controls, and acting.
Root cause analysis (RCA) is one part of that process – the structured technique used during the analysis stage to push beyond immediate causes to the underlying organisational failings.
Every well-conducted investigation includes RCA. Not every RCA is part of an incident investigation.
Yes, and they are arguably the highest-value investigations you can run. A near miss reveals the same underlying weaknesses as a serious incident without the human or financial cost.
Best practice is to investigate near misses in proportion to their potential severity, not the actual outcome.
There is no fixed rule. The HSE expects investigations to begin promptly, within hours of the event for serious incidents, but the depth of the analysis should match the severity. A minor incident might be closed within a day or two; a serious incident might take weeks. What matters is that the investigation is timely, thorough, and proportionate.
The HSE’s primary guidance document is HSG245, Investigating Accidents and Incidents: A Workbook for Employers, Unions, Safety Representatives and Safety Professionals. It is freely available on the HSE website and provides the four-stage framework used throughout this guide.
There is no single law that says “you must investigate every incident”, but the practical effect of the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999, RIDDOR, and ISO 45001 is that any responsible employer must have an incident investigation process in place. The HSE will expect to see one in any inspection.
A competent lead investigator (typically a trained H&S professional), the manager who has authority to implement actions, a worker representative who brings frontline context, and for serious incidents, an independent technical specialist. For potential fatalities or major events, legal counsel and external investigators may be involved.
Stopping at the first plausible cause. Most repeat incidents trace back to investigations that identified the immediate cause but never asked why the conditions for that error existed. Discipline in pushing through to the root cause is the single biggest lever for preventing recurrence.