Incident Reporting, Investigation and Corrective Action

Introduction

Industrial safety management does not end when an injury is treated or a machine is repaired. The event must be reported, understood and used to prevent recurrence. Incident reporting and investigation therefore form a management-control process linking frontline observation with organisational learning, legal accountability and maintenance improvement.

A mature system distinguishes between what happened, why it happened and what must change. It avoids the common error of treating the injured person or the last operator as the complete cause. Most significant incidents arise from interacting technical, human, organisational and environmental conditions. Effective investigation identifies these relationships and develops corrective actions that control risk at its source.

This chapter applies to production plants, warehouses, utilities, workshops and maintenance operations. It treats incident management as a professional activity requiring objectivity, evidence preservation, confidentiality, technical competence and follow-through.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Classify accidents, near misses, unsafe conditions, unsafe acts and maintenance failures.
2. Explain the immediate, underlying and root causes of incidents.
3. Secure a scene, preserve evidence and conduct ethically sound interviews.
4. Apply 5 Whys, fishbone analysis, fault-tree analysis and barrier analysis.
5. Develop corrective and preventive actions using the hierarchy of controls.
6. Prepare clear, factual and legally defensible incident reports.
7. Design learning, verification and closure systems for corrective actions.

1. The Incident Concept and Safety Learning

An incident is an unplanned event, or chain of events, that caused or could have caused injury, ill health, property damage, environmental harm, production loss or other undesirable consequences. The term is broader than “accident.” An accident normally refers to an incident that resulted in harm, whereas a near miss had the potential for harm but did not produce the harmful outcome.

The distinction between event and outcome is important. If a spanner falls from a platform and narrowly misses a worker, the physical event may be almost identical to one in which the worker is struck. The absence of injury may reflect distance, timing or chance rather than effective control. Near misses therefore provide valuable leading information.

A useful causal sequence is:

hazard → exposure → initiating event → loss of control → consequence

For example, an unguarded rotating coupling is a hazard; a worker reaching into it is exposure; unexpected motor start-up is the initiating event; contact with the coupling is loss of control; and entanglement is the potential consequence. Investigation should examine every link rather than only the final injury.

Safety learning is strongest when reports are timely, non-punitive for honest mistakes, technically credible and connected to visible action. This does not mean that wilful violations, falsification or reckless behaviour are ignored. It means that discipline is not used as a substitute for system analysis.

2. Classification of Events

Classification determines notification, investigation depth, trend analysis and management response. Local law and organisational procedures always take precedence over generic categories.

Severity and probability should not be confused. Actual severity describes what occurred; potential severity describes what could reasonably have occurred. A low-injury event may have high potential severity and consequently require senior review.

Unsafe conditions, unsafe acts and maintenance failures

An unsafe condition includes defective guarding, poor illumination, blocked emergency access, an unprotected energy source or an overloaded electrical circuit. An unsafe act includes bypassing an interlock, entering a restricted zone or using a tool contrary to instructions. However, investigators must ask why the act occurred. Production pressure, inadequate staffing, poor design, confusing procedures, weak supervision or unavailable equipment may have shaped the behaviour.

A maintenance failure is not limited to component breakage. It can involve an incorrect specification, missed preventive-maintenance task, ineffective inspection, poor lubrication, inadequate competency, failed permit-to-work control, incomplete handover or failure to manage a temporary repair. Maintenance records are therefore evidence of both equipment condition and management performance.

3. Reporting: From Event to Reliable Record

Reporting should be immediate enough to protect people and preserve evidence. The first person who discovers an event should, within their competence:

1. Raise the alarm and obtain emergency assistance.
2. Stop work and isolate energy if this can be done safely.
3. Protect injured persons without unnecessarily disturbing evidence.
4. Control access to the scene.
5. Notify the designated supervisor or incident coordinator.
6. Record basic facts, witnesses and immediate conditions.

A report should distinguish observed facts from interpretation. “The guard was found on the floor beside the conveyor” is a fact. “The operator removed the guard to increase output” is a conclusion unless supported by evidence. Good reports identify date, time, location, people involved, task, equipment, energy sources, weather or environmental conditions, injury or damage, immediate actions and witnesses.

Legal and ethical quality

A legally sound report is accurate, timely, complete, consistent and based on traceable evidence. It should not speculate, assign blame without evidence or conceal unfavourable information. Corrections should be dated and attributable; original records should not be destroyed. Photographs, drawings, instrument readings, permits, work orders, training records and statements should be controlled according to organisational retention and privacy requirements.

Confidential medical information must be handled only by authorised personnel. Reports should use respectful language and avoid discriminatory descriptions. The purpose is prevention and compliance, not humiliation. Investigators must also recognise mandatory reporting requirements for fatalities, serious injuries, dangerous occurrences, environmental releases and regulatory breaches. These requirements vary by jurisdiction and must be checked against current law.

Information quality

The reliability of an investigation depends on the quality of its evidence. A practical evidence hierarchy is:

• contemporaneous physical evidence and instrument records;
• photographs, video and system data;
• verified documents such as permits and work orders;
• consistent accounts from independent witnesses;
• individual recollection obtained after delay;
• assumptions and unsupported opinions.

The hierarchy is not absolute: a witness may provide the only evidence of a conversation or decision. The investigator should compare sources, identify contradictions and record uncertainty rather than forcing a single explanation.

4. Investigation Planning and Scene Preservation

Investigation depth should be proportionate to actual and potential severity, complexity, recurrence, legal significance and learning value. A minor housekeeping observation may require local correction; a fatality, serious near miss or major maintenance failure requires a trained multidisciplinary team and formal control of evidence.

Securing the scene

The scene should be made safe before investigation begins. This may require electrical isolation, pressure release, stopping traffic, fire protection, environmental containment or rescue operations. After life-saving actions, equipment should not be reset, cleaned or repaired until authorised, except where necessary to prevent further harm. Any unavoidable change should be documented.

The investigator should establish:

• the physical boundaries of the scene;
• the equipment and energy state;
• the position of people, tools and components;
• relevant alarms, interlocks and control settings;
• environmental conditions;
• recent changes, maintenance or abnormal operations.

Photographs should include overall views, intermediate views and close-ups with scale. A sketch can show distances, direction, elevation and positions that photographs do not communicate clearly. Failed components should be tagged, packaged and preserved to avoid contamination or alteration.

Interviews

Interviews should occur promptly, privately and separately where practicable. Begin with an open request such as, “Please describe what happened from the beginning.” Allow the person to speak without interruption, then clarify times, locations, decisions, warnings and conditions. Avoid leading questions, accusations and promises that cannot be kept. Ask what made the task difficult and what normally happens, not only what should have happened.

The investigator should explain the purpose, record the person’s words accurately and permit correction of the statement. Memory is reconstructive and may be affected by shock, group discussion, fatigue or fear. Differences between accounts are not automatically dishonesty; they may reveal changing conditions or uncertain visibility.

5. Causal Analysis: From Immediate to Root Causes

A strong investigation separates several levels of cause:

• Immediate causes: unsafe conditions or acts directly preceding the event, such as missing guarding or entry into a live zone.
• Contributing causes: conditions that increased likelihood or severity, such as poor lighting, fatigue, time pressure or inadequate layout.
• Underlying causes: weaknesses in supervision, competence, procedures, inspection, procurement or maintenance planning.
• Root or systemic causes: failures in the management system that allowed hazards to remain uncontrolled, such as weak accountability, ineffective risk governance or production goals that consistently override safety.

“Root cause” should not be treated as a magical single answer. Complex events commonly have multiple necessary and interacting causes. The objective is to identify causes that, if effectively addressed, materially reduce recurrence.

5.1 The 5 Whys

The 5 Whys method repeatedly asks why a condition occurred until the analysis reaches controllable system factors. Five is a prompt, not a mandatory number. The questioning should follow evidence and may branch into several chains.

Example: A technician suffered a hand injury when a pump started during cleaning.

1. Why was the hand exposed? The technician reached into the pump casing.
2. Why was the casing opened without effective isolation? The isolation was incomplete.
3. Why was isolation incomplete? The procedure did not identify a stored-pressure source.
4. Why did the procedure omit it? The maintenance risk assessment had not been reviewed after a pump modification.
5. Why was review not triggered? The management-of-change process did not include maintenance risk assessment as a mandatory approval step.

The analysis should be tested against evidence. A weak chain stops at “operator error.” A stronger chain asks what design, procedure, training, supervision and organisational conditions made the error possible or likely.

5.2 Fishbone analysis

Fishbone, or cause-and-effect, analysis organises possible causes around a defined effect. Common categories include people, equipment, materials, methods, measurement, environment and management. Categories should be adapted to the task.

The team first writes a precise effect, such as “unplanned start-up during pump cleaning,” and then generates evidence-based causes under each branch. It should distinguish possible causes from verified causes. The tool is excellent for broad exploration and team participation but does not by itself establish probability or causation. Each proposed cause requires confirmation through records, observation, testing or credible testimony.

5.3 Fault-tree analysis

Fault-tree analysis (FTA) is a deductive method that begins with a top event and works backward through combinations of failures. AND gates indicate that all linked events are required; OR gates indicate that any linked event may produce the higher event.

For example, “worker exposed to rotating shaft” may result from:

• guard removed AND machine operating; or
• interlock failed AND machine operating; or
• unexpected start AND worker within the danger zone.

FTA is especially useful for complex equipment, critical barriers and high-consequence events. If numerical probabilities are available and assumptions are justified, Boolean combinations can be quantified. For an independent AND combination, the probability is the product of component probabilities; for an independent OR combination, the probability is one minus the product of the complements. These calculations require credible data and independence assumptions, which are often not satisfied in field investigations. Qualitative FTA is therefore frequently more defensible than false numerical precision.

5.4 Barrier analysis

Barrier analysis asks which controls should have prevented the event, detected deterioration or reduced consequences. Barriers may be physical, technical, procedural, supervisory or emergency-response controls.

For unexpected machine start-up, barriers could include a robust design, guarding, isolation and lockout, permit verification, zero-energy testing, supervision, alarm systems and emergency stop devices. The investigator examines whether each barrier existed, was suitable, was available, was used and was effective. A barrier that exists on paper but is unavailable in practice is not an effective control.

Barrier analysis is valuable because it links investigation directly to corrective action. It also prevents overemphasis on the last person in the chain. If several independent barriers failed, the event reflects a system breakdown rather than one isolated mistake.

6. Corrective Action and Risk Reduction

Corrective action eliminates or controls causes of a detected problem; preventive action addresses potential problems before occurrence. In modern management systems the distinction may overlap, but the essential test is whether the action reduces risk and is verified.

Actions should follow the hierarchy of controls:

1. Elimination: remove the hazardous task or energy source.
2. Substitution: replace a hazard with a less hazardous alternative.
3. Engineering controls: guard, interlock, automate, isolate or contain the hazard.
4. Administrative controls: procedures, training, scheduling, permits and supervision.
5. Personal protective equipment: protect the worker when residual risk remains.

The higher controls are generally more reliable because they depend less on memory and perfect behaviour. “Retrain the operator” is often necessary but rarely sufficient when design or isolation weaknesses remain.

Each action should have a clear owner, due date, required resources, risk priority and acceptance criterion. A useful action statement identifies the object, change and verification method: “Install a trapped-key interlock on the solvent pump access door; test all operating modes; acceptance requires prevention of pump operation while the door is open.” This is stronger than “Improve guarding.”

Prioritising actions

Priority should reflect potential severity, exposure, likelihood, legal obligations and barrier weakness. Immediate temporary controls may be required while permanent solutions are designed. Temporary controls must have an expiry date and responsible owner; otherwise they become permanent administrative dependence.

Corrective actions should be reviewed for unintended consequences. For example, increasing a machine’s speed after eliminating a manual delay may create a new ergonomic or process hazard. A management-of-change review is appropriate where equipment, software, materials, staffing or procedures are altered.

Verification and closure

Closing an action because a document was issued is inadequate. Verification should establish:

• implementation: was the action completed?
• technical effectiveness: does it control the hazard under real conditions?
• behavioural or operational adoption: is it being used?
• sustainability: has performance remained acceptable over time?

Evidence may include commissioning tests, field observations, audit results, maintenance records, worker feedback and trend data. An independent person should verify high-risk actions. If effectiveness is not demonstrated, the action remains open or is redesigned.

7. Learning Systems and Performance Indicators

An organisation learns when information travels beyond the original department. A learning system may include safety alerts, toolbox discussions, engineering design reviews, maintenance strategy updates, competency changes, procurement requirements and cross-site communication. Alerts should explain the event, causal factors, required controls and actions without exposing unnecessary personal information.

Trend analysis can identify recurring equipment, task, location, shift or causal patterns. Counts alone can mislead: a rise in near-miss reports may indicate worsening conditions, improved reporting culture or both. Indicators should therefore combine leading and lagging information.

Examples include:

• proportion of incidents reported within the required time;
• percentage of high-risk actions completed by due date;
• overdue corrective actions weighted by risk;
• repeat incidents involving the same cause;
• quality of field verification;
• preventive-maintenance completion and overdue critical tasks;
• actual injury and loss events.

A useful rate for internal comparison is:

Here, K is a chosen standardising constant, such as 200,000 or 1,000,000 hours, and must be stated consistently. The measure is meaningful only when the numerator definition, reporting period, workforce coverage and hours denominator are consistent. Rates should not be used to compare organisations blindly when definitions and exposure differ. Nor should a low injury rate be interpreted as proof of safety if near misses and hazard reports are suppressed.

8. Applied Case: Illustrative Conveyor Incident

Background

A packaging plant experienced a near miss when a contractor entered a conveyor transfer point to remove a jam. The conveyor restarted while the contractor’s arm was near the nip point. No injury occurred because a nearby worker pressed an emergency stop.

Initial findings

The guard had been removed during an earlier maintenance task. The local isolator was labelled, but the contractor believed the control-panel stop button was sufficient. A production supervisor had encouraged rapid restart because orders were behind schedule. The work permit did not identify the transfer point as requiring isolation, and the contractor had received general induction but no task-specific verification.

Analysis

The immediate causes were entry into a danger zone and inadequate isolation. Fishbone analysis identified equipment design, method, competence, supervision, production pressure and permit weaknesses. Barrier analysis showed that guarding, isolation verification, permit controls and supervision had all failed or been bypassed. The 5 Whys reached a management-of-change weakness: a conveyor modification had changed access and jam-clearing practice, but the risk assessment and permit system had not been revised.

Corrective approach

The plant took the following actions:

• stopped access to the transfer point until a temporary physical barrier was installed;
• redesigned the guard so jams could be cleared from outside the danger zone;
• installed an interlocked access gate and tested it under normal and fault conditions;
• revised the isolation procedure to include electrical and mechanical stored energy;
• introduced a permit checklist requiring personal lock verification;
• provided task-specific contractor assessment and authorisation;
• required a management-of-change review for conveyor modifications;
• audited similar conveyors across the site.

Outcome and learning

The immediate controls reduced exposure, while engineering changes reduced dependence on operator behaviour. The site also discovered two similar permit deficiencies elsewhere. The case demonstrates why a near miss deserves investigation proportional to its potential severity and why “operator failed to stop the conveyor” would have been an incomplete conclusion.

9. Challenges and Limitations

Investigation quality can be undermined by production pressure, fear of blame, poor records, contaminated scenes, hindsight bias, confirmation bias and inadequate technical competence. Teams may also confuse compliance with effectiveness: a signed checklist does not prove that energy was isolated.

Causal tools have limits. The 5 Whys can oversimplify complex systems. Fishbone diagrams can generate untested speculation. Fault trees depend on accurate system boundaries and assumptions. Barrier analysis may overlook informal controls or interactions between barriers. These tools should be combined with observation, document review, interviews, testing and professional judgement.

Investigators should guard against hindsight bias—the belief that an outcome was obvious beforehand. Decisions must be assessed using information reasonably available at the time, while still examining whether the system made safe decisions difficult. A just culture distinguishes human error, at-risk behaviour and reckless conduct, responding respectively through system improvement, coaching and proportionate accountability.

10. Technology and Contemporary Practice

Digital reporting applications can provide time stamps, geolocation, photographs, workflow control and action dashboards. Computerised maintenance-management systems can connect incidents to work orders, asset history, failure modes and overdue preventive tasks. Sensor data, historian records and access-control logs may reconstruct sequence and equipment state.

Artificial intelligence can assist with text classification, recurring-theme detection, translation and prioritisation of large report volumes. It must not replace investigator judgement. AI outputs can reproduce reporting bias, misclassify rare events, expose personal information or invent causal links. Human review, access control, audit trails and transparent decision criteria are essential. Predictive analytics should support—not justify—unsafe surveillance or penalisation of workers for reporting.

Contemporary good practice increasingly integrates safety, reliability, process safety, environmental protection and human factors. Maintenance failures are treated as signals about asset design, maintainability, spare parts, competency and work planning, not merely as isolated technical defects.

Best-Practice Checklist

Before closing an investigation, confirm that:

• people received appropriate care and the scene was made safe;
• required notifications were completed;
• facts, assumptions and uncertainties are clearly separated;
• evidence and records are preserved and traceable;
• actual and potential consequences were assessed;
• immediate, contributing and systemic causes were examined;
• affected workers and technical specialists participated;
• actions follow the hierarchy of controls;
• every action has an owner, due date and acceptance criterion;
• effectiveness has been verified in the field;
• lessons were shared with relevant operations and maintenance groups;
• similar assets and tasks were screened for the same weakness.

Chapter Summary

Incident management is a cycle of reporting, scene control, evidence preservation, causal analysis, corrective action, verification and organisational learning. Accidents, near misses, unsafe conditions, unsafe acts and maintenance failures must be classified accurately because each provides different information and may require different responses. Effective investigations distinguish immediate events from underlying and systemic causes. The 5 Whys explores causal chains; fishbone analysis structures team thinking; fault-tree analysis examines combinations of failures; and barrier analysis evaluates controls that should have prevented or limited the event. Corrective actions should favour elimination and engineering controls over reliance on procedures or personal protective equipment. Reports must be factual, timely, ethical, confidential where necessary and compliant with applicable law. Learning is demonstrated not by producing a report but by implementing and verifying changes that reduce recurrence.

Key Terms

Incident: An unplanned event that caused or could have caused harm or loss.

Accident: An incident resulting in injury, ill health, damage or another harmful outcome.

Near miss: An incident with potential for harm but no harmful outcome.

Unsafe condition: A hazardous physical or organisational condition.

Unsafe act: Behaviour or decision that increases exposure to risk.

Maintenance failure: Failure in equipment, maintenance work or maintenance control.

Immediate cause: Condition or act directly preceding an incident.

Contributing cause: Factor that increases the likelihood or severity of an event.

Underlying cause: Management or operational weakness supporting the event.

Root cause: A systemic cause whose correction can materially reduce recurrence.

Evidence preservation: Protection of physical, digital and documentary information from alteration or loss.

5 Whys: Iterative questioning used to explore causal chains.

Fishbone analysis: A structured cause-and-effect diagram for generating and organising causes.

Fault-tree analysis: Deductive analysis of combinations of failures leading to a top event.

Barrier analysis: Examination of controls intended to prevent or mitigate an incident.

Corrective action: Action taken to eliminate a detected cause or control its effects.

Hierarchy of controls: Ranked approach of elimination, substitution, engineering, administrative controls and PPE.

Management of change: Formal process for assessing risks created by changes.

Just culture: An approach distinguishing error, at-risk behaviour and reckless conduct fairly.

Effectiveness verification: Evidence that a corrective action works and remains effective.

Review Questions

Short Answer Questions

1. Distinguish an accident from a near miss and explain why both should be reported.
2. What information should be recorded in an initial incident report?
3. Differentiate immediate, contributing, underlying and root causes.
4. State the purpose of barrier analysis.
5. Why is retraining alone often an inadequate corrective action?

Long Answer Questions

1. Explain a complete incident investigation process from emergency response through corrective-action verification.
2. Compare 5 Whys, fishbone analysis, fault-tree analysis and barrier analysis, including the strengths and limitations of each.
3. Discuss how legal, ethical and evidence-quality requirements affect incident reporting.
4. Explain how the hierarchy of controls should guide corrective-action design in maintenance operations.
5. Describe how an organisation can convert incident information into a sustainable learning system.

Analytical / Application Questions

1. A machine restarts during cleaning, but no one is injured. Develop a causal analysis using 5 Whys and identify at least four failed barriers.
2. A plant has many overdue maintenance actions but few reported injuries. Analyse what this combination may mean and recommend suitable leading indicators.
3. Design a corrective-action plan for a contractor who enters a conveyor danger zone after receiving only a general induction. Include immediate, engineering, procedural and verification actions.

Multiple Choice Questions with Answers

Question 1

Which event is best classified as a near miss?

A. A worker suffers a fractured wrist after falling.

B. A machine guard is found loose during an inspection.

C. A falling tool narrowly misses a worker without causing injury.

D. A pump fails and causes an environmental release.

Correct Answer: C. A falling tool narrowly misses a worker without causing injury.

Question 2

What should normally occur first after discovering an incident?

A. Assign personal blame

B. Raise the alarm and make the situation safe

C. Restart production to determine the fault

D. Delete incomplete electronic records

Correct Answer: B. Raise the alarm and make the situation safe

Question 3

Which statement is a verifiable fact rather than an unsupported conclusion?

A. The operator ignored safety rules.

B. Production pressure caused the incident.

C. The guard was found on the floor beside the conveyor.

D. The supervisor did not care about safety.

Correct Answer: C. The guard was found on the floor beside the conveyor.

Question 4

In the 5 Whys method, the number five is best understood as:

A. A legally required number of questions

B. A fixed statistical sample size

C. A prompt to continue until controllable systemic causes are explored

D. A limit that prevents discussion of management causes

Correct Answer: C. A prompt to continue until controllable systemic causes are explored

Question 5

Which tool begins with a top event and analyses combinations of failures leading to it?

A. Fault-tree analysis

B. Fishbone analysis

C. Safety observation sampling

D. Permit review

Correct Answer: A. Fault-tree analysis

Question 6

Which is the highest-level control in the hierarchy of controls?

A. Personal protective equipment

B. Administrative procedure

C. Engineering guard

D. Elimination

Correct Answer: D. Elimination

Question 7

Which corrective-action statement is strongest?

A. Improve machine safety.

B. Remind workers to be careful.

C. Install and test an interlocked access gate by the specified due date.

D. Investigate further if the problem happens again.

Correct Answer: C. Install and test an interlocked access gate by the specified due date.

Question 8

Why should a high-potential near miss receive serious investigation?

A. Near misses always cause hidden injuries.

B. The potential consequence may be severe even though the actual outcome was minor.

C. Near misses are legally identical in every jurisdiction.

D. It eliminates the need for corrective action.

Correct Answer: B. The potential consequence may be severe even though the actual outcome was minor.

Question 9

What does effectiveness verification establish?

A. That an action was merely assigned

B. That a document was filed

C. That the implemented action controls the hazard under actual conditions

D. That the original investigator agrees with the supervisor

Correct Answer: C. That the implemented action controls the hazard under actual conditions

Question 10

Which statement about AI in incident investigation is most appropriate?

A. AI can replace human judgement in high-consequence investigations.

B. AI-generated causal links are automatically reliable.

C. AI may assist classification and trend detection but requires human review and governance.

D. AI removes the need to protect personal information.

Correct Answer: C. AI may assist classification and trend detection but requires human review and governance.