How to Conduct an Incident Investigation: Root Cause Analysis for Safety Managers

Most incident investigations finish within 24 hours and reach the same conclusion: worker error. The worker wasn’t paying attention. The worker didn’t follow the procedure. The worker made a mistake.

That’s not a root cause analysis. That’s blame assignment dressed up in a form.

The investigation that ends with “human error” hasn’t asked enough questions. It’s found a symptom and stopped. Real investigations take longer, dig further, and find causes that the organization can actually change.

Before Anyone Gets Hurt: Building Investigation Capacity

The worst time to figure out how your organization investigates incidents is after one happens. The decisions you make in the first hour matter a lot, and you don’t have time to write a process from scratch while someone is being transported to the hospital.

Every safety program needs an investigation team defined in advance. That team should include people from outside the department where the incident occurred. A supervisor investigating their own team’s incident has a conflict. The investigation team needs authority to access records, interview employees, and recommend corrective actions that cross departmental lines.

You need standard forms ready before you need them. These include a scene documentation form, a witness interview template, and a corrective action tracking log. They don’t have to be complex. They just need to exist before you’re standing at an incident scene trying to remember what to write down.

The team is not the same thing as the safety department writing a report. The safety manager may lead the investigation. But the team should include a supervisor from the affected department, a front-line worker who does the same type of work, and ideally a member of the safety committee. Different perspectives catch different things.

The First Hour

Medical response comes first. Always. Get the injured person help before you start photographing the scene or collecting statements.

After medical response is underway, the scene matters. Evidence disappears fast. Equipment gets moved, fluids get cleaned up, other workers clear the area. If it’s possible to secure the scene without creating a hazard or interfering with medical response, do it.

Photograph everything. The position of the equipment, the condition of the floor, the PPE the worker was wearing, the tool or machine involved, any guards or barriers that were or weren’t in place. Take more photos than you think you need. Wider angles and close-ups. You can’t go back.

Get witness names before anyone leaves the area. Workers disperse quickly after a serious incident. Supervisors move people away from the scene. By the end of the shift, half of your witnesses may be unreachable. Write down names now. Interview later.

Do not let supervisors talk to witnesses before the investigation team has a chance to interview them separately. A supervisor who tells witnesses “here’s what I think happened before you talk to anyone” contaminates every subsequent interview. That may not be the supervisor’s intent, but the effect is the same.

For serious events, OSHA notification requirements run parallel to your investigation. Fatalities must be reported to OSHA within 8 hours of the employer learning of the death. Inpatient hospitalizations, amputations, and loss of an eye must be reported within 24 hours. You report by calling 1-800-321-OSHA or through OSHA’s online system. This is separate from your OSHA 300 log recordkeeping obligations, which come later.

Evidence Collection

A thorough investigation draws from three categories of evidence, and weak investigations typically skip one or two of them.

Physical evidence is what was present at the scene. The equipment involved, tools, materials, PPE (was it worn? was it the right type? was it in good condition?), and the positions of objects. If a machine was involved, what was its condition? Were guards in place? Were they designed for the way the task was actually performed?

Documentary evidence is what your records show. Training records for the employee: what did they receive, when, and what did the training actually cover? Maintenance logs for the equipment: when was it last inspected, were there prior complaints or work orders? The job hazard analysis for the task: did one exist, and did it identify this hazard? Written procedures: did a procedure exist, and was it current? Previous incident reports for similar events in the same area or on the same equipment.

Witness evidence is interviews with people who saw what happened, people who do the same work regularly, and the injured employee when they’re able and willing to talk. These interviews happen separately, not in a group. You ask open-ended questions. You listen more than you talk. You don’t start with your theory.

Each category builds a picture. Physical evidence tells you the state of the environment. Documentary evidence tells you what the organization knew and what systems were in place. Witness evidence tells you how the work was actually being done versus how the procedures said it should be done. Those two things are often different.

Root Cause Analysis Methods

The 5 Whys method is the most common and, when used honestly, genuinely useful. You start with the incident and ask why it happened. You take that answer and ask why again. You repeat until you reach a cause that, if fixed, would prevent the incident from recurring.

Here’s how it works in practice. A worker falls from a ladder.

Why? Because the ladder slipped.

Why? Because an A-frame ladder was used for work that required a straight ladder.

Why? Because the right ladder wasn’t available on that floor.

Why? Because the warehouse only stocked A-frame ladders for that area.

Why? Because the person who ordered equipment wasn’t aware that the task required a straight ladder, because there was no ladder selection guidance in the job hazard analysis for that task.

Root cause: the job hazard analysis didn’t address ladder selection, and procurement had no way to know what was needed. The corrective actions are specific and preventable: update the JHA, add ladder selection criteria to the task, add that specification to the procurement process. Not “retrain workers on ladder safety.”

“Human error” is never a root cause. It’s always a symptom. When an investigation finds human error, the next question is: why was that error possible? What organizational conditions, training gaps, design flaws, or production pressures made it easy for the error to occur? Those are the actual causes.

Fault Tree Analysis works for complex incidents with multiple contributing factors. You start at the top with the incident and work downward through logical AND and OR gates, mapping combinations of failures that produced the outcome. It’s more rigorous than 5 Whys and better suited to incidents with multiple simultaneous failures.

Fishbone diagrams organize potential causes by category: people, equipment, methods, environment, materials, measurement. They’re good for brainstorming at the start of an investigation when you don’t yet know where the causes are. They help teams avoid fixating on the most obvious factor.

The method matters less than the commitment to keep asking why. Any method stops working when the team accepts “worker wasn’t paying attention” as a final answer.

Corrective Actions That Actually Work

Most corrective actions are retraining and reminders. Retraining and reminders almost never prevent recurrence.

Apply the hierarchy of controls to corrective actions the same way you apply it to hazard control. Elimination is the most effective: remove the hazard from the workplace. Substitution: replace the hazardous equipment or process with something less hazardous. Engineering controls: redesign the process or environment so the hazard can’t reach the worker. Administrative controls: change procedures, schedules, or supervision. PPE: provide equipment to reduce exposure.

If the investigation found a root cause in the design of the work environment, the corrective action needs to address that design. If the root cause was in the procurement process, the corrective action needs to change the procurement process. If the root cause was a gap in a job hazard analysis, the corrective action is updating the JHA and the process for maintaining JHAs.

Corrective actions that add a sign, retrain a worker, or remind everyone to be careful leave the hazardous conditions in place. The next person who works in those conditions faces the same risk.

Getting corrective actions implemented requires management buy-in, and that doesn’t always come easily after an incident. Production pressure to return to normal quickly can close out corrective actions before they’re actually complete. Track corrective actions in writing with assigned owners and due dates. Verify completion. Don’t let the paper close before the work is done.

Writing the Investigation Report

The report is a permanent record. Write it carefully.

The facts section describes what happened, what was found, and what evidence supports each finding. Be specific. Dates, times, equipment serial numbers, training record dates, exact locations. Vague findings produce vague corrective actions.

The analysis section describes the causes. Direct cause (what immediately caused the injury), contributing causes (conditions that made the direct cause possible), and root causes (the organizational or system factors that created those conditions). Trace the chain.

The recommendations section is where you propose specific corrective actions for each identified cause. For each recommendation: who is responsible, what specifically needs to be done, and by what date.

Write findings as factual observations, not as accusations. “The hazard was identified in a prior audit in March 2025 without a corrective action being assigned” is a factual finding. It creates a record. It leads to a corrective action in the process for tracking audit findings. On serious incidents, have legal counsel review the report before it’s distributed. Investigation reports can be discoverable in litigation.

Near-Miss Programs

A near-miss is an event that could have caused injury but didn’t. The worker on the ladder who caught themselves before falling. The load that swung but cleared the operator. The chemical spill that was contained before anyone was exposed.

Near-misses are not OSHA recordable. They’re more valuable than recordable incidents for prevention, because they reveal the exact same conditions that cause injuries, without the cost.

Organizations that investigate near-misses seriously have lower injury rates than those that only respond after someone gets hurt. That’s not an opinion. OSHA’s incident investigation guidance and safety research literature consistently support that relationship.

Near-miss reporting requires trust. Workers won’t report near-misses if they expect the report to be used against them. They especially won’t report if they’ve watched prior near-miss reports lead to discipline of the reporter. A functioning near-miss program means the reporter is protected and the investigation focuses on conditions, not on who was involved.

If you’re setting up investigation processes early in your tenure at a new organization, the first 90 days guide covers how to assess what systems already exist and what needs to be built.

The quality of the corrective action tells you whether the investigation found the real root cause. If the recommendation is “retrain employees,” the investigation stopped too soon. The hazard is still there. The conditions that produced the incident haven’t changed. And the next worker to encounter those conditions will face the same risk the previous one did.

Sources: OSHA Incident Investigation guidance (osha.gov/incident-investigation). NIOSH Fatality Assessment and Control Evaluation program (cdc.gov/niosh/face/).