An incident investigation has two purposes: to establish what happened, and to prevent it happening again. A good one secures the facts early, identifies the immediate cause, the significant contributing factors and the root cause, sets corrective actions that follow the hierarchy of controls, and confirms the fix worked.
Most small businesses do some of that. Far fewer do all of it, and the gap is usually where the same incident returns.
Step 1: Check whether it is notifiable
Before anything else, work out whether the incident is notifiable to your WHS regulator. A death, a serious injury or illness, or a dangerous incident has to be reported, and the site generally has to be left undisturbed until an inspector says otherwise. That comes ahead of your own investigation, and the rules and contact details differ by state and territory. We have covered who to call in a separate piece: Where to Report a Workplace Incident, State by State.
Incidents that are not notifiable are still worth investigating, and that includes near misses. If you are unsure how to categorise an event, our piece on the difference between a hazard report and an incident report covers it.
Step 2: Secure the facts early
Where it is safe to do so, preserve the scene and any equipment involved, record what you can see, and speak to the people involved and any witnesses while the detail is fresh. Photographs, measurements, work instructions, maintenance records and training records all matter. Memory fades quickly, and the physical evidence often changes within hours.
Step 3: Find the causes
Most incidents do not have a single cause. A thorough investigation looks at three layers.
The immediate cause is what happened at the moment of the incident. A person entered the path of a moving forklift. A guard was not in place. A load shifted.
Significant contributing factors are the conditions that made the immediate cause possible. They typically sit in the task design, the equipment, the layout, the environment, the training and supervision, the workload and timing, or earlier reports that were not acted on.
The root cause is the underlying gap that would allow the incident to recur even if the immediate cause were fixed. It is usually a procedure, a decision, a missed review, or a change to the workplace that was never assessed.
The simplest way to move from one layer to the next is to keep asking why. For example, a worker enters the path of a reversing forklift (immediate cause). The pedestrian walkway crosses the forklift route with no barrier, and shift changeover puts people in that spot at the busiest time of day (significant contributing factors). The layout was changed last year and the traffic arrangements were never reviewed (root cause). Fixing only the first layer leaves the other two in place.
Match the depth to the incident. Not every incident needs a formal investigation team. For a near miss or a minor incident, a simple structured review is usually enough. PEEPO is a common one, which works through People, Environment, Equipment, Procedures and Organisation to bring out the contributing factors. For serious incidents, or those with high potential severity, a more rigorous method such as ICAM (Incident Cause Analysis Method) with a small investigation team is more appropriate. The more serious the incident or its potential, the deeper you go.
Step 4: Choose stronger controls using the hierarchy
Corrective actions work best when they follow the hierarchy of control measures, from most effective to least:
Eliminate the hazard, if reasonably practicable.
Substitute it with something safer.
Isolate it from people.
Engineering controls, such as guards, barriers, sensors or physical redesign.
Administrative controls, such as procedures, training, signage and scheduling.
Personal protective equipment, as the last line.
In the forklift example, the strongest action is to reroute the walkway so it no longer crosses the forklift path. Barriers or sensors come next, then a revised traffic management plan and staggered changeover, with hi-vis as a back-up. Administrative controls and PPE rely on people and supervision to work, so they are best used to support a higher control, not to replace one.
Step 5: Assign owners and dates, then confirm the fix worked
Every corrective action needs a named owner and a due date. An action with neither tends to stay open indefinitely. The investigation is not finished when the action is completed. It is finished when someone has checked the risk is actually controlled and the outcome is recorded. If the control is not working, the investigation reopens.
What the law says, and what it does not
The general WHS framework does not lay down a single step-by-step investigation procedure for most workplaces, and the depth is for the business to scale to the incident. What it does require lines up closely with the process above.
Under the model WHS laws, a business must work through the hierarchy of control measures when managing risks, and must review its control measures, and revise them where necessary, when they are not effective. An incident is a clear signal that one may not be. Officers must also take reasonable steps to ensure the business has appropriate processes for receiving and considering information about incidents, hazards and risks, and responding to that information in a timely way. An investigation that ends in tracked, closed-out actions is the practical evidence that this is happening.
Victoria is different. The Occupational Health and Safety Act 2004 requires employers to notify WorkSafe immediately of a notifiable incident, provide a written record within 48 hours, and leave the site undisturbed until an inspector directs otherwise, with exceptions to protect health and safety, help an injured person or make the site safe. It also requires risks to be eliminated so far as is reasonably practicable and, where that is not possible, reduced. WorkSafe's guidance uses the hierarchy of control to meet that duty.
What your investigation record should show
When a regulator, an insurer, an administrator or a liquidator asks what happened and what the business did about it, the record is what answers. A good one covers what happened, the evidence gathered, the immediate cause, contributing factors and root cause, the corrective actions and where each sits in the hierarchy, who owns each one, the dates, and the close-out.
Where MXM Institute fits in
Knowing what a good investigation looks like is the easy part. Running one consistently, with the actions tracked until they are closed, is harder. SafeBase includes an incident register with corrective actions, so each investigation sits in one place with an owner and a date against every action. If you want to know how your current process measures up, our WHS Consulting Gap Audit looks at how incidents are reported, investigated and closed out. mxminstitute.com.au/whs-consulting