TeamAssurance

    What is an incident investigation?

    Short answer

    An incident investigation is a structured inquiry into a workplace injury, illness, near miss or damage event to establish what happened, why it happened and what will prevent it happening again. It gathers facts from the scene, people and records, analyses causes at the individual, task, environment and organisational levels, and ends in corrective actions that are tracked to closure.

    Last updated · TeamAssurance

    The steps

    1. Respond and secure. Treat the injured, make the area safe, preserve the scene and notify the regulator if the incident is notifiable.
    2. Gather facts. Photographs, measurements, equipment state, documents (procedures, training records, maintenance history) and interviews with those involved and witnesses, separately and soon.
    3. Build the sequence of events. A timeline of what happened, in order, from the facts.
    4. Analyse causes. Move from the immediate cause (the unguarded nip point) to the underlying and organisational causes (why it was unguarded, why nobody raised it, why the audit missed it).
    5. Recommend actions. Controls chosen from the hierarchy of control, with owners and dates.
    6. Report and share. Findings to the people affected, the leadership team and other sites with the same hazard.
    7. Verify. Confirm the actions were done and the control holds.

    ICAM

    ICAM (Incident Cause Analysis Method), widely used in Australian mining and heavy industry, organises the analysis into four layers: absent or failed defences, individual or team actions, task and environmental conditions, and organisational factors. Its value is that it stops the investigation at the organisational level, where the lasting fix usually is, rather than at the person.

    5 whys and fishbone

    For lower-severity incidents and near misses, five whys at the tier board gets to a workable cause in minutes. A fishbone diagram organises causes when several factors combine. ICAM is for serious or potentially serious events.

    What makes investigations fail

    • Blaming the person and stopping.
    • Investigating weeks later, when memory and the scene have changed.
    • Actions that are all retraining and reminders (administrative controls).
    • Reports filed with nobody checking the actions were done.

    Incident investigation inside daily management

    A near miss raised at the huddle is investigated by the team that day with five whys; a serious event triggers ICAM with a cross-functional team reviewed at Tier 2. In both cases the actions sit on the same board as every other action, with owners and dates, and the verification step is a dated check that the control is in place.

    How TeamAssurance helps

    In TeamAssurance, incidents and near misses are raised from the floor with photos, investigated with five whys or a structured problem-solving project, and their corrective actions are tracked on tier boards to closure with a verification step, so the same incident is visible across shifts and sites.

    Explore Safety Management Request a demo

    Frequently asked questions

    What incidents must be reported to the regulator in Australia?

    Notifiable incidents under the WHS Act: a death, a serious injury or illness, or a dangerous incident. They must be reported to the state or territory regulator immediately and the scene preserved.

    What is the difference between an incident investigation and a root cause analysis?

    Root cause analysis is the analysis step inside an investigation. The investigation also covers response, fact gathering, actions, reporting and verification.

    Should near misses be investigated?

    Yes, in proportion to their potential. A near miss that could have killed someone is investigated as if it had.

    ← Back to the glossary