Incident Investigation

An incident can be defined as an occurrence arising out of or in the course of work that resulted in or could have resulted in injuries, illnesses, damage to health, fatalities, or material damage.

The term "accident" is also commonly used.  The formal definition may vary.  It has been defined as an unplanned event that interrupts the completion of an activity, and that may (or may not) include injury or property damage. Some make a distinction between accident and incident. They use the term incident to refer to an unexpected event that did not cause injury or damage at that time but had the potential. "Near miss" or "dangerous occurrence" are also terms for an event that could have caused harm but did not

Please note: The term incident is used in some situations and jurisdictions to cover both an "accident" and an "incident". However, it is argued that the word "accident" implies that the event was related to fate or chance. When the root cause is determined, it is usually found that many events were predictable and could have been prevented if appropriate actions were taken, making the event not one of fate or chance (thus, the word incident is used). For simplicity, we will use the term incident to mean all of the above events.

The information that follows is intended to be a general guide for employers, supervisors, health and safety committee members, and members of an incident investigation team. When incidents are investigated, the emphasis should be on finding the root cause so that the event can be prevented from happening again. The purpose is to find facts that can lead to corrective actions, not to find fault. Always look for deeper causes. Do not simply record the steps of the event.

Reasons to investigate a workplace incident include:

• Most importantly, to find out the cause of incidents and to prevent similar incidents in the future
• To fulfill any legal requirements (e.g., non-compliance with applicable occupational health and safety legislation, criminal code, etc.)
• To determine the cost of an incident
• To process workers' compensation claims

The same principles apply to an inquiry of a minor incident and to the more formal investigation of a serious event. Most importantly, these steps can be used to investigate any situation (such as near misses or dangerous occurrences) as a way to prevent another incident.

It is generally recommended to have a documented incident response plan that guides those involved in the investigation process. The plan may include:

• Guidance on what data is required and how to gather that information
• Steps to take to make sure the investigators remain safe while conducting their duties
• How to preserve the scene
• If the scene requires access by others (e.g., OHS inspectors or police)
• How the organization will continue functioning while the investigation is conducted
• What and how early information can be shared so that prevention steps can be taken

The CSA standard "CSA Z1005 Workplace incident investigation" could be useful in developing an incident investigation plan.

Ideally, an investigation would be conducted by someone or a group of people who are:

• experienced in incident causation models,
• experienced in investigative techniques,
• knowledgeable of any legal or organizational requirements,
• knowledgeable in occupational health and safety fundamentals,
• knowledgeable in the work processes, procedures, persons, and industrial relations environment for that particular situation,
• able to use interview and other person-to-person techniques effectively (such as mediation or conflict resolution),
• knowledgeable of requirements for documents, records, and data collection; and
• able to analyze the data gathered to determine findings and reach recommendations.

There are requirements, based on jurisdiction, that need to be met when investigating incidents, such as ensuring that worker members of the health and safety committee are involved in the incident investigation or that investigators must be knowledgeable about the work processes. Refer to your jurisdictional requirements and ensure compliance when investigating incidents.

Members of the team can include:

• employees with knowledge of the work
• supervisor of the area or work
• safety officer
• health and safety committee or the worker representative
• union representative, if applicable
• employees with experience in investigations
• "outside" experts
• representative from local health and safety jurisdiction or police, where required

Note: In some cases, other authorities may have jurisdiction, such as if a serious injury or fatality occurred. Your organization should establish, implement, and maintain a procedure to coordinate managing incidents with the authority having jurisdiction (such as the police, regulatory health and safety inspectors, etc.). This coordination may include the authority taking control of the incident scene.

The advantage is that this person is likely to know most about the work, the people involved, and the current conditions. Furthermore, the supervisor can usually take immediate remedial action. The counterargument is that there may be an attempt to gloss over the supervisor’s shortcomings in the incident. This situation should not arise if the incident is investigated by a team of people, and if the worker representative(s) and the investigation team members review all incident investigation findings and recommendations thoroughly.

After an incident occurs, an investigation aims to find out what caused it. When investigating an event, there are always "direct causes" and "indirect causes." Direct causes are unsafe conditions or acts, while indirect causes are factors that contributed to the incident, such as a lack of training, inadequate supervision, poor motivation, workplace design, management programs, etc. These causes may also be referred to as contributing factors.  

The term root cause is used because it is important to determine the actual cause or causes and to look beyond immediate findings. Why look for the root cause?

Always be aware of any biases when conducting an investigation. An investigator or team that believes that unsafe conditions cause incidents will likely try to uncover conditions as causes. On the other hand, one who believes incidents are caused by unsafe acts will attempt to find the human errors that are the cause. Therefore, it is necessary to examine all underlying factors in a chain of events that ends in an incident.

The important point is that even in the most seemingly straightforward incidents, seldom, if ever, is there only a single cause. For example, an "investigation" that concludes that an incident was due to worker carelessness, and goes no further, may have failed to find answers to several important questions, such as:

• Was the worker distracted? If yes, why was the worker distracted?
• Was a safe work procedure being followed? If not, why not?
• Were safety devices in order? If not, why not?
• Was the worker trained? If not, why not?

An investigation that answers these and related questions will probably reveal conditions that can be corrected properly versus attempts to prevent "carelessness."

There is no single definitive way to conduct a root cause analysis. The guidance in this fact sheet can help you conduct a proper incident investigation. Some tools or techniques exist that can help guide the incident investigation process and help to arrive at the root cause(s). Some popular root cause analysis tools are:

• 5 Whys: a technique where the investigator asks "why" 5 or more times
• Brainstorming: a method that seeks to gather as many ideas as possible 
• Fault tree analysis (FTA): a top-down method that starts with an event and visually works backward to find the cause(s)

Some organizations choose to use established tools, such as those above, or create their own (which can be a combination of these tools or something entirely different). Your organization's root cause analysis tool should be documented in the incident investigation plan and used for all incident investigations.

First:

• Report the incident occurrence to a designated person within the organization.
• Provide first aid and medical care, as necessary, to the injured person(s) and prevent further injuries or damage.

The incident investigation team would perform the following general steps:

• Scene management and scene assessment (secure the scene, make sure it is safe for investigators to do their job)
• Witness management (provide support, limit interaction with other witnesses, interview)
• Investigate the incident and collect data
• Analyze the data and identify the root causes
• Report the findings and recommendations

The organization would then:

• Develop a plan for corrective action
• Implement the plan
• Evaluate the effectiveness of the corrective action
• Make changes for continual improvement

As little time as possible should be lost between the moment of an incident and the beginning of the investigation. In this way, one is most likely to be able to observe the conditions as they were at the time, prevent disturbance of evidence, and identify witnesses. The tools that members of the investigating team may need (pencil, paper, camera or recording device, tape measure, etc.) should be immediately available so that no time is wasted. These items can be kept in an incident investigation kit for quick access when mobilization to the scene of an incident.

Causation Models

Many models of causation have been proposed, ranging from Heinrich's domino theory to the sophisticated Management Oversight and Risk Tree (MORT).

The simple model shown in Figure 1 attempts to illustrate that the causes of any incident can be grouped into five categories: task, material, environment, personnel, and management. When this model is used, possible causes in each category should be investigated. Each category is examined more closely below. Remember that these are sample questions only: no attempt has been made to develop a comprehensive checklist.

Figure 1: Incident Categories 

Task

Here, the actual work procedure being used at the time of the incident is explored. Members of the investigation team will look for answers to questions such as:

• Was a safe work procedure used?
• Had conditions changed to make the normal procedure unsafe?
• Were the appropriate tools and materials available?
• Were they used?
• Were safety devices working properly?
• Was the lockout used when necessary?

For most of these questions, an important follow-up question is "If not, why not?"

Material

To seek out possible causes resulting from the equipment and materials used, investigators might ask:

• Was there an equipment failure?
• What caused it to fail?
• Was the machinery poorly designed?
• Was the equipment maintained as recommended by the manufacturer?
• Were hazardous products involved?
• Were they clearly identified?
• Was a less hazardous alternative product possible and available?
• Was the raw material substandard in some way?
• Should personal protective equipment (PPE) have been used?
• Was the PPE used?
• Were users of PPE properly educated and trained?

Again, each time the answer reveals an unsafe condition, the investigator must ask why this situation was allowed to exist.

Work Environment

The physical work environment, and especially sudden changes to that environment, are factors that need to be identified. The situation at the time of the incident is what is important, not what the "usual" conditions were. For example, investigators may want to know:

• What were the weather conditions?
• Was poor housekeeping a problem?
• Was it too hot or too cold?
• Was noise a problem?
• Was there adequate light?
• Were toxic or hazardous gases, dusts, or fumes present?

Personnel

The physical and mental condition of those individuals directly involved in the event must be explored, as well as the psychosocial environment in which they were working. The purpose of investigating the incident is not to establish blame against someone, but the inquiry will not be complete unless personal characteristics or psychosocial factors are considered. Some factors will remain essentially constant while others may vary from day to day:

• Did the worker follow the safe work procedures?
• Were workers experienced in the work being done?
• Had they been adequately educated and trained?
• Can they physically do the work?
• What was the status of their health?
• Were they tired?
• Was fatigue or shiftwork an issue?
• Were they under stress (work or personal)?
• Was there pressure to complete tasks under a deadline, or to by-pass safety procedures?

Management

Management holds the legal responsibility for the safety of the workplace, and therefore, the role of supervisors and higher management and the role or presence of management systems must always be considered in an incident investigation. These factors may also be called organizational factors.  Ask questions such as:

• Were safety rules or safe work procedures established, communicated to, and understood by workers involved in the incident?
• Were written procedures and orientation available?
• Were the safe work procedures being enforced?
• Was there adequate supervision?
• Were workers educated and trained to do the work?
• Had hazards and risks been previously identified and assessed?
• Had procedures been developed to eliminate the hazards or control the risks?
• Were unsafe conditions corrected?
• Was there an established program for regular maintenance of equipment, and was it being followed?
• Were regular safety inspections carried out?
• Had the condition or concern been reported beforehand?
• Was action taken?

This model of incident investigation provides a guide for uncovering all possible causes and reduces the likelihood of looking at facts in isolation. Some investigators may prefer to place some of the sample questions in different categories; however, the categories are not important, as long as each question is asked. Obviously, there is considerable overlap between categories; this overlap reflects the situation in real life. Again, it should be emphasized that the above sample questions do not make up a complete checklist, but are examples only.

The steps in the investigation are simple: the investigators gather data, analyze it, determine their findings, and make recommendations. Although the procedures are seemingly straightforward, each step can have its pitfalls. An open mind is necessary in an investigation: preconceived notions and biases may result in some wrong paths being followed while leaving some significant facts uncovered. All possible causes should be considered. Making notes of ideas as they occur is a good practice, but conclusions should not be made until all the data is gathered.

Physical Evidence

Before attempting to gather information, examine the site for a quick overview, take steps to preserve evidence, and identify all witnesses. In some jurisdictions, an incident site must not be disturbed without approval from appropriate government officials such as the coroner, inspector, or police. Physical evidence is probably the most non-controversial information available. It is also subject to rapid change or obliteration; therefore, it should be the first to be recorded. Based on your knowledge of the work process, you may want to check items such as:

• Positions of injured workers
• Equipment being used
• Products being used
• Safety devices in use
• Position of appropriate guards
• Position of machinery controls
• Damage to equipment
• Housekeeping of the area
• Weather conditions
• Lighting levels
• Noise levels
• Time of day

You may want to take photographs before anything is moved, both of the general area and specific items. In some instances, video surveillance footage may be available for review. Access this recording before it is overwritten or otherwise lost. A later study of the pictures (and videos, if available) may reveal conditions or observations that were missed initially. Sketches of the scene based on measurements taken may also help in later analysis and will clarify any written reports. Broken equipment, debris, and samples of materials involved may be removed for further analysis by appropriate experts. Even if photographs are taken, written notes about the location of these items at the scene should be prepared.

Witness Accounts

Although there may be occasions when you are unable to do so, every effort should be made to interview witnesses. In some situations, witnesses may be your primary source of information because you may be called upon to investigate an incident without being able to examine the scene immediately after the event. Because witnesses may be under severe emotional stress or afraid to be completely open for fear of recrimination, interviewing witnesses is probably the hardest task facing an investigator.

Witnesses should be kept apart and interviewed as soon as possible after the incident. If witnesses have an opportunity to discuss the event among themselves, individual perceptions may be lost in the normal process of accepting a consensus view where doubt exists about the facts.

Witnesses should be interviewed alone, rather than in a group. You may decide to interview a witness at the scene, where it is easier to establish the positions of each person involved and to obtain a description of the events. On the other hand, it may be preferable to carry out interviews in a quiet office where there will be fewer distractions. The decision may depend in part on the nature of the incident and the emotional state of the witnesses.

Interviewing

The purpose of the interview is to establish an understanding with the witness and to obtain his or her own words describing the event:

DO

• Put the witness, who is probably upset, at ease
• Emphasize the real reason for the investigation: to determine what happened and why, so that similar future events can be prevented
• Empathize with the witness.  
• Let the witness talk, listen
• Confirm that you have the statement correct
• Try to sense any underlying feelings of the witness
• Make short notes or ask someone else on the team to take them during the interview
• Ask if it is okay to record the interview, if you are doing so
• Close on a positive note

DO NOT

• Intimidate the witness
• Interrupt
• Prompt
• Ask leading questions (that is, questions that lead the interviewee to an answer, particularly one that you might be biased toward)
• Jump to conclusions

Ask open-ended questions that cannot be answered by simply "yes" or "no". The actual questions you ask the witness will naturally vary with each incident, but there are some general questions that should be asked each time:

• Where were you at the time of the incident?
• What were you doing at the time?
• What did you see or hear?
• What were the work environment conditions (weather, light, noise, etc.) at the time?
• What was (were) the injured worker(s) doing at the time?
• Do you have any further information you would like to add?
• In your opinion, what caused the incident?
• How might similar incidents be prevented in the future?

Asking questions is a straightforward approach to establishing what happened. But, care must be taken to assess the accuracy of any statements made in the interviews.

Another technique sometimes used to determine the sequence of events is to re-enact or replay them as they happened. Care must be taken so that further injury or damage does not occur. A witness (usually the injured worker) is asked to reenact in slow motion the actions that happened before the incident.

A similar approach can be used when interviewing other people, such as supervisors, managers, maintenance workers, etc., who may have information about events leading to the incident but were not direct witnesses. 

Other Information

Data can be found in documents such as technical data sheets, health and safety committee minutes, inspection reports, company policies, maintenance reports, past incident reports, safe work procedures, and training reports. Any relevant information should be studied to see what might have happened, and what changes might be recommended to prevent recurrence of similar incidents.

At this stage of the investigation, most of the facts about what happened and how it happened should be known. Data gathering takes considerable effort to accomplish, but it represents only the first half of the objective. Now comes the key question - why did it happen?

Keep an open mind to all possibilities and look for all pertinent facts. There may still be gaps in your understanding of the sequence of events that resulted in the incident. You may need to re-interview some witnesses or look for other data to fill these gaps in your knowledge.

When your analysis is complete, write down a step-by-step account of what happened (the team’s conclusions), working back from the moment of the incident, listing all possible causes at each step (it could be laid out in a timeline or flowchart). This documentation is not extra work: it is a draft for part of the final report. Each conclusion should be checked to see if:

• It is supported by evidence,
• The evidence is direct (physical or documentary) or based on eyewitness accounts, or
• The evidence is based on an assumption.

This list serves as a final check on discrepancies that should be explained.

The most important final step is to come up with a set of well-considered recommendations designed to prevent recurrences of similar incidents. Recommendations should:

• Be specific
• Be constructive
• Identify root causes
• Identify contributing factors

Resist the temptation to make only general recommendations to save time and effort.

For example, you have determined that a blind corner contributed to an incident. Rather than just recommending "eliminate blind corners," it would be better to suggest:

• Install mirrors at the northwest corner of building X (specific to this incident)
• Install mirrors at blind corners where required throughout the worksite (general)

Try to avoid recommendations about disciplining a person or persons who may have been at fault. This action could not only be counter to the real purpose of the investigation, but it would also jeopardize the chances for a free flow of information in future investigations. Disciplining a worker should not be the immediate thought after an incident occurs. However, a proper investigation without preconceived notions or biases could, in some cases, find a worker at fault. Corrective actions should be aimed at helping the worker not repeat the actions that resulted in the incident, such as providing additional training and supervision.

In the unlikely event that you did not determine the causes of an incident with complete certainty, you would have probably still uncovered weaknesses within the process, or management system. It is appropriate that recommendations be made to correct these deficiencies.

The Written Report

The prepared draft of the sequence of events can now be used to describe what happened. Remember that readers of the report do not have the intimate knowledge of the incident that the investigator or team has, so include all relevant details, including photographs and diagrams. Identify clearly where evidence is based on certain facts, witness accounts, or the team’s assumptions.

If doubt exists about any particular part of the event, say so. The reasons for the conclusions should be stated and followed by the recommendations. Do not include extra material that is not required for a full understanding of the incident and its causes, such as photographs that are not relevant and parts of the investigation that led nowhere. The measure of a good report is quality, not quantity.

Always communicate the findings and recommendations with workers, supervisors and management. Present the information 'in context' so everyone understands how the incident occurred and the actions needed to put in place to prevent it from happening again.

Some organizations may use pre-determined forms or checklists. However, use these documents with caution as they may be limiting in some cases. Always provide all of the information needed to help others understand the causes of the event, and why the recommendations are important.

A difficulty that has bothered many investigators is the idea that one does not want to lay blame. However, when a thorough worksite investigation reveals that some person or persons among management, supervisor, and the workers were apparently at fault, then this fact should be documented. The intention here is to remedy the situation, not to discipline an individual.

Failing to point out human failings that contributed to an incident will not only downgrade the quality of the investigation, but it will also allow future incidents to happen from similar causes because they have not been addressed.

However, never make recommendations about disciplining anyone who may be at fault. Any disciplinary steps should be taken within the normal personnel procedures.

Management is responsible for acting on the recommendations in the investigation report. The health and safety committee or representative, if present, can monitor the progress of these actions.

Follow-up actions include:

• Respond to the recommendations in the report by explaining what can and cannot be done (and why or why not)
• Develop a timetable for corrective actions
• Assign corrective actions to specific individuals
• Monitor that the scheduled actions have been completed
• Check the condition of the injured worker(s)
• Educate and train other workers at risk
• Re-orient worker(s) on their return to work