5.5 Essential Incident Investigation Steps

A successful incident investigation begins with a consistent process designed to uncover what happened so future incidents can be avoided. Investigations need to be performed as soon after the incident as possible and be completed as quickly as possible. Witnesses’ recall may deteriorate over time and important evidence may disappear if there is a delay. The sooner an investigation is completed, the sooner changes can be made to make the worksite safer. Employers may also be required to report incidents and investigation results within a specified time period.

Step 1. Scene Security  

Securing the scene entails two actions. First, any uncontrolled hazard (e.g., leaking gas) needs to be eliminated to ensure the safety of the investigators and others. Second, the scene needs to be protected so that no evidence can be destroyed or altered (intentionally or unintentionally) until the completion of the investigation. Protection normally includes restricting access to the scene. In some circumstances, it may also require protecting the scene from inclement weather.

Step 2. Identify and Interview Witnesses

Investigators normally prioritize interviewing witnesses, including the injured worker(s). Witnesses should be interviewed as soon as possible after the incident while their memories are fresh and uncontaminated by discussing the event with others. A few principles should be followed in interviewing to ensure accurate information and the well-being of the witness:

• Ensure the witness is physically and emotionally well. Witnessing an incident can traumatize people and assistance, such as counselling, may be necessary before an interview takes place.
• Be clear about the purpose of the interview and the investigation, highlighting that it is not about laying blame.
• Interview witnesses separately and in a neutral location. A worker representative should be provided if the witness requests it or if the union agreement requires it.
• Allow witnesses to describe what happened in their own words. Do not lead or put words in their mouths.
• Ask only questions that elicit more information or clarify answers. Do not ask the witness “why” they think something happened.
• Be an active listener. Ensure the investigator has correctly heard them by repeating or summarizing what they said.
• Record the interview in some fashion—either with detailed notes or (if appropriate) audio recording.
• Be aware of power relations. Interviews can be distorted by unrecognized power imbalances, such as the interviewer being the supervisor of the worker, or the worker who was injured being under the witness’s supervision. These dynamics can be a barrier to accurate reporting of the incident.

Step 3. Complete the Investigation

The next step in an investigation is to gather evidence. There are a number of techniques for collecting the relevant information. They will be used in various combinations depending on the nature of the incident and the workplace. Gathering might begin with a walk-through, which is an inspection of the incident scene to get an overall picture of the environment. A walk-through may also clarify which additional evidence-gathering techniques are appropriate. These further techniques should include recording the scene through photos or video or drawings (if photos or video are not practical) to create a visual record of the scene.

Another investigative technique is a re-enactment of the incident, which is a simulation designed to recreate the circumstances that led to the incident. A re-enactment might entail asking witnesses to act out the events that took place before the incident, or re-establishing a set of conditions relevant to what occurred. The value of the re-enactment is that it can identify how circumstances, events, or behaviours interacted to cause the incident. These interactions can be difficult to identify solely through witness testimony because of the limited perspective any one witness will have on an incident. Other investigative techniques might include inspecting machinery and tools, checking logs and records, collecting debris, materials and other relevant items, or conducting air sampling or noise testing. Investigators should also gather any relevant company policies, government regulations, or operator’s manuals and guides.

Step 4. Root Cause Analysis

Once all the information has been gathered, the next step is to analyze the data to determine the causes. This is a crucial step, and is often where investigations go wrong. The immediate reasons for the incident will be the first to appear. These causes will usually be worker error or some factor that may appear to be uncontrollable. Stopping the investigation at this point will lead to an incomplete analysis and the investigation will likely fail at one of its key goals—preventing future incidents. Additional analysis of the data will reveal underlying reasons for (the “root cause” of) the incident. A simple way to think about probing data for root causes is to keep asking “why?” Asking why something happened allows the investigators to get past their initial understanding of the incident. 

In an attempt to help investigators get to root cause, a variety of analysis models have been developed. The domino theory dates back to 1936 and remains popular due to its ease of illustration. It envisions cause as a series of five dominos lined up together.^[1] Each domino represents factors reaching back from an incident. The first (closest) domino is labelled Injury, followed by Incident, Unsafe Acts and Conditions, Personal Defects (e.g., equipment failure, personal factors), and finally Background (e.g., lack of management control). The theory contends that injury results from failure at all five levels. If any of the failures does not happen (i.e., one of the dominoes is removed from the chain), an injury will not occur. For example, if a worker is taught to work safely, an injury might be prevented even though failures in background decisions still occurred.

A more recent revision to domino theory is the Swiss cheese model.^[2] This model retains the five factors giving rise to injuries that are outlined in domino theory. Each of these dominoes is then given “holes” that represent various subfactors that influence whether an incident occurs or not, such as organizational influences, local working conditions, unsafe acts, and defences, barriers, and safeguards. In the Swiss cheese model, an incident requires that the holes in the dominoes line up—in other words, a failure must occur in each domino. This model emphasizes that injuries are the result of multiple failures. If one of the subfactors is functioning properly, then weakness in the other four may still not lead to an incident. For example, bad organizational culture (an organizational influence) around safety may not lead to injury if there are appropriate guards (a defence, barrier, or safeguard) to prevent injury. The domino theory and Swiss cheese models are popular because of their simplicity in articulating a core principle that an investigator must look beyond immediate actions and explore underlying factors that contributed to the incident. 

Step 5. Reporting and Recommendations  

The next step in the investigation process is to write a formal report outlining the findings and making recommendations. In some respects this can be considered the most crucial phase, as a careful investigation is without value if the recommendations fail to improve the situation. The incident report will be the permanent record of the incident and its causes and thus should clearly outline what happened and why it happened. It may even have future legal ramifications, as its recommendations may be used by government inspectors to determine if an employer met the standard of due diligence in controlling hazards after the incident.

Incident reports can take different forms depending on context, organization, and situation. All incident reports should include the following elements:

• Who performed the investigation
• Details of the incident, including date, time, persons involved, outcomes
• Details of the investigation and how it was conducted, timelines, etc.
• An outline of the factors that led up to the incident
• Clear identification of the root causes of the incident
• Specific recommendations designed to prevent future incidents

In designing a report template, a report that requires investigators to answer open-ended questions is preferable to a report that provides a checklist of options. To elicit action, recommendations need to be specific and directed to the identified causes. Nevertheless, if they are too specific, they risk not addressing systemic issues adequately. The recommended action also needs to be within the control of the employer. This can be difficult when environmental conditions played an important role in the incident. For example, bad weather may have been a factor in an incident. While the employer cannot control weather, the employer can implement controls that neutralize the effect of weather on workers. There is also the issue of how to report on the role of human error in the incident. Should human error be identified during the incident investigation, it should be identified without assigning blame.

The investigator(s) should ensure all affected parties receive a copy of the investigation report, including involved workers, the joint committee (if applicable), and responsible managers. It is the responsibility of the employer to implement recommendations. Often employers will delay implementation, seek out other solutions, or respond that the recommendation is too expensive or not practicable. Lack of follow-through on recommendations is a reality of in practice and it can undermine both workplace safety and how carefully investigators examine future incidents. An action plan should accompany the report in order to assign timelines and resources to implement the recommendations.

Step 6. Follow up

The final step in the incident investigation process is follow up. During the reporting stage, specific recommendations were put forward which most often include corrective and preventative measures. The goal is to eliminate or minimize the risk of a similar incident happening in the future. One question to ask is “have the recommendations been implemented?” If the employer discovers the recommendations have not been fully implemented as yet, review the action plan to determine if the appropriate timelines and resources have been assigned to this phase, and revise if necessary.

Finally, the employer needs to determine if the recommendations are effective? As everyone in the workplace is part of the IRS (Internal Responsibility System), it is important to include stakeholders such as the health and safety representative or committee, the area supervisor and union representation (if applicable) to determine the effectiveness of the corrective and preventative measures.

“Incident Investigation” in Health and Safety in Canadian Workplaces by Jason Foster and Bob Barneston, published by AU Press is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License, unless otherwise noted.