Safety incident investigation and root cause analysis field guide

What incident investigation is, and why it prevents the next one

An incident investigation is what you do after something goes wrong: an injury, a near-miss, or property damage. You care for the person first, secure the scene, gather the facts before they disappear, work out why it happened down to the system that allowed it, and put a fix in place that holds. Done right, it is the cheapest safety work you will ever do, because the incident already paid for the lesson. The only question left is whether you collect it.

There are two kinds of investigation and they look almost identical on paper. One asks who did it, finds a worker to blame, writes him up, and closes the file. The other asks why it was possible, finds the hole in the system, and fixes the hole. The first one feels like accountability and changes nothing, because the conditions that produced the incident are all still there waiting for the next person. The second one is uncomfortable, because it usually points back at a decision someone above the injured worker made, and it is the only one that prevents a repeat.

This guide is the investigation itself. The written program that should already exist around it, the manual, training, the competent person, and the 300 log, lives in the construction safety program guide, and the fall protection that keeps roofers off the ground in the first place lives in the roof fall protection guide. Read those for the structure and the trigger heights. This one is what you do in the hours and days after the structure failed to stop something.

Why investigate an incident at all?

You investigate to stop the next one. That is the whole reason, and every other reason serves it. Nearly every incident on a jobsite was preventable, which means it had a cause you can find and a condition you can change. An investigation that ends without changing a condition was a waste of everyone's afternoon.

The other reasons are real and they stack on top. OSHA expects employers to investigate and to keep the records that prove hazards get found and fixed. Your insurer reads incident frequency and the workers compensation claims behind it, and that history drives your experience modification rate, which drives your premium and sometimes whether a general contractor lets you bid at all. If the event was serious, lawyers will read your file, so what you wrote and how you wrote it matters. And the crew watches. A company that investigates to learn builds people who report problems early. A company that investigates to punish builds people who hide them.

Hold one rule above the rest. The job of the investigation is to find the system fault, not the scapegoat. The moment the team settles on which worker to blame, the thinking stops, the real cause stays in place, and the file closes over a problem that is still live. Blame is the easiest answer and it is almost never the useful one.

The first minutes: care, secure, stop

Before any of the investigation starts, three things happen, and they happen in order. Care for the injured person first. Nothing about preserving evidence or filling out a form comes ahead of getting someone medical help. Call emergency services if the injury warrants it, render first aid if you are trained, and do not move a seriously injured person unless they are in further danger where they lie.

Once the person is being cared for, secure the scene. Keep people out of the area, control any live hazard that is still active, and shut off energy or equipment that could hurt the next person who walks up. A scene that is still dangerous will produce a second victim, often one of the people who rushed in to help, so the order is care for the hurt person, then make sure no one else joins them.

Then stop the related work. If a worker fell because an anchor pulled out, every other crew tied to a similar anchor needs to come down until you know why. If a saw kicked back, the identical saws on the other floors stop. The instinct on a production job is to keep the rest of the crew moving while one person deals with the incident, and that instinct is exactly wrong when the cause might be shared. Stop the work that could repeat the event, then start finding out what happened.

How do you preserve an incident scene?

Preserve the scene before anyone cleans it up, because the cleanup destroys the evidence faster than anything else. The natural reaction after an injury is to tidy: coil the cord, move the ladder, sweep the debris, get the area safe and normal again. Every one of those acts erases a fact you will want in two days when the story stops adding up.

Photograph everything before it moves. Wide shots to place the scene, then close shots of the specific things: the failed anchor, the unguarded edge, the broken rung, the position of the tool, the housekeeping, the weather. Shoot more than you think you need, because you cannot go back and the scene will be gone within the hour. Take measurements that matter to the event, the height of the fall, the distance to the edge, the length of the lanyard, and note them with the photos so a number is tied to an image.

Then leave it alone as much as the work allows. Rope off the area, tag the equipment out of service, and hold the failed parts. Do not let the broken harness go back in the gang box and do not let the ladder get used again before someone has looked at it. If production pressure forces you to clear the area, document it completely first, because once it is swept you are investigating from memory, and memory is the weakest evidence on the site. Capture it before it is cleaned up, not after.

When do you have to report an injury to OSHA?

Some events run on a clock that starts the moment the incident happens, and missing it is its own violation on top of whatever caused the injury. Under the OSHA reporting rule, a work-related fatality must be reported to OSHA within 8 hours. An in-patient hospitalization, an amputation, or the loss of an eye must be reported within 24 hours. Those deadlines run from when the event occurs, or from when it is reported to you if you did not know at the time. The hospitalization, amputation, or eye loss is reportable when it results from a work-related incident that occurred within 24 hours of the event, and a fatality is reportable when the death occurs within 30 days of the incident.

Reporting is not the same as recording. The OSHA recordkeeping rule is the separate question of whether a work-related injury or illness goes on the 300 log: generally, anything beyond first aid, anything causing days away, restricted duty or transfer, loss of consciousness, or a significant diagnosed injury. Most employers above a size threshold keep the 300 log and post the 300A summary each year. The construction safety program guide covers the log and the posting cycle in full.

Know both clocks before you ever need them. Have the reporting phone number and the online path posted where the foreman can find them at 6 a.m., because the day you are scrambling to help an injured person is the worst possible time to learn the deadline. The exact thresholds, the recordable criteria, and how they are enforced can differ under an OSHA-approved state plan, so confirm the current rule with OSHA or your state plan rather than trusting a number from memory. When in doubt on whether something is reportable, the safe move is to report it. Meet the deadline.

Gather the facts fast: people, position, parts, paper

Memories fade and they fade fast, so the facts get collected in the first hours, not the first week. Within a day, witnesses have already talked to each other and started, without meaning to, to converge on a single agreed version that smooths over the contradictions you need. The contradictions are where the truth usually is. Get to the facts before they get sanded down.

Four buckets cover most of what you need. People: who was involved, who saw it, who was nearby, and who assigned or supervised the task. Position: where everyone and everything was at the moment it happened, which is what your scene photos and measurements capture. Parts: the physical evidence, the failed equipment, the tool, the material, the PPE, held and not returned to service. Paper: the records that frame the task, the job hazard analysis, the training records, the inspection logs, the equipment maintenance history, the manufacturer instructions, and the weather for the day.

Write down what you find as you find it, because the value of a fact decays the longer it sits in someone's head. A photo taken on the spot, a measurement noted at the scene, and a witness account captured the same day are worth more than a polished report assembled from recollection a week later. Speed is not about rushing the analysis. It is about freezing the evidence before it moves.

Interviewing the witnesses

Talk to witnesses separately, soon, and one at a time, before they have compared notes and merged their accounts into one. Two people who saw the same fall will describe it differently, and those differences tell you things a single agreed story hides. Interview them together and you lose that, because the louder or more senior voice sets the version and the rest nod along.

Ask open questions and let people talk. Walk me through what you saw beats did you see him unclip, which hands the witness the answer you are fishing for. Start broad with tell me what happened, then narrow with what were you doing just before, where was he standing, what did you hear. Silence is a tool. People fill it, and what they add to fill it is often the detail they were not sure they should mention.

Keep blame out of the room, completely. The instant a worker thinks the interview is hunting for who to punish, the shutters come down and you get a careful account designed to protect, not a true one. Say plainly that the point is to keep it from happening again, not to find fault, and then prove it by how you handle what comes out. You are after the story, not a confession. The worker who trusts that the investigation is fair is the one who tells you the near-miss that almost killed someone last month, which is the lesson you actually needed.

What is root cause analysis?

Root cause analysis is the work of pushing past what happened to why it was possible, until you reach a cause you can fix that stops the event from recurring. The immediate cause is easy and usually useless on its own. A worker fell. That is a fact, not a cause. Why was he where he could fall, why was there no guardrail, why did the plan put him at that edge, why did nobody catch it. The root cause is the answer several questions deep, where you find a decision or a condition that, changed, would have prevented it.

Two methods do most of the field work and they pair well. The 5 Whys keeps asking why, in a chain, until the answers stop pointing at the worker and start pointing at the system. The fishbone, sometimes called the cause-and-effect or Ishikawa diagram, sorts possible causes into categories so you do not fixate on the first one you find. Common categories are man, machine, method, material, and environment: the person and the training, the equipment and tools, the procedure and the plan, the materials and PPE, and the conditions like weather, light, and housekeeping.

OSHA encourages root cause analysis precisely because a fix aimed at the immediate cause does not prevent recurrence. Retrain the worker who fell and you have done nothing about the missing guardrail, the schedule that rushed him, or the plan that exposed him. The methods are simple. The discipline is refusing to stop at the first answer that lets everyone off the hook. Ask why until the answer is something you can engineer or manage, not something you can only scold.

What is the 5 Whys?

The 5 Whys is a method where you ask why an incident happened, then ask why of that answer, and keep going until you reach a cause worth fixing. The number five is a guide, not a rule. Sometimes it takes three, sometimes six. The point is to keep going past the first answer, because the first answer is almost always the worker and the worker is almost never the root cause.

Worked through a real chain, it looks like this. A worker cut his hand on a blade. Why: the guard was off the saw. Why: it had been removed weeks ago because it bound on the material. Why: nobody fixed or replaced it. Why: there is no system to flag and pull damaged equipment from service. Why: the company never set up a tool inspection process. Stop at the first why and you blame the worker for a bad cut. Follow it to the fifth and you find a missing inspection system, which is a thing you can build and which protects every other worker on every other saw.

Notice where the answers point as the chain runs. The early whys land on the individual. The later whys land on decisions, procedures, and the absence of a system, which is to say on management. That drift from person to system is the whole value of the method. If your 5 Whys keeps the blame on the worker all the way down, you stopped asking too early or you flinched at where the honest answer was leading.

Worker error is a symptom, not the cause

When you find that a worker made a mistake, you have found a symptom, not the root cause. People make errors. That is a constant you design around, not a defect you can train out of existence. The real question is never just did the worker err. It is why the system let that error turn into an injury, and why the error was likely in the first place.

Push on the why and the system shows itself. He did not tie off, so ask why: was he ever trained, was an anchor available, was he rushed by a schedule that made the safe way the slow way, did his supervisor work unprotected in front of him and set the norm. He used the wrong tool, so ask why: was the right one on the truck, was it broken and never replaced, did the procedure even specify one. No training, time pressure, a missing guard, a bad procedure, an unavailable tool, a supervisor who looked the other way. Those are the causes. The worker's error is the last domino, not the hand that pushed.

This is not about excusing carelessness, and a competent person still addresses genuine recklessness. It is about where the prevention lives. You cannot reliably fix human nature. You can fix the conditions that make a human error deadly, and that is where an investigation that wants results spends its time.

Most incidents have more than one cause

Serious incidents are rarely one thing going wrong. They are several smaller failures lining up, each one survivable alone, that happen to align on a bad day. The Swiss cheese model is the useful picture: every layer of defense, the plan, the equipment, the training, the supervision, has holes, and an incident happens when the holes line up and something passes straight through.

Run it through a real fall. The guardrail was missing, the worker was not tied off, the anchor that was available was the wrong type, the JHA never named that edge, and the foreman was pulled to another problem at the moment it mattered. Pull any one of those back into place and the worker probably goes home. That is why an investigation that finds a single cause and stops is usually an investigation that quit early. There is almost always a second and a third.

The practical consequence is that you fix more than one thing. Multiple contributing causes mean multiple corrective actions, and the strongest fix is the one that closes the most holes at once or removes the hazard so the holes do not matter. Look for all of them. The cause you skip because you already found one is the one that lines up with the next set of holes.

How do you fix an incident so it cannot repeat?

You fix it by moving up the hierarchy of controls, not by defaulting to retraining and a memo. The hierarchy ranks fixes by how well they hold, from most effective to least: eliminate the hazard, substitute something less dangerous, engineer a control that does not depend on behavior, use administrative controls like procedures and training, and last, personal protective equipment. The higher you go, the less the fix relies on a person doing the right thing under pressure every single time.

Most weak investigations land at the bottom every time. Retrain the worker, hold a toolbox talk, post a sign. Those have a place, but they are the least durable fixes because they all depend on human attention that the next deadline will erode. If a worker fell at an unguarded edge, the strong fix is a guardrail, which is an engineering control that protects everyone whether they remember the talk or not. Retraining the one worker who fell does nothing for the next crew at the same edge.

Ask of every corrective action where it sits on the hierarchy, and push it up at least one level if you can. Can the task be done from the ground instead, eliminating the exposure. Can a guard or a rail do the work so behavior does not have to. If the honest answer is that PPE and a procedure are all that is available, fine, but reach for that only after the higher controls are genuinely off the table. Fix it up the hierarchy.

Investigate the near-miss too

A near-miss is a free lesson. The anchor pulled but the worker was already on the ladder. The load swung but nobody was under it. The same holes lined up, the same system failed, and the only difference between the near-miss and the funeral was luck. Investigate it with the same seriousness, because you got the warning without paying for it, and the next alignment of those holes may not be so kind.

Crews report near-misses only when reporting is safe. The instant a near-miss report gets someone disciplined, the reports dry up, and you lose the cheapest early warning you have. Treat near-miss reporting as no-blame, thank the person who raised it, and act on it visibly, and you build a stream of warnings that lets you fix conditions before anyone gets hurt. Punish a near-miss report and you have trained the crew to stay silent until silence is no longer possible.

The math is plain. For every injury there are many near-misses pointing at the same hazard, and they arrive first. A company that investigates near-misses fixes things while the cost is still zero. A company that waits for the injury pays full price for a lesson it could have had for free.

Track corrective actions to closure

A finding with no fix is worthless, and a fix that never gets verified is barely better. The most common way an investigation fails is not in the analysis. It is afterward, when the corrective action gets written down, assigned to nobody in particular, and quietly never done. The report reads well, the file closes, and the same hazard takes the next worker because the rail that was supposed to go up never went up.

Every corrective action needs three things or it does not exist: an owner who is one named person, a due date, and a verification step that confirms it actually got done and worked. Open until verified. Not open until somebody says they will get to it. Someone has to go look and confirm the guardrail is installed, the procedure is changed, the tool is in the truck, before the action closes.

This is exactly where a field tool earns its place, because corrective actions die in the gap between the office binder and the crew on the roof. In FieldOS, you can log the incident, attach the scene photos and the witness notes to it, open a corrective action with an owner and a due date, and keep it visible until it is verified closed instead of lost in an email thread. The point is not the software. The point is that an open action stays in front of someone until it is done, and when an inspector or an insurer asks what you changed after the incident, the record shows the finding, the fix, the date, and who signed off. Close the corrective action.

Writing the investigation report

The report exists so the lesson survives the people who learned it. Crews turn over, foremen move on, and a year later the only thing that remembers why the procedure changed is the file. Write it so a stranger can read it and understand what happened, why, and what you did about it.

Cover what happened, when and where, who was involved, the causes you found including the root cause and the contributing factors, and the corrective actions with their owners and dates. Stick to facts and findings. Describe the conditions, the sequence, and the evidence, and let the causes follow from them. A report that reads like a verdict against a worker is both bad investigation and, if the event was serious, a document you will not enjoy seeing read back to you later.

Keep the language factual and avoid editorializing or admissions of fault in the write-up. There is a difference between the guardrail was not installed at the south edge, which is a fact, and we were negligent in failing to protect the edge, which is a legal conclusion you are not the one to draw. Record what was observed. Save the conclusions about liability for the people whose job that is.

Share the lesson with every crew

A lesson learned by one crew and filed away helps no one else. The hazard that took a worker on one job is on the next job too, and the only way the other crews benefit is if you tell them. Get the finding out of the report and onto the rest of the company.

A short safety alert and a toolbox talk are the usual tools, and they work when they are specific. Here is what happened, here is why, here is what we changed, here is what to watch for on your job. Skip the worker's name and the blame, because the point is the hazard and the fix, not the person. The construction safety program guide covers how toolbox talks and alerts fit into the wider program and how to document that they happened.

Sharing also feeds the reporting culture you want. When a crew sees that a near-miss someone reported turned into a fix that protected everyone, reporting stops feeling like snitching and starts feeling like how the company keeps people safe. The lesson shared is worth more than the lesson filed, and it is the difference between one crew getting smarter and the whole company doing it.

Workers comp, return to work, and the EMR

When an injury is recordable, a workers compensation claim usually follows, and how you handle it affects both the injured worker and the company's costs for years. Report the claim promptly to your carrier. Late reporting drives up the cost of a claim, complicates the medical care, and signals to the insurer that the company is not on top of its safety, all of which work against you.

Get the worker appropriate medical care and look hard at return-to-work options. Modified or light duty that brings a recovering worker back to suitable tasks tends to produce better recoveries and lower claim costs than leaving someone home with nothing to do, and it keeps an experienced person connected to the crew. The specifics are governed by your state workers compensation system and the treating physician, so work within those rules rather than improvising.

Behind the premium sits the experience modification rate, the EMR, which scales your workers comp cost against your claims history. Frequent or severe claims push it above 1.0 and your premium with it, and a high EMR can lock you out of bids on jobs that set a ceiling. Real investigation and real corrective action are what bend the claim history down over time. The state plan and your carrier control the details, so confirm the specifics with them, but the direction is not in doubt: fewer incidents, lower cost, more work you are allowed to bid.

Careful with the written word

What you write during an investigation can end up in front of a regulator, an insurer, or a court, so write facts, not admissions. There is a real difference between recording what happened and drawing a legal conclusion about fault. The first is good investigation. The second is a job for counsel, and putting it in your own report can hurt the company and the injured worker both.

Document the conditions, the sequence, the evidence, and the corrective actions in plain factual language. The edge had no guardrail. The anchor was rated for a different application. The JHA did not address the task. Those are observations a reviewer can verify. Avoid speculation, blame, and conclusions like we were at fault or this was avoidable, which are characterizations, not facts, and which you are not the right person to commit to paper.

On a serious event, loop in counsel early, because some investigation work may be conducted under attorney direction and the rules around that are specific to your situation and jurisdiction. This is not advice to hide anything, and you still meet your OSHA reporting and recordkeeping obligations on time. It is a reminder that on a serious incident, how the investigation is structured has legal consequences, and a lawyer should help shape it. When the stakes are high, get that guidance before you write, not after.

When the event is serious, do not go it alone

A fatality, a catastrophe, or a severe injury is a different animal, and the foreman should not be running it solo from a clipboard. On a serious event, OSHA may come to the site and open its own investigation, your own counsel should be involved, and senior people in the company need to be engaged from the first hour. The reporting clock still applies, and meeting it is not optional.

Preserve the scene tightly and do not disturb it beyond what is needed to care for people and remove immediate danger. Cooperate with OSHA within the framework your counsel sets, keep your records straight, and resist the pressure to assign blame fast to make the event feel resolved. Serious investigations that rush to a worker-error conclusion tend to miss the systemic causes and tend to age badly when the facts come out.

The honest summary is short. On a serious event, get help, slow down enough to get it right, and lean on people who do this for a living. The exact obligations and how OSHA and your state plan handle a serious incident vary, so confirm them rather than guessing.

How do you spot the pattern across incidents?

One incident gives you a cause. A stack of incidents gives you a pattern, and the pattern is where the real prevention is, because it points at the condition your company keeps producing. The same cut keeps showing up, the same near-miss at the same kind of edge, the same tool failing the same way. Fix the one incident and you helped one crew. Fix the pattern and you changed the company.

This is the difference between lagging and leading indicators. Lagging indicators count what already hurt people: recordable injuries, lost-time days, the 300 log totals. They are real but they are a body count, and by the time they move, the harm is done. Leading indicators count the things that come before injuries: near-misses reported, inspection findings, corrective actions closed on time, toolbox talks held. Watch the leading indicators and you can act before the lagging ones climb.

Trending takes records you can actually sort, which is where keeping incidents and near-misses in one place pays off. Log every incident and near-miss against the job, the crew, and the cause, then look across them for the repeat type instead of rediscovering the same hazard one investigation at a time. When you can see that the same cause produced six near-misses this quarter, you stop treating each as a one-off and start fixing the pattern. Fix the pattern, not just the last incident.

What to capture at each step

The record is what turns an investigation into something an inspector, an insurer, or the next foreman can rely on later. Capture it as you go, because reconstructing it after the fact loses the detail that mattered. The table below is the minimum a defensible investigation leaves behind.

Field checklist

Common mistakes

• Blaming the worker instead of finding the system fault that made the error possible.
• Cleaning up or moving the scene before it is photographed and measured.
• Missing the OSHA reporting deadline because nobody knew the clock.
• A shallow root cause that stops at worker error instead of asking why it was possible.
• Corrective actions written down, assigned to no one, and never closed out.
• Fixing only with retraining and a memo when an engineering control was available.
• Investigating the injury but ignoring the near-miss that warned of it.
• Keeping the lesson in the file instead of sharing it with the other crews.
• Writing admissions and conclusions of fault into the report instead of facts.

Standards and references

The framework lives in a few places. OSHA's recordkeeping and reporting rules sit in 29 CFR Part 1904: the reporting deadlines for fatalities, hospitalizations, amputations, and eye loss in the reporting section, and the 300 log recordable criteria in the recordkeeping sections. The duty to provide a safe workplace runs through the General Duty Clause of the OSH Act and, for construction, the 1926 standards that govern the specific hazards. The construction safety program guide and the roof fall protection guide cover those installation and program requirements in detail.

The investigation methods are not OSHA standards but recognized practice OSHA points to. Root cause analysis, the 5 Whys, and the fishbone or cause-and-effect diagram are the common tools, and the hierarchy of controls, eliminate, substitute, engineer, administrative, then PPE, is the recognized order for choosing a corrective action. OSHA publishes guidance encouraging root cause analysis and warning that fixes aimed only at the immediate cause do not prevent recurrence.

Workers compensation and the experience modification rate are governed by your state workers comp system and your insurance carrier, not by OSHA. The exact reporting deadlines, recordable criteria, thresholds, and section numbers can differ under an OSHA-approved state plan and change between revisions, so confirm the current requirement with OSHA, your state plan, your carrier, and counsel before relying on it. Across all of it, three things carry the most weight: find the root cause instead of a scapegoat, meet the reporting deadline, and close the corrective action.

Terms and definitions

Incident investigation borrows terms from safety, recordkeeping, and insurance, and the same idea shows up under different names across a report, a claim, and an OSHA form.

OSHA prefers incident over accident, because accident implies bad luck and most events were preventable. A near-miss is an incident that could have caused harm but did not. Recordable means it meets the criteria for the 300 log, while reportable means it triggers the direct-notification clock to OSHA, and the two are not the same event set.

Incident

An unplanned event that caused or could have caused injury, illness, or property damage; OSHA prefers it over accident

Near-miss

An incident that could have caused harm but did not, the free warning before an injury

Root cause

The underlying system fault that, if corrected, would prevent recurrence, found past the worker error

Recordable

A work-related injury or illness meeting the 300 log criteria, such as treatment beyond first aid or days away

Reportable

An event that triggers direct notification to OSHA on a clock: fatality, in-patient hospitalization, amputation, or eye loss

Corrective action

The fix put in place to prevent recurrence, ranked by the hierarchy of controls and tracked to verified closure

Hierarchy of controls

The order for choosing a control: eliminate, substitute, engineer, administrative, then PPE

EMR

Experience modification rate, a multiplier that scales workers comp premium against claims history

Related tools

Calculators and readiness checks for this work

Compare your options

FAQ

People also ask

• What is a construction safety program?
• At what height is fall protection required on a roof?
• What is a job hazard analysis?
• What is the 4 to 1 ladder rule?
• What is a mast-climbing work platform?