How to Properly Investigate an Incident Under ISO 45001

ISO 45001 requires organisations to investigate incidents to understand what happened, why it happened, and whether the same thing could happen again. A good investigation should focus on finding the real causes—not simply blaming an individual.

What Is an Incident?

An incident is any event related to work that causes or could cause injury or ill health.

This includes:

• Injuries

• Work-related ill health

• Near misses

• Incidents involving contractors

• Incidents involving visitors

If an organisation investigates only incidents that cause injuries, it may be missing important warning signs that could help prevent more serious incidents in the future.

Step 1: Make the Area Safe and Collect Information

First, make sure the area is safe and prevent further harm.

Then collect evidence that may disappear or change, such as:

• Photos of the scene

• Position of equipment and materials

• Condition of machinery

• Statements from people who witnessed the incident

Speak to people separately and as soon as possible. Memories can change quickly, especially after people discuss the incident with each other.

Ask “What happened?” rather than “Who is responsible?”. This encourages people to provide more honest and useful information.

Step 2: Establish What Happened

Before deciding why the incident happened, first understand exactly what happened and in what order.

Create a timeline covering:

• Events

• Working conditions

• Actions

• Decisions

Avoid deciding on a cause too early. Otherwise, investigators may look only for evidence that supports their first assumption.

Step 3: Identify All the Causes

An incident usually has more than one cause.

Look at three levels:

1. Immediate Causes

What directly caused the incident?

For example:

• An unsafe action

• Faulty equipment

• An unsafe workplace condition

2. Contributing Causes

What made the immediate cause more likely?

For example:

• Time pressure

• Poor lighting

• Equipment condition

• Lack of staff

• Fatigue

• Poor workplace layout

3. Underlying Causes

Why did those conditions exist in the first place?

This could involve:

• Poor planning

• Inadequate resources

• Maintenance decisions

• Procurement decisions

• Insufficient supervision

• Poor work design

A useful question is: “Why did this happen?” Keep asking why until you reach a management or system-level decision.

If the investigation ends only with “the worker made a mistake,” it may not have gone deep enough.

Step 4: Don't Immediately Blame Human Error

If the investigation identifies human error, ask:

1. Was the correct action realistically possible under the circumstances?

2. Could another trained and competent person have made the same mistake?

3. Did the way the work was designed make the mistake more likely?

If a reasonable person could have made the same error, the mistake may be a symptom of a system weakness, rather than the root cause.

Step 5: Choose Corrective Actions Using the Hierarchy of Controls

Corrective actions should follow the hierarchy of controls.

Before choosing training, procedures, or instructions, consider whether the hazard can be:

• Eliminated

• Replaced with something safer

• Controlled through engineering measures

Training and procedures are useful, but they are generally lower-level controls.

Therefore, if retraining is the only corrective action, ask whether stronger controls could address the hazard more effectively.

Step 6: Check Whether the Same Problem Exists Elsewhere

One of the most important parts of an investigation is checking whether a similar risk exists in other areas.

For example:

• If one machine has a missing safety guard, check other machines.

• If a permit was not issued for one job, review the permit process for similar jobs.

• If one department has a particular risk, check whether other departments face the same risk.

Think of every incident as a warning or sample that may reveal a wider problem.

Step 7: Complete the Actions and Communicate the Results

Do not simply assign corrective actions. Check that they were:

• Actually implemented

• Effective

• Preventing the problem from happening again

Then communicate the findings and changes to the workforce.

When employees see that reported incidents lead to real improvements, they are more likely to continue reporting incidents and near misses.

Common Weaknesses in Incident Investigations

Avoid these common mistakes:

1. Stopping the investigation at the immediate cause.

2. Automatically blaming operator error without checking whether it was foreseeable.

3. Making retraining the only corrective action.

4. Failing to check whether the same risk exists elsewhere.

5. Assigning actions without checking whether they were effective.

6. Recording near misses but not investigating them.

7. Failing to communicate the investigation results to employees.

The Key Message

A good ISO 45001 incident investigation should not simply answer “Who made the mistake?”

It should answer:

What happened? → Why did it happen? → What allowed it to happen? → Could it happen elsewhere? → What can we change to prevent it from happening again?