Most organisations investigate incidents. Far fewer change anything as a result. The gap between those two statements is where repeat incidents live, and it is usually a process problem rather than a willingness problem.
Safe Work Australia’s national figures make the point sharply. Over the decade to 2025, the national worker fatality rate fell 15%, from 1.8 deaths per 100,000 workers in 2015 to 1.5 in 2025. Over the same period, the absolute number of deaths climbed to its highest level since 2012.
Conditions are getting safer on average while the count refuses to fall. The three industries recording the most worker deaths are manufacturing, health care and social assistance, and construction.
That pattern is not a hazard-discovery problem. Businesses in those sectors know what hurts people. It is a closing-the-loop problem, and that is what an investigation is for.
Why Most Incident Investigations Produce Nothing Useful
Three failure modes account for most of it. The first is speed: an investigation is completed within the hour after the event, when the priority is reassurance rather than understanding. The second is scope: only the injury gets investigated, so near misses with identical causes are logged and forgotten.
The third is the most common. The investigation finds a person rather than a system. Once the answer is “the operator did not follow the procedure”, the corrective action becomes retraining that operator, and nothing about the work changes. The next operator meets the same conditions.
Separate the Investigation From the Blame Question
These are two different exercises, and they need different rooms. Disciplinary processes ask whether a person met an expectation. Investigations ask why the work was set up so that the outcome was possible.
Running them together guarantees a poor investigation, because the people who know most about how the work gets done will not tell you while their position is at risk. Say explicitly, at the start, that the investigation is about the system. Then behave that way when the findings are uncomfortable.
That holds only if everyone drawn into the process understands it the same way. Witnesses, supervisors and the person who happened to be nearest all behave differently depending on what they think the exercise is for, which is why accident investigation training is usually aimed at the wider group rather than the investigator alone.
The Six-Step Investigation Process
The sequence matters more than the paperwork. Most credible methodologies reduce to the same six steps and apply to every incident, not only those that hurt someone. SafeWork NSW puts that plainly: all unsafe work is serious, whether an injury occurs or not, and every incident must be recorded and investigated.
- Make the scene safe and preserve it: Stop the work, control the hazard, and leave the scene undisturbed where it is safe to do so.
- Gather evidence while it is still perishable: Photographs, equipment settings, maintenance logs, rosters, training records and the physical items involved.
- Interview individually and early: Memories converge quickly once people compare accounts, so separate conversations produce better information than a group debrief.
- Build the factual sequence: A timeline of what happened, with opinion and causation stripped out entirely.
- Analyse causes with a named method: Pick the method deliberately rather than defaulting to whichever template is on the shared drive.
- Assign, verify and close corrective actions: Each with a single owner, a date, and a test of whether it worked.
The order is deliberate. Analysis before the factual sequence is complete produces a conclusion that the evidence then gets fitted around.
Choosing a Root Cause Method That Fits the Incident
Method choice is the step organisations skip, and it is the step that decides whether the analysis is any good. Simple incidents with a single causal chain need a simple method. Incidents involving several contributing conditions need a built-in solution.
A useful filter: if you can describe the event in one sentence without the word “and”, a linear method will probably hold. If you cannot, use something that handles parallel causes.
The Five Whys, and Where It Breaks Down
The Five Whys asks why repeatedly until the chain reaches something structural. It is quick, requires no training, and works well for equipment failures and process breakdowns, with one obvious thread.
It has two well-known weaknesses. It produces a single chain, so genuinely parallel causes get dropped. And it tends to end with human error, because “why did the operator do that?” is a comfortable place for a tired investigator to stop.
The discipline that fixes both is a rule that no answer naming a person may be the final one.
Fishbone and ICAM for Incidents With Multiple Causes
A fishbone diagram, sometimes called a cause-and-effect or Ishikawa diagram, forces breadth by sorting contributing factors into categories: people, process, equipment, environment, materials and management. Its value is that empty categories become visible, which prompts the question nobody asked.
ICAM, the Incident Cause Analysis Method, is widely used across Australian resources, construction, and utilities work, and it goes a step further. It sorts findings into absent or failed defences, individual or team actions, task or environmental conditions, and organisational factors.
The structure is deliberately weighted. A finding about an individual action sits alongside the conditions and organisational factors that shaped it, which makes a purely person-centred conclusion hard to sustain.
ICAM also supplies its own collection framework, PEEPO, covering people, environment, equipment, procedures and organisation. Gathering against those five headings before any analysis starts is what stops the investigation from arriving at the categories with only the evidence that suits them.
For a serious incident, or any incident likely to attract a regulator’s attention, a structured method such as ICAM is worth the extra hours. Investigation competence is itself trainable, and organisations that run these analyses regularly tend to invest in formal incident investigation training rather than relying on whoever is senior that day.
What an Incident Report Template Must Capture
A report template is not a formality. It is the mechanism that stops an investigation by quietly omitting the inconvenient parts. At a minimum, it should capture:
- Identifiers: date, time and precise location, who reported it and when.
- Classification: injury, illness, near miss, property damage, environmental, and whether the event is notifiable to a regulator.
- People: those involved, those affected, and witnesses, including contractors and visitors.
- Factual sequence: what happened, in order, without opinion or attribution.
- Immediate actions: what was done to make the situation safe, and when.
- Evidence register: what was collected, by whom, and where it is held.
- Contributing conditions: the task, environmental and equipment factors present.
- Causes, by named method: which method was used, and what it found.
- Corrective actions: each with one owner, a due date, and the level of control it represents.
- Effectiveness verification: how you will know the action worked, and the date that was confirmed.
- Sign-off: who reviewed and accepted the findings.
Two fields do most of the work. The notifiability assessment, because the window for notifying a regulator is short and missing it is its own offence in many jurisdictions. And the effectiveness verification, because without it, a closed action means only that somebody said it was done.
Turning Findings Into Corrective Actions That Close
An action with three owners has none. An action with no date is a sentiment. Both are extremely common and visible in any action register within about thirty seconds.
Rank actions by how much they rely on a person behaving correctly. Eliminating the task, substituting the substance or engineering the hazard out will outlast any amount of instruction. Instruction and protective equipment are where you finish, not where you start.
If every corrective action from an investigation ends up on the training-and-reminder end, the investigation has not finished its job.
The Executive Questions Worth Asking After Every Serious Incident
Leaders rarely need to run investigations. They do need to know whether the ones being run are working, and five questions reveal that quickly.
- Did we investigate the near miss, or only the event that caused an injury?
- Does the corrective action change the system, or only the person?
- Who owns each action, and on what date does it close?
- Has something materially similar happened before, in another team or site?
- Would our process have surfaced this incident if nobody had been hurt?
Answering the last one honestly is usually the most informative thing a leadership team can do on this subject. An organisation that only learns from injuries is waiting for harm to improve, and the data suggest that is a slow way to get better.
