QHSE Incident Investigation: Root Cause to Closure 2026

QHSE incident investigation is how an organization turns an accident, near miss or nonconformity into a lasting improvement instead of a repeat event. ISO 45001, the occupational health and safety standard, sets the expectations in clause 10.2, and most quality, environmental and safety management systems adopt the same pattern: react, investigate, correct, check and record. The difference between a good and a poor system usually lies in the depth of the root cause analysis and in whether anyone checks that the fix worked.

This guide sets out a practical process based on the requirements for incidents, nonconformity and corrective action, as summarised by training providers. It sits alongside our guides to the QHSE management system, the hierarchy of controls and QHSE KPIs. Read the clause text in your licensed copy of the standard to confirm details.

What the standard expects from QHSE incident investigation

Summaries of ISO 45001 clause 10.2 describe five expectations. The table lists them with the evidence that typically satisfies each.

Expectation	What it means	Typical evidence
React in a timely manner	Control the situation and deal with the consequences	Incident report, first aid or containment records
Investigate causes	Find the underlying causes with worker participation, and consider whether similar events could occur elsewhere	Investigation report, interview notes, cause analysis
Take corrective action	Follow the hierarchy of controls and change management, and review risk assessments	Action plan, updated risk assessment, change records
Review effectiveness	Check over time that the action prevents recurrence	Follow-up review, monitoring data
Keep documented information	Record the event, actions and results, and communicate them to those affected	Register, reports, briefings

The stated goal is preventing recurrence across all locations, not only where the incident happened.

Step 1: react and make safe

The first hour matters. Protect people, stop further harm, secure the scene and provide medical help or environmental containment. Record the time, location and people involved, and preserve evidence such as equipment settings, photographs, samples and data logs. Notify managers and, where legally required, regulators. These reactions deal with consequences but are not corrective action. Do not stop at this step.

Step 2: decide the depth of investigation

Not every event needs the same effort. Define levels in your procedure based on actual and potential severity. A near miss with potential for a fatality deserves a full investigation, while a minor first-aid case may need a shorter review. Use a simple matrix with consequence and likelihood, and record who decides the level. Also set time limits, for example starting within 24 hours and completing within a set number of days.

Step 3: collect facts with workers

Standards summaries stress worker participation in the analysis. Interview those involved and witnesses separately, ask open questions and record what was seen and done, not opinions about blame. Review procedures, risk assessments, training records, maintenance history and previous events. Walk the scene with a worker who does the task. People closest to the work often know about shortcuts and design problems that managers never see.

Set the tone

Investigations that hunt for someone to blame teach staff to hide problems. Make it clear that the aim is to find system causes. If a person acted deliberately against a safe procedure, deal with that through your disciplinary process, separately, and continue looking for the conditions that made the shortcut attractive.

Step 4: find root causes

Use a structured method such as the five whys, a fishbone diagram or a barrier analysis. The point is to move from the immediate cause, such as a guard removed, to the underlying causes: why was it removed, why did supervision not notice, why does the task design encourage it and why did earlier audits not find the problem. Look at categories such as equipment, procedures, training, supervision, communication, workload and management decisions.

Ask whether the same problem could occur in other areas or sites. The standard summary explicitly mentions considering whether similar events have occurred elsewhere or could potentially occur.

Step 5: choose corrective actions

Corrective actions should follow the hierarchy of controls. Start by asking whether the hazard can be eliminated or substituted. Then consider engineering controls, administrative controls and, last, personal protective equipment. A retraining action alone is the weakest response, since people forget and new staff arrive. Where the action changes a process or equipment, use your change management procedure, and review the affected risk assessments for new or changed hazards.

• Give each action an owner and due date.
• State the expected effect so it can be checked later.
• Include actions for other locations where the same risk exists.
• Link actions to the risk register and objectives.

Step 6 of QHSE incident investigation: verify corrective action effectiveness

Closing an action when it is completed is not the same as closing it when it works. Schedule an effectiveness review, for example after three or six months, and decide in advance what you will look at: incident rates, audit findings, observations or worker feedback. If the problem returns, reopen the analysis. Feed results into management review, as described in our guide to QHSE management review.

Step 7: record and communicate

Record the nature of the event, the actions taken and the results, including effectiveness. Share lessons with affected workers, their representatives and other relevant parties. A one-page safety alert with a photo and three key messages is often more effective than a long report. Keep a central register so trends can be analysed. See our guide to QHSE documentation for structuring the records.

Building capability for QHSE incident investigation

A good process needs trained investigators. Give supervisors and safety representatives practical training in interviewing, evidence preservation and root cause methods, and keep a short list of people qualified to lead serious investigations. For major events, use a small team with a lead, a technical expert and a worker representative, plus a manager who can approve resources. Practise with past incidents, and ask a colleague to review each report for depth and clarity. Over time, this builds a culture where QHSE incident investigation is seen as learning, and staff are willing to report near misses.

Using data across investigations

Individual reports help, but patterns across many events show more. Classify each event by type, location, task, equipment, shift and cause category, and review the data each quarter. Look for repeated causes, such as maintenance backlogs, unclear procedures or contractor supervision. Report the trends to management and the safety committee, and use them to set objectives. Leading indicators, such as the number of near miss reports and the time taken to close actions, tell you about the health of the system, while lagging indicators, such as injury rates, tell you about its results.

Contractors and shared sites

Incidents involving contractors or shared sites need clear rules about who investigates, who reports and how findings are shared. Include these in contracts and site rules. Ask contractors to notify you promptly, and involve them in the analysis. Where several employers share a workplace, agree the responsibilities in advance so that evidence is not lost while everyone waits to find out who is in charge.

A hypothetical example

A hypothetical fabrication shop records a near miss when a pallet slips from a forklift. The supervisor stops the work, secures the area and records the event. Interviews with the driver and other operators reveal that pallets are often stacked above the recommended height because the packing station is short of space. The team finds root causes in layout, missing height markings and a lack of feedback on earlier similar events. Actions include marking stack limits, changing the layout of the packing station and adding stacking checks to the daily inspection. After three months, observations show compliance, and no further slips have occurred. The action is closed with a note on effectiveness. The example is invented for illustration.

Common findings on QHSE incident investigation

• Investigation stops at the immediate cause or at human error.
• Workers are not involved in the analysis.
• Actions rely on retraining or reminders alone.
• Effectiveness of corrective action is never checked.
• Similar hazards at other sites are ignored.
• Records are incomplete or not shared with affected workers.

The standard itself is described on the ISO 45001 page, and your certification body can explain how it audits this clause. Combine the process with internal audits, as covered in our guide to combined internal audits.

Templates for QHSE incident investigation

To avoid building incident reports, root cause worksheets and action trackers from scratch, the QHSE Documentation Bundles provide documents you can adapt. Have your safety lead check them against local law and your certification requirements.

QHSE incident investigation FAQ

Which standard sets the requirements?

ISO 45001 clause 10.2 covers incidents, nonconformity and corrective action, and quality and environmental standards have similar corrective action clauses.

Must workers take part in investigations?

Summaries of the standard say the analysis involves workers and relevant stakeholders. Build this into your procedure.

Are near misses in scope?

Yes. Near misses are incidents, and often reveal the causes of later harm most cheaply.

How do we show corrective action effectiveness?

Set a follow-up date and metrics in advance, review results and record whether the problem recurred.

Is retraining an adequate corrective action?

Rarely on its own. It sits low in the hierarchy of controls, so look for elimination, substitution or engineering solutions first.