How to Investigate a Workplace Incident

What an Incident Investigation Is and When You Need One

An incident investigation is a structured look at an unplanned event to find out what happened, why it happened and what needs to change. The event might be an injury, an occupational illness, damage to equipment or property, a spill or release, or a near miss where nobody was hurt this time. The point is the same for all of them: understand the causes well enough to stop the next one.

An incident investigation is not a search for the person to blame, and it isn't a paperwork exercise to satisfy an insurer or a regulator. The UK Health and Safety Executive's guidance on investigating accidents puts it plainly: investigations that conclude operator error was the sole cause are rarely acceptable, because the root causes behind an incident are almost always management, organizational or planning failures. The US Occupational Safety and Health Administration (OSHA) makes the same point, describing the goal as fact-finding, not fault-finding.

A 2026 University of Regina report based on Association of Workers' Compensation Boards of Canada data counted 1,042 accepted work-related deaths in Canada in 2024, along with hundreds of thousands of accepted lost-time claims. Behind most serious injuries are warning signs that were missed, and a good incident investigation is how an organization learns to catch them.

So which events need an incident investigation? The law sets the minimum, and it differs across Canada, as the table further down shows. In practice, a sound program investigates:

• Every serious injury, illness or death, and every incident your jurisdiction requires you to report to the regulator.
• Injuries that need medical treatment, lost-time injuries and occupational illnesses.
• Dangerous occurrences, such as a structural collapse, a crane or equipment upset, contact with an energized line or an uncontrolled release, whether or not anyone was hurt.
• Near misses that could have caused serious harm. British Columbia, Alberta and Manitoba all require these to be investigated, and the causes are usually the same as the causes of serious injuries.
• Repeat minor events, such as the third hand laceration on the same line this month, because the pattern says something a single event doesn't.

Not every event needs the same depth. The UK Health and Safety Executive's guide sets the level of investigation by risk: a supervisor can look into a minor event with low potential, while an event that caused or could have caused serious harm calls for a team, with senior management involved. A sensible rule is to scale the investigation to the worst credible outcome, not just to what actually happened. A dropped wrench that missed someone's head deserves more attention than a paper cut.

Canada's national standard for this work is CSA Z1005:21, Workplace incident investigation, which was reaffirmed in 2026 and replaced the 2017 edition. It's a voluntary standard unless a contract, client or regulator requires it, but it's a useful benchmark for building or checking a written investigation procedure.

Who Should Be Involved

An incident investigation is only as good as the people doing it. Three qualities matter most: knowledge of the work, independence from the outcome, and the trust of the workers who'll be asked what happened.

• The supervisor of the area. They know the work, the people and the normal way things are done. They usually lead the first response and smaller investigations, but they may also have been part of the conditions that led to the incident, so they shouldn't be the only investigator on a serious event.
• A worker representative. A joint health and safety committee member or the health and safety representative brings the workers' view and makes it easier for witnesses to speak openly. In several jurisdictions, their participation is a legal requirement, not an option.
• Someone who knows the task or equipment well. A competent worker, maintenance technician, engineer or the equipment manufacturer can explain what should have happened, which is essential for understanding what did.
• A safety professional or trained investigator. Where you have one, they guide the process, keep the analysis on track and make sure the report meets legal and company requirements.
• A manager with authority to act. For serious incidents, senior management should be involved, because the root causes usually sit in decisions about resources, staffing, scheduling and priorities that only they can change.

The law spells out who takes part in some places. British Columbia requires the employer and a worker representative to take part where they're reasonably available, along with people who know the type of work. In Saskatchewan, the occupational health committee co-chairs, or their designates, carry out the investigation. Manitoba requires the committee co-chairs or their designates; where there's no committee, the employer and the representative; or, with neither, the employer and a non-management worker. Federally regulated employers must appoint a qualified person to investigate and tell the workplace committee or representative who it is.

Everyone on the team should have some investigation training. Untrained investigators tend to stop at the first plausible explanation, ask leading questions and recommend retraining for almost everything.

The First Hour: Make It Safe, Report It and Protect the Scene

What happens in the first hour largely decides how good the incident investigation can be. The order matters: people first, then the hazard, then the legal notifications, then the evidence.

Care for the injured and make the area safe. Give first aid and call emergency services as needed. Then control the hazard so nobody else gets hurt: stop the work, isolate and lock out the equipment, barricade the area or evacuate it. Every Canadian scene-preservation rule lets you act to save life and help the injured, and most also allow you to prevent further harm or protect endangered property, so never delay rescue or hazard control to preserve evidence.

Report what the law requires. Serious injuries, deaths and listed dangerous occurrences must be reported to the OHS regulator quickly, often immediately or within 24 hours, and what counts as reportable varies by jurisdiction. Alberta, for example, requires prime contractors and employers to report deaths, hospital admissions, unplanned or uncontrolled explosions, fires and floods with the potential for serious injury, crane and hoist collapses and structural failures as soon as possible.

Ontario requires a death or critical injury to be reported to an inspector, the committee and the union immediately, with a written report within 48 hours. Workers' compensation reporting is a separate obligation with its own deadlines. Keep the regulator's reporting number posted where supervisors can find it, and check your own jurisdiction's list in our OHS Legislation in Canada guide.

Protect the scene. After a serious incident, Canadian law generally prohibits disturbing the scene until the regulator gives permission. Alberta's OHS Act bars anyone from disturbing or working at the scene, or moving equipment, documents or information, unless an officer or the police direct otherwise. Ontario's OHS Act has a similar rule for deaths and critical injuries, and Manitoba requires the scene of a serious incident to be left for at least 24 hours after notice is given, unless an officer directs otherwise.

Federally, the Canada Labour Code bars anyone from disturbing the scene where an employee is killed or seriously injured without the regulator's authorization. Tape off the area, post someone at the boundary if needed and keep a record of who enters.

For incidents that don't trigger a legal hold, preserving the scene is still good practice. Photograph and record everything before anything is moved, cleaned or repaired. Evidence disappears fast: a spill gets mopped up, a damaged sling goes in the scrap bin, a ladder goes back on the truck, and the conditions that mattered are gone.

Where Canadian Law Requires an Investigation

Most Canadian jurisdictions require employers to investigate at least some incidents, and several set out who takes part, what the report must contain and how long it's kept. The table summarizes the incident investigation duties in the jurisdictions our guides focus on. Reporting deadlines and scene rules are covered above, and the full text of each law is linked in the Sources section.

Other provinces and territories set their own rules. Where no law requires an incident investigation, your own safety program, your COR or SECOR audit standard and your duty of due diligence still do. A documented investigation is often the clearest evidence that an employer took every reasonable precaution.

How a Good Investigation Fits Together

Every sound incident investigation follows the same broad shape, whatever its size. The UK Health and Safety Executive describes four stages: gather the information, analyze it, identify the risk controls and put an action plan in place. OSHA's guide for employers uses almost the same four. In practice, the work runs in a loop, because analysis often sends you back for more facts.

Match the detail in each stage to the seriousness of the event, but don't skip any of them, even for a near miss that takes 30 minutes to look into.

Gathering the Facts: The Scene, the Equipment and the Paper Trail

Start with what you can see before memories and conditions change. Good evidence comes from three places, and a sound investigation uses all of them.

The scene and the equipment. Take wide, medium and close-up photographs from several angles, with something in the frame for scale. Sketch the layout and measure distances, heights and positions that may matter, such as where the worker stood, how far a load fell or where a vehicle stopped. Note the lighting, weather, noise, temperature, housekeeping and ground conditions. Record the state of the equipment: guards, interlocks, switch positions, gauges, tags and locks. Keep damaged parts, failed slings, broken tools and torn PPE, label them and store them securely, because they may need closer examination by the manufacturer or an engineer.

The people. List everyone who was involved, who saw what happened, who arrived afterward and who may know something about the conditions beforehand, such as the previous shift. BC's Workers Compensation Act requires employers to make witnesses available and record their contact information, and that's sound practice everywhere.

The paper trail. Documents often explain why the conditions at the scene existed. Gather the job hazard analysis for the work, the day's field-level hazard assessment, safe work procedures, permits, training and competency records, inspection reports, maintenance and pre-use records, the manufacturer's instructions, shift schedules and overtime, and any earlier incidents, near misses or hazard reports involving the same task or equipment. Electronic records such as camera footage, telematics, alarm logs and equipment data loggers can be overwritten within days, so secure them early.

Collect facts without deciding what they mean yet. Forming a theory in the first hour and gathering only the evidence that supports it is a common trap, and research has a name for it: what you look for is what you find. A 2009 study in the journal Safety Science compared eight investigation manuals and found that the cause model built into each one largely decided which causes investigators found, and those causes then decided what got fixed. Keeping an open mind at the fact-gathering stage is what keeps the analysis honest later.

Interviewing Witnesses So They'll Tell You What Happened

Witness accounts are usually the richest source of information, and the most fragile. Memories fade and change quickly, and they merge with other people's versions once witnesses talk to each other. How you interview decides how much of the truth you get.

Interview early and separately. Speak with each witness as soon as they're able, ideally the same day, and one at a time so their accounts stay their own. SAFE Work Manitoba's investigation guide makes the same point. If a witness is injured or shaken, wait until they're ready, but don't let days go by without at least a short first account.

Set the right tone. Choose a quiet place near the work but away from the scene's commotion. Explain that the purpose is to understand what happened and prevent it happening again, not to discipline anyone, and mean it. A worker who thinks the conversation could cost them their job will give you the shortest, safest answer they can. Having the worker representative in the room helps.

Let them tell it their way. Start with an open request: "Tell me everything you remember, from the start of the shift, in as much detail as you can, even things that seem unimportant." Don't interrupt. Then go back over the account with open questions such as "What were you doing just before?", "What did you notice?", "How is this job normally done?" and "Was anything different today?" Avoid leading questions such as "You didn't have your lock on, did you?" that suggest the answer.

This approach draws on the cognitive interview, a technique developed for police witness interviews. A 1999 meta-analysis of 42 studies found it drew out substantially more correct detail than standard interviews, with accuracy rates almost the same. You don't need to be a trained police interviewer to use its basic ideas: rebuild the context, ask for everything, and let the witness talk.

Ask about normal, not just the day. Some of the most useful answers come from questions about how the work usually goes. "Is this how it's normally done?" and "What makes this job hard?" often reveal shortcuts that have become normal, pressure to finish, missing tools or a procedure that doesn't fit the real job. Those are the conditions behind the incident.

Record the account in the witness's own words, read it back to them, and invite them to come back if they remember more. They often do.

Building the Timeline

Once you have the facts and accounts, put them in order. A timeline sets out each event, decision and condition in sequence, from well before the incident to the response afterward, with the source of each item noted. It's the bridge between gathering facts and finding causes.

Start earlier than you think you need to. The incident may have happened at 2:15 p.m., but the story might begin at the morning toolbox talk, the previous night's maintenance or a purchasing decision six months ago. Mark the points where something could have gone differently: a missed check, a changed plan, a warning that wasn't acted on. Gaps and contradictions in the timeline show you where to go back for more information.

Finding the Causes: Immediate, Underlying and Root

This is the heart of the incident investigation, and where many fall short. Most incidents have several causes working together, and they sit at different levels. Regulators across Canada describe them in similar terms.

• Immediate causes are the unsafe acts and conditions present at the moment of the incident: a missing guard, an unlocked energy source, a wet floor, a worker standing in the line of fire.
• Underlying causes explain why those acts and conditions existed: a procedure that didn't fit the task, training that didn't cover it, equipment that wasn't maintained, supervision that wasn't there, or a hazard assessment that missed it.
• Root causes explain why the underlying causes weren't caught and corrected. WorkSafe Saskatchewan describes them as the underlying problems that set the events in motion. They usually sit in the management system: how work is planned, staffed, resourced and checked.

SAFE Work Manitoba gives a simple example. A worker trips over an electrical cord. The direct cause is the cord across the floor. The indirect causes are housekeeping, not following safe work procedures and rushing. The root cause is the design of the workspace: there weren't enough electrical outlets, so cords would keep crossing the floor until that was fixed.

Two simple tools get you most of the way. The five whys asks "why?" of each cause until you reach something the organization controls and can change. A cause diagram, often called a fishbone, sorts possible causes into categories such as people, equipment, materials, procedures, environment and management, so nothing is missed. Manitoba's guide suggests a similar set: task, material and equipment, worker, management and environment. For serious or complex events, more structured methods are worth the effort, and our article Digging Deeper: The Role of Root Cause Analysis in Workplace Safety explains them further.

Treat "human error" as the start, not the end. OSHA's guide for employers quotes the safety researcher Sidney Dekker: human error is not the conclusion of an investigation, it's the starting point. People make mistakes for reasons. If a worker skipped a step, ask why it seemed reasonable at the time. Was the step impractical? Was there time pressure? Had it been skipped many times before with no consequence? Did the supervisor know? An investigation that ends with "worker failed to follow procedure" or "worker wasn't paying attention" has usually stopped one or two layers short, and the corrective action that follows, usually a reminder or retraining, won't prevent the next one.

Test each cause before you accept it. Is it supported by the evidence? If it hadn't been present, would the incident still have happened? Can the organization change it? Causes that pass all three tests are the ones to act on.

Turning Causes into Corrective Actions

An incident investigation is only worth what it changes. Each cause you've identified, at each level, needs a corrective action that deals with it, with an owner, a priority and a due date. The investigation isn't finished until those actions are in place and working. OSHA's guide makes the same point.

Choose strong actions. Use the hierarchy of controls to test each one: eliminating the hazard or adding an engineering control is far more reliable than a new procedure, a sign or another training session. A 2017 review in BMJ Quality & Safety found that root cause investigations often settle for weaker administrative fixes such as reminders, and that only an estimated 45 to 70 percent of recommendations were ever carried out. Health care was the setting, but the pattern is familiar in any workplace.

Act on the root causes as well as the immediate ones. Replacing the damaged sling fixes this lift. Changing how rigging is inspected, who's competent to inspect it and how defective gear is removed from service fixes the next hundred lifts. Look sideways too: if the same hazard could exist on similar equipment, at other sites or in other crews, fix it there as well.

Track every action in the same log as your other corrective actions, and verify that each one works before you close it. Our guide on how to manage corrective actions covers this in detail, including how to set priorities and escalate overdue items.

Writing the Report and Sharing What You Learned

The report is the record of what happened, what you found and what's changing. Several Canadian jurisdictions set out what it must contain. Saskatchewan's regulations, for example, require a description of the incident, photographs or other evidence, the causes, the immediate corrective action and the long-term action, or the reasons none is being taken. Manitoba adds the indirect factors behind the cause. A report that covers the following will meet most requirements and serve your program well:

• who was involved and injured, and the date, time and exact location;
• a factual description of what happened, with the timeline;
• photographs, sketches, measurements and other evidence;
• the immediate, underlying and root causes, with the evidence for each;
• the immediate actions taken and the corrective actions, each with an owner, a priority and a due date;
• who investigated, including the worker representative, and the date of the report.

Write it in plain language, stick to facts and avoid judgemental words such as "careless" or "negligent". Keep medical details to what the investigation needs, and protect workers' personal information.

Then get it to the people the law says should have it. That's often the joint health and safety committee or representative, and sometimes the regulator. Alberta requires copies for a Director and the committee or representative, BC requires the reports to go to the committee or representative and the full report to WorkSafeBC within 30 days, and the federal regulations require certain reports to go to the regulator within 14 days. Keep it for the required period: at least two years in Alberta, five in Manitoba and ten for federally regulated employers.

Finally, share what you learned. A short summary, without names, of what happened, why and what's changing belongs in toolbox talks, safety meetings, the committee agenda and, where it fits, new worker orientation. When workers see that reporting leads to real fixes, they report more, and that's where the next prevention opportunity comes from.

Investigating Near Misses

A near miss is an incident where nobody was hurt, usually by luck. It has the same causes as an injury, without the cost, and that makes it the cheapest lesson you'll get. British Columbia requires investigation of incidents with the potential for serious injury, Manitoba requires investigation of occurrences that could have caused a serious incident, and Alberta requires potentially serious incidents to be investigated and reported online.

The challenge is getting near misses reported at all. A 2013 study of near-miss reporting in Denmark's offshore oil and gas sector found that companies had reporting systems but near misses were under-reported, partly from fear of blame, and that responses tended to be quick local fixes with little organizational learning. A NIOSH study of mine workers' near-miss reports found that more than half of 167 reports described high- or critical-risk situations, and that the reports could guide corrective actions when they were analyzed systematically.

So keep near-miss reporting simple, thank people for it, investigate the ones with serious potential using the same approach as an injury, and tell the reporter what changed.

Common Incident Investigation Mistakes to Avoid

• Stopping at human error. "Worker not paying attention" or "failed to follow procedure" is the start of the analysis, not the conclusion.
• Waiting too long. Evidence gets cleaned up, equipment gets repaired and memories blend within a day or two. Start the same day.
• Investigating only injuries. Near misses and dangerous occurrences share the same causes and cost nothing to learn from.
• Interviewing in a group or with a disciplinary tone. Witnesses then agree on one safe story, and the details you need disappear.
• Deciding the answer early. A theory formed in the first hour tends to steer the evidence you collect. Gather the facts first.
• Defaulting to weak fixes. Retraining, reminders and a new sign rarely change the conditions behind an incident.
• Never closing the loop. Corrective actions that aren't tracked, verified and shared leave the hazard in place and teach workers that reporting changes nothing.

Download the Investigation Form and Quick Guide

• Incident Investigation Form (PDF). A fillable form with clickable checkboxes that walks the team through the event details, evidence, witnesses, timeline, causes at each level and corrective actions, with sign-offs for the investigators and the worker representative.
• Incident Investigation Quick Guide (PDF). A two-page summary of the first hour, the investigation stages, interview tips and the cause levels, sized to keep in a vehicle or an incident investigation kit.

Adapt the form to your workplace and confirm the requirements for your own jurisdiction.

About the author

John Duplessis, B.Sc., CRSP

President and Principal Health & Safety Consultant

John Duplessis is a Canadian Registered Safety Professional with more than 30 years of occupational health and safety experience in oil and gas, construction, green energy, midstream operations and industrial project work.

Meet our team