How to Write an ISO 45001 Incident Investigation Report That Prevents Repeat Accidents

A worker is injured, the incident form says "employee failed to follow procedure," refresher training is delivered and the case is closed. Several months later, a similar incident happens because the defective system, unsuitable procedure or production pressure was never corrected.

A report prevents recurrence only when it converts reliable evidence into system-level corrective action. Writing an ISO 45001 incident investigation report that meets the standard requires structured evidence gathering, objective analysis and documented corrective action. This article shows how.

An ISO 45001 incident investigation report should include the incident details, a verified timeline, collected evidence, witness accounts, analysis of immediate and root causes, identified control failures, corrective actions with named owners and deadlines, and verification of implementation effectiveness. The report must demonstrate that investigation findings led to preventive action, not just blame.

What Does ISO 45001 Require After a Workplace Incident?

ISO 45001 Clause 10.2 establishes the requirements for incident, nonconformity and corrective action. The organisation must respond to the incident, investigate its causes, determine the necessary actions and evaluate their effectiveness.

Investigation findings must connect to risk assessments, procedures, operational controls and continual improvement. The standard requires documented information—records that prove the investigation was thorough, competent and free from bias.

Key organisational responsibilities:

• Respond promptly to protect people and isolate hazards
• Investigate causes with competent personnel
• Involve workers meaningfully in the investigation
• Document findings and corrective actions
• Verify that actions are implemented and effective
• Communicate lessons learned

ISO identifies incident investigation and continual improvement as core elements of the OH&S management system. The ILO also recommends that investigations be documented, carried out by competent people and completed with appropriate worker participation.

Incident Report vs Incident Investigation Report: What Is the Difference?

An incident form records the occurrence; an investigation report provides the evidence-based route to prevention.

How Do You Write an ISO 45001 Incident Investigation Report?

Step 1: Record the Incident and Immediate Response

Document the foundational facts:

• Date, time and exact location
• People involved (name, role, experience)
• Injury, illness, damage or near-miss classification
• Work activity underway when the incident occurred
• Emergency treatment provided
• Equipment shutdown or isolation actions
• Temporary controls implemented
• Required internal and regulatory notifications made

Immediate controls protect people now; they are not necessarily permanent corrective actions. A temporary barrier around a hazard is an immediate control. A redesigned work process is a corrective action.

Jurisdictional note: Notification deadlines and reportability rules vary by location. Verify your local requirements before finalising the report.

Step 2: Write a Verified Sequence of Events

Create an objective timeline using observable facts, not conclusions:

• What happened before the incident: Normal work patterns, changes in staffing, equipment condition
• The task being performed: What was the worker doing?
• Changes in equipment, conditions or staffing: Had anything altered from standard practice?
• The triggering event: The moment something changed
• The immediate response: What did people do to stop the harm?
• What happened after the event: Outcome of the incident and immediate controls

Writing rule: Use observable facts, not conclusions.

Weak wording: "Operator behaved carelessly."

Better wording: "The guard was open while the equipment remained energised."

Step 3: Record the Evidence and Worker Accounts

Gather and document evidence systematically:

Physical Evidence:

• Scene photographs and sketches
• CCTV or digital records
• Equipment condition and damage patterns

Documentary Evidence:

• Permits, JSA/JHA and risk assessments
• Maintenance and inspection records
• Training and competency records
• Procedures and work instructions
• Shift, staffing and production information

Witness Evidence:

• Interviews conducted promptly and respectfully
• Separate interviews (not group sessions)
• Open questions ("What did you see?") rather than leading questions
• Documented statements

HSE organises investigation around gathering information, analysing it, identifying controls and implementing an action plan.

Step 4: Separate Immediate Causes From Root Causes

Define the causal levels clearly:

Immediate Cause: The direct condition or event that triggered the incident (e.g., guard was open)

Contributing Factor: A circumstance that increased the likelihood or severity (e.g., production pressure led to rushed work)

Underlying Cause: A weakness in planning, supervision or control (e.g., inspection checklist not used)

Root Cause: A correctable system-level failure that allowed the problem to exist (e.g., inspection procedures not enforced)

Suitable analysis tools:

• Five Whys for relatively straightforward events
• Fishbone analysis for grouped contributing factors
• Timeline or causal-factor chart for multi-stage events
• Fault or event-tree analysis for complex incidents

OSHA advises investigators to go beyond the visible event because correcting only an immediate cause may remove the symptom without correcting the underlying problem.

Professionals who want to strengthen evidence collection, causal analysis and corrective-action skills can develop them through our Incident Investigation / Root Cause Analysis course.

Step 5: Identify Failed and Missing Safety Controls

Ask these critical questions during analysis:

• Which control should have prevented the incident?
• Was the hazard identified in the risk assessment?
• Was the control correctly designed and implemented?
• Was it inspected and maintained?
• Did workers understand the procedure?
• Was the procedure realistic under actual working conditions?
• Did workload, production pressure or contractor coordination affect compliance?
• Were previous warnings or near misses ignored?

Connect the findings to hazard identification, risk assessment, operational procedures, training, maintenance, supervision, procurement and management review. Weak controls reveal system-level failures.

Step 6: Develop a Corrective Action Plan

Every corrective action should include:

• Action required: Clearly defined task
• Hazard or root cause addressed: Link to analysis findings
• Responsible owner: Named individual accountable
• Target completion date: Specific deadline
• Resources required: Budget, expertise, equipment
• Priority level: Urgent, high, medium or routine
• Interim protection: Temporary controls until permanent action complete
• Evidence of completion: How will you know it's done?
• Effectiveness measure: How will you test if it works?

Use the hierarchy of controls when selecting actions.

Weak action: "Remind employees to be careful."

Stronger action: "Install an interlocked guard, revise the isolation procedure, retrain affected workers and inspect all comparable machines by [specific date]."

Step 7: Verify Corrective-Action Effectiveness

5th image

Distinguish between completion and effectiveness. Completion means the action was done. Effectiveness means the action controls the risk.

Completion evidence may include:

• Installation photograph
• Revised procedure with approval date
• Training record or attendance sheet
• Purchase or maintenance record
• Email confirmation

Effectiveness evidence may include:

• Follow-up inspection showing control is functioning
• Worker observation confirming procedure is followed
• Control-function test or safety verification
• Audit result
• Reduction in repeated near misses
• Review of similar equipment or tasks

An action should not be closed merely because it was completed; it should be closed when there is evidence that it controls the identified risk.

Step 8: Approve, Communicate and Close the Investigation

Cover these final steps:

• Investigator approval: Investigator signs off on completeness and objectivity
• Management review: Senior leader confirms findings and actions
• Worker or safety-committee consultation: Involve workforce in outcomes
• Distribution of lessons learned: Share findings across the organisation
• Updates to procedures and risk assessments: Embed learning into systems
• Review of similar sites, tasks or equipment: Check for wider hazards
• Document version control: Track all versions of the report
• Closure date: Mark when the investigation is formally complete
• Retention of supporting records: Store evidence for future reference
• Follow-up review date: Schedule effectiveness verification

Lessons should be shared without exposing unnecessary personal information. Communicate the hazard, the failed control and the corrective action—not the name of the injured or involved worker.

ISO 45001 Incident Investigation Report Checklist

Incident Identification

• Report number
• Date, time and location
• Department, project or work area
• Incident or near-miss category
• People and contractors involved

Incident Evidence

• Factual event description
• Timeline of events
• Photographs and diagrams
• Witness accounts
• Relevant procedures and records

Cause Analysis

• Immediate causes identified
• Contributing factors listed
• Failed controls documented
• Underlying causes explained
• Root causes determined
• Analysis method documented

Corrective Action and Closure

• Interim controls in place
• Permanent corrective actions defined
• Responsible owner named
• Due date and priority set
• Completion evidence collected
• Effectiveness-verification method chosen
• Lessons communicated
• Approval and closure date recorded

ISO 45001 Incident Investigation Report Example

Forklift–Pedestrian Near Miss

Incident: A reversing forklift narrowly missed a warehouse employee at a blind intersection.

Immediate cause: The operator and pedestrian could not see each other.

Weak conclusion: "The pedestrian was not paying attention."

Root-cause findings:

• No physical separation between vehicles and pedestrians
• Poor intersection visibility
• Inadequate traffic-management assessment
• Delivery schedules created congestion
• Earlier near misses were not analysed

Corrective actions:

• Install barriers and controlled crossings
• Add mirrors or detection technology
• Redesign traffic routes
• Review delivery scheduling
• Investigate previous near-miss data
• Verify effectiveness through observations and follow-up inspections

Common Incident Report Writing Mistakes

1. Blaming the injured worker: Shifts focus from system failure
2. Treating "human error" as the final cause: Stops analysis prematurely
3. Mixing assumptions with verified facts: Weakens evidence credibility
4. Failing to involve workers: Misses frontline perspective and loses trust
5. Recommending training as the only corrective action: Ignores equipment, procedure and management failures
6. Assigning actions without owners or deadlines: Actions do not get completed

OSHA incident investigation guidance explains why the investigation must examine system deficiencies rather than stop at carelessness or procedural noncompliance.

A strong ISO 45001 incident investigation report connects evidence to root causes, root causes to corrective actions and corrective actions to measurable prevention. Build the practical skills needed to investigate accidents, analyse system failures and recommend defensible corrective actions through our practical Incident Investigation / Root Cause Analysis training.